statelyai 0.15.1 → 0.16.0

package/README.md

@@ -48,9 +48,9 @@ npm install --global statelyai
 
 <!-- trusted local campaign command from src/testCommand.ts -->
 
-`statelyai test ./feature.campaign.mjs` runs graph paths and property testing through `@statelyai/model-testing`. Install that package in the campaign project. The campaign is trusted JavaScript with ordinary local permissions. The child process is not a sandbox.
+`statelyai test ./feature.campaign.mjs` runs graph paths and property testing through the shared internal testing runtime. Install `statelyai` in the campaign project and import authoring helpers from `statelyai/testing`. The campaign is trusted JavaScript with ordinary local permissions. The child process is not a sandbox.
 
-Use `--report report.json --fixture regression.json` to save results and a concrete counterexample, then `--replay regression.json` after fixing the app. Exit codes are 0 for passed, 1 for a model/app discrepancy, and 2 for inconclusive execution. See [Test application behavior](../../docs/cli/test.md) for budgets and replay, or the [runnable browser example](../model-testing/README.md#verify-the-browser-example).
+Use `--report report.json --fixture regression.json` to save results and a concrete counterexample, then `--replay regression.json` after fixing the app. Exit codes are 0 for passed, 1 for a model/app discrepancy, and 2 for inconclusive execution. See [Test application behavior](../../docs/cli/test.md) for budgets and replay, or the [runnable browser example](../mcp/testing/README.md#verify-the-browser-example).
 
 ## Quick start
 

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as run } from "./cli-CE7KhcOJ.mjs";
+import { C as run } from "./cli-CqVcBAPG.mjs";
 
 //#region src/bin.ts
 run();

package/dist/{cli-CE7KhcOJ.mjs → cli-CqVcBAPG.mjs}

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { z, z as z$1 } from "zod";
 import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
 import { changeSet, createFileStore, createLoop, editorGraphRevision, graphPathGenerationId, graphPathNextCursor, graphPathsPageSchema, parseModelGraph, proposalOutline, stableJson, verdictLines, verify } from "@statelyai/mcp/loop";
-import { campaignExitCode, modelTestReplaySchema, reportReplays, runCampaignFile } from "@statelyai/model-testing";
+import { campaignExitCode, modelTestReplaySchema, reportReplays, runCampaignFile } from "@statelyai/mcp/testing";
 import { StudioApiError, buildAuthorizeUrl, createPkcePair, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken, registerOAuthClient } from "@statelyai/sdk";
 import * as ts$1 from "typescript";
 import ts from "typescript";
@@ -31,7 +31,7 @@ var __commonJSMin$1 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).expo
 
 //#endregion
 //#region src/version.ts
-const CLI_VERSION = "0.15.1";
+const CLI_VERSION = "0.16.0";
 
 //#endregion
 //#region src/behaviorCi.ts
@@ -1273,7 +1273,7 @@ async function prepareTestOutputs(options) {
 var TestCommand = class TestCommand extends Command {
 	static enableJsonFlag = false;
 	static summary = "Run a trusted local model-based testing campaign.";
-	static description = "Imports and executes a trusted .mjs campaign with ordinary local permissions. This is not a sandbox. Install @statelyai/model-testing in the campaign project. Runs graph paths and property tests; --replay checks a saved counterexample as a regression. Exit 0 passes, 1 is a model/app discrepancy, 2 is inconclusive or an infrastructure failure.";
+	static description = "Imports and executes a trusted .mjs campaign with ordinary local permissions. This is not a sandbox. Install statelyai in the campaign project and import statelyai/testing. Runs graph paths and property tests; --replay checks a saved counterexample as a regression. Exit 0 passes, 1 is a model/app discrepancy, 2 is inconclusive or an infrastructure failure.";
 	static args = { campaign: Args.string({
 		required: true,
 		description: "Trusted local .mjs campaign module"
@@ -2659,7 +2659,7 @@ function offsetAt(lineStarts, line, character) {
 }
 
 //#endregion
-//#region ../graph-tools/dist/semanticDiff-D3jKVmli.mjs
+//#region ../graph-tools/dist/semanticDiff-pFPzuv8z.mjs
 /**
 * Convert a resolved {@link GraphNode} back into a {@link NodeConfig}.
 *
@@ -5601,7 +5601,7 @@ function createMachine(config, implementations) {
 }
 
 //#endregion
-//#region ../graph-tools/dist/validation-D8ipdyfF.mjs
+//#region ../graph-tools/dist/validation-Du75Lsap.mjs
 function resolveProfileData(data, namespace) {
 	const prefix = `${namespace}.`;
 	return Object.fromEntries(Object.entries(data).filter(([key]) => key.startsWith(prefix)).map(([key, value]) => [key.slice(prefix.length), value]));
@@ -6618,12 +6618,7 @@ function graphToMachineConfig(graph, options = {}) {
 }
 function analyzeXStateV5Compatibility(graph) {
 	const issues = [];
-	const graphPaths = [
-		["data.version", graph.data.version],
-		["data.options", graph.data.options],
-		["data.schemas.input", graph.data.schemas?.input],
-		["data.schemas.output", graph.data.schemas?.output]
-	].filter(([, value]) => value != null);
+	const graphPaths = [["data.version", graph.data.version], ["data.options", graph.data.options]].filter(([, value]) => value != null);
 	if (graphPaths.length) issues.push({
 		level: "warning",
 		message: "XState v6 machine fields are retained but read-only in XState v5.",
@@ -6658,8 +6653,6 @@ const XSTATE_V5_PROJECTION = {
 	readOnlyPaths: [
 		"data.version",
 		"data.options",
-		"data.schemas.input",
-		"data.schemas.output",
 		"nodes.*.data.initialInput",
 		"nodes.*.data.timeout",
 		"nodes.*.data.route",
@@ -23859,7 +23852,7 @@ function describeCredentialBackend(backend, location) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@statelyai+graph@2.1.0_@statelyai+layout@0.4.3_cytoscape@3.34.0_d3-force@3.0.0_d3-hiera_2afdfa88fae2fa10712f99651d0f58d6/node_modules/@statelyai/graph/dist/index.mjs
+//#region ../../node_modules/.pnpm/@statelyai+graph@2.1.0_@statelyai+layout@0.5.0_cytoscape@3.34.0_d3-force@3.0.0_d3-hiera_b5a11f1847a44c5e54d10b16dab0c7b9/node_modules/@statelyai/graph/dist/index.mjs
 const LAYOUT_KEYS = {
 	node: [
 		"x",

