xoonya 3.0.1 → 3.1.0

package/lib/provenance_lane_contract.js

@@ -1,54 +1,54 @@
-"use strict";
-
-function buildProvenanceLanePack() {
-  return {
-    product: "xoonya",
-    category: "proof-provenance-lane-pack",
-    pack_version: "xoonya-provenance-lane-pack-v1",
-    lane_state: "first_party_provenance_lane_present",
-    posture: "proof_release_and_bundle_supply_chain_trust_lane",
-    standards: ["slsa"],
-    focal_surfaces: ["release_candidate", "release_manifest", "proof_bridge", "result_package_trust"],
-    supported_surfaces: {
-      release_candidate_ref: "/v1/release-candidate",
-      release_manifest_ref: "/v1/release-manifest",
-      release_center_ref: "/v1/release-center",
-      proof_bridge_ref: "/v1/proof-bridge",
-      result_package_trust_ref: "/v1/result-package-trust"
-    },
-    first_run_flows: [
-      {
-        flow_ref: "proof_provenance_review",
-        recommended_reason: "best path for teams that need trust in proof artifacts, release posture, and imported evidence before wider rollout",
-        sequence: [
-          "inspect_provenance_lane_summary",
-          "inspect_release_candidate_and_manifest",
-          "inspect proof_bridge and result_package_trust surfaces",
-          "treat proof artifacts and release posture as provenance-carrying trust anchors"
-        ]
-      }
-    ],
-    guardrails: [
-      "provenance should strengthen trust in proof artifacts without replacing proof verification itself",
-      "supply-chain trust remains complementary to canonical proof semantics"
-    ]
-  };
-}
-
-function summarizeProvenanceLanePack() {
-  const pack = buildProvenanceLanePack();
-  return {
-    product: "xoonya",
-    category: "proof-provenance-lane-pack-summary",
-    summary_version: "xoonya-provenance-lane-pack-summary-v1",
-    lane_state: pack.lane_state,
-    standard_count: pack.standards.length,
-    focal_surface_count: pack.focal_surfaces.length,
-    linked_surfaces: pack.supported_surfaces
-  };
-}
-
-module.exports = {
-  buildProvenanceLanePack,
-  summarizeProvenanceLanePack
-};
+"use strict";
+
+function buildProvenanceLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-provenance-lane-pack",
+    pack_version: "xoonya-provenance-lane-pack-v1",
+    lane_state: "first_party_provenance_lane_present",
+    posture: "proof_release_and_bundle_supply_chain_trust_lane",
+    standards: ["slsa"],
+    focal_surfaces: ["release_candidate", "release_manifest", "proof_bridge", "result_package_trust"],
+    supported_surfaces: {
+      release_candidate_ref: "/v1/release-candidate",
+      release_manifest_ref: "/v1/release-manifest",
+      release_center_ref: "/v1/release-center",
+      proof_bridge_ref: "/v1/proof-bridge",
+      result_package_trust_ref: "/v1/result-package-trust"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "proof_provenance_review",
+        recommended_reason: "best path for teams that need trust in proof artifacts, release posture, and imported evidence before wider rollout",
+        sequence: [
+          "inspect_provenance_lane_summary",
+          "inspect_release_candidate_and_manifest",
+          "inspect proof_bridge and result_package_trust surfaces",
+          "treat proof artifacts and release posture as provenance-carrying trust anchors"
+        ]
+      }
+    ],
+    guardrails: [
+      "provenance should strengthen trust in proof artifacts without replacing proof verification itself",
+      "supply-chain trust remains complementary to canonical proof semantics"
+    ]
+  };
+}
+
+function summarizeProvenanceLanePack() {
+  const pack = buildProvenanceLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-provenance-lane-pack-summary",
+    summary_version: "xoonya-provenance-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    standard_count: pack.standards.length,
+    focal_surface_count: pack.focal_surfaces.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildProvenanceLanePack,
+  summarizeProvenanceLanePack
+};

