sdd-agent-platform 0.4.2 → 0.5.1

package/node_modules/@sdd-agent-platform/core/src/context/evidence-summary.ts

@@ -1,163 +1,144 @@
-import {
-  ACCEPTANCE_POLICY_RULESET_VERSION,
-  EVIDENCE_SUMMARY_CONTRACT_VERSION,
-  SDD_EVIDENCE_CONTRACT,
-  SDD_EVIDENCE_VERSION
-} from '../contracts.js';
-import { branchToSafePartition } from '../path-safety.js';
-import { listInvocationLedgerEntries } from '../run-state/invocation-ledger.js';
-import { readRunEvents } from '../run-state/events.js';
-import { readRunState } from '../run-state/run-state.js';
-import { recordRuntimeProjection, withRuntimeStore } from '../storage/runtime-store.js';
-import { contextSourceRefForProjectPath, uniqueContextSourceRefs } from './source-refs.js';
-import type { ContextSourceRef } from './source-refs.js';
-
-type EvidenceCoverageStatus = 'PASS' | 'FAIL' | 'BLOCKED' | 'REFERENCED_ONLY' | 'MISSING';
-export type EvidenceQualityIssue = 'EMPTY_EVIDENCE' | 'TODO_PLACEHOLDER' | 'TEMPLATE_TEXT' | 'MENTION_ONLY' | 'UNSOURCED_PASS' | 'MISSING_COMMAND_OUTPUT' | 'MISSING_ARTIFACT_REFERENCE' | 'MISSING_MATERIAL_REFERENCE' | 'PROVENANCE_GAP' | 'POLICY_RULE_FAILED' | 'DERIVED_SOURCE_EVIDENCE' | 'PARTITION_SCOPE_VIOLATION';
-
-interface ContractValidationIssue {
-  field: string;
-  message: string;
-  recommendation: string;
-}
-
-interface EvidenceItem {
-  kind: string;
-  ref: string;
-  summary: string | null;
-}
-
-export interface EvidenceClaim {
-  contract: typeof SDD_EVIDENCE_CONTRACT;
-  version: typeof SDD_EVIDENCE_VERSION;
-  task: string;
-  acceptance: string;
-  status: EvidenceCoverageStatus;
-  claim: string;
-  sourceArtifact: string;
-  evidence: EvidenceItem[];
-  provenance: string[];
-  policy: string[];
-  rawMetadata: Record<string, string | string[]>;
-}
-
-export interface EvidenceSummaryProjection {
-  contract: typeof EVIDENCE_SUMMARY_CONTRACT_VERSION;
-  authoritative: false;
-  usableForPass: false;
-  runId: string;
-  taskId: string | null;
-  sources: ContextSourceRef[];
-  passCount: number;
-  blockedCount: number;
-  failCount: number;
-  issueCodes: EvidenceQualityIssue[];
-  policyRefs: string[];
-  highlights: string[];
-}
-
-export interface EvidenceSummaryOptions {
-  runId: string;
-  taskId?: string;
-}
-
-export async function buildEvidenceSummaryProjection(projectRoot: string, options: EvidenceSummaryOptions): Promise<EvidenceSummaryProjection> {
-  const state = await readRunState(projectRoot, options.runId);
-  const [events, invocationLedger] = await Promise.all([
-    readRunEvents(projectRoot, options.runId),
-    listInvocationLedgerEntries(projectRoot, options.runId)
-  ]);
-  const taskId = options.taskId ?? state.currentTask ?? state.taskId;
-  const admittedClaims = await readRuntimeEvidenceClaims(projectRoot, state.runId, taskId ?? null);
-  const artifactIngestions = Object.values(state.artifactIngestions ?? {}).filter((record) => !taskId || record.task === taskId);
-  const artifacts = state.artifacts.filter((artifact) => !taskId || artifact.task === taskId);
-  const branch = state.gitBranch ?? state.partition ?? 'unscoped';
-  const ledgerArtifactRefs = invocationLedger
-    .filter((entry) => entry.kind === 'artifact_hash' && entry.artifactPath)
-    .map((entry) => ({
-      path: stageEvidenceDisplayRefForRuntimeArtifact(branch, entry.artifactPath as string, 'artifact'),
-      kind: 'artifact' as const,
-      hash: entry.outputHash ?? null
-    }));
-  const artifactSourceRefs = artifacts.map((artifact) => ({ path: stageEvidenceDisplayRefForRuntimeArtifact(branch, artifact.path, artifact.kind), kind: 'artifact' as const }));
-  const hashedArtifactSourceRefs: ContextSourceRef[] = ledgerArtifactRefs
-    .filter((artifact): artifact is { path: string; kind: 'artifact'; hash: string } => artifact.hash !== null)