package/dist/index.d.mts

@@ -321,7 +321,7 @@ declare function createStatelyProjectConfig(options: {
   defaultXStateVersion?: number;
 }): StatelyProjectConfig;
 //#endregion
-//#region ../../node_modules/.pnpm/@statelyai+graph@2.1.0_@statelyai+layout@0.4.3_cytoscape@3.34.0_d3-force@3.0.0_d3-hiera_2afdfa88fae2fa10712f99651d0f58d6/node_modules/@statelyai/graph/dist/types-BAEQTwK_.d.mts
+//#region ../../node_modules/.pnpm/@statelyai+graph@2.1.0_@statelyai+layout@0.5.0_cytoscape@3.34.0_d3-force@3.0.0_d3-hiera_b5a11f1847a44c5e54d10b16dab0c7b9/node_modules/@statelyai/graph/dist/types-BAEQTwK_.d.mts
 //#region src/types.d.ts
 /**
  * Directedness of a graph or an individual edge.
@@ -910,8 +910,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
   version: z.ZodLiteral<1>;
   suite: z.ZodString;
   status: z.ZodEnum<{
-    failed: "failed";
     passed: "passed";
+    failed: "failed";
   }>;
   verdict: z.ZodEnum<{
     inconclusive: "inconclusive";
@@ -1016,8 +1016,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
     type: z.ZodLiteral<"path-result">;
     id: z.ZodString;
     status: z.ZodEnum<{
-      failed: "failed";
       passed: "passed";
+      failed: "failed";
     }>;
     witnessedStates: z.ZodArray<z.ZodString>;
     witnessedTransitions: z.ZodArray<z.ZodString>;
@@ -1028,8 +1028,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
     state: z.ZodString;
     event: z.ZodString;
     status: z.ZodEnum<{
-      failed: "failed";
       passed: "passed";
+      failed: "failed";
     }>;
   }, z.core.$strip>>>;
   divergences: z.ZodArray<z.ZodObject<{
@@ -1073,8 +1073,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
       predicateResults: z.ZodArray<z.ZodObject<{
         state: z.ZodString;
         status: z.ZodEnum<{
-          failed: "failed";
           passed: "passed";
+          failed: "failed";
         }>;
         signals: z.ZodArray<z.ZodString>;
         message: z.ZodOptional<z.ZodString>;
@@ -1088,8 +1088,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
       predicateResults: z.ZodArray<z.ZodObject<{
         state: z.ZodString;
         status: z.ZodEnum<{
-          failed: "failed";
           passed: "passed";
+          failed: "failed";
         }>;
         signals: z.ZodArray<z.ZodString>;
         message: z.ZodOptional<z.ZodString>;
@@ -1159,8 +1159,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
         predicateResults: z.ZodArray<z.ZodObject<{
           state: z.ZodString;
           status: z.ZodEnum<{
-            failed: "failed";
             passed: "passed";
+            failed: "failed";
           }>;
           signals: z.ZodArray<z.ZodString>;
           message: z.ZodOptional<z.ZodString>;
@@ -1174,8 +1174,8 @@ declare const verificationRunReportSchema: z.ZodObject<{
         predicateResults: z.ZodArray<z.ZodObject<{
           state: z.ZodString;
           status: z.ZodEnum<{
-            failed: "failed";
             passed: "passed";
+            failed: "failed";
           }>;
           signals: z.ZodArray<z.ZodString>;
           message: z.ZodOptional<z.ZodString>;
@@ -1229,8 +1229,8 @@ declare const verificationRequestSchema: z.ZodObject<{
       version: z.ZodLiteral<1>;
       suite: z.ZodString;
       status: z.ZodEnum<{
-        failed: "failed";
         passed: "passed";
+        failed: "failed";
       }>;
       verdict: z.ZodEnum<{
         inconclusive: "inconclusive";
@@ -1335,8 +1335,8 @@ declare const verificationRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"path-result">;
         id: z.ZodString;
         status: z.ZodEnum<{
-          failed: "failed";
           passed: "passed";
+          failed: "failed";
         }>;
         witnessedStates: z.ZodArray<z.ZodString>;
         witnessedTransitions: z.ZodArray<z.ZodString>;
@@ -1347,8 +1347,8 @@ declare const verificationRequestSchema: z.ZodObject<{
         state: z.ZodString;
         event: z.ZodString;
         status: z.ZodEnum<{
-          failed: "failed";
           passed: "passed";
+          failed: "failed";
         }>;
       }, z.core.$strip>>>;
       divergences: z.ZodArray<z.ZodObject<{
@@ -1392,8 +1392,8 @@ declare const verificationRequestSchema: z.ZodObject<{
           predicateResults: z.ZodArray<z.ZodObject<{
             state: z.ZodString;
             status: z.ZodEnum<{
-              failed: "failed";
               passed: "passed";
+              failed: "failed";
             }>;
             signals: z.ZodArray<z.ZodString>;
             message: z.ZodOptional<z.ZodString>;
@@ -1407,8 +1407,8 @@ declare const verificationRequestSchema: z.ZodObject<{
           predicateResults: z.ZodArray<z.ZodObject<{
             state: z.ZodString;
             status: z.ZodEnum<{
-              failed: "failed";
               passed: "passed";
+              failed: "failed";
             }>;
             signals: z.ZodArray<z.ZodString>;
             message: z.ZodOptional<z.ZodString>;
@@ -1478,8 +1478,8 @@ declare const verificationRequestSchema: z.ZodObject<{
             predicateResults: z.ZodArray<z.ZodObject<{
               state: z.ZodString;
               status: z.ZodEnum<{
-                failed: "failed";
                 passed: "passed";
+                failed: "failed";
               }>;
               signals: z.ZodArray<z.ZodString>;
               message: z.ZodOptional<z.ZodString>;
@@ -1493,8 +1493,8 @@ declare const verificationRequestSchema: z.ZodObject<{
             predicateResults: z.ZodArray<z.ZodObject<{
               state: z.ZodString;
               status: z.ZodEnum<{
-                failed: "failed";
                 passed: "passed";
+                failed: "failed";
               }>;
               signals: z.ZodArray<z.ZodString>;
               message: z.ZodOptional<z.ZodString>;

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { A as formatVerificationJUnit, B as calibrateBehavior, C as run, D as resourceId, E as linkProject, F as readGraphFile, I as verifyReport, L as adoptBehavior, M as briefReport, N as changesReport, O as resolveVerificationRequest, P as pendingReport, R as behaviorCiConfigSchema, S as resolveProjectStatus, T as scanProjectSources, V as checkBehavior, _ as isFileGitDirty, a as discoverMachinesInSource, b as resolveCredentialStatus, c as formatDiscoveredMachines, d as formatProjectStatus, f as formatStoredCredentialSource, g as initProject, h as inferInitProjectName, i as discoverLinkedPullTargets, j as createStatelyProjectConfig, k as verifyProject, l as formatMissingNewMachineDirMessage, m as getEnvCredential, n as buildOAuthLoginStart, o as discoverOAuthLogin, p as getEnvApiKey, r as classifyPushCandidates, s as discoverRemoteProjectMachineTargets, t as COMMANDS, u as formatPlanSummary, v as resolveApiKey, w as scanProjectMachines, x as resolveOpenRootDir, y as resolveConfiguredPullTargets, z as behaviorCiResultsSchema } from "./cli-CE7KhcOJ.mjs";
+import { A as formatVerificationJUnit, B as calibrateBehavior, C as run, D as resourceId, E as linkProject, F as readGraphFile, I as verifyReport, L as adoptBehavior, M as briefReport, N as changesReport, O as resolveVerificationRequest, P as pendingReport, R as behaviorCiConfigSchema, S as resolveProjectStatus, T as scanProjectSources, V as checkBehavior, _ as isFileGitDirty, a as discoverMachinesInSource, b as resolveCredentialStatus, c as formatDiscoveredMachines, d as formatProjectStatus, f as formatStoredCredentialSource, g as initProject, h as inferInitProjectName, i as discoverLinkedPullTargets, j as createStatelyProjectConfig, k as verifyProject, l as formatMissingNewMachineDirMessage, m as getEnvCredential, n as buildOAuthLoginStart, o as discoverOAuthLogin, p as getEnvApiKey, r as classifyPushCandidates, s as discoverRemoteProjectMachineTargets, t as COMMANDS, u as formatPlanSummary, v as resolveApiKey, w as scanProjectMachines, x as resolveOpenRootDir, y as resolveConfiguredPullTargets, z as behaviorCiResultsSchema } from "./cli-CqVcBAPG.mjs";
 
