#!/usr/bin/env node

const assert = require("assert");
const fs = require("fs");
const path = require("path");

const repo = path.resolve(__dirname, "..");

function read(relativePath) {
  return fs.readFileSync(path.join(repo, relativePath), "utf8");
}

function maybeRead(relativePath) {
  const fullPath = path.join(repo, relativePath);
  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, "utf8") : null;
}

function expect(source, name, pattern) {
  if (process.env.DISASMER_ACCEPTANCE_CONTRACT_TRACE) {
    process.stderr.write(`checking acceptance evidence: ${name}\n`);
  }
  assert.match(source, pattern, `missing acceptance evidence guard: ${name}`);
}

function expectGate(script, gateName) {
  assert(
    script.includes("node scripts/acceptance-evidence-contract-smoke.js"),
    `${gateName} must run acceptance-evidence-contract-smoke.js`
  );
}

const phase2 = read("acceptance_criteria_phase2.md");
const publicAcceptance = read("scripts/acceptance-public.sh");
const privateAcceptance = read("scripts/acceptance-private.sh");
const cliFirstAcceptance = read("scripts/acceptance-cli-first.sh");
const publicSplit = read("scripts/verify-public-split.sh");
const codeSizeGuard = read("scripts/code-size-guard.js");
const phase3Ledger = read("scripts/phase3-ledger.js");
const coreAuth = read("crates/disasmer-core/src/auth.rs");
const coreArtifact = read("crates/disasmer-core/src/artifact.rs");
const coreBundle = read("crates/disasmer-core/src/bundle.rs");
const coreCheckpoint = read("crates/disasmer-core/src/checkpoint.rs");
const coreExecution = read("crates/disasmer-core/src/execution.rs");
const coreProject = read("crates/disasmer-core/src/project.rs");
const coreWire = read("crates/disasmer-core/src/wire.rs");
const sdkLib = read("crates/disasmer-sdk/src/lib.rs");
const sdkTaskArgs = read("crates/disasmer-sdk/src/task_args.rs");
const coordinatorDurable = read("crates/disasmer-coordinator/src/durable.rs");
const coordinatorPostgres = read("crates/disasmer-coordinator/src/postgres_store.rs");
const coordinatorRuntimeDurable = read("crates/disasmer-coordinator/src/service/durable_runtime.rs");
const coordinatorSessions = read("crates/disasmer-coordinator/src/sessions.rs");
const coordinatorAgents = read("crates/disasmer-coordinator/src/agents.rs");
const coordinatorProtocol = `${read("crates/disasmer-coordinator/src/service/protocol.rs")}\n${read("crates/disasmer-coordinator/src/service/protocol/responses.rs")}\n${read("crates/disasmer-coordinator/src/service/wire_protocol.rs")}`;
const coordinatorService = `${read("crates/disasmer-coordinator/src/service.rs")}\n${read("crates/disasmer-coordinator/src/service/routing.rs")}`;
const coordinatorAdmin = read("crates/disasmer-coordinator/src/service/admin.rs");
const coordinatorArtifacts = read("crates/disasmer-coordinator/src/service/artifacts.rs");
const coordinatorQuota = read("crates/disasmer-coordinator/src/service/quota.rs");
const coordinatorAuthenticated = read("crates/disasmer-coordinator/src/service/authenticated.rs");
const coordinatorAuthorization = read("crates/disasmer-coordinator/src/service/authorization.rs");
const coordinatorTcp = read("crates/disasmer-coordinator/src/service/tcp.rs");
const coordinatorMain = read("crates/disasmer-coordinator/src/main.rs");
const coordinatorNodes = read("crates/disasmer-coordinator/src/service/nodes.rs");
const coordinatorSignedNodes = read("crates/disasmer-coordinator/src/service/signed_nodes.rs");
const coordinatorSignedNodeSurface = `${coordinatorService}\n${coordinatorSignedNodes}`;
const coordinatorProcesses = `${read("crates/disasmer-coordinator/src/service/process_launch.rs")}\n${read("crates/disasmer-coordinator/src/service/processes.rs")}`;
const coordinatorMainRuntime = read("crates/disasmer-coordinator/src/service/main_runtime.rs");
const coordinatorDebug = `${read("crates/disasmer-coordinator/src/service/debug_requests.rs")}\n${read("crates/disasmer-coordinator/src/service/debug.rs")}\n${read("crates/disasmer-coordinator/src/service/debug/validation.rs")}`;
const coordinatorLogs = read("crates/disasmer-coordinator/src/service/logs.rs");
const coordinatorServiceTests = read("crates/disasmer-coordinator/src/service/tests.rs");
const cliConfig = read("crates/disasmer-cli/src/config.rs");
const cliClient = read("crates/disasmer-cli/src/client.rs");
const cliAuth = read("crates/disasmer-cli/src/auth.rs");
const cliLogout = read("crates/disasmer-cli/src/logout.rs");
const cliAdmin = read("crates/disasmer-cli/src/admin.rs");
const cliNode = read("crates/disasmer-cli/src/node.rs");
const cliProject = read("crates/disasmer-cli/src/project.rs");
const cliRun = read("crates/disasmer-cli/src/run.rs");
const cliRunLocalServices = read("crates/disasmer-cli/src/run/local_services.rs");
const cliBundle = read("crates/disasmer-cli/src/bundle.rs");
const cliTests = read("crates/disasmer-cli/src/tests.rs");
const nodeLib = read("crates/disasmer-node/src/lib.rs");
const nodeDaemon = read("crates/disasmer-node/src/daemon.rs");
const nodeAssignmentRunner = `${read("crates/disasmer-node/src/assignment_runner.rs")}\n${read("crates/disasmer-node/src/assignment_runner/control_watcher.rs")}\n${read("crates/disasmer-node/src/assignment_runner/process_runner.rs")}\n${read("crates/disasmer-node/src/assignment_runner/validation.rs")}`;
const sharedWasmtimeRuntime = `${read("crates/disasmer-wasm-runtime/src/lib.rs")}\n${read("crates/disasmer-wasm-runtime/src/task_host_linker.rs")}`;
const nodeIdentity = read("crates/disasmer-node/src/node_identity.rs");
const nodeCoordinatorSession = read("crates/disasmer-node/src/coordinator_session.rs");
const nodeTaskArtifacts = read("crates/disasmer-node/src/task_artifacts.rs");
const nodeTaskReports = read("crates/disasmer-node/src/task_reports.rs");
const nodeDebugAgent = read("crates/disasmer-node/src/debug_agent.rs");
const hostedPolicyRoot = maybeRead("private/hosted-policy/src/lib.rs");
const hostedObservability = maybeRead("private/hosted-policy/src/observability.rs");
const hostedPolicy = hostedPolicyRoot
  ? `${hostedPolicyRoot}\n${hostedObservability || ""}`
  : null;
const hostedPostgresSmoke = maybeRead(
  "private/hosted-policy/src/bin/disasmer-postgres-durable-smoke.rs"
);
const dapAdapter = read("crates/disasmer-dap/src/adapter.rs");
const dapBreakpoints = read("crates/disasmer-dap/src/breakpoints.rs");
const dapRuntimeClient = `${read("crates/disasmer-dap/src/runtime_client.rs")}\n${read("crates/disasmer-dap/src/runtime_client/transport.rs")}\n${read("crates/disasmer-dap/src/runtime_client/debug_protocol.rs")}`;
const dapVirtualModel = read("crates/disasmer-dap/src/virtual_model.rs");
const dapTests = read("crates/disasmer-dap/src/tests.rs");
const nodeAttachSmoke = read("scripts/node-attach-smoke.js");
const schedulerPlacementSmoke = read("scripts/scheduler-placement-smoke.js");
const selfHostedCoordinatorSmokeSource = read("scripts/self-hosted-coordinator-smoke.js");
const cliLocalRunSmoke = read("scripts/cli-local-run-smoke.js");
const vscodeF5Smoke = read("scripts/vscode-f5-smoke.js");
const dapSmoke = read("scripts/dap-smoke.js");
const artifactDownloadSmoke = read("scripts/artifact-download-smoke.js");
const artifactExportSmoke = read("scripts/artifact-export-smoke.js");
const realFlagshipHarness = read("scripts/real-flagship-harness.js");
const selfHostedCoordinatorSmoke = read("scripts/self-hosted-coordinator-smoke.js");
const wasmtimeAssignmentSmoke = read("scripts/wasmtime-assignment-smoke.js");
const publicLocalDemoMatrix = read("scripts/public-local-demo-matrix-smoke.js");
const hostedClientCompatSmoke = fs.existsSync(
  path.join(repo, "private/hosted-policy/scripts/hosted-client-compat-smoke.js")
)
  ? read("private/hosted-policy/scripts/hosted-client-compat-smoke.js")
  : null;
const publicDryrunServiceSmoke = fs.existsSync(
  path.join(repo, "private/hosted-policy/scripts/public-release-dryrun-service-smoke.js")
)
  ? read("private/hosted-policy/scripts/public-release-dryrun-service-smoke.js")
  : null;
const hostedService = maybeRead("private/hosted-policy/src/bin/disasmer-hosted-service.rs");
const hostedStartup = maybeRead(
  "private/hosted-policy/src/bin/disasmer-hosted-service/startup.rs"
);
const hostedOperatorAuth = maybeRead(
  "private/hosted-policy/src/bin/disasmer-hosted-service/operator_auth.rs"
);
const publicDryrunE2e = read("scripts/public-release-dryrun-e2e.js");
const finalDryrunEvidence = read("scripts/public-release-dryrun-final-evidence.js");
const mvpCompletionReview = maybeRead("MVP_COMPLETION_REVIEW.md");
const mvpCompletionReport = maybeRead("MVP_COMPLETION_REPORT.md");

