Verify immutable simulation custody and independent live assignment authority

guarantees/agent/golden/scenes/component-boundaries.scene.yaml

@@ -153,6 +153,51 @@ workflow:
   - id: live-assignment-profile-denial-unit
     action: { verifier: agent.golden.live-assignment-profile-denial-unit }
     expect: { status: passed }
+  - id: live-graph-identity-unit
+    action: { verifier: agent.golden.live-graph-identity-unit }
+    expect: { status: passed }
+  - id: live-node-revision-unit
+    action: { verifier: agent.golden.live-node-revision-unit }
+    expect: { status: passed }
+  - id: live-graph-missing-unit
+    action: { verifier: agent.golden.live-graph-missing-unit }
+    expect: { status: passed }
+  - id: live-workspace-scope-unit
+    action: { verifier: agent.golden.live-workspace-scope-unit }
+    expect: { status: passed }
+  - id: live-workspace-branch-unit
+    action: { verifier: agent.golden.live-workspace-branch-unit }
+    expect: { status: passed }
+  - id: live-workspace-paths-unit
+    action: { verifier: agent.golden.live-workspace-paths-unit }
+    expect: { status: passed }
+  - id: live-frozen-source-denial-unit
+    action: { verifier: agent.golden.live-frozen-source-denial-unit }
+    expect: { status: passed }
+  - id: live-source-context-unit
+    action: { verifier: agent.golden.live-source-context-unit }
+    expect: { status: passed }
+  - id: live-workspace-base-unit
+    action: { verifier: agent.golden.live-workspace-base-unit }
+    expect: { status: passed }
+  - id: live-allocation-missing-unit
+    action: { verifier: agent.golden.live-allocation-missing-unit }
+    expect: { status: passed }
+  - id: live-predecessor-missing-unit
+    action: { verifier: agent.golden.live-predecessor-missing-unit }
+    expect: { status: passed }
+  - id: live-runtime-missing-unit
+    action: { verifier: agent.golden.live-runtime-missing-unit }
+    expect: { status: passed }
+  - id: live-runtime-reopen-unit
+    action: { verifier: agent.golden.live-runtime-reopen-unit }
+    expect: { status: passed }
+  - id: live-runtime-publication-unit
+    action: { verifier: agent.golden.live-runtime-publication-unit }
+    expect: { status: passed }
+  - id: live-graph-denial-unit
+    action: { verifier: agent.golden.live-graph-denial-unit }
+    expect: { status: passed }
   - id: live-assignment-records-native
     action: { verifier: agent.golden.live-assignment-records-native }
     expect: { status: passed }

guarantees/agent/golden/sdk-complete.guarantee.yaml

@@ -11,6 +11,8 @@ scene:
   required: true
   manifest: guarantees/agent/golden/scenes/sdk-complete.scene.yaml
 acceptanceCriteria:
+  - criterion: 4d3a65d9ab4becd82cc9336051f6e069a26bfcd662eb52fe3f7a32f67c8530bf
+    verifierRefs: [agent.golden.live.campaign, agent.golden.architecture-profile-custody-live-1, api.golden.execution-normal-sdk-clean-schema-live-1, agent.golden.architecture-record-custody-live-1]
   - criterion: 9778c4caf01add1b3815fa1cd3fe27ef11073cc98dbdc4a5deeb54e2a441f1dc
     verifierRefs: [sdk.golden.live.product]
   - criterion: fc80e789a38eb6ae75fada867226ac0157844505619b12c90c55cbe317c6cc9d

