switchboard-cli 0.1.0-alpha.3 → 0.1.0-alpha.5

package/src/commands/audit-codex.ts

@@ -1,266 +0,0 @@
-/**
- * switchboard audit codex
- *
- * Generates a Codex audit packet from the latest dispatch + return + receipt.
- * This is a packet-generation surface — it prepares audit context for Codex
- * but does not execute the Codex transport.
- *
- * Uses existing @switchboard/core: shouldRequireAudit, computeAuditResult,
- * formatDispatchPacket.
- *
- * Does not require the hosted web app or Supabase.
- */
-
-import { randomBytes } from "crypto";
-import { existsSync } from "fs";
-import { join } from "path";
-import type { Command } from "commander";
-import {
-  shouldRequireAudit,
-  computeAuditResult,
-  noAuditRequired,
-  parseStructuredReturn,
-  formatDispatchPacket,
-  type Surface,
-} from "@switchboard/core";
-import { requireRepoRoot, packetsDir, returnsDir, sbDir } from "../lib/paths";
-import { readMarkdown, readYaml } from "../lib/yaml-io";
-import {
-  loadContract,
-  loadCurrentState,
-  loadReceiptByDispatch,
-  loadLatestReceipt,
-  loadSpec,
-  writePacket,
-} from "../store/filesystem-store";
-import * as out from "../lib/output";
-import { withCliErrors } from "../lib/errors";
-import { detectCodexTransport, executeCodexTransport } from "../lib/transport";
-import { captureTranscriptProof, buildAndWriteProofManifest } from "../lib/proof";
-
-export function registerAuditCodexCommand(program: Command): void {
-  program
-    .command("audit")
-    .argument("<surface>", "Audit surface: codex")
-    .description("Generate an audit packet for Codex review")
-    .action(withCliErrors(async (surfaceArg: string) => {
-      if (surfaceArg !== "codex") {
-        out.fail(`Wave 2 audit only supports 'codex'. Got: "${surfaceArg}"`);
-        process.exitCode = 1;
-        return;
-      }
-
-      const repoRoot = requireRepoRoot();
-
-      out.heading("switchboard audit codex");
-
-      // 1. Load state
-      const contract = loadContract(repoRoot);
-      const current = loadCurrentState(repoRoot);
-      const spec = loadSpec(repoRoot) ?? "";
-
-      // 2. Anchor to latest-ingest.yaml — the governed ingest pointer.
-      //    This ensures the audit targets the exact dispatch that was
-      //    ingested, not a stale handoff or un-ingested dispatch.
-      const pointerPath = join(sbDir(repoRoot), "working", "latest-ingest.yaml");
-      const pointer = readYaml<{
-        dispatch_id?: string;
-        has_proof_manifest?: boolean;
-        proof_manifest_id?: string;
-      }>(pointerPath);
-
-      if (!pointer?.dispatch_id) {
-        out.fail("No ingested dispatch found. Run the full loop first:");
-        out.bullet("switchboard run claude → switchboard ingest → switchboard audit codex");
-        process.exitCode = 1;
-        return;
-      }
-
-      const dispatchId = pointer.dispatch_id;
-      out.section("Auditing dispatch", dispatchId);
-
-      // 3. Load the return data for the ingested dispatch
-      const returnPath = join(returnsDir(repoRoot), `${dispatchId}-return.yaml`);
-      const rawReturn = readMarkdown(returnPath);
-
-      if (!rawReturn) {
-        out.fail(`No return data for dispatch ${dispatchId}. The ingest pointer exists but the return file is missing.`);
-        process.exitCode = 1;
-        return;
-      }
-
-      const report = parseStructuredReturn(rawReturn);
-      out.success(`Loaded return: ${report.status}, ${report.changed_files.length} file(s)`);
-
-      // 4. Run audit check
-      const auditCheck = shouldRequireAudit({
-        report,
-        complexityMode: null,
-        taskType: "implementation-request",
-      });
-
-      const audit = auditCheck.required
-        ? computeAuditResult({ report, triggers: auditCheck.triggers, returnId: dispatchId })
-        : noAuditRequired(dispatchId);
-
-      out.section("Audit required", audit.audit_required ? "yes" : "no");
-      out.section("Outcome", audit.outcome);
-
-      if (audit.findings.length > 0) {
-        for (const f of audit.findings) {
-          const icon = f.severity === "blocker" ? "BLOCKED" : "CAUTION";
-          out.bullet(`[${icon}] ${f.check}: ${f.detail}`);
-        }
-      }
-
-      // 5. Load receipt for this dispatch by scanning receipt files for matching dispatch_id
-      let receipt = loadReceiptByDispatch(repoRoot, dispatchId);
-      if (!receipt) {
-        // Fallback to latest, but warn if it belongs to a different dispatch
-        receipt = loadLatestReceipt(repoRoot);
-        if (receipt && (receipt as any).dispatch_id !== dispatchId) {
-          out.warn(`Latest receipt belongs to dispatch ${(receipt as any).dispatch_id}, not ${dispatchId}. Using for context only.`);
-        }
-      }
-
