witnora 0.18.12 → 0.18.14

package/dist/gateway-service.js

@@ -53,6 +53,11 @@ export async function restartCurrentGatewayService(options) {
     await run(plan.start.command, plan.start.args);
     return plan;
 }
+export async function stopCurrentGatewayService(options) {
+    const plan = createGatewayServicePlan(currentPlanInput(options));
+    await (options.run ?? runCommand)(plan.stop.command, plan.stop.args).catch(() => undefined);
+    return plan;
+}
 export function createGatewayServicePlan(input) {
     const suffix = createHash("sha256").update(`${input.repository}\n${input.gatewayDirectory}`).digest("hex").slice(0, 12);
     const id = `witnora-gateway-${suffix}`;

package/dist/gateway.js

@@ -609,8 +609,12 @@ export async function runCustomerGateway(options) {
         throw error;
     }
 }
-function configManagedWorkflowHarnessImport() {
-    return import(new URL("./vendor/onegent-runtime/managed-workflow-harness.js", import.meta.url).href);
+async function configManagedWorkflowHarnessImport() {
+    const [managed, runtimeWatch] = await Promise.all([
+        import(new URL("./vendor/onegent-runtime/managed-workflow-harness.js", import.meta.url).href),
+        import(new URL("./vendor/onegent-runtime/failure-runtime-watch.js", import.meta.url).href),
+    ]);
+    return { ...managed, ...runtimeWatch };
 }
 function configBusinessTaskEvaluatorImport() {
     return import(new URL("./vendor/onegent-runtime/business-task-evaluator.js", import.meta.url).href);
@@ -671,6 +675,43 @@ export async function createConfiguredWorkflowHarness(input) {
             return body.report;
         },
     });
+    const runtimeWatchConfiguration = input.config.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA
+        && input.runtimeWorker?.adapterId === LOCAL_SANDBOX_ADAPTER_ID
+        && (!input.config.realPathActivations || (input.config.realPathActivations.length === 1
+            && input.config.realPathActivations[0]?.environment === "sandbox"
+            && input.config.realPathActivations[0].actionPathIds.length === 1));
+    const activation = runtimeWatchConfiguration
+        && input.config.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA
+        && input.config.realPathActivations?.length === 1
+        && input.config.realPathActivations[0]?.environment === "sandbox"
+        && input.config.realPathActivations[0].actionPathIds.length === 1
+        ? input.config.realPathActivations[0]
+        : undefined;
+    const runtimeWatch = runtimeWatchConfiguration
+        && input.managed.ManagedFailureRuntimeWatch
+        && input.managed.FileFailureRuntimeWatchCheckpointStore
+        && input.managed.createFailureRuntimeWatchHostedClient
+        && input.managed.readLocalSandboxRuntimeWatchOutcome
+        ? new input.managed.ManagedFailureRuntimeWatch({
+            client: input.managed.createFailureRuntimeWatchHostedClient({
+                baseUrl: input.server,
+                projectId: input.projectId,
+                apiKey: input.apiKey,
+                fetch: requestFetch,
+            }),
+            checkpoints: new input.managed.FileFailureRuntimeWatchCheckpointStore(join(input.directory, "data", "failure-runtime-watch")),
+            intervalMs: input.config.pollIntervalMs ?? 5_000,
+            ...(activation ? { bindings: [{ taskContractId: activation.taskContractId, actionPathId: activation.actionPathIds[0], environment: "sandbox" }] } : {}),
+            readOutcome: async ({ resourceId, actions, receipts }) => input.managed.readLocalSandboxRuntimeWatchOutcome({
+                path: join(input.directory, "data", "runtime-sandbox", "fixture", "audit.jsonl"),
+                resourceId,
+                actions: actions.map((action) => {
+                    const executionSessionId = receipts.find((receipt) => receipt.actionId === action.id)?.receipt?.core?.executionSessionId;
+                    return { id: action.id, ...(executionSessionId ? { executionSessionId } : {}) };
+                }),
+            }),
+        })
+        : undefined;
     let timer;
     let closing = false;
     let lastTickAt;
@@ -683,12 +724,19 @@ export async function createConfiguredWorkflowHarness(input) {
                 await managedEvaluator.healthCheck();
             }
             const result = await worker.tick();
+            const watchResult = runtimeWatch ? await runtimeWatch.tick() : undefined;
             lastTickAt = new Date().toISOString();
             lastError = (result.evaluationsFailed ?? 0) > 0 ? result.limitations?.[0] ?? "One or more evaluations failed closed." : undefined;
             if ((result.evaluationsFailed ?? 0) > 0) {
                 process.stderr.write(`Managed Workflow Harness stopped ${result.evaluationsFailed} evaluation(s) fail-closed. ${lastError}\n`);
             }
-            return result;
+            return watchResult ? {
+                ...result,
+                runtimeWatchCasesInspected: watchResult.casesInspected ?? 0,
+                runtimeWatchObservationsUploaded: watchResult.observationsUploaded ?? 0,
+                runtimeWatchOutcomesDeferred: watchResult.outcomesDeferred ?? 0,
+                runtimeWatchLimitations: watchResult.limitations ?? [],
+            } : result;
         }
         catch (error) {
             lastTickAt = new Date().toISOString();
@@ -751,6 +799,7 @@ export async function createContinuousAssuranceController(input) {
             server: input.server,
             apiKey: input.apiKey,
             config,
+            runtimeWorker: input.config.runtimeWorker,
             managed,
             evaluatorKit: input.evaluatorKit,
             fetch: request,