if (mvpCompletionReview || mvpCompletionReport) {
  assert(
    mvpCompletionReview && mvpCompletionReport,
    "MVP completion review and report must be present together"
  );
  const reviewedCriteria = [
    ...new Set(mvpCompletionReview.match(/AC-\d{2}\.\d{2}/g) || []),
  ];
  const reportedRows = mvpCompletionReport
    .split(/\r?\n/)
    .map((line) => line.match(/^\| (AC-\d{2}\.\d{2}) \| ([^|]+) \|/))
    .filter(Boolean);
  const reportedCriteria = reportedRows.map((match) => match[1]);
  assert.strictEqual(
    reviewedCriteria.length,
    108,
    "MVP completion review criterion inventory changed unexpectedly"
  );
  assert.deepStrictEqual(
    [...reportedCriteria].sort(),
    [...reviewedCriteria].sort(),
    "MVP completion report must contain exactly one table row for every reviewed criterion"
  );
  assert.strictEqual(
    new Set(reportedCriteria).size,
    reportedCriteria.length,
    "MVP completion report contains duplicate criterion rows"
  );
  const allowedLevels = new Set([
    "Specified",
    "Contract-verified",
    "Integration-verified",
    "Live-verified",
    "Open",
  ]);
  for (const [, criterion, rawLevel] of reportedRows) {
    assert(
      allowedLevels.has(rawLevel.trim()),
      `${criterion} uses an unknown verification level: ${rawLevel.trim()}`
    );
  }
  const openCriteria = reportedRows
    .filter(([, , rawLevel]) => rawLevel.trim() === "Open")
    .map(([, criterion]) => criterion);
  assert(
    openCriteria.length === 0 ||
      (openCriteria.length === 1 && openCriteria[0] === "AC-14.14"),
    "the completion report may leave only immutable release provenance open"
  );
  for (let index = 1; index <= 13; index += 1) {
    const criterion = `AC-14.${String(index).padStart(2, "0")}`;
    const row = reportedRows.find(([, candidate]) => candidate === criterion);
    assert.strictEqual(
      row?.[2].trim(),
      "Live-verified",
      `${criterion} must retain strict hosted evidence`
    );
  }
  for (const requiredSection of [
    "## Verification snapshot",
    "## Authoritative verification runs",
    "## Exact verification commands",
    "## Candidate provenance (not final immutable evidence)",
    "## Change accounting and replaced shortcuts",
    "## Clean filtered-tree quickstart transcript",
    "## Strict hosted transcript",
    "## Known Windows-only issues",
    "## Acceptance-criterion audit",
    "## Remaining release sequence",
  ]) {
    assert(
      mvpCompletionReport.includes(requiredSection),
      `MVP completion report omitted required section: ${requiredSection}`
    );
  }
  if (openCriteria.length === 1) {
    expect(
      mvpCompletionReport,
      "completed strict transcript keeps dirty provenance explicit",
      /harness verdict is `partial` only[\s\S]*`source_tree_clean`[\s\S]*configuration `clean` are false/
    );
  }
  expect(
    mvpCompletionReport,
    "exact strict command requires hosted authority and VPS restart proof",
    /DISASMER_STRICT_FULL_RELEASE=1[\s\S]*DISASMER_STRICT_VPS_RESTART=1[\s\S]*DISASMER_SECOND_TENANT_(?:SESSION|EVIDENCE)_FILE=[\s\S]*DISASMER_EXPIRED_USER_SESSION_FILE=/
  );
}

expect(
  phase2,
  "phase 2 rejects type-only acceptance",
  /- \[x\] \*\*Passed:\*\* A criterion cannot be accepted solely because a type, trait, schema, mock, or unit-level model exists\./
);

for (const [gateName, script] of [
  ["public acceptance", publicAcceptance],
  ["private acceptance", privateAcceptance],
  ["CLI-first acceptance", cliFirstAcceptance],
  ["public split", publicSplit],
]) {
  expectGate(script, gateName);
}

