xytara 2.6.0 → 2.8.0

package/scripts/verify_operator_observability_boundary.js

@@ -0,0 +1,83 @@
+"use strict";
+
+const assert = require("assert");
+const {
+  buildOperatorObservabilityPack,
+  validateOperatorObservabilityBoundary
+} = require("../lib/operator_intelligence");
+const { createRuntimeState } = require("../lib/commerce_runtime");
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function assertRejected(pack, expectedCode) {
+  const validation = validateOperatorObservabilityBoundary(pack);
+  assert.strictEqual(validation.observability_boundary_valid, false, `expected ${expectedCode} to block operator observability boundary`);
+  assert.strictEqual(
+    validation.rejection_codes.includes(expectedCode),
+    true,
+    `missing deterministic rejection code ${expectedCode}`
+  );
+  return validation;
+}
+
+function main() {
+  const pack = buildOperatorObservabilityPack(createRuntimeState());
+  const validation = validateOperatorObservabilityBoundary(pack);
+  assert.strictEqual(pack.category, "machine-commerce-operator-observability-pack", "operator observability category mismatch");
+  assert.strictEqual(validation.observability_boundary_valid, true, "operator observability boundary should validate");
+  assert.deepStrictEqual(validation.rejection_codes, [], "operator observability boundary should not carry rejections");
+  assert.strictEqual(pack.deterministic_rejection_codes.length >= 8, true, "operator observability rejection codes missing");
+
+  const missingBoundary = clone(pack);
+  missingBoundary.boundary = "unsafe";
+  assertRejected(missingBoundary, "boundary_missing");
+
+  const missingSurface = clone(pack);
+  delete missingSurface.linked_surfaces.payment_ledger_ref;
+  assertRejected(missingSurface, "missing_linked_surface");
+
+  const mutationSurface = clone(pack);
+  mutationSurface.linked_surfaces.payment_ledger_ref = "/v1/payment-ledger/refund";
+  assertRejected(mutationSurface, "mutation_surface_linked");
+
+  const settlementSubmit = clone(pack);
+  settlementSubmit.linked_surfaces.settlement_ref = "/v1/settlement/bsv-teranode/submit";
+  assertRejected(settlementSubmit, "settlement_submission_surface_linked");
+
+  const fundMovement = clone(pack);
+  fundMovement.linked_surfaces.operator_intelligence_ref = "/v1/treasury/release";
+  assertRejected(fundMovement, "fund_movement_surface_linked");
+
+  const unsafeAction = clone(pack);
+  unsafeAction.attention_queue = [{
+    lane: "settlement",
+    priority: "high",
+    action: "submit_settlement_now",
+    surface_ref: "/v1/settlement/bsv-teranode",
+    reason: "bad action"
+  }];
+  assertRejected(unsafeAction, "unsafe_attention_action");
+
+  const secretMaterial = clone(pack);
+  secretMaterial.operator_token = "sk_live_accidental_secret";
+  assertRejected(secretMaterial, "secret_material_forbidden");
+
+  const badCount = clone(pack);
+  badCount.counts.quote_count = "1";
+  assertRejected(badCount, "count_not_number");
+
+  const output = {
+    ok: true,
+    product: "xytara",
+    category: "xytara-operator-observability-boundary-verification",
+    status: "operator_observability_stays_read_only_without_secret_material_or_mutation_surfaces",
+    deterministic_rejection_code_count: pack.deterministic_rejection_codes.length,
+    adversarial_case_count: 8,
+    boundary: validation.boundary
+  };
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+main();

package/scripts/verify_pricing_experiment_plan.js

@@ -0,0 +1,124 @@
+"use strict";
+
+const assert = require("assert");
+const {
+  buildPricingExperimentPlan,
+  summarizePricingExperimentPlan,
+  validatePricingExperimentLaunchRequest
+} = require("../lib/pricing_optimization_contract");
+const { createRuntimeState } = require("../lib/commerce_runtime");
+
+function populateMaturePricingState(state) {
+  for (let index = 0; index < 100; index += 1) {
+    state.quotes.set(`quote_${index}`, {
+      quote_id: `quote_${index}`,