package/dist/onboard.js

@@ -12,7 +12,7 @@ import { doctorCustomerGateway, activateManagedWorkflowHarness, ensureCustomerGa
 import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-sandbox-kit.js";
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
 import { activateRealPathIntegrations } from "./real-path-activation.js";
-import { installCurrentGatewayService } from "./gateway-service.js";
+import { installCurrentGatewayService, stopCurrentGatewayService } from "./gateway-service.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
     const output = options.output ?? ((message) => process.stdout.write(message));
@@ -91,6 +91,19 @@ export async function runOnboard(options) {
         start: startManagedCustomerGateway,
         stop: stopManagedCustomerGateway,
     };
+    const gatewayServiceLifecycle = options.gatewayServiceLifecycle ?? (!options.gatewayLifecycle ? {
+        stop: async ({ repository, configHome }) => {
+            await stopCurrentGatewayService({
+                repository,
+                configHome,
+                cliEntry: fileURLToPath(new URL("./cli.js", import.meta.url)),
+            });
+        },
+    } : undefined);
+    const stopGatewayOwners = async () => {
+        await gatewayServiceLifecycle?.stop({ repository: repositoryPath, configHome: options.configHome });
+        return gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+    };
     let gatewayMigration;
     let managedGateway;
     let runtimeUpgrade;
@@ -184,7 +197,7 @@ export async function runOnboard(options) {
                     try {
                         runtimeUpgrade = await prepareRuntime(() => upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, agentIdentity, configHome: options.configHome, fetch: requestFetch }));
                         if (runtimeUpgrade.changed) {
-                            const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+                            const stopped = await stopGatewayOwners();
                             if (stopped.state !== "STOPPED" || stopped.healthy)
                                 throw new Error("The prior managed Gateway process did not stop before Runtime generation replacement.");
                         }
@@ -205,11 +218,11 @@ export async function runOnboard(options) {
                 }
             }
             else {
-                const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+                const stopped = await stopGatewayOwners();
                 if (stopped.state === "STOPPED" || stopped.state === "STALE") {
                     output(`\nStopped the managed Gateway for project ${binding.projectId} before rebinding this repository.\n`);
                 }
-                await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.projectId, token.projectId);
+                await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.collectorId, binding.projectId, token.projectId);
                 gatewayMigration = await archiveGateway(gatewayState.directory, repositoryPath, binding.projectId);
                 output(`\nExisting Gateway belongs to project ${binding.projectId}; archived it at ${gatewayMigration.archiveDirectory}.\n`);
                 const gateway = await prepareRuntime(() => initializeCustomerGateway({
@@ -239,14 +252,14 @@ export async function runOnboard(options) {
             assuranceHarnessReadiness = { state: "WAITING_FOR_CUSTOMER_HARNESS", limitation: detail };
         }
         if (assuranceHarnessChanged && gatewayState.status !== "absent") {
-            const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+            const stopped = await stopGatewayOwners();
             if (stopped.state !== "STOPPED" && stopped.state !== "STALE")
                 throw new Error("The prior managed Gateway process did not stop before Assurance Harness activation.");
         }
         if (!options.gatewayLifecycle) {
             // Stop any detached Gateway left by an earlier CLI before the OS-owned
             // supervisor is installed. The service becomes the single process owner.
-            await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch }).catch(() => undefined);
+            await stopGatewayOwners().catch(() => undefined);
             const port = await ensureCustomerGatewayPortAvailable({ repository: repositoryPath });
             if (port.changed)
                 output(`Rebound this repository's generated Gateway to available localhost port ${port.port}; another project remains untouched.\n`);
@@ -304,7 +317,7 @@ export async function runOnboard(options) {
     catch (error) {
         const diagnosis = error instanceof Error ? error.message : String(error);
         if (managedGateway?.started) {
-            await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch }).catch(() => undefined);
+            await stopGatewayOwners().catch(() => undefined);
         }
         await realPathActivation?.rollback().catch(() => undefined);
         await rollbackGeneratedFiles(generatedFiles);
@@ -349,18 +362,25 @@ async function inspectGatewayBinding(directory, projectId, server) {
     const existingProjectId = typeof value.projectId === "string" ? value.projectId.trim() : "";
     const existingServer = typeof value.server === "string" ? normalizeServer(value.server) : "";
     const connectionName = typeof value.connectionName === "string" ? value.connectionName.trim() : "";
+    const collectorId = typeof value.collectorId === "string" ? value.collectorId.trim() : "";
     const host = typeof value.host === "string" && value.host.trim() ? value.host.trim() : "127.0.0.1";
     const port = Number(value.port);
-    if (!existingProjectId || !existingServer || !connectionName || !Number.isInteger(port) || port < 1 || port > 65_535) {
-        throw new Error("Existing Gateway configuration is missing a valid project, server, host, or port. Preserve it and repair the setup in Advanced mode.");
+    if (!existingProjectId || !existingServer || !connectionName || !collectorId || !Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error("Existing Gateway configuration is missing a valid project, server, connection, collector, host, or port. Preserve it and repair the setup in Advanced mode.");
     }
-    return { matches: existingProjectId === projectId && existingServer === server, projectId: existingProjectId, server: existingServer, connectionName, host, port };
+    return { matches: existingProjectId === projectId && existingServer === server, projectId: existingProjectId, server: existingServer, connectionName, collectorId, host, port };
 }
-async function assertGatewayStopped(requestFetch, host, port, oldProjectId, newProjectId) {
+async function assertGatewayStopped(requestFetch, host, port, oldCollectorId, oldProjectId, newProjectId) {
     try {
         const response = await requestFetch(`http://${host}:${port}/healthz`, { signal: AbortSignal.timeout(800) });
         if (!response.ok)
             return;
+        const health = await response.json().catch(() => ({}));
+        // A different repository may legitimately own the old localhost port.
+        // It must remain untouched; this repository will select a free port after
+        // its prior Gateway directory is archived and regenerated.
+        if (health.collectorId !== oldCollectorId)
+            return;
     }
     catch {
         return;

package/dist/vendor/onegent-runtime/failure-experiment-hosted.d.ts

@@ -0,0 +1,65 @@
+export declare const FAILURE_EXPERIMENT_SUBMISSION_SCHEMA_VERSION: "witnora.failure_experiment_submission.v0.1";
+export interface HostedFailureDefinition {
+    title: string;
+    taskContractId: string;
+    actionPathId: string;
+    provider: string;
+    environment: "sandbox" | "production";
+    failureSignal: string;
+    successSignal: string;
+    hardInvariants: string[];
+    outcomeCheck: {
+        kind: "READ_ONLY_PROVIDER_QUERY" | "READ_ONLY_DATABASE_QUERY" | "SIGNED_WEBHOOK_OBSERVATION" | "CUSTOMER_PROBE";
+        providerState: string;
+        expectedValue: string;
+    };
+    reproduction: {
+        kind: "DETERMINISTIC";
+        requiredRuns: number;
+    } | {
+        kind: "STATISTICAL";
+        runs: number;
+        minimumFailureRate: number;
+        allowedError: number;
+    };
+}
+export interface HostedFailureExperimentInput {
+    discoveryKey: string;
+    phase: "BASELINE" | "CANDIDATE" | "RUNTIME";
+    /** Stable source observation time; callers should reuse it on retry. */
+    observedAt?: string;
+    definition: HostedFailureDefinition;
+    result: {
+        agentVersion: string;
+        attempts: number;
+        providerCommitCount: number;
+        duplicateOutcomeCount: number;
+        failureCount: number;
+        hardInvariantViolations?: number;
+        observation: "REPORTED" | "RECORDED";
+        executionControl: "ENFORCED" | "NOT_ENFORCED" | "UNKNOWN";
+        outcome: "VERIFIED" | "NOT_VERIFIED" | "INCONCLUSIVE";
+        review: "NOT_REVIEWED" | "INTERNALLY_REVIEWED" | "INDEPENDENTLY_REVIEWED";
+        receiptIds?: string[];
+    };
+    evidence: {
+        summary: string;
+        measurements?: Record<string, string | number | boolean | null>;
+        limitations?: string[];
+    };
+}
+export interface HostedFailureExperimentOptions {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    fetch?: typeof fetch;
+}
+export interface HostedFailureExperimentResult {
+    run: Record<string, unknown>;
+    evidence: Record<string, unknown>;
+    completion: Record<string, unknown>;
+    failureCase: Record<string, unknown>;
+    verifiedFixReport: Record<string, unknown>;
+}
+export declare function uploadFailureExperiment(input: HostedFailureExperimentInput, options: HostedFailureExperimentOptions): Promise<HostedFailureExperimentResult>;
+//# sourceMappingURL=failure-experiment-hosted.d.ts.map

