stylegallery 0.1.0

package/scripts/test-agent-projections.mjs

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const moduleFiles = Object.freeze({
+  a2a: path.join(repositoryRoot, "scripts", "agent-native", "a2a-projection.mjs"),
+  agui: path.join(repositoryRoot, "scripts", "agent-native", "agui-projection.mjs"),
+});
+
+const domainTask = Object.freeze({
+  stableRef: "sg:task/projection-fixture",
+  taskId: "sg:task/projection-fixture",
+  state: "RUNNING",
+  runId: "sg:run/projection-fixture",
+  intent: { operation: "resolve", stableRef: "sg:profile/editorial-reference-profile" },
+  requiredResult: { type: "profile" },
+});
+const domainRun = Object.freeze({ runId: "sg:run/projection-fixture", taskId: domainTask.taskId, state: "RUNNING" });
+const protocolBinding = Object.freeze({
+  bindingId: "sg:binding/a2a-projection-fixture",
+  protocolBindingId: "sg:binding/a2a-projection-fixture",
+  protocol: "a2a",
+  taskId: domainTask.taskId,
+  runId: domainRun.runId,
+});
+const message = Object.freeze({
+  messageId: "a2a-message-projection-fixture",
+  role: "user",
+  parts: [{ kind: "text", text: "Resolve the editorial profile." }],
+});
+
+function pick(value, ...keys) {
+  if (!value || typeof value !== "object") return undefined;
+  for (const key of keys) if (Object.hasOwn(value, key)) return value[key];
+  return undefined;
+}
+
+function unwrap(value) {
+  return value?.ok === true && Object.hasOwn(value, "result") ? value.result : value;
+}
+
+function object(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function stateOf(value) {
+  const status = pick(value, "status");
+  return String(pick(status, "state", "status") ?? pick(value, "state", "taskState", "task_state") ?? "").toLowerCase();
+}
+
+function idOf(value, ...keys) {
+  return pick(value, ...keys, "id", "taskId", "task_id", "runId", "run_id", "stableRef", "stable_ref");
+}
+
+async function load(name) {
+  try {
+    return { ok: true, module: await import(pathToFileURL(moduleFiles[name]).href) };
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "kernel_module_missing",
+        module: name,
+        path: moduleFiles[name],
+        message: error instanceof Error ? error.message : String(error),
+      },
+    };
+  }
+}
+
+function findExport(loaded, names, moduleName) {
+  if (!loaded.ok) throw Object.assign(new Error(loaded.error.message), loaded.error);
+  for (const name of names) if (typeof loaded.module[name] === "function") return loaded.module[name];
+  const error = new Error(`${moduleName} must export one of ${names.join(", ")}`);
+  error.code = "kernel_export_missing";
+  error.module = moduleName;
+  throw error;
+}
+
+async function call(loaded, names, moduleName, input) {
+  const fn = findExport(loaded, names, moduleName);
+  return await fn(input);
+}
+
+function row(name, expected, actual, ok, details) {
+  return { actual, expected, name, ok, ...(details ? { details } : {}) };
+}
+
+function failure(error) {
+  return { code: error?.code ?? "projection_case_exception", message: error?.message ?? String(error), ...(error?.path ? { path: error.path } : {}) };
+}
+
+function taskProjection(value) {
+  const result = unwrap(value);
+  return pick(result, "task", "taskProjection", "task_projection") ?? result;
+}
+
+function bindingOf(value) {
+  const result = unwrap(value);
+  return pick(result, "protocolBinding", "protocol_binding", "binding") ?? {};
+}
+
+function protocolTaskId(value) {
+  const task = taskProjection(value);
+  return idOf(task, "id", "taskId", "task_id");
+}
+
+async function testA2A(loaded) {
+  const rows = [];
+  try {
+    const card = unwrap(await call(loaded, ["createAgentCard", "buildAgentCard", "projectAgentCard", "agentCard"], "a2a", { fixture: true }));
+    const capabilities = pick(card, "capabilities");
+    rows.push(row(
+      "a2a_agent_card_is_v1_shaped",
+      "Agent Card has protocolVersion, identity, URL, capabilities, input/output modes, and skills",
+      card,
+      object(card)
+        && typeof pick(card, "protocolVersion", "protocol_version") === "string"
+        && typeof pick(card, "name") === "string"
+        && typeof pick(card, "url") === "string"
+        && object(capabilities)
