soturail 1.2.0 → 1.5.0

package/dist/core/context-pack.js

@@ -5,6 +5,9 @@ import { getCurrentGitCommit } from "./git.js";
 import { listMcpResources } from "./mcp-resources.js";
 import { readSkills } from "./skill-store.js";
 import { listWorkflows } from "./workflow-store.js";
+import { createSharedContextArtifact } from "./context-artifact.js";
+import { createWorkspaceFingerprint } from "./workspace-fingerprint.js";
+import { artifactStore } from "./artifact-store.js";
 export const contextTargets = ["claude", "codex", "gemini", "cursor", "antigravity", "generic"];
 export async function buildAllContextPacks(root = process.cwd(), options = {}) {
     const results = [];
@@ -17,10 +20,11 @@ export async function buildContextPack(target, root = process.cwd(), options = {
     await ensureWorkspace(root);
     const paths = getWorkspacePaths(root);
     const now = options.now ?? new Date().toISOString();
+    const config = await loadConfig(root);
     const sections = [
         ["Static SotuRail Header", staticHeader(target)],
         ["Governance Files Summary", await governanceSummary(root)],
-        ["Project Config", JSON.stringify(await loadConfig(root), null, 2)],
+        ["Project Config", JSON.stringify(config, null, 2)],
         ["Repo Map Summary", await readOptional(path.join(paths.indexesDir, "repo-map.json"), "No repo map found. Run soturail index.")],
         ["Approved Rules", await readOptional(paths.rulesFile, "No approved rules found.")],
         ["Approved Specs", await approvedSpecs(root)],
@@ -29,7 +33,12 @@ export async function buildContextPack(target, root = process.cwd(), options = {
         ["Workflow Summary", await workflowSummary(root)],
         ["MCP Resource List", await mcpResourceSummary()]
     ];
-    const stable = sections.map(([title, content]) => `## ${title}\n\n${content.trim()}\n`).join("\n");
+    const stableItems = sections.map(([title, content], index) => ({
+        id: title.toLowerCase().replace(/[^a-z0-9]+/g, "-"),
+        content: `## ${title}\n\n${content.trim()}\n`,
+        priority: 900 - index * 50,
+        classification: index <= 2 || title === "Approved Rules" ? "LOSSLESS_ONLY" : "COMPRESSIBLE"
+    }));
     const dynamic = [
         "<!-- soturail:dynamic-footer -->",
         "## Dynamic Footer",
@@ -40,11 +49,14 @@ export async function buildContextPack(target, root = process.cwd(), options = {
         "last_commands: dynamic local session state is intentionally kept after stable blocks",
         ""
     ].join("\n");
-    const payload = `${stable}\n${dynamic}`;
+    const workspace = await createWorkspaceFingerprint(root);
+    const artifact = createSharedContextArtifact([...stableItems, { id: "dynamic-footer", content: dynamic, priority: 1000, classification: "LOSSLESS_ONLY" }], workspace, { maxBytes: options.maxBytes ?? config.context.max_bytes, maxTokens: options.maxTokens ?? config.context.max_tokens });
+    const payload = artifact.payload;
+    const stable = payload.split("<!-- soturail:dynamic-footer -->")[0]?.trimEnd() ?? payload;
     const filePath = path.join(paths.contextDir, `${target}-context.md`);
-    await fs.mkdir(paths.contextDir, { recursive: true });
-    await fs.writeFile(filePath, payload, "utf8");
-    return { target, path: filePath, payload, stablePrefix: stable };
+    await artifactStore.writeText(filePath, payload);
+    await artifactStore.writeJson(path.join(paths.contextDir, `${target}-context.artifact.json`), artifact);
+    return { target, path: filePath, payload, stablePrefix: stable, artifact };
 }
 export async function contextDoctor(root = process.cwd()) {
     await ensureWorkspace(root);
@@ -54,7 +66,8 @@ export async function contextDoctor(root = process.cwd()) {
         "SotuRail context doctor",
         "stable_order: header, governance, config, repo_map, approved_rules, approved_specs, approved_memory, skills, dynamic_footer",
         `context_dir: ${path.normalize(path.relative(root, paths.contextDir))}`,
-        `existing_packs: ${existing.length}`
+        `existing_packs: ${existing.length}`,
+        "hard_budget: enabled"
     ].join("\n") + "\n";
 }
 export function explainContextPacks() {

