wendkeep 0.87.0 → 0.89.0

package/packages/observer/src/token-registry.mjs

@@ -0,0 +1,122 @@
+import { createHash, randomBytes } from 'node:crypto';
+
+const ROLES = new Set(['viewer', 'auditor', 'publisher', 'admin']);
+
+export function hashObserverToken(token) {
+  const value = String(token || '');
+  if (!value) throw Object.assign(new Error('token vazio.'), { code: 'observer_token_invalid' });
+  return `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`;
+}
+
+function json(value) { return JSON.stringify(value); }
+function parse(value) { try { return JSON.parse(value || '[]'); } catch { return []; } }
+function validTime(value, field) {
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) throw Object.assign(new Error(`${field} inválido.`), { code: 'observer_token_invalid' });
+  return parsed.toISOString();
+}
+
+export function registerObserverToken(db, {
+  tokenId = randomBytes(12).toString('hex'), token, role, projectIds = [], scopes = [],
+  createdAt = new Date().toISOString(), expiresAt, rotatedFrom = null,
+} = {}) {
+  if (!ROLES.has(role)) throw Object.assign(new Error('role inválida.'), { code: 'observer_role_invalid' });
+  if (!Array.isArray(projectIds) || projectIds.length === 0) throw Object.assign(new Error('projectIds é obrigatório.'), { code: 'observer_projects_invalid' });
+  if (!Array.isArray(scopes) || scopes.length === 0) throw Object.assign(new Error('scopes é obrigatório.'), { code: 'observer_scopes_invalid' });
+  const row = {
+    token_id: String(tokenId), token_hash: hashObserverToken(token), role,
+    project_ids_json: json([...new Set(projectIds.map(String))].sort()),
+    scopes_json: json([...new Set(scopes.map(String))].sort()),
+    created_at: validTime(createdAt, 'createdAt'), expires_at: validTime(expiresAt, 'expiresAt'),
+    revoked_at: null, rotated_from: rotatedFrom ? String(rotatedFrom) : null,
+  };
+  db.prepare(`INSERT INTO observer_tokens(token_id, token_hash, role, project_ids_json, scopes_json, created_at, expires_at, revoked_at, rotated_from)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(...Object.values(row));
+  return { token_id: row.token_id, role, project_ids: parse(row.project_ids_json), scopes: parse(row.scopes_json), expires_at: row.expires_at, rotated_from: row.rotated_from };
+}
+
+export function resolveObserverPrincipal(db, token, { now = new Date().toISOString() } = {}) {
+  let tokenHash;
+  try { tokenHash = hashObserverToken(token); } catch { return { ok: false, code: 'observer_token_missing' }; }
+  const row = db.prepare('SELECT * FROM observer_tokens WHERE token_hash = ?').get(tokenHash);
+  if (!row) return { ok: false, code: 'observer_token_invalid' };
+  const timestamp = new Date(now).getTime();
+  if (row.revoked_at && new Date(row.revoked_at).getTime() <= timestamp) return { ok: false, code: 'observer_token_revoked', token_id: row.token_id };
+  if (new Date(row.expires_at).getTime() <= timestamp) return { ok: false, code: 'observer_token_expired', token_id: row.token_id };
+  return {
+    ok: true, token_id: row.token_id, role: row.role,
+    project_ids: parse(row.project_ids_json), scopes: parse(row.scopes_json), expires_at: row.expires_at,
