spawnfile 0.1.13 → 0.1.14

package/README.md

@@ -20,6 +20,26 @@ It's not a runtime-to-runtime translator. The compiler starts from the canonical
 
 Pairs with [**Moltnet**](https://moltnet.dev) as the first provider for `team.networks[]`, letting compiled agents share declared rooms, DMs, and history across runtimes without Spawnfile injecting its own message router.
 
+For a Simfile linked to a Spawnfile, the product entrypoint is owned by
+Simfile:
+
+```bash
+simfile run ./Simfile --view
+```
+
+That command delegates only organization lifecycle operations to Spawnfile's
+public CLI and versioned receipts. Spawnfile prepares target resources,
+deploys the organization, records the pinned Pi-bridge Moltnet identity,
+exports evidence, and cleans up; it does not carry simulation behavior or
+trigger cognition. The world reaches paused/pristine readiness first, the
+organization starts second, and one attested activation releases independent
+world ticks and organization-owned schedules. A separately manifested
+`simfile.world-decision-claim.v1` capability may extend the base world-sidecar
+ABI without changing it. See
+[`specs/ECOSYSTEM_RUNTIME_BOUNDARIES.md`](specs/ECOSYSTEM_RUNTIME_BOUNDARIES.md)
+for ownership and [`specs/TARGETS.md`](specs/TARGETS.md) for target, auth,
+Moltnet pinning, recovery, and cleanup contracts.
+
 ## Install
 
 ```bash
@@ -49,7 +69,7 @@ spawnfile status . --live                        # inspect the detached deployme
 spawnfile publish . --tag you/my-agent:1.0.0     # compile + build + verify + push
 ```
 
-Compiled output lands under `.spawn/` by default, including a `Dockerfile`, `entrypoint.sh`, `.env.example`, and a prebuilt `container/rootfs/` tree. `spawnfile build` uses the pinned runtime artifacts from `runtimes.yaml`; it does not rebuild runtimes from source. Daimon, OpenClaw, and PicoClaw use published copyable artifact images by default, so normal prompt/config edits reuse their dependency layers. To test a local runtime artifact instead, set `SPAWNFILE_DAIMON_RUNTIME_IMAGE`, `SPAWNFILE_OPENCLAW_RUNTIME_IMAGE`, or `SPAWNFILE_PICOCLAW_RUNTIME_IMAGE` to a local image tag. For Pi-heavy orgs, build a reusable runtime base with `npm run runtime:pi-base -- noopolis/spawnfile-pi-runtime:0.79.9-node24`, then set `SPAWNFILE_PI_RUNTIME_BASE_IMAGE` during `spawnfile up`. For `build`/`up` on a docker `--context`, Moltnet release assets are staged for that context's architecture (`amd64` or `arm64`); for local-only manual compile targeting a fixed architecture, set `SPAWNFILE_MOLTNET_TARGET_ARCH=amd64|arm64`.
+Compiled output lands under `.spawn/` by default, including a `Dockerfile`, `entrypoint.sh`, `.env.example`, and a prebuilt `container/rootfs/` tree. `spawnfile build` uses the pinned runtime artifacts from `runtimes.yaml`; it does not rebuild runtimes from source. Daimon, OpenClaw, and PicoClaw use published copyable artifact images by default, so normal prompt/config edits reuse their dependency layers. To test a local runtime artifact instead, set `SPAWNFILE_DAIMON_RUNTIME_IMAGE`, `SPAWNFILE_OPENCLAW_RUNTIME_IMAGE`, or `SPAWNFILE_PICOCLAW_RUNTIME_IMAGE` to a local image tag. For `build`/`up` on a docker `--context`, Moltnet release assets are staged for that context's architecture (`amd64` or `arm64`); for local-only manual compile targeting a fixed architecture, set `SPAWNFILE_MOLTNET_TARGET_ARCH=amd64|arm64`.
 
 `spawnfile status` is read-only. By default it shows authored and compiled state without Docker, runtime, or Moltnet calls. With `--live`, it reads the selected detached deployment record, inspects the recorded Docker target, runs adapter-owned runtime probes, and checks Moltnet metadata without reading message bodies. Add `--logs` for a redacted Docker log tail, or `--watch` to refresh status continuously. For a remote Docker context where the local record is missing, pass `--context <name>` with `--live` to recover the deployment from Spawnfile container labels.
