spawnfile 0.1.12 → 0.1.14

package/README.md

@@ -20,6 +20,26 @@ It's not a runtime-to-runtime translator. The compiler starts from the canonical
 
 Pairs with [**Moltnet**](https://moltnet.dev) as the first provider for `team.networks[]`, letting compiled agents share declared rooms, DMs, and history across runtimes without Spawnfile injecting its own message router.
 
+For a Simfile linked to a Spawnfile, the product entrypoint is owned by
+Simfile:
+
+```bash
+simfile run ./Simfile --view
+```
+
+That command delegates only organization lifecycle operations to Spawnfile's
+public CLI and versioned receipts. Spawnfile prepares target resources,
+deploys the organization, records the pinned Pi-bridge Moltnet identity,
+exports evidence, and cleans up; it does not carry simulation behavior or
+trigger cognition. The world reaches paused/pristine readiness first, the
+organization starts second, and one attested activation releases independent
+world ticks and organization-owned schedules. A separately manifested
+`simfile.world-decision-claim.v1` capability may extend the base world-sidecar
+ABI without changing it. See
+[`specs/ECOSYSTEM_RUNTIME_BOUNDARIES.md`](specs/ECOSYSTEM_RUNTIME_BOUNDARIES.md)
+for ownership and [`specs/TARGETS.md`](specs/TARGETS.md) for target, auth,
+Moltnet pinning, recovery, and cleanup contracts.
+
 ## Install
 
 ```bash
@@ -40,17 +60,50 @@ spawnfile compile                                # lower to runtime-native outpu
 spawnfile status .                               # read declared/compiled status
 spawnfile auth sync --profile dev --env-file .env
 spawnfile build  --tag my-agent                  # compile + docker build
+spawnfile up . --context gpu-4090 --detach       # build and run on a Docker context
+spawnfile dev up . --auth-profile dev            # detached dev loop in .spawn-dev
+spawnfile dev apply . --agent researcher         # hot-add/reload one Pi agent
+spawnfile dev activity . --agent researcher      # inspect buffered Pi activity events
 spawnfile run    --tag my-agent --auth-profile dev --detach
 spawnfile status . --live                        # inspect the detached deployment
 spawnfile publish . --tag you/my-agent:1.0.0     # compile + build + verify + push
 ```
 
-Compiled output lands under `.spawn/` by default, including a `Dockerfile`, `entrypoint.sh`, `.env.example`, and a prebuilt `container/rootfs/` tree. `spawnfile build` uses the pinned runtime artifacts from `runtimes.yaml`; it does not rebuild runtimes from source.
+Compiled output lands under `.spawn/` by default, including a `Dockerfile`, `entrypoint.sh`, `.env.example`, and a prebuilt `container/rootfs/` tree. `spawnfile build` uses the pinned runtime artifacts from `runtimes.yaml`; it does not rebuild runtimes from source. Daimon, OpenClaw, and PicoClaw use published copyable artifact images by default, so normal prompt/config edits reuse their dependency layers. To test a local runtime artifact instead, set `SPAWNFILE_DAIMON_RUNTIME_IMAGE`, `SPAWNFILE_OPENCLAW_RUNTIME_IMAGE`, or `SPAWNFILE_PICOCLAW_RUNTIME_IMAGE` to a local image tag. For `build`/`up` on a docker `--context`, Moltnet release assets are staged for that context's architecture (`amd64` or `arm64`); for local-only manual compile targeting a fixed architecture, set `SPAWNFILE_MOLTNET_TARGET_ARCH=amd64|arm64`.
+
+`spawnfile status` is read-only. By default it shows authored and compiled state without Docker, runtime, or Moltnet calls. With `--live`, it reads the selected detached deployment record, inspects the recorded Docker target, runs adapter-owned runtime probes, and checks Moltnet metadata without reading message bodies. Add `--logs` for a redacted Docker log tail, or `--watch` to refresh status continuously. For a remote Docker context where the local record is missing, pass `--context <name>` with `--live` to recover the deployment from Spawnfile container labels.
 
-`spawnfile status` is read-only. By default it shows authored and compiled state without Docker, runtime, or Moltnet calls. With `--live`, it reads the selected detached deployment record, inspects the recorded Docker target, runs adapter-owned runtime probes, and checks Moltnet metadata without reading message bodies. Add `--logs` for a redacted Docker log tail, or `--watch` to refresh status continuously.