+  };
+}
+
+export function ensureObserverBootstrapToken(db, {
+  token, tokenId = '', role, projectIds = [], scopes = [], expiresAt, createdAt = new Date().toISOString(), now = createdAt,
+} = {}) {
+  const tokenHash = hashObserverToken(token);
+  const existing = db.prepare('SELECT * FROM observer_tokens WHERE token_hash = ?').get(tokenHash);
+  if (existing) {
+    const expired = new Date(existing.expires_at).getTime() <= new Date(validTime(now, 'now')).getTime();
+    return {
+      created: false,
+      token_id: existing.token_id,
+      role: existing.role,
+      project_ids: parse(existing.project_ids_json),
+      scopes: parse(existing.scopes_json),
+      expires_at: existing.expires_at,
+      revoked: Boolean(existing.revoked_at),
+      expired,
+    };
+  }
+  if (!Array.isArray(projectIds) || projectIds.length === 0 || projectIds.includes('*')) {
+    throw Object.assign(new Error('bootstrap exige projectIds explícitos e não aceita wildcard.'), { code: 'observer_bootstrap_projects_invalid' });
+  }
+  const normalizedExpiry = validTime(expiresAt, 'expiresAt');
+  if (new Date(normalizedExpiry).getTime() <= new Date(validTime(now, 'now')).getTime()) {
+    throw Object.assign(new Error('bootstrap exige expiração futura.'), { code: 'observer_bootstrap_expired' });
+  }
+  const id = String(tokenId || `bootstrap-${tokenHash.slice(-24)}`);
+  if (db.prepare('SELECT token_id FROM observer_tokens WHERE token_id = ?').get(id)) {
+    throw Object.assign(new Error('tokenId de bootstrap já pertence a outra credencial.'), { code: 'observer_bootstrap_token_id_conflict' });
+  }
+  return {
+    created: true,
+    ...registerObserverToken(db, {
+      tokenId: id,
+      token,
+      role,
+      projectIds,
+      scopes,
+      createdAt,
+      expiresAt: normalizedExpiry,
+    }),
+    revoked: false,
+    expired: false,
+  };
+}
+
+export function revokeObserverToken(db, { tokenId, revokedAt = new Date().toISOString() } = {}) {
+  const result = db.prepare('UPDATE observer_tokens SET revoked_at = ? WHERE token_id = ? AND revoked_at IS NULL')
+    .run(validTime(revokedAt, 'revokedAt'), String(tokenId || ''));
+  return { token_id: String(tokenId || ''), revoked: Number(result.changes) > 0 };
+}
+
+export function rotateObserverToken(db, {
+  tokenId, newTokenId, newToken, rotatedAt = new Date().toISOString(), expiresAt,
+} = {}) {
+  const current = db.prepare('SELECT * FROM observer_tokens WHERE token_id = ?').get(String(tokenId || ''));
+  if (!current || current.revoked_at) throw Object.assign(new Error('token não pode ser rotacionado.'), { code: 'observer_token_rotation_invalid' });
+  db.exec('BEGIN IMMEDIATE');
+  try {
+    revokeObserverToken(db, { tokenId, revokedAt: rotatedAt });
+    const created = registerObserverToken(db, {
+      tokenId: newTokenId, token: newToken, role: current.role,
+      projectIds: parse(current.project_ids_json), scopes: parse(current.scopes_json),
+      createdAt: rotatedAt, expiresAt, rotatedFrom: tokenId,
+    });
+    db.exec('COMMIT');
+    return created;
+  } catch (error) {
+    db.exec('ROLLBACK');
+    throw error;
+  }
+}