package/dist/core/context-pack.js.map

@@ -1 +1 @@
-{"version":3,"file":"context-pack.js","sourceRoot":"","sources":["../../src/core/context-pack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAepD,MAAM,CAAC,MAAM,cAAc,GAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAEjH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,UAA8B,EAAE;IAC/F,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,EACpB,UAA8B,EAAE;IAEhC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG;QACf,CAAC,wBAAwB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,0BAA0B,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,kBAAkB,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAChI,CAAC,gBAAgB,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACnF,CAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,iBAAiB,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,kBAAkB,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,mBAAmB,EAAE,MAAM,kBAAkB,EAAE,CAAC;KACzC,CAAC;IACX,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG;QACd,kCAAkC;QAClC,mBAAmB;QACnB,EAAE;QACF,iBAAiB,GAAG,EAAE;QACtB,eAAe,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE;QAC7D,0EAA0E;QAC1E,sFAAsF;QACtF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACtD,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,yBAAyB;QACzB,6HAA6H;QAC7H,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE;QACvE,mBAAmB,QAAQ,CAAC,MAAM,EAAE;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,yEAAyE;QACzE,4KAA4K;QAC5K,2FAA2F;KAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,4BAA4B,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAuE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjI,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAuE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzJ,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClG,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1H,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnG,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,QAAgB;IAC5D,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,wBAAwB;QACxB,WAAW,MAAM,EAAE;QACnB,0FAA0F;QAC1F,mFAAmF;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"context-pack.js","sourceRoot":"","sources":["../../src/core/context-pack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAA8B,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBpD,MAAM,CAAC,MAAM,cAAc,GAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAEjH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,UAA8B,EAAE;IAC/F,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,EACpB,UAA8B,EAAE;IAEhC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG;QACf,CAAC,wBAAwB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,0BAA0B,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC,kBAAkB,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAChI,CAAC,gBAAgB,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACnF,CAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,iBAAiB,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,kBAAkB,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,mBAAmB,EAAE,MAAM,kBAAkB,EAAE,CAAC;KACzC,CAAC;IACX,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;QACnD,OAAO,EAAE,MAAM,KAAK,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI;QAC7C,QAAQ,EAAE,GAAG,GAAG,KAAK,GAAG,EAAE;QAC1B,cAAc,EAAE,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,eAAwB,CAAC,CAAC,CAAC,cAAuB;KAC9G,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG;QACd,kCAAkC;QAClC,mBAAmB;QACnB,EAAE;QACF,iBAAiB,GAAG,EAAE;QACtB,eAAe,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE;QAC7D,0EAA0E;QAC1E,sFAAsF;QACtF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,CAAC,GAAG,WAAW,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,EAC7G,SAAS,EACT,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CACtH,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC;IACrE,MAAM,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,MAAM,wBAAwB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACtD,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,yBAAyB;QACzB,6HAA6H;QAC7H,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE;QACvE,mBAAmB,QAAQ,CAAC,MAAM,EAAE;QACpC,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,yEAAyE;QACzE,4KAA4K;QAC5K,2FAA2F;KAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,4BAA4B,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAuE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjI,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAuE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzJ,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClG,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1H,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnG,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,QAAgB;IAC5D,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,wBAAwB;QACxB,WAAW,MAAM,EAAE;QACnB,0FAA0F;QAC1F,mFAAmF;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/core/evidence-provenance.d.ts

