substrate-ai 0.21.9 → 0.21.11

package/dist/{manifest-read-qsNEHEaF.js → manifest-read-BGzmmY01.js}

@@ -1,17 +1,18 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { LEARNING_FINDING, createDecision, getDecisionsByCategory } from "./dist-CO4BbTu3.js";
+import { LEARNING_FINDING, createDecision, getDecisionsByCategory } from "./dist-BZGqn-XQ.js";
 import * as path$1 from "path";
 import { join } from "path";
 import { readFile } from "fs/promises";
 import { EventEmitter } from "node:events";
 import { YAMLException, load } from "js-yaml";
-import { existsSync, promises, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, promises, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { execSync, spawn } from "node:child_process";
 import * as path$2 from "node:path";
 import { basename as basename$1, delimiter, dirname as dirname$1, join as join$1, relative, resolve as resolve$1 } from "node:path";
+import { tmpdir } from "node:os";
 import { createHash } from "node:crypto";
 import { z } from "zod";
-import { mkdir as mkdir$1, open, readFile as readFile$1, readdir as readdir$1, unlink as unlink$1, writeFile as writeFile$1 } from "node:fs/promises";
+import { mkdir as mkdir$1, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, rm, unlink as unlink$1, writeFile as writeFile$1 } from "node:fs/promises";
 import * as fs from "fs";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
@@ -2679,6 +2680,15 @@ const JourneyRegistrySchema = z.object({
 }).superRefine((registry, ctx) => {
 	const seenJourneyIds = new Map();
 	registry.journeys.forEach((journey, i) => {
+		if (journey.criticality === "critical" && journey.epic === void 0) ctx.addIssue({
+			code: "custom",
+			path: [
+				"journeys",
+				i,
+				"epic"
+			],
+			message: `critical journey "${journey.id}" must declare an epic — it is the blocking-audit boundary; without it the journey is only reported at run end, never enforced`
+		});
 		const firstIndex = seenJourneyIds.get(journey.id);
 		if (firstIndex !== void 0) ctx.addIssue({
 			code: "custom",
@@ -5747,6 +5757,259 @@ ${rows}
 `;
 }
 