 
@@ -57,6 +77,33 @@ Compiled output lands under `.spawn/` by default, including a `Dockerfile`, `ent
 
 Compiled images are self-describing: `spawnfile publish` pushes one to any OCI registry, and anyone can run it with no source — `spawnfile up you/my-agent:1.0.0 --deployment prod --detach --auth-profile me` — or inspect what it needs first with `spawnfile status you/my-agent:1.0.0`. See [`specs/DISTRIBUTION.md`](specs/DISTRIBUTION.md).
 
+### Target adapter CLI
+
+`spawnfile target` is the explicit, non-interactive target-adapter boundary for
+an external orchestrator. It takes one absolute request JSON file and one
+strict private configuration object on standard input — never a configuration
+path or inline configuration:
+
+```bash
+target-config-producer | spawnfile target --config - create_data_network /absolute/path/request.json
+```
+
+On success it writes exactly one canonical JSON receipt followed by a newline.
+
+For a crash-safe machine caller handoff, project-mode `up --json`, `artifacts export
+--json`, and `down --json` accept `--lifecycle-invocation lci_<stable-id>`. Spawnfile
+binds that id to the exact operation, correlation, and request policy, atomically stores
+the exact JSON bytes after the owner returns and before stdout, and rejects reuse with
+drift. `spawnfile lifecycle lookup <id>` is read-only and returns one versioned state:
+`not_applied`, `pending`, `completed`, or `ambiguous`, without Docker/provider
+inspection. Recovery only resumes an operation when that command verifies exact durable
+evidence that resumption is safe; otherwise it seals `ambiguous` and fails closed.
+It writes no secret values to output or diagnostics. The full verb list,
+request/receipt contract, and exit behavior are in [`specs/TARGETS.md`](specs/TARGETS.md).
+`target lookup_operation` accepts the original mutation request with a minimal
+read-only context config and reports `completed`, `pending`, or `not_applied`
+without calling the target provider or changing its journal.
+
 Declare external credentials in `secrets:` and provide values through an ignored env file or the shell environment. `spawnfile auth sync --env-file .env` stores declared model auth and project secrets in a local auth profile; `spawnfile run --env-file .env` can inject the same values directly for a single run. This is the intended pattern for credentials like `GH_TOKEN`, MCP tokens, and provider API keys.
 
 ## Project structure
@@ -105,8 +152,6 @@ v0.1 targets autonomous agent runtimes that share a markdown workspace identity
 | OpenClaw  | active        | ✅      | Discord, Telegram, WhatsApp, Slack            |
 | PicoClaw  | active        |         | Discord, Telegram, Slack (WhatsApp blocked)   |
 | Pi        | active        |         | Embedded org app, Moltnet client config       |
-| NullClaw  | exploratory   |         | No active adapter yet                         |
-| ZeroClaw  | exploratory   |         | No active adapter yet                         |
 | OpenFang  | exploratory   |         | No active adapter yet                         |
 | Hermes Agent | exploratory |        | No active adapter yet                         |
 | OpenCode  | exploratory   |         | No active adapter yet                         |
@@ -131,7 +176,7 @@ The source-of-truth specs live in this repo:
 - [`specs/SURFACES.md`](specs/SURFACES.md) — messaging surface model
 - [`specs/STATUS.md`](specs/STATUS.md) — static and live operational status
 - [`specs/DISTRIBUTION.md`](specs/DISTRIBUTION.md) — image distribution, publish, and sourceless run
-- [`fixtures/`](fixtures/) — canonical example projects
+- [`test/fixtures/`](test/fixtures/) — canonical example projects
 
 ## From source
 
@@ -144,16 +189,10 @@ npm run build
 npm link
 ```
 
-To clone pinned runtimes and generate reference blueprints:
-
-```bash
-npm run runtimes:sync
-```
-
 For local development without linking globally:
 
 ```bash
-npm run dev -- validate fixtures/single-agent
+npm run dev -- validate test/fixtures/single-agent
 ```
 
 ## Contributing

package/dist/audit/auditCli.d.ts

@@ -0,0 +1,19 @@
+export interface AuditCliOptions {
+    compiledOutput?: string;
+    fixtures?: string;
+    ledger?: string;
+    out?: string;
+    requiredSecret?: string[];
+}
+/**
+ * `npm run audit:generate` entry point / `tsx src/audit/auditCli.ts`. Two
+ * input modes: `--fixtures <dir>` treats one directory as BOTH the
+ * compiled-output root (`Dockerfile`/`entrypoint.sh`/`runtime/app.mjs`) and
+ * the ledger root (`*.jsonl` + `expected-denials.json`) — the shape every
+ * `src/audit/fixtures/<name>/` directory uses. `--compiled-output <dir>` /
+ * `--ledger <dir>` set them independently, for a real `spawnfile compile`
+ * output paired with a separately-located ledger capture. Prints the report
+ * JSON to stdout (or writes it to `--out <path>`), a one-line summary to
+ * stderr, and exits 1 if any check failed.