@@ -0,0 +1,48 @@
+import { type WorkspaceFingerprint } from "./workspace-fingerprint.js";
+export type EvidenceStatus = "verified" | "unverified" | "blocked" | "inferred" | "stale";
+export interface ProvenanceEvidence {
+    schemaVersion: "soturail.evidence.provenance.v1";
+    id: string;
+    createdAt: string;
+    status: EvidenceStatus;
+    freshness: "current" | "stale" | "unknown";
+    workspace: WorkspaceFingerprint;
+    filesRead: Array<{
+        path: string;
+        status: EvidenceStatus;
+        source: string;
+    }>;
+    filesChanged: Array<{
+        path: string;
+        status: EvidenceStatus;
+        source: string;
+    }>;
+    checks: Array<{
+        command: string;
+        exitCode: number;
+        status: EvidenceStatus;
+        rawId: string;
+    }>;
+    reportsGenerated: Array<{
+        path: string;
+        status: EvidenceStatus;
+    }>;
+    blockers: string[];
+    sourcePaths: string[];
+    warnings: string[];
+    nextCommands: string[];
+}
+export declare function collectEvidence(root?: string): Promise<{
+    dir: string;
+    evidence: ProvenanceEvidence;
+}>;
+export declare function verifyEvidence(root?: string): Promise<{
+    dir: string;
+    evidence: ProvenanceEvidence;
+}>;
+export declare function reportEvidence(root?: string): Promise<{
+    dir: string;
+    evidence: ProvenanceEvidence;
+    report: string;
+}>;
+export declare function renderEvidenceReport(evidence: ProvenanceEvidence): string;