+        && Array.isArray(pick(card, "defaultInputModes", "default_input_modes"))
+        && Array.isArray(pick(card, "defaultOutputModes", "default_output_modes"))
+        && Array.isArray(pick(card, "skills")),
+    ));
+
+    const map = findExport(loaded, ["mapTaskState", "projectTaskState", "toA2ATaskState"], "a2a");
+    const mappings = {
+      PENDING: "submitted", RUNNING: "working", COMPLETED: "completed", FAILED: "failed",
+      CANCELED: "canceled", REJECTED: "rejected", AUTH_REQUIRED: "auth-required", UNKNOWN: "unknown",
+    };
+    const actualMappings = Object.fromEntries(Object.entries(mappings).map(([input]) => [input, map(input)]));
+    rows.push(row("a2a_task_state_mapping_is_total", "all domain terminal/intermediate states map to official A2A states", actualMappings, Object.entries(mappings).every(([input, expected]) => String(actualMappings[input]).toLowerCase() === expected)));
+
+    const send = unwrap(await call(loaded, ["sendMessage", "projectSendMessage", "handleSendMessage"], "a2a", {
+      message,
+      task: domainTask,
+      run: domainRun,
+      protocolBinding,
+    }));
+    const sentTaskId = protocolTaskId(send);
+    const sentBinding = bindingOf(send);
+    const bindingId = idOf(sentBinding, "protocolBindingId", "protocol_binding_id", "bindingId", "binding_id");
+    const boundTaskId = idOf(sentBinding, "taskId", "task_id", "domainTaskId", "domain_task_id");
+    const boundRunId = idOf(sentBinding, "runId", "run_id", "domainRunId", "domain_run_id");
+    rows.push(row(
+      "a2a_send_message_creates_distinct_protocol_binding",
+      "SendMessage returns a submitted A2A task and ProtocolBinding that does not replace domain Task/Run IDs",
+      { taskId: sentTaskId, state: stateOf(send), bindingId, boundTaskId, boundRunId },
+      object(send) && typeof sentTaskId === "string" && stateOf(send) === "submitted"
+        && typeof bindingId === "string" && bindingId !== domainTask.taskId && bindingId !== domainRun.runId
+        && boundTaskId === domainTask.taskId && boundRunId === domainRun.runId,
+    ));
+
+    const get = unwrap(await call(loaded, ["getTask", "projectGetTask", "handleGetTask"], "a2a", {
+      task: send,
+      domainTask,
+      run: domainRun,
+      protocolBinding: sentBinding,
+      taskId: sentTaskId,
+    }));
+    rows.push(row("a2a_get_task_projects_current_domain_state", "GetTask preserves protocol task identity and maps RUNNING to working", { taskId: protocolTaskId(get), state: stateOf(get) }, protocolTaskId(get) === sentTaskId && stateOf(get) === "working"));
+
+    const canceled = unwrap(await call(loaded, ["cancelTask", "projectCancelTask", "handleCancelTask"], "a2a", {
+      task: get,
+      domainTask: { ...domainTask, state: "CANCELED" },
+      run: domainRun,
+      protocolBinding: sentBinding,
+      taskId: sentTaskId,
+    }));
+    rows.push(row("a2a_cancel_task_projects_canceled", "CancelTask returns the same protocol task in canceled state", { taskId: protocolTaskId(canceled), state: stateOf(canceled) }, protocolTaskId(canceled) === sentTaskId && stateOf(canceled) === "canceled"));
+  } catch (error) {
+    rows.push(row("a2a_projection_kernel_available", "A2A projection module exports the required pure functions", failure(error), false));
+  }
+  return rows;
+}
+
+function eventType(event) {
+  return String(pick(event, "type", "eventType", "event_type", "name") ?? "").toUpperCase();
+}
+
+function eventList(value) {
+  const result = unwrap(value);
+  return Array.isArray(result) ? result : pick(result, "events", "items") ?? [];
+}
+
+async function testAGUI(loaded) {
+  const rows = [];
+  try {
+    const project = findExport(loaded, ["projectAgUiEvents", "projectAGUIEvents", "projectAguiEvents", "createAgUiEvents"], "agui");
+    const projection = await project({
+      task: domainTask,
+      run: domainRun,
+      protocolBinding: { ...protocolBinding, protocol: "ag-ui", bindingId: "sg:binding/agui-projection-fixture" },
+      text: "Editorial profile resolved.",
+      toolCall: { id: "tool-call-projection-fixture", name: "resolve", args: { stableRef: "sg:profile/editorial-reference-profile" } },
+      state: { stableRef: "sg:profile/editorial-reference-profile", status: "resolved" },
+      outcome: "COMPLETED",
