zob-harness 0.1.0

package/.pi/extensions/zob-harness/src/factory-selector.ts

@@ -0,0 +1,318 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+
+import { sha256 } from "./utils/hashing.js";
+import { safeFileStem } from "./utils/paths.js";
+import { isRecord } from "./utils/records.js";
+import { readableZobResourcePaths } from "./utils/resources.js";
+
+export type FactoryDemandSignal = "code_review" | "budget_preflight" | "roadmap_lots" | "opencode_patterns" | "project_dna" | "factory_forge";
+export type FactorySelectionStatus = "existing_factory_selected" | "factory_forge_quarantine_recommended" | "no_factory_available";
+
+export interface FactoryDemandInput {
+  id?: string;
+  refinedSpec?: string;
+  acceptanceCriteria?: string[];
+  expectedArtifacts?: string[];
+}
+
+export interface FactorySelectorCandidateInput {
+  id?: string;
+  name?: string;
+  sourcePath?: string;
+  summary?: string;
+  description?: string;
+  metadata?: Record<string, unknown>;
+  manifests?: string[];
+}
+
+export interface FactorySelectorDemandSummary {
+  demandId: string;
+  demandHash: string;
+  signals: FactoryDemandSignal[];
+  acceptanceCriteriaHashes: string[];
+  expectedArtifactHashes: string[];
+}
+
+export interface FactorySelectorCandidateScore {
+  kind: "factory";
+  id: string;
+  sourcePath?: string;
+  score: number;
+  confidence: number;
+  reasonCodes: string[];
+  demandMatches: Array<{ demandId: string; signals: FactoryDemandSignal[]; score: number; reasonCodes: string[] }>;
+  manifestAvailability: { smoke: boolean; pilot: boolean; batch: boolean };
+  summaryHash?: string;
+  selected: boolean;
+}
+
+export interface FactorySelectorResult {
+  schema: "zob.factory-selector.v1" | "zob.autonomous-factory-selection-score.v1";
+  selectionStatus: FactorySelectionStatus;
+  selectedFactory?: string;
+  selectedScore: number;
+  confidence: number;
+  signals: FactoryDemandSignal[];
+  demands: FactorySelectorDemandSummary[];
+  deterministicScoring: true;
+  multiDemand: true;
+  candidates: FactorySelectorCandidateScore[];
+  factoryForge: {
+    available: boolean;
+    selected: boolean;
+    quarantineRequired: boolean;
+    noAutoActivation: true;
+    activationRequiresReview: true;
+    activationPerformed: false;
+    quarantineOnly: true;
+  };
+  noAutoActivation: true;
+  quarantineRequiredForNewFactory: boolean;
+  bodyStored: false;
+  promptBodiesStored: false;
+  outputBodiesStored: false;
+}
+
+export interface FactorySelectorSmokeReport {
+  schema: "zob.factory-selector-smoke.v1";
+  status: "passed" | "failed";
+  result: FactorySelectorResult;
+  checks: Array<{ name: string; passed: boolean }>;
+  failedChecks: string[];
+  no_ship: boolean;
+  bodyStored: false;
+  promptBodiesStored: false;
+  outputBodiesStored: false;
+  generatedAt: string;
+}
+
+const SIGNAL_MATCHERS: Array<{ signal: FactoryDemandSignal; pattern: RegExp }> = [
+  { signal: "code_review", pattern: /\b(code review|review code|review changes|oracle matrix|security review|qa review|correctness|architecture)\b/i },
+  { signal: "budget_preflight", pattern: /\b(budget|cost|costs|cap|caps|preflight|strict budget|max runs|max cost|parallel children)\b/i },
+  { signal: "roadmap_lots", pattern: /\b(roadmap|lot|lots|milestone|unchecked item|execution queue)\b/i },
+  { signal: "opencode_patterns", pattern: /\b(opencode|pattern|patterns|canonizer|canonical|taxonomy|workflow rules|quality gates)\b/i },
+  { signal: "project_dna", pattern: /\b(projectdna|project dna|project-dna|knowledge graph|code knowledge|context pack|repo scan|reference project)\b/i },
