wendkeep 0.80.2 → 0.85.0

package/src/sync-protocol.mjs

@@ -0,0 +1,368 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+
+const HASH_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const OPERATIONS = new Set(['put', 'tombstone', 'resolve']);
+const ID_PATTERN = /^[A-Za-z0-9._:@/-]{1,512}$/;
+
+function syncError(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
+  }
+  return value;
+}
+
+export function canonicalSyncJson(value) {
+  return JSON.stringify(stable(value));
+}
+
+export function syncSha256(value) {
+  return `sha256:${createHash('sha256').update(
+    typeof value === 'string' ? value : canonicalSyncJson(value), 'utf8',
+  ).digest('hex')}`;
+}
+
+function requiredText(value, field, maximum = 512) {
+  const text = String(value || '').trim();
+  if (!text || text.length > maximum || /[\0\r\n]/.test(text)) {
+    throw syncError('WENDKEEP_SYNC_SCHEMA_INVALID', `${field} is invalid`);
+  }
+  return text;
+}
+
+function encode(value) {
+  return encodeURIComponent(requiredText(value, 'record key component', 512));
+}
+
+export function canonicalRecordKey({
+  projectId, repositoryId, namespace, key, branch = '', worktreeId = '', scope = 'worktree',
+} = {}) {
+  const project = encode(projectId);
+  const repository = encode(repositoryId);
+  const category = encode(namespace);
+  const name = encode(key);
+  if (!['project', 'branch', 'worktree'].includes(scope)) {
+    throw syncError('WENDKEEP_SYNC_SCOPE_INVALID', `unknown record scope: ${scope}`);
+  }
+  const branchPart = scope === 'project' ? '-' : encode(branch || '-');
+  const worktreePart = scope === 'worktree' ? encode(worktreeId || '-') : '-';
+  return `v1|p=${project}|r=${repository}|s=${scope}|b=${branchPart}|w=${worktreePart}|n=${category}|k=${name}`;
+}
+
+export function createSyncState(projectId) {
+  return {
+    schema_version: 1,
+    project_id: requiredText(projectId, 'project_id', 160),
+    records: {},
+    conflicts: {},
+    pending: {},
+    leases: {},
+    decisions: [],
+    applied_event_ids: [],
+  };
+}
+
+function validatePrivatePayload(payload) {
+  if (!payload || payload.schema_version !== 1 || payload.algorithm !== 'AES-256-GCM'
+    || !payload.key_id || !payload.iv || !payload.ciphertext || !payload.auth_tag) {
+    throw syncError('WENDKEEP_SYNC_PRIVATE_PLAINTEXT', 'private records require an E2E envelope');
+  }
+}
+
+export function createSyncEvent({
+  projectId, recordKey, revision, baseRevision, payload = null, causalParentIds = [],
+  actorId, deviceId, leaseId = '', observedAt, operation = 'put', privacy = 'shared',
+} = {}) {
+  const project_id = requiredText(projectId, 'project_id', 160);
+  const record_key = requiredText(recordKey, 'record_key', 2048);
+  const actor_id = requiredText(actorId, 'actor_id', 160);
+  const device_id = requiredText(deviceId, 'device_id', 160);
+  const revisionNumber = Number(revision);
+  const baseNumber = Number(baseRevision);
+  if (!Number.isSafeInteger(revisionNumber) || revisionNumber < 1
+    || !Number.isSafeInteger(baseNumber) || baseNumber < 0
+    || revisionNumber !== baseNumber + 1) {
+    throw syncError('WENDKEEP_SYNC_REVISION_INVALID', 'revision must equal base_revision + 1');
+  }
+  if (!OPERATIONS.has(operation)) throw syncError('WENDKEEP_SYNC_OPERATION_INVALID', `invalid operation: ${operation}`);
+  if (!['shared', 'private'].includes(privacy)) throw syncError('WENDKEEP_SYNC_PRIVACY_INVALID', 'invalid privacy policy');
+  if (privacy === 'private') validatePrivatePayload(payload);
+  const timestamp = new Date(observedAt);
+  if (Number.isNaN(timestamp.getTime())) throw syncError('WENDKEEP_SYNC_TIME_INVALID', 'observed_at is invalid');
+  const parents = [...new Set(causalParentIds.map((item) => requiredText(item, 'causal_parent_id', 128)))].sort();
+  const draft = {
+    schema_version: 1,