+`spawnfile dev` is the source-backed interactive loop. It uses `.spawn-dev/` by default, starts a detached dev deployment with `spawnfile dev up`, and can hot-apply one Daimon runtime agent with `spawnfile dev apply --agent <id>` without restarting the rest of the org. Hot apply recompiles source, copies the selected agent workspace, Daimon config, matching Moltnet node configs, and managed Moltnet server configs into the running container, loads it through the Daimon control endpoint, and starts only that agent's Moltnet bridges when it is new. `spawnfile dev activity` reads the generated Daimon app's bounded activity buffer as JSON lines so operators can see queued wakes, turn starts/completions, runtime event types, output completions, and errors without mixing those diagnostics into Moltnet chat. Running managed Moltnet servers keep their current in-memory room membership until an operator-token `moltnet apply` or server restart reconciles the copied server config.
 
 Compiled images are self-describing: `spawnfile publish` pushes one to any OCI registry, and anyone can run it with no source — `spawnfile up you/my-agent:1.0.0 --deployment prod --detach --auth-profile me` — or inspect what it needs first with `spawnfile status you/my-agent:1.0.0`. See [`specs/DISTRIBUTION.md`](specs/DISTRIBUTION.md).
 
+### Target adapter CLI
+
+`spawnfile target` is the explicit, non-interactive target-adapter boundary for
+an external orchestrator. It takes one absolute request JSON file and one
+strict private configuration object on standard input — never a configuration
+path or inline configuration:
+
+```bash
+target-config-producer | spawnfile target --config - create_data_network /absolute/path/request.json
+```
+
+On success it writes exactly one canonical JSON receipt followed by a newline.
+
+For a crash-safe machine caller handoff, project-mode `up --json`, `artifacts export
+--json`, and `down --json` accept `--lifecycle-invocation lci_<stable-id>`. Spawnfile
+binds that id to the exact operation, correlation, and request policy, atomically stores
+the exact JSON bytes after the owner returns and before stdout, and rejects reuse with
+drift. `spawnfile lifecycle lookup <id>` is read-only and returns one versioned state:
+`not_applied`, `pending`, `completed`, or `ambiguous`, without Docker/provider
+inspection. Recovery only resumes an operation when that command verifies exact durable
+evidence that resumption is safe; otherwise it seals `ambiguous` and fails closed.
+It writes no secret values to output or diagnostics. The full verb list,
+request/receipt contract, and exit behavior are in [`specs/TARGETS.md`](specs/TARGETS.md).
+`target lookup_operation` accepts the original mutation request with a minimal
+read-only context config and reports `completed`, `pending`, or `not_applied`
+without calling the target provider or changing its journal.
+
 Declare external credentials in `secrets:` and provide values through an ignored env file or the shell environment. `spawnfile auth sync --env-file .env` stores declared model auth and project secrets in a local auth profile; `spawnfile run --env-file .env` can inject the same values directly for a single run. This is the intended pattern for credentials like `GH_TOKEN`, MCP tokens, and provider API keys.
 
 ## Project structure
@@ -98,8 +151,7 @@ v0.1 targets autonomous agent runtimes that share a markdown workspace identity
 |-----------|---------------|---------|-----------------------------------------------|
 | OpenClaw  | active        | ✅      | Discord, Telegram, WhatsApp, Slack            |
 | PicoClaw  | active        |         | Discord, Telegram, Slack (WhatsApp blocked)   |
-| NullClaw  | exploratory   |         | No active adapter yet                         |
-| ZeroClaw  | exploratory   |         | No active adapter yet                         |
+| Pi        | active        |         | Embedded org app, Moltnet client config       |
 | OpenFang  | exploratory   |         | No active adapter yet                         |
 | Hermes Agent | exploratory |        | No active adapter yet                         |
 | OpenCode  | exploratory   |         | No active adapter yet                         |
@@ -124,7 +176,7 @@ The source-of-truth specs live in this repo:
 - [`specs/SURFACES.md`](specs/SURFACES.md) — messaging surface model
 - [`specs/STATUS.md`](specs/STATUS.md) — static and live operational status
 - [`specs/DISTRIBUTION.md`](specs/DISTRIBUTION.md) — image distribution, publish, and sourceless run
-- [`fixtures/`](fixtures/) — canonical example projects
+- [`test/fixtures/`](test/fixtures/) — canonical example projects
 
 ## From source
 
@@ -137,16 +189,10 @@ npm run build
 npm link
 ```
 
-To clone pinned runtimes and generate reference blueprints:
-
-```bash
-npm run runtimes:sync
-```
-
 For local development without linking globally:
 
 ```bash
-npm run dev -- validate fixtures/single-agent
+npm run dev -- validate test/fixtures/single-agent
 ```
 
 ## Contributing

package/dist/audit/auditCli.d.ts

@@ -0,0 +1,19 @@
+export interface AuditCliOptions {
+    compiledOutput?: string;
+    fixtures?: string;
+    ledger?: string;
+    out?: string;
+    requiredSecret?: string[];
+}
+/**
+ * `npm run audit:generate` entry point / `tsx src/audit/auditCli.ts`. Two
+ * input modes: `--fixtures <dir>` treats one directory as BOTH the
+ * compiled-output root (`Dockerfile`/`entrypoint.sh`/`runtime/app.mjs`) and
+ * the ledger root (`*.jsonl` + `expected-denials.json`) — the shape every
+ * `src/audit/fixtures/<name>/` directory uses. `--compiled-output <dir>` /
+ * `--ledger <dir>` set them independently, for a real `spawnfile compile`
+ * output paired with a separately-located ledger capture. Prints the report
+ * JSON to stdout (or writes it to `--out <path>`), a one-line summary to
+ * stderr, and exits 1 if any check failed.