+ */
+export declare const runAuditCli: (argv: string[]) => Promise<void>;

package/dist/audit/auditCli.js

@@ -0,0 +1,63 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Command } from "commander";
+import { generateAudit } from "./generateAudit.js";
+const collectRepeatable = (value, previous) => [...previous, value];
+/**
+ * `npm run audit:generate` entry point / `tsx src/audit/auditCli.ts`. Two
+ * input modes: `--fixtures <dir>` treats one directory as BOTH the
+ * compiled-output root (`Dockerfile`/`entrypoint.sh`/`runtime/app.mjs`) and
+ * the ledger root (`*.jsonl` + `expected-denials.json`) — the shape every
+ * `src/audit/fixtures/<name>/` directory uses. `--compiled-output <dir>` /
+ * `--ledger <dir>` set them independently, for a real `spawnfile compile`
+ * output paired with a separately-located ledger capture. Prints the report
+ * JSON to stdout (or writes it to `--out <path>`), a one-line summary to
+ * stderr, and exits 1 if any check failed.
+ */
+export const runAuditCli = async (argv) => {
+    const command = new Command();
+    command
+        .name("spawnfile audit:generate")
+        .description("Generate a deterministic offline spawnfile.audit.v1 security-audit report")
+        .option("--fixtures <dir>", "Directory used as both the compiled-output and ledger root")
+        .option("--compiled-output <dir>", "Compiled-output directory (Dockerfile/entrypoint.sh/runtime/app.mjs)")
+        .option("--ledger <dir>", "Ledger directory (*.jsonl + expected-denials.json)")
+        .option("--required-secret <name>", "Required secret env var name (repeatable)", collectRepeatable, [])
+        .option("--out <path>", "Write the report JSON to this path instead of stdout");
+    await command.parseAsync(argv, { from: "user" });
+    const options = command.opts();
+    const compiledOutputDirPath = options.compiledOutput ?? options.fixtures;
+    const ledgerDirPath = options.ledger ?? options.fixtures;
+    if (!compiledOutputDirPath) {
+        throw new Error("audit:generate requires --fixtures <dir> or --compiled-output <dir>");
+    }
+    const report = await generateAudit({
+        compiledOutputDirPath,
+        ledgerDirPath,
+        requiredSecrets: options.requiredSecret
+    });
+    const json = `${JSON.stringify(report, null, 2)}\n`;
+    if (options.out) {
+        await writeFile(path.resolve(options.out), json, "utf8");
+    }
+    else {
+        process.stdout.write(json);
+    }
+    process.stderr.write(`spawnfile audit: ${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.na} n/a\n`);
+    if (report.summary.failed > 0) {
+        process.exitCode = 1;
+    }
+};
+// Only run when invoked directly (`tsx src/audit/auditCli.ts ...`), never on
+// import — this keeps `runAuditCli` safely testable in isolation. Not
+// unit-testable itself (import.meta.url never equals process.argv[1] under
+// vitest), mirroring how src/ledger/causalConformanceCli.ts's own bottom
+// bootstrap is excluded from coverage.
+/* v8 ignore start -- process entrypoint bootstrap, exercised by `npm run audit:generate` / the CLI-run validate step, not by unit tests */
+if (import.meta.url === `file://${process.argv[1]}`) {
+    runAuditCli(process.argv.slice(2)).catch((error) => {
+        process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}
+/* v8 ignore stop */

package/dist/audit/checks.d.ts

@@ -0,0 +1,100 @@
+import type { RunLedgerEvidence, StaticContainerEvidence } from "./checksShared.js";
+import type { AuditCheck } from "./types.js";
+export type { RunLedgerEvidence, StaticContainerEvidence } from "./checksShared.js";
+/**
+ * Check 1 — `causal.principals-authenticated` (run). Grounded in
+ * `runRealConformance` reporting zero issues over the ledger jsonl, and in
+ * `isAuthenticatedPrincipal` (src/ledger/principal.ts:87) rejecting a bare,
+ * literal-`anonymous`, or `system:moltnet.anonymous` principal
+ * (principal.ts:45,93). Fails on either a nonempty `issues` list (any
+ * schema/seq/payload/principal/chain problem `runRealConformance` found) or
+ * an event whose `principal_id` is not authenticated — evidence names the
+ * offending event and principal directly rather than relying on issue-
+ * message string matching.