-    .map((artifact) => ({ path: artifact.path, kind: artifact.kind, hash: artifact.hash }));
-  const unresolvedArtifactSourceRefs = [
-    ...artifactSourceRefs,
-    ...ledgerArtifactRefs.filter((artifact) => artifact.hash === null).map((artifact) => ({ path: artifact.path, kind: artifact.kind }))
-  ];
-  const sources = await uniqueContextSourceRefs([
-    await contextSourceRefForProjectPath(projectRoot, `.sdd/runtime.sqlite`, 'run_state'),
-    await contextSourceRefForProjectPath(projectRoot, `.sdd/runtime.sqlite`, 'command_output'),
-    await contextSourceRefForProjectPath(projectRoot, `.sdd/runtime.sqlite`, 'ledger'),
-    ...hashedArtifactSourceRefs,
-    ...(await Promise.all(unresolvedArtifactSourceRefs.map((artifact) => contextSourceRefForProjectPath(projectRoot, artifact.path, artifact.kind))))
-  ]);
-  const issueCodes = uniqueEvidenceIssueCodes(artifactIngestions.flatMap((record) => record.issues));
-  const passCount = Math.max(admittedClaims.filter((claim) => claim.status === 'PASS').length, artifactIngestions.filter((record) => record.status === 'accepted' && (record.resultStatus === 'PASS' || record.resultStatus === 'PASS_WITH_GAPS')).length);
-  const failCount = Math.max(admittedClaims.filter((claim) => claim.status === 'FAIL').length, artifactIngestions.filter((record) => record.status === 'rejected' || record.resultStatus === 'FAIL').length);
-  const blockedCount = Math.max(admittedClaims.filter((claim) => claim.status === 'BLOCKED').length, artifactIngestions.filter((record) => record.resultStatus === 'BLOCKED' || record.resultStatus === 'TIMED_OUT' || record.resultStatus === 'CANCELLED' || record.gaps.length > 0).length);
-  const highlights = [
-    `run=${state.runId} status=${state.status} phase=${state.phase ?? 'none'}`,
-    `task=${taskId ?? 'none'} validation=${state.validation.status}`,
-    `stage_evidence_refs=${artifacts.length} ingestions=${artifactIngestions.length} admitted_claims=${admittedClaims.length} events=${events.length} ledger=${invocationLedger.length}`,
-    `pass=${passCount} blocked=${blockedCount} fail=${failCount}`
-  ];
-  if (issueCodes.length > 0) {
-    highlights.push(`issues=${issueCodes.join(',')}`);
-  }
-  const projection: EvidenceSummaryProjection = {
-    contract: EVIDENCE_SUMMARY_CONTRACT_VERSION,
-    authoritative: false,
-    usableForPass: false,
-    runId: state.runId,
-    taskId: taskId ?? null,
-    sources,
-    passCount,
-    blockedCount,
-    failCount,
-    issueCodes,
-    policyRefs: [
-      `${ACCEPTANCE_POLICY_RULESET_VERSION}:require-source-evidence`,
-      `${ACCEPTANCE_POLICY_RULESET_VERSION}:require-provenance`,
-      `${ACCEPTANCE_POLICY_RULESET_VERSION}:reject-derived-source-evidence`
-    ],
-    highlights
-  };
-  await recordRuntimeProjection(projectRoot, 'evidence_summary', `${state.runId}:${taskId ?? 'all'}`, projection);
-  return projection;
-}
-
-function stageEvidenceDisplayRefForRuntimeArtifact(branch: string, artifactPath: string, kind: string): string {
-  const portablePath = artifactPath.replace(/\\/g, '/').replace(/^\.\//, '');
-  if (portablePath.startsWith('.sdd/runs/')) {
-    return portablePath;
-  }
-  const fileName = portablePath.split('/').filter(Boolean).pop() ?? 'evidence.md';
-  const stage = kind === 'validation' || kind === 'test-validation' || fileName.startsWith('validation-') || fileName.startsWith('test-validation-') ? 'test' : 'do';
-  return `.sdd/runs/${branchToSafePartition(branch)}/${stage}/${fileName}`;
-}
-
-export async function readRuntimeEvidenceClaims(projectRoot: string, runId: string, taskId: string | null): Promise<EvidenceClaim[]> {
-  return withRuntimeStore(projectRoot, ({ db }) => {
-    const rows = taskId