+//#endregion
+//#region packages/sdlc/dist/acceptance/gate-state.js
+/** Repo-relative path of the operator-local gate state. */
+const GATE_STATE_PATH = ".substrate/acceptance/gate-state.json";
+const GateStateSchema = z.object({
+	demoted: z.boolean(),
+	reason: z.string(),
+	since: z.string(),
+	detail: z.string().optional()
+});
+/** Read the demotion overlay. Absent/unreadable/invalid → not demoted. */
+function readGateState(projectRoot) {
+	const path$3 = join$1(projectRoot, GATE_STATE_PATH);
+	if (!existsSync(path$3)) return void 0;
+	try {
+		const parsed = GateStateSchema.safeParse(JSON.parse(readFileSync(path$3, "utf-8")));
+		return parsed.success ? parsed.data : void 0;
+	} catch {
+		return void 0;
+	}
+}
+/** Is the gate currently auto-demoted (blocking authority suspended)? */
+function isGateDemoted(projectRoot) {
+	return readGateState(projectRoot)?.demoted === true;
+}
+/** Write the demotion overlay (canary miss / precision breach). Idempotent. */
+function demoteGate(projectRoot, reason, detail) {
+	const state = {
+		demoted: true,
+		reason,
+		since: new Date().toISOString(),
+		...detail !== void 0 ? { detail } : {}
+	};
+	const path$3 = join$1(projectRoot, GATE_STATE_PATH);
+	mkdirSync(dirname$1(path$3), { recursive: true });
+	writeFileSync(path$3, JSON.stringify(state, null, 2) + "\n", "utf-8");
+	return state;
+}
+/** Operator clears the demotion (after diagnosing the miss/precision issue). */
+function clearGateDemotion(projectRoot) {
+	const path$3 = join$1(projectRoot, GATE_STATE_PATH);
+	if (!existsSync(path$3)) return false;
+	rmSync(path$3, { force: true });
+	return true;
+}
+/**
+* Resolve the EFFECTIVE acceptance mode: a demoted gate can never be
+* `blocking`, no matter what the config says. `off` stays off.
+*/
+function effectiveAcceptanceMode(configured, projectRoot) {
+	if (configured === "off") return "off";
+	if (configured === "blocking" && isGateDemoted(projectRoot)) return "advisory";
+	return configured;
+}
+
+//#endregion
+//#region packages/sdlc/dist/acceptance/canary.js
+function git(args, cwd) {
+	return new Promise((resolve$2) => {
+		let stderr = "";
+		const proc = spawn("git", args, {
+			cwd,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			]
+		});
+		proc.stderr?.on("data", (c) => stderr += c.toString("utf-8"));
+		proc.on("error", (err) => resolve$2({
+			code: null,
+			stderr,
+			spawnError: err.message
+		}));
+		proc.on("close", (code) => resolve$2({
+			code,
+			stderr
+		}));
+	});
+}
+/**
+* Run one canary. Clones the repo into a scratch dir, reverts the wiring
+* commit(s), renders the journey's non-web surfaces, judges, and reports
+* whether the verdict flipped away from all-PASS.
+*
+* `caught: false` with `inconclusive: false` is the alarming case — the gate
+* rated a de-wired journey as passing. Setup failures (revert conflict, render
+* error, judge error) are `inconclusive: true` and are NOT treated as misses
+* (they mean "couldn't test", not "gate is blind").
+*/
+async function runCanary(opts) {
+	const { repoRoot, journey, contract, wiringCommits, judge } = opts;
+	const scratch = await mkdtemp(join$1(tmpdir(), "substrate-canary-"));
+	try {
+		const clone = await git([
+			"clone",
+			"--quiet",
+			"--no-hardlinks",
+			repoRoot,
+			scratch
+		], tmpdir());
+		if (clone.code !== 0) return {
+			journeyId: journey.id,
+			caught: false,
+			inconclusive: true,
+			detail: `clone failed: ${clone.stderr.trim() || clone.spawnError || "unknown"}`
+		};
+		await git([
+			"config",
+			"user.email",
+			"canary@local"
+		], scratch);
+		await git([
+			"config",
+			"user.name",
+			"canary"
+		], scratch);
+		for (const sha of wiringCommits) {
+			const rev = await git([
+				"revert",
+				"--no-edit",
+				sha
+			], scratch);
+			if (rev.code !== 0) return {
+				journeyId: journey.id,
+				caught: false,
+				inconclusive: true,
+				detail: `git revert ${sha} failed (conflict?): ${rev.stderr.trim().slice(0, 300)}`
+			};
+		}
+		const artifactsDir = join$1(scratch, ".canary-artifacts");
+		const artifacts = [];
+		for (const surface of journey.surfaces) {
+			if (surface === "web") continue;
+			if (contract.surfaces[surface] === void 0) continue;
+			const res = await renderSurface({
+				surface,
+				contract,
+				workingDirectory: scratch,
+				artifactsDir: join$1(artifactsDir, surface)
+			});
+			if (res.status === "rendered") artifacts.push(...res.artifacts.map((a) => join$1(surface, a)));
+		}
+		if (artifacts.length === 0) return {
+			journeyId: journey.id,
+			caught: true,
+			detail: "no surfaces rendered after reverting the wiring commit — journey is structurally unreachable (caught)"
+		};
+		const judged = await judge(journey, artifactsDir, artifacts);
+		if (!judged.ok) return {
+			journeyId: journey.id,
+			caught: false,
+			inconclusive: true,
+			detail: `judge error: ${judged.error}`
+		};
+		const allPass = judged.verdicts.length > 0 && judged.verdicts.every((v) => v.verdict === "PASS");
+		return {
+			journeyId: journey.id,
+			caught: !allPass,
+			detail: allPass ? "MISS: judge still rated every end-state PASS after the wiring was reverted — the gate is blind to this journey" : `caught: verdict flipped to ${judged.verdicts.map((v) => `${v.end_state_id}=${v.verdict}`).join(", ")}`,
+			postRevertVerdicts: judged.verdicts
+		};
+	} finally {
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+
+//#endregion
+//#region packages/sdlc/dist/acceptance/precision.js
+const ACCEPTANCE_METRICS_PATH = ".substrate/acceptance/metrics.json";
+const AcceptanceMetricsSchema = z.object({
+	total_fails: z.number().int().nonnegative().default(0),
+	overrides: z.array(z.object({
+		story: z.string(),
+		reason: z.string(),
+		at: z.string()
+	})).default([]),
+	canaries_planted: z.number().int().nonnegative().default(0),
+	canaries_caught: z.number().int().nonnegative().default(0)
+});
+const EMPTY = {
+	total_fails: 0,
+	overrides: [],
+	canaries_planted: 0,
+	canaries_caught: 0
+};
+function readAcceptanceMetrics(projectRoot) {
+	const path$3 = join$1(projectRoot, ACCEPTANCE_METRICS_PATH);
+	if (!existsSync(path$3)) return { ...EMPTY };
+	try {
+		const parsed = AcceptanceMetricsSchema.safeParse(JSON.parse(readFileSync(path$3, "utf-8")));
+		return parsed.success ? parsed.data : { ...EMPTY };
+	} catch {
+		return { ...EMPTY };
+	}
+}
+function writeMetrics(projectRoot, m) {
+	const path$3 = join$1(projectRoot, ACCEPTANCE_METRICS_PATH);
+	mkdirSync(dirname$1(path$3), { recursive: true });
+	writeFileSync(path$3, JSON.stringify(m, null, 2) + "\n", "utf-8");
+}
+/** Precision = confirmed-fails / total-fails. 1.0 when no fails yet (nothing to be wrong about). */
+function computePrecision(m) {
+	if (m.total_fails === 0) return 1;
+	const confirmed = Math.max(0, m.total_fails - m.overrides.length);
+	return confirmed / m.total_fails;
+}
+/** Recall = caught / planted. 1.0 when no canaries run yet. */
+function computeRecall(m) {
+	if (m.canaries_planted === 0) return 1;
+	return m.canaries_caught / m.canaries_planted;
+}
+/** A6.2: the gate blocked a journey-critical FAIL — count it (precision denominator). */
+function recordCriticalFail(projectRoot) {
+	const m = readAcceptanceMetrics(projectRoot);
+	m.total_fails += 1;
+	writeMetrics(projectRoot, m);
+}
+/** A6.1: record a canary outcome (recall). */
+function recordCanary(projectRoot, caught) {
+	const m = readAcceptanceMetrics(projectRoot);
+	m.canaries_planted += 1;
+	if (caught) m.canaries_caught += 1;
+	writeMetrics(projectRoot, m);
+}
+/**
+* A6.2 AC1: record an operator override of a FAIL verdict, then re-check the
+* precision floor. Below floor → auto-demote (AC2).
+*/
+function recordOverride(projectRoot, story, reason, precisionFloor) {
+	const m = readAcceptanceMetrics(projectRoot);
+	m.overrides.push({
+		story,
+		reason,
+		at: new Date().toISOString()
+	});
+	writeMetrics(projectRoot, m);
+	const precision = computePrecision(m);
+	let demoted = false;
+	if (m.total_fails >= 3 && precision < precisionFloor) {
+		demoteGate(projectRoot, "precision-floor", `verdict precision ${precision.toFixed(2)} < floor ${precisionFloor.toFixed(2)} (${m.overrides.length} overrides / ${String(m.total_fails)} blocks)`);
+		demoted = true;
+	}
+	return {
+		metrics: m,
+		precision,
+		demoted
+	};
+}
+
 //#endregion
 //#region packages/sdlc/dist/run-model/cli-flags.js
 /**
@@ -7191,5 +7454,5 @@ async function resolveRunManifest(dbRoot, runId) {
 }
 