+ */
+export declare const checkPrincipalsAuthenticated: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 2 — `causal.denied-ledger-visible` (run). Grounded in
+ * `DEFAULT_PAYLOAD_MINIMUMS` (conformance.ts:67-69) for every `*.denied`
+ * type: any such event that appears must carry its required keys. Also
+ * detects a silent drop — this fixture's `expected-denials.json` asserted a
+ * denial type occurred, but no matching `*.denied` event exists in the
+ * ledger — which fails even when every event that *is* present is well
+ * shaped.
+ *
+ * `not_applicable`, never `pass`, when there is no `expected-denials.json`
+ * manifest AND zero `*.denied` events are present in the ledger — with
+ * neither an assertion to check against nor an event to inspect, there is
+ * nothing here to actually assess (see AGENTS.md's cardinal rule: absent
+ * evidence is `not_applicable`, never `pass`). A manifest being present is
+ * enough to keep evaluating (silent-drop detection needs no observed event
+ * to fire), and any `*.denied` event that *is* present is always
+ * key-validated regardless of manifest presence.
+ */
+export declare const checkDeniedLedgerVisible: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 3 — `control.wake-fail-closed` (static). Grounded in
+ * appControlSource.ts:31-47 (B62 Option B): the operator wake endpoint must
+ * fail closed when `SPAWNFILE_PI_CONTROL_TOKEN` is unset, never treat an
+ * unset token as "auth disabled". Passes only when the compiled Pi app
+ * source references the token env, contains the verbatim fail-closed
+ * rejection text, and never bakes a literal default value for it.
+ */
+export declare const checkControlWakeFailClosed: (evidence: StaticContainerEvidence) => AuditCheck;
+/**
+ * Check 4 — `container.no-baked-secrets` (static). Grounded in
+ * containerEntrypointRender.ts:232-233: every required secret is emitted as
+ * a `require_env <name>` runtime check, never a literal value baked into the
+ * Dockerfile build layer or the entrypoint script. Passes only when every
+ * `requiredSecrets` name is `require_env`-guarded in the entrypoint AND no
+ * name is ever followed by a literal (non-`$`) assignment anywhere in the
+ * compiled Dockerfile/entrypoint text.
+ */
+export declare const checkContainerNoBakedSecrets: (evidence: StaticContainerEvidence) => AuditCheck;
+/**
+ * Check 5 — `memory.cross-scope-capability` (run). Grounded in mneme's
+ * `mneme.cap.system.v1` foreign-scope escalation capability
+ * (ecosystem/mneme/src/policy/capability.ts:28) and the
+ * `memory.write.denied` payload minimum (conformance.ts:68:
+ * `requested_scope`, `reason`). `mneme.cap.system.v1` is carried as an
+ * informational `grounding` string only — this function performs no static
+ * check against mneme's source, so the status is never driven by that
+ * literal.
+ *
+ * `not_applicable`, never `pass`, when no `memory.write.denied` event is
+ * present in the ledger: enforcement was never exercised in this run, and
+ * "nothing to violate" is not evidence the capability guard works (see
+ * AGENTS.md). When one or more denial events are present, every one must
+ * carry both `requested_scope` and `reason` to pass.
+ */
+export declare const checkMemoryCrossScopeCapability: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 6 — `network.non-member-write-denied` (run). Grounded in moltnet's
+ * `writeForbiddenError` (ecosystem/moltnet/internal/rooms/access_policy.go:23,71-72)
+ * and the `message.denied` payload minimum (conformance.ts:67: `target`,
+ * `reason`, `content_sha256`). The `writeForbiddenError` path is carried as
+ * an informational `grounding` string only — this function performs no
+ * static check against moltnet's source, so the status is never driven by
+ * that literal.
+ *
+ * `not_applicable`, never `pass`, when no `message.denied` event is present:
+ * non-member-write enforcement was never exercised in this run, which is not
+ * evidence it works (see AGENTS.md). When one or more denial events are
+ * present, every one must carry `target`, `reason`, and `content_sha256` to
+ * pass.
+ */
+export declare const checkNonMemberWriteDenied: (evidence: RunLedgerEvidence | undefined) => AuditCheck;
+/**
+ * Check 7 — `provenance.signed-report` — always `not_applicable`. Report
+ * signing/provenance is deferred to B66; this audit generator has no
+ * signing input to check and must never claim it. Takes no evidence input
+ * on purpose: there is nothing yet for it to inspect.
+ */
+export declare const checkProvenanceSignedReport: () => AuditCheck;
+/**
+ * The seven check ids in the order `generateAudit.ts` assembles
+ * `AuditReport.checks` in (each check function above takes a different
+ * evidence shape, so this is a documentation/ordering list only — not a
+ * uniformly-callable array).