+  { signal: "factory_forge", pattern: /\b(new factory|create factory|generate factory|factory scaffold|quarantine|factory-forge|forge)\b/i },
+];
+
+const FACTORY_SIGNAL_IDS: Record<FactoryDemandSignal, string> = {
+  code_review: "code-review-matrix",
+  budget_preflight: "budget-preflight-dry-run",
+  roadmap_lots: "roadmap-smoke-lots",
+  opencode_patterns: "opencode-pattern-canonizer",
+  project_dna: "project-dna",
+  factory_forge: "factory-forge",
+};
+
+function uniqueSorted<T extends string>(items: T[]): T[] {
+  return [...new Set(items)].sort() as T[];
+}
+
+function stableStrings(items: unknown): string[] {
+  return Array.isArray(items) ? items.filter((item): item is string => typeof item === "string" && item.trim().length > 0).map((item) => item.trim()).sort() : [];
+}
+
+function hashList(items: string[]): string[] {
+  return items.map((item) => sha256(item)).sort();
+}
+
+export function detectFactoryDemandSignals(...values: string[]): FactoryDemandSignal[] {
+  const text = values.join("\n");
+  return uniqueSorted(SIGNAL_MATCHERS.filter((entry) => entry.pattern.test(text)).map((entry) => entry.signal));
+}
+
+function manifestAvailability(manifests: string[]): { smoke: boolean; pilot: boolean; batch: boolean } {
+  return {
+    smoke: manifests.includes("smoke-manifest.json"),
+    pilot: manifests.includes("pilot-manifest.json"),
+    batch: manifests.includes("batch-manifest.json"),
+  };
+}
+
+function candidateManifests(candidate: FactorySelectorCandidateInput): string[] {
+  const metadata = isRecord(candidate.metadata) ? candidate.metadata : {};
+  return uniqueSorted([
+    ...stableStrings(candidate.manifests),
+    ...stableStrings(metadata.manifests),
+  ]);
+}
+
+function candidateId(candidate: FactorySelectorCandidateInput): string {
+  return safeFileStem(typeof candidate.id === "string" ? candidate.id : typeof candidate.name === "string" ? candidate.name : "unknown");
+}
+
+function summarizeDemand(demand: FactoryDemandInput, index: number): FactorySelectorDemandSummary {
+  const acceptanceCriteria = stableStrings(demand.acceptanceCriteria);
+  const expectedArtifacts = stableStrings(demand.expectedArtifacts);
+  const refinedSpec = typeof demand.refinedSpec === "string" ? demand.refinedSpec : "";
+  return {
+    demandId: safeFileStem(demand.id ?? `demand-${index + 1}`),
+    demandHash: sha256([refinedSpec, ...acceptanceCriteria, ...expectedArtifacts].join("\n")),
+    signals: detectFactoryDemandSignals(refinedSpec, acceptanceCriteria.join("\n"), expectedArtifacts.join("\n")),
+    acceptanceCriteriaHashes: hashList(acceptanceCriteria),
+    expectedArtifactHashes: hashList(expectedArtifacts),
+  };
+}
+
+function scoreDemandForFactory(factoryId: string, demand: FactorySelectorDemandSummary): { score: number; reasonCodes: string[] } {
+  const reasonCodes: string[] = [];
+  let score = 0;
+  for (const signal of demand.signals) {
+    if (FACTORY_SIGNAL_IDS[signal] === factoryId) {
+      score += 8;
+      reasonCodes.push(`signal:${signal}`);
+    }
+  }
+  return { score, reasonCodes };
+}
+
+function scoreFactoryCandidate(candidate: FactorySelectorCandidateInput, demands: FactorySelectorDemandSummary[]): Omit<FactorySelectorCandidateScore, "selected"> {
+  const id = candidateId(candidate);
+  const manifests = candidateManifests(candidate);
+  const availability = manifestAvailability(manifests);
+  const demandMatches = demands.map((demand) => {
+    const score = scoreDemandForFactory(id, demand);