package/dist/vendor/onegent-runtime/failure-experiment-hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-experiment-hosted.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/failure-experiment-hosted.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4CAA4C,EAAG,4CAAqD,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE;QACZ,IAAI,EAAE,0BAA0B,GAAG,0BAA0B,GAAG,4BAA4B,GAAG,gBAAgB,CAAC;QAChH,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACzD;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5C,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,uBAAuB,CAAC;IACpC,MAAM,EAAE;QACN,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,qBAAqB,EAAE,MAAM,CAAC;QAC9B,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,UAAU,GAAG,UAAU,CAAC;QACrC,gBAAgB,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;QAC1D,OAAO,EAAE,UAAU,GAAG,cAAc,GAAG,cAAc,CAAC;QACtD,MAAM,EAAE,cAAc,GAAG,qBAAqB,GAAG,wBAAwB,CAAC;QAC1E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;QAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,6BAA6B,CAAC,CAsFxC"}

package/dist/vendor/onegent-runtime/failure-experiment-hosted.js

@@ -0,0 +1,146 @@
+import { createHash } from "node:crypto";
+export const FAILURE_EXPERIMENT_SUBMISSION_SCHEMA_VERSION = "witnora.failure_experiment_submission.v0.1";
+export async function uploadFailureExperiment(input, options) {
+    if (input.definition.environment !== "sandbox") {
+        throw new Error("Automatic Failure Case progression is limited to the customer sandbox.");
+    }
+    validateExperimentCounts(input.result);
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const submittedAt = input.observedAt === undefined ? new Date().toISOString() : normalizedTimestamp(input.observedAt, "observedAt");
+    const boundedEvidence = {
+        schemaVersion: "witnora.failure_experiment_evidence.v0.1",
+        discoveryKey: input.discoveryKey,
+        phase: input.phase,
+        taskContractId: input.definition.taskContractId,
+        actionPathId: input.definition.actionPathId,
+        environment: input.definition.environment,
+        provider: input.definition.provider,
+        summary: bounded(input.evidence.summary, "evidence.summary", 1, 2_000),
+        measurements: boundedMeasurements(input.evidence.measurements),
+        limitations: (input.evidence.limitations ?? []).slice(0, 20).map((item) => bounded(item, "evidence.limitation", 1, 500)),
+        result: structuredClone(input.result),
+        observedAt: submittedAt,
+        rawPayloadRetainedByCustomer: true,
+    };
+    const bytes = Buffer.from(`${JSON.stringify(boundedEvidence, null, 2)}\n`, "utf8");
+    if (bytes.byteLength > 64 * 1024)
+        throw new Error("Failure experiment evidence exceeds the 64 KiB hosted boundary.");
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    const operation = `failure-experiment-${digest.slice(0, 32)}`;
+    const run = await jsonRequest(requestFetch, `${projectUrl}/runs`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operation}:run` },
+        body: JSON.stringify({
+            externalId: `${input.discoveryKey}:${input.phase.toLowerCase()}:${digest.slice(0, 16)}`,
+            kind: "custom",
+            schemaVersion: FAILURE_EXPERIMENT_SUBMISSION_SCHEMA_VERSION,
+            startedAt: submittedAt,
+            metadata: { failureExperiment: {
+                    schemaVersion: FAILURE_EXPERIMENT_SUBMISSION_SCHEMA_VERSION,
+                    discoveryKey: input.discoveryKey,
+                    phase: input.phase,
+                    taskContractId: input.definition.taskContractId,
+                    actionPathId: input.definition.actionPathId,
+                    evidenceDigestSha256: digest,
+                    rawPayloadRetainedByCustomer: true,
+                } },
+        }),
+    });
+    const runId = id(run, "Run");
+    const query = new URLSearchParams({
+        fileName: `failure-experiment-${input.phase.toLowerCase()}-evidence.json`,
+        kind: "failure_experiment",
+        schemaVersion: "witnora.failure_experiment_evidence.v0.1",
+        runId,
+    });
+    const evidence = await jsonRequest(requestFetch, `${projectUrl}/evidence?${query}`, apiKey, {
+        method: "POST",
+        headers: { "content-type": "application/json", "idempotency-key": `${operation}:evidence` },
+        body: new Uint8Array(bytes).buffer,
+    });
+    const evidenceId = id(evidence, "Evidence");
+    const completion = await jsonRequest(requestFetch, `${projectUrl}/runs/${encodeURIComponent(runId)}/complete`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operation}:complete` },
+        body: JSON.stringify({
+            status: input.phase === "BASELINE" ? "manual_review" : input.result.failureCount ? "failed" : "passed",
+            score: input.result.failureCount ? 0 : 1,
+            summary: boundedEvidence.summary,
+            metadata: { evidenceId, evidenceSha256: evidence.sha256, failureExperimentDigestSha256: digest },
+        }),
+    });
+    const failureCase = await jsonRequest(requestFetch, `${projectUrl}/failure-cases/ingest`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operation}:ingest` },
+        body: JSON.stringify({
+            schemaVersion: FAILURE_EXPERIMENT_SUBMISSION_SCHEMA_VERSION,
+            discoveryKey: input.discoveryKey,
+            phase: input.phase,
+            definition: input.definition,
+            result: { ...input.result, runIds: [runId], evidenceIds: [evidenceId] },
+        }),
+    });
+    const failureCaseId = id(failureCase, "Failure Case");
+    const verifiedFixReport = await jsonRequest(requestFetch, `${projectUrl}/failure-cases/${encodeURIComponent(failureCaseId)}/report`, apiKey, { method: "GET" });
+    return { run, evidence, completion, failureCase, verifiedFixReport };
+}
+function validateExperimentCounts(result) {
+    const counts = [
+        result.attempts,
+        result.providerCommitCount,
+        result.duplicateOutcomeCount,
+        result.failureCount,
+        result.hardInvariantViolations ?? 0,
+    ];
+    if (counts.some((value) => !Number.isInteger(value) || value < 0)) {
+        throw new Error("Failure experiment counts must be non-negative integers.");
+    }
+    if (result.attempts < 1
+        || result.providerCommitCount > result.attempts
+        || result.failureCount > result.attempts
+        || result.duplicateOutcomeCount > result.providerCommitCount) {
+        throw new Error("Failure experiment counts are internally inconsistent.");
+    }
+}
+async function jsonRequest(requestFetch, url, apiKey, init) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${apiKey}`);
+    if (typeof init.body === "string")
+        headers.set("content-type", "application/json");
+    const response = await requestFetch(url, { ...init, headers, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(typeof value.error === "string" ? value.error : `Witnora Control Plane request failed (${response.status}).`);
+    return value;
+}
+function required(value, name) {
+    return bounded(value.trim(), name, 1, 2_000);
+}
+function normalizedTimestamp(value, name) {
+    if (!value.trim() || Number.isNaN(Date.parse(value)))
+        throw new Error(`Failure experiment ${name} must be an ISO timestamp.`);
+    return new Date(value).toISOString();
+}
+function bounded(value, name, minimum, maximum) {
+    if (value.length < minimum || value.length > maximum)
+        throw new Error(`Failure experiment ${name} must contain ${minimum}-${maximum} characters.`);
+    return value;
+}
+function boundedMeasurements(value) {
+    const entries = Object.entries(value ?? {}).slice(0, 50);
+    for (const [key, item] of entries) {
+        bounded(key, "evidence.measurement key", 1, 100);
+        if (typeof item === "string")
+            bounded(item, "evidence.measurement value", 0, 500);
+    }
+    return Object.fromEntries(entries);
+}
+function id(value, kind) {
+    if (typeof value.id !== "string" || !value.id)
+        throw new Error(`Witnora Control Plane returned ${kind} without an id.`);
+    return value.id;
+}