guarantees/verifiers/golden.verifiers.yaml

@@ -216,6 +216,81 @@ verifiers:
     ownerPackage: "@treeseed/agent"
     testFile: tests/modern/kernel/architecture/custody/profile-custody-readback.test.ts
     testName: "live profile inspection denies an independently substituted runtime or failed public read without repairing the original attempt"
+  agent.golden.live-graph-identity-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "accepts exact independent graph authority without rewriting source observations and denies every substituted issued field"
+  agent.golden.live-node-revision-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "retains a legitimate earlier completed attempt when independently verified request-changes history advances its graph node"
+  agent.golden.live-graph-missing-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies missing independent graph before accepting a newly issued assignment"
+  agent.golden.live-workspace-scope-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "retains exact simulation workspace authority and rejects malformed or substituted branch scope without rewriting observations"
+  agent.golden.live-workspace-branch-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies a foreign simulation branch before accepting matching assignment views"
+  agent.golden.live-workspace-paths-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies writable paths outside the original simulation workspace contract"
+  agent.golden.live-frozen-source-denial-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies a self-consistent foreign Git base and context against the original frozen source"
+  agent.golden.live-source-context-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "requires every frozen source and exact granted content while retaining original context and rejecting unissued commits"
+  agent.golden.live-workspace-base-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies a Git workspace base absent from original exact context before accepting matching assignment views"
+  agent.golden.live-allocation-missing-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies a missing owning allocation receipt before allowing a newly observed assignment to continue"
+  agent.golden.live-predecessor-missing-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies a predecessor result absent from the complete owning assignment inventory before campaign progress"
+  agent.golden.live-runtime-missing-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies absent independent provider publication rather than trusting the runtime build repeated in assignment views"
+  agent.golden.live-runtime-reopen-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "retains original provider publication when a later session opens after the observed assignment was issued"
+  agent.golden.live-runtime-publication-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "requires the exact independently published provider adapter build model and canonical limits while retaining unrelated histories"
+  agent.golden.live-graph-denial-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/monitoring/live-graph-inspection.test.ts
+    testName: "denies foreign source estimate node and graph revisions rather than accepting internally matching public assignment views"
   agent.golden.live-assignment-records-native:
     kind: vitestCase
     ownerPackage: "@treeseed/agent"

tests/acceptance/campaign.test.ts

@@ -4,7 +4,7 @@ import test from 'node:test';
 import { fileURLToPath } from 'node:url';
 import { monitorCampaign, openSdkCampaignDiscussion, requirePlanningWindow, retainCampaignWorkdayStart } from './campaign.ts';
 import { verifyFreezeIntegrity } from './freeze-integrity.ts';
-import { read } from './acceptance-cli.ts';
+import { read, row } from './acceptance-cli.ts';
 import { verifyGolden } from './sdk-runtime-golden.test.ts';
 import { prepareSdkCampaign, verifySdkExternalState } from './prepare-campaign.ts';
 import { observeCampaign } from './workday/support/campaign-observation.ts';
@@ -58,7 +58,7 @@ test('Frozen SDK campaign drives planning acting review and terminal golden gate
 	}, inspect: () => {
 		assert.ok(currentRun, 'ACCEPTANCE_LIVE_ASSIGNMENT: Original observed workday required');
 		const assignments = readCompleteEvidence(['assignments', 'list', '--workday', workdayId], team, 50, 'ACCEPTANCE_LIVE_ASSIGNMENT');
-		observeLiveAssignmentRecords(currentRun, assignments, observedAssignments, item => inspectLiveAssignmentProfile(item, team));
+		observeLiveAssignmentRecords(currentRun, assignments, observedAssignments, item => inspectLiveAssignmentProfile(item, team, assignments, { 'treeseed-ai/sdk': row(freeze.sourceHeads).sdk }));
 	}, now: Date.now, wait: () => new Promise(resolve => setTimeout(resolve, 30_000)), stop,
 		collaboration: () => {
 			verifyGolden('collaboration');