+ */
+export declare const runAuditCli: (argv: string[]) => Promise<void>;

package/dist/audit/auditCli.js

@@ -0,0 +1,63 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Command } from "commander";
+import { generateAudit } from "./generateAudit.js";
+const collectRepeatable = (value, previous) => [...previous, value];
+/**
+ * `npm run audit:generate` entry point / `tsx src/audit/auditCli.ts`. Two
+ * input modes: `--fixtures <dir>` treats one directory as BOTH the
+ * compiled-output root (`Dockerfile`/`entrypoint.sh`/`runtime/app.mjs`) and
+ * the ledger root (`*.jsonl` + `expected-denials.json`) — the shape every
+ * `src/audit/fixtures/<name>/` directory uses. `--compiled-output <dir>` /
+ * `--ledger <dir>` set them independently, for a real `spawnfile compile`
+ * output paired with a separately-located ledger capture. Prints the report
+ * JSON to stdout (or writes it to `--out <path>`), a one-line summary to
+ * stderr, and exits 1 if any check failed.
+ */
+export const runAuditCli = async (argv) => {
+    const command = new Command();
+    command
+        .name("spawnfile audit:generate")
+        .description("Generate a deterministic offline spawnfile.audit.v1 security-audit report")
+        .option("--fixtures <dir>", "Directory used as both the compiled-output and ledger root")
+        .option("--compiled-output <dir>", "Compiled-output directory (Dockerfile/entrypoint.sh/runtime/app.mjs)")
+        .option("--ledger <dir>", "Ledger directory (*.jsonl + expected-denials.json)")
+        .option("--required-secret <name>", "Required secret env var name (repeatable)", collectRepeatable, [])
+        .option("--out <path>", "Write the report JSON to this path instead of stdout");
+    await command.parseAsync(argv, { from: "user" });
+    const options = command.opts();
+    const compiledOutputDirPath = options.compiledOutput ?? options.fixtures;
+    const ledgerDirPath = options.ledger ?? options.fixtures;
+    if (!compiledOutputDirPath) {
+        throw new Error("audit:generate requires --fixtures <dir> or --compiled-output <dir>");
+    }
+    const report = await generateAudit({
+        compiledOutputDirPath,
+        ledgerDirPath,
+        requiredSecrets: options.requiredSecret
+    });
+    const json = `${JSON.stringify(report, null, 2)}\n`;
+    if (options.out) {
+        await writeFile(path.resolve(options.out), json, "utf8");
+    }
+    else {
+        process.stdout.write(json);
+    }
+    process.stderr.write(`spawnfile audit: ${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.na} n/a\n`);
+    if (report.summary.failed > 0) {
+        process.exitCode = 1;
+    }
+};
+// Only run when invoked directly (`tsx src/audit/auditCli.ts ...`), never on
+// import — this keeps `runAuditCli` safely testable in isolation. Not
+// unit-testable itself (import.meta.url never equals process.argv[1] under
+// vitest), mirroring how src/ledger/causalConformanceCli.ts's own bottom
+// bootstrap is excluded from coverage.
+/* v8 ignore start -- process entrypoint bootstrap, exercised by `npm run audit:generate` / the CLI-run validate step, not by unit tests */
+if (import.meta.url === `file://${process.argv[1]}`) {
+    runAuditCli(process.argv.slice(2)).catch((error) => {
+        process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}
+/* v8 ignore stop */

package/dist/audit/checks.d.ts

@@ -0,0 +1,100 @@
+import type { RunLedgerEvidence, StaticContainerEvidence } from "./checksShared.js";
+import type { AuditCheck } from "./types.js";
+export type { RunLedgerEvidence, StaticContainerEvidence } from "./checksShared.js";
+/**
+ * Check 1 — `causal.principals-authenticated` (run). Grounded in
+ * `runRealConformance` reporting zero issues over the ledger jsonl, and in
+ * `isAuthenticatedPrincipal` (src/ledger/principal.ts:87) rejecting a bare,
+ * literal-`anonymous`, or `system:moltnet.anonymous` principal
+ * (principal.ts:45,93). Fails on either a nonempty `issues` list (any
+ * schema/seq/payload/principal/chain problem `runRealConformance` found) or
+ * an event whose `principal_id` is not authenticated — evidence names the
+ * offending event and principal directly rather than relying on issue-
+ * message string matching.