+    project_id,
+    record_key,
+    revision: revisionNumber,
+    base_revision: baseNumber,
+    content_hash: syncSha256(operation === 'tombstone' ? null : payload),
+    causal_parent_ids: parents,
+    actor_id,
+    device_id,
+    lease_id: String(leaseId || ''),
+    observed_at: timestamp.toISOString(),
+    operation,
+    privacy,
+    payload: operation === 'tombstone' ? null : structuredClone(payload),
+  };
+  return { ...draft, event_id: syncSha256(draft).slice(7) };
+}
+
+export function validateSyncEvent(event, { projectId = '' } = {}) {
+  if (!event || event.schema_version !== 1 || typeof event !== 'object'
+    || !ID_PATTERN.test(String(event.event_id || '')) || !HASH_PATTERN.test(String(event.content_hash || ''))
+    || event.event_id !== syncSha256(Object.fromEntries(
+      Object.entries(event).filter(([key]) => key !== 'event_id'),
+    )).slice(7)) {
+    throw syncError('WENDKEEP_SYNC_EVENT_INVALID', 'event integrity validation failed');
+  }
+  if (projectId && event.project_id !== projectId) {
+    throw syncError('WENDKEEP_SYNC_PROJECT_MISMATCH', 'event belongs to another project');
+  }
+  createSyncEvent({
+    projectId: event.project_id,
+    recordKey: event.record_key,
+    revision: event.revision,
+    baseRevision: event.base_revision,
+    payload: event.payload,
+    causalParentIds: event.causal_parent_ids,
+    actorId: event.actor_id,
+    deviceId: event.device_id,
+    leaseId: event.lease_id,
+    observedAt: event.observed_at,
+    operation: event.operation,
+    privacy: event.privacy,
+  });
+  return event;
+}
+
+function eventCandidate(event) {
+  return {
+    event_id: event.event_id,
+    revision: event.revision,
+    base_revision: event.base_revision,
+    content_hash: event.content_hash,
+    causal_parent_ids: [...event.causal_parent_ids],
+    actor_id: event.actor_id,
+    device_id: event.device_id,
+    observed_at: event.observed_at,
+    operation: event.operation,
+    privacy: event.privacy,
+    payload: structuredClone(event.payload),
+  };
+}
+
+function recordFromEvent(event, { conflicted = false } = {}) {
+  return {
+    revision: event.revision,
+    content_hash: event.content_hash,
+    event_id: event.event_id,
+    causal_parent_ids: [...event.causal_parent_ids],
+    actor_id: event.actor_id,
+    device_id: event.device_id,
+    observed_at: event.observed_at,
+    operation: event.operation,
+    privacy: event.privacy,
+    payload: structuredClone(event.payload),
+    tombstone: event.operation === 'tombstone',
+    conflicted,
+    event: eventCandidate(event),
+  };
+}
+
+function rememberApplied(state, eventId) {
+  if (!state.applied_event_ids.includes(eventId)) state.applied_event_ids.push(eventId);
+  state.applied_event_ids.sort();
+}
+
+function addPending(state, event) {
+  const rows = state.pending[event.record_key] || [];
+  if (!rows.some((item) => item.event_id === event.event_id)) rows.push(structuredClone(event));
+  rows.sort((left, right) => left.revision - right.revision || left.event_id.localeCompare(right.event_id));
+  state.pending[event.record_key] = rows;
+}
+
+function conflict(state, current, incoming) {
+  const key = incoming.record_key;
+  const prior = state.conflicts[key]?.candidates || [];
+  const candidates = new Map(prior.map((item) => [item.event_id, item]));
+  if (current?.event) candidates.set(current.event.event_id, structuredClone(current.event));
+  candidates.set(incoming.event_id, eventCandidate(incoming));
+  state.conflicts[key] = {
+    schema_version: 1,
+    record_key: key,
+    status: 'open',
+    candidates: [...candidates.values()].sort((left, right) => left.event_id.localeCompare(right.event_id)),
+  };
+  if (current) current.conflicted = true;
+  rememberApplied(state, incoming.event_id);
