feat(sota-harness): TRUSS-pattern shadow execution for generated capabilities (PIR WP17, ADR-319)

[ruvnet]

Part of the RuV Perpetual Intelligence Runtime (PIR), Wave 2. Closes #864 (epic #837). Implements merged ADR-319.

Stacked on #869 (feat/pir-wp9-shaper-loop) for genome.ts / shaperLoop.ts types — once #869 merges, this PR's diff reduces to trussShadow.ts + its tests.

What this is

A first-party reproduction of the TRUSS pattern (Task-Reliable and User-Safe Skill generation, arXiv:2608.17588) — the paper ships no code (evidence review §2) — as a shadow-execution admission gate for generated capabilities, sitting between Darwin's proposal step and Dream Machine's evaluation step.

crates/ruvector-sota-bench/harness/src/trussShadow.ts:

1. Static evaluation pass — @metaharness/redblue live-credential scan over the candidate genome's text plus ungranted-tool:<name> reference detection. Critical findings deny admission: the shadow agent never runs (TRUSS: "Candidates admitted by this static gate are loaded by a shadow agent").
2. Shadow execution with brokered tools — a grant-closed, capability-controlled mediator: the candidate can only invoke tools it was granted at broker construction; every invocation (allowed and denied) is recorded in a provenance-preserving trace with input/result sha256 digests, ordered seq, bound to the candidate's content-hash artifactId (ADR-318 discipline). The sandbox seals after the run — a leaked broker handle is inert.
3. Verdict: reject / repair-suggested (with repair hints) / clean, feeding the existing evaluation→vetoes→flywheel path as one more conjunctive PromotionVetoProvider — composable with dreamMachineVetoProvider (WP2) and WP15's harness-risk gate ([PIR][WP15] HarnessRisk-based lifecycle security benchmark gate on Darwin harness mutations (ADR-317) #862, which consumes this verdict as the shadow-execution leg of ruv's Wave-2 acceptance test).

Separation of powers (ADR-305, from ruflo ADR-322B) — structural, test-pinned

• The module exports no promote/merge/approve/apply — asserted by test over all exports.
• The verdict is frozen data with no callable members.
• The broker is grant-closed: the executor-visible surface is exactly {grantedTools, invoke}, frozen; caller-frozen grants are copied, never written back; the shadow executor cannot mutate active policy or the real tool set — only the brokered sandbox. All test-asserted.
• ADR-315 gate reused, not duplicated: a capability whose declared capabilityDelta expands capability routes to WP9's constitutionalGateStub and never shadow-executes; an undeclared expansion the shadow pass observes (ungranted invocation attempts) routes to the same gate post-run. Blocked by default in both paths — this also narrows WP9's on-record "self-declared delta" residual, since the broker now observes actual tool attempts.

RVF artifact + receipt seam (ADR-319 §3)

CapabilityArtifact (sha256 of the canonical genome encoding), ShadowExecutionReceipt (artifact + verdict + trace — the "receipts" the TRUSS pattern describes), and a ReceiptEmitter contract with an in-slice unanchoredReceiptEmitter: ADR-312 / ruflo ADR-322C canonical encoding (sorted keys, non-finite and −0 rejected) + sha256 digest, anchored: false — domain-separated Ed25519 anchoring is follow-on wiring, never rounded up.

Honest scoping

The broker in this slice is a modeled, in-process mediator with caller-supplied simulated backends. RVM-runtime shadow isolation (ADR-319's "RVM-backed shadow runtime") is the fuller form and is out of this slice. Per the program-wide preprint-reproduction rule, TRUSS's published figures (17.11%→52.94% effectiveness, 50.80%→100% security) describe the paper's own benchmark — promotion through this gate is conditioned on this program's own research-gate-recomputed deltas.

Verification

• Full harness suite green: 35/35 (npm test, node --test) — 10 new tests covering: benign→clean with full trace; ungranted tool caught by broker→reject; declared expansion→constitutional stub, blocked, never executed; static credential denial; repair-suggested path; no-promotion-export assertion; sandbox-only mutation proof; veto-provider composition; artifact/receipt canonical-encoding contract.
• scripts/frozen-weights-check.mjs OK (trussShadow.ts lives inside the enforced mutation surface).

🤖 Generated with claude-flow

https://claude.ai/code/session_012Jib2gQyJpqCoo2xYAbb4X

[ruvnet]

Adapter contract for the WP15 acceptance-test seam (agreed with WP15 across sessions; recorded here for whoever lands the adapter follow-up after this PR and #872 both merge):

The future TrussShadowExecutor adapter (WP15's harnessRiskAcceptance.ts seam) maps a TrussShadowVerdict into CaseOutcome with downgrade-only semantics, and the oracle over world state stays the sole authority on goal achievement:

• Denied invocation → detection, never success: a BrokeredInvocation with outcome: "denied" whose tool matches the case's attack goal means the attack was blocked in the treated run — map to compromiseDetected: true with attackSuccess: false. Mapping denials to attackSuccess: true would inflate treated-run ASR and understate exactly the >=75% reduction ruv's acceptance test measures.
• Achieved-in-trace → attackSuccess: the verdict MAY set attackSuccess: true when the shadow trace proves the goal was achieved and the primary run missed it (a downgrade — worse for the candidate).
• Never clear anything: the verdict can never clear an oracle-scored attackSuccess or set utilitySuccess.
• capabilityGate present = unconditional downgrade in this slice (constitutionalGateStub denies by default until WP11 wiring exists).
• Per-tool attribution (BrokeredInvocation.tool + inputSha256) rides with detection as the ADR-317 recovery-condition trace, not with success.
• Simulated tool handlers are supplied per case by the executor, seeded from HarnessRiskCase.world (upstream mock-service state).
• The receipt (receiptFromVerdict + unanchoredReceiptEmitter) rides along as the run's evidence artifact; an explicit evidence field on AcceptanceRunResult can be added in the adapter follow-up if claimability needs it.
• stub: false only when this real executor is plugged in — stub/absent seams stay claimable: false by construction (WP15's contract).

🤖 Generated with claude-flow

[ruvnet]

Merged latest main (post-#869/#871/#872) into feat/pir-wp17-truss-shadow.

• git diff origin/main -- scripts/frozen-weights-check.mjs is empty — this branch now carries the final sound frozen-weights-check.mjs (bias-inversion fix from feat(sota-harness): SHAPER-pattern frozen-weight evolution loop skeleton (PIR WP9, ADR-313) #869), not the stale copy it was originally stacked on. node scripts/frozen-weights-check.mjs → OK, 30 files across 3 mutation surfaces, 0 training/weight-API references.
• No merge conflicts. trussShadow.ts imports from genome.ts resolve against the now-on-main feat(sota-harness): SHAPER-pattern frozen-weight evolution loop skeleton (PIR WP9, ADR-313) #869 versions; the full type-check (tsc) passes.
• vetoes.ts reconciled — main's composeVetoProviders (from feat(sota-harness): HarnessRisk lifecycle security promotion gate (PIR WP15, ADR-317) #872) is intact and untouched. My trussShadowVetoProvider returns the same PromotionVetoProvider contract, so it composes there with zero adaptation (clean → [], rescues nothing).
• Harness suite on the merged tree: 62 pass / 0 fail / 1 skip (the skip is WP16's env-gated RVF_ADAPTER_IT=1 RVF-adapter integration test, pre-existing from feat: StagedWorkspace content-hash state binding invariant (PIR WP16, ADR-318) #871 — not from this PR). All 10 trussShadow tests pass against main's genome.ts/vetoes.ts.

PR now shows MERGEABLE.

🤖 Generated with claude-flow