+    return { demandId: demand.demandId, signals: demand.signals, score: score.score, reasonCodes: score.reasonCodes.sort() };
+  });
+  const manifestScore = (availability.smoke ? 1 : 0) + (availability.pilot ? 1 : 0) + (availability.batch ? 1 : 0);
+  const signalScore = demandMatches.reduce((sum, match) => sum + match.score, 0);
+  const reasonCodes = uniqueSorted([
+    ...demandMatches.flatMap((match) => match.reasonCodes),
+    ...(availability.smoke ? ["manifest:smoke"] : []),
+    ...(availability.pilot ? ["manifest:pilot"] : []),
+    ...(availability.batch ? ["manifest:batch"] : []),
+  ]);
+  const score = signalScore + manifestScore;
+  const candidateSummary = typeof candidate.summary === "string" ? candidate.summary : typeof candidate.description === "string" ? candidate.description : undefined;
+  return {
+    kind: "factory",
+    id,
+    sourcePath: candidate.sourcePath,
+    score,
+    confidence: Math.max(0, Math.min(0.99, score / Math.max(12, demands.length * 10))),
+    reasonCodes,
+    demandMatches,
+    manifestAvailability: availability,
+    summaryHash: candidateSummary ? sha256(candidateSummary) : undefined,
+  };
+}
+
+export function selectFactoryForDemands(input: { factories: FactorySelectorCandidateInput[]; demands?: FactoryDemandInput[]; refinedSpec?: string; acceptanceCriteria?: string[]; expectedArtifacts?: string[]; schema?: FactorySelectorResult["schema"] }): FactorySelectorResult {
+  const demandInputs = input.demands && input.demands.length > 0
+    ? input.demands
+    : [{ id: "primary", refinedSpec: input.refinedSpec ?? "", acceptanceCriteria: input.acceptanceCriteria ?? [], expectedArtifacts: input.expectedArtifacts ?? [] }];
+  const demands = demandInputs.map(summarizeDemand);
+  const signals = uniqueSorted(demands.flatMap((demand) => demand.signals));
+  const scoredWithoutSelection = input.factories
+    .map((candidate) => scoreFactoryCandidate(candidate, demands))
+    .sort((left, right) => right.score - left.score || left.id.localeCompare(right.id));
+  const forgeCandidate = scoredWithoutSelection.find((candidate) => candidate.id === "factory-forge");
+  const bestExisting = scoredWithoutSelection.find((candidate) => candidate.id !== "factory-forge" && candidate.score >= 8);
+  const selected = bestExisting ?? (forgeCandidate && (forgeCandidate.score >= 8 || !bestExisting) ? forgeCandidate : undefined);
+  const selectedFactory = selected?.id;
+  const selectionStatus: FactorySelectionStatus = selectedFactory && selectedFactory !== "factory-forge"
+    ? "existing_factory_selected"
+    : selectedFactory === "factory-forge"
+      ? "factory_forge_quarantine_recommended"
+      : "no_factory_available";
+  const candidates = scoredWithoutSelection.map((candidate) => ({ ...candidate, selected: candidate.id === selectedFactory }));
+  const forgeSelected = selectedFactory === "factory-forge";
+  return {
+    schema: input.schema ?? "zob.factory-selector.v1",
+    selectionStatus,
+    selectedFactory,
+    selectedScore: selected?.score ?? 0,
+    confidence: selected?.confidence ?? 0,
+    signals,
+    demands,
+    deterministicScoring: true,
+    multiDemand: true,
+    candidates,
+    factoryForge: {
+      available: Boolean(forgeCandidate),
+      selected: forgeSelected,
+      quarantineRequired: forgeSelected,
+      noAutoActivation: true,
+      activationRequiresReview: true,
+      activationPerformed: false,
+      quarantineOnly: true,
+    },
+    noAutoActivation: true,
+    quarantineRequiredForNewFactory: forgeSelected,
+    bodyStored: false,
+    promptBodiesStored: false,