+      status: index < 50 ? "executed" : "expired",
+      amount_minor: 40,
+      task_refs: ["adapter.mcp.invoke"],
+      payment_protocol: "x402",
+      settlement_mode: "bsv_teranode"
+    });
+  }
+  for (let index = 0; index < 20; index += 1) {
+    state.paymentLedger.push({
+      payment_id: `payment_${index}`,
+      status: "recorded",
+      amount_minor: 40
+    });
+    state.transactions.set(`txn_${index}`, {
+      transaction: {
+        transaction_id: `txn_${index}`,
+        status: "completed"
+      }
+    });
+  }
+}
+
+function buildValidLaunchRequest(candidate) {
+  const rollback_trigger_thresholds = {};
+  for (const trigger of candidate.rollback_triggers) {
+    rollback_trigger_thresholds[trigger] = "operator_defined_threshold";
+  }
+  return {
+    experiment_id: candidate.experiment_id,
+    target_surface: candidate.target_surface,
+    operator_approval_ref: "ops.pricing.approval.2026-04-22",
+    baseline_metrics_ref: "ops.pricing.baseline.2026-04-22",
+    rollback_trigger_thresholds,
+    public_checkout_copy_review_ref: "ops.pricing.copy_review.2026-04-22",
+    post_experiment_review_window_days: 14
+  };
+}
+
+function assertRejected(plan, request, expectedCode) {
+  const validation = validatePricingExperimentLaunchRequest(plan, request);
+  assert.strictEqual(validation.launch_allowed, false, `expected ${expectedCode} to block pricing experiment launch`);
+  assert.strictEqual(
+    validation.rejection_codes.includes(expectedCode),
+    true,
+    `missing deterministic rejection code ${expectedCode}`
+  );
+  return validation;
+}
+
+function main() {
+  const state = createRuntimeState();
+  const plan = buildPricingExperimentPlan(state);
+  const summary = summarizePricingExperimentPlan(state);
+
+  assert.strictEqual(plan.experiment_plan_version, "xytara-pricing-experiment-plan-v1", "pricing experiment plan version mismatch");
+  assert.strictEqual(plan.allow_experiment_launch, false, "empty state must not allow pricing experiments");
+  assert.strictEqual(plan.experiment_state, "blocked_collect_more_live_data", "empty state experiment gate mismatch");
+  assert.strictEqual(plan.required_minimum_live_sample.quote_count, 100, "quote sample floor mismatch");
+  assert.strictEqual(plan.required_minimum_live_sample.payment_ledger_count, 20, "payment sample floor mismatch");
+  assert.strictEqual(plan.required_minimum_live_sample.execution_transaction_count, 20, "execution sample floor mismatch");
+  assert.strictEqual(plan.candidate_experiments.length >= 3, true, "candidate experiments missing");
+  assert.strictEqual(
+    plan.candidate_experiments.every((entry) => entry.allowed_now === false),
+    true,
+    "candidate experiments should be blocked while sparse"
+  );
+  assert.strictEqual(
+    plan.blocked_actions.includes("start_price_ab_test_from_sparse_signals"),
+    true,
+    "sparse-signal blocked action missing"
+  );
+  assert.strictEqual(summary.category, "machine-commerce-pricing-experiment-plan-summary", "summary category mismatch");
+  assert.strictEqual(summary.allow_experiment_launch, false, "summary experiment launch guard mismatch");
+  assert.strictEqual(summary.deterministic_rejection_code_count >= 9, true, "pricing rejection code count missing");
+
+  assertRejected(plan, buildValidLaunchRequest(plan.candidate_experiments[0]), "pricing_sample_too_sparse");
+  assertRejected(plan, { experiment_id: "unknown_experiment" }, "experiment_not_registered");
+
+  const matureState = createRuntimeState();
+  populateMaturePricingState(matureState);
+  const maturePlan = buildPricingExperimentPlan(matureState);
+  const matureCandidate = maturePlan.candidate_experiments[0];
+  const validLaunchRequest = buildValidLaunchRequest(matureCandidate);
+  const validLaunch = validatePricingExperimentLaunchRequest(maturePlan, validLaunchRequest);
+  assert.strictEqual(maturePlan.allow_experiment_launch, true, "mature state should allow operator-reviewed experiments");