expect(codeSizeGuard, "code-size guard enforces 1000-line production file limit", /maxProductionLines = 1000/);
expect(
  codeSizeGuard,
  "code-size guard excludes test-only Rust modules from business-logic threshold",
  /isTestRustFile/
);
expect(
  phase3Ledger,
  "Phase 3 ledger defines the exact pre-final and final states",
  /Phase 3 ledger must contain 191 criteria[\s\S]*Passed: 0, Partial: 181, Open: 10[\s\S]*P3-GATE-[\s\S]*Passed: 191, Partial: 0, Open: 0/
);
expect(
  publicDryrunE2e,
  "final public-release E2E requires the pre-final Phase 3 ledger",
  /assertPreFinalLedger\(readPhase3Ledger\(repo\)\)/
);
expect(
  finalDryrunEvidence,
  "final evidence requires every Phase 3 criterion to be Passed",
  /assertFinalLedger\(readPhase3Ledger\(repo\)\)/
);
expect(
  dapVirtualModel,
  "DAP launch state uses shared core identity and debug model types",
  /use disasmer_core::\{[\s\S]*DebugRuntimeState[\s\S]*ProcessId[\s\S]*ProjectId[\s\S]*TaskDefinitionId[\s\S]*TaskInstanceId[\s\S]*TenantId[\s\S]*UserId[\s\S]*\}[\s\S]*pub\(crate\) tenant: TenantId[\s\S]*pub\(crate\) project_id: ProjectId[\s\S]*pub\(crate\) actor_user: UserId/
);
expect(
  coreBundle,
  "bundle debug metadata contains source probe records",
  /pub struct BundleDebugMetadata[\s\S]*pub probes: Vec<BundleDebugProbe>[\s\S]*pub struct BundleDebugProbe[\s\S]*source_path[\s\S]*line_start[\s\S]*line_end[\s\S]*function[\s\S]*task: TaskDefinitionId[\s\S]*pub fn discover_source_debug_probes[\s\S]*disasmer_probe_task[\s\S]*namespace\.ident != "disasmer"[\s\S]*"main"[\s\S]*strip_suffix\("_main"\)[\s\S]*"task"/
);
assert.doesNotMatch(
  coreBundle,
  /debug_probe_task_for_function|"file_scope"/,
  "bundle debug metadata must not guess runtime task ownership from function names or invent a file-scope probe"
);
expect(
  `${cliBundle}\n${cliTests}`,
  "CLI bundle inspection populates generated debug probes from selected source inputs",
  /discover_debug_probes\(&project, &selected_inputs\)[\s\S]*metadata\.debug_metadata\.probes = debug_probes[\s\S]*discover_source_debug_probes\(&input\.path, &source\)[\s\S]*bundle_inspect_discovers_environments_selected_inputs_and_source_providers[\s\S]*debug_metadata[\s\S]*probes[\s\S]*compile_linux/
);
expect(
  `${coreProject}\n${cliTests}`,
  "project inspection derives real Disasmer entrypoints and never invents launch surfaces",
  /NoEntrypoints[\s\S]*discover_entrypoints[\s\S]*segments\.as_slice\(\) == \["disasmer", "main"\][\s\S]*entrypoint_name[\s\S]*project_without_declared_entrypoint_does_not_invent_product_surfaces[\s\S]*entrypoint == "build"[\s\S]*entrypoint == "release"/
);
expect(
  sdkTaskArgs,
  "SDK task boundary compile-fail examples reject host-only values",
  /```compile_fail[\s\S]*borrowed\.as_str\(\)[\s\S]*```compile_fail[\s\S]*std::ptr::null[\s\S]*```compile_fail[\s\S]*std::fs::File[\s\S]*```compile_fail[\s\S]*Mutex::new/
);
expect(
  dapVirtualModel,
  "DAP state stores bundle debug probe metadata",
  /debug_probes: Vec<BundleDebugProbe>[\s\S]*load_bundle_debug_probes\(&self\.project, &self\.source_path\)/
);
expect(
  dapBreakpoints,
  "DAP breakpoint resolver uses bundle debug probes",
  /load_bundle_debug_probes[\s\S]*discover_source_debug_probes\(source_path, &source\)[\s\S]*resolve_breakpoints[\s\S]*debug_probe_for_line[\s\S]*Mapped to Disasmer debug probe[\s\S]*No Disasmer debug probe metadata covers this source line/
);
expect(
  dapAdapter,
  "DAP setBreakpoints calls probe-aware resolver",
  /let requested_source_path = request[\s\S]*let requested_lines = request[\s\S]*resolve_breakpoints_for_source\([\s\S]*requested_source_path,[\s\S]*requested_lines[\s\S]*breakpoint\.to_dap\(\)/
);
expect(
  `${dapTests}\n${dapSmoke}`,
  "DAP tests and smoke cover probe-backed breakpoint mapping",
  /breakpoint_resolution_uses_bundle_debug_probe_metadata[\s\S]*buildMainLine[\s\S]*setBreakpoints[\s\S]*breakpointResponse\.body\.breakpoints\[0\]\.verified, true/
);
expect(
  dapRuntimeClient,
  "DAP runtime client calls coordinator restart_task and parses boundary decision",
  /pub\(crate\) fn restart_task\([\s\S]*state: &AdapterState,[\s\S]*task: &TaskInstanceId,[\s\S]*"type": "restart_task"[\s\S]*parse_task_restart_response[\s\S]*accepted[\s\S]*clean_boundary_available[\s\S]*requires_whole_process_restart/
);
expect(
  dapRuntimeClient,
  "local and live DAP launch share the real Wasm entrypoint path",
  /run_local_services_runtime[\s\S]*launch_services_debug_entrypoint\(&listen, state, &repo\)[\s\S]*fn launch_services_debug_entrypoint[\s\S]*build_debug_bundle[\s\S]*"set_debug_breakpoints"[\s\S]*"kind": "coordinator_node_wasm"[\s\S]*"wasm_module_base64"[\s\S]*run_live_services_runtime[\s\S]*launch_services_debug_entrypoint\(&coordinator, state, &repo\)/
);
assert.doesNotMatch(
  dapRuntimeClient,
  /launch_live_placed_task|"command": "cargo"|"task": "compile-linux"/,
  "live DAP must not launch a separate synthetic cargo task"
);
expect(
  dapAdapter,
  "DAP services restartFrame uses coordinator restart decision",
  /state\.runtime_backend != RuntimeBackend::Simulated[\s\S]*restart_task_through_coordinator[\s\S]*restart_task\(state, &task\)[\s\S]*coordinator refused task restart[\s\S]*whole virtual-process restart required/
);
expect(
  dapRuntimeClient,
  "DAP failed-main restart explicitly replaces the existing virtual process",
  /relaunch_services_main_runtime[\s\S]*restart_state\.restart_existing = true[\s\S]*launch_services_debug_entrypoint/
);
expect(
  `${coordinatorProcesses}\n${coordinatorMainRuntime}`,
  "process replacement retires the old main and rejects late incarnation commands",
  /replacing_existing[\s\S]*interrupt_process[\s\S]*controls[\s\S]*remove[\s\S]*next_launch_id[\s\S]*is_current_scope[\s\S]*coordinator main process incarnation was replaced/
);
expect(
  `${dapTests}\n${dapSmoke}`,
  "DAP tests and smoke cover coordinator restart boundary refusal",
  /task_restart_response_preserves_coordinator_boundary_decision[\s\S]*client\.send\("restartFrame"[\s\S]*restartFailure[\s\S]*checkpoint boundary\|still active/
);
expect(
  dapSmoke,
  "DAP restarts a terminal failed task and waits for its new acknowledged probe stop",
  /failMainLine[\s\S]*restartClient\.send\("continue"[\s\S]*message\.event === "terminated"[\s\S]*send\("restartFrame"[\s\S]*response\(restartRequest, "restartFrame"\)[\s\S]*Restarted main from the rebuilt bundle[\s\S]*allThreadsStopped, true/
);
expect(
  `${sharedWasmtimeRuntime}\n${nodeAssignmentRunner}\n${dapVirtualModel}\n${dapSmoke}`,
  "DAP proves real dynamic child threads, arguments, handles, and probe-boundary all-stop",
  /enter_quiescent_host_boundary[\s\S]*leave_quiescent_host_boundary[\s\S]*TaskHostOperation::DebugProbe[\s\S]*debug_handle_snapshot[\s\S]*task_handle_\{handle_id\}[\s\S]*runtime_task_args[\s\S]*insert_runtime_thread[\s\S]*taskTrapLine[\s\S]*childThread[\s\S]*arg_0[\s\S]*task_handle_[\s\S]*definition=task_trap instance=ti:.*:child:\\d\+ state=active/
);
expect(
  `${dapAdapter}\n${dapRuntimeClient}\n${dapVirtualModel}\n${dapTests}`,
  "DAP attach product mode reads coordinator debug/task state",
  /attach_services_runtime[\s\S]*RuntimeBackend::LocalServices \| RuntimeBackend::LiveServices[\s\S]*apply_attach_record[\s\S]*"type": "debug_attach"[\s\S]*authorization[\s\S]*allowed[\s\S]*"type": "list_task_events"[\s\S]*coordinator_threads_from_events[\s\S]*attach_record_replaces_demo_threads_with_coordinator_task_events/
);
expect(
  coordinatorProtocol,
  "coordinator protocol exposes probe hits and acknowledged Debug Epoch state",
  /SetDebugBreakpoints \{[\s\S]*InspectDebugBreakpoints \{[\s\S]*CreateDebugEpoch \{[\s\S]*ResumeDebugEpoch \{[\s\S]*InspectDebugEpoch \{[\s\S]*ReportDebugState \{[\s\S]*ReportDebugProbeHit \{[\s\S]*DebugEpochStatus \{/
);
expect(
  `${coordinatorMain}\n${coordinatorRuntimeDurable}\n${coordinatorPostgres}\n${coordinatorServiceTests}\n${hostedStartup || ""}`,
  "actual standalone and hosted services load and persist durable state through configured Postgres",
  /DATABASE_URL[\s\S]*new_with_database_url[\s\S]*RuntimeDurableStore[\s\S]*PostgresDurableStore::connect[\s\S]*disasmer_cli_sessions[\s\S]*postgres_backed_runtime_service_survives_restart_without_live_process_state[\s\S]*new_with_admin_token_database_url_and_quota/
);
if (hostedPostgresSmoke) {
  expect(
    hostedPostgresSmoke,
    "private Postgres restart evidence authenticates the same durable CLI session after reboot",
    /issue_cli_session[\s\S]*try_persist[\s\S]*Coordinator::try_boot[\s\S]*authenticate_cli_session_at[\s\S]*durable_cli_session_present/
  );
}
expect(
  coordinatorService,
  "coordinator stores transient Debug Epoch maps",
  /debug_epochs: BTreeMap<ProcessControlKey, u64>[\s\S]*debug_epoch_runtime: BTreeMap<ProcessControlKey, debug::DebugEpochRuntime>[\s\S]*debug_breakpoints: BTreeMap<ProcessControlKey, debug::DebugBreakpointPlan>[\s\S]*debug_commands: BTreeMap<TaskControlKey, debug::DebugPendingCommand>/
);
expect(
  coordinatorDebug,
  "executing Wasm probe hits create a freeze Debug Epoch",
  /handle_report_debug_probe_hit[\s\S]*wasm_debug_probe_hit[\s\S]*"freeze"[\s\S]*executing Wasm reached probe/
);
expect(
  coordinatorDebug,
  "coordinator exposes freeze, resume, poll, and signed state handlers",
  /handle_create_debug_epoch[\s\S]*"freeze"[\s\S]*handle_resume_debug_epoch[\s\S]*"resume"[\s\S]*handle_poll_debug_command[\s\S]*handle_report_debug_state/
);
expect(
  coordinatorDebug,
  "coordinator derives all-stop and resumed state from participant acknowledgements",
  /all_acknowledged[\s\S]*fully_frozen[\s\S]*DebugAcknowledgementState::Frozen[\s\S]*fully_resumed[\s\S]*DebugAcknowledgementState::Running/
);
expect(
  `${dapAdapter}\n${dapRuntimeClient}\n${dapVirtualModel}\n${dapSmoke}`,
  "DAP services mode waits for coordinator Debug Epoch acknowledgement",
  /run_local_services_runtime[\s\S]*set_debug_breakpoints[\s\S]*wait_for_breakpoint_hit[\s\S]*wait_for_debug_epoch_state_at[\s\S]*all_participants_frozen[\s\S]*resume_debug_epoch\(state[\s\S]*wait_for_debug_epoch_resumed/
);
expect(
  coordinatorServiceTests,
  "coordinator test proves signed node freeze/resume debug commands",