+    outputBodiesStored: false,
+  };
+}
+
+export function loadFactorySelectorCandidates(repoRoot: string): FactorySelectorCandidateInput[] {
+  const byId = new Map<string, FactorySelectorCandidateInput>();
+  for (const factoriesDir of readableZobResourcePaths(repoRoot, "factories")) {
+    for (const entry of readdirSync(factoriesDir, { withFileTypes: true }).filter((item) => item.isDirectory())) {
+      const factoryName = safeFileStem(entry.name);
+      const factoryDir = join(factoriesDir, factoryName);
+      const factoryJsonPath = join(factoryDir, "factory.json");
+      const parsed = existsSync(factoryJsonPath) ? JSON.parse(readFileSync(factoryJsonPath, "utf8")) as unknown : {};
+      const record = isRecord(parsed) ? parsed : {};
+      const candidate = {
+        id: typeof record.name === "string" ? record.name : factoryName,
+        sourcePath: `.pi/factories/${factoryName}/factory.json`,
+        summary: typeof record.summary === "string" ? record.summary : undefined,
+        description: typeof record.description === "string" ? record.description : undefined,
+        manifests: readdirSync(factoryDir, { withFileTypes: true }).filter((file) => file.isFile() && file.name.endsWith("-manifest.json")).map((file) => basename(file.name)).sort(),
+        metadata: isRecord(record.metadata) ? record.metadata : {},
+      };
+      byId.set(candidateId(candidate), candidate);
+    }
+  }
+  return [...byId.values()].sort((left, right) => candidateId(left).localeCompare(candidateId(right)));
+}
+
+export function buildFactorySelectorSmokeReport(repoRoot: string): FactorySelectorSmokeReport {
+  const candidates = loadFactorySelectorCandidates(repoRoot);
+  const result = selectFactoryForDemands({
+    factories: candidates,
+    demands: [
+      {
+        id: "code-review",
+        refinedSpec: "Run a code review matrix with architecture, correctness, security, and QA review.",
+        acceptanceCriteria: ["oracle matrix", "security review"],
+        expectedArtifacts: ["code-review-matrix.json"],
+      },
+      {
+        id: "new-factory",
+        refinedSpec: "Create a new factory scaffold in quarantine for visual QA workflow.",
+        acceptanceCriteria: ["factory-forge quarantine", "manual activation required"],
+        expectedArtifacts: ["factory.json", "smoke-manifest.json"],
+      },
+    ],
+  });
+  const forgeOnly = selectFactoryForDemands({
+    factories: candidates,
+    refinedSpec: "Generate a new factory scaffold in quarantine for a future workflow.",
+    acceptanceCriteria: ["quarantine only", "no activation"],
+    expectedArtifacts: ["factory scaffold"],
+  });
+  const checks = [
+    { name: "multi_demand_enabled", passed: result.multiDemand === true && result.demands.length === 2 },
+    { name: "existing_factory_selected_for_existing_signal", passed: result.selectedFactory === "code-review-matrix" && result.signals.includes("code_review") },
+    { name: "factory_forge_available", passed: result.factoryForge.available === true && result.candidates.some((candidate) => candidate.id === "factory-forge") },
+    { name: "forge_only_routes_to_quarantine", passed: forgeOnly.selectedFactory === "factory-forge" && forgeOnly.quarantineRequiredForNewFactory === true && forgeOnly.factoryForge.activationPerformed === false },
+    { name: "no_auto_activation", passed: result.noAutoActivation === true && forgeOnly.noAutoActivation === true },
+    { name: "body_free", passed: result.bodyStored === false && result.promptBodiesStored === false && result.outputBodiesStored === false },