-      // 6. Generate the Codex audit packet
-      const auditDispatchId = `codex-audit-${randomBytes(6).toString("hex")}`;
-      const auditPromptSections: string[] = [];
-
-      auditPromptSections.push("# Codex Audit Packet\n");
-      auditPromptSections.push(`**Project:** ${contract.title}`);
-      auditPromptSections.push(`**Dispatch:** ${dispatchId}`);
-      auditPromptSections.push(`**Return status:** ${report.status}`);
-      auditPromptSections.push(`**Objective met:** ${report.objective_met}\n`);
-
-      auditPromptSections.push("## Audit Findings\n");
-      if (audit.findings.length === 0) {
-        auditPromptSections.push("No audit findings.\n");
-      } else {
-        for (const f of audit.findings) {
-          auditPromptSections.push(`- **[${f.severity}]** ${f.check}: ${f.detail}`);
-          if (f.files_affected.length > 0) {
-            auditPromptSections.push(`  Files: ${f.files_affected.join(", ")}`);
-          }
-        }
-      }
-
-      auditPromptSections.push("\n## Changed Files\n");
-      for (const f of report.changed_files) {
-        auditPromptSections.push(`- ${f}`);
-      }
-
-      auditPromptSections.push("\n## Verification Runs\n");
-      if (report.verification_run.length === 0) {
-        auditPromptSections.push("None reported.\n");
-      } else {
-        for (const v of report.verification_run) {
-          auditPromptSections.push(`- ${v}`);
-        }
-      }
-
-      auditPromptSections.push("\n## Evidence\n");
-      if (report.evidence.length === 0) {
-        auditPromptSections.push("None reported.\n");
-      } else {
-        for (const e of report.evidence) {
-          auditPromptSections.push(`- ${e}`);
-        }
-      }
-
-      auditPromptSections.push("\n## Return Summary\n");
-      auditPromptSections.push(report.summary);
-
-      if (receipt) {
-        auditPromptSections.push("\n## Receipt Context\n");
-        auditPromptSections.push(`- Receipt ID: ${receipt.receipt_id}`);
-        const verdict = (receipt as any).issuance_assessment?.verdict ?? (receipt as any).trust_posture ?? "unknown";
-        auditPromptSections.push(`- Verdict: ${verdict}`);
-        auditPromptSections.push(`- Trust posture: ${(receipt as any).trust_posture ?? "unknown"}`);
-        auditPromptSections.push(`- Residuals: ${(receipt as any).residual_count ?? 0}`);
-      }
-
-      auditPromptSections.push("\n---\n");
-      auditPromptSections.push("## Audit Instructions\n");
-      auditPromptSections.push("Review the changed files against the audit findings.");
-      auditPromptSections.push("Verify that sensitive systems (auth, payment, migration) have adequate testing.");
-      auditPromptSections.push("Report any additional concerns not caught by the pattern-based audit.");
-
-      const auditContent = auditPromptSections.join("\n");
-
-      // 7. Write the audit packet
-      const timestamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-      const filename = `codex-audit-${timestamp}-${auditDispatchId.slice(12)}.md`;
-
-      const packetContent = [
-        "---",
-        `dispatch_id: ${auditDispatchId}`,
-        `surface: codex`,
-        `audit_for_dispatch: ${dispatchId}`,
-        `generated_at: ${new Date().toISOString()}`,
-        "---\n",
-        auditContent,
-      ].join("\n");
-
-      const packetPath = writePacket(repoRoot, filename, packetContent);
-      out.fileWritten("Codex audit packet", packetPath);
-
-      out.heading("Audit packet ready");
-      out.section("Audit dispatch", auditDispatchId);
-      out.section("Systems audited", audit.systems_audited.join(", ") || "baseline only");
-
-      // 8. Attempt automatic Codex transport
-      const transport = detectCodexTransport();
-      out.section("Transport", `${transport.status} — ${transport.detail}`);
-
-      if (transport.status !== "ready") {
-        if (transport.status === "no-cli") {
-          out.warn("Codex CLI not found — falling back to manual audit.");
-          out.info("To enable automatic audit:");
-          out.bullet("  npm install -g @openai/codex");
-        } else if (transport.status === "cli-error") {
-          out.warn(`Codex CLI found but not invocable: ${transport.detail}`);
-        } else {
-          out.warn(`Transport not ready: ${transport.detail}`);
-        }
-        out.bullet("Send the audit packet to Codex for independent review");
-        return;
-      }
-
-      // Transport ready — execute via Codex CLI (read-only review)
-      const auditTitle = `Switchboard audit for dispatch ${dispatchId} — ${contract.title}`;
-      out.info("Executing audit via Codex CLI (codex review --uncommitted)...");
-      const result = executeCodexTransport(transport.cli_path!, auditTitle, repoRoot);