package/dist/vendor/onegent-runtime/failure-runtime-watch.d.ts

@@ -0,0 +1,144 @@
+import { type HostedFailureDefinition, type HostedFailureExperimentInput } from "./failure-experiment-hosted.js";
+export type FailureRuntimeWatchHealth = "HEALTHY" | "REGRESSION" | "INSUFFICIENT_EVIDENCE" | "CONNECTION_UNAVAILABLE";
+export interface FailureRuntimeWatchCase {
+    id: string;
+    projectId: string;
+    status: "FIX_VERIFIED" | "RUNTIME_PROTECTED" | "REGRESSION_DETECTED" | string;
+    updatedAt?: string;
+    definition: HostedFailureDefinition;
+    discovery?: {
+        discoveryKey?: string;
+    };
+    candidate?: {
+        agentVersion: string;
+        recordedAt?: string;
+    };
+    runtimeWatch?: {
+        activatedAt?: string;
+        receiptIds?: string[];
+        latest?: {
+            receiptIds?: string[];
+        };
+    };
+}
+export interface FailureRuntimeWatchAction {
+    id: string;
+    status: string;
+    updatedAt?: string;
+    verificationSuccess?: boolean;
+    expectedState?: Record<string, unknown>;
+    businessTaskBinding?: {
+        taskContractId?: string;
+        actionPathId?: string;
+        environment?: string;
+        agentVersion?: string;
+    };
+}
+export interface FailureRuntimeWatchReceipt {
+    id: string;
+    actionId: string;
+    currentStatus: string;
+    createdAt: string;
+    receipt: {
+        core: {
+            evidenceStrength?: string;
+            enforcementLevel?: string;
+            executionSessionId?: string;
+        };
+    };
+    discoveryBoundary?: "SIGNED_VERIFIED_ACTION";
+}
+export interface FailureRuntimeWatchOutcome {
+    classification: "HEALTHY" | "REGRESSION" | "INSUFFICIENT_EVIDENCE" | "CONNECTION_UNAVAILABLE" | "SCHEMA_DIGEST_DRIFT";
+    attempts?: number;
+    providerCommitCount?: number;
+    duplicateOutcomeCount?: number;
+    failureCount?: number;
+    hardInvariantViolations?: number;
+    observedAt: string;
+    reason?: string;
+}
+export type FailureRuntimeWatchOutcomeReader = (input: {
+    failureCase: FailureRuntimeWatchCase;
+    resourceId: string;
+    actions: FailureRuntimeWatchAction[];
+    receipts: FailureRuntimeWatchReceipt[];
+}) => Promise<FailureRuntimeWatchOutcome>;
+export interface FailureRuntimeWatchStatusInput {
+    health: FailureRuntimeWatchHealth;
+    lastCheckedAt: string;
+    nextCheckAt: string;
+    detail?: string;
+}
+export interface FailureRuntimeWatchHostedClient {
+    listFailureCases(): Promise<FailureRuntimeWatchCase[]>;
+    listActions(): Promise<FailureRuntimeWatchAction[]>;
+    listReceipts(actions?: FailureRuntimeWatchAction[]): Promise<FailureRuntimeWatchReceipt[]>;
+    uploadObservation(input: HostedFailureExperimentInput & {
+        observedAt: string;
+    }): Promise<unknown>;
+    updateStatus(failureCaseId: string, input: FailureRuntimeWatchStatusInput): Promise<unknown>;
+}
+export declare function createFailureRuntimeWatchHostedClient(options: {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    fetch?: typeof fetch;
+}): FailureRuntimeWatchHostedClient;
+export interface FailureRuntimeWatchCheckpoint {
+    processedReceiptIds: string[];
+    updatedAt: string;
+}
+export interface FailureRuntimeWatchCheckpointStore {
+    load(key: string): Promise<FailureRuntimeWatchCheckpoint | undefined>;
+    save(key: string, checkpoint: FailureRuntimeWatchCheckpoint): Promise<void>;
+}
+export declare class MemoryFailureRuntimeWatchCheckpointStore implements FailureRuntimeWatchCheckpointStore {
+    #private;
+    load(key: string): Promise<FailureRuntimeWatchCheckpoint | undefined>;
+    save(key: string, checkpoint: FailureRuntimeWatchCheckpoint): Promise<void>;
+}
+export declare class FileFailureRuntimeWatchCheckpointStore implements FailureRuntimeWatchCheckpointStore {
+    private readonly directory;
+    constructor(directory: string);
+    load(key: string): Promise<FailureRuntimeWatchCheckpoint | undefined>;
+    save(key: string, checkpoint: FailureRuntimeWatchCheckpoint): Promise<void>;
+    private path;
+}
+export interface ManagedFailureRuntimeWatchResult {
+    casesInspected: number;
+    observationsUploaded: number;
+    outcomesDeferred: number;
+    limitations: string[];
+}
+export declare class ManagedFailureRuntimeWatch {
+    #private;
+    constructor(options: {
+        client: FailureRuntimeWatchHostedClient;
+        checkpoints: FailureRuntimeWatchCheckpointStore;
+        intervalMs?: number;
+        now?: () => Date;
+        readOutcome: FailureRuntimeWatchOutcomeReader;
+        bindings?: Array<{
+            taskContractId: string;
+            actionPathId: string;
+            environment: "sandbox";
+        }>;
+    });
+    tick(): Promise<ManagedFailureRuntimeWatchResult>;
+    private runTick;
+}
+/**
+ * Reads only the local sandbox result fields required by Runtime Watch. Raw
+ * provider payloads and unbound audit records never leave the customer Harness.
+ */
+export declare function readLocalSandboxRuntimeWatchOutcome(input: {
+    path: string;
+    resourceId: string;
+    actions: Array<{
+        id: string;
+        executionSessionId?: string;
+    }>;
+    now?: () => Date;
+}): Promise<FailureRuntimeWatchOutcome>;
+//# sourceMappingURL=failure-runtime-watch.d.ts.map