package/schema/ecosystem-bridge-artifact-manifest-v1.schema.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wendkeep.dev/schema/ecosystem-bridge-artifact-manifest-v1.schema.json",
+  "title": "WendKeep ecosystem bridge artifact manifest v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "artifacts"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "artifacts": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/artifact" }
+    }
+  },
+  "$defs": {
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "external_id", "kind", "path", "sensor_id", "task_id"],
+      "properties": {
+        "source": { "const": "superpowers" },
+        "external_id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+        "kind": { "enum": ["artifact", "review", "commit"] },
+        "path": { "type": "string", "minLength": 1 },
+        "sensor_id": { "type": "string", "minLength": 1 },
+        "task_id": { "type": "string", "minLength": 1 }
+      }
+    }
+  }
+}

package/schema/ecosystem-bridge-v1.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wendkeep.dev/schema/ecosystem-bridge-v1.schema.json",
+  "title": "WendKeep ecosystem bridge contracts v1",
+  "oneOf": [
+    { "$ref": "#/$defs/specProjection" }, { "$ref": "#/$defs/dispatch" },
+    { "$ref": "#/$defs/handoff" }, { "$ref": "#/$defs/externalArtifact" },
+    { "$ref": "#/$defs/proof" }, { "$ref": "#/$defs/statusProjection" }
+  ],
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "envelopeId": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "origin": {
+      "type": "object", "required": ["tool"],
+      "properties": { "tool": { "type": "string", "minLength": 1 }, "version": { "type": "string" }, "root": { "type": "string" }, "external_id": { "type": "string" }, "source_projection_id": { "$ref": "#/$defs/sha256" }, "evidence_envelope_id": { "$ref": "#/$defs/envelopeId" } }
+    },
+    "compatibility": {
+      "type": "object", "additionalProperties": false,
+      "required": ["range", "detected_version", "supported"],
+      "properties": { "range": { "type": "string", "minLength": 1 }, "detected_version": { "type": "string", "minLength": 1 }, "supported": { "type": "boolean" } }
+    },
+    "provenance": {
+      "type": "object", "additionalProperties": false, "required": ["state", "source"],
+      "properties": { "state": { "enum": ["reported", "verified"] }, "source": { "type": "string", "minLength": 1 } }
+    },
+    "mapping": {
+      "type": "object", "additionalProperties": false,
+      "required": ["source_id", "source_kind", "capability", "change_slug", "task_ids"],
+      "properties": { "source_id": { "type": "string", "minLength": 1 }, "source_kind": { "enum": ["story", "requirement"] }, "capability": { "type": "string", "minLength": 1 }, "change_slug": { "type": "string", "minLength": 1 }, "task_ids": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true } }
+    },
+    "reference": {
+      "type": "object", "required": ["kind", "source_id", "path", "sha256", "authority"],
+      "properties": { "kind": { "enum": ["constitution", "spec", "plan", "task", "artifact", "review", "commit"] }, "source_id": { "type": "string", "minLength": 1 }, "path": { "type": "string", "minLength": 1 }, "sha256": { "$ref": "#/$defs/sha256" }, "authority": { "const": "reported" }, "title": { "type": "string", "maxLength": 300 } }
+    },
+    "ownership": {
+      "type": "object", "required": ["concept", "owner"],
+      "properties": { "concept": { "enum": ["spec_source", "plan", "task", "execution", "artifact", "evidence"] }, "owner": { "const": "wendkeep" } }
+    },
+    "specProjection": {
+      "type": "object", "required": ["schema_version", "contract_kind", "projection_id", "adapter", "adapter_version", "authority", "origin", "compatibility", "provenance", "ownership", "references", "mappings", "diagnostics", "ok"],
+      "properties": { "schema_version": { "const": 1 }, "contract_kind": { "const": "spec-projection" }, "projection_id": { "$ref": "#/$defs/sha256" }, "adapter": { "const": "spec-kit" }, "adapter_version": { "type": "string", "minLength": 1 }, "authority": { "const": "reported" }, "origin": { "$ref": "#/$defs/origin" }, "compatibility": { "$ref": "#/$defs/compatibility" }, "provenance": { "$ref": "#/$defs/provenance" }, "ownership": { "type": "array", "items": { "$ref": "#/$defs/ownership" } }, "references": { "type": "array", "items": { "$ref": "#/$defs/reference" } }, "mappings": { "type": "array", "items": { "$ref": "#/$defs/mapping" } }, "diagnostics": { "type": "array" }, "ok": { "type": "boolean" } }
