wendkeep 0.80.2 → 0.85.0

package/src/tdd-attestation.mjs

@@ -0,0 +1,254 @@
+import { createHash } from 'node:crypto';
+
+import { sanitizeMemoryText } from '../packages/vault/src/memory-schema.mjs';
+
+const OUTPUT_TAIL_LIMIT = 2_000;
+const COMMAND_LIMIT = 1_000;
+const IDENTITY_FIELDS = [
+  'project_id', 'repository_id', 'worktree_id', 'work_session_id', 'change_slug',
+];
+const INFRASTRUCTURE_FAILURES = [
+  /cannot find module/i,
+  /module not found/i,
+  /cannot find package/i,
+  /syntaxerror/i,
+  /enoent/i,
+  /command not found/i,
+  /is not recognized as an internal or external command/i,
+  /failed to load (?:config|configuration)/i,
+  /configuration (?:error|invalid|missing)/i,
+  /unknown (?:option|argument)/i,
+];
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
+}
+
+function sha256(value) {
+  return `sha256:${createHash('sha256').update(String(value || ''), 'utf8').digest('hex')}`;
+}
+
+function canonicalId(value) {
+  return createHash('sha256').update(JSON.stringify(stableValue(value)), 'utf8').digest('hex');
+}
+
+function uniqueStrings(values) {
+  const input = Array.isArray(values) ? values : [values];
+  return [...new Set(input.map((value) => String(value || '').trim()).filter(Boolean))];
+}
+
+function normalizedPath(value) {
+  const path = String(value || '').replaceAll('\\', '/').replace(/^\.\//, '').trim();
+  if (!path || path.startsWith('/') || /^[A-Za-z]:\//.test(path) || path.split('/').includes('..')) {
+    throw Object.assign(new Error(`invalid test path: ${value}`), { code: 'TDD_TEST_PATH_INVALID' });
+  }
+  return path;
+}
+
+function testPathsOf(values) {
+  return uniqueStrings(values).map(normalizedPath).sort();
+}
+
+function sanitizeDiagnostic(value) {
+  return sanitizeMemoryText(String(value || ''))
+    .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/file:\/\/\/[A-Za-z]:\/[^\s)]+/gi, '[LOCAL_FILE]')
+    .replace(/"[A-Za-z]:\\[^"\r\n]+"/g, '"[LOCAL_EXECUTABLE]"')
+    .replace(/'[A-Za-z]:\\+[^'\r\n]+'/g, "'[LOCAL_FILE]'")
+    .replace(/\b[A-Za-z]:\\+[^\s)"'\r\n]+/g, '[LOCAL_FILE]')
+    .replace(/\/[Uu]sers\/[^/\s]+\/[^\s)]+/g, '[LOCAL_FILE]')
+    .replace(/\bgh[pousr]_[A-Za-z0-9_]{12,}\b/g, '[REDACTED_SECRET]')
+    .replace(/\bxox[baprs]-[A-Za-z0-9-]{12,}\b/g, '[REDACTED_SECRET]')
+    .replace(/:\/\/([^:\s/@]+):([^@\s/]+)@/g, '://[REDACTED_SECRET]@')
+    .replace(/\r/g, '')
+    .trim();
+}
+
+function boundedTail(value) {
+  const sanitized = sanitizeDiagnostic(value);
+  return sanitized.length <= OUTPUT_TAIL_LIMIT
+    ? sanitized
+    : `…${sanitized.slice(-(OUTPUT_TAIL_LIMIT - 1))}`;
+}
+
+function commandObservation(command, result, observedAt) {
+  const rawOutput = [result?.stdout, result?.stderr, result?.error?.message].filter(Boolean).join('\n');
+  return {
+    command: sanitizeDiagnostic(command).slice(0, COMMAND_LIMIT),
+    command_digest: sha256(command),
+    exit_code: Number.isInteger(result?.status) ? result.status : null,
+    output_digest: sha256(rawOutput),
+    output_tail: boundedTail(rawOutput),
+    observed_at: String(observedAt || new Date().toISOString()),
+  };
+}
+
+function snapshotObservation(snapshot = {}) {
+  return {
+    branch: String(snapshot.branch || ''),
+    head_sha: String(snapshot.head_sha || ''),
+    index_tree_sha: String(snapshot.index_tree_sha || ''),
+    worktree_digest: String(snapshot.worktree_digest || ''),
+    change_manifest: stableValue(snapshot.change_manifest || {}),
+  };
+}
+
+function attestationIdentity({ identity = {}, taskId, requirementId }) {
+  const normalizedIdentity = Object.fromEntries(