+    });
+    const events = eventList(projection);
+    const types = events.map(eventType);
+    const index = (names) => types.findIndex((type) => names.includes(type));
+    const terminal = types.filter((type) => ["RUN_FINISHED", "RUN_ERROR"].includes(type));
+    const ordered = index(["RUN_STARTED"]) >= 0
+      && index(["TEXT_MESSAGE_START"]) > index(["RUN_STARTED"])
+      && index(["TEXT_MESSAGE_CONTENT"]) > index(["TEXT_MESSAGE_START"])
+      && index(["TEXT_MESSAGE_END"]) > index(["TEXT_MESSAGE_CONTENT"])
+      && index(["TOOL_CALL_START"]) > index(["TEXT_MESSAGE_END"])
+      && index(["TOOL_CALL_ARGS", "TOOL_CALL_ARGUMENTS"]) > index(["TOOL_CALL_START"])
+      && index(["TOOL_CALL_END"]) > index(["TOOL_CALL_ARGS", "TOOL_CALL_ARGUMENTS"])
+      && index(["STATE_SNAPSHOT", "STATE_DELTA"]) > index(["TOOL_CALL_END"])
+      && terminal.length === 1
+      && types.indexOf(terminal[0]) === types.length - 1;
+    rows.push(row("agui_projection_has_ordered_v057_lifecycle", "RUN, text, tool, state, then exactly one terminal event", { types }, ordered));
+
+    const validate = findExport(loaded, ["validateAgUiTransitions", "validateAGUITransitions", "assertAgUiTransitions", "validateEventSequence"], "agui");
+    let rejected = false;
+    let rejection;
+    try {
+      rejection = await validate({ events: [{ type: "RUN_FINISHED", runId: "protocol-run-fixture" }, { type: "RUN_STARTED", runId: "protocol-run-fixture" }] });
+      rejected = rejection?.ok === false || rejection?.valid === false;
+    } catch (error) {
+      rejected = true;
+      rejection = failure(error);
+    }
+    rows.push(row("agui_invalid_transition_is_rejected", "a terminal-before-start sequence is rejected before projection", rejection, rejected));
+  } catch (error) {
+    rows.push(row("agui_projection_kernel_available", "AG-UI projection module exports ordered event and transition validation functions", failure(error), false));
+  }
+  return rows;
+}
+
+async function main() {
+  const unsupported = process.argv.slice(2).filter((argument) => argument !== "--json");
+  if (unsupported.length > 0) {
+    process.stdout.write(`${JSON.stringify({ ok: false, status: "RED", failures: [{ code: "argument_unknown", message: `unknown argument ${unsupported[0]}` }], results: [] }, null, 2)}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  const modules = { a2a: await load("a2a"), agui: await load("agui") };
+  const results = [...await testA2A(modules.a2a), ...await testAGUI(modules.agui)];
+  const ok = results.every((result) => result.ok);
+  process.stdout.write(`${JSON.stringify({ ok, status: ok ? "GREEN" : "RED", modules: Object.fromEntries(Object.entries(modules).map(([name, loaded]) => [name, loaded.ok ? { ok: true } : { ok: false, error: loaded.error }])), results }, null, 2)}\n`);
+  process.exitCode = ok ? 0 : 1;
+}
+
+await main();

package/scripts/test-agent-registry-mcp-integrity.mjs

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+
+import { canonicalize } from "./agent-native/canonical-json.mjs";
+import { createStyleGalleryMcpServer } from "./agent-native/mcp-adapter.mjs";
+import { agentNativeRegistry } from "./agent-native/registry.mjs";
+
+const MUTATIONS = [
+  "effect.record",
+  "effect.reconcile",
+  "proposal.create",
+  "proposal.decide",
+  "proposal.promote",
+  "proposal.verify",
+  "run.start",
+  "task.create",
+];
+const PROFILE_REF = "sg:profile/editorial-reference-profile";
+
+function result(name, expected, actual, ok) {
+  return { actual, expected, name, ok };
+}
+
+function equal(left, right) {
+  return canonicalize(left) === canonicalize(right);
+}
+
+function envelope(response) {
+  if (response?.structuredContent && typeof response.structuredContent === "object") return response.structuredContent;
+  const text = response?.content?.find((item) => item?.type === "text")?.text;
+  try { return JSON.parse(text); } catch { return null; }
+}
+
+async function connected(registry = agentNativeRegistry) {
+  const server = createStyleGalleryMcpServer({ registry });
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  const client = new Client({ name: "stylegallery-registry-mcp-integrity", version: "1.0.0" });
+  await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+  return { client, server };