package/dist/core/evidence-provenance.js

@@ -0,0 +1,150 @@
+import { execFile } from "node:child_process";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+import { ensureWorkspace, getWorkspacePaths, readJsonl, relativeToRoot, writeJson } from "./config.js";
+import { makeRailId, redactProbableSecrets } from "./rail-utils.js";
+import { createWorkspaceFingerprint } from "./workspace-fingerprint.js";
+import { createArtifactEnvelope } from "./artifact-envelope.js";
+import { artifactStore } from "./artifact-store.js";
+import { SOTURAIL_VERSION } from "./version.js";
+const execFileAsync = promisify(execFile);
+export async function collectEvidence(root = process.cwd()) {
+    await ensureWorkspace(root);
+    const paths = getWorkspacePaths(root);
+    const workspace = await createWorkspaceFingerprint(root);
+    const id = makeRailId("evidence", root);
+    const dir = path.join(paths.evidenceDir, id);
+    await fs.mkdir(dir, { recursive: true });
+    const changed = await gitChangedFiles(root);
+    const knowledgeSources = await readKnowledgeSources(paths.knowledgeDir);
+    const raw = await readJsonl(paths.rawIndex);
+    const checks = raw.slice(-20).filter((record) => looksLikeCheck(record.command)).map((record) => ({
+        command: redactProbableSecrets(record.command),
+        exitCode: record.exit_code,
+        status: record.exit_code === 0 ? "verified" : "blocked",
+        rawId: record.raw_id
+    }));
+    const reportsGenerated = await listReports(paths.reportsDir, root);
+    const blockers = checks.filter((check) => check.status === "blocked").map((check) => `${check.command} exited ${check.exitCode}`);
+    const evidence = {
+        schemaVersion: "soturail.evidence.provenance.v1",
+        id,
+        createdAt: new Date().toISOString(),
+        status: blockers.length > 0 ? "blocked" : checks.length > 0 ? "verified" : "unverified",
+        freshness: "current",
+        workspace,
+        filesRead: knowledgeSources.map((source) => ({ path: source, status: "inferred", source: "knowledge source-map" })),
+        filesChanged: changed.map((file) => ({ path: file, status: "verified", source: "git status --short" })),
+        checks,
+        reportsGenerated,
+        blockers,
+        sourcePaths: [...new Set([...knowledgeSources, ...changed, ...reportsGenerated.map((report) => report.path)])],
+        warnings: checks.length === 0 ? ["No locally recorded verification checks were found; status remains unverified."] : [],
+        nextCommands: ["soturail evidence verify", "soturail evidence report"]
+    };
+    await writeEvidenceArtifacts(dir, evidence);
+    return { dir, evidence };
+}
+export async function verifyEvidence(root = process.cwd()) {
+    const latest = await latestEvidence(root);
+    if (!latest)
+        throw new Error("No evidence run found. Run: soturail evidence collect");
+    const missing = [];
+    const currentWorkspace = await createWorkspaceFingerprint(root);
+    for (const source of latest.evidence.sourcePaths)
+        if (!await exists(path.resolve(root, source)))
+            missing.push(source);
+    const persistentBlockers = latest.evidence.blockers.filter((blocker) => !blocker.startsWith("Workspace fingerprint changed:"));
+    const workspaceChanged = !latest.evidence.workspace?.fingerprint || latest.evidence.workspace.fingerprint !== currentWorkspace.fingerprint;
+    latest.evidence.blockers = [...new Set([
+            ...persistentBlockers,
+            ...missing.map((source) => `Missing source: ${source}`),
+            ...(workspaceChanged ? [`Workspace fingerprint changed: ${latest.evidence.workspace?.fingerprint ?? "UNAVAILABLE"} -> ${currentWorkspace.fingerprint}`] : [])
+        ])];
+    latest.evidence.freshness = workspaceChanged ? "stale" : "current";
+    latest.evidence.warnings = latest.evidence.warnings.filter((warning) => !warning.startsWith("Evidence verification"));
+    latest.evidence.warnings.push(`Evidence verification inspected ${latest.evidence.sourcePaths.length} local source paths without running commands.`);
+    latest.evidence.status = workspaceChanged
+        ? "stale"
+        : latest.evidence.blockers.length > 0
+            ? "blocked"
+            : latest.evidence.checks.some((check) => check.status === "verified")
+                ? "verified"
+                : latest.evidence.sourcePaths.length > 0 ? "inferred" : "unverified";
+    await writeEvidenceArtifacts(latest.dir, latest.evidence);
+    return latest;
+}
+export async function reportEvidence(root = process.cwd()) {
+    const latest = await latestEvidence(root);
+    if (!latest)
+        throw new Error("No evidence run found. Run: soturail evidence collect");
+    const report = renderEvidenceReport(latest.evidence);
+    await artifactStore.writeText(path.join(latest.dir, "report.md"), report);
+    await artifactStore.writeText(path.join(latest.dir, "provenance.md"), renderProvenance(latest.evidence));
+    return { ...latest, report };
+}
+export function renderEvidenceReport(evidence) {
+    return [`# Evidence Report ${evidence.id}`, "", `Status: **${evidence.status}**`, `Freshness: **${evidence.freshness}**`, `Workspace fingerprint: \`${evidence.workspace?.fingerprint ?? "UNAVAILABLE"}\``, "", "## Files Read", ...(evidence.filesRead.length ? evidence.filesRead.map((item) => `- [${item.status}] \`${item.path}\` (${item.source})`) : ["- none recorded"]), "", "## Files Changed", ...(evidence.filesChanged.length ? evidence.filesChanged.map((item) => `- [${item.status}] \`${item.path}\` (${item.source})`) : ["- none detected"]), "", "## Checks Referenced", ...(evidence.checks.length ? evidence.checks.map((item) => `- [${item.status}] \`${item.command}\` exit=${item.exitCode} raw=${item.rawId}`) : ["- none recorded"]), "", "## Known Blockers", ...(evidence.blockers.length ? evidence.blockers.map((item) => `- ${item}`) : ["- none"]), "", "## Warnings", ...(evidence.warnings.length ? evidence.warnings.map((item) => `- ${item}`) : ["- none"]), "", "No unsupported verification is claimed. Missing proof remains unverified, inferred, stale or blocked.", ""].join("\n");
+}
+async function latestEvidence(root) {
+    const base = getWorkspacePaths(root).evidenceDir;
+    const entries = (await fs.readdir(base, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+    const latest = entries.at(-1);
+    if (!latest)
+        return null;
+    const dir = path.join(base, latest);
+    return { dir, evidence: JSON.parse(await fs.readFile(path.join(dir, "evidence.json"), "utf8")) };
+}
+async function writeEvidenceArtifacts(dir, evidence) {
+    await writeJson(path.join(dir, "evidence.json"), evidence);
+    await artifactStore.writeText(path.join(dir, "report.md"), renderEvidenceReport(evidence));
+    await artifactStore.writeText(path.join(dir, "provenance.md"), renderProvenance(evidence));
+    const envelope = await createArtifactEnvelope({
+        artifactType: "evidence",
+        artifactId: evidence.id,
+        producer: "soturail.evidence",
+        producerVersion: SOTURAIL_VERSION,
+        payload: evidence,
+        workspace: evidence.workspace,
+        status: evidence.status === "verified" ? "verified" : evidence.status === "blocked" ? "blocked" : "unverified"
+    });
+    envelope.freshness = evidence.freshness;
+    await writeJson(path.join(dir, "envelope.json"), envelope);
+}
+function renderProvenance(evidence) {
+    return [`# Provenance ${evidence.id}`, "", `- schemaVersion: ${evidence.schemaVersion}`, `- createdAt: ${evidence.createdAt}`, `- status: ${evidence.status}`, `- freshness: ${evidence.freshness}`, `- workspaceFingerprint: ${evidence.workspace?.fingerprint ?? "UNAVAILABLE"}`, "- collection: local artifacts and read-only git status only", "- commands executed by evidence verification: none", "", "## Source Paths", ...(evidence.sourcePaths.length ? evidence.sourcePaths.map((source) => `- \`${source}\``) : ["- none"]), ""].join("\n");
+}
+async function gitChangedFiles(root) {
+    try {
+        const { stdout } = await execFileAsync("git", ["status", "--short"], { cwd: root, timeout: 5000, windowsHide: true });
+        return stdout.split(/\r?\n/).filter(Boolean).map((line) => line.slice(3).trim().replace(/\\/g, "/")).filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+async function readKnowledgeSources(dir) {
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const sources = new Set();
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const map = await fs.readFile(path.join(dir, entry.name, "source-map.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => null);
+        for (const source of map?.sources ?? [])
+            if (source.path)
+                sources.add(source.path);
+    }
+    return [...sources].sort();
+}
+async function listReports(dir, root) {
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    return entries.filter((entry) => entry.isFile() && /\.(json|md|html)$/i.test(entry.name)).slice(-20).map((entry) => ({ path: relativeToRoot(root, path.join(dir, entry.name)).replace(/\\/g, "/"), status: "inferred" }));
+}
+function looksLikeCheck(command) {
+    return /\b(test|typecheck|build|lint|audit|check|verify|vitest|tsc)\b/i.test(command);
+}
+async function exists(file) {
+    return fs.access(file).then(() => true).catch(() => false);
+}
+//# sourceMappingURL=evidence-provenance.js.map