+  return { status: 'conflict', event_id: incoming.event_id, record_key: key };
+}
+
+function replayPending(state, recordKey) {
+  const replayed = [];
+  let progress = true;
+  while (progress) {
+    progress = false;
+    const rows = state.pending[recordKey] || [];
+    const currentRevision = state.records[recordKey]?.revision || 0;
+    const ready = rows.filter((event) => event.base_revision <= currentRevision);
+    if (!ready.length) break;
+    for (const event of ready) {
+      state.pending[recordKey] = (state.pending[recordKey] || []).filter((item) => item.event_id !== event.event_id);
+      const outcome = applySyncEvent(state, event, { replay: true });
+      if (outcome.status === 'applied') replayed.push(event.event_id);
+      progress = true;
+    }
+  }
+  if (!(state.pending[recordKey] || []).length) delete state.pending[recordKey];
+  return replayed;
+}
+
+export function applySyncEvent(state, event, { replay = false } = {}) {
+  validateSyncEvent(event, { projectId: state?.project_id });
+  if (state.applied_event_ids.includes(event.event_id)) {
+    return { status: 'duplicate', event_id: event.event_id, record_key: event.record_key };
+  }
+  if ((state.pending[event.record_key] || []).some((item) => item.event_id === event.event_id) && !replay) {
+    return { status: 'pending', event_id: event.event_id, record_key: event.record_key };
+  }
+  const current = state.records[event.record_key] || null;
+  const currentRevision = current?.revision || 0;
+  if (state.conflicts[event.record_key]?.status === 'open') return conflict(state, current, event);
+  if (event.base_revision > currentRevision) {
+    addPending(state, event);
+    return { status: 'pending', event_id: event.event_id, record_key: event.record_key };
+  }
+  if (event.base_revision < currentRevision) return conflict(state, current, event);
+  if (event.causal_parent_ids.length && current && !event.causal_parent_ids.includes(current.event_id)) {
+    return conflict(state, current, event);
+  }
+  state.records[event.record_key] = recordFromEvent(event);
+  rememberApplied(state, event.event_id);
+  const replayed = replayPending(state, event.record_key);
+  return { status: 'applied', event_id: event.event_id, record_key: event.record_key, replayed };
+}
+
+export function resolveSyncConflict(state, {
+  recordKey, selectedEventId, actorId, deviceId, reason, observedAt = new Date().toISOString(),
+} = {}) {
+  const key = requiredText(recordKey, 'record_key', 2048);
+  const set = state.conflicts[key];
+  if (!set || set.status !== 'open') throw syncError('WENDKEEP_SYNC_CONFLICT_NOT_FOUND', 'open conflict not found');
+  const selected = set.candidates.find((item) => item.event_id === selectedEventId);
+  if (!selected) throw syncError('WENDKEEP_SYNC_CONFLICT_SELECTION_INVALID', 'candidate is not in the conflict set');
+  const decisionReason = requiredText(reason, 'reason', 500);
+  const revision = Math.max(...set.candidates.map((item) => item.revision)) + 1;
+  const resolution = createSyncEvent({
+    projectId: state.project_id,
+    recordKey: key,
+    revision,
+    baseRevision: revision - 1,
+    payload: selected.payload,
+    causalParentIds: set.candidates.map((item) => item.event_id),
+    actorId,
+    deviceId,
+    observedAt,
+    operation: selected.operation === 'tombstone' ? 'tombstone' : 'resolve',
+    privacy: selected.privacy,
+  });
+  state.records[key] = recordFromEvent(resolution);
+  rememberApplied(state, resolution.event_id);
+  set.status = 'resolved';
+  set.resolution_event_id = resolution.event_id;
+  set.selected_event_id = selectedEventId;
+  const decision = {
+    schema_version: 1, record_key: key, selected_event_id: selectedEventId,
+    resolution_event_id: resolution.event_id, actor_id: requiredText(actorId, 'actor_id', 160),
