wip(rm-02): round-4 remediation held at RM-60 boundary

2026-08-01 14:39:36 -05:00
parent fbb6191298
commit 9b7005d59b
23 changed files with 851 additions and 1442 deletions
@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+import { assertCurrentTreeObservation } from './gate-verify.mjs';
+
+const prohibitedReports = [
+  'HISTORY PROVENANCE VERIFIED local-ref',
+  'COMMIT ANCESTRY VERIFIED origin/main',
+  'PROVIDER LINEAGE SUCCESS pipeline-7',
+];
+const accepted = prohibitedReports.filter((report) => {
+  try {
+    assertCurrentTreeObservation(report);
+    return true;
+  } catch {
+    return false;
+  }
+});
+
+const verifier = await readFile(path.join(process.cwd(), 'scripts', 'gate-verify.mjs'), 'utf8');
+const outputWrites = [...verifier.matchAll(/process\.stdout\.write\s*\(/g)].length;
+const productionRendererWired =
+  outputWrites === 2 &&
+  /for \(const observation of observations\) \{\s*assertCurrentTreeObservation\(observation\);\s*process\.stdout\.write/s.test(
+    verifier,
+  ) &&
+  !/\bconsole\.(?:log|info|debug)\s*\(/.test(verifier);
+
+if (accepted.length > 0 || !productionRendererWired) {
+  process.stderr.write(
+    `HISTORY_PROVENANCE_FORBIDDEN: closed current-tree observation renderer rejected=${prohibitedReports.length - accepted.length}/${prohibitedReports.length} production-wired=${productionRendererWired}\n`,
+  );
+  process.exit(79);
+}
+process.stdout.write('history provenance reporting capability is absent; owner RM-60\n');