package/dist/core/evidence-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-provenance.js","sourceRoot":"","sources":["../../src/core/evidence-provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvG,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAA6B,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAoB1C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACxD,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAe,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,MAAM,EAAE,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,SAAkB;QACzE,KAAK,EAAE,MAAM,CAAC,MAAM;KACrB,CAAC,CAAC,CAAC;IACJ,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClI,MAAM,QAAQ,GAAuB;QACnC,aAAa,EAAE,iCAAiC;QAChD,EAAE;QACF,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;QACvF,SAAS,EAAE,SAAS;QACpB,SAAS;QACT,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnH,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACvG,MAAM;QACN,gBAAgB;QAChB,QAAQ;QACR,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB,EAAE,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9G,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,CAAC,EAAE;QACvH,YAAY,EAAE,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;KACvE,CAAC;IACF,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACtF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW;QAAE,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtH,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAC/H,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,KAAK,gBAAgB,CAAC,WAAW,CAAC;IAC3I,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YACrC,GAAG,kBAAkB;YACrB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,EAAE,CAAC;YACvD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,kCAAkC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,IAAI,aAAa,OAAO,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9J,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACtH,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,+CAA+C,CAAC,CAAC;IACpJ,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,gBAAgB;QACvC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;gBACnE,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;IACzE,MAAM,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzG,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC/D,OAAO,CAAC,qBAAqB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,QAAQ,CAAC,MAAM,IAAI,EAAE,gBAAgB,QAAQ,CAAC,SAAS,IAAI,EAAE,4BAA4B,QAAQ,CAAC,SAAS,EAAE,WAAW,IAAI,aAAa,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,OAAO,WAAW,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,uGAAuG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClkC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3J,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAuB,EAAE,CAAC;AACzH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,QAA4B;IAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;QAC5C,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,eAAe,EAAE,gBAAgB;QACjC,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;KAC/G,CAAC,CAAC;IACH,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACxC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,OAAO,CAAC,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,oBAAoB,QAAQ,CAAC,aAAa,EAAE,EAAE,gBAAgB,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,QAAQ,CAAC,MAAM,EAAE,EAAE,gBAAgB,QAAQ,CAAC,SAAS,EAAE,EAAE,2BAA2B,QAAQ,CAAC,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,EAAE,6DAA6D,EAAE,oDAAoD,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1hB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAW;IAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QACnC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChL,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE;YAAE,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,CAAC,CAAC,CAAC;AACrO,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,gEAAgE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/dist/core/execution-envelope.d.ts