+    device_id: requiredText(deviceId, 'device_id', 160), reason: decisionReason,
+    observed_at: new Date(observedAt).toISOString(),
+  };
+  state.decisions.push(decision);
+  return { status: 'resolved', event: resolution, decision };
+}
+
+export function acquireSyncLease(state, {
+  recordKey, leaseId, actorId, deviceId, acquiredAt, expiresAt, now = new Date().toISOString(),
+} = {}) {
+  const key = requiredText(recordKey, 'record_key', 2048);
+  const acquiredTime = new Date(acquiredAt);
+  const expiresTime = new Date(expiresAt);
+  const serverTime = new Date(now);
+  if ([acquiredTime, expiresTime, serverTime].some((value) => Number.isNaN(value.getTime()))
+    || expiresTime.getTime() <= acquiredTime.getTime()) {
+    throw syncError('WENDKEEP_SYNC_LEASE_INVALID', 'lease timestamps are invalid');
+  }
+  const lease = {
+    lease_id: requiredText(leaseId, 'lease_id', 160),
+    actor_id: requiredText(actorId, 'actor_id', 160),
+    device_id: requiredText(deviceId, 'device_id', 160),
+    acquired_at: acquiredTime.toISOString(),
+    expires_at: expiresTime.toISOString(),
+  };
+  const existing = state.leases[key];
+  if (existing?.active && Date.parse(existing.active.expires_at) > serverTime.getTime()) {
+    if (existing.active.lease_id === lease.lease_id) return { status: 'existing', lease: existing.active };
+    throw syncError('WENDKEEP_SYNC_LEASE_HELD', 'record has an unexpired lease');
+  }
+  const history = [...(existing?.history || [])];
+  if (existing?.active) history.push({ ...existing.active, ended_as: 'expired' });
+  state.leases[key] = { schema_version: 1, active: lease, history };
+  return { status: existing?.active ? 'taken_over' : 'acquired', lease };
+}
+
+function keyBytes(value) {
+  let bytes;
+  try { bytes = Buffer.from(requiredText(value, 'encryption key', 256), 'base64'); }
+  catch { throw syncError('WENDKEEP_SYNC_KEY_INVALID', 'key must be base64'); }
+  if (bytes.length !== 32) throw syncError('WENDKEEP_SYNC_KEY_INVALID', 'key must decode to 32 bytes');
+  return bytes;
+}
+
+export function encryptPrivatePayload(payload, {
+  key, keyId, aad = '', iv = randomBytes(12),
+} = {}) {
+  const keyBuffer = keyBytes(key);
+  const ivBuffer = Buffer.from(iv);
+  if (ivBuffer.length !== 12) throw syncError('WENDKEEP_SYNC_KEY_INVALID', 'AES-GCM IV must be 12 bytes');
+  const cipher = createCipheriv('aes-256-gcm', keyBuffer, ivBuffer);
+  cipher.setAAD(Buffer.from(String(aad), 'utf8'));
+  const encrypted = Buffer.concat([cipher.update(canonicalSyncJson(payload), 'utf8'), cipher.final()]);
+  return {
+    schema_version: 1,
+    algorithm: 'AES-256-GCM',
+    key_id: requiredText(keyId, 'key_id', 160),
+    iv: ivBuffer.toString('base64'),
+    ciphertext: encrypted.toString('base64'),
+    auth_tag: cipher.getAuthTag().toString('base64'),
+  };
+}
+
+export function decryptPrivatePayload(envelope, { key, aad = '' } = {}) {
+  try {
+    validatePrivatePayload(envelope);
+    const decipher = createDecipheriv('aes-256-gcm', keyBytes(key), Buffer.from(envelope.iv, 'base64'));
+    decipher.setAAD(Buffer.from(String(aad), 'utf8'));
+    decipher.setAuthTag(Buffer.from(envelope.auth_tag, 'base64'));
+    const bytes = Buffer.concat([
+      decipher.update(Buffer.from(envelope.ciphertext, 'base64')),
+      decipher.final(),
+    ]);
+    return JSON.parse(bytes.toString('utf8'));
+  } catch (error) {
+    if (error?.code === 'WENDKEEP_SYNC_KEY_INVALID') throw error;
+    throw syncError('WENDKEEP_SYNC_DECRYPT_FAILED', 'private payload authentication failed');
+  }
+}
+
+export function rotatePrivatePayloadKey(envelope, {
+  oldKey, newKey, newKeyId, aad = '', iv = randomBytes(12),
+} = {}) {
+  const payload = decryptPrivatePayload(envelope, { key: oldKey, aad });
+  return encryptPrivatePayload(payload, { key: newKey, keyId: newKeyId, aad, iv });
+}