+ */
+export declare const checkPrincipalsAuthenticated: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 2 — `causal.denied-ledger-visible` (run). Grounded in
+ * `DEFAULT_PAYLOAD_MINIMUMS` (conformance.ts:67-69) for every `*.denied`
+ * type: any such event that appears must carry its required keys. Also
+ * detects a silent drop — this fixture's `expected-denials.json` asserted a
+ * denial type occurred, but no matching `*.denied` event exists in the
+ * ledger — which fails even when every event that *is* present is well
+ * shaped.
+ *
+ * `not_applicable`, never `pass`, when there is no `expected-denials.json`
+ * manifest AND zero `*.denied` events are present in the ledger — with
+ * neither an assertion to check against nor an event to inspect, there is
+ * nothing here to actually assess (see AGENTS.md's cardinal rule: absent
+ * evidence is `not_applicable`, never `pass`). A manifest being present is
+ * enough to keep evaluating (silent-drop detection needs no observed event
+ * to fire), and any `*.denied` event that *is* present is always
+ * key-validated regardless of manifest presence.
+ */
+export declare const checkDeniedLedgerVisible: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 3 — `control.wake-fail-closed` (static). Grounded in
+ * appControlSource.ts:31-47 (B62 Option B): the operator wake endpoint must
+ * fail closed when `SPAWNFILE_PI_CONTROL_TOKEN` is unset, never treat an
+ * unset token as "auth disabled". Passes only when the compiled Pi app
+ * source references the token env, contains the verbatim fail-closed
+ * rejection text, and never bakes a literal default value for it.
+ */
+export declare const checkControlWakeFailClosed: (evidence: StaticContainerEvidence) => AuditCheck;
+/**
+ * Check 4 — `container.no-baked-secrets` (static). Grounded in
+ * containerEntrypointRender.ts:232-233: every required secret is emitted as
+ * a `require_env <name>` runtime check, never a literal value baked into the
+ * Dockerfile build layer or the entrypoint script. Passes only when every
+ * `requiredSecrets` name is `require_env`-guarded in the entrypoint AND no
+ * name is ever followed by a literal (non-`$`) assignment anywhere in the
+ * compiled Dockerfile/entrypoint text.
+ */
+export declare const checkContainerNoBakedSecrets: (evidence: StaticContainerEvidence) => AuditCheck;
+/**
+ * Check 5 — `memory.cross-scope-capability` (run). Grounded in mneme's
+ * `mneme.cap.system.v1` foreign-scope escalation capability
+ * (ecosystem/mneme/src/policy/capability.ts:28) and the
+ * `memory.write.denied` payload minimum (conformance.ts:68:
+ * `requested_scope`, `reason`). `mneme.cap.system.v1` is carried as an
+ * informational `grounding` string only — this function performs no static
+ * check against mneme's source, so the status is never driven by that
+ * literal.
+ *
+ * `not_applicable`, never `pass`, when no `memory.write.denied` event is
+ * present in the ledger: enforcement was never exercised in this run, and
+ * "nothing to violate" is not evidence the capability guard works (see
+ * AGENTS.md). When one or more denial events are present, every one must
+ * carry both `requested_scope` and `reason` to pass.
+ */
+export declare const checkMemoryCrossScopeCapability: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 6 — `network.non-member-write-denied` (run). Grounded in moltnet's
+ * `writeForbiddenError` (ecosystem/moltnet/internal/rooms/access_policy.go:23,71-72)
+ * and the `message.denied` payload minimum (conformance.ts:67: `target`,
+ * `reason`, `content_sha256`). The `writeForbiddenError` path is carried as
+ * an informational `grounding` string only — this function performs no
+ * static check against moltnet's source, so the status is never driven by
+ * that literal.
+ *
+ * `not_applicable`, never `pass`, when no `message.denied` event is present:
+ * non-member-write enforcement was never exercised in this run, which is not
+ * evidence it works (see AGENTS.md). When one or more denial events are
+ * present, every one must carry `target`, `reason`, and `content_sha256` to
+ * pass.