+    IDENTITY_FIELDS.map((field) => [field, String(identity[field] || '').trim()]),
+  );
+  if (Object.values(normalizedIdentity).some((value) => !value)
+    || !String(taskId || '').trim() || !String(requirementId || '').trim()) {
+    throw Object.assign(new Error('causal identity, task and requirement are required'), {
+      code: 'TDD_IDENTITY_REQUIRED',
+    });
+  }
+  return {
+    ...normalizedIdentity,
+    task_id: String(taskId).trim(),
+    requirement_id: String(requirementId).trim(),
+  };
+}
+
+function baseAttestation(input) {
+  const causal = attestationIdentity(input);
+  return {
+    schema_version: 1,
+    attestation_id: canonicalId(causal),
+    ...causal,
+    profile: String(input.profile || 'OFF').toUpperCase(),
+    state: 'invalid',
+    test_paths: testPathsOf(input.testPaths),
+    red: null,
+    green: null,
+    green_history: [],
+    waiver: null,
+    review_flags: [],
+    invalid_reason: null,
+  };
+}
+
+function invalid(attestation, reason) {
+  return { ...attestation, state: 'invalid', invalid_reason: reason };
+}
+
+export function classifyTddRedResult(result = {}) {
+  if ((result.status ?? 1) === 0) return { valid: false, reason: 'TDD_RED_ALREADY_GREEN' };
+  const diagnostic = [result.stdout, result.stderr, result.error?.message].filter(Boolean).join('\n');
+  if (INFRASTRUCTURE_FAILURES.some((pattern) => pattern.test(diagnostic))) {
+    return { valid: false, reason: 'TDD_RED_INFRASTRUCTURE_FAILURE' };
+  }
+  return { valid: true, reason: null };
+}
+
+export function createRedAttestation(input = {}) {
+  const base = baseAttestation(input);
+  const execution = commandObservation(input.command, input.result, input.observedAt);
+  const red = {
+    ...snapshotObservation(input.snapshot),
+    ...execution,
+    failure_digest: execution.output_digest,
+  };
+  delete red.output_digest;
+  const observed = { ...base, red };
+  const classification = classifyTddRedResult(input.result);
+  return classification.valid
+    ? { ...observed, state: 'red-observed', invalid_reason: null }
+    : invalid(observed, classification.reason);
+}
+
+function sameIdentity(attestation, input) {
+  return IDENTITY_FIELDS.every((field) => (
+    String(attestation?.[field] || '') === String(input.identity?.[field] || '')
+  ))
+    && String(attestation?.task_id || '') === String(input.taskId || '')
+    && String(attestation?.requirement_id || '') === String(input.requirementId || '');
+}
+
+function changedManifestPaths(left = {}, right = {}) {
+  const paths = new Set([...Object.keys(left || {}), ...Object.keys(right || {})]);
+  return [...paths].filter((path) => String(left?.[path] || '') !== String(right?.[path] || '')).sort();
+}
+
+function isDeclaredTestPath(path, declared) {
+  const normalized = normalizedPath(path);
+  return declared.some((testPath) => normalized === testPath || normalized.startsWith(`${testPath}/`));
+}
+
+export function completeGreenAttestation(attestation, input = {}) {
+  const current = { ...attestation, green_history: [...(attestation?.green_history || [])] };
+  if (!sameIdentity(current, input)
+    || String(current.red?.branch || '') !== String(input.snapshot?.branch || '')) {
+    return invalid(current, 'TDD_CAUSAL_IDENTITY_MISMATCH');
+  }
+  if (!current.red || !['red-observed', 'green-observed'].includes(String(current.state || ''))) {
+    return invalid(current, 'TDD_RED_REQUIRED');
+  }
+  if ((input.result?.status ?? 1) !== 0) return invalid(current, 'TDD_GREEN_FAILED');
+  if (input.isAncestor !== true) return invalid(current, 'TDD_GREEN_NOT_CAUSAL_SUCCESSOR');