package/src/sync.mjs

@@ -20,6 +20,14 @@ function opt(argv, name) {
 const step = (n, label) => process.stdout.write(`\n[${n}/3] ${label}\n`);
 
 export async function runSync(argv) {
+  const { isSyncProtocolCommand, runSyncProtocol, SYNC_PROTOCOL_HELP } = await import('./sync-protocol-cli.mjs');
+  if (argv.includes('--help') || argv.includes('-h')) {
+    process.stdout.write(`wendkeep sync [--project <dir>] [--vault <dir>] [--yes]\n\n`);
+    process.stdout.write('Without a protocol subcommand, runs init -> sync-defs -> doctor.\n\n');
+    process.stdout.write(SYNC_PROTOCOL_HELP);
+    return 0;
+  }
+  if (isSyncProtocolCommand(argv)) return runSyncProtocol(argv);
   const projectRaw = opt(argv, '--project');
   const vaultRaw = opt(argv, '--vault');
   const hasProfile = argv.includes('--profile') || argv.some((a) => a.startsWith('--profile='));

package/src/task-contracts.mjs

@@ -11,6 +11,9 @@ import { parseTasks } from '../hooks/change-core.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 import { buildEffectiveRequirementPackage, contentHashOf, tasksHashOf } from '../hooks/spec-core.mjs';
 import { activeContextKey, resolveActiveContext } from '../hooks/active-context-store.mjs';
+import { evaluateHostCoverage } from '../packages/integrations/src/capabilities.mjs';
+import { evaluateTddAttestation } from './tdd-attestation.mjs';
+import { captureTddSnapshot, readTddAttestationStore } from './tdd-attestation-store.mjs';
 
 const IGNORED_DIRECTORIES = new Set(['.git', '.worktrees', 'node_modules', 'dist']);
 const BINDING_FIELDS = [
@@ -59,6 +62,8 @@ export function deriveTaskContracts(input = {}) {
   }
   const binding = bindingFrom(input);
   const artifactSpecs = new Map((input.artifactSpecs ?? []).map((spec) => [String(spec.name || ''), spec]));
+  const profile = String(input.profile || '').trim().toUpperCase();
+  const attestations = Array.isArray(input.tddAttestations) ? input.tddAttestations : [];
   return (input.tasks ?? []).map((task) => {
     const taskId = String(task.id || '').trim();
     const phase = String(task.phase || 'execute').trim().toLowerCase();
@@ -70,16 +75,26 @@ export function deriveTaskContracts(input = {}) {
       ? lease : null;
     const dependencies = uniqueStrings(task.dependencies);
     const requiredArtifacts = uniqueStrings(task.artifacts);
+    const requirementIds = uniqueStrings(task.reqs);
+    const tddRequired = (profile === 'GOVERN' && task.tdd === true)
+      || (profile === 'ASSURE' && phase === 'execute'
+        && (requirementIds.length > 0 || uniqueStrings(task.sensors).length > 0));
+    const tddAttestation = attestations.find((attestation) => (
+      String(attestation?.task_id || '') === taskId
+      && requirementIds.includes(String(attestation?.requirement_id || ''))
+      && ['green-observed', 'waived'].includes(String(attestation?.state || ''))
+    )) || null;
     const authored = {
       change_slug: changeSlug,
       task_id: taskId,
       title: String(task.text || '').trim(),
       phase,
       checked: task.done === true,
-      requirement_ids: uniqueStrings(task.reqs),
+      requirement_ids: requirementIds,
       required_sensors: uniqueStrings(task.sensors ?? (task.sensor ? [task.sensor] : [])),
       required_artifacts: requiredArtifacts,
       dependencies,
+      tdd_required: tddRequired,
       binding,
       artifact_specs: requiredArtifacts.map((name) => artifactSpecs.get(name) ?? { name }),
     };
@@ -101,6 +116,8 @@ export function deriveTaskContracts(input = {}) {
       owner: activeLease?.owner_session_id ?? null,
       work_session_id: activeLease?.owner_work_session_id ?? null,
       evidence_envelope_id: input.evidenceEnvelopeId ?? null,
+      tdd_required: tddRequired,
+      tdd_attestation_id: tddAttestation ? String(tddAttestation.attestation_id || '') || null : null,
       checked: authored.checked,
       authored_sha256: sha256(canonicalJson(authored)),
       binding,
@@ -140,11 +157,20 @@ export function evaluateTaskContract(contract, options = {}) {
     .filter((name) => artifacts.get(name)?.satisfied !== true);
   const completedTasks = new Set(uniqueStrings(options.completedTaskIds));
   const openDependencies = uniqueStrings(contract.dependencies).filter((id) => !completedTasks.has(id));
+  const tddMissing = contract.tdd_required === true && !String(contract.tdd_attestation_id || '').trim();
 