package/dist/vendor/onegent-runtime/failure-runtime-watch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-runtime-watch.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/failure-runtime-watch.ts"],"names":[],"mappings":"AAIA,OAAO,EAA2B,KAAK,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE1I,MAAM,MAAM,yBAAyB,GACjC,SAAS,GACT,YAAY,GACZ,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,GAAG,mBAAmB,GAAG,qBAAqB,GAAG,MAAM,CAAC;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,SAAS,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC;CACpG;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,mBAAmB,CAAC,EAAE;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,IAAI,EAAE;YAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACzG,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;CAC9C;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,EAAE,SAAS,GAAG,YAAY,GAAG,uBAAuB,GAAG,wBAAwB,GAAG,qBAAqB,CAAC;IACtH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,gCAAgC,GAAG,CAAC,KAAK,EAAE;IACrD,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACrC,QAAQ,EAAE,0BAA0B,EAAE,CAAC;CACxC,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAE1C,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,yBAAyB,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,+BAA+B;IAC9C,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACvD,WAAW,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACpD,YAAY,CAAC,OAAO,CAAC,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAC3F,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClG,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9F;AAED,wBAAgB,qCAAqC,CAAC,OAAO,EAAE;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,+BAA+B,CAoClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kCAAkC;IACjD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAED,qBAAa,wCAAyC,YAAW,kCAAkC;;IAG3F,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC;IAKrE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlF;AAED,qBAAa,sCAAuC,YAAW,kCAAkC;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAIxC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC;IASrE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,OAAO,CAAC,IAAI;CAIb;AAED,MAAM,WAAW,gCAAgC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,qBAAa,0BAA0B;;gBASzB,OAAO,EAAE;QACnB,MAAM,EAAE,+BAA+B,CAAC;QACxC,WAAW,EAAE,kCAAkC,CAAC;QAChD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,WAAW,EAAE,gCAAgC,CAAC;QAC9C,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,cAAc,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,SAAS,CAAA;SAAE,CAAC,CAAC;KAC5F;IAYD,IAAI,IAAI,OAAO,CAAC,gCAAgC,CAAC;YAMnC,OAAO;CA4ItB;AAID;;;GAGG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAiEtC"}