+
+  const nextTestPaths = testPathsOf(input.testPaths?.length ? input.testPaths : current.test_paths);
+  const allTestPaths = uniqueStrings([...current.test_paths, ...nextTestPaths]).map(normalizedPath);
+  const changedPaths = uniqueStrings([
+    ...changedManifestPaths(current.red.change_manifest, input.snapshot?.change_manifest),
+    ...(input.committedPaths || []),
+  ]).map(normalizedPath).sort();
+  const productionPaths = changedPaths.filter((path) => !isDeclaredTestPath(path, allTestPaths));
+  if (!productionPaths.length) return invalid(current, 'TDD_IMPLEMENTATION_NOT_AFTER_RED');
+
+  const execution = commandObservation(input.command, input.result, input.observedAt);
+  const green = {
+    ...snapshotObservation(input.snapshot),
+    ...execution,
+    result_digest: execution.output_digest,
+    production_paths: productionPaths,
+  };
+  delete green.output_digest;
+  if (current.green) current.green_history.push(current.green);
+  const testPathsChanged = JSON.stringify(current.test_paths) !== JSON.stringify(nextTestPaths);
+  return {
+    ...current,
+    state: 'green-observed',
+    invalid_reason: null,
+    test_paths: nextTestPaths,
+    green,
+    green_history: current.green_history,
+    review_flags: testPathsChanged ? ['TDD_TEST_PATHS_CHANGED'] : [],
+  };
+}
+
+export function evaluateTddAttestation(attestation, snapshot = {}, options = {}) {
+  if (!attestation || !['green-observed', 'waived'].includes(attestation.state)) {
+    return attestation || { state: 'invalid', invalid_reason: 'TDD_ATTESTATION_MISSING' };
+  }
+  if (attestation.state === 'waived') return attestation;
+  if (Array.isArray(options.mutationSurvivors) && options.mutationSurvivors.length) {
+    return invalid(attestation, 'TDD_MUTATION_SURVIVOR');
+  }
+  const green = attestation.green || {};
+  const stale = ['head_sha', 'index_tree_sha', 'worktree_digest']
+    .some((field) => String(green[field] || '') !== String(snapshot[field] || ''));
+  return stale ? invalid(attestation, 'TDD_GREEN_STALE_AFTER_REFACTOR') : attestation;
+}
+
+export function waiveTddAttestation(input = {}) {
+  const authority = sanitizeDiagnostic(input.authority);
+  const reason = sanitizeDiagnostic(input.reason);
+  if (!authority || !reason) {
+    throw Object.assign(new Error('waiver requires explicit human authority and reason'), {
+      code: 'TDD_WAIVER_AUTHORITY_REQUIRED',
+    });
+  }
+  return {
+    ...baseAttestation(input),
+    state: 'waived',
+    invalid_reason: null,
+    waiver: {
+      authority: authority.slice(0, 200),
+      reason: reason.slice(0, 1_000),
+      observed_at: String(input.observedAt || new Date().toISOString()),
+    },
+  };
+}

package/src/tdd.mjs

@@ -0,0 +1,198 @@
+import { isAbsolute, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+import { activeChange } from '../hooks/change-core.mjs';
+import { resolveActiveContext } from '../hooks/active-context-store.mjs';
+import { resolveHookOperatingProfile } from '../hooks/operating-profile-runtime.mjs';
+import { findProjectRoot } from '../packages/harness/src/sensors-core.mjs';
+import { resolveCommandActiveContext } from './active-context-runtime.mjs';
+import { buildTaskContractSnapshot } from './task-contracts.mjs';
+import {
+  completeGreenAttestation,
+  createRedAttestation,
+  evaluateTddAttestation,
+  waiveTddAttestation,
+} from './tdd-attestation.mjs';
+import {
+  captureTddSnapshot,
+  committedPathsBetween,
+  isGitAncestor,
+  readTddAttestationStore,
+  saveTddAttestation,