package/lib/provider_lane_contract.js

@@ -1,67 +1,67 @@
-"use strict";
-
-const {
-  buildPhase1OpenaiCodexProofPack,
-  summarizePhase1OpenaiCodexProofPack
-} = require("./phase_1_openai_codex_proof_pack");
-const {
-  buildPhase1ClaudeMcpProofPack,
-  summarizePhase1ClaudeMcpProofPack
-} = require("./phase_1_claude_mcp_proof_pack");
-
-function buildProviderLanePack() {
-  return {
-    product: "xoonya",
-    category: "proof-provider-lane-pack",
-    pack_version: "xoonya-provider-lane-pack-v1",
-    lane_state: "first_party_provider_family_present",
-    posture: "provider_entry_and_proof_followthrough_family",
-    featured_providers: {
-      openai_codex: {
-        pack: buildPhase1OpenaiCodexProofPack(),
-        summary: summarizePhase1OpenaiCodexProofPack()
-      },
-      claude_mcp: {
-        pack: buildPhase1ClaudeMcpProofPack(),
-        summary: summarizePhase1ClaudeMcpProofPack()
-      }
-    },
-    supported_surfaces: {
-      phase_1_summary_ref: "/v1/phases/phase-1/summary",
-      openai_codex_summary_ref: "/v1/phases/phase-1/openai-codex/proof/summary",
-      claude_mcp_summary_ref: "/v1/phases/phase-1/claude-mcp/proof/summary",
-      proof_bridge_ref: "/v1/proof-bridge",
-      integrations_ref: "/v1/integrations"
-    },
-    first_run_flows: [
-      {
-        flow_ref: "provider_family_proof_selection",
-        recommended_reason: "best first path for understanding how named provider-originated runs enter the canonical proof and review system",
-        sequence: [
-          "inspect_provider_lane_summary",
-          "inspect_openai_codex_and_claude_mcp_proof_profiles",
-          "choose_the_followthrough_shape",
-          "continue_into_bridge_and_result_package_review"
-        ]
-      }
-    ]
-  };
-}
-
-function summarizeProviderLanePack() {
-  const pack = buildProviderLanePack();
-  return {
-    product: "xoonya",
-    category: "proof-provider-lane-pack-summary",
-    summary_version: "xoonya-provider-lane-pack-summary-v1",
-    lane_state: pack.lane_state,
-    featured_provider_count: Object.keys(pack.featured_providers).length,
-    first_run_flow_count: pack.first_run_flows.length,
-    linked_surfaces: pack.supported_surfaces
-  };
-}
-
-module.exports = {
-  buildProviderLanePack,
-  summarizeProviderLanePack
-};
+"use strict";
+
+const {
+  buildPhase1OpenaiCodexProofPack,
+  summarizePhase1OpenaiCodexProofPack
+} = require("./phase_1_openai_codex_proof_pack");
+const {
+  buildPhase1ClaudeMcpProofPack,
+  summarizePhase1ClaudeMcpProofPack
+} = require("./phase_1_claude_mcp_proof_pack");
+
+function buildProviderLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-provider-lane-pack",
+    pack_version: "xoonya-provider-lane-pack-v1",
+    lane_state: "first_party_provider_family_present",
+    posture: "provider_entry_and_proof_followthrough_family",
+    featured_providers: {
+      openai_codex: {
+        pack: buildPhase1OpenaiCodexProofPack(),
+        summary: summarizePhase1OpenaiCodexProofPack()
+      },
+      claude_mcp: {
+        pack: buildPhase1ClaudeMcpProofPack(),
+        summary: summarizePhase1ClaudeMcpProofPack()
+      }
+    },
+    supported_surfaces: {
+      phase_1_summary_ref: "/v1/phases/phase-1/summary",
+      openai_codex_summary_ref: "/v1/phases/phase-1/openai-codex/proof/summary",
+      claude_mcp_summary_ref: "/v1/phases/phase-1/claude-mcp/proof/summary",
+      proof_bridge_ref: "/v1/proof-bridge",
+      integrations_ref: "/v1/integrations"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "provider_family_proof_selection",
+        recommended_reason: "best first path for understanding how named provider-originated runs enter the canonical proof and review system",
+        sequence: [
+          "inspect_provider_lane_summary",
+          "inspect_openai_codex_and_claude_mcp_proof_profiles",
+          "choose_the_followthrough_shape",
+          "continue_into_bridge_and_result_package_review"
+        ]
+      }
+    ]
+  };
+}
+
+function summarizeProviderLanePack() {
+  const pack = buildProviderLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-provider-lane-pack-summary",
+    summary_version: "xoonya-provider-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    featured_provider_count: Object.keys(pack.featured_providers).length,
+    first_run_flow_count: pack.first_run_flows.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildProviderLanePack,
+  summarizeProviderLanePack
+};