-
-      // Capture audit transcript as proof and rebuild manifest
-      captureTranscriptProof(repoRoot, dispatchId, result.transcript, "codex-audit", result.duration_ms);
-      const updatedManifest = buildAndWriteProofManifest(repoRoot, dispatchId);
-      out.info(`Proof manifest rebuilt: ${updatedManifest.artifacts.length} artifact(s), ${updatedManifest.provenance_summary.captured_count} captured`);
-
-      if (result.success) {
-        out.success(`Codex audit completed (${result.duration_ms}ms)`);
-
-        // Write the Codex response alongside the packet
-        const responseFilename = `codex-audit-response-${auditDispatchId.slice(12)}.md`;
-        writePacket(repoRoot, responseFilename, [
-          "---",
-          `audit_dispatch_id: ${auditDispatchId}`,
-          `source_dispatch: ${dispatchId}`,
-          `completed_at: ${new Date().toISOString()}`,
-          `duration_ms: ${result.duration_ms}`,
-          "---\n",
-          "# Codex Audit Response\n",
-          result.transcript,
-        ].join("\n"));
-        out.fileWritten("Codex audit response", responseFilename);
-        out.info("Audit transcript captured as proof artifact.");
-      } else {
-        out.warn(`Codex audit exited with code ${result.exit_code} (${result.duration_ms}ms)`);
-        if (result.error) {
-          out.info(`Error: ${result.error.slice(0, 200)}`);
-        }
-        out.info("Partial transcript captured. Review the audit packet manually.");
-        out.bullet("Send the audit packet to Codex for independent review");
-      }
-    }));
-}

package/src/commands/calibrate.ts

@@ -1,70 +0,0 @@
-/**
- * switchboard calibrate
- *
- * Runs the two-layer calibration harness against the governance pipeline.
- * Layer A: internal pipeline with full trace access.
- * Layer B: independent black-box scorer with zero core imports.
- *
- * Produces an append-only calibration ledger with seeds, traces,
- * verdicts, diffs, diagnosis cards, and escalation queue.
- */
-
-import type { Command } from "commander";
-import { resolve } from "path";
-import { runCalibration } from "../../calibration/skill/calibrate";
-import * as out from "../lib/output";
-import { withCliErrors } from "../lib/errors";
-
-export function registerCalibrateCommand(program: Command): void {
-  program
-    .command("calibrate")
-    .description("Run two-layer calibration harness against the governance pipeline")
-    .option("--blind <count>", "Number of blind seeds (default: 5)")
-    .option("--adversarial <count>", "Number of adversarial seeds (default: 3)")
-    .option("--replay <count>", "Number of replay seeds (default: 2)")
-    .option("--adversarial-only [count]", "Run only adversarial seeds")
-    .option("--replay-only", "Run only replay seeds")
-    .option("--retest", "Re-test seeds from open diagnosis cards")
-    .option("--review", "Review pending escalations")
-    .option("--trends", "Show calibration trends over time")
-    .action(withCliErrors(async (opts) => {
-      out.heading("switchboard calibrate");
-
-      // Build args string from commander options
-      const args = buildArgsString(opts);
-
-      // Use the CLI package root as the project root for calibration
-      // (calibration ledger lives inside the package, not the user's project)
-      const calibrationRoot = resolve(__dirname, "..", "..");
-
-      const result = await runCalibration(args, calibrationRoot);
-
-      console.log(result.report);
-
-      if (result.warnings.length > 0) {
-        console.log("");
-        out.heading("Self-monitoring warnings");
-        for (const w of result.warnings) {
-          out.warn(w);
-        }
-      }
-    }));
-}
-
-function buildArgsString(opts: Record<string, unknown>): string {
-  const parts: string[] = [];
-
-  if (opts["blind"]) parts.push(`--blind ${opts["blind"]}`);
-  if (opts["adversarial"]) parts.push(`--adversarial ${opts["adversarial"]}`);
-  if (opts["replay"]) parts.push(`--replay ${opts["replay"]}`);
-  if (opts["adversarialOnly"]) {
-    const count = typeof opts["adversarialOnly"] === "string" ? opts["adversarialOnly"] : "";
-    parts.push(`--adversarial-only ${count}`.trim());
-  }
-  if (opts["replayOnly"]) parts.push("--replay-only");
-  if (opts["retest"]) parts.push("--retest");
-  if (opts["review"]) parts.push("--review");
-  if (opts["trends"]) parts.push("--trends");
-
-  return parts.join(" ");
-}

package/src/commands/compile.ts

@@ -1,117 +0,0 @@
-/**
- * switchboard compile
- *
- * Reads canonical local state (.switchboard/project/contract.yaml,
- * .switchboard/working/current.yaml), compiles a governed loop contract
- * using existing @switchboard/core logic, and writes the result to
- * .switchboard/working/loop.yaml.