+  assert.strictEqual(validLaunch.launch_allowed, true, "valid mature launch request should pass");
+  assert.deepStrictEqual(validLaunch.rejection_codes, [], "valid launch request must not carry rejection codes");
+
+  assertRejected(maturePlan, { ...validLaunchRequest, operator_approval_ref: null }, "operator_approval_missing");
+  assertRejected(maturePlan, { ...validLaunchRequest, baseline_metrics_ref: null }, "baseline_metrics_missing");
+  assertRejected(maturePlan, { ...validLaunchRequest, rollback_trigger_thresholds: {} }, "rollback_trigger_thresholds_missing");
+  assertRejected(maturePlan, { ...validLaunchRequest, public_checkout_copy_review_ref: null }, "public_checkout_copy_review_missing");
+  assertRejected(maturePlan, { ...validLaunchRequest, post_experiment_review_window_days: 0 }, "post_experiment_review_window_missing");
+  assertRejected(maturePlan, { ...validLaunchRequest, target_surface: "wrong_surface" }, "target_surface_mismatch");
+
+  const output = {
+    ok: true,
+    product: "xytara",
+    category: "xytara-pricing-experiment-plan-verification",
+    status: "experiment_plan_blocks_sparse_signal_and_malformed_launch_requests",
+    candidate_experiment_count: plan.candidate_experiments.length,
+    launch_requirement_count: plan.launch_requirements.length,
+    deterministic_rejection_code_count: plan.deterministic_rejection_codes.length,
+    adversarial_case_count: 8,
+    boundary: plan.boundary
+  };
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+main();

package/scripts/verify_production_readiness.js

@@ -0,0 +1,251 @@
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+function ensureReleaseCandidate() {
+  const releaseOutput = execFileSync(process.execPath, [
+    path.resolve(__dirname, "..", "bin", "xytara-release.js"),
+    "--candidate",
+    "--summary"
+  ], {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+  const releaseCandidate = JSON.parse(releaseOutput);
+  assert.strictEqual(releaseCandidate.product, "xytara", "release candidate product mismatch");
+}
+
+function ensurePersistenceConfig() {
+  const stateFile = process.env.XYTARA_STATE_FILE;
+  const supabaseUrl = process.env.XYTARA_SUPABASE_URL;
+  const supabaseServiceRoleKey = process.env.XYTARA_SUPABASE_SERVICE_ROLE_KEY;
+
+  const fileConfigured = typeof stateFile === "string" && stateFile.trim().length > 0;
+  const supabaseConfigured =
+    typeof supabaseUrl === "string" &&
+    supabaseUrl.trim().length > 0 &&
+    typeof supabaseServiceRoleKey === "string" &&
+    supabaseServiceRoleKey.trim().length > 0;
+
+  assert.strictEqual(
+    fileConfigured || supabaseConfigured,
+    true,
+    "configure XYTARA_STATE_FILE on persistent disk or XYTARA_SUPABASE_URL + XYTARA_SUPABASE_SERVICE_ROLE_KEY before treating xytara as production-ready"
+  );
+
+  if (fileConfigured) {
+    const resolvedPath = path.resolve(stateFile);
+    const parentDirectory = path.dirname(resolvedPath);
+    assert.strictEqual(
+      fs.existsSync(parentDirectory),
+      true,
+      `XYTARA_STATE_FILE parent directory does not exist: ${parentDirectory}`
+    );
+    fs.accessSync(parentDirectory, fs.constants.W_OK);
+  }
+}
+
+function ensureProductionSecurityConfig() {
+  const verificationMode = String(process.env.XYTARA_PAYMENT_VERIFICATION_MODE || "").trim() || "presence";
+  assert.notStrictEqual(
+    verificationMode,
+    "presence",
+    "set XYTARA_PAYMENT_VERIFICATION_MODE to local_signed or stronger before treating xytara as production-ready"
+  );
+
+  if (verificationMode === "local_signed") {
+    const walletRegistryJson = String(process.env.XYTARA_WALLET_REGISTRY_JSON || "").trim();
+    assert.strictEqual(walletRegistryJson.length > 0, true, "configure XYTARA_WALLET_REGISTRY_JSON before using local_signed payment verification");
+    const parsed = JSON.parse(walletRegistryJson);
+    assert.strictEqual(Array.isArray(parsed), true, "XYTARA_WALLET_REGISTRY_JSON must be a JSON array");