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { type CapabilityEpoch } from "./capability-registry.js";
+import type { ChangeContract } from "./change-contract.js";
+import type { GovernanceVerdict } from "./governance.js";
+export declare const ExecutionEnvelopeSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"soturail.execution-envelope.v1">;
+    id: z.ZodString;
+    runId: z.ZodString;
+    phase: z.ZodEnum<{
+        review: "review";
+        release: "release";
+        plan: "plan";
+        implement: "implement";
+    }>;
+    actor: z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+            agent: "agent";
+            human: "human";
+            automation: "automation";
+        }>;
+    }, z.core.$strip>;
+    action: z.ZodObject<{
+        capability: z.ZodString;
+        payloadDigest: z.ZodString;
+    }, z.core.$strip>;
+    workspaceFingerprint: z.ZodString;
+    contract: z.ZodObject<{
+        id: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strip>;
+    governance: z.ZodObject<{
+        verdict: z.ZodEnum<{
+            unavailable: "unavailable";
+            allow: "allow";
+            deny: "deny";
+        }>;
+        policyDigest: z.ZodString;
+    }, z.core.$strip>;
+    capabilityEpoch: z.ZodString;
+    issuedAt: z.ZodString;
+}, z.core.$strip>;
+export type ExecutionEnvelope = z.infer<typeof ExecutionEnvelopeSchema>;
+export declare function digestPayload(payload: unknown): string;
+export declare function createExecutionEnvelope(input: {
+    runId: string;
+    phase: CapabilityEpoch["phase"];
+    actor: ExecutionEnvelope["actor"];
+    capability: string;
+    payload: unknown;
+    workspaceFingerprint: string;
+    contract: ChangeContract;
+    governance: GovernanceVerdict;
+    epoch?: CapabilityEpoch;
+}): ExecutionEnvelope;
+export declare function verifyExecutionEnvelope(envelope: ExecutionEnvelope, executedPayload: unknown): {
+    valid: boolean;
+    status: "ATTESTED" | "NOT_ATTESTED";
+    reason: string;
+};

package/dist/core/execution-envelope.js

@@ -0,0 +1,52 @@
+import { createHash, randomUUID } from "node:crypto";
+import { z } from "zod";
+import { createCapabilityEpoch } from "./capability-registry.js";
+import { changeContractDigest } from "./change-contract.js";
+export const ExecutionEnvelopeSchema = z.object({
+    schemaVersion: z.literal("soturail.execution-envelope.v1"),
+    id: z.string().min(1),
+    runId: z.string().min(1),
+    phase: z.enum(["plan", "implement", "review", "release"]),
+    actor: z.object({ id: z.string().min(1), type: z.enum(["human", "agent", "automation"]) }),
+    action: z.object({ capability: z.string().min(1), payloadDigest: z.string().regex(/^[a-f0-9]{64}$/i) }),
+    workspaceFingerprint: z.string().min(1),
+    contract: z.object({ id: z.string().min(1), digest: z.string().regex(/^[a-f0-9]{64}$/i) }),
+    governance: z.object({ verdict: z.enum(["allow", "deny", "unavailable"]), policyDigest: z.string().min(1) }),
+    capabilityEpoch: z.string().min(1),
+    issuedAt: z.string().datetime()
+});
+export function digestPayload(payload) {
+    return createHash("sha256").update(canonicalJson(payload)).digest("hex");
+}
+export function createExecutionEnvelope(input) {
+    const epoch = input.epoch ?? createCapabilityEpoch(input.phase);
+    return ExecutionEnvelopeSchema.parse({
+        schemaVersion: "soturail.execution-envelope.v1",
+        id: `act-${randomUUID()}`,
+        runId: input.runId,
+        phase: input.phase,
+        actor: input.actor,
+        action: { capability: input.capability, payloadDigest: digestPayload(input.payload) },
+        workspaceFingerprint: input.workspaceFingerprint,
+        contract: { id: input.contract.id, digest: changeContractDigest(input.contract) },
+        governance: { verdict: input.governance.verdict, policyDigest: input.governance.policyDigest },
+        capabilityEpoch: epoch.id,
+        issuedAt: new Date().toISOString()
+    });
+}
+export function verifyExecutionEnvelope(envelope, executedPayload) {
+    if (envelope.governance.verdict !== "allow")
+        return { valid: false, status: "NOT_ATTESTED", reason: `Governance verdict is ${envelope.governance.verdict}.` };
+    const executedDigest = digestPayload(executedPayload);
+    if (executedDigest !== envelope.action.payloadDigest)
+        return { valid: false, status: "NOT_ATTESTED", reason: "Evaluated payload digest does not match executed payload digest." };
+    return { valid: true, status: "ATTESTED", reason: "Governance allowed the exact executed payload digest." };
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=execution-envelope.js.map