package/dist/vendor/onegent-runtime/failure-runtime-watch.js

@@ -0,0 +1,457 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { uploadFailureExperiment } from "./failure-experiment-hosted.js";
+export function createFailureRuntimeWatchHostedClient(options) {
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/u, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const receiptCache = new Map();
+    return {
+        listFailureCases: async () => list(await hostedJson(requestFetch, `${projectUrl}/failure-cases`, apiKey), "failureCases"),
+        listActions: async () => list(await hostedJson(requestFetch, `${projectUrl}/actions`, apiKey), "actions"),
+        listReceipts: async (actions = []) => {
+            const eligible = actions.filter((action) => action.status === "VERIFIED"
+                && action.verificationSuccess === true
+                && action.businessTaskBinding?.environment === "sandbox");
+            const discovered = await Promise.all(eligible.map(async (action) => {
+                const cached = receiptCache.get(action.id);
+                if (cached && cached.actionUpdatedAt === action.updatedAt)
+                    return cached.receipts;
+                const detail = await hostedJson(requestFetch, `${projectUrl}/actions/${encodeURIComponent(required(action.id, "actionId"))}`, apiKey);
+                const receipts = signedVerifiedActionReceipt(detail);
+                receiptCache.set(action.id, { actionUpdatedAt: action.updatedAt, receipts });
+                return receipts;
+            }));
+            return discovered.flat();
+        },
+        uploadObservation: async (input) => uploadFailureExperiment(input, { baseUrl, projectId, apiKey, fetch: requestFetch }),
+        updateStatus: async (failureCaseId, input) => hostedJson(requestFetch, `${projectUrl}/failure-cases/${encodeURIComponent(required(failureCaseId, "failureCaseId"))}/runtime-watch-status`, apiKey, { method: "POST", body: JSON.stringify(input) }),
+    };
+}
+export class MemoryFailureRuntimeWatchCheckpointStore {
+    #checkpoints = new Map();
+    async load(key) {
+        const checkpoint = this.#checkpoints.get(key);
+        return checkpoint ? structuredClone(checkpoint) : undefined;
+    }
+    async save(key, checkpoint) {
+        this.#checkpoints.set(key, structuredClone(checkpoint));
+    }
+}
+export class FileFailureRuntimeWatchCheckpointStore {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+        if (!directory.trim())
+            throw new Error("Failure Runtime Watch checkpoint directory is required.");
+    }
+    async load(key) {
+        try {
+            return validateCheckpoint(JSON.parse(await readFile(this.path(key), "utf8")));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async save(key, checkpoint) {
+        const value = validateCheckpoint(checkpoint);
+        await mkdir(this.directory, { recursive: true });
+        const target = this.path(key);
+        const temporary = `${target}.${randomUUID()}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(value)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, target);
+    }
+    path(key) {
+        if (!key.trim())
+            throw new Error("Failure Runtime Watch checkpoint key is required.");
+        return join(this.directory, `${createHash("sha256").update(key).digest("hex")}.json`);
+    }
+}
+export class ManagedFailureRuntimeWatch {
+    #client;
+    #checkpoints;
+    #intervalMs;
+    #now;
+    #readOutcome;
+    #bindings;
+    #activeTick;
+    constructor(options) {
+        this.#client = options.client;
+        this.#checkpoints = options.checkpoints;
+        this.#intervalMs = options.intervalMs ?? 5_000;
+        this.#now = options.now ?? (() => new Date());
+        this.#readOutcome = options.readOutcome;
+        this.#bindings = options.bindings ? new Set(options.bindings.map(bindingKey)) : undefined;
+        if (!Number.isSafeInteger(this.#intervalMs) || this.#intervalMs < 1_000 || this.#intervalMs > 60_000) {
+            throw new Error("Failure Runtime Watch intervalMs must be between 1000 and 60000.");
+        }
+    }
+    tick() {
+        if (this.#activeTick)
+            return this.#activeTick;
+        this.#activeTick = this.runTick().finally(() => { this.#activeTick = undefined; });
+        return this.#activeTick;
+    }
+    async runTick() {
+        const failureCases = await this.#client.listFailureCases();
+        const candidates = failureCases.filter((failureCase) => failureCase.definition.environment === "sandbox"
+            && (!this.#bindings || this.#bindings.has(bindingKey(failureCase.definition)))
+            && ["FIX_VERIFIED", "RUNTIME_PROTECTED", "REGRESSION_DETECTED"].includes(failureCase.status));
+        if (!candidates.length)
+            return { casesInspected: 0, observationsUploaded: 0, outcomesDeferred: 0, limitations: [] };
+        let actions;
+        let receipts;
+        try {
+            actions = await this.#client.listActions();
+            const candidateBindings = new Set(candidates.map((failureCase) => bindingKey(failureCase.definition)));
+            receipts = await this.#client.listReceipts(actions.filter((action) => {
+                const binding = action.businessTaskBinding;
+                return Boolean(binding?.taskContractId && binding.actionPathId && binding.environment
+                    && candidateBindings.has(bindingKey({
+                        taskContractId: binding.taskContractId,
+                        actionPathId: binding.actionPathId,
+                        environment: binding.environment,
+                    })));
+            }));
+        }
+        catch {
+            const detail = "Runtime Watch could not load new Action and Receipt metadata from Witnora.";
+            await Promise.all(candidates.map((failureCase) => {
+                const checkedAt = this.#now().toISOString();
+                return this.#client.updateStatus(failureCase.id, {
+                    health: "CONNECTION_UNAVAILABLE",
+                    lastCheckedAt: checkedAt,
+                    nextCheckAt: new Date(Date.parse(checkedAt) + this.#intervalMs).toISOString(),
+                    detail,
+                });
+            }));
+            return { casesInspected: candidates.length, observationsUploaded: 0, outcomesDeferred: candidates.length, limitations: [detail] };
+        }
+        let eligible = candidates;
+        if (!this.#bindings) {
+            const discoveredBindings = coveredBindingKeys(actions, receipts);
+            if (discoveredBindings.size !== 1) {
+                const detail = "Runtime Watch requires one exact sandbox Task and action path with an active enforced Receipt.";
+                await Promise.all(candidates.map((failureCase) => {
+                    const checkedAt = this.#now().toISOString();
+                    return this.#client.updateStatus(failureCase.id, {
+                        health: "INSUFFICIENT_EVIDENCE",
+                        lastCheckedAt: checkedAt,
+                        nextCheckAt: new Date(Date.parse(checkedAt) + this.#intervalMs).toISOString(),
+                        detail,
+                    });
+                }));
+                return { casesInspected: candidates.length, observationsUploaded: 0, outcomesDeferred: candidates.length, limitations: [detail] };
+            }
+            const discoveredBinding = [...discoveredBindings][0];
+            eligible = candidates.filter((failureCase) => bindingKey(failureCase.definition) === discoveredBinding);
+        }
+        let observationsUploaded = 0;
+        let outcomesDeferred = 0;
+        const limitations = [];