+    assert.strictEqual(parsed.length > 0, true, "register at least one enabled wallet in XYTARA_WALLET_REGISTRY_JSON before treating xytara as production-ready");
+  }
+
+  assert.strictEqual(
+    String(process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN || "").trim().length > 0,
+    true,
+    "configure XYTARA_CREDIT_BRIDGE_BEARER_TOKEN before treating xytara as production-ready"
+  );
+  assert.strictEqual(
+    String(process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN || "").trim().length > 0,
+    true,
+    "configure XYTARA_ACCOUNT_AUTH_BEARER_TOKEN before treating xytara as production-ready"
+  );
+}
+
+function ensureTreasuryConfig() {
+  const treasuryPath = String(process.env.XYTARA_TREASURY_DESTINATIONS_PATH || "").trim();
+  assert.strictEqual(
+    treasuryPath.length > 0,
+    true,
+    "configure XYTARA_TREASURY_DESTINATIONS_PATH before treating xytara as production-ready"
+  );
+  const resolvedPath = path.resolve(treasuryPath);
+  assert.strictEqual(fs.existsSync(resolvedPath), true, `treasury destinations file does not exist: ${resolvedPath}`);
+  const parsed = JSON.parse(fs.readFileSync(resolvedPath, "utf8"));
+  const configuredRails = Object.values(parsed || {}).filter((entry) =>
+    entry
+    && typeof entry === "object"
+    && typeof entry.external_ref === "string"
+    && entry.external_ref.trim().length > 0
+  );
+  assert.strictEqual(
+    configuredRails.length > 0,
+    true,
+    "configure at least one treasury destination external_ref before treating xytara as production-ready"
+  );
+}
+
+function ensureCallbackDeliveryConfig() {
+  const callbackDeliveryEnabled = String(process.env.XYTARA_CALLBACK_DELIVERY_ENABLED || "true").trim().toLowerCase() !== "false";
+  if (!callbackDeliveryEnabled) return;
+  assert.strictEqual(
+    String(process.env.XYTARA_CALLBACK_SIGNING_SECRET || "").trim().length > 0,
+    true,
+    "configure XYTARA_CALLBACK_SIGNING_SECRET before treating xytara as production-ready"
+  );
+}
+
+function ensureHostedCheckoutIngressSecurity() {
+  const verificationRequired = String(
+    process.env.XYTARA_CHECKOUT_WEBHOOK_VERIFICATION_REQUIRED
+    || process.env.XYTARA_HOSTED_CHECKOUT_ENABLED
+    || "true"
+  ).trim().toLowerCase();
+  if (["false", "0", "no", "off"].includes(verificationRequired)) {
+    return;
+  }
+  assert.strictEqual(
+    String(process.env.XYTARA_CHECKOUT_WEBHOOK_SECRET || process.env.XYTARA_HOSTED_CHECKOUT_WEBHOOK_SECRET || "").trim().length > 0,
+    true,
+    "configure XYTARA_CHECKOUT_WEBHOOK_SECRET before treating hosted-checkout ingress as production-ready"
+  );
+}
+
+function ensureL402Config() {
+  const l402Enabled = String(process.env.XYTARA_L402_ENABLED || "false").trim().toLowerCase() === "true";
+  if (!l402Enabled) return;
+  assert.strictEqual(
+    String(process.env.XYTARA_L402_SHARED_SECRET || "").trim().length > 0,
+    true,
+    "configure XYTARA_L402_SHARED_SECRET before treating the L402 ingress as production-ready"
+  );
+}
+
+function ensureBoltConfig() {
+  const boltEnabled = String(process.env.XYTARA_BOLT_ENABLED || "false").trim().toLowerCase() === "true";
+  if (!boltEnabled) return;
+  assert.strictEqual(
+    String(process.env.XYTARA_BOLT_SHARED_SECRET || "").trim().length > 0,
+    true,
+    "configure XYTARA_BOLT_SHARED_SECRET before treating the BOLT ingress as production-ready"
+  );
+}
+
+function ensureMppConfig() {
+  const mppEnabled = String(process.env.XYTARA_MPP_ENABLED || "false").trim().toLowerCase() === "true";
+  if (!mppEnabled) return;
+  assert.strictEqual(
+    String(process.env.XYTARA_MPP_SHARED_SECRET || "").trim().length > 0,
+    true,
+    "configure XYTARA_MPP_SHARED_SECRET before treating the MPP ingress as production-ready"
+  );
+}
+
+function ensureRateLimitConfig() {
+  const rateLimitEnabled = String(process.env.XYTARA_RATE_LIMIT_ENABLED || "true").trim().toLowerCase() !== "false";
+  assert.strictEqual(
+    rateLimitEnabled,
+    true,