 export { COMMANDS, adoptBehavior, behaviorCiConfigSchema, behaviorCiResultsSchema, briefReport, buildOAuthLoginStart, calibrateBehavior, changesReport, checkBehavior, classifyPushCandidates, createStatelyProjectConfig, discoverLinkedPullTargets, discoverMachinesInSource, discoverOAuthLogin, discoverRemoteProjectMachineTargets, formatDiscoveredMachines, formatMissingNewMachineDirMessage, formatPlanSummary, formatProjectStatus, formatStoredCredentialSource, formatVerificationJUnit, getEnvApiKey, getEnvCredential, inferInitProjectName, initProject, isFileGitDirty, linkProject, pendingReport, readGraphFile, resolveApiKey, resolveConfiguredPullTargets, resolveCredentialStatus, resolveOpenRootDir, resolveProjectStatus, resolveVerificationRequest, resourceId, run, scanProjectMachines, scanProjectSources, verifyProject, verifyReport };

package/dist/skills/setup-behavior-ci/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: setup-behavior-ci
+description: Set up deterministic Stately behavior CI from existing Vitest tests or authored executable model-based campaigns, with reviewed requirements, calibrated mappings, real application adapters and immutable evidence history.
+---
+
+Set up the selected feature from real source and authoritative intent. CI runs the existing CLI and tests without an LLM. Author the model and bindings for the user; do not ask them to maintain hashes.
+
+Choose the mode before setup. Preserve the existing selected-Vitest mode when connecting current tests to an estimated model. For an executable model-based campaign, read [executable mode](references/executable.md), author the model, generators, real adapter and requirement assertions, then apply the shared calibration/adoption rules below. Do not treat estimated graph coverage as executed requirement evidence.
+
+This skill ships with `statelyai` at `dist/skills/setup-behavior-ci/SKILL.md`. Resolve its exported `statelyai/skills/setup-behavior-ci/SKILL.md` path from a local install; copy the complete skill directory into the target agent's skill location when installation is requested. Its relative assets/references remain usable outside this monorepo. Repository `.agents/skills/setup-behavior-ci` is the sole maintained source; the package build copies it deterministically.
+
+For selected-Vitest mode:
+
+1. Discover the feature's existing test files, native runner command/configuration, source dependencies and authoritative requirements. Run the actual bounded Vitest selection once with `--reporter=json --outputFile=<fresh temporary file>`. Read native `testResults[].name` and `assertionResults[].fullName`; copy exact titles into mappings. Map every case in the selected native command, including existing public tests. Compare the complete `(file, fullName)` inventory against config mappings and require exact equality before proceeding. Label ancillary observed smoke checks as observations rather than invented requirements. Preserve existing behavioral assertions. Don't substitute toy tests or invent reporter titles.
+2. Read [the contract](references/contract.md). Generate a short `spec.json` with meaningful stable requirement/check IDs, acceptance criteria, source authority/citations, and `retire: []`. Requirements inferred from implementation must be labeled inference. Estimate the behavior as XGraph JSON in `model.json`; describe states/transitions that matter, including retained edge cases. Entity mappings aid investigation; they do not prove coverage. Review generated meaning against source/spec and existing assertions. The model is an estimate, not executable test truth.
+3. Independently challenge the estimated model with external inputs. Inventory all seven categories in [plan](assets/plan.json): user, host-update, async-result, cancellation, timer, server-event, lifecycle. Trace each relevant state owner and ingress in source, not just the selected tests. Combine operations across owners, such as host replacement after selection, cancellation before completion, disposal during work, and timer expiry during retry. Map discovered obligations to stable requirement/check/entity IDs, or record a cited gap or reasoned not-applicable entry. Keep cited intent, observations, inferences and assumptions distinct. Existing passing tests do not settle requirement conflicts.
+4. Copy/adapt [config](assets/config.json) and the self-contained [Vitest adapter](assets/vitest-adapter.mjs). Select bounded source, test producer, runner configuration, and meaningful dependency files. Paths are repository-relative, including check file paths; command cwd may be a package. Include project/package manifests and lockfiles for the selected dependency scope. The CLI automatically includes root and command-cwd manifests/locks, config/spec/model/adapter/mapped tests and exact baseline files. Materialize external/user intent in checked requirements documents and list authoritative intent files in `plan.authorityInputs`; edits to them must invalidate calibration. Put runner/producer configuration modules in `plan.runnerInputs` so changes require recalibration. Pin CI Node and package-manager versions to the calibrated versions; original and current OS/architecture remain evidence. Limit all selected files together to 200. No broad workspace directory or `node_modules` selection. Keep state/output outside inputs.
+5. Adapt [workflow](assets/workflow.yml) to the repository's package manager, lockfile, installation, CLI pin/build, selected command and paths. Use hosted runners by default, `contents: read`, unconditional artifact upload including hidden files and job summary. Keep `GITHUB_SHA` tied to actual checkout. Never run an LLM, auto-adopt, push, or add auth credentials in CI. Include the actual workflow path and Vitest config in config inputs before staging and checking. Existing trusted self-hosted runner workflows require same-repository trusted branch triggers, not arbitrary fork code.
+6. Stage generated input files with `git add` before the first local run. `baseline: null` bootstraps a public FileStore model and behavior record. Run `statelyai behavior calibrate --config <config> --output <fresh ignored directory>` against the unchanged implementation first. The CLI executes the real native runner and generates a self-contained calibration receipt. Inspect every mismatch against authoritative requirements. Correct a wrong model/test assumption or fix the implementation, then recalibrate. If a known implementation defect must remain red, add a cited, reasoned `implementation-defect` disposition to the plan before recalibration. Unresolved calibration mismatches block adoption. Never copy observed bugs into the requirements automatically. Inspect summary, native report, argv/exit/logs, manifest, model bindings and current gaps. A passing run is exit 0; mapped test failures/missing/skipped checks are 1; invalid evidence is 2. Fix setup errors; do not shrink obligations to make red pass.
+7. Explicitly run `statelyai behavior adopt <inspected output> --config <config>`. Adopt red as well as green records before the next evolution so failures remain in history. Commit generated config/spec/model/adapter/plan, the installed calibration receipt and the complete stateRoot `.statelyai` tree. Adoption updates baseline; no manual hashes. For dirty local runs, bound bytes must still match when adopting. `git add -f` may be needed when repository ignores `.statelyai`. Never commit output logs/runstore.
+8. Verify the generated setup with the built/installed CLI and real tests. Check a deliberate assertion failure in a selected existing test produces exit 1, a missing required mapping cannot pass, and a restored run passes while history still shows failure. Any unmapped selected case, including a passing case, is ERROR and cannot be adopted; fix the mapping inventory before application repair. Never turn that ERROR into a claimed behavioral FAIL. Keep experimental changes isolated. Remote execution is a separate verification step requiring actual run/log/artifact evidence. On a remote red or green run, download and inspect the artifact, adopt it against its exact checked parent, then commit the advanced state before the next run.
+
+Normal CI runs `behavior check` with the checked receipt. Changed model/spec/plan/mappings/adapter/producer or runner identity requires explicit native recalibration and inspected adoption. Implementation changes run against the stable calibrated contract. Calibration binds its original revision and files; it does not pin all future app revisions. Schema 1 remains readable but has no setup assurance claim.
+
+On later requirement changes, update spec and model estimate, preserve IDs for the same obligation, and use an explicit reasoned retirement to remove one. Omitted requirements/checks remain active. Refresh mappings from actual reporter output when tests change. Adopt refuses divergent ancestry; inspect both refs and rerun from the chosen checked baseline rather than rewriting artifact history.