+    },
+    "dispatch": {
+      "type": "object", "required": ["schema_version", "contract_kind", "dispatch_id", "adapter", "authority", "canonical_owner", "origin", "compatibility", "provenance", "task_contract", "worktree"],
+      "properties": { "schema_version": { "const": 1 }, "contract_kind": { "const": "dispatch" }, "dispatch_id": { "$ref": "#/$defs/sha256" }, "adapter": { "const": "superpowers" }, "authority": { "const": "reported" }, "canonical_owner": { "const": "wendkeep" }, "origin": { "$ref": "#/$defs/origin" }, "compatibility": { "$ref": "#/$defs/compatibility" }, "provenance": { "$ref": "#/$defs/provenance" }, "task_contract": { "type": "object" }, "worktree": { "type": "object" } }
+    },
+    "handoff": {
+      "type": "object", "required": ["schema_version", "contract_kind", "handoff_id", "task_contract_id", "head_sha", "authority", "origin", "provenance"],
+      "properties": { "schema_version": { "const": 1 }, "contract_kind": { "const": "handoff" }, "handoff_id": { "type": "string", "minLength": 1 }, "task_contract_id": { "$ref": "#/$defs/sha256" }, "head_sha": { "type": "string", "pattern": "^[a-f0-9]{40}$" }, "authority": { "const": "reported" }, "origin": { "$ref": "#/$defs/origin" }, "provenance": { "$ref": "#/$defs/provenance" } }
+    },
+    "externalArtifact": {
+      "type": "object", "required": ["schema_version", "contract_kind", "source", "external_id", "kind", "sha256", "authority", "origin", "provenance"],
+      "properties": { "schema_version": { "const": 1 }, "contract_kind": { "const": "external-artifact" }, "source": { "const": "superpowers" }, "external_id": { "type": "string", "minLength": 1 }, "kind": { "enum": ["artifact", "review", "commit"] }, "sha256": { "$ref": "#/$defs/sha256" }, "authority": { "enum": ["reported", "verified"] }, "origin": { "$ref": "#/$defs/origin" }, "provenance": { "$ref": "#/$defs/provenance" }, "proof": { "$ref": "#/$defs/proof" } },
+      "allOf": [{ "if": { "properties": { "authority": { "const": "verified" } }, "required": ["authority"] }, "then": { "required": ["proof"] } }]
+    },
+    "proof": {
+      "type": "object", "required": ["schema_version", "contract_kind", "proof_id", "type", "external_id", "artifact_sha256", "authority", "origin", "provenance", "evidence_envelope_id", "sensor_id", "task_id", "path", "head_sha", "git_blob", "manifest_git_blob"],
+      "properties": { "schema_version": { "const": 1 }, "contract_kind": { "const": "proof" }, "proof_id": { "$ref": "#/$defs/sha256" }, "type": { "const": "evidence-envelope" }, "external_id": { "type": "string", "minLength": 1 }, "artifact_sha256": { "$ref": "#/$defs/sha256" }, "authority": { "const": "verified" }, "origin": { "$ref": "#/$defs/origin" }, "provenance": { "$ref": "#/$defs/provenance" }, "evidence_envelope_id": { "$ref": "#/$defs/envelopeId" }, "sensor_id": { "type": "string", "minLength": 1 }, "task_id": { "type": "string", "minLength": 1 }, "path": { "type": "string", "minLength": 1 }, "head_sha": { "type": "string", "pattern": "^[a-f0-9]{40}$" }, "git_blob": { "type": "string", "pattern": "^[a-f0-9]{40}$" }, "manifest_git_blob": { "type": "string", "pattern": "^[a-f0-9]{40}$" } }
+    },
+    "statusProjection": {
+      "type": "object", "required": ["schema_version", "contract_kind", "status_projection_id", "adapter", "authority", "canonical_owner", "origin", "provenance", "source_projection_id", "tasks", "evidence"],
+      "properties": { "schema_version": { "const": 1 }, "contract_kind": { "const": "status-projection" }, "status_projection_id": { "$ref": "#/$defs/sha256" }, "adapter": { "const": "spec-kit" }, "authority": { "const": "reported" }, "canonical_owner": { "const": "wendkeep" }, "origin": { "$ref": "#/$defs/origin" }, "provenance": { "$ref": "#/$defs/provenance" }, "source_projection_id": { "$ref": "#/$defs/sha256" }, "tasks": { "type": "array" }, "evidence": { "type": "array" } }
+    }
+  }
+}