tests/acceptance/sdk-runtime-golden.test.ts

@@ -2,7 +2,7 @@ import assert from 'node:assert/strict';
 import { isDeepStrictEqual } from 'node:util';
 import { createHash } from 'node:crypto';
 import test from 'node:test';
-import { assignmentReferenceSchema, assignmentTimingAwarenessReceiptSchema, authorizedContextItemSchema, estimateSchema, exactEntityReferenceSchema } from '@treeseed/sdk/agent-capacity';
+import { assignmentReferenceSchema, assignmentTimingAwarenessReceiptSchema, authorizedContextItemSchema, exactEntityReferenceSchema } from '@treeseed/sdk/agent-capacity';
 import { canonicalStandardsJson } from '@treeseed/sdk/standards';
 import { DEFAULT_CAPACITY_PAGE_LIMIT } from '@treeseed/sdk/capacity-pagination';
 import { validatePortableContentData } from '@treeseed/sdk/content-validation';
@@ -11,60 +11,15 @@ import { readApprovedWorkReview, readDecisionContent, readGovernedContentFile, v
 import { verifyAssignmentAuthority, verifyAssignmentWorkspaceInventory, verifyTeardownAuthority, verifyTreeDxWorkspaceClosure, verifyMeasuredVerification, verifyNativeCounterAgreement, verifyTerminalUsageClock } from './workday/support/assignment-authority.ts';
 import { verifyPlanningEvidence } from './workday/support/planning-evidence.ts';
 import { readCompleteEvidence } from './workday/support/evidence-pages.ts';
+import { verifyAllocation } from './workday/support/monitoring/assignment-allocation.ts';
 import { verifyReportRecordCustody } from './workday/support/record-custody.ts';
 const rows = (value: unknown): Row[] => Array.isArray(value) ? value.map(row) : [];
 const text = (value: unknown): string => typeof value === 'string' ? value : '';
 // Each exact test is independently selectable by the existing guarantee runner.
 // These read-back gates do not stand in for campaign orchestration or external-state proof.
 const gates = ['lifecycle', 'collaboration', 'graph', 'revision', 'results', 'settlement', 'reporter', 'stopped'] as const;
 type Gate = typeof gates[number];
-function verifyAllocation(item: Row, run: Row): void {
-	const attempt = row(item.assignmentAttempt), envelope = row(item.capacityEnvelope);
-	const allocation = row(row(row(item.explanation).metadata).allocation), calibration = row(allocation.calibration);
-	const finite = (value: unknown): value is number => typeof value === 'number' && Number.isFinite(value);
-	const estimate = estimateSchema.safeParse(attempt.estimate);
-	assert.ok(estimate.success, 'ACCEPTANCE_ALLOCATION_ESTIMATE: Exact expected/maximum estimate required');
-	assert.ok(allocation.admitted === true && Number.isInteger(allocation.allocatedSeconds) && Number(allocation.allocatedSeconds) > 0,
-		'ACCEPTANCE_ALLOCATION_RECEIPT: Successful positive immutable allocation required');
-	const allocated = Number(allocation.allocatedSeconds), desired = Number(allocation.desiredSeconds);
-	assert.ok(Number.isInteger(allocation.desiredSeconds) && desired > 0 && allocated <= desired,
-		'ACCEPTANCE_ALLOCATION_DURATION: Allocation must be bounded by its calibrated task duration');
-	assert.equal(row(attempt.limits).maximumSeconds, allocated, 'ACCEPTANCE_ALLOCATION_LIMIT: Immutable attempt limit drifted');
-	assert.equal(envelope.requestedSeconds, allocated, 'ACCEPTANCE_ALLOCATION_RESERVATION: Requested authority drifted');
-	assert.equal(envelope.reservedSeconds, allocated, 'ACCEPTANCE_ALLOCATION_RESERVATION: Reserved authority drifted');
-	assert.ok(Array.isArray(allocation.constraints) && allocation.constraints.length > 0,