+}
+
+async function close(connection) {
+  await connection.client.close().catch(() => {});
+  const closed = connection.server.close?.();
+  if (closed && typeof closed.catch === "function") await closed.catch(() => {});
+}
+
+async function rejected(action) {
+  try {
+    const response = await action();
+    return { error: null, response };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error), response: null };
+  }
+}
+
+async function main() {
+  const results = [];
+  const names = agentNativeRegistry.operations.map((operation) => operation.name).sort();
+  const missingMutations = MUTATIONS.filter((name) => !names.includes(name));
+  results.push(result(
+    "common_registry_contains_governed_mutations",
+    "proposal, task, run, effect recording, and effect reconciliation operations exist in the common registry",
+    { missingMutations, names },
+    missingMutations.length === 0,
+  ));
+
+  const invalidMetadata = agentNativeRegistry.operations
+    .filter((operation) => typeof operation.read_only !== "boolean"
+      || (operation.read_only === true && operation.effect_class !== "NONE"))
+    .map((operation) => ({ effect_class: operation.effect_class, name: operation.name, read_only: operation.read_only }));
+  const registryReads = agentNativeRegistry.operations.filter((operation) => operation.read_only === true).map((operation) => operation.name).sort();
+  results.push(result(
+    "registry_read_only_metadata_is_closed",
+    "every operation declares read_only and no effectful operation is read-only",
+    { invalidMetadata, registryReads },
+    invalidMetadata.length === 0 && registryReads.length > 0,
+  ));
+
+  for (const name of MUTATIONS.filter((item) => names.includes(item))) {
+    const invoked = agentNativeRegistry.invoke(name, {});
+    const codes = (invoked.failures ?? []).map((failure) => failure.code);
+    results.push(result(
+      `registered_handler_${name}`,
+      "the registered mutation reaches its schema or handler instead of operation_unknown",
+      invoked,
+      invoked.operation === name && !codes.includes("operation_unknown"),
+    ));
+  }
+
+  const connection = await connected();
+  try {
+    const tools = (await connection.client.listTools()).tools.map((tool) => tool.name).sort();
+    results.push(result(
+      "mcp_tools_derive_from_registry_read_only",
+      registryReads,
+      tools,
+      equal(tools, registryReads),
+    ));
+
+    const mutationCalls = [];
+    for (const name of MUTATIONS) {
+      const observed = await rejected(() => connection.client.callTool({ name, arguments: {} }));
+      const body = envelope(observed.response);
+      mutationCalls.push({ error: observed.error, isError: observed.response?.isError, name, body });
+    }
+    results.push(result(
+      "existing_mutations_are_not_mcp_tools",
+      "every mutation that exists in the registry is absent from MCP and denied on direct call",
+      mutationCalls,
+      mutationCalls.every((call) => !tools.includes(call.name)
+        && (call.error !== null || (call.isError === true && call.body?.failures?.[0]?.code === "operation_not_exposed"))),
+    ));
+
+    const templates = (await connection.client.listResourceTemplates()).resourceTemplates ?? [];
+    const template = templates.find((item) => item.uriTemplate === "sg://object/{reference}");
+    results.push(result(
+      "object_resource_template_is_discoverable",
+      "sg://object/{reference} is advertised",
+      templates,
+      Boolean(template),
+    ));
+
+    const objectUri = `sg://object/${encodeURIComponent(PROFILE_REF)}`;
+    const resources = (await connection.client.listResources()).resources ?? [];
+    const listed = resources.some((resource) => resource.uri === objectUri);
+    const resource = await rejected(() => connection.client.readResource({ uri: objectUri }));
+    const text = resource.response?.contents?.find((item) => item.uri === objectUri)?.text;
+    let parsed = null;
+    try { parsed = JSON.parse(text); } catch { /* asserted below */ }
+    const resolved = agentNativeRegistry.invoke("resolve", { reference: PROFILE_REF });
+    results.push(result(
+      "object_resource_uses_registry_resolver",