-      ? db.prepare('SELECT c.payload_json FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND c.task_id = ? AND (c.partition IS NULL OR r.partition IS NULL OR c.partition = r.partition) ORDER BY c.created_at ASC, c.claim_id ASC').all(runId, taskId)
-      : db.prepare('SELECT c.payload_json FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND (c.partition IS NULL OR r.partition IS NULL OR c.partition = r.partition) ORDER BY c.created_at ASC, c.claim_id ASC').all(runId);
-    return (rows as Array<{ payload_json: string }>).map((row) => JSON.parse(row.payload_json) as EvidenceClaim);
-  });
-}
-
-export async function hasRuntimeEvidenceScopeViolation(projectRoot: string, runId: string, taskId: string | null): Promise<boolean> {
-  return withRuntimeStore(projectRoot, ({ db }) => {
-    const row = taskId
-      ? db.prepare('SELECT COUNT(*) AS count FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND c.task_id = ? AND c.partition IS NOT NULL AND r.partition IS NOT NULL AND c.partition <> r.partition').get(runId, taskId)
-      : db.prepare('SELECT COUNT(*) AS count FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND c.partition IS NOT NULL AND r.partition IS NOT NULL AND c.partition <> r.partition').get(runId);
-    return ((row as { count?: number } | undefined)?.count ?? 0) > 0;
-  });
-}
-
-export function uniqueEvidenceIssueCodes(issues: ContractValidationIssue[]): EvidenceQualityIssue[] {
-  const known: EvidenceQualityIssue[] = ['EMPTY_EVIDENCE', 'TODO_PLACEHOLDER', 'TEMPLATE_TEXT', 'MENTION_ONLY', 'UNSOURCED_PASS', 'MISSING_COMMAND_OUTPUT', 'MISSING_ARTIFACT_REFERENCE', 'MISSING_MATERIAL_REFERENCE', 'PROVENANCE_GAP', 'POLICY_RULE_FAILED', 'DERIVED_SOURCE_EVIDENCE', 'PARTITION_SCOPE_VIOLATION'];
-  return known.filter((code) => issues.some((issue) => issue.message.includes(code)));
-}
+import {
+  ACCEPTANCE_POLICY_RULESET_VERSION,
+  EVIDENCE_SUMMARY_CONTRACT_VERSION,
+  SDD_EVIDENCE_CONTRACT,
+  SDD_EVIDENCE_VERSION
+} from '../contracts.js';
+import { branchToSafePartition } from '../path-safety.js';
+import { listInvocationLedgerEntries } from '../run-state/invocation-ledger.js';
+import { readRunEvents } from '../run-state/events.js';
+import { readRunState } from '../run-state/run-state.js';
+import { recordRuntimeProjection, withRuntimeStore } from '../storage/runtime-store.js';
+import { contextSourceRefForProjectPath, uniqueContextSourceRefs } from './source-refs.js';
+import type { ContextSourceRef } from './source-refs.js';
+
+type EvidenceCoverageStatus = 'PASS' | 'FAIL' | 'BLOCKED' | 'REFERENCED_ONLY' | 'MISSING';
+export type EvidenceQualityIssue = 'EMPTY_EVIDENCE' | 'TODO_PLACEHOLDER' | 'TEMPLATE_TEXT' | 'MENTION_ONLY' | 'UNSOURCED_PASS' | 'MISSING_COMMAND_OUTPUT' | 'MISSING_ARTIFACT_REFERENCE' | 'MISSING_MATERIAL_REFERENCE' | 'PROVENANCE_GAP' | 'POLICY_RULE_FAILED' | 'DERIVED_SOURCE_EVIDENCE' | 'PARTITION_SCOPE_VIOLATION';
+
+interface ContractValidationIssue {
+  field: string;
+  message: string;
+  recommendation: string;
+}
+
+interface EvidenceItem {
+  kind: string;
+  ref: string;
+  summary: string | null;
+}
+
+export interface EvidenceClaim {
+  contract: typeof SDD_EVIDENCE_CONTRACT;
+  version: typeof SDD_EVIDENCE_VERSION;
+  task: string;
+  acceptance: string;
+  status: EvidenceCoverageStatus;
+  claim: string;
+  sourceArtifact: string;
+  evidence: EvidenceItem[];
+  provenance: string[];
+  policy: string[];
+  rawMetadata: Record<string, string | string[]>;
+}
+
+export interface EvidenceSummaryProjection {
+  contract: typeof EVIDENCE_SUMMARY_CONTRACT_VERSION;
+  authoritative: false;
+  usableForPass: false;
+  runId: string;
+  taskId: string | null;
+  sources: ContextSourceRef[];
+  passCount: number;
+  blockedCount: number;