+ */
+export declare const AUDIT_CHECK_IDS: readonly ["causal.principals-authenticated", "causal.denied-ledger-visible", "control.wake-fail-closed", "container.no-baked-secrets", "memory.cross-scope-capability", "network.non-member-write-denied", "provenance.signed-report"];

package/dist/audit/checks.js

@@ -0,0 +1,279 @@
+// Not re-exported by src/ledger/index.js's barrel (see conformance.ts, which
+// also imports it directly from principal.js rather than through the
+// barrel); mirrored here for the same reason.
+import { isAuthenticatedPrincipal } from "../ledger/principal.js";
+import { CONTROL_TOKEN_ENV, DENIAL_MINIMUMS_BY_TYPE, escapeRegExp, FAIL_CLOSED_MARKER, literalAssignmentPattern, missingRequiredKeys, notApplicable, statusFor } from "./checksShared.js";
+/**
+ * Check 1 — `causal.principals-authenticated` (run). Grounded in
+ * `runRealConformance` reporting zero issues over the ledger jsonl, and in
+ * `isAuthenticatedPrincipal` (src/ledger/principal.ts:87) rejecting a bare,
+ * literal-`anonymous`, or `system:moltnet.anonymous` principal
+ * (principal.ts:45,93). Fails on either a nonempty `issues` list (any
+ * schema/seq/payload/principal/chain problem `runRealConformance` found) or
+ * an event whose `principal_id` is not authenticated — evidence names the
+ * offending event and principal directly rather than relying on issue-
+ * message string matching.
+ */
+export const checkPrincipalsAuthenticated = (evidence) => {
+    const id = "causal.principals-authenticated";
+    const category = "causal";
+    const severity = "critical";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const offendingPrincipals = evidence.events
+        .filter((event) => !isAuthenticatedPrincipal(event.principal_id))
+        .map((event) => ({ event_id: event.event_id, principal_id: event.principal_id }));
+    return {
+        category,
+        evidence: {
+            eventCount: evidence.eventCount,
+            issueCount: evidence.issues.length,
+            offendingPrincipals,
+            sources: evidence.sources
+        },
+        id,
+        severity,
+        status: statusFor(evidence.issues.length === 0 && offendingPrincipals.length === 0)
+    };
+};
+/**
+ * Check 2 — `causal.denied-ledger-visible` (run). Grounded in
+ * `DEFAULT_PAYLOAD_MINIMUMS` (conformance.ts:67-69) for every `*.denied`
+ * type: any such event that appears must carry its required keys. Also
+ * detects a silent drop — this fixture's `expected-denials.json` asserted a
+ * denial type occurred, but no matching `*.denied` event exists in the
+ * ledger — which fails even when every event that *is* present is well
+ * shaped.
+ *
+ * `not_applicable`, never `pass`, when there is no `expected-denials.json`
+ * manifest AND zero `*.denied` events are present in the ledger — with
+ * neither an assertion to check against nor an event to inspect, there is
+ * nothing here to actually assess (see AGENTS.md's cardinal rule: absent
+ * evidence is `not_applicable`, never `pass`). A manifest being present is
+ * enough to keep evaluating (silent-drop detection needs no observed event
+ * to fire), and any `*.denied` event that *is* present is always
+ * key-validated regardless of manifest presence.
+ */
+export const checkDeniedLedgerVisible = (evidence) => {
+    const id = "causal.denied-ledger-visible";
+    const category = "causal";
+    const severity = "high";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const presentDenials = evidence.events.filter((event) => DENIAL_MINIMUMS_BY_TYPE.has(event.type));
+    if (!evidence.manifestPresent && presentDenials.length === 0) {
+        return notApplicable(id, category, severity, "no denial events and no expected-denials manifest; cannot assess silent-drop");
+    }
+    const malformed = presentDenials
+        .map((event) => ({
+        event_id: event.event_id,
+        /* v8 ignore next -- presentDenials already filtered by DENIAL_MINIMUMS_BY_TYPE.has(event.type), so .get() always hits; defensive fallback only */
+        missingKeys: missingRequiredKeys(event, DENIAL_MINIMUMS_BY_TYPE.get(event.type) ?? []),
+        type: event.type
+    }))
+        .filter((entry) => entry.missingKeys.length > 0);
+    const presentTypes = new Set(presentDenials.map((event) => event.type));
+    const silentlyDropped = evidence.expectedDenialTypes.filter((type) => !presentTypes.has(type));
+    return {
+        category,
+        evidence: {
+            deniedEventCount: presentDenials.length,
+            expectedDenialTypes: evidence.expectedDenialTypes,
+            malformed,
+            silentlyDropped
+        },
+        id,
+        severity,
+        status: statusFor(malformed.length === 0 && silentlyDropped.length === 0)
+    };
+};
+/**
+ * Check 3 — `control.wake-fail-closed` (static). Grounded in
+ * appControlSource.ts:31-47 (B62 Option B): the operator wake endpoint must
+ * fail closed when `SPAWNFILE_PI_CONTROL_TOKEN` is unset, never treat an
+ * unset token as "auth disabled". Passes only when the compiled Pi app
+ * source references the token env, contains the verbatim fail-closed
+ * rejection text, and never bakes a literal default value for it.