package/dist/core/execution-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-envelope.js","sourceRoot":"","sources":["../../src/core/execution-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAwB,MAAM,0BAA0B,CAAC;AAEvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;IAC1D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACvG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC1F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAUvC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,uBAAuB,CAAC,KAAK,CAAC;QACnC,aAAa,EAAE,gCAAgC;QAC/C,EAAE,EAAE,OAAO,UAAU,EAAE,EAAE;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QACrF,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QACjF,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE;QAC9F,eAAe,EAAE,KAAK,CAAC,EAAE;QACzB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA2B,EAAE,eAAwB;IAC3F,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,yBAAyB,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,EAAE,CAAC;IAC9J,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,QAAQ,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAClL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9N,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/core/governance.d.ts

@@ -0,0 +1,50 @@
+export type GovernanceVerdictValue = "allow" | "deny" | "unavailable";
+export interface GovernanceSnapshot {
+    actor: {
+        id: string;
+        type: "human" | "agent" | "automation";
+    };
+    capability: string;
+    workspaceFingerprint: string;
+    approval: "approved" | "rejected" | "not-required" | "missing";
+    payloadDigest: string;
+}
+export interface GovernanceVerdict {
+    schemaVersion: "soturail.governance.verdict.v1";
+    provider: string;
+    point: string;
+    verdict: GovernanceVerdictValue;
+    reasons: string[];
+    policyDigest: string;
+    evaluatedAt: string;
+}
+export interface ProviderHealth {
+    provider: string;
+    status: "ready" | "degraded" | "unavailable";
+    details: string[];
+}
+export interface ValidationResult {
+    valid: boolean;
+    findings: string[];
+}
+export interface GovernanceProvider {
+    readonly id: string;
+    evaluate(point: string, snapshot: GovernanceSnapshot): Promise<GovernanceVerdict>;
+    validate(): Promise<ValidationResult>;
+    health(): Promise<ProviderHealth>;
+    capabilities(): Promise<string[]>;
+}
+export declare class NativeMinimalGovernanceProvider implements GovernanceProvider {
+    readonly id = "native-minimal";
+    evaluate(point: string, snapshot: GovernanceSnapshot): Promise<GovernanceVerdict>;
+    validate(): Promise<ValidationResult>;
+    health(): Promise<ProviderHealth>;
+    capabilities(): Promise<string[]>;
+}
+export declare class AgtAcsGovernanceProvider implements GovernanceProvider {
+    readonly id = "agt-acs";
+    evaluate(point: string): Promise<GovernanceVerdict>;
+    validate(): Promise<ValidationResult>;
+    health(): Promise<ProviderHealth>;
+    capabilities(): Promise<string[]>;
+}