+  failCount: number;
+  issueCodes: EvidenceQualityIssue[];
+  policyRefs: string[];
+  highlights: string[];
+}
+
+export interface EvidenceSummaryOptions {
+  runId: string;
+  taskId?: string;
+}
+
+export async function buildEvidenceSummaryProjection(projectRoot: string, options: EvidenceSummaryOptions): Promise<EvidenceSummaryProjection> {
+  const state = await readRunState(projectRoot, options.runId);
+  const [events, invocationLedger] = await Promise.all([
+    readRunEvents(projectRoot, options.runId),
+    listInvocationLedgerEntries(projectRoot, options.runId)
+  ]);
+  const taskId = options.taskId ?? state.currentTask ?? state.taskId;
+  const admittedClaims = await readRuntimeEvidenceClaims(projectRoot, state.runId, taskId ?? null);
+  const artifactIngestions = Object.values(state.artifactIngestions ?? {}).filter((record) => !taskId || record.task === taskId);
+  const artifacts = state.artifacts.filter((artifact) => !taskId || artifact.task === taskId);
+  const ledgerArtifactRefs = invocationLedger
+    .filter((entry) => entry.kind === 'artifact_hash' && entry.artifactPath)
+    .map((entry) => ({ path: entry.artifactPath as string, kind: 'artifact' as const }));
+  const branchEvidenceRoot = `.sdd/runs/${branchToSafePartition(state.gitBranch ?? state.partition ?? 'unscoped')}/evidence`;
+  const artifactSourceRefs = [
+    ...artifacts.map((artifact) => ({ path: `${branchEvidenceRoot}/${artifact.path}`, kind: 'artifact' as const })),
+    ...ledgerArtifactRefs.map((artifact) => ({ path: `${branchEvidenceRoot}/${artifact.path}`, kind: artifact.kind }))
+  ];
+  const sources = await uniqueContextSourceRefs([
+    await contextSourceRefForProjectPath(projectRoot, `.sdd/runtime.sqlite`, 'run_state'),
+    await contextSourceRefForProjectPath(projectRoot, `.sdd/runtime.sqlite`, 'command_output'),
+    await contextSourceRefForProjectPath(projectRoot, `.sdd/runtime.sqlite`, 'ledger'),
+    ...(await Promise.all(artifactSourceRefs.map((artifact) => contextSourceRefForProjectPath(projectRoot, artifact.path, artifact.kind))))
+  ]);
+  const issueCodes = uniqueEvidenceIssueCodes(artifactIngestions.flatMap((record) => record.issues));
+  const passCount = Math.max(admittedClaims.filter((claim) => claim.status === 'PASS').length, artifactIngestions.filter((record) => record.status === 'accepted' && (record.resultStatus === 'PASS' || record.resultStatus === 'PASS_WITH_GAPS')).length);
+  const failCount = Math.max(admittedClaims.filter((claim) => claim.status === 'FAIL').length, artifactIngestions.filter((record) => record.status === 'rejected' || record.resultStatus === 'FAIL').length);
+  const blockedCount = Math.max(admittedClaims.filter((claim) => claim.status === 'BLOCKED').length, artifactIngestions.filter((record) => record.resultStatus === 'BLOCKED' || record.resultStatus === 'TIMED_OUT' || record.resultStatus === 'CANCELLED' || record.gaps.length > 0).length);
+  const highlights = [
+    `run=${state.runId} status=${state.status} phase=${state.phase ?? 'none'}`,
+    `task=${taskId ?? 'none'} validation=${state.validation.status} sync_back=${state.syncBack.status}`,
+    `artifacts=${artifacts.length} ingestions=${artifactIngestions.length} admitted_claims=${admittedClaims.length} events=${events.length} ledger=${invocationLedger.length}`,
+    `pass=${passCount} blocked=${blockedCount} fail=${failCount}`
+  ];
+  if (issueCodes.length > 0) {
+    highlights.push(`issues=${issueCodes.join(',')}`);
+  }
+  const projection: EvidenceSummaryProjection = {
+    contract: EVIDENCE_SUMMARY_CONTRACT_VERSION,
+    authoritative: false,
+    usableForPass: false,
+    runId: state.runId,
+    taskId: taskId ?? null,
+    sources,
+    passCount,
+    blockedCount,
+    failCount,
+    issueCodes,