package/dist/skills/setup-behavior-ci/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: 'Setup Behavior CI'
+  short_description: 'Set up Vitest or executable campaign behavior CI'

package/dist/skills/setup-behavior-ci/assets/campaign-adapter.mjs

@@ -0,0 +1,203 @@
+const statuses = new Set(["passed", "discrepancy", "inconclusive"]);
+const nonempty = (value) => typeof value === "string" && value.trim().length > 0;
+const count = (value) => Number.isSafeInteger(value) && value >= 0;
+const fail = (message) => {
+  throw new Error(`Invalid campaign evidence: ${message}`);
+};
+
+export const executionFullName = "campaign.execution";
+export const assertionFullName = (requirementId, checkId) =>
+  `campaign.assertion ${JSON.stringify([requirementId, checkId])}`;
+
+export default function normalize(envelope) {
+  const { file, report } = envelope ?? {};
+  if (
+    !nonempty(file) ||
+    file.startsWith("/") ||
+    file.includes("\\") ||
+    file.split("/").some((part) => !part || part === "." || part === "..") ||
+    !file.endsWith(".mjs")
+  )
+    fail("file must be a repository-relative campaign .mjs path");
+  if (report?.formatVersion !== 1 || report.mode !== "campaign" || !statuses.has(report.status))
+    fail("expected a native full-campaign report");
+  if (
+    !Array.isArray(report.phases) ||
+    report.phases.length !== 2 ||
+    report.phases[0]?.phase !== "paths" ||
+    report.phases[1]?.phase !== "property" ||
+    report.phases.some((phase) => !statuses.has(phase.status))
+  )
+    fail("expected paths and property phases in order");
+  const status = report.phases.some((phase) => phase.status === "inconclusive")
+    ? "inconclusive"
+    : report.phases.some((phase) => phase.status === "discrepancy")
+      ? "discrepancy"
+      : "passed";
+  if (status !== report.status) fail("native verdict conflicts with phases");
+
+  if (
+    !nonempty(report.campaign?.id) ||
+    !nonempty(report.campaign.intent) ||
+    !nonempty(report.campaign.scope) ||
+    !nonempty(report.campaign.modelVersion) ||
+    !Array.isArray(report.campaign.assumptions) ||
+    !report.campaign.assumptions.every(nonempty) ||
+    !Array.isArray(report.campaign.evidence) ||
+    !report.campaign.evidence.every(nonempty) ||
+    !/^[a-f0-9]{64}$/.test(report.provenance?.entrySha256 ?? "") ||
+    report.provenance?.hashScope !== "entry-module-only" ||
+    !nonempty(report.provenance.node) ||
+    !["runner", "xstate", "xstateTest", "fastCheck"].every((key) =>
+      nonempty(report.provenance.versions?.[key]),
+    ) ||
+    !Number.isSafeInteger(report.budget?.seed) ||
+    !["numRuns", "maxCommands", "pathLimit", "timeoutMs"].every(
+      (key) => count(report.budget?.[key]) && report.budget[key] > 0,
+    )
+  )
+    fail("native campaign metadata, provenance or budget missing");
+  for (const phase of report.phases) {
+    if (phase.status !== "passed" && !nonempty(phase.message)) fail("native diagnostic missing");
+    if (phase.status !== "passed" && phase.requirementGaps === undefined) continue;
+    const coverage = phase.coverage;
+    if (
+      !coverage ||
+      !count(coverage.totals?.runs) ||
+      coverage.totals.runs === 0 ||
+      !coverage.exploration ||
+      typeof coverage.exploration.truncated !== "boolean" ||
+      !Array.isArray(coverage.exploration.truncationReasons) ||
+      (coverage.exploration.truncated &&
+        (coverage.exploration.truncationReasons.length === 0 ||
+          coverage.exploration.truncationReasons.some(
+            (reason) => phase.phase !== "property" || reason !== "maximum sequence length reached",
+          ))) ||
+      !Array.isArray(coverage.temporal?.failed) ||
+      coverage.temporal.failed.length > 0 ||
+      !Array.isArray(coverage.temporal?.inconclusive) ||
+      coverage.temporal.inconclusive.length > 0
+    )
+      fail("passing or coverage-gap native phase lacks completed execution evidence");
+    const assertions = [
+      "sutComparisons",
+      "oracleComparisons",
+      "invariantChecks",
+      "temporalChecks",
+    ].map((key) => coverage.totals[key]);
+    assertions.push(phase.additionalAssertions ?? 0);
+    if (!assertions.every(count) || assertions.reduce((total, value) => total + value, 0) === 0)
+      fail("passing or coverage-gap native phase lacks observable assertions");
+  }
+
+  const declarations = report.campaign?.requirements;
+  if (!Array.isArray(declarations) || declarations.length === 0)
+    fail("nonempty campaign.requirements declarations required");
+  const requirements = new Map();
+  const checks = new Set();
+  for (const requirement of declarations) {
+    if (
+      !nonempty(requirement?.id) ||
+      requirements.has(requirement.id) ||
+      !Array.isArray(requirement.checks) ||
+      requirement.checks.length === 0
+    )
+      fail("duplicate or malformed requirement declaration");
+    const entries = new Map();
+    for (const id of requirement.checks) {
+      if (!nonempty(id) || checks.has(id)) fail("duplicate or malformed assertion declaration");
+      checks.add(id);
+      entries.set(id, { passed: 0, failed: 0 });
+    }
+    requirements.set(requirement.id, entries);
+  }
+  for (const phase of report.phases) {
+    if (!Array.isArray(phase.requirements) || phase.requirements.length !== requirements.size)
+      fail(`missing requirement inventory in ${phase.phase}`);
+    const seenRequirements = new Set();
+    for (const requirement of phase.requirements) {
+      const expected = requirements.get(requirement?.id);
+      if (
+        !expected ||
+        seenRequirements.has(requirement.id) ||
+        !Array.isArray(requirement.checks) ||
+        requirement.checks.length !== expected.size
+      )
+        fail(`requirement inventory mismatch in ${phase.phase}`);
+      seenRequirements.add(requirement.id);
+      const seenChecks = new Set();
+      for (const check of requirement.checks) {
+        const total = expected.get(check?.id);
+        if (!total || seenChecks.has(check.id) || !count(check.passed) || !count(check.failed))
+          fail(`assertion inventory or counts invalid in ${phase.phase}`);
+        if (phase.status === "passed" && check.failed > 0)
+          fail("passed phase contains failed assertions");
+        seenChecks.add(check.id);
+        total.passed += check.passed;
+        total.failed += check.failed;
+        if (!count(total.passed) || !count(total.failed)) fail("assertion counts overflow");
+      }
+    }
+  }
+  const results = [];
+  for (const [requirementId, entries] of requirements) {
+    for (const [checkId, counts] of entries) {
+      results.push({
+        file,
+        fullName: assertionFullName(requirementId, checkId),
+        outcome: counts.failed ? "failed" : counts.passed ? "passed" : "skipped",
+        detail:
+          `Assertion ${checkId}: ${counts.passed} passed, ${counts.failed} failed invocations across paths and property, including shrinking.`.slice(
+            0,
+            4000,
+          ),
+      });
+    }
+  }
+  const missing = results.filter((result) => result.outcome === "skipped");
+  const inconclusive = report.phases.filter((phase) => phase.status === "inconclusive");
+  const discrepancy = report.phases.some((phase) => phase.status === "discrepancy");
+  const missingIds = [...requirements.values()].flatMap((entries) =>
+    [...entries].filter(([, counts]) => counts.passed + counts.failed === 0).map(([id]) => id),
+  );
+  for (const phase of report.phases) {
+    if (
+      phase.requirementGaps !== undefined &&
+      (discrepancy ||
+        phase.phase !== "property" ||
+        phase.status !== "inconclusive" ||
+        !Array.isArray(phase.requirementGaps) ||
+        phase.requirementGaps.length === 0 ||
+        results.some((result) => result.outcome === "failed") ||
+        new Set(phase.requirementGaps).size !== phase.requirementGaps.length ||
+        JSON.stringify([...phase.requirementGaps].sort()) !==
+          JSON.stringify([...missingIds].sort()))
+    )
+      fail("requirement gap marker conflicts with unevaluated assertions");
+  }
+  const coverageOnly =
+    inconclusive.length > 0 && inconclusive.every((phase) => phase.requirementGaps !== undefined);
+  const detail = report.phases
+    .filter((phase) => phase.status !== "passed")
+    .map((phase) => `${phase.phase}: ${phase.message}`)
+    .join("\n");
+  results.push({
+    file,
+    fullName: executionFullName,
+    outcome:
+      inconclusive.length && !coverageOnly
+        ? "error"
+        : discrepancy
+          ? "failed"
+          : missing.length
+            ? "skipped"
+            : "passed",
+    detail: (
+      detail ||
+      (missing.length
+        ? "Required assertions were not executed."
+        : "Native paths and property execution passed.")
+    ).slice(0, 4000),
+  });
+  return results;
+}