+ */
+export const checkControlWakeFailClosed = (evidence) => {
+    const combined = `${evidence.dockerfile}\n${evidence.entrypoint}\n${evidence.piAppSource}`;
+    const tokenReferenced = combined.includes(CONTROL_TOKEN_ENV);
+    const failClosedMarkerFound = evidence.piAppSource.includes(FAIL_CLOSED_MARKER);
+    const bakedDefaultFound = literalAssignmentPattern(CONTROL_TOKEN_ENV).test(combined);
+    return {
+        category: "control",
+        evidence: {
+            bakedDefaultFound,
+            envSourceList: [CONTROL_TOKEN_ENV],
+            failClosedMarkerFound,
+            tokenReferenced
+        },
+        id: "control.wake-fail-closed",
+        severity: "critical",
+        status: statusFor(tokenReferenced && failClosedMarkerFound && !bakedDefaultFound)
+    };
+};
+/**
+ * Check 4 — `container.no-baked-secrets` (static). Grounded in
+ * containerEntrypointRender.ts:232-233: every required secret is emitted as
+ * a `require_env <name>` runtime check, never a literal value baked into the
+ * Dockerfile build layer or the entrypoint script. Passes only when every
+ * `requiredSecrets` name is `require_env`-guarded in the entrypoint AND no
+ * name is ever followed by a literal (non-`$`) assignment anywhere in the
+ * compiled Dockerfile/entrypoint text.
+ */
+export const checkContainerNoBakedSecrets = (evidence) => {
+    const combined = `${evidence.dockerfile}\n${evidence.entrypoint}`;
+    const missingRequireEnv = evidence.requiredSecrets.filter((name) => !new RegExp(`require_env\\s+['"]${escapeRegExp(name)}['"]`, "u").test(evidence.entrypoint));
+    const bakedLiteralValues = evidence.requiredSecrets.filter((name) => literalAssignmentPattern(name).test(combined));
+    return {
+        category: "container",
+        evidence: {
+            bakedLiteralValues,
+            missingRequireEnv,
+            requiredSecrets: evidence.requiredSecrets
+        },
+        id: "container.no-baked-secrets",
+        severity: "critical",
+        status: statusFor(missingRequireEnv.length === 0 && bakedLiteralValues.length === 0)
+    };
+};
+/**
+ * Check 5 — `memory.cross-scope-capability` (run). Grounded in mneme's
+ * `mneme.cap.system.v1` foreign-scope escalation capability
+ * (ecosystem/mneme/src/policy/capability.ts:28) and the
+ * `memory.write.denied` payload minimum (conformance.ts:68:
+ * `requested_scope`, `reason`). `mneme.cap.system.v1` is carried as an
+ * informational `grounding` string only — this function performs no static
+ * check against mneme's source, so the status is never driven by that
+ * literal.
+ *
+ * `not_applicable`, never `pass`, when no `memory.write.denied` event is
+ * present in the ledger: enforcement was never exercised in this run, and
+ * "nothing to violate" is not evidence the capability guard works (see
+ * AGENTS.md). When one or more denial events are present, every one must
+ * carry both `requested_scope` and `reason` to pass.