+    policyRefs: [
+      `${ACCEPTANCE_POLICY_RULESET_VERSION}:require-source-evidence`,
+      `${ACCEPTANCE_POLICY_RULESET_VERSION}:require-provenance`,
+      `${ACCEPTANCE_POLICY_RULESET_VERSION}:reject-derived-source-evidence`
+    ],
+    highlights
+  };
+  await recordRuntimeProjection(projectRoot, 'evidence_summary', `${state.runId}:${taskId ?? 'all'}`, projection);
+  return projection;
+}
+
+export async function readRuntimeEvidenceClaims(projectRoot: string, runId: string, taskId: string | null): Promise<EvidenceClaim[]> {
+  return withRuntimeStore(projectRoot, ({ db }) => {
+    const rows = taskId
+      ? db.prepare('SELECT c.payload_json FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND c.task_id = ? AND (c.partition IS NULL OR r.partition IS NULL OR c.partition = r.partition) ORDER BY c.created_at ASC, c.claim_id ASC').all(runId, taskId)
+      : db.prepare('SELECT c.payload_json FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND (c.partition IS NULL OR r.partition IS NULL OR c.partition = r.partition) ORDER BY c.created_at ASC, c.claim_id ASC').all(runId);
+    return (rows as Array<{ payload_json: string }>).map((row) => JSON.parse(row.payload_json) as EvidenceClaim);
+  });
+}
+
+export async function hasRuntimeEvidenceScopeViolation(projectRoot: string, runId: string, taskId: string | null): Promise<boolean> {
+  return withRuntimeStore(projectRoot, ({ db }) => {
+    const row = taskId
+      ? db.prepare('SELECT COUNT(*) AS count FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND c.task_id = ? AND c.partition IS NOT NULL AND r.partition IS NOT NULL AND c.partition <> r.partition').get(runId, taskId)
+      : db.prepare('SELECT COUNT(*) AS count FROM evidence_claims c JOIN runs r ON r.run_id = c.run_id WHERE c.run_id = ? AND c.partition IS NOT NULL AND r.partition IS NOT NULL AND c.partition <> r.partition').get(runId);
+    return ((row as { count?: number } | undefined)?.count ?? 0) > 0;
+  });
+}
+
+export function uniqueEvidenceIssueCodes(issues: ContractValidationIssue[]): EvidenceQualityIssue[] {
+  const known: EvidenceQualityIssue[] = ['EMPTY_EVIDENCE', 'TODO_PLACEHOLDER', 'TEMPLATE_TEXT', 'MENTION_ONLY', 'UNSOURCED_PASS', 'MISSING_COMMAND_OUTPUT', 'MISSING_ARTIFACT_REFERENCE', 'MISSING_MATERIAL_REFERENCE', 'PROVENANCE_GAP', 'POLICY_RULE_FAILED', 'DERIVED_SOURCE_EVIDENCE', 'PARTITION_SCOPE_VIOLATION'];
+  return known.filter((code) => issues.some((issue) => issue.message.includes(code)));
+}

package/node_modules/@sdd-agent-platform/core/src/context/log-worker.ts

@@ -1,48 +1,48 @@
-import { LOG_WORKER_SUMMARY_CONTRACT_VERSION } from '../contracts.js';
-import type { ContractValidationIssue } from '../delegation/state-machine.js';
-import type { ContextSourceRef } from './source-refs.js';
-
-export interface LogWorkerSummary {
-  contract: typeof LOG_WORKER_SUMMARY_CONTRACT_VERSION;
-  authoritative: false;
-  usableForPass: false;
-  runId: string;
-  taskId: string | null;
-  workerId: string;
-  sources: ContextSourceRef[];
-  highlights: string[];
-  forbiddenAuthority: string[];
-}
-
-export interface LogWorkerSummaryValidation {
-  valid: boolean;
-  issues: ContractValidationIssue[];
-}
-
-export function validateLogWorkerSummary(summary: LogWorkerSummary): LogWorkerSummaryValidation {
-  const issues: ContractValidationIssue[] = [];
-  const candidate = summary as LogWorkerSummary & Record<string, unknown>;
-  if (candidate.contract !== LOG_WORKER_SUMMARY_CONTRACT_VERSION) {
-    issues.push(contractIssue('contract', 'Log worker summary contract is invalid.', `Use ${LOG_WORKER_SUMMARY_CONTRACT_VERSION}.`));
-  }
-  if (candidate.authoritative !== false) {
-    issues.push(contractIssue('authoritative', 'Log worker summary must be non-authoritative.', 'Set authoritative=false and keep workflow decisions in core runtime.'));
