fix(nodekit): align ActiveGraph native identity replay

[HomenShum]

What changed

• align the Python replay evaluator and JSON Schema with the JavaScript boundary for native session identity and stage-local graph lifecycle events
• validate identity snapshots, graph scope, edge bindings, node lifecycle, identity drift, and incomplete/open graph state fail-closed
• add production-shaped identity, lifecycle, and stale-identity scenarios
• publish a sanitized 20-export production corpus receipt and close the ActiveGraph adoption experiment with an honest reject verdict

Root cause

The production exporter and JavaScript wrapper already supported session.nativeIdentity and graph lifecycle events, but the Python evaluator and JSON Schema still enforced the older export shape. Unit coverage had therefore tested asymmetric boundaries. The first owner-authorized production export exposed the mismatch.

Result

All 20 owner-authorized exports validated and retained persistence/reload parity after the fix. ActiveGraph was 14,003.6x slower than canonical validation at the median and added no material explanatory value, triggering both predefined stop conditions. It remains an optional offline diagnostic canary and is not production authority.

The committed receipt excludes owner identifiers, run identifiers, exported events, databases, and private evidence directories.

Validation

• npx vitest run scripts/__tests__/collectActiveGraphCorpus.test.ts scripts/__tests__/nodekitActiveGraphCorpus.test.ts scripts/__tests__/nodekitActiveGraphCanary.test.ts — 23 passed
• pinned ActiveGraph venv: python -m pytest evals/activegraph/tests -q — 50 passed
• receipt JSON parsed and asserted for reject, 20 exports, and ownerDataIncluded: false
• sensitive-field scan found no run IDs, owner IDs, export hashes, chain heads, secrets, or evidence-directory paths in the committed receipt
• git diff --check passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodebench-ai	Ready	Preview	Jul 30, 2026 4:29am

[github-actions]

PR size advisory

This PR adds 764 lines of substantive change. CONTRIBUTING.md defines a soft limit of ~400 LOC.

If the PR is genuinely cohesive (e.g. an architecture map, a generated migration, a deletion of a dead module), no action is needed. Otherwise consider:

• splitting into 2-3 PRs along independent concerns
• pre-discussing the architecture change in a GitHub Discussion before merge

This is advisory — it does not block the merge.