  /debug_epoch_commands_are_polled_by_signed_active_task_nodes[\s\S]*SetDebugBreakpoints[\s\S]*ReportDebugProbeHit[\s\S]*PollDebugCommand[\s\S]*ReportDebugState[\s\S]*fully_frozen[\s\S]*ResumeDebugEpoch[\s\S]*fully_resumed/
);
expect(
  coreCheckpoint,
  "core models the exact clean task entry and VFS boundary",
  /CheckpointBoundary[\s\S]*serialized_args[\s\S]*environment_digest[\s\S]*vfs_epoch[\s\S]*task_abi/
);
expect(
  coordinatorProcesses,
  "coordinator captures that boundary before dispatch",
  /capture_task_restart_checkpoint[\s\S]*required_artifacts[\s\S]*VfsManifest[\s\S]*task_restart_checkpoints\.insert[\s\S]*TaskRestartCheckpoint/
);
expect(
  `${coordinatorDebug}\n${coordinatorServiceTests}\n${wasmtimeAssignmentSmoke}`,
  "failed task restart uses the captured boundary and relaunches the real assignment",
  /RestartPolicy\.decide[\s\S]*handle_launch_task_with_actor[\s\S]*selected task restarted as new instance[\s\S]*from clean VFS entry boundary[\s\S]*service_reports_task_restart_boundary_through_public_api[\s\S]*restarted_assignment[\s\S]*trapRestart[\s\S]*clean_boundary_available, true[\s\S]*restartedTrapNodeRun\.node_status, "failed"/
);
expect(
  coordinatorProtocol,
  "launch and assignment protocol carry the TaskSpec and exact Wasm module bytes",
  /LaunchTask \{[\s\S]*task_spec: TaskSpec[\s\S]*wasm_module_base64: String[\s\S]*pub struct TaskAssignment \{[\s\S]*pub task_spec: TaskSpec[\s\S]*pub wasm_module_base64: String/
);
expect(
  coordinatorProcesses,
  "coordinator placement preserves the TaskSpec and Wasm module in the assignment",
  /let assignment = TaskAssignment \{[\s\S]*task_spec: pending\.task_spec[\s\S]*wasm_module_base64: pending\.wasm_module_base64/
);
expect(
  sharedWasmtimeRuntime,
  "shared Wasmtime runtime verifies the module digest before compilation",
  /fn verified_module_bytes[\s\S]*let actual = Digest::sha256\(bytes\)[\s\S]*if &actual != expected_bundle_digest[\s\S]*BundleDigestMismatch/
);
expect(
  `${nodeAssignmentRunner}\n${nodeDaemon}`,
  "node assignment runner requires the bundle digest and executes the versioned task export through the verified runtime",
  /run_verified_wasmtime_assignment[\s\S]*bundle_digest\.as_ref\(\)[\s\S]*run_task_export_verified_with_task_host[\s\S]*daemon_wasm_task_assignment_uses_abi_version_and_verifies_bundle_digest/
);
expect(
  nodeLib,
  "node-facing runtime test rejects a digest mismatch before Wasm parsing",
  /wasmtime_runtime_rejects_bundle_digest_mismatch_before_compilation[\s\S]*WasmTaskError::BundleDigestMismatch[\s\S]*failed to parse/
);
expect(
  `${coreExecution}\n${coordinatorProtocol}\n${coordinatorProcesses}\n${coordinatorServiceTests}`,
  "product-mode spawn uses one Wasm TaskSpec and signed parent-scoped child launch",
  /pub enum TaskDispatch[\s\S]*CoordinatorNodeWasm[\s\S]*pub struct TaskSpec[\s\S]*product_mode_uses_remote_dispatch[\s\S]*LaunchChildTask \{[\s\S]*parent_task: String[\s\S]*TaskAssignment \{[\s\S]*task_spec: TaskSpec[\s\S]*handle_launch_child_task[\s\S]*TaskDispatch::CoordinatorNodeWasm[\s\S]*signed_active_wasm_task_can_spawn_and_join_child_in_its_process_only/
);
expect(
  `${coreExecution}\n${coordinatorProtocol}\n${coordinatorLogs}\n${coordinatorService}\n${coordinatorServiceTests}`,
  "join_task returns event-derived remote task results",
  /pub struct TaskJoinResult[\s\S]*result: Option<TaskBoundaryValue>[\s\S]*remote_completion_observed[\s\S]*from_remote_completion[\s\S]*JoinTask \{[\s\S]*TaskJoined \{[\s\S]*handle_join_task[\s\S]*event\.result\.clone\(\)[\s\S]*waiting for signed node task_completed event[\s\S]*TaskJoinState::Pending[\s\S]*SmallJson/
);
expect(
  `${coordinatorProtocol}\n${coordinatorService}\n${coordinatorProcesses}\n${coordinatorServiceTests}`,
  "launch_task can explicitly wait for a later capable node",
  /LaunchTask \{[\s\S]*wait_for_node: bool[\s\S]*TaskQueued \{[\s\S]*pending_task_launches: VecDeque<processes::PendingTaskLaunch>[\s\S]*Err\(err\) if wait_for_node[\s\S]*pending_task_launches[\s\S]*push_back[\s\S]*CoordinatorResponse::TaskQueued[\s\S]*assign_pending_task_to_node[\s\S]*DefaultScheduler\.place\(std::slice::from_ref\(&descriptor\)[\s\S]*coordinator_side_task_launch_can_wait_for_capable_worker[\s\S]*wait_for_node: true[\s\S]*late worker should receive pending assignment/
);
expect(
  schedulerPlacementSmoke,
  "scheduler smoke proves queued placement through process boundary and signed node poll",
  /type: "start_process"[\s\S]*type: "launch_task"[\s\S]*task_definition: "prepare_source"[\s\S]*abi: "task_v1"[\s\S]*required_capabilities: \["SourceFilesystem", "SourceGit"\][\s\S]*wait_for_node: true[\s\S]*task_queued[\s\S]*gitCapabilities[\s\S]*type: "poll_task_assignment"[\s\S]*late capable node should receive queued assignment/
);
expect(
  coreAuth,
  "core agent workflow auth uses Ed25519 signatures over scoped request data",
  /pub struct AgentSignedRequest[\s\S]*pub fn sign_agent_workflow_request[\s\S]*SigningKey::from_bytes[\s\S]*pub fn verify_agent_workflow_signature[\s\S]*VerifyingKey::from_bytes[\s\S]*agent_workflow_signature_message/
);
expect(
  coreAuth,
  "core node request auth uses Ed25519 signatures over scoped node request data",
  /pub struct NodeSignedRequest[\s\S]*pub fn sign_node_request[\s\S]*SigningKey::from_bytes[\s\S]*pub fn verify_node_request_signature[\s\S]*VerifyingKey::from_bytes[\s\S]*node_request_signature_message/
);
expect(
  coordinatorProtocol,
  "coordinator protocol supports a versioned wire request envelope",
  /pub enum CoordinatorWireRequest[\s\S]*Envelope\(CoordinatorRequestEnvelope\)[\s\S]*pub struct CoordinatorRequestEnvelope[\s\S]*protocol_version: u64[\s\S]*request_id: String[\s\S]*operation: String[\s\S]*authentication: Option<Value>[\s\S]*payload: CoordinatorRequest/
);
expect(
  coordinatorProtocol,
  "coordinator TCP protocol accepts only versioned wire requests",
  /pub enum CoordinatorWireRequest\s*\{\s*Envelope\(CoordinatorRequestEnvelope\),?\s*\}/
);
expect(
  coreWire,
  "shared coordinator wire envelope includes protocol version, request id, operation, auth metadata, and payload",
  /COORDINATOR_PROTOCOL_VERSION: u64 = 1[\s\S]*COORDINATOR_WIRE_REQUEST_TYPE[\s\S]*pub fn coordinator_wire_request[\s\S]*"protocol_version"[\s\S]*"request_id"[\s\S]*"operation"[\s\S]*"authentication"[\s\S]*"payload"/
);
expect(
  coordinatorProtocol,
  "coordinator validates wire envelope version and operation before dispatch",
  /if self\.protocol_version != COORDINATOR_PROTOCOL_VERSION[\s\S]*request_id\.trim\(\)\.is_empty\(\)[\s\S]*operation .*does not match payload operation/
);
expect(
  coordinatorTcp,
  "coordinator TCP framing decodes versioned wire requests",
  /decode_wire_request[\s\S]*serde_json::from_str::<super::CoordinatorWireRequest>[\s\S]*into_request\(\)/
);
expect(
  coordinatorTcp,
  "standalone Core coordinator TCP authority is strict by default",
  /pub enum ClientAuthorityMode[\s\S]*Strict[\s\S]*LocalTrustedLoopback[\s\S]*pub fn serve_tcp[\s\S]*ClientAuthorityMode::Strict/
);
expect(
  coordinatorTcp,
  "local trusted request authority is explicitly restricted to loopback development",
  /serve_tcp_local_trusted[\s\S]*local_addr\(\)\?[\s\S]*ip\(\)\.is_loopback\(\)[\s\S]*local trusted request mode is restricted to a loopback listener/
);
expect(
  coordinatorTcp,
  "strict Core Client authority rejects request-body identity",
  /authorize_client_request[\s\S]*CoordinatorRequest::Authenticated[\s\S]*CoordinatorRequest::SignedNode[\s\S]*request-body identity fields are not authority/
);
expect(
  `${coordinatorMain}\n${cliRun}\n${cliRunLocalServices}`,
  "local trusted loopback authority requires an explicit development opt-in",
  /--allow-local-trusted-loopback[\s\S]*serve_tcp_local_trusted[\s\S]*--allow-local-trusted-loopback/
);
expect(
  dapRuntimeClient,
  "DAP local-services coordinator explicitly opts into loopback development authority",
  /run_local_services_runtime[\s\S]*"--listen"[\s\S]*"127\.0\.0\.1:0"[\s\S]*"--allow-local-trusted-loopback"/
);
expect(
  `${cliClient}\n${nodeDaemon}\n${dapRuntimeClient}`,
  "CLI, node, and DAP transports send versioned coordinator wire requests",
  /JsonLineSession[\s\S]*coordinator_wire_request[\s\S]*CoordinatorSession[\s\S]*coordinator_wire_request[\s\S]*fn coordinator_request[\s\S]*coordinator_wire_request/
);
expect(
  `${coordinatorServiceTests}\n${cliTests}`,
  "focused tests prove versioned coordinator wire envelope behavior",
  /service_stream_rejects_invalid_versioned_envelope_metadata[\s\S]*operation attach_node does not match payload operation ping[\s\S]*doctor_pings_configured_coordinator[\s\S]*"coordinator_request"[\s\S]*"protocol_version"/
);
expect(
  coordinatorServiceTests,
  "strict TCP test proves body-authority denial and CLI-session success",
  /strict_service_stream_rejects_body_authority_and_accepts_cli_session[\s\S]*victim-tenant[\s\S]*request-body identity fields are not authority[\s\S]*strict-stream-session[\s\S]*vp-authenticated/
);
expect(
  `${coordinatorProtocol}\n${coordinatorService}\n${coordinatorAuthenticated}`,
  "authenticated scheduling derives scope from the CLI session",
  /AuthenticatedCoordinatorRequest[\s\S]*ScheduleTask[\s\S]*AuthenticatedCoordinatorRequest::ScheduleTask[\s\S]*context\.tenant[\s\S]*context\.project/
);
expect(
  `${coreArtifact}\n${coordinatorNodes}\n${artifactDownloadSmoke}`,
  "signed node retention inventory removes garbage-collected artifact availability",
  /reconcile_node_retention[\s\S]*retaining_nodes\.remove\(node\)[\s\S]*reconcile_node_retention\(&node, &artifact_locations\)[\s\S]*artifact_locations: \[\][\s\S]*const collectedLink[\s\S]*unavailable from current retention/
);
expect(
  nodeTaskArtifacts,
  "node artifact store reads retained chunks only after digest and size verification",
  /NodeArtifactStore[\s\S]*read_verified_chunk[\s\S]*expected_digest[\s\S]*expected_size_bytes/
);
expect(
  `${coordinatorProtocol}\n${coordinatorArtifacts}`,
  "coordinator reverse-transfer protocol polls and verifies uploaded artifact chunks",
  /PollArtifactTransfer[\s\S]*UploadArtifactTransferChunk[\s\S]*artifact reverse transfer chunk digest mismatch/