package/schema/observer/006-observer-security.sql

@@ -0,0 +1,64 @@
+-- wendkeep:structural
+-- Security lifecycle: hash-only credentials, access audit, retention, purge receipts and encrypted columns.
+
+ALTER TABLE llm_calls ADD COLUMN prompt_envelope TEXT NOT NULL DEFAULT '';
+ALTER TABLE llm_calls ADD COLUMN response_envelope TEXT NOT NULL DEFAULT '';
+ALTER TABLE llm_calls ADD COLUMN metadata_envelope TEXT NOT NULL DEFAULT '';
+ALTER TABLE documents ADD COLUMN content_envelope TEXT NOT NULL DEFAULT '';
+ALTER TABLE documents ADD COLUMN metadata_envelope TEXT NOT NULL DEFAULT '';
+ALTER TABLE transcripts ADD COLUMN metadata_envelope TEXT NOT NULL DEFAULT '';
+ALTER TABLE project_snapshots ADD COLUMN snapshot_envelope TEXT NOT NULL DEFAULT '';
+
+CREATE TABLE IF NOT EXISTS observer_tokens (
+  token_id TEXT PRIMARY KEY,
+  token_hash TEXT NOT NULL UNIQUE,
+  role TEXT NOT NULL CHECK(role IN ('viewer', 'auditor', 'publisher', 'admin')),
+  project_ids_json TEXT NOT NULL,
+  scopes_json TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  rotated_from TEXT REFERENCES observer_tokens(token_id) ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_observer_tokens_hash_active ON observer_tokens(token_hash, revoked_at, expires_at);
+
+CREATE TABLE IF NOT EXISTS observer_access_audit (
+  audit_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  token_id TEXT REFERENCES observer_tokens(token_id) ON DELETE SET NULL,
+  capability TEXT NOT NULL,
+  outcome TEXT NOT NULL,
+  occurred_at TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_observer_audit_project_time ON observer_access_audit(project_id, occurred_at);
+
+CREATE TABLE IF NOT EXISTS observer_retention_policies (
+  project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+  policy_json TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS observer_purge_receipts (
+  receipt_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  request_hash TEXT NOT NULL,
+  cutoff_at TEXT NOT NULL,
+  classes_json TEXT NOT NULL,
+  counts_json TEXT NOT NULL,
+  purged_at TEXT NOT NULL,
+  receipt_hash TEXT NOT NULL UNIQUE,
+  receipt_json TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_observer_purge_project_time ON observer_purge_receipts(project_id, purged_at);
+CREATE INDEX IF NOT EXISTS idx_observer_purge_request ON observer_purge_receipts(project_id, request_hash, purged_at);
+
+CREATE TABLE IF NOT EXISTS observer_security_backfill (
+  project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+  status TEXT NOT NULL,
+  protected_rows INTEGER NOT NULL DEFAULT 0,
+  updated_at TEXT NOT NULL
+);

package/schema/observer-policy-v1.schema.json

@@ -0,0 +1,63 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wendkeep.dev/schema/observer-policy-v1.schema.json",
+  "title": "WendKeep Observer policy v1",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "document_capture": { "enum": ["none", "metadata", "selected", "full"] },
+    "transcript_capture": { "enum": ["none", "metadata", "messages", "full"] },
+    "prompt_capture": { "enum": ["none", "redacted", "full"] },
+    "response_capture": { "enum": ["none", "redacted", "full"] },
+    "usage_capture": { "enum": ["none", "aggregate", "calls"] },
+    "require_loopback_auth": { "type": "boolean" },
+    "encryption_required": { "type": "boolean" },
+    "rules": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["data_class", "capture"],
+        "properties": {
+          "project_id": { "type": "string", "minLength": 1, "maxLength": 121 },
+          "data_class": { "enum": ["document", "transcript", "prompt", "response", "usage"] },
+          "path": { "type": "string", "maxLength": 2048 },
+          "entity_type": { "type": "string", "maxLength": 160 },
+          "capture": { "enum": ["none", "metadata", "selected", "full", "messages", "redacted", "aggregate", "calls"] }
+        }
+      }
+    },
+    "redaction": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "rules": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["pattern"],
+            "properties": {
+              "pattern": { "type": "string", "minLength": 1, "maxLength": 512 },
+              "replacement": { "type": "string", "maxLength": 160 }
+            }
+          }
+        }
+      }
+    },
+    "retention": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "document": { "type": "integer", "minimum": 0 },
+        "transcript": { "type": "integer", "minimum": 0 },
+        "prompt": { "type": "integer", "minimum": 0 },
+        "response": { "type": "integer", "minimum": 0 },
+        "usage": { "type": "integer", "minimum": 0 },
+        "documents": { "type": "integer", "minimum": 0 },
+        "calls": { "type": "integer", "minimum": 0 },
+        "transcripts": { "type": "integer", "minimum": 0 }
+      }
+    }
+  }
+}

package/schema/sync-event-v1.schema.json

@@ -20,6 +20,16 @@
     "observed_at": { "type": "string", "format": "date-time" },
     "operation": { "enum": ["put", "tombstone", "resolve"] },
     "privacy": { "enum": ["shared", "private"] },
+    "policy_ref": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["policy_id", "version", "hash"],
+      "properties": {
+        "policy_id": { "type": "string", "minLength": 1, "maxLength": 160 },
+        "version": { "type": "integer", "minimum": 1 },
+        "hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+      }
+    },
     "payload": {}
   }
 }