+    "keep XYTARA_RATE_LIMIT_ENABLED=true before treating xytara as production-ready unless you have an equivalent upstream control"
+  );
+  const windowMs = Number(process.env.XYTARA_RATE_LIMIT_WINDOW_MS || 0);
+  const maxRequests = Number(process.env.XYTARA_RATE_LIMIT_MAX_REQUESTS || 0);
+  assert.strictEqual(Number.isFinite(windowMs) && windowMs > 0, true, "configure XYTARA_RATE_LIMIT_WINDOW_MS to a positive value");
+  assert.strictEqual(Number.isFinite(maxRequests) && maxRequests > 0, true, "configure XYTARA_RATE_LIMIT_MAX_REQUESTS to a positive value");
+}
+
+function ensureExecutionTargetConfig() {
+  const raw = String(process.env.XYTARA_EXECUTION_TARGETS_JSON || "").trim();
+  const requireTargets = String(process.env.XYTARA_EXTERNAL_EXECUTION_REQUIRED || "false").trim().toLowerCase() === "true";
+  if (!raw) {
+    assert.strictEqual(
+      requireTargets,
+      false,
+      "configure XYTARA_EXECUTION_TARGETS_JSON before treating xytara as production-ready when XYTARA_EXTERNAL_EXECUTION_REQUIRED=true"
+    );
+    return;
+  }
+
+  const parsed = JSON.parse(raw);
+  assert.strictEqual(Array.isArray(parsed), true, "XYTARA_EXECUTION_TARGETS_JSON must be a JSON array");
+  assert.strictEqual(parsed.length > 0, true, "configure at least one execution target in XYTARA_EXECUTION_TARGETS_JSON");
+  parsed.forEach((entry, index) => {
+    assert.strictEqual(
+      entry && typeof entry === "object" && !Array.isArray(entry),
+      true,
+      `execution target ${index + 1} must be an object`
+    );
+    assert.strictEqual(
+      typeof entry.endpoint_url === "string" && entry.endpoint_url.trim().length > 0,
+      true,
+      `execution target ${index + 1} must include endpoint_url`
+    );
+    assert.strictEqual(
+      Boolean(
+        (typeof entry.task_ref === "string" && entry.task_ref.trim().length > 0)
+        || (typeof entry.tool_name === "string" && entry.tool_name.trim().length > 0)
+        || (typeof entry.integration_id === "string" && entry.integration_id.trim().length > 0)
+      ),
+      true,
+      `execution target ${index + 1} must match at least one of task_ref, tool_name, or integration_id`
+    );
+  });
+}
+
+function ensureNativeSettlementConfig() {
+  const runtimeMode = String(process.env.XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE || "mock").trim().toLowerCase() || "mock";
+  assert.notStrictEqual(
+    runtimeMode,
+    "mock",
+    "configure XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE to observe, arc, or another live runtime mode before treating xytara as production-ready"
+  );
+  assert.strictEqual(
+    String(process.env.XYTARA_BSV_TERANODE_MERCHANT_ADDRESS || process.env.XYTARA_BSV_TERANODE_MERCHANT_PAYMAIL || "").trim().length > 0,
+    true,
+    "configure XYTARA_BSV_TERANODE_MERCHANT_ADDRESS or XYTARA_BSV_TERANODE_MERCHANT_PAYMAIL before treating xytara as production-ready"
+  );
+  if (runtimeMode === "arc") {
+    assert.strictEqual(
+      String(process.env.XYTARA_BSV_TERANODE_RPC_URL || "").trim().length > 0,
+      true,
+      "configure XYTARA_BSV_TERANODE_RPC_URL before treating arc settlement mode as production-ready"
+    );
+    assert.strictEqual(
+      String(process.env.XYTARA_BSV_TERANODE_RPC_API_KEY || "").trim().length > 0,
+      true,
+      "configure XYTARA_BSV_TERANODE_RPC_API_KEY before treating arc settlement mode as production-ready"
+    );
+  }
+}
+
+function main() {
+  ensureReleaseCandidate();
+  ensurePersistenceConfig();
+  ensureProductionSecurityConfig();
+  ensureTreasuryConfig();
+  ensureCallbackDeliveryConfig();
+  ensureHostedCheckoutIngressSecurity();
+  ensureL402Config();
+  ensureBoltConfig();
+  ensureMppConfig();
+  ensureRateLimitConfig();
+  ensureExecutionTargetConfig();
+  ensureNativeSettlementConfig();
+  console.log("xytara verify:production-readiness passed");
+}
+
+main();

package/scripts/verify_release_candidate.js

@@ -0,0 +1,59 @@
+"use strict";
+
+const assert = require("assert");
+const path = require("path");