);
expect(
  artifactDownloadSmoke,
  "explicit artifact download waits for the retaining-node reverse stream",
  /downloadRetainedBytes[\s\S]*retaining_node_reverse_stream_pending[\s\S]*retaining_node_reverse_stream/
);
expect(
  artifactDownloadSmoke,
  "downloaded retained bytes are checked against coordinator artifact size and digest",
  /downloadRetainedBytes\([\s\S]*packageEvent\.artifact_size_bytes[\s\S]*createHash\("sha256"\)[\s\S]*downloaded\.content[\s\S]*downloadedDigest, packageEvent\.artifact_digest/
);
expect(
  `${realFlagshipHarness}\n${artifactDownloadSmoke}\n${artifactExportSmoke}`,
  "one real CLI flagship path runs Wasm children in rootless Podman and transfers retained bytes",
  /ensureRootlessPodman[\s\S]*runFlagshipWorker[\s\S]*create_node_enrollment_grant[\s\S]*--enrollment-grant[\s\S]*"run", "build"[\s\S]*disasmer\+tcp:\/\/[\s\S]*worker_placement_requested[\s\S]*compile_linux[\s\S]*package_release[\s\S]*downloadRetainedBytes[\s\S]*launchFlagship[\s\S]*artifact_size_bytes/
);
expect(
  coordinatorProtocol,
  "node heartbeat carries signed enrolled-key proof",
  /NodeHeartbeat \{[\s\S]*node: String[\s\S]*node_signature: Option<NodeSignedRequest>/
);
expect(
  coordinatorProtocol,
  "node-originated public requests can be wrapped in signed node envelope",
  /SignedNode \{[\s\S]*node: String[\s\S]*node_signature: NodeSignedRequest[\s\S]*request: Box<CoordinatorRequest>/
);
expect(
  coordinatorNodes,
  "coordinator verifies signed node heartbeat freshness and rejects replay",
  /handle_node_heartbeat[\s\S]*authenticate_node_request[\s\S]*requires a signed proof of enrolled private-key possession[\s\S]*issued_at_epoch_seconds[\s\S]*abs_diff\(now_epoch_seconds\)[\s\S]*node_replay_nonces\.contains_key[\s\S]*verify_node_request_signature/
);
expect(
  coordinatorSignedNodeSurface,
  "coordinator requires signed node envelope for node-originated requests",
  /CoordinatorRequest::SignedNode[\s\S]*handle_signed_node_request[\s\S]*signed_node_request_kind[\s\S]*signed_node_request_node[\s\S]*reject_unsigned_node_request[\s\S]*node-originated request requires signed_node envelope proof/
);
expect(
  cliNode,
  "CLI node attach derives and uses a node private key",
  /let node_private_key = node_private_key_for_attach[\s\S]*node_ed25519_public_key_from_private_key[\s\S]*sign_node_request[\s\S]*signed_node_request_json[\s\S]*fn node_private_key_for_attach[\s\S]*DISASMER_NODE_PRIVATE_KEY/
);
expect(
  cliNode,
  "CLI node attach persists fallback node credentials under project .disasmer",
  /StoredNodeCredential[\s\S]*load_or_create_local_node_credential[\s\S]*"disasmer_node_credential"[\s\S]*local_node_credential_file[\s\S]*"\.disasmer"[\s\S]*"nodes"/
);
expect(
  cliNode,
  "CLI node attach wraps node-originated requests in signed_node envelope",
  /fn signed_node_request_json[\s\S]*sign_node_request[\s\S]*"type": "signed_node"[\s\S]*"node_signature": node_signature[\s\S]*"request": request/
);
expect(
  `${nodeDaemon}\n${nodeIdentity}`,
  "node daemon derives and uses a node private key",
  /let node_private_key = node_private_key_for_runtime[\s\S]*sign_node_request[\s\S]*signed_node_request_json[\s\S]*node_ed25519_public_key_from_private_key[\s\S]*fn node_private_key_for_runtime[\s\S]*DISASMER_NODE_PRIVATE_KEY/
);
expect(
  nodeIdentity,
  "node daemon persists fallback node credentials under project .disasmer",
  /StoredNodeCredential[\s\S]*load_or_create_local_node_credential[\s\S]*"disasmer_node_credential"[\s\S]*local_node_credential_file[\s\S]*"\.disasmer"[\s\S]*"nodes"/
);
expect(
  `${nodeDaemon}\n${nodeIdentity}`,
  "node daemon wraps node-originated requests in signed_node envelope",
  /fn signed_node_request_json[\s\S]*sign_node_request[\s\S]*"type": "signed_node"[\s\S]*"node_signature": node_signature[\s\S]*"request": request/
);
expect(
  `${nodeIdentity}\n${nodeCoordinatorSession}\n${sharedWasmtimeRuntime}\n${nodeAssignmentRunner}\n${nodeTaskArtifacts}\n${nodeTaskReports}\n${nodeDebugAgent}`,
  "node responsibilities are split into identity, coordinator session, versioned Wasm host capabilities, artifact/VFS, logs, and debug modules",
  /struct StoredNodeCredential[\s\S]*struct CoordinatorSession[\s\S]*struct WasmtimeTaskRuntime[\s\S]*command_run_v1[\s\S]*run_verified_wasmtime_assignment[\s\S]*struct TaskArtifactStore[\s\S]*record_completed_task[\s\S]*poll_task_cancellation/
);
expect(
  coordinatorAgents,
  "coordinator agent authorization requires signed request freshness and registered public key verification",
  /authorize_agent_project_run[\s\S]*AgentSignedRequest[\s\S]*issued_at_epoch_seconds[\s\S]*abs_diff\(now_epoch_seconds\)[\s\S]*verify_agent_workflow_signature/
);
expect(
  coordinatorProtocol,
  "agent workflow requests carry signed request proof",
  /LaunchTask \{[\s\S]*agent_public_key_fingerprint: Option<Digest>[\s\S]*agent_signature: Option<AgentSignedRequest>[\s\S]*StartProcess \{[\s\S]*agent_public_key_fingerprint: Option<Digest>[\s\S]*agent_signature: Option<AgentSignedRequest>/
);
expect(
  coordinatorProcesses,
  "coordinator rejects fingerprint-only agent workflow dispatch and tracks nonce replay",
  /requires a signed request proving private-key possession[\s\S]*agent_replay_nonces\.contains[\s\S]*agent signed request nonce has already been used[\s\S]*authorize_agent_project_run/
);
expect(
  cliRun,
  "CLI signs agent workflow requests when private key identity is used",
  /DISASMER_AGENT_PRIVATE_KEY[\s\S]*"agent_signature"[\s\S]*fn agent_signature_for_request[\s\S]*sign_agent_workflow_request/
);
expect(
  coordinatorDurable,
  "durable state records scoped CLI session credentials",
  /pub struct CliSessionRecord[\s\S]*pub session_digest: Digest[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId[\s\S]*pub user: UserId[\s\S]*pub revoked: bool[\s\S]*pub cli_sessions: BTreeMap<Digest, CliSessionRecord>/
);
expect(
  coordinatorSessions,
  "coordinator issues and authenticates CLI sessions by digest",
  /pub fn issue_cli_session[\s\S]*Digest::sha256\(session_secret\)[\s\S]*pub fn authenticate_cli_session[\s\S]*cli_sessions[\s\S]*AuthContext/
);
expect(
  coordinatorSessions,
  "coordinator rejects expired and revoked CLI sessions",
  /expires_at_epoch_seconds[\s\S]*expires_at <= now_epoch_seconds[\s\S]*CLI session credential has expired[\s\S]*pub fn revoke_cli_session[\s\S]*record\.revoked = true/
);
expect(
  coordinatorProtocol,
  "coordinator has authenticated request envelope without trusted actor fields",
  /Authenticated \{[\s\S]*session_secret: String[\s\S]*request: AuthenticatedCoordinatorRequest[\s\S]*pub enum AuthenticatedCoordinatorRequest[\s\S]*AuthStatus[\s\S]*ListProjects/
);
expect(
  coordinatorProtocol,
  "authenticated request protocol covers node enrollment, descriptor listing, and revocation",
  /AuthenticatedCoordinatorRequest[\s\S]*CreateNodeEnrollmentGrant \{[\s\S]*ListNodeDescriptors[\s\S]*RevokeNodeCredential \{[\s\S]*node: String/
);
expect(
  coordinatorProtocol,
  "authenticated request protocol covers user process, task, debug, and artifact operations",
  /AuthenticatedCoordinatorRequest[\s\S]*StartProcess \{[\s\S]*CancelProcess \{[\s\S]*RestartTask \{[\s\S]*DebugAttach \{[\s\S]*ListTaskEvents \{[\s\S]*CreateArtifactDownloadLink \{[\s\S]*OpenArtifactDownloadStream \{[\s\S]*RevokeArtifactDownloadLink \{[\s\S]*ExportArtifactToNode \{/
);
expect(
  coordinatorProtocol,
  "authenticated request protocol can revoke the current CLI session",
  /AuthenticatedCoordinatorRequest[\s\S]*RevokeCliSession[\s\S]*CliSessionRevoked/
);
expect(
  coordinatorProtocol,
  "admin protocol requests carry nonce-bound proof fields instead of bearer tokens",
  /AdminStatus \{[\s\S]*actor_user: String[\s\S]*admin_proof: Digest[\s\S]*admin_nonce: String[\s\S]*issued_at_epoch_seconds: u64[\s\S]*SuspendTenant \{[\s\S]*target_tenant: String[\s\S]*admin_proof: Digest/
);
expect(
  coordinatorService,
  "coordinator derives authenticated public request context from session secret",
  /CoordinatorRequest::Authenticated[\s\S]*handle_authenticated_request[\s\S]*authenticate_cli_session\(&session_secret\)[\s\S]*AuthenticatedCoordinatorRequest::AuthStatus/
);
expect(
  coordinatorAuthorization,
  "coordinator has centralized authorization helper for authenticated public user requests",
  /pub\(super\) enum PublicUserOperation[\s\S]*AuthStatus[\s\S]*StartProcess[\s\S]*DebugAttach[\s\S]*ExportArtifactToNode[\s\S]*pub\(super\) fn authorize_authenticated_user_operation[\s\S]*authenticated .* request requires a user CLI session/
);
expect(
  coordinatorService,
  "authenticated public dispatcher calls centralized authorization before handling",
  /let context = self\.coordinator\.authenticate_cli_session\(&session_secret\)\?;[\s\S]*authorize_authenticated_user_operation\(&context, &request\)\?;[\s\S]*match request/
);
expect(
  coordinatorAuthorization,
  "coordinator tests prove centralized authenticated public authorization rejection",
  /authenticated_public_authorization_requires_user_context_and_names_operation[\s\S]*authenticated debug_attach request requires a user CLI session/
);
expect(
  `${coordinatorService}\n${coordinatorAuthenticated}\n${coordinatorDebug}`,
  "coordinator routes user process/task/debug/artifact authenticated requests through session-derived context",
  /AuthenticatedCoordinatorRequest::StartProcess[\s\S]*handle_start_process\([\s\S]*context\.tenant[\s\S]*Some\(actor\.as_str\(\)\.to_owned\(\)\)[\s\S]*AuthenticatedCoordinatorRequest::CancelProcess[\s\S]*handle_cancel_process[\s\S]*AuthenticatedCoordinatorRequest::RestartTask[\s\S]*handle_restart_task[\s\S]*AuthenticatedCoordinatorRequest::DebugAttach[\s\S]*handle_authenticated_debug_request[\s\S]*AuthenticatedCoordinatorRequest::ListTaskEvents[\s\S]*handle_list_task_events[\s\S]*AuthenticatedCoordinatorRequest::CreateArtifactDownloadLink[\s\S]*handle_create_artifact_download_link[\s\S]*AuthenticatedCoordinatorRequest::ExportArtifactToNode[\s\S]*handle_export_artifact_to_node[\s\S]*handle_debug_attach/
);
expect(
  `${coreAuth}\n${coordinatorService}\n${coordinatorAdmin}\n${coordinatorServiceTests}`,