-  }
-  if (candidate.usableForPass !== false) {
-    issues.push(contractIssue('usableForPass', 'Log worker summary cannot be used for PASS evidence.', 'Set usableForPass=false and reference source artifacts for PASS evidence.'));
-  }
-  const forbiddenAuthority = Array.isArray(candidate.forbiddenAuthority) ? candidate.forbiddenAuthority.filter((item) => typeof item === 'string') : [];
-  if (forbiddenAuthority.length > 0) {
-    issues.push(contractIssue('forbiddenAuthority', `Log worker summary claims forbidden workflow authority: ${forbiddenAuthority.join(', ')}.`, 'Remove PASS/BLOCKED/route/doctor/truth-alignment decisions from worker summaries.'));
-  }
-  for (const field of ['status', 'verdict', 'routeDecision', 'doctorVerdict', 'truthAlignmentReady']) {
-    if (field in candidate) {
-      issues.push(contractIssue(field, `Log worker summary must not expose workflow decision field ${field}.`, 'Keep decision fields in core runtime outputs only.'));
-    }
-  }
-  return { valid: issues.length === 0, issues };
-}
-
-function contractIssue(field: string, message: string, recommendation: string): ContractValidationIssue {
-  return { field, message, recommendation };
-}
+import { LOG_WORKER_SUMMARY_CONTRACT_VERSION } from '../contracts.js';
+import type { ContractValidationIssue } from '../delegation/state-machine.js';
+import type { ContextSourceRef } from './source-refs.js';
+
+export interface LogWorkerSummary {
+  contract: typeof LOG_WORKER_SUMMARY_CONTRACT_VERSION;
+  authoritative: false;
+  usableForPass: false;
+  runId: string;
+  taskId: string | null;
+  workerId: string;
+  sources: ContextSourceRef[];
+  highlights: string[];
+  forbiddenAuthority: string[];
+}
+
+export interface LogWorkerSummaryValidation {
+  valid: boolean;
+  issues: ContractValidationIssue[];
+}
+
+export function validateLogWorkerSummary(summary: LogWorkerSummary): LogWorkerSummaryValidation {
+  const issues: ContractValidationIssue[] = [];
+  const candidate = summary as LogWorkerSummary & Record<string, unknown>;
+  if (candidate.contract !== LOG_WORKER_SUMMARY_CONTRACT_VERSION) {
+    issues.push(contractIssue('contract', 'Log worker summary contract is invalid.', `Use ${LOG_WORKER_SUMMARY_CONTRACT_VERSION}.`));
+  }
+  if (candidate.authoritative !== false) {
+    issues.push(contractIssue('authoritative', 'Log worker summary must be non-authoritative.', 'Set authoritative=false and keep workflow decisions in core runtime.'));
+  }
+  if (candidate.usableForPass !== false) {
+    issues.push(contractIssue('usableForPass', 'Log worker summary cannot be used for PASS evidence.', 'Set usableForPass=false and reference source artifacts for PASS evidence.'));
+  }
+  const forbiddenAuthority = Array.isArray(candidate.forbiddenAuthority) ? candidate.forbiddenAuthority.filter((item) => typeof item === 'string') : [];
+  if (forbiddenAuthority.length > 0) {
+    issues.push(contractIssue('forbiddenAuthority', `Log worker summary claims forbidden workflow authority: ${forbiddenAuthority.join(', ')}.`, 'Remove PASS/BLOCKED/route/doctor/sync-back decisions from worker summaries.'));
+  }
+  for (const field of ['status', 'verdict', 'routeDecision', 'doctorVerdict', 'syncBackReady']) {
+    if (field in candidate) {
+      issues.push(contractIssue(field, `Log worker summary must not expose workflow decision field ${field}.`, 'Keep decision fields in core runtime outputs only.'));
+    }
+  }
+  return { valid: issues.length === 0, issues };
+}
+
+function contractIssue(field: string, message: string, recommendation: string): ContractValidationIssue {
+  return { field, message, recommendation };
+}