package/schema/wendkeep.evidence-envelope-v2.schema.json

@@ -52,6 +52,10 @@
       "type": "array",
       "items": { "$ref": "#/$defs/sensor" }
     },
+    "external_artifacts": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/externalArtifact" }
+    },
     "host_coverage": { "$ref": "host-coverage-v1.schema.json" },
     "tdd_attestations": {
       "type": "array",
@@ -100,10 +104,45 @@
         "exit_code": { "type": ["integer", "null"] },
         "output_sha256": { "$ref": "#/$defs/sha256" },
         "output_tail": { "type": "string", "maxLength": 2000 },
+        "artifact_results": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/sensorArtifactResult" }
+        },
         "note": { "type": "string", "maxLength": 2000 },
         "survivors": { "type": "array" },
         "ts": { "type": "string", "format": "date-time" }
       }
+    },
+    "sensorArtifactResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "external_id", "path", "algorithm", "digest"],
+      "properties": {
+        "schema_version": { "const": 1 },
+        "external_id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+        "path": { "type": "string", "minLength": 1 },
+        "algorithm": { "const": "sha256" },
+        "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+      }
+    },
+    "externalArtifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "source", "external_id", "kind", "path", "sha256", "authority", "sensor_id", "task_id", "git_blob", "manifest_path", "manifest_git_blob"],
+      "properties": {
+        "schema_version": { "const": 1 },
+        "source": { "const": "superpowers" },
+        "external_id": { "type": "string", "minLength": 1 },
+        "kind": { "enum": ["artifact", "review", "commit"] },
+        "path": { "type": "string", "minLength": 1 },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "authority": { "enum": ["reported", "verified"] },
+        "sensor_id": { "type": "string", "minLength": 1 },
+        "task_id": { "type": "string", "minLength": 1 },
+        "git_blob": { "$ref": "#/$defs/gitObject" },
+        "manifest_path": { "const": ".wendkeep/bridge-artifacts.json" },
+        "manifest_git_blob": { "$ref": "#/$defs/gitObject" }
+      }
     }
   }
 }

package/schema/wendkeep.sensors.schema.json

@@ -40,6 +40,20 @@
           "severity": { "enum": ["critical", "warning"], "default": "critical" },
           "type": { "enum": ["command", "mutation"], "default": "command" },
           "command": { "type": "string", "minLength": 1 },
+          "artifact_results": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["schema_version", "external_id", "path", "algorithm"],
+              "properties": {
+                "schema_version": { "const": 1 },
+                "external_id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+                "path": { "type": "string", "minLength": 1 },
+                "algorithm": { "const": "sha256" }
+              }
+            }
+          },
           "report": {
             "type": "string",
             "description": "type: mutation only — path (project-relative) to the mutation-testing-elements report."

package/src/doctor.mjs

@@ -1,5 +1,6 @@
 // `wendkeep doctor` — vault/session integrity (hooks/vault-health.mjs) PLUS the a2
 // harness integrity check (hooks/harness-doctor.mjs). Exits 1 on any error.
+import * as bridgeFs from 'node:fs';
 import { resolve } from 'node:path';
 import { checkHarness, checkVaultLinks, checkSessionActivity, checkStackedFrontmatter, renderStackedFrontmatterLines, checkUnpricedModels, renderUnpricedModelLines, checkStaleDerivedSections, renderStaleDerivedSectionLines, checkSessionObservability, renderSessionObservabilityLines } from '../hooks/harness-doctor.mjs';
 import { diagnoseManagedWorktrees } from './worktree.mjs';
@@ -20,6 +21,7 @@ import { inspectPortableState } from './portable.mjs';
 import { inspectSyncOutbox, readLocalSyncState } from './sync-outbox.mjs';
 import { readProjectForValidation } from '../packages/vault/src/validate-memory.mjs';
 import { inspectGitCommitHooks } from './git-commit-hooks.mjs';
+import { inspectEcosystemBridges, renderEcosystemBridgeLines } from '../packages/integrations/src/ecosystem-bridge.mjs';
 