+ */
+export const checkMemoryCrossScopeCapability = (evidence) => {
+    const id = "memory.cross-scope-capability";
+    const category = "memory";
+    const severity = "high";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const denials = evidence.events.filter((event) => event.type === "memory.write.denied");
+    if (denials.length === 0) {
+        return {
+            category,
+            evidence: {
+                deniedEventCount: 0,
+                reason: "no memory.write.denied events observed; cross-scope enforcement was not exercised in this run"
+            },
+            id,
+            severity,
+            status: "not_applicable"
+        };
+    }
+    /* v8 ignore next -- "memory.write.denied" is always in DEFAULT_PAYLOAD_MINIMUMS (conformance.ts:68); defensive fallback only */
+    const requiredKeys = DENIAL_MINIMUMS_BY_TYPE.get("memory.write.denied") ?? [];
+    const malformed = denials
+        .map((event) => ({
+        event_id: event.event_id,
+        missingKeys: missingRequiredKeys(event, requiredKeys),
+        requested_scope: event.payload.requested_scope,
+        reason: event.payload.reason
+    }))
+        .filter((entry) => entry.missingKeys.length > 0);
+    return {
+        category,
+        evidence: {
+            deniedEventCount: denials.length,
+            grounding: "mneme.cap.system.v1",
+            malformed
+        },
+        id,
+        severity,
+        status: statusFor(malformed.length === 0)
+    };
+};
+/**
+ * Check 6 — `network.non-member-write-denied` (run). Grounded in moltnet's
+ * `writeForbiddenError` (ecosystem/moltnet/internal/rooms/access_policy.go:23,71-72)
+ * and the `message.denied` payload minimum (conformance.ts:67: `target`,
+ * `reason`, `content_sha256`). The `writeForbiddenError` path is carried as
+ * an informational `grounding` string only — this function performs no
+ * static check against moltnet's source, so the status is never driven by
+ * that literal.
+ *
+ * `not_applicable`, never `pass`, when no `message.denied` event is present:
+ * non-member-write enforcement was never exercised in this run, which is not
+ * evidence it works (see AGENTS.md). When one or more denial events are
+ * present, every one must carry `target`, `reason`, and `content_sha256` to
+ * pass.
+ */
+export const checkNonMemberWriteDenied = (evidence) => {
+    const id = "network.non-member-write-denied";
+    const category = "network";
+    const severity = "high";
+    if (!evidence) {
+        return notApplicable(id, category, severity, "no run artifacts provided");
+    }
+    const denials = evidence.events.filter((event) => event.type === "message.denied");
+    if (denials.length === 0) {
+        return {
+            category,
+            evidence: {
+                deniedEventCount: 0,
+                reason: "no message.denied events observed; non-member write enforcement was not exercised in this run"
+            },
+            id,
+            severity,
+            status: "not_applicable"
+        };
+    }
+    /* v8 ignore next -- "message.denied" is always in DEFAULT_PAYLOAD_MINIMUMS (conformance.ts:67); defensive fallback only */
+    const requiredKeys = DENIAL_MINIMUMS_BY_TYPE.get("message.denied") ?? [];
+    const malformed = denials
+        .map((event) => ({
+        event_id: event.event_id,
+        missingKeys: missingRequiredKeys(event, requiredKeys),
+        target: event.payload.target,
+        reason: event.payload.reason
+    }))
+        .filter((entry) => entry.missingKeys.length > 0);
+    return {
+        category,
+        evidence: {
+            deniedEventCount: denials.length,
+            grounding: "ecosystem/moltnet/internal/rooms/access_policy.go writeForbiddenError",
+            malformed
+        },
+        id,
+        severity,
+        status: statusFor(malformed.length === 0)
+    };
+};
+/**
+ * Check 7 — `provenance.signed-report` — always `not_applicable`. Report
+ * signing/provenance is deferred to B66; this audit generator has no
+ * signing input to check and must never claim it. Takes no evidence input
+ * on purpose: there is nothing yet for it to inspect.
+ */
+export const checkProvenanceSignedReport = () => notApplicable("provenance.signed-report", "provenance", "medium", "not yet enforced (see B66)");
+/**
+ * The seven check ids in the order `generateAudit.ts` assembles
+ * `AuditReport.checks` in (each check function above takes a different
+ * evidence shape, so this is a documentation/ordering list only — not a
+ * uniformly-callable array).
+ */
+export const AUDIT_CHECK_IDS = [
+    "causal.principals-authenticated",
+    "causal.denied-ledger-visible",
+    "control.wake-fail-closed",
+    "container.no-baked-secrets",
+    "memory.cross-scope-capability",
+    "network.non-member-write-denied",
+    "provenance.signed-report"
+];

package/dist/audit/checksShared.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Evidence input types and small pure helpers shared by every check function
+ * in checks.ts. Split out purely to keep checks.ts under the repo's 400-line
+ * cap (see /Users/apresmoi/Documents/spawnfile/CLAUDE.md) — nothing here is
+ * a different layer or a different contract, it is checks.ts's own
+ * plumbing. No I/O, same as checks.ts itself.