package/node_modules/@sdd-agent-platform/core/src/context/source-refs.ts

@@ -1,41 +1,41 @@
-import { createHash } from 'node:crypto';
-import { readFile, stat } from 'node:fs/promises';
-import path from 'node:path';
-import { exists } from '../storage/json-io.js';
-import { normalizePortablePath } from '../path-safety.js';
-
-export type ContextSourceKind = 'artifact' | 'run_state' | 'ledger' | 'document' | 'command_output' | 'derived';
-
-export interface ContextSourceRef {
-  path: string;
-  hash: string;
-  kind: ContextSourceKind;
-}
-
-export async function contextSourceRefForProjectPath(projectRoot: string, relativePath: string, kind: ContextSourceKind): Promise<ContextSourceRef> {
-  const normalized = normalizePortablePath(relativePath);
-  return contextSourceRefForAbsolutePath(projectRoot, path.join(projectRoot, normalized), kind, normalized);
-}
-
-export async function contextSourceRefForAbsolutePath(projectRoot: string, absolutePath: string, kind: ContextSourceKind, displayPath?: string): Promise<ContextSourceRef> {
-  const relativePath = displayPath ?? normalizePortablePath(path.relative(projectRoot, absolutePath));
-  if (!relativePath || relativePath.startsWith('../') || path.isAbsolute(relativePath)) {
-    return { path: normalizePortablePath(absolutePath), hash: hashDocumentContent(`external:${absolutePath}`), kind };
-  }
-  if (!await exists(absolutePath)) {
-    return { path: relativePath, hash: hashDocumentContent(`missing:${relativePath}`), kind };
-  }
-  const fileStat = await stat(absolutePath);
-  if (fileStat.isDirectory()) {
-    return { path: relativePath, hash: hashDocumentContent(`directory:${relativePath}`), kind };
-  }
-  return { path: relativePath, hash: hashDocumentContent(await readFile(absolutePath, 'utf8')), kind };
-}
-
-export function uniqueContextSourceRefs(refs: ContextSourceRef[]): ContextSourceRef[] {
-  return [...new Map(refs.map((ref) => [`${ref.kind}:${ref.path}`, ref])).values()];
-}
-
-function hashDocumentContent(raw: string): string {
-  return createHash('sha256').update(raw.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
-}
+import { createHash } from 'node:crypto';
+import { readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { exists } from '../storage/json-io.js';
+import { normalizePortablePath } from '../path-safety.js';
+
+export type ContextSourceKind = 'artifact' | 'run_state' | 'ledger' | 'document' | 'command_output' | 'derived';
+
+export interface ContextSourceRef {
+  path: string;
+  hash: string;
+  kind: ContextSourceKind;
+}
+
+export async function contextSourceRefForProjectPath(projectRoot: string, relativePath: string, kind: ContextSourceKind): Promise<ContextSourceRef> {
+  const normalized = normalizePortablePath(relativePath);
+  return contextSourceRefForAbsolutePath(projectRoot, path.join(projectRoot, normalized), kind, normalized);
+}
+
+export async function contextSourceRefForAbsolutePath(projectRoot: string, absolutePath: string, kind: ContextSourceKind, displayPath?: string): Promise<ContextSourceRef> {
+  const relativePath = displayPath ?? normalizePortablePath(path.relative(projectRoot, absolutePath));
+  if (!relativePath || relativePath.startsWith('../') || path.isAbsolute(relativePath)) {
+    return { path: normalizePortablePath(absolutePath), hash: hashDocumentContent(`external:${absolutePath}`), kind };
+  }
+  if (!await exists(absolutePath)) {
+    return { path: relativePath, hash: hashDocumentContent(`missing:${relativePath}`), kind };
+  }
+  const fileStat = await stat(absolutePath);
+  if (fileStat.isDirectory()) {
+    return { path: relativePath, hash: hashDocumentContent(`directory:${relativePath}`), kind };
+  }
+  return { path: relativePath, hash: hashDocumentContent(await readFile(absolutePath, 'utf8')), kind };