+ */
+export declare const checkNonMemberWriteDenied: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 7 — `provenance.signed-report` — always `not_applicable`. Report
+ * signing/provenance is deferred to B66; this audit generator has no
+ * signing input to check and must never claim it. Takes no evidence input
+ * on purpose: there is nothing yet for it to inspect.
+ */
+export declare const checkProvenanceSignedReport: () => AuditCheck;
+/**
+ * The seven check ids in the order `generateAudit.ts` assembles
+ * `AuditReport.checks` in (each check function above takes a different
+ * evidence shape, so this is a documentation/ordering list only — not a
+ * uniformly-callable array).
+ */
+export declare const AUDIT_CHECK_IDS: readonly ["causal.principals-authenticated", "causal.denied-ledger-visible", "control.wake-fail-closed", "container.no-baked-secrets", "memory.cross-scope-capability", "network.non-member-write-denied", "provenance.signed-report"];

package/dist/audit/checks.js

@@ -0,0 +1,279 @@
+// Not re-exported by src/ledger/index.js's barrel (see conformance.ts, which
+// also imports it directly from principal.js rather than through the
+// barrel); mirrored here for the same reason.
+import { isAuthenticatedPrincipal } from "../ledger/principal.js";
+import { CONTROL_TOKEN_ENV, DENIAL_MINIMUMS_BY_TYPE, escapeRegExp, FAIL_CLOSED_MARKER, literalAssignmentPattern, missingRequiredKeys, notApplicable, statusFor } from "./checksShared.js";
+/**
+ * Check 1 — `causal.principals-authenticated` (run). Grounded in
+ * `runRealConformance` reporting zero issues over the ledger jsonl, and in
+ * `isAuthenticatedPrincipal` (src/ledger/principal.ts:87) rejecting a bare,
+ * literal-`anonymous`, or `system:moltnet.anonymous` principal
+ * (principal.ts:45,93). Fails on either a nonempty `issues` list (any
+ * schema/seq/payload/principal/chain problem `runRealConformance` found) or
+ * an event whose `principal_id` is not authenticated — evidence names the
+ * offending event and principal directly rather than relying on issue-
+ * message string matching.
+ */
+export const checkPrincipalsAuthenticated = (evidence) => {
+    const id = "causal.principals-authenticated";
+    const category = "causal";
+    const severity = "critical";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const offendingPrincipals = evidence.events
+        .filter((event) => !isAuthenticatedPrincipal(event.principal_id))
+        .map((event) => ({ event_id: event.event_id, principal_id: event.principal_id }));
+    return {
+        category,
+        evidence: {
+            eventCount: evidence.eventCount,
+            issueCount: evidence.issues.length,
+            offendingPrincipals,
+            sources: evidence.sources
+        },
+        id,
+        severity,
+        status: statusFor(evidence.issues.length === 0 && offendingPrincipals.length === 0)
+    };
+};
+/**
+ * Check 2 — `causal.denied-ledger-visible` (run). Grounded in
+ * `DEFAULT_PAYLOAD_MINIMUMS` (conformance.ts:67-69) for every `*.denied`
+ * type: any such event that appears must carry its required keys. Also
+ * detects a silent drop — this fixture's `expected-denials.json` asserted a
+ * denial type occurred, but no matching `*.denied` event exists in the
+ * ledger — which fails even when every event that *is* present is well
+ * shaped.
+ *
+ * `not_applicable`, never `pass`, when there is no `expected-denials.json`
+ * manifest AND zero `*.denied` events are present in the ledger — with
+ * neither an assertion to check against nor an event to inspect, there is
+ * nothing here to actually assess (see AGENTS.md's cardinal rule: absent
+ * evidence is `not_applicable`, never `pass`). A manifest being present is
+ * enough to keep evaluating (silent-drop detection needs no observed event
+ * to fire), and any `*.denied` event that *is* present is always
+ * key-validated regardless of manifest presence.
