draft: fixed-trace evidence integrity hardening

package.json

@@ -29,7 +29,8 @@
     "deploy:cdn-artifacts-cutover": "wrangler deploy --config workers/artifact-cdn/wrangler.cutover.toml",
     "deploy:cdn-artifacts-cutover:dry-run": "wrangler deploy --config workers/artifact-cdn/wrangler.cutover.toml --dry-run",
     "verify:cdn-artifacts-cutover": "node scripts/verify-cdn-artifacts-cutover.mjs",
-    "typecheck": "tsc --project server/tsconfig.json --noEmit",
+    "typecheck": "tsc --project server/tsconfig.json --noEmit && npm run typecheck:fixed-trace-rollout-tests",
+    "typecheck:fixed-trace-rollout-tests": "node scripts/typecheck-fixed-trace-rollout-tests.mjs",
     "test:schemas": "node tests/schema-validation.test.cjs && node --test tests/outcome-target.test.cjs tests/trusted-match-offer-creative-data.test.cjs tests/accessibility-violation-details.test.cjs tests/portfolio-routing-scope.test.cjs tests/catalog-item-availability-updates.test.cjs tests/compact-product-lifecycle-storyboards.test.cjs tests/timezone-resolution-storyboards.test.cjs tests/dooh-allocation.test.cjs tests/identity-absence-coherence.test.cjs tests/schema-deprecation-metadata.test.cjs tests/products-only-brief-compatibility.test.cjs tests/async-identity-convergence.test.cjs tests/creative-rotation.test.cjs tests/canonical-forecast-point-parity.test.cjs tests/creative-revisions.test.cjs tests/creative-delivery-contracts.test.cjs tests/tracker-execution-contracts.test.cjs tests/tracker-execution-package-integration.test.cjs tests/metric-identity-coherence.test.cjs tests/sort-contract-delivery-reporting.test.cjs tests/time-based-views-contract.test.cjs tests/metric-qualifier-parity.test.cjs tests/requested-metrics-contract.test.cjs tests/auto-breakdown-negotiation-contract.test.cjs tests/format-delivery-reporting-contract.test.cjs tests/inventory-delivery-reporting-contract.test.cjs tests/lint-schema-enum-drift.test.cjs tests/synthetic-depiction.test.cjs tests/creative-rendering-authority.test.cjs tests/buyer-reason.test.cjs tests/reporting-status-contract.test.cjs tests/reporting-reconciliation-fixture.test.cjs tests/reporting-core-fixture.test.cjs tests/reporting-native-version-ref-bounds.test.cjs && npm run test:premium-display-formats && npm run test:geo-region-targeting",
     "test:performance-feedback": "node --test --test-force-exit --test-timeout=30000 tests/performance-feedback-contract.test.cjs",
     "test:dist-schema-version-ids": "node --test --test-force-exit --test-timeout=30000 tests/dist-schema-version-ids.test.cjs",