+}
+
+export function uniqueContextSourceRefs(refs: ContextSourceRef[]): ContextSourceRef[] {
+  return [...new Map(refs.map((ref) => [`${ref.kind}:${ref.path}`, ref])).values()];
+}
+
+function hashDocumentContent(raw: string): string {
+  return createHash('sha256').update(raw.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
+}

package/node_modules/@sdd-agent-platform/core/src/context-offload/contracts.ts

@@ -1,47 +1,47 @@
-import type { RuntimeConfidence, RuntimeRef, RuntimeScope } from '../contracts.js';
-import { CONTEXT_LOAD_SIGNAL_CONTRACT_VERSION, CONTEXT_OFFLOAD_DECISION_CONTRACT_VERSION, SCOPED_CONTEXT_HANDOFF_CONTRACT_VERSION } from '../contracts.js';
-
-export type ContextLoadLevel = 'normal' | 'elevated' | 'high' | 'overloaded';
-export type ContextOffloadAction = 'inline' | 'summarize' | 'dispatch-subagent' | 'block-for-curation';
-
-export interface ContextLoadSignal {
-  contract: typeof CONTEXT_LOAD_SIGNAL_CONTRACT_VERSION;
-  scope: RuntimeScope;
-  level: ContextLoadLevel;
-  score: number;
-  fileCountScore: number;
-  artifactSizeScore: number;
-  dependencyFanoutScore: number;
-  unknownImpactScore: number;
-  staleEvidenceScore: number;
-  logVolumeScore: number;
-  confidence: RuntimeConfidence;
-  inputRefs: RuntimeRef[];
-  reasons: string[];
-  generatedAt: string;
-}
-
-export interface ContextOffloadDecision {
-  contract: typeof CONTEXT_OFFLOAD_DECISION_CONTRACT_VERSION;
-  scope: RuntimeScope;
-  action: ContextOffloadAction;
-  loadSignalRef: RuntimeRef;
-  requiredBefore: 'stage-output' | 'handoff' | 'ship' | 'never';
-  inlineRefs: RuntimeRef[];
-  summarizeRefs: RuntimeRef[];
-  dispatchRefs: RuntimeRef[];
-  blockingReasons: string[];
-  generatedAt: string;
-}
-
-export interface ScopedContextHandoff {
-  contract: typeof SCOPED_CONTEXT_HANDOFF_CONTRACT_VERSION;
-  id: string;
-  scope: RuntimeScope;
-  purpose: string;
-  mustReadRefs: RuntimeRef[];
-  summaryRefs: RuntimeRef[];
-  doNotReadUnlessNeededRefs: RuntimeRef[];
-  producedFor: 'main-agent' | 'co-main-agent' | 'subagent';
-  generatedAt: string;
-}
+import type { RuntimeConfidence, RuntimeRef, RuntimeScope } from '../contracts.js';
+import { CONTEXT_LOAD_SIGNAL_CONTRACT_VERSION, CONTEXT_OFFLOAD_DECISION_CONTRACT_VERSION, SCOPED_CONTEXT_HANDOFF_CONTRACT_VERSION } from '../contracts.js';
+
+export type ContextLoadLevel = 'normal' | 'elevated' | 'high' | 'overloaded';
+export type ContextOffloadAction = 'inline' | 'summarize' | 'dispatch-subagent' | 'block-for-curation';
+
+export interface ContextLoadSignal {
+  contract: typeof CONTEXT_LOAD_SIGNAL_CONTRACT_VERSION;
+  scope: RuntimeScope;
+  level: ContextLoadLevel;
+  score: number;
+  fileCountScore: number;
+  artifactSizeScore: number;
+  dependencyFanoutScore: number;
+  unknownImpactScore: number;
+  staleEvidenceScore: number;
+  logVolumeScore: number;
+  confidence: RuntimeConfidence;
+  inputRefs: RuntimeRef[];
+  reasons: string[];
+  generatedAt: string;
+}
+
+export interface ContextOffloadDecision {
+  contract: typeof CONTEXT_OFFLOAD_DECISION_CONTRACT_VERSION;
+  scope: RuntimeScope;
+  action: ContextOffloadAction;
+  loadSignalRef: RuntimeRef;
+  requiredBefore: 'stage-output' | 'handoff' | 'sync-back' | 'ship' | 'never';
+  inlineRefs: RuntimeRef[];
+  summarizeRefs: RuntimeRef[];
+  dispatchRefs: RuntimeRef[];
+  blockingReasons: string[];
+  generatedAt: string;
+}
+
+export interface ScopedContextHandoff {
+  contract: typeof SCOPED_CONTEXT_HANDOFF_CONTRACT_VERSION;
+  id: string;
+  scope: RuntimeScope;
+  purpose: string;
+  mustReadRefs: RuntimeRef[];
+  summaryRefs: RuntimeRef[];
+  doNotReadUnlessNeededRefs: RuntimeRef[];
+  producedFor: 'main-agent' | 'co-main-agent' | 'subagent';
+  generatedAt: string;
+}