   for (const id of missingRequirements) blockingFindings.push(taskFinding('TASK_REQUIREMENT_MISSING', 'requirement_ids', id, null));
   for (const id of missingSensors) blockingFindings.push(taskFinding('TASK_SENSOR_MISSING_OR_RED', 'required_sensors', id, sensors.get(id)?.status ?? null));
   for (const name of missingArtifacts) blockingFindings.push(taskFinding('TASK_ARTIFACT_MISSING', 'required_artifacts', name, null));
   for (const id of openDependencies) blockingFindings.push(taskFinding('TASK_DEPENDENCY_OPEN', 'dependencies', id, null));
+  if (tddMissing) {
+    blockingFindings.push(taskFinding(
+      'TASK_TDD_ATTESTATION_MISSING_OR_INVALID',
+      'tdd_attestation_id',
+      'green-observed or waived',
+      null,
+    ));
+  }
 
   const canComplete = blockingFindings.length === 0;
   return {
@@ -290,6 +316,7 @@ export function buildTaskContractSnapshot({
   context = null,
   registeredArtifacts = [],
   artifactLimits,
+  profile = 'GOVERN',
 } = {}) {
   const slug = String(changeSlug || '').trim();
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(slug)) {
@@ -307,6 +334,10 @@ export function buildTaskContractSnapshot({
   const manifest = artifactManifest(changeDir);
   const evidence = readJson(join(changeDir, 'evidencia.json'), null);
   const causalContext = context || resolveActiveContext(vaultBase, identity);
+  const tddSnapshot = captureTddSnapshot(projectRoot);
+  const mutationSurvivors = (evidence?.sensors ?? []).flatMap((sensor) => sensor.survivors ?? []);
+  const tddAttestations = readTddAttestationStore(vaultBase, slug).attestations
+    .map((attestation) => evaluateTddAttestation(attestation, tddSnapshot, { mutationSurvivors }));
   const binding = {
     projectId: identity.projectId,
     activeContextId: activeContextKey(identity),
@@ -322,6 +353,8 @@ export function buildTaskContractSnapshot({
     artifactSpecs: manifest.specs,
     taskLeases: causalContext?.task_leases ?? {},
     evidenceEnvelopeId: evidence?.envelope_id ?? null,
+    profile,
+    tddAttestations,
   });
   const artifactEvaluation = evaluateArtifactSpecs({
     projectRoot,
@@ -339,6 +372,7 @@ export function buildTaskContractSnapshot({
     sensor_results: evidence?.sensors ?? [],
     evidence_envelope_id: evidence?.envelope_id ?? null,
     artifact_results: artifactEvaluation.results,
+    tdd_attestations: tddAttestations,
   };
 }
 