 //#endregion
-export { ACCEPTANCE_CONTRACT_PROFILE_PATH, FindingsInjector, JOURNEY_DEFERRALS_PATH, JOURNEY_REGISTRY_PATH, RunManifest, RuntimeProbeListSchema, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, applyConfigToGraph, computeJourneyCoverage, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, loadAcceptanceContractFromTrustedTree, loadJourneyDeferralsFromTrustedTree, loadJourneyRegistryFromFile, loadJourneyRegistryFromTrustedTree, parseAcceptanceContract, parseJourneyDeferrals, parseJourneyRegistry, parseRuntimeProbes, parseStoryFrontmatter, readCurrentRunId, renderFindings, renderSurface, renderVerdictHtml, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck, runStaleVerificationRecovery, summarizeCoverage };
-//# sourceMappingURL=manifest-read-qsNEHEaF.js.map
+export { ACCEPTANCE_CONTRACT_PROFILE_PATH, FindingsInjector, JOURNEY_DEFERRALS_PATH, JOURNEY_REGISTRY_PATH, RunManifest, RuntimeProbeListSchema, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, applyConfigToGraph, clearGateDemotion, computeJourneyCoverage, computePrecision, computeRecall, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, demoteGate, detectsEventDrivenAC, detectsStateIntegratingAC, effectiveAcceptanceMode, extractTargetFilesFromStoryContent, loadAcceptanceContractFromTrustedTree, loadJourneyDeferralsFromTrustedTree, loadJourneyRegistryFromFile, loadJourneyRegistryFromTrustedTree, parseAcceptanceContract, parseJourneyDeferrals, parseJourneyRegistry, parseRuntimeProbes, parseStoryFrontmatter, readAcceptanceMetrics, readCurrentRunId, readGateState, recordCanary, recordCriticalFail, recordOverride, renderFindings, renderSurface, renderVerdictHtml, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck, runCanary, runStaleVerificationRecovery, summarizeCoverage };
+//# sourceMappingURL=manifest-read-BGzmmY01.js.map