+      "the listed encoded object URI returns the exact registry resolve payload",
+      { error: resource.error, listed, parsed, resolved },
+      listed && resource.error === null && resolved.ok === true && equal(parsed, resolved.result),
+    ));
+
+    const unknown = await rejected(() => connection.client.readResource({
+      uri: `sg://object/${encodeURIComponent("sg:profile/does-not-exist")}`,
+    }));
+    const malformed = await rejected(() => connection.client.readResource({ uri: "sg://object/%E0%A4%A" }));
+    const versionId = resolved.ok ? resolved.result.version_id : "";
+    const versioned = await rejected(() => connection.client.readResource({
+      uri: `sg://object/${encodeURIComponent(versionId)}`,
+    }));
+    results.push(result(
+      "object_resource_accepts_only_encoded_stable_refs",
+      "unknown, malformed, and VersionID object references are rejected",
+      { malformed, unknown, versioned },
+      unknown.error !== null && malformed.error !== null && versioned.error !== null,
+    ));
+  } finally {
+    await close(connection);
+  }
+
+  const dynamicName = "diagnostics.snapshot";
+  const dynamicOperation = Object.freeze({
+    adapters: [], description: "Dynamically registered read projection.", effect_class: "NONE",
+    idempotent: true, input_schema: { additionalProperties: false, type: "object" },
+    name: dynamicName, output_schema: { type: "object" }, read_only: true,
+    record_kind: "operation", stable_ref: "sg:operation/diagnostics-snapshot",
+  });
+  const dynamicRegistry = Object.freeze({
+    ...agentNativeRegistry,
+    invoke: (name, input = {}) => name === dynamicName
+      ? Object.freeze({ ok: true, operation: name, result: Object.freeze({ input, source: "dynamic-registry" }) })
+      : agentNativeRegistry.invoke(name, input),
+    operations: Object.freeze([...agentNativeRegistry.operations, dynamicOperation]),
+  });
+  const dynamic = await connected(dynamicRegistry);
+  try {
+    const namesFromMcp = (await dynamic.client.listTools()).tools.map((tool) => tool.name);
+    const called = await dynamic.client.callTool({ name: dynamicName, arguments: {} });
+    results.push(result(
+      "new_read_operation_needs_no_adapter_allowlist_change",
+      "a new read_only registry operation is automatically listed and callable",
+      { called: envelope(called), namesFromMcp },
+      namesFromMcp.includes(dynamicName) && envelope(called)?.ok === true,
+    ));
+  } finally {
+    await close(dynamic);
+  }
+
+  const contradictoryRegistry = {
+    ...agentNativeRegistry,
+    operations: [...agentNativeRegistry.operations, {
+      ...dynamicOperation,
+      effect_class: "EXTERNAL",
+      name: "diagnostics.unsafe",
+      stable_ref: "sg:operation/diagnostics-unsafe",
+    }],
+  };
+  let contradiction;
+  try { createStyleGalleryMcpServer({ registry: contradictoryRegistry }); } catch (error) {
+    contradiction = error instanceof Error ? error.message : String(error);
+  }
+  results.push(result(
+    "contradictory_read_only_effect_metadata_is_rejected",
+    "read_only:true cannot disguise an EXTERNAL operation",
+    { contradiction },
+    typeof contradiction === "string" && contradiction.includes("cannot expose EXTERNAL effects as read-only"),
+  ));
+
+  const report = { ok: results.every((item) => item.ok), results };
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  process.exitCode = report.ok ? 0 : 1;
+}
+
+await main().catch((error) => {
+  process.stdout.write(`${JSON.stringify({ ok: false, results: [result("registry_mcp_integrity_runtime", "structured report", error instanceof Error ? error.message : String(error), false)] }, null, 2)}\n`);
+  process.exitCode = 1;
+});

package/scripts/test-agent-registry-mutations.mjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+
+import { agentNativeRegistry as registry } from "./agent-native/registry.mjs";
+
+function result(name, expected, actual, ok) {
+  return { actual, expected, name, ok };
+}
+
+function invoke(name, input) {
+  const response = registry.invoke(name, input);
+  return { name, response };
+}
+
+const claim = registry.fixture.records.find((record) => record.stable_ref === "sg:claim/editorial-profile-addressable");
+const proposal = invoke("proposal.create", {