package/dist/skills/setup-behavior-ci/assets/campaign-producer.mjs

@@ -0,0 +1,63 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import {
+  campaignExitCode,
+  modelTestReportSchema,
+  reportReplays,
+  runCampaignFile,
+} from 'statelyai/testing';
+import normalize from './campaign-adapter.mjs';
+
+const { positionals, values } = parseArgs({
+  allowPositionals: true,
+  options: { report: { type: 'string' }, budget: { type: 'string' } },
+});
+if (positionals.length !== 1 || !values.report)
+  throw new Error(
+    'Usage: node campaign-producer.mjs <campaign.mjs> --report <file> [--budget <budget.json>]',
+  );
+const file = path
+  .relative(process.cwd(), path.resolve(positionals[0]))
+  .split(path.sep)
+  .join('/');
+if (
+  !file ||
+  file.startsWith('../') ||
+  path.isAbsolute(file) ||
+  !file.endsWith('.mjs')
+)
+  throw new Error(
+    'Campaign must be a repository-relative .mjs file; run from repository root.',
+  );
+const budget = values.budget
+  ? JSON.parse(await readFile(values.budget, 'utf8'))
+  : undefined;
+const report = modelTestReportSchema.parse(
+  await runCampaignFile(file, {
+    budget,
+    onLog: (text) => process.stderr.write(text),
+  }),
+);
+const output = path.resolve(
+  process.env.STATELY_BEHAVIOR_OUTPUT ?? path.dirname(values.report),
+);
+const traces = path.join(output, 'traces');
+await mkdir(traces, { recursive: true });
+const writeJson = (filename, value) =>
+  writeFile(filename, `${JSON.stringify(value, null, 2)}\n`);
+await writeJson(path.join(traces, 'campaign-report.json'), report);
+await writeJson(path.join(traces, 'campaign-process.json'), {
+  nativeExitCode: campaignExitCode(report),
+});
+for (const [index, replay] of reportReplays(report).entries())
+  await writeJson(path.join(traces, `replay-${index + 1}.json`), replay);
+await mkdir(path.dirname(path.resolve(values.report)), { recursive: true });
+const envelope = { file, report };
+await writeJson(values.report, envelope);
+const results = normalize(envelope);
+process.exitCode = results.some(
+  (result) => result.outcome === 'failed' || result.outcome === 'error',
+)
+  ? 1
+  : 0;

package/dist/skills/setup-behavior-ci/assets/config.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": 2,
+  "name": "Selected behavior",
+  "spec": ".behavior-ci/feature/spec.json",
+  "model": ".behavior-ci/feature/model.json",
+  "adapter": ".behavior-ci/feature/vitest-adapter.mjs",
+  "stateRoot": ".behavior-ci/feature/state",
+  "baseline": null,
+  "command": {
+    "executable": "pnpm",
+    "args": [
+      "exec",
+      "vitest",
+      "run",
+      "src/feature.test.ts",
+      "--reporter=json",
+      "--outputFile={report}"
+    ],
+    "cwd": "."
+  },
+  "inputs": [
+    "src/feature.ts",
+    "src/feature.test.ts",
+    "vitest.config.ts",
+    ".github/workflows/behavior.yml"
+  ],
+  "checks": [
+    {
+      "id": "feature.check",
+      "file": "src/feature.test.ts",
+      "fullName": "exact native reporter fullName"
+    }
+  ],
+  "timeoutMs": 120000,
+  "assurance": {
+    "plan": ".behavior-ci/feature/plan.json",
+    "calibration": ".behavior-ci/feature/calibration.json"
+  }
+}

package/dist/skills/setup-behavior-ci/assets/estimated-model.json

@@ -0,0 +1,12 @@
+{
+  "id": "feature",
+  "nodes": [
+    { "id": "feature", "type": "node", "parentId": null, "data": { "key": "feature" } },
+    { "id": "feature.off", "type": "node", "parentId": "feature", "data": { "key": "off" } },
+    { "id": "feature.on", "type": "node", "parentId": "feature", "data": { "key": "on" } }
+  ],
+  "edges": [
+    { "id": "feature.turn-on", "type": "edge", "sourceId": "feature.off", "targetId": "feature.on", "data": { "eventType": "ON" } }
+  ],
+  "data": {}
+}

package/dist/skills/setup-behavior-ci/assets/executable-config.json

@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 2,
+  "name": "Executable campaign behavior",
+  "spec": ".behavior-ci/feature/spec.json",
+  "model": ".behavior-ci/feature/model.json",
+  "adapter": ".behavior-ci/feature/campaign-adapter.mjs",
+  "stateRoot": ".behavior-ci/feature/state",
+  "baseline": null,
+  "command": {
+    "executable": "node",
+    "args": [
+      ".behavior-ci/feature/campaign-producer.mjs",
+      ".behavior-ci/feature/feature.campaign.mjs",
+      "--report",
+      "{report}"
+    ],
+    "cwd": "."
+  },
+  "inputs": [
+    "src/feature.ts",
+    ".behavior-ci/feature/feature.campaign.mjs",
+    ".behavior-ci/feature/sut.mjs",
+    ".github/workflows/behavior.yml"
+  ],
+  "checks": [
+    {
+      "id": "feature.assertion",
+      "file": ".behavior-ci/feature/feature.campaign.mjs",
+      "fullName": "campaign.assertion [\"feature.requirement\",\"feature.assertion\"]"
+    },
+    {
+      "id": "feature.execution",
+      "file": ".behavior-ci/feature/feature.campaign.mjs",
+      "fullName": "campaign.execution"
+    }
+  ],
+  "timeoutMs": 120000,
+  "assurance": {
+    "plan": ".behavior-ci/feature/plan.json",
+    "calibration": ".behavior-ci/feature/calibration.json"
+  }
+}