 const healthStatusLabel = (status) => ({
   healthy: 'saudável', warning: 'atenção', degraded: 'degradada', blocked: 'bloqueada', legacy: 'legado',
@@ -178,6 +180,8 @@ export function runDoctor(argv) {
   for (const w of warnings) process.stdout.write(`  ! ${w}\n`);
 
   const worktrees = diagnoseManagedWorktrees({ startDir: projectRoot });
+  const bridges = inspectEcosystemBridges({ projectRoot, fs: bridgeFs });
+  process.stdout.write(`\n${renderEcosystemBridgeLines(bridges).join('\n')}\n`);
   process.stdout.write(`\n[worktrees] ${worktrees.initialized ? `${worktrees.issues.length} problema(s)` : 'não inicializado'}\n`);
   for (const issue of worktrees.issues) {
     process.stdout.write(`  → ${issue.slug}: ${issue.errorCode} — ${issue.repair}\n`);
@@ -264,6 +268,7 @@ export function runDoctor(argv) {
     || warnings.length
     || worktrees.issues.length
     || (commitHooks.configured && commitHooks.status !== 'healthy')
+    || !bridges.ok
     || activeContexts.issues.length
     || ['diverged', 'invalid'].includes(portable.status)
     || sync.status === 'corrupt'
@@ -276,5 +281,5 @@ export function runDoctor(argv) {
     || (staleDerived.notes || staleDerived.items || []).length
     || !observability.ok
   );
-  return (scope !== 'runtime' && (healthStatus !== 0 || recallStatus !== 0)) || errors.length || strictDebt ? 1 : 0;
+  return (scope !== 'runtime' && (healthStatus !== 0 || recallStatus !== 0)) || errors.length || !bridges.ok || strictDebt ? 1 : 0;
 }