+} from './tdd-attestation-store.mjs';
+
+const HELP = `wendkeep tdd <red|green|status|waive> <task-id>
+
+  --requirement <id>   requirement bound to the task
+  --test <path>        test path (repeatable)
+  --command <command>  discriminating test command
+  --reason <text>      waiver reason
+  --authority <id>     explicit human waiver authority
+  --session <id>       causal work session
+  --change <slug>      active change override
+  --json               emit structured JSON
+`;
+
+function opt(argv, name) {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] || '' : '';
+}
+
+function opts(argv, name) {
+  const values = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] === name && argv[index + 1]) values.push(argv[index + 1]);
+  }
+  return values;
+}
+
+function tddError(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+
+function commandState(argv) {
+  const vaultRaw = opt(argv, '--vault') || process.env.OBSIDIAN_VAULT_PATH;
+  if (!vaultRaw) throw tddError('TDD_VAULT_MISSING', 'no vault (--vault or OBSIDIAN_VAULT_PATH)');
+  const vaultBase = isAbsolute(vaultRaw) ? vaultRaw : resolve(process.cwd(), vaultRaw);
+  const projectRoot = resolve(opt(argv, '--project') || findProjectRoot(process.cwd()) || process.cwd());
+  const requestedSession = opt(argv, '--session') || process.env.CODEX_THREAD_ID || process.env.CLAUDE_SESSION_ID || '';
+  const identity = resolveCommandActiveContext({
+    vaultBase, projectRoot, sessionId: requestedSession, requireExisting: true,
+  });
+  if (!identity) throw tddError('TDD_ACTIVE_CONTEXT_NOT_FOUND', 'active context is required');
+  const context = resolveActiveContext(vaultBase, identity);
+  const explicitChange = opt(argv, '--change');
+  const changeSlug = explicitChange || activeChange(vaultBase, { context: identity });
+  if (!changeSlug) throw tddError('TDD_CHANGE_NOT_FOUND', 'no active change');
+  if (explicitChange && context.change_slug && explicitChange !== context.change_slug) {
+    throw tddError('TDD_CHANGE_CONTEXT_MISMATCH', 'requested change differs from active context');
+  }
+  const runtime = resolveHookOperatingProfile({
+    input: { cwd: projectRoot, session_id: identity.sessionId || requestedSession },
+  });
+  return {
+    vaultBase, projectRoot, identity, context, changeSlug,
+    profile: runtime.profile,
+    json: argv.includes('--json'),
+  };
+}
+
+function causalIdentity(state) {
+  return {
+    project_id: state.identity.projectId,
+    repository_id: state.identity.repositoryId,
+    worktree_id: state.identity.worktreeId,
+    work_session_id: state.identity.workSessionId,
+    change_slug: state.changeSlug,
+  };
+}
+
+function taskAndRequirement(state, taskId, requested = '') {
+  const snapshot = buildTaskContractSnapshot({ ...state, profile: state.profile });
+  const task = snapshot.contracts.find((item) => item.task_id === taskId);
+  if (!task) throw tddError('TDD_TASK_NOT_FOUND', `task not found: ${taskId || '(missing id)'}`);
+  const requirementId = String(requested || task.requirement_ids[0] || '').trim();
+  if (!requirementId || !task.requirement_ids.includes(requirementId)) {
+    throw tddError('TDD_REQUIREMENT_NOT_BOUND', `requirement is not bound to task ${taskId}`);
+  }
+  return { task, requirementId };
+}
+
+function runObserved(command, projectRoot) {
+  if (!String(command || '').trim()) throw tddError('TDD_COMMAND_REQUIRED', '--command is required');
+  const env = { ...process.env };
+  // A test command launched by the CLI is a new observation, not a recursive
+  // child of WendKeep's own node:test process.