package/dist/skills/setup-behavior-ci/assets/minimal.campaign.mjs

@@ -0,0 +1,50 @@
+import assert from "node:assert/strict";
+import { createMachine, defineCampaign, defineRequirements, fc } from "statelyai/testing";
+
+const requirements = defineRequirements({
+  "TOGGLE-001": ["initial.off", "on.turns-on"],
+});
+
+export default defineCampaign({
+  id: "minimal-toggle",
+  intent: "A new toggle starts off; ON turns it on.",
+  scope: "API-shape example; replace with the real application adapter.",
+  assumptions: ["One ON operation; no persistence or concurrency."],
+  evidence: ["The explicit intent above is example-only."],
+  modelVersion: "1",
+  requirements,
+  model: createMachine({
+    initial: "off",
+    states: {
+      off: { on: { ON: () => ({ target: "on" }) } },
+      on: {},
+    },
+  }),
+  options: {
+    events: {
+      ON: [{ case: "valid-on", generate: fc.constant({}) }],
+    },
+    sut: {
+      create() {
+        let value = "off";
+        return {
+          send(event) {
+            if (event.type === "ON") value = "on";
+          },
+          read() {
+            return value;
+          },
+        };
+      },
+    },
+    states: {
+      "*": async (snapshot, session) => {
+        const actual = await session.read();
+        const check = snapshot.value === "off" ? "initial.off" : "on.turns-on";
+        await requirements.assert(check, () => {
+          assert.equal(actual, snapshot.value);
+        });
+      },
+    },
+  },
+});

package/dist/skills/setup-behavior-ci/assets/plan.json

@@ -0,0 +1,86 @@
+{
+  "schemaVersion": 1,
+  "runnerInputs": [
+    "vitest.config.ts"
+  ],
+  "inputs": [
+    {
+      "kind": "mapped",
+      "category": "user",
+      "source": {
+        "authority": "cited-requirement",
+        "citation": "requirements.md#feature"
+      },
+      "requirementIds": [
+        "feature"
+      ],
+      "checkIds": [
+        "feature.check"
+      ],
+      "entityIds": [
+        "feature"
+      ]
+    },
+    {
+      "kind": "gap",
+      "category": "host-update",
+      "source": {
+        "authority": "inference",
+        "citation": "Review external state owners in source"
+      },
+      "reason": "Discover whether host replacement can invalidate current selections"
+    },
+    {
+      "kind": "gap",
+      "category": "async-result",
+      "source": {
+        "authority": "inference",
+        "citation": "Review asynchronous completion handlers"
+      },
+      "reason": "Discover stale and out-of-order completions"
+    },
+    {
+      "kind": "gap",
+      "category": "cancellation",
+      "source": {
+        "authority": "inference",
+        "citation": "Review cancellation and abort handlers"
+      },
+      "reason": "Discover cancellation during pending work"
+    },
+    {
+      "kind": "gap",
+      "category": "timer",
+      "source": {
+        "authority": "inference",
+        "citation": "Review timers and deadlines"
+      },
+      "reason": "Discover expiry and clock-driven transitions"
+    },
+    {
+      "kind": "gap",
+      "category": "server-event",
+      "source": {
+        "authority": "inference",
+        "citation": "Review inbound server events"
+      },
+      "reason": "Discover retries, duplicate deliveries and server updates"
+    },
+    {
+      "kind": "gap",
+      "category": "lifecycle",
+      "source": {
+        "authority": "inference",
+        "citation": "Review initialization, teardown and restoration"
+      },
+      "reason": "Discover restart and disposal behavior"
+    }
+  ],
+  "coverage": {
+    "kind": "selected-checks"
+  },
+  "dispositions": [],
+  "authorityInputs": [
+    "requirements.md"
+  ]
+}

package/dist/skills/setup-behavior-ci/assets/vitest-adapter.mjs

@@ -0,0 +1,47 @@
+import path from "node:path";
+
+export default function normalize(report, { root }) {
+  if (!report || !Array.isArray(report.testResults) || typeof report.success !== "boolean") {
+    throw new Error("Expected native Vitest JSON report");
+  }
+  if (report.numRuntimeErrorTestSuites > 0 || report.unhandledErrors?.length) {
+    throw new Error("Vitest reported runtime errors");
+  }
+  const results = [];
+  for (const suite of report.testResults) {
+    if (typeof suite.name !== "string" || !Array.isArray(suite.assertionResults)) {
+      throw new Error("Malformed Vitest suite");
+    }
+    if (suite.status === "failed" && suite.assertionResults.length === 0) {
+      throw new Error(`Suite failed before tests ran: ${suite.name}`);
+    }
+    for (const test of suite.assertionResults) {
+      if (typeof test.fullName !== "string" || !Array.isArray(test.failureMessages)) {
+        throw new Error("Malformed Vitest assertion");
+      }
+      const outcome = {
+        passed: "passed",
+        failed: "failed",
+        pending: "skipped",
+        skipped: "skipped",
+        todo: "skipped",
+      }[test.status];
+      if (!outcome) throw new Error(`Unknown Vitest status: ${test.status}`);
+      results.push({
+        file: path.relative(root, suite.name).split(path.sep).join("/"),
+        fullName: test.fullName,
+        outcome,
+        detail: test.failureMessages.join("\n").slice(0, 4000) || `Vitest: ${test.status}`,
+      });
+    }
+  }
+  const failed = results.filter((r) => r.outcome === "failed").length;
+  if (
+    report.numFailedTests !== failed ||
+    report.numTotalTests !== results.length ||
+    report.success === failed > 0
+  ) {
+    throw new Error("Vitest report totals/success disagree with assertions");
+  }
+  return results;
+}

package/dist/skills/setup-behavior-ci/assets/workflow.yml

@@ -0,0 +1,28 @@
+name: Behavior evidence
+on:
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  behavior:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24.17.0"
+      - uses: pnpm/action-setup@v4
+      - run: pnpm install --frozen-lockfile
+      - name: Check behavior
+        run: pnpm exec statelyai behavior check --config .behavior-ci/feature/config.json --output .scratch/behavior-run
+      - name: Job summary
+        if: always()
+        run: cat .scratch/behavior-run/summary.md >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: behavior-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .scratch/behavior-run
+          include-hidden-files: true
+          if-no-files-found: error