+ */
+export const checkDeniedLedgerVisible = (evidence) => {
+    const id = "causal.denied-ledger-visible";
+    const category = "causal";
+    const severity = "high";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const presentDenials = evidence.events.filter((event) => DENIAL_MINIMUMS_BY_TYPE.has(event.type));
+    if (!evidence.manifestPresent && presentDenials.length === 0) {
+        return notApplicable(id, category, severity, "no denial events and no expected-denials manifest; cannot assess silent-drop");
+    }
+    const malformed = presentDenials
+        .map((event) => ({
+        event_id: event.event_id,
+        /* v8 ignore next -- presentDenials already filtered by DENIAL_MINIMUMS_BY_TYPE.has(event.type), so .get() always hits; defensive fallback only */
+        missingKeys: missingRequiredKeys(event, DENIAL_MINIMUMS_BY_TYPE.get(event.type) ?? []),
+        type: event.type
+    }))
+        .filter((entry) => entry.missingKeys.length > 0);
+    const presentTypes = new Set(presentDenials.map((event) => event.type));
+    const silentlyDropped = evidence.expectedDenialTypes.filter((type) => !presentTypes.has(type));
+    return {
+        category,
+        evidence: {
+            deniedEventCount: presentDenials.length,
+            expectedDenialTypes: evidence.expectedDenialTypes,
+            malformed,
+            silentlyDropped
+        },
+        id,
+        severity,
+        status: statusFor(malformed.length === 0 && silentlyDropped.length === 0)
+    };
+};
+/**
+ * Check 3 — `control.wake-fail-closed` (static). Grounded in
+ * appControlSource.ts:31-47 (B62 Option B): the operator wake endpoint must
+ * fail closed when `SPAWNFILE_PI_CONTROL_TOKEN` is unset, never treat an
+ * unset token as "auth disabled". Passes only when the compiled Pi app
+ * source references the token env, contains the verbatim fail-closed
+ * rejection text, and never bakes a literal default value for it.
+ */
+export const checkControlWakeFailClosed = (evidence) => {
+    const combined = `${evidence.dockerfile}\n${evidence.entrypoint}\n${evidence.piAppSource}`;
+    const tokenReferenced = combined.includes(CONTROL_TOKEN_ENV);
+    const failClosedMarkerFound = evidence.piAppSource.includes(FAIL_CLOSED_MARKER);
+    const bakedDefaultFound = literalAssignmentPattern(CONTROL_TOKEN_ENV).test(combined);
+    return {
+        category: "control",
+        evidence: {
+            bakedDefaultFound,
+            envSourceList: [CONTROL_TOKEN_ENV],
+            failClosedMarkerFound,
+            tokenReferenced
+        },
+        id: "control.wake-fail-closed",
+        severity: "critical",
+        status: statusFor(tokenReferenced && failClosedMarkerFound && !bakedDefaultFound)
+    };
+};
+/**
+ * Check 4 — `container.no-baked-secrets` (static). Grounded in
+ * containerEntrypointRender.ts:232-233: every required secret is emitted as
+ * a `require_env <name>` runtime check, never a literal value baked into the
+ * Dockerfile build layer or the entrypoint script. Passes only when every
+ * `requiredSecrets` name is `require_env`-guarded in the entrypoint AND no
+ * name is ever followed by a literal (non-`$`) assignment anywhere in the
+ * compiled Dockerfile/entrypoint text.
+ */
+export const checkContainerNoBakedSecrets = (evidence) => {
+    const combined = `${evidence.dockerfile}\n${evidence.entrypoint}`;
+    const missingRequireEnv = evidence.requiredSecrets.filter((name) => !new RegExp(`require_env\\s+['"]${escapeRegExp(name)}['"]`, "u").test(evidence.entrypoint));
+    const bakedLiteralValues = evidence.requiredSecrets.filter((name) => literalAssignmentPattern(name).test(combined));
+    return {
+        category: "container",
+        evidence: {
+            bakedLiteralValues,
+            missingRequireEnv,
+            requiredSecrets: evidence.requiredSecrets
+        },
+        id: "container.no-baked-secrets",
+        severity: "critical",
+        status: statusFor(missingRequireEnv.length === 0 && bakedLiteralValues.length === 0)
+    };
+};
+/**
+ * Check 5 — `memory.cross-scope-capability` (run). Grounded in mneme's
+ * `mneme.cap.system.v1` foreign-scope escalation capability
+ * (ecosystem/mneme/src/policy/capability.ts:28) and the
+ * `memory.write.denied` payload minimum (conformance.ts:68:
+ * `requested_scope`, `reason`). `mneme.cap.system.v1` is carried as an
+ * informational `grounding` string only — this function performs no static
+ * check against mneme's source, so the status is never driven by that
+ * literal.
+ *
+ * `not_applicable`, never `pass`, when no `memory.write.denied` event is
+ * present in the ledger: enforcement was never exercised in this run, and
+ * "nothing to violate" is not evidence the capability guard works (see
+ * AGENTS.md). When one or more denial events are present, every one must
+ * carry both `requested_scope` and `reason` to pass.