package/dist/modules/interactive-prompt/index.js

@@ -1,6 +1,6 @@
 import "../../logger-KeHncl-f.js";
-import "../../dist-CO4BbTu3.js";
-import "../../manifest-read-qsNEHEaF.js";
-import { runInteractivePrompt } from "../../interactive-prompt-qTo2iuop.js";
+import "../../dist-BZGqn-XQ.js";
+import "../../manifest-read-BGzmmY01.js";
+import { runInteractivePrompt } from "../../interactive-prompt-BvHUcoY4.js";
 
 export { runInteractivePrompt };

package/dist/{recovery-engine-BKGBeBnW.js → recovery-engine-dtLHyV4M.js}

@@ -1,5 +1,5 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { WorkGraphRepository } from "./work-graph-repository-DZyJv5pV.js";
+import { WorkGraphRepository } from "./work-graph-repository-4cKsf8Lf.js";
 import { randomUUID } from "node:crypto";
 
 //#region src/modules/recovery-engine/index.ts
@@ -278,4 +278,4 @@ function buildSuggestedAction(rootCause, storyKey) {
 
 //#endregion
 export { classifyRecoveryAction, runRecoveryEngine };
-//# sourceMappingURL=recovery-engine-BKGBeBnW.js.map
+//# sourceMappingURL=recovery-engine-dtLHyV4M.js.map

package/dist/{routing-Bet3Iu2w.js → routing-BcnHtKAm.js}

@@ -1,4 +1,4 @@
-import { ModelRoutingConfigSchema, ProviderPolicySchema, RoutingConfigError, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, TASK_TYPE_PHASE_MAP, getModelTier, loadModelRoutingConfig } from "./dist-CO4BbTu3.js";
-import "./routing-DFxoKHDt.js";
+import { ModelRoutingConfigSchema, ProviderPolicySchema, RoutingConfigError, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, TASK_TYPE_PHASE_MAP, getModelTier, loadModelRoutingConfig } from "./dist-BZGqn-XQ.js";
+import "./routing-DZT5PN3N.js";
 
 export { loadModelRoutingConfig };