package/dist/skills/setup-behavior-ci/references/contract.md

@@ -0,0 +1,31 @@
+# Checked contract
+
+The source of truth is `packages/cli/src/behaviorCi.ts` (`behaviorCiConfigSchema`, `behaviorCiResultsSchema`) and the public `@statelyai/mcp/loop` behavior record contract. JSON config is strict; unknown keys fail.
+
+New config uses `schemaVersion: 2` and `assurance: {plan,calibration}` plus `name`, `spec`, `model`, `adapter`, `stateRoot`, `baseline`, `command: {executable,args,cwd}`, `inputs`, `checks`, `timeoutMs`. Paths are repository-relative without traversal or symlinks. `cwd: "."` is valid. `baseline` is initially null and subsequently `{machineId,versionId,sha256}` written by adoption. `checks` map stable check `id` to exact repository-relative `file` and native reporter `fullName`. A test maps once. Command argv includes exactly one `{report}` placeholder, usually `--outputFile={report}`. Spawn uses no shell. Timeout range is 100–600000 ms.
+
+The `.mjs` module exports a default function `(rawReport, {root,cwd}) => results`, optionally async. Each result is `{file,fullName,outcome,detail}`. Outcomes are `passed`, `failed`, `skipped`, `error`. Detail is nonempty and at most 4000 characters. Keep the adapter self-contained except Node built-ins; its source is part of the binding. Config owns check IDs, never the adapter. The Vitest adapter handles native Vitest JSON. The executable adapter handles the native campaign envelope described in [executable mode](executable.md); this is not a framework registry.
+
+`spec.json` contains `requirements` and `retire`. Each requirement is `{id,text,source:{authority,citation},entityIds,checks:[{id,acceptance}]}`. Authority is `cited-requirement`, `observation`, `inference` or `assumption`. Retirement is `{kind:"requirement"|"check",id,reason}`. Core omission retains prior requirements and checks. Record and requirement limits remain core limits, including 100 reports and 200 bound files; this pilot does not compact history automatically.
+
+`model.json` is XGraph JSON. Start from the structurally tested [estimated model](../assets/estimated-model.json), then adapt it to the actual feature. Nodes use `parentId` for hierarchy; transitions use `sourceId` and `targetId`, not `source` and `target`. Use the public graph schema for other fields. Generated graph meaning deserves review; structural validity alone is insufficient.
+
+Output is summary.md, run.json, the captured config.json, manifest.json, process.json, stdout/stderr, raw report.json and a `store/.statelyai` copy in the existing FileStore format. Run metadata references exact immutable model/record versions. Current verdict covers every retained active check on this run; historical reports and core aggregate gaps are displayed separately. Tests, sources, adapter, model, specification, config, selected manifests/locks and baseline files are hashed before and after execution. Runner metadata includes CLI package version and the SHA-256 of the executing source/bundle; built ignored distribution files need not become tracked application inputs. No transitive completeness claim. Core execution remains reported and review identity unavailable.
+
+Inputs must be tracked; local staged/dirty bytes are allowed and labeled. CI requires clean bound inputs and actual HEAD equal to GITHUB_SHA. GitHub env is declared metadata, not authenticated proof. Authenticate the run, commit, logs and downloaded artifact externally before adopting. Artifact checksums detect corruption, not a malicious trusted runner forging an entire artifact.
+
+Adoption reads data only; it never imports the downloaded adapter or runs artifact commands. Exact checked parent, record/model digests, checksums, recorded Git bytes (or unchanged local dirty bytes) and immutable file conflicts must validate. Green/red evidence can advance the baseline; setup/error evidence cannot. Repeated adoption of the same next ref is idempotent. CI never changes checked baseline.
+
+Setup maps every selected native case, including existing public tests, using exact `(file, fullName)` pairs. A failed selected case outside those mappings produces ERROR, not an adoptable FAIL. Preserve that artifact, complete the mappings without weakening obligations, and rerun before application repair. A mapped native failure is a reported test failure; its detail may describe an assertion, runtime exception or timeout. The CLI does not establish a causal diagnosis from the failure status alone.
+
+Schema 2 requires a discovery plan with `schemaVersion: 1`, `runnerInputs`, `authorityInputs`, `inputs`, `coverage` and `dispositions`. List checked authoritative intent documents in nonempty `authorityInputs`; changed intent requires recalibration even when structured spec is unchanged. List command producer/configuration modules in `runnerInputs`; mapped test files and adapter are automatic. All seven input categories must occur: `user`, `host-update`, `async-result`, `cancellation`, `timer`, `server-event`, `lifecycle`. Each entry has `source: {authority,citation}`. A `kind: "mapped"` entry adds nonempty `requirementIds`, `checkIds` and `entityIds`; referenced IDs must exist and selected checks must belong to the listed requirements. A `kind: "gap"` or `"not-applicable"` entry adds a reason. Both coverage modes retain disclosed discovery gaps. Complete bounded path retrieval does not establish complete feature input coverage. Coverage is `{kind:"selected-checks"}` or `{kind:"bounded-paths",artifact,caseMappings:[{pathId,checkIds}]}`. Complete bounded-path claims require complete bound generation evidence and a native mapping for every path; generated paths are not themselves executed cases.
+
+`behavior calibrate --config <config> --output <fresh-directory>` runs the same deterministic native process as `check`, then saves `calibration.json`. The receipt includes original manifest, snapshots of original selected bytes, actual process outcome, raw native report, normalized results, contract digest and explicit implementation-defect dispositions. Checksums detect corruption; receipts do not attest that a trusted producer told the truth. `adopt` verifies the receipt against the current contract and local adapter, and installs it at the checked calibration path. It never executes downloaded code or artifact commands. It can import the current trusted repository adapter to verify native normalization. A failed calibration check requires a plan disposition `{checkId,kind:"implementation-defect",reason,source}` before it can be adopted. Skipped/missing/error calibration outcomes cannot establish a baseline. Red history remains red; a disposition never changes a failure to a pass.
+
+`check` requires a valid receipt for schema 2. Model, spec, plan, authoritative intent files, mappings, native test producer files, command, adapter or runner identity changes invalidate it. Ordinary implementation edits do not invalidate the contract. The receipt and run store the original checkout root for native report normalization when CI or adoption uses another checkout path. Receipt snapshots keep original revision evidence inspectable even in shallow CI checkouts. Run output includes the used receipt. Schema 1 check/adopt remains compatible but reports assurance unavailable. Schema 2 rejects every extra selected native `(file,fullName)` pair, including passing cases.
+
+A bounded-path archive is `{schemaVersion:1,source:{graph,kind:"simple"|"shortest"},pages:[...actual generate_graph_paths structuredContent]}`. Collect every continuation until null. Validation requires identical model, contiguous offsets, canonical cursor chain, matching generation hash, valid modeled states/transitions/events, complete retrieval, reported complete generation and exact path-to-native-check mappings. This is complete retrieval of the declared bounded generator result. Generator completeness is reported, not independently recomputed or attested. Checksums cannot authenticate a malicious trusted producer that rewrites an entire archive. The PR summary states this limit and separately counts generated paths and native passed/failed cases. The runner executable/version, Node version and CLI code digest are contract-bound; platform and architecture remain original/current evidence rather than invalidating the contract when CI uses another OS.
+
+Calibration destinations must be isolated from every selected file, selected directory, auto-selected manifest/lockfile, stateRoot and run output. Parent/child overlaps and dot aliases are refused before native execution or receipt installation.
+
+The native child receives `STATELY_BEHAVIOR_OUTPUT`, always overridden to its unique absolute run directory. Producers may write diagnostic files below its `traces/` directory on both success and failure. Keep assertion semantics independent of this path. The CLI hashes these files with the report and validates their complete inventory during adoption; extra, removed or changed trace files invalidate the artifact. Limits and symlink rules also apply to traces. Producers that ignore the variable are unchanged.