+  delete env.NODE_TEST_CONTEXT;
+  return spawnSync(command, [], {
+    cwd: projectRoot,
+    shell: true,
+    encoding: 'utf8',
+    windowsHide: true,
+    maxBuffer: 8 * 1024 * 1024,
+    env,
+  });
+}
+
+function currentAttestation(state, taskId) {
+  return readTddAttestationStore(state.vaultBase, state.changeSlug).attestations
+    .find((item) => item.task_id === taskId) || null;
+}
+
+function write(value, json) {
+  process.stdout.write(json ? `${JSON.stringify(value)}\n` : `${value.task_id}: ${value.state}\n`);
+}
+
+function fail(error, json) {
+  const payload = { ok: false, code: error?.code || 'TDD_COMMAND_FAILED', error: String(error?.message || error) };
+  process.stderr.write(json ? `${JSON.stringify(payload)}\n` : `wendkeep tdd: ${payload.code}: ${payload.error}\n`);
+  return 2;
+}
+
+export function runTdd(argv = []) {
+  const sub = argv[0];
+  if (!sub || ['help', '--help', '-h'].includes(sub)) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+  const json = argv.includes('--json');
+  try {
+    const state = commandState(argv);
+    const taskId = String(argv[1] || '').trim();
+    if (!taskId) throw tddError('TDD_TASK_REQUIRED', 'task id is required');
+
+    if (sub === 'red') {
+      const { requirementId } = taskAndRequirement(state, taskId, opt(argv, '--requirement'));
+      const testPaths = opts(argv, '--test');
+      if (!testPaths.length) throw tddError('TDD_TEST_PATH_REQUIRED', 'at least one --test is required');
+      const command = opt(argv, '--command');
+      const attestation = createRedAttestation({
+        identity: causalIdentity(state), taskId, requirementId, testPaths,
+        profile: state.profile, command, result: runObserved(command, state.projectRoot),
+        snapshot: captureTddSnapshot(state.projectRoot),
+      });
+      saveTddAttestation(state.vaultBase, state.changeSlug, attestation);
+      write(attestation, state.json);
+      return attestation.state === 'red-observed' ? 0 : 1;
+    }
+
+    if (sub === 'green') {
+      const current = currentAttestation(state, taskId);
+      if (!current) throw tddError('TDD_RED_REQUIRED', 'no RED attestation exists for this task');
+      const command = opt(argv, '--command');
+      const snapshot = captureTddSnapshot(state.projectRoot);
+      const attestation = completeGreenAttestation(current, {
+        identity: causalIdentity(state), taskId, requirementId: current.requirement_id,
+        testPaths: opts(argv, '--test'), command,
+        result: runObserved(command, state.projectRoot), snapshot,
+        isAncestor: isGitAncestor(state.projectRoot, current.red?.head_sha, snapshot.head_sha),
+        committedPaths: committedPathsBetween(state.projectRoot, current.red?.head_sha, snapshot.head_sha),
+      });
+      saveTddAttestation(state.vaultBase, state.changeSlug, attestation);
+      write(attestation, state.json);
+      return attestation.state === 'green-observed' ? 0 : 1;
+    }
+
+    if (sub === 'waive') {
+      const { requirementId } = taskAndRequirement(state, taskId, opt(argv, '--requirement'));
+      const attestation = waiveTddAttestation({
+        identity: causalIdentity(state), taskId, requirementId, profile: state.profile,
+        reason: opt(argv, '--reason'), authority: opt(argv, '--authority'),
+      });