- *
- * Also updates current.yaml stage to "activation-compiled" if it was
- * still in a shaping stage.
- *
- * Does not require the hosted web app, Supabase, or a running server.
- */
-
-import type { Command } from "commander";
-import {
-  chooseRecommendedSurface,
-  compileLoopContract,
-  workingStateSchema,
-  type RoutingResult,
-  type Surface,
-} from "@switchboard/core";
-import { requireRepoRoot } from "../lib/paths";
-import {
-  loadContract,
-  loadCurrentState,
-  loadSpec,
-  writeCurrentState,
-  writeLoop,
-} from "../store/filesystem-store";
-import * as out from "../lib/output";
-import { withCliErrors } from "../lib/errors";
-import { loopPath } from "../lib/paths";
-
-export function registerCompileCommand(program: Command): void {
-  program
-    .command("compile")
-    .description("Compile a governed loop contract from canonical state")
-    .option("--objective <text>", "Override the loop objective")
-    .option("--surface <surface>", "Force a target surface (claude-code, chatgpt, cursor, codex)")
-    .action(withCliErrors(async (opts: { objective?: string; surface?: string }) => {
-      const repoRoot = requireRepoRoot();
-
-      out.heading("switchboard compile");
-
-      // 1. Load canonical state
-      const contract = loadContract(repoRoot);
-      const current = loadCurrentState(repoRoot);
-      const spec = loadSpec(repoRoot);
-
-      out.success(`Loaded contract: ${contract.title} (${contract.project_id})`);
-      out.success(`Loaded state: stage=${current.stage}`);
-
-      // 2. Route to surface
-      const route: RoutingResult = chooseRecommendedSurface({
-        repo_present: contract.repo_status === "repo-present",
-        task: opts.objective ?? current.next_objective,
-      });
-
-      // Allow surface override
-      if (opts.surface) {
-        const validSurfaces = ["claude-code", "chatgpt", "cursor", "codex"];
-        if (!validSurfaces.includes(opts.surface)) {
-          out.fail(`Invalid surface: ${opts.surface}. Must be one of: ${validSurfaces.join(", ")}`);
-          process.exitCode = 1;
-          return;
-        }
-        (route as { primary_recommendation: Surface }).primary_recommendation = opts.surface as Surface;
-      }
-
-      out.section("Route", `${route.primary_recommendation} (fallback: ${route.fallback_surface})`);
-      out.section("Rationale", route.rationale);
-
-      // 3. Compile loop contract using existing core logic
-      const loopInput: Parameters<typeof compileLoopContract>[0] = {
-        contract,
-        current,
-        route,
-      };
-      if (opts.objective) loopInput.objective = opts.objective;
-      const loop = compileLoopContract(loopInput);
-
-      out.success(`Compiled loop contract`);
-      out.section("Objective", loop.objective);
-      out.section("Scope in", `${loop.scope_in.length} item(s)`);
-      out.section("Scope out", `${loop.scope_out.length} item(s)`);
-      out.section("Done when", `${loop.done_when.length} condition(s)`);
-      out.section("Execution shape", loop.execution_shape);
-
-      // 4. Write loop to filesystem
-      writeLoop(repoRoot, loop);
-      out.fileWritten("Loop contract", loopPath(repoRoot));
-
-      // 5. Update current state — sync next_objective to the compiled loop
-      //    objective so packet/run dispatch the same thing compile produced.
-      const shouldUpdateStage = current.stage.startsWith("activation-shaping") || current.stage === "activation-needs-narrowing";
-      const updated = workingStateSchema.parse({
-        ...current,
-        stage: shouldUpdateStage ? "activation-compiled" : current.stage,
-        current_objective: loop.objective,
-        next_recommended_surface: route.primary_recommendation,
-        // CRITICAL: next_objective must be the compiled loop objective,
-        // not the router's derived objective. Otherwise packet/run diverge.