+  ];
+  const failedChecks = checks.filter((check) => !check.passed).map((check) => check.name);
+  return {
+    schema: "zob.factory-selector-smoke.v1",
+    status: failedChecks.length === 0 ? "passed" : "failed",
+    result,
+    checks,
+    failedChecks,
+    no_ship: failedChecks.length > 0,
+    bodyStored: false,
+    promptBodiesStored: false,
+    outputBodiesStored: false,
+    generatedAt: new Date().toISOString(),
+  };
+}

package/.pi/extensions/zob-harness/src/full-autonomy-test.ts

@@ -0,0 +1,226 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { loadFactorySelectorCandidates, selectFactoryForDemands, type FactorySelectorResult } from "./factory-selector.js";
+import { buildControlledWorkerPoolPlan, evaluateLaunchAuthorizedApplyGate, type ControlledWorkerPoolPlan, type LaunchAuthorizedApplyGate } from "./launch-apply.js";
+import { sha256 } from "./utils/hashing.js";
+import { safeFileStem } from "./utils/paths.js";
+
+export interface FullAutonomyTestInput {
+  runId?: string;
+  launchConfirmed?: boolean;
+  allowedPaths?: string[];
+  forbiddenPaths?: string[];
+  maxParallelWorkers?: number;
+}
+
+export interface FullAutonomyTestRun {
+  schema: "zob.full-autonomy-test-run.v1";
+  runId: string;
+  status: "full_autonomy_test_ready" | "blocked";
+  no_ship: boolean;
+  testMode: true;
+  productionMode: false;
+  scopedTestAutonomyEnabled: boolean;
+  globalAutonomyClaimAllowed: false;
+  manualPerActionApprovalRequired: false;
+  launchAuthorization: Record<string, unknown>;
+  workerPool: ControlledWorkerPoolPlan;
+  factorySelection: FactorySelectorResult;
+  applyGate: LaunchAuthorizedApplyGate;
+  inScopeAutonomousTestWrite: {
+    performed: boolean;
+    relativePath: string;
+    pathHash: string;
+    artifactHash: string;
+    allowedByLaunch: boolean;
+    productionWrite: false;
+  };
+  safety: {
+    secretsAccessed: false;
+    destructiveCommandsRun: false;
+    commitsCreated: false;
+    networkAccessed: false;
+    productionWritesPerformed: false;
+    outOfScopeWritesPerformed: false;
+    bodyStored: false;
+    promptBodiesStored: false;
+    outputBodiesStored: false;
+  };
+  checks: Array<{ name: string; passed: boolean }>;
+  failedChecks: string[];
+  evidenceRefs: string[];
+  bodyStored: false;
+  promptBodiesStored: false;
+  outputBodiesStored: false;
+  generatedAt: string;
+}
+
+function defaultForbiddenPaths(input?: string[]): string[] {
+  return [...new Set([...(input ?? []), ".env", ".env.*", "**/.env*", "~/.ssh", "~/.aws", "node_modules", "dist", "build", "secrets", "raw-conversation-history"])].sort();
+}
+
+function buildLaunchAuthorization(runId: string, allowedPaths: string[], forbiddenPaths: string[], launchConfirmed: boolean): Record<string, unknown> {
+  return {
+    schema: "zob.launch-authorization.v1",
+    runId,
+    originalUserAskHash: sha256("enable full autonomous test mode"),
+    refinedSpecHash: sha256("spec locked: run a scoped full-autonomy test with in-scope autonomous test write and no production apply"),
+    specLocked: true,
+    userLaunchConfirmed: launchConfirmed,
+    launchConfirmedAt: launchConfirmed ? new Date().toISOString() : undefined,
+    authorizedAutonomyLevel: "L6",
+    allowedActions: ["read_repo", "context_lookup", "select_factory", "run_worker_pool", "sandbox_edit", "apply_in_scope_test_artifact", "post_apply_validation", "post_apply_oracle"],
+    allowedPaths,
+    forbiddenPaths,
+    applyPolicy: {
+      mode: "auto_apply_in_scope",
+      rollbackRequired: true,
+      exactDiffHashRequired: true,