+ */
+export const checkMemoryCrossScopeCapability = (evidence) => {
+    const id = "memory.cross-scope-capability";
+    const category = "memory";
+    const severity = "high";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const denials = evidence.events.filter((event) => event.type === "memory.write.denied");
+    if (denials.length === 0) {
+        return {
+            category,
+            evidence: {
+                deniedEventCount: 0,
+                reason: "no memory.write.denied events observed; cross-scope enforcement was not exercised in this run"
+            },
+            id,
+            severity,
+            status: "not_applicable"
+        };
+    }
+    /* v8 ignore next -- "memory.write.denied" is always in DEFAULT_PAYLOAD_MINIMUMS (conformance.ts:68); defensive fallback only */
+    const requiredKeys = DENIAL_MINIMUMS_BY_TYPE.get("memory.write.denied") ?? [];
+    const malformed = denials
+        .map((event) => ({
+        event_id: event.event_id,
+        missingKeys: missingRequiredKeys(event, requiredKeys),
+        requested_scope: event.payload.requested_scope,
+        reason: event.payload.reason
+    }))
+        .filter((entry) => entry.missingKeys.length > 0);
+    return {
+        category,
+        evidence: {
+            deniedEventCount: denials.length,
+            grounding: "mneme.cap.system.v1",
+            malformed
+        },
+        id,
+        severity,
+        status: statusFor(malformed.length === 0)
+    };
+};
+/**
+ * Check 6 — `network.non-member-write-denied` (run). Grounded in moltnet's
+ * `writeForbiddenError` (ecosystem/moltnet/internal/rooms/access_policy.go:23,71-72)
+ * and the `message.denied` payload minimum (conformance.ts:67: `target`,
+ * `reason`, `content_sha256`). The `writeForbiddenError` path is carried as
+ * an informational `grounding` string only — this function performs no
+ * static check against moltnet's source, so the status is never driven by
+ * that literal.
+ *
+ * `not_applicable`, never `pass`, when no `message.denied` event is present:
+ * non-member-write enforcement was never exercised in this run, which is not
+ * evidence it works (see AGENTS.md). When one or more denial events are
+ * present, every one must carry `target`, `reason`, and `content_sha256` to
+ * pass.
+ */
+export const checkNonMemberWriteDenied = (evidence) => {
+    const id = "network.non-member-write-denied";
+    const category = "network";
+    const severity = "high";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const denials = evidence.events.filter((event) => event.type === "message.denied");
+    if (denials.length === 0) {
+        return {
+            category,
+            evidence: {
+                deniedEventCount: 0,
+                reason: "no message.denied events observed; non-member write enforcement was not exercised in this run"
+            },
+            id,
+            severity,
+            status: "not_applicable"
+        };
+    }
+    /* v8 ignore next -- "message.denied" is always in DEFAULT_PAYLOAD_MINIMUMS (conformance.ts:67); defensive fallback only */
+    const requiredKeys = DENIAL_MINIMUMS_BY_TYPE.get("message.denied") ?? [];
+    const malformed = denials
+        .map((event) => ({
+        event_id: event.event_id,
+        missingKeys: missingRequiredKeys(event, requiredKeys),
+        target: event.payload.target,
+        reason: event.payload.reason
+    }))
+        .filter((entry) => entry.missingKeys.length > 0);
+    return {
+        category,
+        evidence: {
+            deniedEventCount: denials.length,
+            grounding: "ecosystem/moltnet/internal/rooms/access_policy.go writeForbiddenError",
+            malformed
+        },
+        id,
+        severity,
+        status: statusFor(malformed.length === 0)
+    };
+};
+/**
+ * Check 7 — `provenance.signed-report` — always `not_applicable`. Report
+ * signing/provenance is deferred to B66; this audit generator has no
+ * signing input to check and must never claim it. Takes no evidence input
+ * on purpose: there is nothing yet for it to inspect.
+ */
+export const checkProvenanceSignedReport = () => notApplicable("provenance.signed-report", "provenance", "medium", "not yet enforced (see B66)");
+/**
+ * The seven check ids in the order `generateAudit.ts` assembles
+ * `AuditReport.checks` in (each check function above takes a different
+ * evidence shape, so this is a documentation/ordering list only — not a
+ * uniformly-callable array).
+ */
+export const AUDIT_CHECK_IDS = [
+    "causal.principals-authenticated",
+    "causal.denied-ledger-visible",
+    "control.wake-fail-closed",
+    "container.no-baked-secrets",
+    "memory.cross-scope-capability",
+    "network.non-member-write-denied",
+    "provenance.signed-report"
+];

package/dist/audit/checksShared.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Evidence input types and small pure helpers shared by every check function
+ * in checks.ts. Split out purely to keep checks.ts under the repo's 400-line
+ * cap (see /Users/apresmoi/Documents/spawnfile/CLAUDE.md) — nothing here is
+ * a different layer or a different contract, it is checks.ts's own
+ * plumbing. No I/O, same as checks.ts itself.