@@ -384,10 +418,16 @@ export function deriveHandoffContract(input = {}) {
     decisions: uniqueStrings(input.decisions),
     next_actions: uniqueStrings(input.nextActions),
     blockers: uniqueStrings(input.blockers),
+    tdd_attestation_ids: uniqueStrings(input.tddAttestationIds),
     head_sha: String(input.headSha || ''),
     tasks_sha256: String(input.tasksSha256 || ''),
     spec_sha256: String(input.specSha256 || ''),
-    authority: 'verified',
+    ...(input.hostCoverage ? {
+      host_coverage: structuredClone(input.hostCoverage),
+      coverage_findings: Array.isArray(input.coverageFindings) ? structuredClone(input.coverageFindings) : [],
+      coverage_waivers: Array.isArray(input.coverageWaivers) ? structuredClone(input.coverageWaivers) : [],
+    } : {}),
+    authority: input.authority === 'reported' ? 'reported' : 'verified',
   };
   for (const field of ['from', 'to', 'active_context_id', 'head_sha', 'tasks_sha256', 'spec_sha256']) {
     if (!contract[field]) {
@@ -421,9 +461,15 @@ export function normalizeHandoffContract(value) {
     decisions: uniqueStrings(value.decisions),
     next_actions: uniqueStrings(value.next_actions),
     blockers: uniqueStrings(value.blockers),
+    tdd_attestation_ids: uniqueStrings(value.tdd_attestation_ids),
     head_sha: String(value.head_sha || ''),
     tasks_sha256: String(value.tasks_sha256 || ''),
     spec_sha256: String(value.spec_sha256 || ''),
+    ...(value.host_coverage ? {
+      host_coverage: structuredClone(value.host_coverage),
+      coverage_findings: Array.isArray(value.coverage_findings) ? structuredClone(value.coverage_findings) : [],
+      coverage_waivers: Array.isArray(value.coverage_waivers) ? structuredClone(value.coverage_waivers) : [],
+    } : {}),
     authority: value.authority === 'verified' ? 'verified' : 'reported',
   };
   if (!normalized.handoff_id || !normalized.active_context_id || !normalized.head_sha
@@ -485,6 +531,18 @@ export function buildStructuredTaskHandoff({
     ...uniqueStrings(base.blockers),
     ...(selectedEvaluation?.blocking_findings ?? []).map((finding) => finding.code),
   ]);
+  const hostCoverage = context?.host_coverage || null;
+  const coverageEvaluation = hostCoverage
+    ? evaluateHostCoverage(hostCoverage, ['session.stop', 'task.completed', 'edit.attribution'], {
+        waivers: Array.isArray(base.coverage_waivers) ? base.coverage_waivers : [],
+      })
+    : { ok: true, findings: [], waived: [] };
+  if (String(profile || '').toUpperCase() === 'ASSURE' && !coverageEvaluation.ok) {
+    throw Object.assign(new Error('ASSURE requires host capabilities or explicit human waivers'), {
+      code: 'HANDOFF_CAPABILITY_UNAVAILABLE',
+      findings: coverageEvaluation.findings,
+    });
+  }
   const contract = deriveHandoffContract({
     from: sessionId,
     to: base.to || 'next-session',
@@ -496,9 +554,16 @@ export function buildStructuredTaskHandoff({
     decisions: base.decisions,
     nextActions: base.next_actions,
     blockers,
+    tddAttestationIds: (snapshot.tdd_attestations ?? [])
+      .filter((attestation) => ['green-observed', 'waived'].includes(attestation.state))
+      .map((attestation) => attestation.attestation_id),
     headSha: snapshot.binding?.head_sha,
     tasksSha256: snapshot.binding?.tasks_sha256,
     specSha256: snapshot.binding?.effective_spec_sha256,
+    hostCoverage,
+    coverageFindings: coverageEvaluation.findings,
+    coverageWaivers: coverageEvaluation.waived,
+    authority: coverageEvaluation.ok ? 'verified' : 'reported',
   });
   assertStructuredHandoffForProfile(profile, contract);
   return {

package/src/task.mjs

@@ -5,6 +5,7 @@ import { resolveCommandActiveContext } from './active-context-runtime.mjs';
 import { buildTaskContractSnapshot, evaluateTaskContracts } from './task-contracts.mjs';
 import { claimTaskLease, releaseTaskLease } from './task-leases.mjs';
 import { findProjectRoot } from '../packages/harness/src/sensors-core.mjs';
+import { resolveHookOperatingProfile } from '../hooks/operating-profile-runtime.mjs';
 
 const HELP = `wendkeep task <list|show|evaluate|claim|release> [task-id]
 
@@ -46,9 +47,12 @@ function commandState(argv) {
   if (explicitChange && context.change_slug && explicitChange !== context.change_slug) {
     throw Object.assign(new Error('requested change differs from active context'), { code: 'TASK_CHANGE_CONTEXT_MISMATCH' });
   }
+  const runtime = resolveHookOperatingProfile({
+    input: { cwd: projectRoot, session_id: identity.sessionId || sessionId },
+  });
   return {
     json, vaultBase, projectRoot, sessionId: identity.sessionId || sessionId,
-    identity, context, changeSlug,
+    identity, context, changeSlug, profile: runtime.profile,
   };
 }
 