package/lib/public_surface_policy_contract.js

@@ -0,0 +1,111 @@
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildPublicSurfacePolicyContractPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-public-surface-policy-contract",
+    pack_version: "naxytra-public-surface-policy-contract-v1",
+    doctrine: "xoonya_respects_public_surface_classification_before_accepting_or_reviewing_any_surface",
+    model_state: "core_now",
+    core_claim: "every public surface must declare discovery paid proof_review or operator_only policy before it is treated as part of the public stack",
+    surface_classes: [
+      {
+        surface_class: "discovery_only",
+        description: "public informational and machine-discoverable surfaces",
+        examples: [
+          "/health",
+          "/server.json",
+          "/.well-known/mcp-server.json",
+          "/.well-known/glama.json",
+          "/v1/agent-discovery-index",
+          "/v1/agent-discovery-index/summary"
+        ]
+      },
+      {
+        surface_class: "paid",
+        description: "machine work or runtime invocation surfaces",
+        examples: [
+          "POST /v1/commands/execute",
+          "POST /x402/commands/execute",
+          "POST /v1/mcp/tools/invoke",
+          "POST /x402/mcp/tools/invoke"
+        ]
+      },
+      {
+        surface_class: "proof_review",
+        description: "proof and evidence review surfaces",
+        examples: [
+          "/v1/proof-truth",
+          "/v1/proof-truth/summary",
+          "/v1/followthrough-truth",
+          "/v1/followthrough-truth/summary",
+          "/v1/receipts",
+          "/v1/receipts/:receipt_id"
+        ]
+      },
+      {
+        surface_class: "operator_only",
+        description: "internal control or mutable operator surfaces",
+        examples: [
+          "/v1/business-cockpit",
+          "/business-cockpit",
+          "/v1/operator-shell",
+          "/v1/agent-accounts"
+        ]
+      }
+    ],
+    enforcement_rules: [
+      "discovery_only_surfaces_must_not_require_payment",
+      "paid_surfaces_must_carry_payment_or_challenge_metadata_when_public",
+      "proof_review_surfaces_must_not_mutate_runtime_or_treasury_truth",
+      "operator_only_surfaces_must_not_be_listed_as_public_discovery",
+      "every_new_surface_must_choose_a_class_before_release"
+    ],
+    route_fields: [
+      "surface_path",
+      "surface_class",
+      "requires_payment",
+      "requires_operator_auth",
+      "proof_boundary",
+      "claim_boundary"
+    ],
+    linked_surfaces: {
+      discovery_index_ref: "/v1/agent-discovery-index",
+      discovery_index_summary_ref: "/v1/agent-discovery-index/summary",
+      proof_truth_ref: "/v1/proof-truth",
+      followthrough_truth_ref: "/v1/followthrough-truth",
+      operator_cockpit_ref: "/v1/business-cockpit"
+    },
+    claim_boundary: "claim_the_public_surface_policy_for_xoonya_only_without_claiming_runtime_payment_or_proof_truth_beyond_the_listed_surfaces"
+  };
+}
+
+function summarizePublicSurfacePolicyContractPack() {
+  const pack = buildPublicSurfacePolicyContractPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-public-surface-policy-contract-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    surface_class_count: pack.surface_classes.length,
+    rule_count: pack.enforcement_rules.length,
+    route_field_count: pack.route_fields.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getPublicSurfaceClassDetail(surfaceClass) {
+  const normalized = String(surfaceClass || "").trim().toLowerCase();
+  return (buildPublicSurfacePolicyContractPack().surface_classes || []).find((entry) => entry.surface_class === normalized) || null;
+}
+
+module.exports = {
+  buildPublicSurfacePolicyContractPack,
+  summarizePublicSurfacePolicyContractPack,
+  getPublicSurfaceClassDetail
+};