-		'ACCEPTANCE_ALLOCATION_CONSTRAINTS: Original hard ceilings required');
-	const constraints = rows(allocation.constraints);
-	assert.equal(new Set(constraints.map(value => value.id)).size, constraints.length, 'ACCEPTANCE_ALLOCATION_CONSTRAINTS: Duplicate ceiling authority');
-	for (const constraint of constraints) assert.ok(text(constraint.id) && finite(constraint.remainingSeconds)
-		&& Number(constraint.remainingSeconds) >= 0 && allocated <= Math.floor(Number(constraint.remainingSeconds)),
-		'ACCEPTANCE_ALLOCATION_CONSTRAINTS: Invalid or exceeded ceiling');
-	const minimum = [...constraints].sort((a, b) => Number(a.remainingSeconds) - Number(b.remainingSeconds) || text(a.id).localeCompare(text(b.id)))[0]!;
-	assert.equal(allocation.limitingConstraint, allocated < desired ? minimum.id : 'task-duration', 'ACCEPTANCE_ALLOCATION_CONSTRAINTS: Limiting authority mismatch');
-	assert.ok(finite(calibration.multiplier) && calibration.multiplier > 0 && calibration.seconds === desired
-		&& Math.ceil(estimate.data.expectedSeconds * calibration.multiplier) === desired,
-		'ACCEPTANCE_ALLOCATION_CALIBRATION: Finite normalized calibration required');
-	assert.ok(Array.isArray(calibration.measurementIds) && calibration.measurementIds.length <= 20
-		&& calibration.measurementIds.every(id => typeof id === 'string' && id.length > 0 && id === id.trim())
-		&& new Set(calibration.measurementIds).size === calibration.measurementIds.length,
-		'ACCEPTANCE_ALLOCATION_CALIBRATION: At most twenty unique exact sample identities required');
-	if (calibration.measurementIds.length === 0) assert.equal(desired, estimate.data.maximumSeconds, 'ACCEPTANCE_ALLOCATION_CALIBRATION: Cold start must preserve the maximum estimate');
-	const opportunity = row(allocation.opportunity);
-	const weight = row(row(row(run.parameters).appliedPlan).policySnapshot).allocationWeight;
-	assert.ok(finite(weight) && weight > 0, 'ACCEPTANCE_ALLOCATION_POLICY: Original applied policy weight required');
-	assert.equal(opportunity.weight, weight, 'ACCEPTANCE_ALLOCATION_POLICY: Receipt cannot invent another workday entitlement');
-	assert.ok(['planning', 'acting'].includes(text(opportunity.phase)), 'ACCEPTANCE_ALLOCATION_PHASE: Exact original phase required');
-	for (const field of ['shareSeconds', 'availableSeconds']) assert.ok(Number.isInteger(opportunity[field]),
-		'ACCEPTANCE_ALLOCATION_SUPPLY: Original integer shared opportunity required');
-	for (const field of ['shareSeconds', 'availableSeconds', 'remainingSupplySeconds', 'committedSeconds', 'planningCommittedSeconds']) {
-		assert.ok(finite(opportunity[field]) && Number(opportunity[field]) >= 0, 'ACCEPTANCE_ALLOCATION_SUPPLY: Finite weighted supply required');
-	}
-	assert.ok(finite(opportunity.weight) && opportunity.weight > 0 && finite(opportunity.totalEligibleWeight)
-		&& opportunity.totalEligibleWeight >= opportunity.weight && allocated <= Number(opportunity.availableSeconds)
-		&& Number(opportunity.availableSeconds) <= Number(opportunity.shareSeconds)
-		&& Number(opportunity.shareSeconds) <= Number(opportunity.remainingSupplySeconds)
-		&& Number(opportunity.planningCommittedSeconds) <= Number(opportunity.committedSeconds), 'ACCEPTANCE_ALLOCATION_SUPPLY: Weighted supply authority exceeded');
-}
+
 function phaseBoundaryCancelled(item: Row, run: Row): boolean {
 	const parameters = row(run.parameters), time = row(row(row(item.capacityEnvelope).budget).time);
 	const boundary = Date.parse(text(run.startedAt)) + Number(parameters.durationSeconds) * Number(parameters.planningPercent) * 10;