+const { execFileSync, execSync } = require("child_process");
+const packageJson = require("../package.json");
+
+function parsePackDryRun() {
+  const output = execSync("npm pack --dry-run --json", {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+  const parsed = JSON.parse(output);
+  return Array.isArray(parsed) ? parsed[0] : parsed;
+}
+
+function main() {
+  const releaseOutput = execFileSync(process.execPath, [
+    path.resolve(__dirname, "..", "bin", "xytara-release.js"),
+    "--candidate",
+    "--summary"
+  ], {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+  const releaseCandidate = JSON.parse(releaseOutput);
+  assert.strictEqual(releaseCandidate.product, "xytara", "release candidate product mismatch");
+  assert.strictEqual(releaseCandidate.publish_access, "public", "release candidate publish access mismatch");
+  assert.strictEqual(releaseCandidate.checklist_count >= 5, true, "release candidate checklist count mismatch");
+
+  const dryRun = parsePackDryRun();
+  assert.strictEqual(dryRun.name, packageJson.name, "npm pack dry-run name mismatch");
+  assert.strictEqual(dryRun.version, packageJson.version, "npm pack dry-run version mismatch");
+  assert.strictEqual(Array.isArray(dryRun.files), true, "npm pack dry-run file list missing");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-run.js"), true, "npm pack dry-run missing xytara-run");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-first-run.js"), true, "npm pack dry-run missing xytara-first-run");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-release.js"), true, "npm pack dry-run missing xytara-release");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_release_candidate.js"), true, "npm pack dry-run missing release verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_framework_provider_promotion.js"), true, "npm pack dry-run missing framework provider promotion verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_operator_observability_boundary.js"), true, "npm pack dry-run missing operator observability boundary verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_pricing_experiment_plan.js"), true, "npm pack dry-run missing pricing experiment verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_treasury_public_boundary.js"), true, "npm pack dry-run missing treasury public boundary verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_all.js"), true, "npm pack dry-run missing package verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "lib/framework_provider_promotion.js"), true, "npm pack dry-run missing framework provider promotion pack");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "README.md"), true, "npm pack dry-run missing README");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "RELEASE_NOTES.md"), true, "npm pack dry-run missing release notes");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "START_HERE.md"), true, "npm pack dry-run missing start-here");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "SERVICE_CONTRACT.md"), true, "npm pack dry-run missing service contract");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "TREASURY_DESTINATIONS.example.json"), true, "npm pack dry-run missing treasury destinations example");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "TREASURY_DESTINATIONS.production.template.json"), true, "npm pack dry-run missing treasury destinations production template");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATOR_START_HERE.md"), false, "npm pack dry-run should not ship operator start-here");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATIONS_RUNBOOK.md"), false, "npm pack dry-run should not ship operations runbook");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "PUBLISH_PLAN.md"), false, "npm pack dry-run should not ship publish plan");
+  assert.strictEqual(dryRun.files.length >= 10, true, "npm pack dry-run file count too small");
+
+  console.log("xytara verify:release-candidate passed");
+}
+
+main();