+ */
+import type { CausalEvent, ConformanceIssue } from "../ledger/index.js";
+import type { AuditCheck, AuditCheckCategory, AuditCheckSeverity, AuditCheckStatus } from "./types.js";
+/**
+ * Ledger evidence handed to every run-mode check (1, 2, 5, 6). Built once by
+ * `generateAudit.ts` from `runRealConformance` (offline-mode: an injected
+ * `exec` that reads fixture files instead of spawning a sibling process —
+ * see generateAudit.ts) plus the audit's own `expected-denials.json`
+ * manifest. `undefined` means "no run artifacts provided" — every run-mode
+ * check below returns `not_applicable` in that case, and never `pass`.
+ */
+export interface RunLedgerEvidence {
+    eventCount: number;
+    events: CausalEvent[];
+    /** Denial types this fixture's `expected-denials.json` asserts a `*.denied` event must exist for (silent-drop detection, check 2). */
+    expectedDenialTypes: string[];
+    /** Every schema/seq/payload-minimum/principal-grammar/chain-stitch issue `runRealConformance` reported — reused, never recomputed. */
+    issues: ConformanceIssue[];
+    /** Whether the ledger directory actually contained an `expected-denials.json` file — distinct from `expectedDenialTypes.length === 0`, which is also true for a *present-but-empty* manifest. Check 2 uses this to tell "no manifest, so silent-drop cannot be assessed" apart from "a manifest exists and asserts nothing". */
+    manifestPresent: boolean;
+    sources: string[];
+}
+/**
+ * Compiled-output evidence handed to every static check (3, 4). Plain
+ * strings, not paths — `generateAudit.ts` owns the file reads, these
+ * functions stay pure. Any file that does not exist in the compiled output
+ * directory reads as an empty string; that is itself audit-worthy (absence
+ * of proof is not proof of enforcement), never treated as not_applicable —
+ * unlike run-mode checks, the compiled-output directory is a required
+ * `generateAudit` input, never optional.
+ */
+export interface StaticContainerEvidence {
+    /** Rendered Dockerfile text (containerArtifactsRender.ts's `renderDockerfile` output shape). */
+    dockerfile: string;
+    /** Rendered entrypoint.sh text (containerEntrypointRender.ts's `renderEntrypoint` output shape). */
+    entrypoint: string;
+    /** Rendered generated Pi app source, if this compile targeted Pi (appControlSource.ts's `renderPiControlSource` output is inlined into it). Empty string if the compiled output has no such file. */
+    piAppSource: string;
+    /** Secret env var NAMES this compile declared required (containerEntrypointRender.ts's `renderEntrypoint(runtimePlans, requiredSecrets, ...)` second argument) — never the values. */
+    requiredSecrets: string[];
+}
+export declare const notApplicable: (id: string, category: AuditCheckCategory, severity: AuditCheckSeverity, reason: string) => AuditCheck;
+export declare const statusFor: (ok: boolean) => AuditCheckStatus;
+/** `conformance.ts`'s `checkPayloadMinimums` is not exported (it is that module's private helper); this is the same one-line key-presence rule applied directly to already-parsed events, not a reimplementation of `validateConformanceSources`'s schema/seq/stitch pipeline. */
+export declare const missingRequiredKeys: (event: CausalEvent, requiredKeys: string[]) => string[];
+export declare const DENIAL_MINIMUMS_BY_TYPE: Map<string, string[]>;
+/** Env name gating the operator-only wake endpoint (appControlSource.ts:45, `CONTROL_TOKEN_ENV`). */
+export declare const CONTROL_TOKEN_ENV = "SPAWNFILE_PI_CONTROL_TOKEN";
+/**
+ * Verbatim source-text substring of appControlSource.ts:75's fail-closed
+ * rejection branch (`return { ok: false, reason: "no operator token
+ * configured (" + CONTROL_TOKEN_ENV + " is unset)" }`). The literal string
+ * checked here is only the first concatenated chunk — the source
+ * concatenates `CONTROL_TOKEN_ENV` in with `+`, so the fully-assembled
+ * runtime message never appears as one literal in the source text itself.
+ * Its presence is direct evidence the fail-closed branch was actually
+ * emitted, not paraphrased.
+ */
+export declare const FAIL_CLOSED_MARKER = "no operator token configured (";
+export declare const escapeRegExp: (value: string) => string;
+/**
+ * Matches a literal (non-`$`-expansion) shell/Dockerfile assignment
+ * `NAME=<value>` — never a `require_env 'NAME'` call (no `=` follows the
+ * name there at all) and never a same-name passthrough reference like
+ * `NAME="$NAME"`/`NAME=${NAME}` (an optional quote followed by `$`), both of
+ * which read the env rather than bake a value into it.
+ */
+export declare const literalAssignmentPattern: (name: string) => RegExp;