  "coordinator verifies scoped self-hosted admin proof freshness and replay resistance",
  /admin_request_proof_from_token_digest[\s\S]*new_with_admin_token[\s\S]*admin_token_digest[\s\S]*verify_admin_request[\s\S]*ADMIN_REQUEST_MAX_CLOCK_SKEW_SECONDS[\s\S]*admin request proof is invalid[\s\S]*admin_replay_nonces\.contains_key[\s\S]*nonce was already used[\s\S]*MAX_REPLAY_NONCES_PER_AUTHORITY[\s\S]*admin_replay_nonces[\s\S]*\.insert[\s\S]*replayed_admin_status/
);
expect(
  `${coordinatorService}\n${coordinatorQuota}`,
  "coordinator keeps quota state and pre-work charging behind a focused quota module",
  /mod quota;[\s\S]*quota: quota::CoordinatorQuota[\s\S]*pub\(super\) struct CoordinatorQuota[\s\S]*can_charge_workflow_spawn[\s\S]*charge_workflow_spawn[\s\S]*charge_rendezvous_attempt[\s\S]*can_charge_download[\s\S]*charge_debug_read/
);
expect(
  coordinatorService,
  "coordinator revokes authenticated CLI sessions through session-derived context",
  /AuthenticatedCoordinatorRequest::RevokeCliSession[\s\S]*revoke_cli_session\(&session_secret\)[\s\S]*CoordinatorResponse::CliSessionRevoked/
);
expect(
  cliConfig,
  "stored CLI session can carry scoped coordinator credential without provider token fields",
  /pub\(crate\) session_secret: Option<String>/
);
expect(
  cliAuth,
  "auth status uses authenticated envelope when a CLI session secret exists",
  /let request = match authenticated_or_local_trusted_request\([\s\S]*coordinator,[\s\S]*stored_session,[\s\S]*"type": "auth_status"/
);
expect(
  cliClient,
  "stored Client credentials are bound to their issuing coordinator endpoint",
  /stored_session_for_coordinator[\s\S]*control_endpoint_identity\(&session\.coordinator\)[\s\S]*control_endpoint_identity\(coordinator\)/
);
expect(
  cliLogout,
  "logout revokes stored CLI sessions through authenticated envelope before local removal",
  /revoke_stored_cli_session_if_possible[\s\S]*"type": "authenticated"[\s\S]*"type": "revoke_cli_session"[\s\S]*"cli_session_revoked"/
);
expect(
  cliAdmin,
  "admin CLI derives nonce-bound proofs and does not send its bearer token",
  /admin_request_proof[\s\S]*command_nonce\("admin-status"\)[\s\S]*"admin_proof": admin_proof[\s\S]*"admin_nonce": admin_nonce[\s\S]*"issued_at_epoch_seconds": issued_at_epoch_seconds[\s\S]*fn admin_token_for_request[\s\S]*DISASMER_ADMIN_TOKEN[\s\S]*--admin-token/
);
expect(
  cliTests,
  "CLI test proves auth status envelope omits trusted actor body field",
  /assert!\(line\.contains\(r#""type":"authenticated""#\)\)[\s\S]*assert!\(line\.contains\(r#""session_secret":"disasmer-cli-session-secret""#\)\)[\s\S]*assert!\(!line\.contains\(r#""actor_user":"user-session""#\)\)/
);
expect(
  cliProject,
  "project commands use authenticated envelope for signed-in CLI sessions",
  /authenticated_or_local_trusted_request[\s\S]*"type": "create_project"[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "list_projects"[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "select_project"/
);
expect(
  cliNode,
  "node commands use authenticated envelope for signed-in CLI sessions",
  /node_enroll_report[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "create_node_enrollment_grant"[\s\S]*node_descriptors_report[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "list_node_descriptors"[\s\S]*node_revoke_report[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "revoke_node_credential"/
);
expect(
  cliProject,
  "project command reports use stored CLI session scope when a session secret exists",
  /fn session_or_effective_scope_value[\s\S]*session\.session_secret\.is_some\(\)[\s\S]*session_value\(session\)/
);
expect(
  cliTests,
  "CLI test proves project list envelope omits trusted actor body field",
  /project_list_uses_authenticated_envelope_with_stored_cli_session[\s\S]*assert!\(line\.contains\(r#""type":"authenticated""#\)\)[\s\S]*assert!\(line\.contains\(r#""session_secret":"project-list-session-secret""#\)\)[\s\S]*assert!\(!line\.contains\(r#""actor_user":"user-session""#\)\)/
);
expect(
  cliTests,
  "CLI test proves node command envelopes omit trusted actor body fields",
  /node_commands_use_authenticated_envelope_with_stored_cli_session[\s\S]*"create_node_enrollment_grant"[\s\S]*"list_node_descriptors"[\s\S]*"revoke_node_credential"[\s\S]*assert!\(!line\.contains\(r#""actor_user":"ignored-user""#\)\)[\s\S]*assert!\(!line\.contains\(r#""tenant":"ignored-tenant""#\)\)[\s\S]*assert!\(!line\.contains\(r#""project":"ignored-project""#\)\)/
);
expect(
  `${cliTests}\n${coordinatorServiceTests}`,
  "CLI and coordinator tests prove user control/artifact/debug requests use session-derived authenticated scope",
  /user_control_commands_use_authenticated_envelope_with_stored_cli_session[\s\S]*"list_task_events"[\s\S]*"start_process"[\s\S]*"cancel_process"[\s\S]*"restart_task"[\s\S]*"create_artifact_download_link"[\s\S]*"debug_attach"[\s\S]*assert!\(!line\.contains\("ignored-tenant"\)\)[\s\S]*authenticated_envelope_derives_user_scope_from_cli_session[\s\S]*AuthenticatedCoordinatorRequest::StartProcess[\s\S]*AuthenticatedCoordinatorRequest::ListTaskEvents[\s\S]*AuthenticatedCoordinatorRequest::CreateArtifactDownloadLink[\s\S]*AuthenticatedCoordinatorRequest::CancelProcess[\s\S]*AuthenticatedCoordinatorRequest::DebugAttach/
);
expect(
  cliTests,
  "CLI tests prove admin coordinator requests require a token but send only a scoped proof",
  /admin_status_and_suspend_use_public_coordinator_api[\s\S]*!line\.contains\(r#""admin_token""#[\s\S]*admin_request_proof[\s\S]*admin_commands_require_explicit_admin_token_for_coordinator_requests[\s\S]*--admin-token/
);
expect(
  cliTests,
  "CLI tests prove expired/revoked sessions ask for login and logout revokes server session",
  /auth_status_reports_expired_or_revoked_cli_session_as_login_required[\s\S]*machine_error"\]\["category"\][\s\S]*"authentication"[\s\S]*logout_revokes_stored_cli_session_on_coordinator_before_local_removal[\s\S]*"revoke_cli_session"/
);
expect(
  cliTests,
  "CLI test proves signed agent workflow requests are sent",
  /run_with_agent_public_key_sends_attributable_workflow_actor[\s\S]*"agent_signature"[\s\S]*"signature":"ed25519:/
);
expect(
  coordinatorServiceTests,
  "coordinator test proves signed agent workflow and fingerprint-only rejection",
  /service_runs_agent_workflows_with_scoped_key_attribution[\s\S]*fingerprint_only[\s\S]*signed request[\s\S]*wrong_fingerprint[\s\S]*nonce/
);
expect(
  coordinatorServiceTests,
  "coordinator test proves authenticated node operations derive scope from CLI session",
  /authenticated_envelope_derives_user_scope_from_cli_session[\s\S]*AuthenticatedCoordinatorRequest::ListNodeDescriptors[\s\S]*AuthenticatedCoordinatorRequest::RevokeNodeCredential[\s\S]*tenant-a[\s\S]*project-a[\s\S]*user-a/
);
expect(
  coordinatorServiceTests,
  "coordinator test proves admin operations fail closed without configured or valid proof",
  /service_reports_and_enforces_public_admin_tenant_suspension[\s\S]*new_with_admin_token[\s\S]*admin credential is not configured[\s\S]*admin request proof is invalid/
);
if (hostedService && hostedStartup && hostedOperatorAuth) {
  expect(
    `${hostedService}\n${hostedStartup}\n${hostedOperatorAuth}`,
    "hosted client path rejects operator operations while private Operator requests require replay-resistant proofs",
    /HOSTED_OPERATOR_TOKEN_ENV[\s\S]*HostedOperatorAuth[\s\S]*hosted operator operation requires an authenticated hosted_operator_request envelope[\s\S]*CoordinatorService::new_with_admin_token[\s\S]*replay_nonces[\s\S]*verify_request[\s\S]*hosted_operator_request_proof_from_token_digest/
  );
}
expect(
  coordinatorServiceTests,
  "coordinator test proves node heartbeat requires signed enrolled key and rejects replay",
  /service_requires_signed_node_heartbeat_from_enrolled_key[\s\S]*signed proof[\s\S]*wrong_signature[\s\S]*fresh-node-heartbeat[\s\S]*nonce/
);
expect(
  coordinatorServiceTests,
  "coordinator test proves raw node-originated requests require signed envelope",
  /service_rejects_raw_node_originated_requests_without_signed_envelope[\s\S]*ReportNodeCapabilities[\s\S]*signed_node envelope proof/
);
expect(
  nodeAttachSmoke,
  "node attach smoke signs direct public coordinator heartbeat",
  /DISASMER_NODE_PRIVATE_KEY[\s\S]*node_signature: signedNodeHeartbeat/
);
expect(
  selfHostedCoordinatorSmokeSource,
  "self-hosted coordinator smoke signs public node heartbeat",
  /public_key: identity\.publicKey[\s\S]*node_signature: signedNodeHeartbeat/
);
expect(
  selfHostedCoordinatorSmokeSource,
  "self-hosted coordinator smoke proves strict authenticated Client authority",
  /DISASMER_SELF_HOSTED_SESSION_SECRET[\s\S]*client_authority, "strict"[\s\S]*forgedBodyAuthority[\s\S]*wrongSession[\s\S]*connect-self-hosted[\s\S]*session-secret-stdin[\s\S]*used_cli_session_credential[\s\S]*authenticated\(\{[\s\S]*type: "schedule_task"/
);
expect(
  wasmtimeAssignmentSmoke,
  "real SDK and Wasmtime smoke runs through strict authenticated Client authority",
  /DISASMER_SELF_HOSTED_SESSION_SECRET[\s\S]*client_authority, "strict"[\s\S]*DISASMER_SDK_SESSION_SECRET[\s\S]*authenticated\(\{[\s\S]*type: "launch_task"[\s\S]*type: "join_task"/
);
if (publicDryrunServiceSmoke) {
  expect(
    publicDryrunServiceSmoke,
    "public release dryrun public coordinator heartbeat is signed",
    /identity = nodeIdentity\("public-release-service-smoke", node\)[\s\S]*public_key: identity\.publicKey[\s\S]*node_signature: signedNodeHeartbeat/
  );
}
if (hostedPolicy) {
  expect(
    hostedPolicy,
    "hosted identity broker mints a non-provider CLI session secret and records only its digest in the login summary",
    /generate_opaque_token\("cli_session"\)[\s\S]*cli_session_secret_digest: Digest::sha256\(&cli_session_secret\)[\s\S]*cli_session_secret/
  );
}
if (hostedService) {
  expect(
    hostedService,
    "hosted service delegates CLI session authority and project creation to the public coordinator",
    /identity_broker\.complete_trusted_oidc_browser_login[\s\S]*core_coordinator[\s\S]*issue_cli_session[\s\S]*CoordinatorRequest::Authenticated[\s\S]*CreateProject/
  );
}