+        for (const failureCase of eligible) {
+            const checkedAt = this.#now().toISOString();
+            const nextCheckAt = new Date(Date.parse(checkedAt) + this.#intervalMs).toISOString();
+            const storedCheckpoint = await this.#checkpoints.load(failureCase.id);
+            const checkpoint = storedCheckpoint ?? {
+                processedReceiptIds: failureCase.runtimeWatch?.receiptIds ?? failureCase.runtimeWatch?.latest?.receiptIds ?? [],
+                updatedAt: checkedAt,
+            };
+            const covered = coveredOutcomes(failureCase, actions, receipts);
+            const pending = covered.filter(({ receipt }) => !checkpoint.processedReceiptIds.includes(receipt.id));
+            if (!pending.length) {
+                await this.#client.updateStatus(failureCase.id, {
+                    health: failureCase.status === "REGRESSION_DETECTED" ? "REGRESSION" : "HEALTHY",
+                    lastCheckedAt: checkedAt,
+                    nextCheckAt,
+                });
+                if (!storedCheckpoint)
+                    await this.#checkpoints.save(failureCase.id, checkpoint);
+                continue;
+            }
+            const resourceId = pending[0].resourceId;
+            const group = covered.filter((item) => item.resourceId === resourceId);
+            const outcome = await this.#readOutcome({
+                failureCase,
+                resourceId,
+                actions: group.map((item) => item.action),
+                receipts: group.map((item) => item.receipt),
+            });
+            if (outcome.classification !== "HEALTHY" && outcome.classification !== "REGRESSION") {
+                outcomesDeferred += 1;
+                limitations.push(outcome.reason ?? `Failure Runtime Watch deferred ${failureCase.id}: ${outcome.classification}.`);
+                await this.#client.updateStatus(failureCase.id, {
+                    health: outcome.classification === "SCHEMA_DIGEST_DRIFT" ? "INSUFFICIENT_EVIDENCE" : outcome.classification,
+                    lastCheckedAt: checkedAt,
+                    nextCheckAt,
+                    ...(outcome.reason ? { detail: outcome.reason } : {}),
+                });
+                continue;
+            }
+            const receiptIds = group.map((item) => item.receipt.id);
+            const agentVersion = requiredAgentVersion(failureCase, group.map((item) => item.action));
+            await this.#client.uploadObservation({
+                discoveryKey: failureCase.discovery?.discoveryKey ?? failureCase.id,
+                phase: "RUNTIME",
+                observedAt: outcome.observedAt,
+                definition: structuredClone(failureCase.definition),
+                result: {
+                    agentVersion,
+                    attempts: outcome.attempts ?? group.length,
+                    providerCommitCount: outcome.providerCommitCount ?? 0,
+                    duplicateOutcomeCount: outcome.duplicateOutcomeCount ?? 0,
+                    failureCount: outcome.failureCount ?? 0,
+                    hardInvariantViolations: outcome.hardInvariantViolations ?? 0,
+                    observation: "RECORDED",
+                    executionControl: "ENFORCED",
+                    outcome: "VERIFIED",
+                    review: "NOT_REVIEWED",
+                    receiptIds,
+                },
+                evidence: {
+                    summary: outcome.classification === "REGRESSION"
+                        ? "A covered sandbox result reproduced the defined failure after the candidate was verified."
+                        : "A covered sandbox result remained healthy after the candidate was verified.",
+                    measurements: {
+                        providerCommitCount: outcome.providerCommitCount ?? 0,
+                        duplicateOutcomeCount: outcome.duplicateOutcomeCount ?? 0,
+                        failureCount: outcome.failureCount ?? 0,
+                        hardInvariantViolations: outcome.hardInvariantViolations ?? 0,
+                        receiptCount: receiptIds.length,
+                    },
+                    limitations: ["This automated observation covers the exact customer-owned sandbox task and action path only; it does not establish production reliability."],
+                },
+            });
+            observationsUploaded += 1;
+            await this.#client.updateStatus(failureCase.id, {
+                health: outcome.classification === "REGRESSION" ? "REGRESSION" : "HEALTHY",
+                lastCheckedAt: checkedAt,
+                nextCheckAt,
+            });
+            await this.#checkpoints.save(failureCase.id, {
+                processedReceiptIds: unique([...checkpoint.processedReceiptIds, ...receiptIds]),
+                updatedAt: checkedAt,
+            });
+        }
+        return { casesInspected: eligible.length, observationsUploaded, outcomesDeferred, limitations };
+    }
+}
+const MAX_LOCAL_SANDBOX_AUDIT_BYTES = 10 * 1024 * 1024;
+/**
+ * Reads only the local sandbox result fields required by Runtime Watch. Raw
+ * provider payloads and unbound audit records never leave the customer Harness.
+ */
+export async function readLocalSandboxRuntimeWatchOutcome(input) {
+    const observedAt = () => (input.now?.() ?? new Date()).toISOString();
+    const attempts = input.actions.length;
+    let source;
+    try {
+        const metadata = await stat(input.path);
+        if (!metadata.isFile() || metadata.size > MAX_LOCAL_SANDBOX_AUDIT_BYTES) {
+            return deferred("SCHEMA_DIGEST_DRIFT", attempts, observedAt(), "The local sandbox audit is not a bounded readable file.");
+        }
+        source = await readFile(input.path, "utf8");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "EACCES" || code === "EPERM") {
+            return deferred("CONNECTION_UNAVAILABLE", attempts, observedAt(), "The local sandbox audit is unavailable to Runtime Watch.");
+        }
+        throw error;
+    }
+    const expected = new Map(input.actions.map((action) => [action.id, action]));
+    if (expected.size !== input.actions.length || !input.resourceId || [...expected.values()].some((action) => !action.id)) {
+        return deferred("INSUFFICIENT_EVIDENCE", attempts, observedAt(), "The covered Action bindings are incomplete.");
+    }
+    const commits = new Map();
+    for (const line of source.split(/\r?\n/u)) {
+        if (!line.trim())
+            continue;
+        let raw;
+        try {
+            raw = JSON.parse(line);
+        }
+        catch {
+            return deferred("SCHEMA_DIGEST_DRIFT", attempts, observedAt(), "The local sandbox audit contains invalid JSON.");
+        }
+        if (!isRecord(raw) || raw.phase !== "COMMITTED")
+            continue;
+        const record = allowlistedCommittedAuditRecord(raw);
+        if (!record) {
+            return deferred("SCHEMA_DIGEST_DRIFT", attempts, observedAt(), "A committed local sandbox result is missing an allowlisted field.");
+        }
+        const expectedAction = expected.get(record.actionId);
+        if (record.resourceId !== input.resourceId || !expectedAction)
+            continue;
+        if (expectedAction.executionSessionId && expectedAction.executionSessionId !== record.executionSessionId)
+            continue;
+        const digest = createHash("sha256").update(JSON.stringify(record.observedState)).digest("hex");
+        if (digest !== record.stateSha256) {
+            return deferred("SCHEMA_DIGEST_DRIFT", attempts, observedAt(), "A covered local sandbox result failed its state digest check.");
+        }
+        const existing = commits.get(record.actionId);