+      saveTddAttestation(state.vaultBase, state.changeSlug, attestation);
+      write(attestation, state.json);
+      return 0;
+    }
+
+    if (sub === 'status') {
+      const current = currentAttestation(state, taskId);
+      if (!current) throw tddError('TDD_ATTESTATION_NOT_FOUND', `no attestation for task ${taskId}`);
+      const evaluated = evaluateTddAttestation(current, captureTddSnapshot(state.projectRoot));
+      write(evaluated, state.json);
+      return ['green-observed', 'waived'].includes(evaluated.state) ? 0 : 1;
+    }
+    throw tddError('TDD_SUBCOMMAND_UNKNOWN', `unknown subcommand: ${sub}`);
+  } catch (error) {
+    return fail(error, json);
+  }
+}

package/src/vault-readme.mjs

@@ -49,9 +49,9 @@ export function renderVaultReadme({ projectName, vaultPath, withMcp = true, loca
   const table = [en ? '| Folder | Contents |' : '| Pasta | Conteúdo |', '| --- | --- |', ...rows].join('\n');
 
   if (en) {
-    const mcpIntro = withMcp ? ', and read/written by the **MCPVault** MCP server' : '';
+    const mcpIntro = withMcp ? ', and queried through the native semantic **WendKeep MCP** server' : '';
     const access = [`- **Obsidian:** open this folder with "Open folder as vault" → \`${vaultPath}\``];
-    if (withMcp) access.push('- **Agent (MCP):** the `wendkeep-vault` server (MCPVault) points at this vault (set in `.mcp.json`), giving the agent read/write on the notes.');
+    if (withMcp) access.push('- **Agent (MCP):** the native `wendkeep-vault` server points at this vault (set in `.mcp.json`), exposing bounded semantic reads and capability-gated writes without arbitrary filesystem access.');
     access.push('- **Hooks:** Codex and Claude Code call `npx --no-install wendkeep hook <name>`; the vault is discovered from the project-local `.wendkeep.json` binding and checked against `.brain/PROJECT.json`.');
     return `# Obsidian vault — ${name}
 
@@ -81,9 +81,9 @@ ${access.join('\n')}
 `;
   }
 
-  const mcpIntro = withMcp ? ', e lida/escrita pelo MCP server **MCPVault**' : '';
+  const mcpIntro = withMcp ? ', e consultada pelo servidor semântico nativo **WendKeep MCP**' : '';
   const access = [`- **Obsidian:** abra esta pasta com "Open folder as vault" → \`${vaultPath}\``];
-  if (withMcp) access.push('- **Agente (MCP):** o servidor `wendkeep-vault` (MCPVault) é apontado para este vault pelo `wendkeep init` (em `.mcp.json`), dando ao agente leitura/escrita das notas.');
+  if (withMcp) access.push('- **Agente (MCP):** o servidor nativo `wendkeep-vault` aponta para este vault pelo `wendkeep init` (em `.mcp.json`), expondo leituras semânticas bounded e writes por capability, sem acesso arbitrário ao filesystem.');
   access.push('- **Hooks:** Codex e Claude Code chamam `npx --no-install wendkeep hook <name>`; o vault é descoberto pelo vínculo local `.wendkeep.json` e validado contra `.brain/PROJECT.json`.');
   return `# Vault Obsidian — ${name}
 

package/src/verify.mjs

@@ -22,7 +22,11 @@ import {
 import { addLesson } from '../hooks/lessons-core.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 import { resolveCommandActiveContext } from './active-context-runtime.mjs';
+import { resolveHookOperatingProfile } from '../hooks/operating-profile-runtime.mjs';
+import { evaluateTddAttestation } from './tdd-attestation.mjs';