package/lib/publish_plan.js

@@ -1,51 +1,51 @@
-"use strict";
-
-const packageJson = require("../package.json");
-
-function buildPublishPlan() {
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "proof-publish-plan",
-    version: packageJson.version,
-    commands: {
-      verify_release_candidate: "npm run verify:release-candidate",
-      pack_dry_run: "npm pack --dry-run --json",
-      publish: "npm publish --access public",
-      release_cli_check: "xoonya-release --candidate --summary"
-    },
-    live_checks: [
-      "/v1/release-candidate/summary",
-      "/v1/release-center/summary",
-      "/v1/announcement-pack/summary",
-      "/v1/outreach-proof/summary"
-    ],
-    publish_sequence: [
-      "run the release-candidate verification",
-      "confirm the dry-run package contents",
-      "publish the npm package at public access",
-      "redeploy the live service surfaces",
-      "verify the release-candidate and release-center summaries live",
-      "run the first public proof-side review path"
-    ]
-  };
-}
-
-function summarizePublishPlan() {
-  const plan = buildPublishPlan();
-  return {
-    ok: true,
-    product: plan.product,
-    category: plan.category,
-    version: plan.version,
-    command_count: Object.keys(plan.commands).length,
-    live_check_count: plan.live_checks.length,
-    publish_step_count: plan.publish_sequence.length,
-    publish_command: plan.commands.publish
-  };
-}
-
-module.exports = {
-  buildPublishPlan,
-  summarizePublishPlan
-};
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildPublishPlan() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "proof-publish-plan",
+    version: packageJson.version,
+    commands: {
+      verify_release_candidate: "npm run verify:release-candidate",
+      pack_dry_run: "npm pack --dry-run --json",
+      publish: "npm publish --access public",
+      release_cli_check: "xoonya-release --candidate --summary"
+    },
+    live_checks: [
+      "/v1/release-candidate/summary",
+      "/v1/release-center/summary",
+      "/v1/announcement-pack/summary",
+      "/v1/outreach-proof/summary"
+    ],
+    publish_sequence: [
+      "run the release-candidate verification",
+      "confirm the dry-run package contents",
+      "publish the npm package at public access",
+      "redeploy the live service surfaces",
+      "verify the release-candidate and release-center summaries live",
+      "run the first public proof-side review path"
+    ]
+  };
+}
+
+function summarizePublishPlan() {
+  const plan = buildPublishPlan();
+  return {
+    ok: true,
+    product: plan.product,
+    category: plan.category,
+    version: plan.version,
+    command_count: Object.keys(plan.commands).length,
+    live_check_count: plan.live_checks.length,
+    publish_step_count: plan.publish_sequence.length,
+    publish_command: plan.commands.publish
+  };
+}
+
+module.exports = {
+  buildPublishPlan,
+  summarizePublishPlan
+};

package/lib/release_candidate.js

@@ -1,50 +1,50 @@
-"use strict";
-
-const packageJson = require("../package.json");
-
-function buildReleaseCandidatePack() {
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "proof-release-candidate",
-    version: packageJson.version,
-    package_posture: {
-      publish_access: packageJson.publishConfig && packageJson.publishConfig.access ? packageJson.publishConfig.access : null,
-      engine: packageJson.engines && packageJson.engines.node ? packageJson.engines.node : null,
-      bin_count: Object.keys(packageJson.bin || {}).length,
-      published_file_count: Array.isArray(packageJson.files) ? packageJson.files.length : 0
-    },
-    rehearsal: {
-      clean_install_command: "npm install xoonya",
-      dry_run_pack_command: "npm pack --dry-run --json",
-      release_check_command: "npm run verify:release-candidate",
-      first_release_view: "xoonya-release --candidate --summary"
-    },
-    checklist: [
-      "run npm run verify:release-candidate",
-      "confirm npm pack --dry-run includes public docs and bin entrypoints",
-      "confirm release-center and announcement-pack summaries are live after deploy",
-      "confirm the first public proof-side review path still succeeds",
-      "only then proceed to npm publish"
-    ]
-  };
-}
-
-function summarizeReleaseCandidatePack() {
-  const pack = buildReleaseCandidatePack();
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    version: pack.version,
-    publish_access: pack.package_posture.publish_access,
-    bin_count: pack.package_posture.bin_count,
-    published_file_count: pack.package_posture.published_file_count,
-    checklist_count: pack.checklist.length
-  };
-}
-
-module.exports = {
-  buildReleaseCandidatePack,
-  summarizeReleaseCandidatePack
-};
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildReleaseCandidatePack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "proof-release-candidate",
+    version: packageJson.version,
+    package_posture: {
+      publish_access: packageJson.publishConfig && packageJson.publishConfig.access ? packageJson.publishConfig.access : null,
+      engine: packageJson.engines && packageJson.engines.node ? packageJson.engines.node : null,
+      bin_count: Object.keys(packageJson.bin || {}).length,
+      published_file_count: Array.isArray(packageJson.files) ? packageJson.files.length : 0
+    },
+    rehearsal: {
+      clean_install_command: "npm install xoonya",
+      dry_run_pack_command: "npm pack --dry-run --json",
+      release_check_command: "npm run verify:release-candidate",
+      first_release_view: "xoonya-release --candidate --summary"
+    },
+    checklist: [
+      "run npm run verify:release-candidate",
+      "confirm npm pack --dry-run includes public docs and bin entrypoints",
+      "confirm release-center and announcement-pack summaries are live after deploy",
+      "confirm the first public proof-side review path still succeeds",
+      "only then proceed to npm publish"
+    ]
+  };
+}
+
+function summarizeReleaseCandidatePack() {
+  const pack = buildReleaseCandidatePack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    version: pack.version,
+    publish_access: pack.package_posture.publish_access,
+    bin_count: pack.package_posture.bin_count,
+    published_file_count: pack.package_posture.published_file_count,
+    checklist_count: pack.checklist.length
+  };
+}
+
+module.exports = {
+  buildReleaseCandidatePack,
+  summarizeReleaseCandidatePack
+};