package/dist/skills/setup-behavior-ci/references/executable.md

@@ -0,0 +1,41 @@
+# Executable campaign mode
+
+Use for authored model-based tests of real functions, stores, services or UI. Keep an XGraph estimate in `model.json` for the existing behavior record. The executable XState model is a separate trusted `.mjs` program. Reconcile both against cited requirements; neither is automatically ground truth.
+
+## Author the campaign
+
+Install a pinned `statelyai` dependency in the application project, with compatible Node and package manager pins and a checked lockfile. An installed global CLI does not supply application imports. When validating an unpublished candidate, install the packed candidate and its pinned dependencies, record its SHA-256 and installation provenance, and call the result packed-candidate proof. Do not claim registry availability or publication from a local pack/install.
+
+Use the runnable [minimal campaign](../assets/minimal.campaign.mjs) for the native callback and event descriptor syntax. Its in-memory toggle demonstrates API shape only; replace it with the application model and real adapter. Write `defineCampaign({...})`, a real model, native event descriptors and fast-check generators. Import `createMachine`, `defineCampaign`, `defineRequirements` and `fc` from `statelyai/testing`. A descriptor such as `{case: 'invalid-empty', generate: fc.constant({value: ''})}` belongs under its actual model event in `options.events`; add `when` or native `pick` only where source/spec establishes state-dependent applicability. Use application source and authoritative requirements to determine expected states and transitions. Include boundary and invalid payloads, repeated/ignored operations, cancellation, retries, timer/lifecycle interactions, and cross-owner sequences that apply to the feature. Record omissions and assumptions in the discovery plan.
+
+Create a `defineRequirements` registry with stable requirement IDs mapped to nonempty arrays of globally unique assertion IDs. Pass that registry as `requirements` to `defineCampaign`. A requirement needing Enter and Blur uses distinct assertion IDs; one must never satisfy the other. Put runtime assertions inside awaited native `invariant`, state callbacks or `sut.check` callbacks:
+
+```js
+const requirements = defineRequirements({
+  'FORM-001': ['validation.invalid-email'],
+});
+// Within a real assertion callback, after reading the application:
+await requirements.assert('validation.invalid-email', () => {
+  assert.equal(observed.validation, 'Enter a valid email');
+});
+```
+
+The body must complete with `undefined` on success and throw on failure. Boolean predicates are not assertion bodies. Await or return `requirements.assert`, including nested asynchronous work. Only consumed assertions whose bodies complete within the active native callback count. Ignored, pending and late assertions make the run inconclusive. Assertions outside these callbacks, setup-only assertions, labels and phase PASS do not establish requirement execution. The tracker does not infer promise ownership: a detached assertion that finishes before the callback returns counts its actual result, and a recorded failure still fails the phase even if the detached task catches it. Counts include exploration and shrinking invocations; they are neither distinct cases nor attribution to the final shrunk witness. A saved replay supplies fresh evidence for only that concrete sequence and does not close unrelated full-campaign gaps.
+
+Use fresh isolated SUT sessions for every path, trial, shrink and replay. `sut.send` drives the real app; `sut.read` observes it. Keep behavioral assertions in `sut.check`, `invariant`, state callbacks or model projections. Browser locator, navigation, setup and service transport errors remain infrastructure errors. Release contexts, services and resources in `dispose` and campaign `cleanup`. Do not add an Action DSL, replace the native engine or run an LLM in CI.
+
+## Bridge into existing behavior CI
+
+Copy [campaign-producer.mjs](../assets/campaign-producer.mjs) and [campaign-adapter.mjs](../assets/campaign-adapter.mjs) together into the checked feature directory. The producer imports the local installed package, calls `runCampaignFile`, validates the native report, then writes the `{file, report}` envelope at `--report {report}`. Its `file` is the repository-relative campaign path. Run from the repository root. An optional `--budget <budget.json>` supplies native budget overrides; check and bind that file. The producer writes the native report, native exit code and portable replays below `STATELY_BEHAVIOR_OUTPUT/traces`. Startup, malformed data or missing bindings are setup errors.
+
+Adapt [executable-config.json](../assets/executable-config.json). Each declared assertion has exactly one selected `(file, fullName)` pair. For requirement `FORM-001` and assertion `validation.invalid-email`, the stable fullName is `campaign.assertion ["FORM-001","validation.invalid-email"]`. It is generated with `campaign.assertion ${JSON.stringify([requirementId, checkId])}`. Every campaign also has `campaign.execution`, mapped to an ancillary observation check, with its own requirement in `spec.json`. The config check IDs are stable specification IDs; the adapter never assigns them. Generate the complete inventory by importing `assertionFullName` and `executionFullName` from the copied adapter and reading the registry declarations. Then compare with actual adapter output. Selected schema-2 inventory must match exactly, including the execution guard. Missing declarations or phase binding metadata is invalid evidence and cannot pass.
+
+The adapter folds actual assertion counts across paths and property. Any failed invocation is `failed`; positive passed count with no failure is `passed`; zero is `skipped`. Every phase must contain the exact declaration/check inventory, including zeros. The separate execution guard preserves projection, invariant, temporal and other unassigned native discrepancies as `failed`; it never assigns them to a requirement arbitrarily. Coverage-only `inconclusive` phases carry validated `requirementGaps` and yield a skipped guard. Other infrastructure or incomplete exploration yields `error`. A phase PASS cannot turn zero assertions into a requirement PASS.
+
+The producer exits 1 when normalization contains `failed` or `error`, otherwise 0, including skipped-only results. This follows the existing behavior runner's process consistency contract. Required skips still make `behavior check` FAIL. Native exit 0/1/2 and raw status remain in traces. Producer exit 0 alone does not mean assurance PASS. Calibration cannot be adopted with skipped/error checks; add meaningful missing execution rather than weakening obligations. True failures require the existing cited implementation-defect disposition before red calibration adoption.
+
+Set `plan.runnerInputs` to the campaign, every campaign import and adapter implementation, producer, native budget/config, relevant package manifests and lockfiles, and actual workflow. Include the application entry points and feature sources in config inputs. For packed candidates, bind package manifests, lockfile integrity entries and the compact SHA-256 provenance manifest. Do not snapshot large binary tarballs in runner inputs; their base64 bytes can exceed the 16 MiB receipt limit. CI must install with the frozen lockfile so altered tarballs fail integrity validation. Record authoritative intent files in `plan.authorityInputs`. Bind all producer/import dependencies explicitly; the native entry SHA hashes only the entry module. Preserve the existing 200-file limit and output/input separation. Use the shared workflow template with pinned installation and real clean-runner dependencies, including Playwright browsers only when the adapter needs them.
+
+## Maintenance handoff
+
+Check in a short feature maintenance document explaining the cited intent, executable and estimated model locations, real SUT adapter, event/generator inventory, requirement/assertion mapping, bounded coverage and gaps, commands, toolchain pins, output/replay locations and evolution procedure. Include it in authority inputs only for authoritative intent; runner maintenance instructions alone are not user requirements. Preserve requirement/assertion IDs for unchanged obligations. Review and explicitly retire removed obligations through `spec.retire`; omission never retires them. A changed campaign, import, producer, adapter, plan, manifest, lockfile, workflow, mapping or native runner requires explicit recalibration and inspected adoption. Preserve red history before the next evolution. Verify green, deliberate real assertion red, restored green, unexecuted assertion, missing binding metadata and concrete replay behavior locally. Remote green/red/fix/evolution/handoff claims require actual remote logs and downloaded artifacts against their exact checked parent.

package/dist/testing.d.mts

@@ -0,0 +1 @@
+export * from "@statelyai/mcp/testing";

package/dist/testing.mjs

@@ -0,0 +1,3 @@
+export * from "@statelyai/mcp/testing"
+
+export {  };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "statelyai",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Command-line tools for Stately",
   "license": "MIT",
   "bin": {
@@ -17,23 +17,27 @@
     ".": {
       "types": "./dist/index.d.mts",
       "import": "./dist/index.mjs"
-    }
+    },
+    "./testing": {
+      "types": "./dist/testing.d.mts",
+      "import": "./dist/testing.mjs"
+    },
+    "./skills/setup-behavior-ci/SKILL.md": "./dist/skills/setup-behavior-ci/SKILL.md"
   },
   "dependencies": {
     "@oclif/core": "^4.10.3",
     "typescript": "^5.9.3",
     "ws": "^8.21.0",
     "zod": "^4.4.1",
-    "@statelyai/mcp": "0.20.0",
-    "@statelyai/sdk": "0.39.1",
-    "@statelyai/model-testing": "0.2.0"
+    "@statelyai/mcp": "0.21.0",
+    "@statelyai/sdk": "0.40.0"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
     "tsdown": "0.21.0-beta.2",
     "vitest": "^3.2.4",
-    "@statelyai/api-contract": "0.9.0",
-    "@statelyai/editor-sync": "0.2.6"
+    "@statelyai/editor-sync": "0.2.7",
+    "@statelyai/api-contract": "0.10.0"
   },
   "oclif": {
     "bin": "statelyai",
@@ -45,7 +49,7 @@
     "topicSeparator": " "
   },
   "scripts": {
-    "build": "tsdown",
+    "build": "tsdown && node scripts/copy-testing-skill.mjs",
     "test": "vitest run"
   }
 }