+import { readTddAttestationStore } from './tdd-attestation-store.mjs';
 import { writeVaultFileAtomic } from '../packages/vault/src/vault-path-safety.mjs';
+import { evaluateHostCoverage } from '../packages/integrations/src/capabilities.mjs';
 import { evidenceCheckoutBinding } from '../packages/vault/src/evidence-envelope.mjs';
 import {
   assertStableHead,
@@ -103,6 +107,16 @@ export function runVerify(argv) {
     process.stderr.write(`wendkeep verify: wendkeep.sensors.json não encontrado em ${loaded.path} — rode da raiz do projeto ou use --project <raiz>\n`);
   }
   const sensors = loaded.sensors;
+  const hostGate = evaluateHostCoverage(
+    commandContext?.hostCoverage || null,
+    loaded.requiredHostCapabilities,
+    { waivers: loaded.hostCapabilityWaivers },
+  );
+  if (!hostGate.ok) {
+    const missing = hostGate.findings.map((item) => `${item.capability}:${item.state}`).join(', ');
+    process.stderr.write(`wendkeep verify: HOST_CAPABILITY_UNAVAILABLE: ${missing}\n`);
+    process.exit(1);
+  }
   const reqIds = [...new Set(tasks.flatMap((task) => task.reqs ?? []))];
   const effective = buildEffectiveRequirementPackage(vaultBase, changeDir, reqIds);
   const tasksHash = tasksHashOf(tarefas);
@@ -126,6 +140,9 @@ export function runVerify(argv) {
     cwd: projectRoot,
     env: sensorProcessEnv(vaultBase),
   });
+  const mutationSurvivors = evidence.flatMap((sensor) => sensor.survivors ?? []);
+  const tddAttestations = readTddAttestationStore(vaultBase, slug).attestations
+    .map((attestation) => evaluateTddAttestation(attestation, startSnapshot, { mutationSurvivors }));
   let finishSnapshot;
   try {
     finishSnapshot = captureGitSnapshot(projectRoot);
@@ -142,8 +159,10 @@ export function runVerify(argv) {
     effectiveSpecSha256: `sha256:${effective.hash}`,
     sensorConfigSha256: sensorConfigSha256(sensors, ids),
     sensors: evidence,
+    tddAttestations,
     startedAt,
     finishedAt: new Date().toISOString(),
+    hostCoverage: commandContext?.hostCoverage || null,
   });
   writeAuthority('evidencia.json', `${JSON.stringify(envelope, null, 2)}\n`);
   // Freshness seal: bind this evidence to the tarefas.md it was produced against, so the archive
@@ -195,11 +214,15 @@ export function runVerify(argv) {
   // verify can announce success or assemble the deep package. Legacy projects without an active
   // context preserve their pre-contract behavior until they migrate.
   if (commandContext) {
+    const profileRuntime = resolveHookOperatingProfile({
+      input: { cwd: projectRoot, session_id: commandContext.sessionId || requestedSession },
+    });
     const taskSnapshot = buildTaskContractSnapshot({
       vaultBase,
       projectRoot,
       changeSlug: slug,
       identity: commandContext,
+      profile: profileRuntime.profile,
     });
     const taskEvaluations = evaluateTaskContracts(taskSnapshot);
     const executeEvaluations = taskEvaluations.filter((task) => task.phase !== 'verify');
@@ -251,6 +274,7 @@ export function runVerify(argv) {
       }),
       tasks: tasks.map((t) => ({ id: t.id, text: t.text, req: t.req || null, reqs: t.reqs || [], done: t.done })),
       sensors: evidence,
+      tddAttestations,
     };
     writeAuthority('verificacao.json', `${JSON.stringify(pkg, null, 2)}\n`);
     if (reqIds.length === 0) {