package/dist/core/governance.js

@@ -0,0 +1,69 @@
+import { createHash } from "node:crypto";
+import { CAPABILITY_REGISTRY, capabilityRegistryDigest, getCapabilityDefinition } from "./capability-registry.js";
+export class NativeMinimalGovernanceProvider {
+    id = "native-minimal";
+    async evaluate(point, snapshot) {
+        const capability = getCapabilityDefinition(snapshot.capability);
+        const reasons = [];
+        if (!capability)
+            reasons.push(`Unknown capability: ${snapshot.capability}`);
+        if (!snapshot.actor.id)
+            reasons.push("Actor identity is required.");
+        if (!/^[a-f0-9]{64}$/i.test(snapshot.payloadDigest))
+            reasons.push("Payload digest must be SHA-256.");
+        if (!snapshot.workspaceFingerprint)
+            reasons.push("Workspace fingerprint is required.");
+        if (capability?.approvalRequired && snapshot.approval !== "approved")
+            reasons.push("Explicit approval is required for this capability.");
+        if (snapshot.approval === "rejected")
+            reasons.push("Approval was explicitly rejected.");
+        return verdict(this.id, point, reasons.length === 0 ? "allow" : "deny", reasons.length ? reasons : ["Native deterministic authority policy passed."]);
+    }
+    async validate() {
+        const duplicateIds = capabilitiesWithDuplicates();
+        return { valid: duplicateIds.length === 0, findings: duplicateIds.map((id) => `Duplicate capability id: ${id}`) };
+    }
+    async health() {
+        return { provider: this.id, status: "ready", details: ["offline", "deterministic", "no mandatory external dependency"] };
+    }
+    async capabilities() {
+        return ["authority.evaluate", "approval.enforce", "capability.validate"];
+    }
+}
+export class AgtAcsGovernanceProvider {
+    id = "agt-acs";
+    async evaluate(point) {
+        return verdict(this.id, point, "unavailable", ["AGT/ACS adapter boundary is present, but no verified upstream runtime is configured."]);
+    }
+    async validate() {
+        return { valid: false, findings: ["AGT/ACS upstream API, license and deployment configuration must be verified before activation."] };
+    }
+    async health() {
+        return { provider: this.id, status: "unavailable", details: ["optional provider", "no mandatory Microsoft dependency", "fail closed"] };
+    }
+    async capabilities() {
+        return [];
+    }
+}
+function verdict(provider, point, value, reasons) {
+    return {
+        schemaVersion: "soturail.governance.verdict.v1",
+        provider,
+        point,
+        verdict: value,
+        reasons,
+        policyDigest: createHash("sha256").update(`${provider}:${capabilityRegistryDigest()}`).digest("hex"),
+        evaluatedAt: new Date().toISOString()
+    };
+}
+function capabilitiesWithDuplicates() {
+    const ids = new Set();
+    const duplicates = new Set();
+    for (const id of CAPABILITY_REGISTRY.map((item) => item.id)) {
+        if (ids.has(id))
+            duplicates.add(id);
+        ids.add(id);
+    }
+    return [...duplicates];
+}
+//# sourceMappingURL=governance.js.map

package/dist/core/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/core/governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAyClH,MAAM,OAAO,+BAA+B;IACjC,EAAE,GAAG,gBAAgB,CAAC;IAE/B,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,QAA4B;QACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACpE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACrG,IAAI,CAAC,QAAQ,CAAC,oBAAoB;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,UAAU,EAAE,gBAAgB,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACzI,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACxF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;IACxJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,4BAA4B,EAAE,EAAE,CAAC,EAAE,CAAC;IACpH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,kCAAkC,CAAC,EAAE,CAAC;IAC3H,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,MAAM,OAAO,wBAAwB;IAC1B,EAAE,GAAG,SAAS,CAAC;IAExB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,sFAAsF,CAAC,CAAC,CAAC;IAC1I,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,gGAAgG,CAAC,EAAE,CAAC;IACxI,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,CAAC;IAC1I,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAED,SAAS,OAAO,CAAC,QAAgB,EAAE,KAAa,EAAE,KAA6B,EAAE,OAAiB;IAChG,OAAO;QACL,aAAa,EAAE,gCAAgC;QAC/C,QAAQ;QACR,KAAK;QACL,OAAO,EAAE,KAAK;QACd,OAAO;QACP,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,wBAAwB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACpG,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC"}

package/dist/core/harness-lifecycle.js

@@ -65,7 +65,7 @@ export async function auditHarnessLifecycle(root = process.cwd()) {
         ], "Record verification evidence before marking a feature done"),
         await auditFiles(root, "security-boundaries", "Security Boundaries", [
             path.join(paths.harnessDir, "scope.md")
-        ], "Review docs/security-boundaries.md and keep local safe defaults")
+        ], "Review docs/security/security-boundaries.md and keep local safe defaults")
     ];
     const passed = checks.filter((check) => check.status === "passed").length;
     const score = Math.round((passed / checks.length) * 100);