-        next_objective: loop.objective,
-      });
-      writeCurrentState(repoRoot, updated);
-      if (shouldUpdateStage) {
-        out.success("Updated working state to activation-compiled");
-      } else {
-        out.success("Synced working state to compiled loop objective");
-      }
-
-      // Summary
-      out.heading("Next steps");
-      out.bullet(`Run \`switchboard packet ${route.primary_recommendation}\` to generate a dispatch packet`);
-    }));
-}

package/src/commands/evaluate.ts

@@ -1,103 +0,0 @@
-/**
- * switchboard evaluate
- *
- * Runs the independent evaluation lane against the latest portable
- * receipt. Writes evaluation output under .switchboard/evaluations/.
- *
- * Uses existing @switchboard/core evaluation logic: runEvaluation
- * from evaluation-lane.ts.
- *
- * Does not require the hosted web app or Supabase.
- */
-
-import type { Command } from "commander";
-import { runEvaluation } from "@switchboard/core";
-import { requireRepoRoot, sbDir } from "../lib/paths";
-import { readYaml } from "../lib/yaml-io";
-import {
-  loadContract,
-  loadLatestAuditedReceipt,
-  saveEvaluationResult,
-  saveEvaluationJson,
-} from "../store/filesystem-store";
-import { loadPortableProofManifest } from "../lib/proof";
-import * as out from "../lib/output";
-import { withCliErrors } from "../lib/errors";
-import { join } from "path";
-
-export function registerEvaluateCommand(program: Command): void {
-  program
-    .command("evaluate")
-    .description("Run independent evaluation on the latest receipt")
-    .action(withCliErrors(async () => {
-      const repoRoot = requireRepoRoot();
-
-      out.heading("switchboard evaluate");
-
-      // 1. Load the audited receipt (V1 format expected by evaluation lane)
-      const receipt = loadLatestAuditedReceipt(repoRoot);
-
-      if (!receipt) {
-        out.fail("No audited receipt found. Run `switchboard receipt` first.");
-        process.exitCode = 1;
-        return;
-      }
-
-      out.success(`Loaded receipt: ${receipt.receipt_id}`);
-      out.section("Gate", receipt.gate_label);
-      out.section("Trust posture", receipt.trust_posture);
-
-      // 2. Load contract for scope context
-      const contract = loadContract(repoRoot);
-
-      // 3. Load proof manifest if available (via ingest pointer)
-      const pointerPath = join(sbDir(repoRoot), "working", "latest-ingest.yaml");
-      const pointer = readYaml<{ dispatch_id?: string; has_proof_manifest?: boolean }>(pointerPath);
-
-      let proofManifest = null;
-      if (pointer?.dispatch_id && pointer?.has_proof_manifest) {
-        proofManifest = loadPortableProofManifest(repoRoot, pointer.dispatch_id);
-        if (proofManifest) {
-          out.success(`Loaded proof manifest: ${proofManifest.manifest_id} (${proofManifest.artifacts.length} artifact(s))`);
-        }
-      }
-
-      if (!proofManifest) {
-        out.info("No proof manifest — evaluation will be honest about provenance gaps.");
-      }
-
-      // 4. Run the evaluation lane with proof manifest when available
-      const result = runEvaluation({
-        receipt,
-        proofManifest,
-        trigger: "operator_requested",
-        contracted_scope_in: contract.task_clauses.scope_in,
-        contracted_done_when: [],
-      });
-
-      // 5. Persist
-      const yamlPath = saveEvaluationResult(repoRoot, result);
-      const jsonPath = saveEvaluationJson(repoRoot, result);
-      out.fileWritten("Evaluation (YAML)", yamlPath);
-      out.fileWritten("Evaluation (JSON)", jsonPath);
-
-      // Summary
-      out.heading("Evaluation complete");
-      out.section("Evaluation ID", result.evaluation_id);
-      out.section("Verdict", result.verdict);
-      out.section("Basis", result.verdict_basis);
-      out.section("Scope", result.evaluation_scope);
-
-      if (result.violation_count > 0) {
-        out.fail(`${result.violation_count} violation(s)`);
-      }
-      if (result.concern_count > 0) {
-        out.warn(`${result.concern_count} concern(s)`);
-      }
-      if (result.flag_count > 0) {
-        out.info(`${result.flag_count} flag(s)`);
-      }
-
-      out.section("Re-entry signal", `${result.reentry_signal} — ${result.reentry_basis}`);
-    }));
-}