package/src/ecosystem-bridge-artifact-collector.mjs

@@ -0,0 +1,111 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { relative, resolve } from 'node:path';
+
+import { isProjectContainedPath } from '../packages/integrations/src/bridge-config.mjs';
+
+const MANIFEST_PATH = '.wendkeep/bridge-artifacts.json';
+const MAX_ARTIFACT_BYTES = 1024 * 1024;
+
+function fail(code, message) {
+  throw Object.assign(new Error(message), { code });
+}
+
+function gitText(projectRoot, args, spawn = spawnSync) {
+  const result = spawn('git', args, {
+    cwd: projectRoot, encoding: 'utf8', windowsHide: true,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return result.status === 0 && !result.error ? String(result.stdout || '').trim() : '';
+}
+
+function trackedBlob(projectRoot, path, spawn) {
+  if (!gitText(projectRoot, ['ls-files', '--error-unmatch', '--', path], spawn)) return '';
+  const working = gitText(projectRoot, ['hash-object', '--', path], spawn);
+  const indexed = gitText(projectRoot, ['rev-parse', `:${path}`], spawn);
+  return working && working === indexed ? indexed : '';
+}
+
+function safeProjectFile(projectRoot, path, code) {
+  const candidate = resolve(projectRoot, String(path || ''));
+  if (!String(path || '').trim() || !isProjectContainedPath(projectRoot, candidate)
+    || !existsSync(candidate) || !lstatSync(candidate).isFile()) {
+    fail(code, `bridge artifact path is unavailable: ${path || '<missing>'}`);
+  }
+  const file = realpathSync(candidate);
+  if (!isProjectContainedPath(projectRoot, file) || lstatSync(file).size > MAX_ARTIFACT_BYTES) {
+    fail(code, `bridge artifact path is unsafe: ${path}`);
+  }
+  return { file, path: relative(projectRoot, file).replaceAll('\\', '/') };
+}
+
+function readManifest(projectRoot, spawn) {
+  const candidate = resolve(projectRoot, MANIFEST_PATH);
+  const tracked = gitText(projectRoot, ['ls-files', '--error-unmatch', '--', MANIFEST_PATH], spawn);
+  if (!tracked && !existsSync(candidate)) return null;
+  if (!tracked || !existsSync(candidate)) {
+    fail('BRIDGE_ARTIFACT_MANIFEST_UNTRACKED', 'bridge artifact manifest must exist and match the Git index');
+  }
+  const manifest = safeProjectFile(projectRoot, MANIFEST_PATH, 'BRIDGE_ARTIFACT_MANIFEST_INVALID');
+  const gitBlob = trackedBlob(projectRoot, manifest.path, spawn);
+  if (!gitBlob) fail('BRIDGE_ARTIFACT_MANIFEST_UNTRACKED', 'bridge artifact manifest must match the Git index');
+  let parsed;
+  try { parsed = JSON.parse(readFileSync(manifest.file, 'utf8')); }
+  catch { fail('BRIDGE_ARTIFACT_MANIFEST_INVALID', 'bridge artifact manifest must be valid JSON'); }
+  if (parsed?.schema_version !== 1 || !Array.isArray(parsed?.artifacts)) {
+    fail('BRIDGE_ARTIFACT_MANIFEST_INVALID', 'bridge artifact manifest requires schema_version 1 and artifacts');
+  }
+  if (Object.keys(parsed).some((key) => !['schema_version', 'artifacts'].includes(key))) {
+    fail('BRIDGE_ARTIFACT_MANIFEST_INVALID', 'bridge artifact manifest contains unsupported fields');
+  }
+  return { artifacts: parsed.artifacts, gitBlob, path: manifest.path };
+}
+
+export function collectBridgeArtifactEvidence({
+  projectRoot, tasks = [], sensors = [], spawn = spawnSync,
+} = {}) {
+  const root = realpathSync(resolve(projectRoot));
+  const manifest = readManifest(root, spawn);
+  if (!manifest) return [];
+  const taskById = new Map((tasks || []).map((task) => [String(task.id || ''), task]));
+  const sensorById = new Map((sensors || []).map((sensor) => [String(sensor.id || ''), sensor]));
+  const seen = new Set();
+  return manifest.artifacts.map((entry) => {
+    const externalId = String(entry?.external_id || '').trim();
+    const kind = String(entry?.kind || '').trim();
+    const sensorId = String(entry?.sensor_id || '').trim();
+    const taskId = String(entry?.task_id || '').trim();
+    if (Object.keys(entry || {}).some((key) => ![
+      'source', 'external_id', 'kind', 'path', 'sensor_id', 'task_id',
+    ].includes(key)) || entry?.source !== 'superpowers' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(externalId)
+      || !['artifact', 'review', 'commit'].includes(kind) || !sensorId || !taskId || seen.has(externalId)) {
+      fail('BRIDGE_ARTIFACT_MANIFEST_INVALID', `invalid or duplicate bridge artifact: ${externalId || '<missing>'}`);
+    }
+    seen.add(externalId);
+    const task = taskById.get(taskId);
+    const requiredSensors = Array.isArray(task?.sensors) && task.sensors.length ? task.sensors : [task?.sensor].filter(Boolean);
+    if (!task || !requiredSensors.includes(sensorId)) {
+      fail('BRIDGE_ARTIFACT_TASK_UNBOUND', `bridge artifact ${externalId} is not bound to task ${taskId} and sensor ${sensorId}`);
+    }
+    const artifact = safeProjectFile(root, entry.path, 'BRIDGE_ARTIFACT_FORGED');
+    const gitBlob = trackedBlob(root, artifact.path, spawn);
+    if (!gitBlob) fail('BRIDGE_ARTIFACT_FORGED', `bridge artifact ${externalId} must match the Git index`);
+    const digest = createHash('sha256').update(readFileSync(artifact.file)).digest('hex');
+    const sensor = sensorById.get(sensorId);
+    const result = (sensor?.artifact_results || []).find((item) => (
+      item?.schema_version === 1 && item.external_id === externalId && item.path === artifact.path
+      && item.algorithm === 'sha256' && item.digest === digest
+    ));
+    if (sensor?.status === 'green' && sensor?.exit_code === 0 && !result) {
+      fail('BRIDGE_ARTIFACT_RESULT_MISSING', `green sensor ${sensorId} did not produce the bound digest for ${externalId}`);
+    }
+    const verified = sensor?.status === 'green' && sensor?.exit_code === 0 && Boolean(result);
+    return {
+      schema_version: 1,
+      source: 'superpowers', external_id: externalId, kind, path: artifact.path,
+      sha256: digest, authority: verified ? 'verified' : 'reported', sensor_id: sensorId, task_id: taskId,
+      git_blob: gitBlob, manifest_path: manifest.path, manifest_git_blob: manifest.gitBlob,
+    };
+  });
+}