+ */
+import type { CausalEvent, ConformanceIssue } from "../ledger/index.js";
+import type { AuditCheck, AuditCheckCategory, AuditCheckSeverity, AuditCheckStatus } from "./types.js";
+/**
+ * Ledger evidence handed to every run-mode check (1, 2, 5, 6). Built once by
+ * `generateAudit.ts` from `runRealConformance` (offline-mode: an injected
+ * `exec` that reads fixture files instead of spawning a sibling process —
+ * see generateAudit.ts) plus the audit's own `expected-denials.json`
+ * manifest. `undefined` means "no run artifacts provided" — every run-mode
+ * check below returns `not_applicable` in that case, and never `pass`.
+ */
+export interface RunLedgerEvidence {
+    eventCount: number;
+    events: CausalEvent[];
+    /** Denial types this fixture's `expected-denials.json` asserts a `*.denied` event must exist for (silent-drop detection, check 2). */
+    expectedDenialTypes: string[];
+    /** Every schema/seq/payload-minimum/principal-grammar/chain-stitch issue `runRealConformance` reported — reused, never recomputed. */
+    issues: ConformanceIssue[];
+    /** Whether the ledger directory actually contained an `expected-denials.json` file — distinct from `expectedDenialTypes.length === 0`, which is also true for a *present-but-empty* manifest. Check 2 uses this to tell "no manifest, so silent-drop cannot be assessed" apart from "a manifest exists and asserts nothing". */
+    manifestPresent: boolean;
+    sources: string[];
+}
+/**
+ * Compiled-output evidence handed to every static check (3, 4). Plain
+ * strings, not paths — `generateAudit.ts` owns the file reads, these
+ * functions stay pure. Any file that does not exist in the compiled output
+ * directory reads as an empty string; that is itself audit-worthy (absence
+ * of proof is not proof of enforcement), never treated as not_applicable —
+ * unlike run-mode checks, the compiled-output directory is a required
+ * `generateAudit` input, never optional.
+ */
+export interface StaticContainerEvidence {
+    /** Rendered Dockerfile text (containerArtifactsRender.ts's `renderDockerfile` output shape). */
+    dockerfile: string;
+    /** Rendered entrypoint.sh text (containerEntrypointRender.ts's `renderEntrypoint` output shape). */
+    entrypoint: string;
+    /** Rendered generated Pi app source, if this compile targeted Pi (appControlSource.ts's `renderPiControlSource` output is inlined into it). Empty string if the compiled output has no such file. */
+    piAppSource: string;
+    /** Secret env var NAMES this compile declared required (containerEntrypointRender.ts's `renderEntrypoint(runtimePlans, requiredSecrets, ...)` second argument) — never the values. */
+    requiredSecrets: string[];
+}
+export declare const notApplicable: (id: string, category: AuditCheckCategory, severity: AuditCheckSeverity, reason: string) => AuditCheck;
+export declare const statusFor: (ok: boolean) => AuditCheckStatus;
+/** `conformance.ts`'s `checkPayloadMinimums` is not exported (it is that module's private helper); this is the same one-line key-presence rule applied directly to already-parsed events, not a reimplementation of `validateConformanceSources`'s schema/seq/stitch pipeline. */
+export declare const missingRequiredKeys: (event: CausalEvent, requiredKeys: string[]) => string[];
+export declare const DENIAL_MINIMUMS_BY_TYPE: Map<string, string[]>;
+/** Env name gating the operator-only wake endpoint (appControlSource.ts:45, `CONTROL_TOKEN_ENV`). */
+export declare const CONTROL_TOKEN_ENV = "SPAWNFILE_PI_CONTROL_TOKEN";
+/**
+ * Verbatim source-text substring of appControlSource.ts:75's fail-closed
+ * rejection branch (`return { ok: false, reason: "no operator token
+ * configured (" + CONTROL_TOKEN_ENV + " is unset)" }`). The literal string
+ * checked here is only the first concatenated chunk — the source
+ * concatenates `CONTROL_TOKEN_ENV` in with `+`, so the fully-assembled
+ * runtime message never appears as one literal in the source text itself.
+ * Its presence is direct evidence the fail-closed branch was actually
+ * emitted, not paraphrased.
+ */
+export declare const FAIL_CLOSED_MARKER = "no operator token configured (";
+export declare const escapeRegExp: (value: string) => string;
+/**
+ * Matches a literal (non-`$`-expansion) shell/Dockerfile assignment
+ * `NAME=<value>` — never a `require_env 'NAME'` call (no `=` follows the
+ * name there at all) and never a same-name passthrough reference like
+ * `NAME="$NAME"`/`NAME=${NAME}` (an optional quote followed by `$`), both of
+ * which read the env rather than bake a value into it.
+ */
+export declare const literalAssignmentPattern: (name: string) => RegExp;