+        if (existing && existing.executionSessionId !== record.executionSessionId) {
+            return deferred("INSUFFICIENT_EVIDENCE", attempts, observedAt(), "A covered Action has more than one execution-session result.");
+        }
+        if (!existing || record.at > existing.at)
+            commits.set(record.actionId, { at: record.at, executionSessionId: record.executionSessionId });
+    }
+    if (commits.size !== expected.size) {
+        return deferred("INSUFFICIENT_EVIDENCE", attempts, observedAt(), "Not every covered Action has a digest-verified committed result.");
+    }
+    const latest = [...commits.values()].map((commit) => commit.at).sort().at(-1);
+    const duplicateOutcomeCount = Math.max(0, commits.size - 1);
+    return {
+        classification: duplicateOutcomeCount > 0 ? "REGRESSION" : "HEALTHY",
+        attempts,
+        providerCommitCount: commits.size,
+        duplicateOutcomeCount,
+        failureCount: duplicateOutcomeCount > 0 ? 1 : 0,
+        hardInvariantViolations: duplicateOutcomeCount > 0 ? 1 : 0,
+        observedAt: latest,
+    };
+}
+function allowlistedCommittedAuditRecord(value) {
+    if (typeof value.resourceId !== "string"
+        || typeof value.actionId !== "string"
+        || typeof value.executionSessionId !== "string"
+        || !isRecord(value.observedState)
+        || typeof value.stateSha256 !== "string"
+        || !/^[a-f0-9]{64}$/u.test(value.stateSha256)
+        || typeof value.at !== "string"
+        || Number.isNaN(Date.parse(value.at)))
+        return undefined;
+    return {
+        resourceId: value.resourceId,
+        actionId: value.actionId,
+        executionSessionId: value.executionSessionId,
+        observedState: value.observedState,
+        stateSha256: value.stateSha256,
+        at: new Date(value.at).toISOString(),
+    };
+}
+function deferred(classification, attempts, observedAt, reason) {
+    return { classification, attempts, observedAt, reason };
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function coveredOutcomes(failureCase, actions, receipts) {
+    const watchStartedAt = timestamp(failureCase.runtimeWatch?.activatedAt
+        ?? failureCase.candidate?.recordedAt
+        ?? failureCase.updatedAt);
+    const receiptsByAction = new Map(receipts.filter((receipt) => {
+        const receiptCreatedAt = timestamp(receipt.createdAt);
+        return eligibleReceipt(receipt)
+            && (!watchStartedAt || (receiptCreatedAt !== undefined && receiptCreatedAt >= watchStartedAt));
+    })
+        .map((receipt) => [receipt.actionId, receipt]));
+    return actions.flatMap((action) => {
+        const binding = action.businessTaskBinding;
+        const receipt = receiptsByAction.get(action.id);
+        const resourceId = typeof action.expectedState?.resourceId === "string" ? action.expectedState.resourceId : undefined;
+        return receipt && action.status === "VERIFIED" && resourceId
+            && binding?.taskContractId === failureCase.definition.taskContractId
+            && binding.actionPathId === failureCase.definition.actionPathId
+            && binding.environment === failureCase.definition.environment
+            ? [{ action, receipt, resourceId }]
+            : [];
+    }).sort((left, right) => left.receipt.createdAt.localeCompare(right.receipt.createdAt));
+}
+function coveredBindingKeys(actions, receipts) {
+    const coveredActionIds = new Set(receipts.filter(eligibleReceipt)
+        .map((receipt) => receipt.actionId));
+    return new Set(actions.flatMap((action) => {
+        const binding = action.businessTaskBinding;
+        return action.status === "VERIFIED" && coveredActionIds.has(action.id)
+            && binding?.environment === "sandbox" && binding.taskContractId && binding.actionPathId
+            ? [bindingKey({ taskContractId: binding.taskContractId, actionPathId: binding.actionPathId, environment: binding.environment })]
+            : [];
+    }));
+}
+function requiredAgentVersion(failureCase, actions) {
+    const versions = new Set(actions.map((action) => action.businessTaskBinding?.agentVersion ?? failureCase.candidate?.agentVersion).filter(Boolean));
+    if (versions.size !== 1)
+        throw new Error("Failure Runtime Watch requires one exact Agent version.");
+    return [...versions][0];
+}
+function unique(values) { return [...new Set(values)]; }
+function bindingKey(value) {
+    return `${value.taskContractId}\0${value.actionPathId}\0${value.environment}`;
+}
+function eligibleReceipt(receipt) {
+    return receipt.discoveryBoundary === "SIGNED_VERIFIED_ACTION"
+        || (receipt.currentStatus === "ACTIVE"
+            && receipt.receipt.core.enforcementLevel === "ENFORCED"
+            && (receipt.receipt.core.evidenceStrength === "OUTCOME_VERIFIED"
+                || receipt.receipt.core.evidenceStrength === "INDEPENDENTLY_REVIEWED"));
+}
+function signedVerifiedActionReceipt(value) {
+    const receiptId = value.receiptId;
+    const actionId = value.id;
+    const signatureCount = value.receiptSignatureCount;
+    const createdAt = typeof value.updatedAt === "string" ? value.updatedAt : value.createdAt;
+    if (value.status !== "VERIFIED"
+        || value.verificationSuccess !== true
+        || typeof receiptId !== "string" || !receiptId
+        || typeof actionId !== "string" || !actionId
+        || !Number.isSafeInteger(signatureCount) || signatureCount < 1
+        || typeof createdAt !== "string" || Number.isNaN(Date.parse(createdAt)))
+        return [];
+    return [{
+            id: receiptId,
+            actionId,
+            currentStatus: "DISCOVERED",
+            createdAt: new Date(createdAt).toISOString(),
+            receipt: { core: {} },
+            discoveryBoundary: "SIGNED_VERIFIED_ACTION",
+        }];
+}
+function timestamp(value) {
+    if (!value)
+        return undefined;
+    const parsed = Date.parse(value);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
+async function hostedJson(requestFetch, url, apiKey, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${apiKey}`);
+    if (typeof init.body === "string")
+        headers.set("content-type", "application/json");
+    const response = await requestFetch(url, { ...init, headers, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(typeof value.error === "string" ? value.error : `Witnora Control Plane request failed (${response.status}).`);
+    return value;
+}
+function list(value, field) {
+    const items = value[field];
+    if (!Array.isArray(items) || items.length > 1_000)
+        throw new Error(`Witnora returned an invalid ${field} list.`);
+    return items;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Failure Runtime Watch ${name} is required.`);
+    return normalized;
+}
+function validateCheckpoint(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Failure Runtime Watch checkpoint is invalid.");
+    const checkpoint = value;
+    if (!Array.isArray(checkpoint.processedReceiptIds)
+        || checkpoint.processedReceiptIds.length > 1_000
+        || checkpoint.processedReceiptIds.some((id) => typeof id !== "string" || !id || id.length > 200)
+        || new Set(checkpoint.processedReceiptIds).size !== checkpoint.processedReceiptIds.length
+        || typeof checkpoint.updatedAt !== "string"
+        || Number.isNaN(Date.parse(checkpoint.updatedAt))) {
+        throw new Error("Failure Runtime Watch checkpoint is invalid.");
+    }
+    return { processedReceiptIds: [...checkpoint.processedReceiptIds], updatedAt: new Date(checkpoint.updatedAt).toISOString() };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.18.12",
+  "version": "0.18.14",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",