+      postApplyValidationRequired: true,
+      postApplyOracleRequired: true,
+    },
+    budgetPolicy: {
+      mode: "strict_requested",
+      strict: true,
+      strictBudgetRequired: true,
+      strictBudgetSatisfied: true,
+    },
+    stopConditions: ["scope_drift", "secret_required", "validation_fail_exhausted", "oracle_no_ship", "budget_exceeded", "forbidden_path", "destructive_command"],
+    launchAuthorizesInScopeActions: launchConfirmed,
+    actionExecutionBlockedUntilLaunch: !launchConfirmed,
+    exceptionApprovalRequiredOnlyForOutOfScope: true,
+    bodyStored: false,
+    promptBodiesStored: false,
+    outputBodiesStored: false,
+  };
+}
+
+export function writeFullAutonomyTestRun(repoRoot: string, input: FullAutonomyTestInput = {}): FullAutonomyTestRun {
+  const runId = safeFileStem(input.runId ?? `full-autonomy-test-${Date.now()}`);
+  const runRoot = join("reports", "autonomous-runs", runId);
+  const runDir = join(repoRoot, runRoot);
+  const testArtifactRelativePath = `${runRoot}/autonomous-test-action.json`;
+  const allowedPaths = [...new Set([...(input.allowedPaths ?? []), `${runRoot}/`])].sort();
+  const forbiddenPaths = defaultForbiddenPaths(input.forbiddenPaths);
+  const launchConfirmed = input.launchConfirmed === true;
+  const launchAuthorization = buildLaunchAuthorization(runId, allowedPaths, forbiddenPaths, launchConfirmed);
+  const workerPool = buildControlledWorkerPoolPlan({ runId, maxParallelWorkers: input.maxParallelWorkers ?? 5, launchAuthorization });
+  const factories = loadFactorySelectorCandidates(repoRoot);
+  const factorySelection = selectFactoryForDemands({
+    factories,
+    demands: [
+      {
+        id: "full-autonomy-test",
+        refinedSpec: "Run a full autonomous test lane with factory selection, worker pool, in-scope apply gate, validation and oracle.",
+        acceptanceCriteria: ["launch authorization", "worker pool", "factory selector", "apply in scope", "oracle validation"],
+        expectedArtifacts: ["autonomous-test-action.json", "FULL_AUTONOMY_TEST_READY.sentinel"],
+      },
+      {
+        id: "fallback-forge-quarantine",
+        refinedSpec: "If a new factory is needed, use factory-forge quarantine only and never auto-activate.",
+        acceptanceCriteria: ["factory-forge quarantine", "no auto activation"],
+        expectedArtifacts: ["factory.json", "smoke-manifest.json"],
+      },
+    ],
+  });
+  const testArtifact = {
+    schema: "zob.full-autonomy-test-action.v1",
+    runId,
+    launchAuthorizationHash: sha256(JSON.stringify(launchAuthorization)),
+    workerPoolHash: sha256(JSON.stringify(workerPool)),
+    factorySelectionHash: sha256(JSON.stringify(factorySelection)),
+    inScopeAutonomousTestAction: true,
+    productionWrite: false,
+    bodyStored: false,
+    promptBodiesStored: false,
+    outputBodiesStored: false,
+    generatedAt: new Date().toISOString(),
+  };
+  const diffHash = sha256(JSON.stringify(testArtifact));
+  const applyGate = evaluateLaunchAuthorizedApplyGate(repoRoot, {
+    runId,
+    launchAuthorization,
+    workerPoolPlan: workerPool,
+    changedPaths: [testArtifactRelativePath],
+    diffHash,
+    sandboxRunId: runId,
+    oracleReviewRef: `${runRoot}/full-autonomy-test-oracle.json`,
+    validationRefs: ["npm run full-autonomy:test", "npm run check -- --pretty false"],
+  });
+  const canWriteTestArtifact = applyGate.applyEligible === true && launchConfirmed;
+  mkdirSync(runDir, { recursive: true });
+  if (canWriteTestArtifact) {