+  changes: [{ op: "replace", path: "/rank", value: 1 }],
+  claim,
+  evidence: [{
+    independence_group: "registry-proposal-source",
+    polarity: "SUPPORT",
+    source_ref: "sg:artifact/editorial-profile-source",
+    stable_ref: "sg:evidence/registry-proposal-source",
+  }],
+  proposer: "agent:registry-proposer",
+  stable_ref: "sg:proposal/registry-invocation-fixture",
+  validation: { status: "PASS", validator: "validator:proposal", validator_version: "1" },
+});
+const verification = invoke("proposal.verify", {
+  evidence: [{
+    independence_group: "registry-independent-source",
+    polarity: "SUPPORT",
+    source_ref: "sg:artifact/editorial-profile-source",
+    stable_ref: "sg:evidence/registry-independent-source",
+  }],
+  proposal: proposal.response.result,
+  validation: { status: "PASS", validator: "validator:independent", validator_version: "1" },
+  verifier: "agent:registry-verifier",
+});
+const decision = invoke("proposal.decide", {
+  governance_decision: {
+    actor: "governor:stylegallery",
+    decided_at: "2026-07-23T00:00:00.000Z",
+    decision: "ACCEPT",
+  },
+  proposal: proposal.response.result,
+  verification: verification.response.result,
+});
+const promotion = invoke("proposal.promote", {
+  governance_decision: decision.response.result,
+  proposal: proposal.response.result,
+  target_stable_ref: "sg:profile/editorial-reference-profile",
+  verification: verification.response.result,
+});
+
+const task = invoke("task.create", {
+  intent: { operation: "resolve" },
+  required_result: { ok: true },
+  stable_ref: "sg:task/registry-invocation-fixture",
+});
+const run = invoke("run.start", {
+  input: { reference: "sg:profile/editorial-reference-profile" },
+  stable_ref: "sg:run/registry-invocation-fixture",
+  task: task.response.result,
+});
+const effect = invoke("effect.record", {
+  effect_class: "EXTERNAL",
+  run_id: run.response.result?.run_id,
+  stable_ref: "sg:effect/registry-invocation-fixture",
+  task_id: task.response.result?.task_id,
+});
+const reconciliation = invoke("effect.reconcile", {
+  effect: effect.response.result,
+  observations: [{ connector_receipt: "sg:receipt/connector-fixture", status: "COMMITTED" }],
+});
+
+const mutations = [proposal, verification, decision, promotion, task, run, effect, reconciliation];
+const results = [
+  result(
+    "governed_learning_chain_is_invokable_from_common_registry",
+    "PROPOSED -> VERIFIED -> ACCEPT -> PROMOTED",
+    mutations.slice(0, 4).map(({ name, response }) => ({ name, ok: response.ok, status: response.result?.status })),
+    proposal.response.ok && verification.response.ok && decision.response.ok && promotion.response.ok
+      && proposal.response.result.status === "PROPOSED"
+      && verification.response.result.status === "VERIFIED"
+      && decision.response.result.status === "ACCEPT"
+      && promotion.response.result.status === "PROMOTED",
+  ),
+  result(
+    "task_run_effect_reconciliation_is_invokable_from_common_registry",
+    "SUBMITTED -> RUNNING -> UNCERTAIN -> COMMITTED",
+    mutations.slice(4).map(({ name, response }) => ({ name, ok: response.ok, state: response.result?.state })),
+    task.response.ok && run.response.ok && effect.response.ok && reconciliation.response.ok
+      && task.response.result.state === "SUBMITTED"
+      && run.response.result.state === "RUNNING"
+      && effect.response.result.state === "UNCERTAIN"
+      && reconciliation.response.result.state === "COMMITTED",
+  ),
+  result(
+    "invokable_mutations_remain_internal",
+    "all eight invoked operations declare read_only:false and omit MCP adapter exposure",
+    registry.operations.filter((operation) => mutations.some((item) => item.name === operation.name))
+      .map((operation) => ({ adapters: operation.adapters, name: operation.name, read_only: operation.read_only })),
+    registry.operations.filter((operation) => mutations.some((item) => item.name === operation.name))
+      .every((operation) => operation.read_only === false && !operation.adapters.includes("mcp")),
+  ),
+];
+
+const report = { ok: results.every((item) => item.ok), results };
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+process.exitCode = report.ok ? 0 : 1;