package/src/tdd-attestation-store.mjs

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+import { getLocale } from '../hooks/locale.mjs';
+import {
+  withVaultPathLock,
+  writeVaultFileAtomic,
+} from '../packages/vault/src/vault-path-safety.mjs';
+import { captureGitSnapshot } from './evidence-envelope.mjs';
+
+function git(projectRoot, args, { allowFailure = false } = {}) {
+  const result = spawnSync('git', args, {
+    cwd: projectRoot,
+    encoding: 'utf8',
+    windowsHide: true,
+    maxBuffer: 8 * 1024 * 1024,
+  });
+  if (!allowFailure && result.status !== 0) {
+    throw Object.assign(new Error(result.stderr || `git ${args.join(' ')} failed`), {
+      code: 'TDD_GIT_FAILED',
+    });
+  }
+  return result;
+}
+
+function zeroPaths(value) {
+  return String(value || '').split('\0').map((path) => path.trim()).filter(Boolean);
+}
+
+function sha256(value) {
+  return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+
+export function captureTddSnapshot(projectRoot) {
+  const snapshot = captureGitSnapshot(projectRoot);
+  const changed = zeroPaths(git(projectRoot, ['diff', '--name-only', '-z', 'HEAD']).stdout);
+  const untracked = zeroPaths(git(projectRoot, ['ls-files', '--others', '--exclude-standard', '-z']).stdout);
+  const paths = [...new Set([...changed, ...untracked])].sort();
+  const changeManifest = {};
+  for (const path of paths) {
+    const target = join(projectRoot, ...path.split('/'));
+    if (!existsSync(target)) changeManifest[path] = 'deleted';
+    else if (lstatSync(target).isFile()) changeManifest[path] = sha256(readFileSync(target));
+  }
+  return { ...snapshot, change_manifest: changeManifest };
+}
+
+export function committedPathsBetween(projectRoot, from, to) {
+  if (!from || !to || from === to) return [];
+  return zeroPaths(git(projectRoot, ['diff', '--name-only', '-z', from, to]).stdout).sort();
+}
+
+export function isGitAncestor(projectRoot, from, to) {
+  if (!from || !to) return false;
+  return git(projectRoot, ['merge-base', '--is-ancestor', from, to], { allowFailure: true }).status === 0;
+}
+
+export function tddAttestationStorePath(vaultBase, changeSlug) {
+  return join(vaultBase, getLocale(vaultBase).folders.changes, changeSlug, 'tdd-attestations.json');
+}
+
+export function readTddAttestationStore(vaultBase, changeSlug) {
+  const path = tddAttestationStorePath(vaultBase, changeSlug);
+  if (!existsSync(path)) return { schema_version: 1, attestations: [] };
+  let parsed;
+  try { parsed = JSON.parse(readFileSync(path, 'utf8')); }
+  catch (cause) {
+    throw Object.assign(new Error('tdd-attestations.json is invalid JSON'), {
+      code: 'TDD_STORE_INVALID', cause,
+    });
+  }
+  if (parsed?.schema_version !== 1 || !Array.isArray(parsed.attestations)) {
+    throw Object.assign(new Error('tdd-attestations.json must use schema_version 1'), {
+      code: 'TDD_STORE_INVALID',
+    });
+  }
+  return parsed;
+}
+
+export function saveTddAttestation(vaultBase, changeSlug, attestation) {
+  const path = tddAttestationStorePath(vaultBase, changeSlug);
+  const outcome = withVaultPathLock(vaultBase, path, () => {
+    const store = readTddAttestationStore(vaultBase, changeSlug);
+    const attestations = store.attestations.filter((item) => item.attestation_id !== attestation.attestation_id);
+    attestations.push(attestation);
+    attestations.sort((left, right) => String(left.attestation_id).localeCompare(String(right.attestation_id)));
+    writeVaultFileAtomic(vaultBase, path, `${JSON.stringify({ schema_version: 1, attestations }, null, 2)}\n`, 'utf8', {
+      label: 'TDD attestation store',
+    });
+    return attestation;
+  }, { timeoutMs: 5_000, code: 'TDD_STORE_BUSY' });
+  if (typeof outcome === 'symbol') {
+    throw Object.assign(new Error('TDD attestation store is busy'), { code: 'TDD_STORE_BUSY' });
+  }
+  return outcome;
+}