tests/acceptance/workday/context-custody.test.ts

@@ -7,7 +7,7 @@ import { parse } from 'yaml';
 import { isDeepStrictEqual } from 'node:util';
 import { acceptanceWorkdayId, read, row, type Row } from '../acceptance-cli.ts';
 import { readWorkdayAssignments } from '../sdk-runtime-golden.test.ts';
-import { verifyAssignmentAuthority, verifyExactContextSource, verifyKnowledgeBookSource, verifyDraftProposalHandoff, verifyModelClockEvidence, modelExecutionInventory } from './support/assignment-authority.ts';
+import { verifyAssignmentAuthority, verifyGitInputContext, verifyExactContextSource, verifyKnowledgeBookSource, verifyDraftProposalHandoff, verifyModelClockEvidence, modelExecutionInventory } from './support/assignment-authority.ts';
 import { readCompleteEvidence } from './support/evidence-pages.ts';
 import { verifySdkArchitectureBook } from '../prepare-campaign.ts';
 
@@ -155,9 +155,7 @@ test('Actual accepted integration work retains its original single base exact in
 		assert.ok(attempt.effectiveProfile.permissionCeiling.tools.includes('release')); assert.deepEqual(attempt.grant.sourceWrite, [repository]);
 		assert.deepEqual(attempt.grant.contentWrite, []); assert.ok(Array.isArray(planned.dependsOn));
 		for (const dependency of planned.dependsOn) assert.ok(predecessors.some(value => value.previous.workItemId === dependency), 'ACCEPTANCE_INTEGRATION_PLAN: Accepted dependency missing from immutable predecessors');
-		const base = [attempt.sourceRef, ...attempt.contextRefs].filter(ref => ref.store === 'git' && ref.repository === repository && ref.commit === workspace.baseCommit);
-		assert.ok(base.length > 0, 'ACCEPTANCE_INTEGRATION_BASE: Original admitted base must remain an explicit exact source/context ref');
-		for (const ref of primary) assert.ok(attempt.contextRefs.some(value => value.store === 'git' && value.repository === ref.repository && value.commit === ref.commit), 'ACCEPTANCE_INTEGRATION_CONTEXT: Every separate native Git input must remain exact');
+		verifyGitInputContext(item, primary);
 		const result = assignmentResultSchema.parse(item.assignmentResult); assert.equal(result.assignmentId, attempt.id); assert.equal(result.status, 'completed');
 		const candidates = result.references.filter(ref => ref.kind === 'git' && ref.repository === repository); assert.equal(candidates.length, 1);
 		assert.ok(Date.parse(result.completedAt) >= Date.parse(attempt.createdAt) && Date.parse(result.completedAt) <= Date.parse(attempt.deadline));

tests/acceptance/workday/support/assignment-authority.ts

@@ -435,3 +435,14 @@ export function verifyAssignmentAuthority(item: Row): void {
 			`${label}: Content context is not in the immutable exact grant`);
 	}
 }
+
+/** Preserve the original native integration input assertions during live reads. */
+export function verifyGitInputContext(item: Row, primary: readonly ReturnType<typeof assignmentReferenceSchema.parse>[]): void {
+	const attempt = assignmentAttemptSchema.parse(item.assignmentAttempt);
+	if (attempt.workspace.mode !== 'git') return;
+	const workspace = attempt.workspace, repository = workspace.repository;
+	const base = [attempt.sourceRef, ...attempt.contextRefs].filter(ref => ref.store === 'git' && ref.repository === repository && ref.commit === workspace.baseCommit);
+	assert.ok(base.length > 0, 'ACCEPTANCE_INTEGRATION_BASE: Original admitted base must remain an explicit exact source/context ref');
+	for (const ref of primary) if (ref.kind === 'git' && ref.repository === repository)
+		assert.ok(attempt.contextRefs.some(value => value.store === 'git' && value.repository === ref.repository && value.commit === ref.commit), 'ACCEPTANCE_INTEGRATION_CONTEXT: Every separate native Git input must remain exact');
+}