for (const [gateName, script] of [
  ["public acceptance", publicAcceptance],
  ["private acceptance", privateAcceptance],
  ["CLI-first acceptance", cliFirstAcceptance],
  ["public split", publicSplit],
]) {
  assert(
    script.includes("node scripts/code-size-guard.js"),
    `${gateName} must run code-size-guard.js`
  );
}

expect(publicAcceptance, "public gate includes unit coverage", /cargo test --workspace/);
expect(publicAcceptance, "public gate includes binary build coverage", /cargo build --workspace --bins/);
expect(privateAcceptance, "private gate includes hosted unit coverage", /cargo test --manifest-path private\/hosted-policy\/Cargo\.toml/);
expect(publicSplit, "public split includes copied-tree unit coverage", /cargo test --workspace --manifest-path "\$tmp_dir\/Cargo\.toml"/);
expect(publicSplit, "public split includes copied-tree binary build coverage", /cargo build --workspace --bins --manifest-path "\$tmp_dir\/Cargo\.toml"/);

for (const [gateName, script] of [
  ["public acceptance", publicAcceptance],
  ["public split", publicSplit],
]) {
  for (const smoke of [
    "scripts/wasmtime-assignment-smoke.js",
    "scripts/node-attach-smoke.js",
    "scripts/cli-local-run-smoke.js",
    "scripts/vscode-f5-smoke.js",
    "scripts/dap-smoke.js",
    "scripts/artifact-download-smoke.js",
    "scripts/artifact-export-smoke.js",
    "scripts/public-local-demo-matrix-smoke.js",
  ]) {
    assert(script.includes(`node ${smoke}`), `${gateName} must run boundary smoke ${smoke}`);
  }
}