+    writeFileSync(join(repoRoot, testArtifactRelativePath), `${JSON.stringify(testArtifact, null, 2)}\n`, "utf8");
+    writeFileSync(join(runDir, "FULL_AUTONOMY_TEST_READY.sentinel"), `full autonomy test ready ${new Date().toISOString()}\n`, "utf8");
+  }
+  const checks = [
+    { name: "spec_locked", passed: launchAuthorization.specLocked === true },
+    { name: "user_launch_confirmed", passed: launchConfirmed },
+    { name: "manual_per_action_approval_disabled_for_in_scope", passed: applyGate.manualPerActionApprovalRequired === false },
+    { name: "worker_pool_enabled", passed: workerPool.workerPoolEnabledByLaunch === true && workerPool.parentOwnedDispatch === true && workerPool.childDirectDispatch === false },
+    { name: "factory_selector_ready", passed: factorySelection.selectionStatus !== "no_factory_available" && factorySelection.noAutoActivation === true },
+    { name: "apply_gate_eligible", passed: applyGate.applyEligible === true && applyGate.autoApplyAuthorizedByLaunch === true },
+    { name: "in_scope_autonomous_test_write_performed", passed: canWriteTestArtifact },
+    { name: "production_writes_blocked", passed: applyGate.productionWritesPerformed === false },
+    { name: "forbidden_paths_preserved", passed: forbiddenPaths.some((path) => path.includes(".env")) && applyGate.gates.forbiddenPathsClear === true },
+  ];
+  const failedChecks = checks.filter((check) => !check.passed).map((check) => check.name);
+  const report: FullAutonomyTestRun = {
+    schema: "zob.full-autonomy-test-run.v1",
+    runId,
+    status: failedChecks.length === 0 ? "full_autonomy_test_ready" : "blocked",
+    no_ship: failedChecks.length > 0,
+    testMode: true,
+    productionMode: false,
+    scopedTestAutonomyEnabled: failedChecks.length === 0,
+    globalAutonomyClaimAllowed: false,
+    manualPerActionApprovalRequired: false,
+    launchAuthorization,
+    workerPool,
+    factorySelection,
+    applyGate,
+    inScopeAutonomousTestWrite: {
+      performed: canWriteTestArtifact,
+      relativePath: testArtifactRelativePath,
+      pathHash: sha256(testArtifactRelativePath),
+      artifactHash: canWriteTestArtifact ? sha256(JSON.stringify(testArtifact)) : sha256("not-written"),
+      allowedByLaunch: applyGate.applyEligible === true,
+      productionWrite: false,
+    },
+    safety: {
+      secretsAccessed: false,
+      destructiveCommandsRun: false,
+      commitsCreated: false,
+      networkAccessed: false,
+      productionWritesPerformed: false,
+      outOfScopeWritesPerformed: false,
+      bodyStored: false,
+      promptBodiesStored: false,
+      outputBodiesStored: false,
+    },
+    checks,
+    failedChecks,
+    evidenceRefs: canWriteTestArtifact ? [testArtifactRelativePath, `${runRoot}/FULL_AUTONOMY_TEST_READY.sentinel`] : [],
+    bodyStored: false,
+    promptBodiesStored: false,
+    outputBodiesStored: false,
+    generatedAt: new Date().toISOString(),
+  };
+  const oracle = {
+    schema: "zob.full-autonomy-test-oracle.v1",
+    runId,
+    verdict: report.no_ship ? "FAIL" : "PASS",
+    no_ship: report.no_ship,
+    scopedTestAutonomyEnabled: report.scopedTestAutonomyEnabled,
+    globalAutonomyClaimAllowed: false,
+    failedChecks,
+    bodyStored: false,
+    promptBodiesStored: false,
+    outputBodiesStored: false,
+    generatedAt: new Date().toISOString(),
+  };
+  writeFileSync(join(runDir, "full-autonomy-test-run.json"), `${JSON.stringify(report, null, 2)}\n`, "utf8");
+  writeFileSync(join(runDir, "full-autonomy-test-oracle.json"), `${JSON.stringify(oracle, null, 2)}\n`, "utf8");
+  return report;
+}