scripts/typecheck-fixed-trace-rollout-tests.mjs

@@ -0,0 +1,76 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+// These SDK-version diagnostics are pre-existing in production-only billing
+// files reached transitively by the legacy rollout module. Keep the exception
+// exact so any fixture or other dependency diagnostic fails this test-aware
+// check rather than being hidden by a broad path allowlist.
+export const knownBaseline = new Set([
+  "server/src/billing/lazy-reconcile.ts(183,5): error TS2352:",
+  "server/src/billing/stripe-client.ts(812,35): error TS2339:",
+  "server/src/billing/stripe-client.ts(856,33): error TS2339:",
+  "server/src/billing/stripe-client.ts(856,70): error TS2339:",
+  "server/src/billing/stripe-client.ts(857,33): error TS2339:",
+  "server/src/billing/stripe-client.ts(869,27): error TS2339:",
+  "server/src/billing/stripe-client.ts(873,37): error TS2339:",
+  "server/src/billing/stripe-client.ts(873,67): error TS2339:",
+  "server/src/billing/stripe-client.ts(878,48): error TS2339:",
+  "server/src/billing/stripe-client.ts(879,21): error TS2339:",
+  "server/src/billing/stripe-client.ts(880,21): error TS2339:",
+  "server/src/billing/stripe-client.ts(881,50): error TS2339:",
+  "server/src/billing/stripe-client.ts(882,21): error TS2339:",
+  "server/src/billing/stripe-client.ts(883,21): error TS2339:",
+  "server/src/billing/stripe-client.ts(1872,22): error TS2339:",
+  "server/src/billing/stripe-client.ts(1873,35): error TS2339:",
+  "server/src/billing/stripe-client.ts(1978,30): error TS2339:",
+]);
+
+function findUnexpectedDiagnostics(output) {
+  const seenBaseline = new Set();
+  return output.split("\n").filter((line) => line.includes(": error TS")).filter((line) => {
+    const baseline = [...knownBaseline].find((prefix) => line.startsWith(prefix));
+    if (!baseline || seenBaseline.has(baseline)) return true;
+    seenBaseline.add(baseline);
+    return false;
+  });
+}
+
+function unexpectedDiagnosticMessage(unexpected) {
+  return `fixed-trace rollout test-aware typecheck found ${unexpected.length} unexpected diagnostic(s)`;
+}
+
+export function assertNoUnexpectedDiagnostics(output) {
+  const unexpected = findUnexpectedDiagnostics(output);
+  if (unexpected.length > 0) throw new Error(unexpectedDiagnosticMessage(unexpected));
+}
+
+function main() {
+  const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  const requiredTypecheck = "tsc --project server/tsconfig.json --noEmit && npm run typecheck:fixed-trace-rollout-tests";
+
+  // This compiler pass protects a test-only contract, so it must be reached by
+  // the normal required typecheck path. Keep this exact assertion beside the
+  // gate: removing or reordering the wiring makes even a direct invocation fail.
+  if (packageJson?.scripts?.typecheck !== requiredTypecheck) {
+    process.stderr.write("fixed-trace rollout test-aware typecheck is not wired into the required typecheck script\n");
+    process.exit(1);
+  }
+
+  const result = spawnSync(
+    process.platform === "win32" ? "npx.cmd" : "npx",
+    ["tsc", "--project", "server/tsconfig.fixed-trace-rollout-tests.json", "--noEmit", "--pretty", "false"],
+    { cwd: process.cwd(), encoding: "utf8" },
+  );
+  const output = `${result.stdout}${result.stderr}`;
+  try {
+    assertNoUnexpectedDiagnostics(output);
+  } catch (error) {
+    process.stderr.write(`${output}\n`);
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+  }
+
+  process.stdout.write("fixed-trace rollout test-aware typecheck passed (no rollout fixture diagnostics)\n");
+}
+
+if (process.argv[1] === new URL(import.meta.url).pathname) main();

server/src/addie/eval/fixed-trace-a-prerequisite-manifest.ts

@@ -0,0 +1,14 @@
+/**
+ * A dependency-free serialized mirror of A's prerequisite declarations.
+ *
+ * This module exports data only. B accepts only a bounded, byte-for-byte
+ * canonical primitive source; it never parses caller-provided JSON. A's
+ * executable protocol independently derives and validates every leaf.
+ */
+export const FIXED_TRACE_A_PREREQUISITE_MANIFEST_MAX_BYTES = 16 * 1024;
+
+export const FIXED_TRACE_A_PREREQUISITE_MANIFEST_CANONICAL_JSON = `{"version":"addie-fixed-trace-A-prerequisite-manifest-v3","protocolVersion":"addie-fixed-trace-evaluation-protocol-v3","corpus":{"suiteVersion":"addie-fixed-traces-v32","suiteSha256":"5f7f0a6d653a4757991728a1d9de8aee69b40d580dafb65e98941c1f9e3fea83"},"partitionManifestSha256":"99a0727723fd84bcc4c7f40852a0e2392b578964bb4e7b0954739946451e4b96","experimentalDesignFingerprint":"d4f54eae99a90426ba43c5a4a26a7196102bc524537cdec56d32f0df8d9fb153","measurement":{"version":"addie-fixed-trace-measurement-manifest-v1","sha256":"c465bc7b5b69f3bf6e8151a5b4ff57d10d630d3f8ddc64c1cce4d504ad80fb5a"},"authorityDigests":{"finalPrerequisitesSha256":"fa4755eb1357c6a52bfe59f71b95700dd33d1cce66cee414847c8d14d29a8623"},"finalPrerequisites":{"randomization":{"scheduleDigest":null,"episodeClusterManifestDigest":null},"pricingWindow":{"id":null,"effectiveFrom":null,"effectiveBefore":null,"digest":null},"calibration":{"status":"unavailable","allowedRelationshipToScoredDevelopment":"separate_or_cross_fitted_only","digest":null},"custody":{"status":"unavailable","custodianIdentity":null,"packDigest":null,"signature":null,"collisionAuditDigest":null},"providerExposure":{"status":"unavailable","digest":null}}}` as const;
+
+/** The only value B consumes; tests may replace this import to prove refusal. */
+export const FIXED_TRACE_A_PREREQUISITE_MANIFEST_JSON =
+  FIXED_TRACE_A_PREREQUISITE_MANIFEST_CANONICAL_JSON;