for (const smoke of [
  "private/hosted-policy/scripts/hosted-deployment-smoke.js",
  "private/hosted-policy/scripts/hosted-client-compat-smoke.js",
  "private/hosted-policy/scripts/postgres-durable-smoke.js",
]) {
  assert(
    privateAcceptance.includes(`node ${smoke}`),
    `private acceptance must run hosted boundary smoke ${smoke}`
  );
}
assert(
  privateAcceptance.includes("node scripts/self-hosted-coordinator-smoke.js"),
  "private acceptance must run standalone Core coordinator smoke"
);

for (const [name, source, patterns] of [
  [
    "real coordinator Wasm assignment",
    wasmtimeAssignmentSmoke,
    [/cp\.spawn/, /disasmer-coordinator/, /type: "create_node_enrollment_grant"/, /disasmer-node/],
  ],
  [
    "node attach",
    nodeAttachSmoke,
    [/cp\.spawn/, /"node"[\s\S]*"attach"/, /used_enrollment_exchange/, /signedNodeHeartbeat/],
  ],
  [
    "CLI local run",
    cliLocalRunSmoke,
    [/cp\.spawn/, /disasmer[\s\S]*run/, /cli_process_started_node_process[\s\S]*true/],
  ],
  [
    "VS Code F5",
    vscodeF5Smoke,
    [
      /runtimeBackend[\s\S]*local-services/,
      /buildMainLine[\s\S]*setBreakpoints[\s\S]*verified, true/,
      /allThreadsStopped, true/,
      /coordinator_task_events[\s\S]*value === 0/,
      /Source Locals/,
      /Task Args and Handles/,
      /unavailable-local-diagnostic/,
      /command_status[\s\S]*frozen through local services at executing Wasm probe/,
      /state[\s\S]*Frozen/,
      /command_spec/,
      /stdout_tail/,
      /stderr_tail/,
    ],
  ],
  [
    "DAP",
    dapSmoke,
    [
      /runtimeBackend: "local-services"/,
      /buildMainLine[\s\S]*setBreakpoints[\s\S]*verified, true/,
      /allThreadsStopped, true[\s\S]*confirmed by every active participant/,
      /threads[\s\S]*build virtual process/,
      /build_main::wasm/,
      /Source Locals/,
      /Wasm Frame Locals/,
      /unavailable-local-diagnostic/,
      /runtime-boundary-diagnostic/,
      /command_status[\s\S]*frozen through local services at executing Wasm probe/,
      /taskTrapLine[\s\S]*childThread[\s\S]*arg_0[\s\S]*task_handle_/,
      /source stepping is not yet available/,
      /checkpoint boundary|still active/,
    ],
  ],
  [
    "artifact download",
    artifactDownloadSmoke,
    [/create_artifact_download_link/, /open_artifact_download_stream/, /crossTenantOpen/],
  ],
  [
    "artifact export",
    artifactExportSmoke,
    [/export_artifact_to_node/, /node-export-receiver/, /coordinator_bulk_relay_allowed[\s\S]*false/],
  ],
  [
    "standalone Core coordinator",
    selfHostedCoordinatorSmoke,
    [/disasmer-coordinator/, /standalone-core-coordinator/, /core-coordinator-compat\.json/],
  ],
  [
    "public local demo matrix",
    publicLocalDemoMatrix,
    [/scripts\/cli-install-smoke\.js/, /scripts\/node-attach-smoke\.js/, /scripts\/vscode-f5-smoke\.js/],
  ],
]) {
  for (const pattern of patterns) {
    expect(source, name, pattern);
  }
}

if (hostedClientCompatSmoke) {
  for (const pattern of [
    /disasmer-hosted-service/,
    /completeHostedBrowserLogin/,
    /DISASMER_BROWSER_OPEN_COMMAND/,
    /"disasmer-cli"[\s\S]*"node"[\s\S]*"attach"/,
    /node_enrollment_exchanged/,
    /DISASMER_HOSTED_CLI_SESSION_TTL_SECONDS/,
    /expired; run disasmer login --browser again/,
    /crossTenantTaskEventsDenied[\s\S]*list_task_events[\s\S]*vp-victim/,
    /hosted-client-compat\.json/,
  ]) {
    expect(hostedClientCompatSmoke, "hosted Client compatibility", pattern);
  }
}

for (const pattern of [
  /DISASMER_PUBLIC_RELEASE_DRYRUN_E2E/,
  /downloadReleaseAssets/,
  /verifyChecksums/,
  /git"[\s\S]*"clone"/,
  /defaultLoginPlan\.coordinator/,
  /DISASMER_PUBLIC_RELEASE_DRYRUN_BROWSER_OPEN_COMMAND/,
  /DISASMER_BROWSER_OPEN_COMMAND: browserOpenCommand/,
  /node_enrollment_exchanged/,
  /disasmerNode/,
  /launch_task/,
  /worker_assignment_poll_verified/,
  /validateStandaloneCoreCoordinator/,
  /core_coordinator_validated/,
  /standalone-core-coordinator/,
  /DISASMER_SELF_HOSTED_SESSION_SECRET/,
  /client_authority, "strict"/,
  /forged_body_authority_denied/,
  /wrong_session_denied/,
  /preTaskMainLine/,
  /compileLinuxLine/,
  /task_recorded/,
  /list_task_events/,
  /create_artifact_download_link/,
  /vscode-f5-smoke\.js/,
  /downloaded_release_assets: true/,
  /vscode_debugger_verified: true/,
  /artifact_download_or_export_verified: true/,
  /public-release-dryrun-e2e\.json/,
]) {
  expect(publicDryrunE2e, "public release e2e evidence", pattern);
}

for (const pattern of [
  /public-release-dryrun-forgejo-release\.json/,
  /deployment-manifest\.json/,
  /public-release-dryrun-service\.json/,
  /hosted-client-compat\.json/,
  /core-coordinator-compat\.json/,
  /public-release-dryrun-e2e\.json/,
  /coordinator_validation/,
  /core_coordinator_client_authority/,
  /core_coordinator_forged_body_authority_denied/,
  /downloaded_release_assets/,
  /vscode_debugger_verified/,
  /artifact_download_or_export_verified/,
  /public-release-dryrun-final\.json/,
]) {
  expect(finalDryrunEvidence, "public release final evidence", pattern);
}

console.log("Acceptance evidence contract smoke passed");