wip v28

Author: geraldarthurdavis

.gitignore

@@ -65,6 +65,10 @@ uapi/stories/**/*.js
 admin/tailwind.config.js
 packages/**/tests/**/*.js
 packages/**/test/**/*.js
+# @bitcode/protocol is a runtime JavaScript package, not TypeScript build
+# output. These sources must ship in git clones for Vercel builds.
+!packages/protocol/src/**/*.js
+!packages/protocol/test/**/*.js
 !protocol-demonstration/test/v26-public-copy.test.js
 packages/**/examples/**/*.js
 packages/**/run/**/*.js

BITCODE_SPEC_V28_NOTES.md

@@ -136,9 +136,9 @@ The standalone `protocol-demonstration` runtime must not import UAPI or commerci
 V28 closes this as a boundary baseline; V29 must continue commercializing freshly ported protocol internals into cleaner packages and narrower APIs.
 Dual-lane setup smoke also found that the embedded demonstration witness could overwrite the commercial Terminal browser title with `Bitcode Demonstration`.
 That is a commercial/demonstration boundary leak, so V28 now requires the mounted witness bundle to guard document-title writes when hosted inside `/terminal`; standalone demonstration may keep its demonstration title.
-The same deployment-readiness pass found a Vercel production build failure in `lib/bitcode-app-context.ts` because the newly formalized `@bitcode/protocol` package was present as a workspace dependency but had not been added to the Next transpilation/webpack alias path.
-V28 treats this as a commercial MVP blocker: formal protocol package imports must resolve during local and Vercel `next build`.
-The UAPI Next configuration now transpiles `@bitcode/protocol`, aliases its root import to `packages/protocol/src/index.js`, and the commercial protocol boundary test asserts this resolver so the standalone demonstration separation remains deployable.
+The same deployment-readiness pass found a Vercel production build failure in `lib/bitcode-app-context.ts` because the newly formalized `@bitcode/protocol` package exported runtime JS from `packages/protocol/src/**`, while those files were still ignored by the generic "package TS build output" rule.
+V28 treats this as a commercial MVP blocker: formal protocol package imports must resolve from a clean git clone during local and Vercel `next build`.
+The repository now explicitly unignores the `@bitcode/protocol` runtime JS source and package-boundary tests, the commercial protocol boundary test asserts required protocol runtime files are present and not ignored, and clean-repro builds pass after those runtime files are present in the clone.
 
 Manual QA was re-ordered on May 8, 2026 into two directionalities.
 The first is natural operator progression: connect wallet/GitHub/identity prerequisites, perform the fastest simple Need through Fit/settlement/delivery readback, then perform the fastest simple Give through measurement/earning/settlement readback.

BITCODE_V28_QA.md

@@ -171,7 +171,7 @@ Implemented after Pass 2, pending next manual QA confirmation:
 | Testnet-readiness | `http://127.0.0.1:3001/terminal` | renders HTTP 200 after cold compile | Server runs with public mock flags disabled and `NEXT_PUBLIC_BITCODE_ENV=testnet`; missing live credentials/providers are expected to appear as blocked readiness, not success. |
 | Both | `/terminal` browser title | pass | Follow-up smoke confirms both lanes keep the commercial `Bitcode Terminal` document title after the embedded witness title guard. |
 | Both | 2026-05-08 dev-server restart for Pass 3A | pass | Mock server restarted on `3000`; testnet-readiness server restarted on `3001`; curl and Playwright smoke confirm `/terminal` HTTP 200, `Bitcode Terminal` title, no page errors, and no non-HMR internal 404s after reload. |
-| Vercel deployment build | pass after fix | Latest deployment failed because `lib/bitcode-app-context.ts` imported `@bitcode/protocol` before Next's workspace-package resolver knew how to transpile/alias the new formal protocol package. V28 now adds `@bitcode/protocol` to `transpilePackages`, aliases the root import to `packages/protocol/src/index.js`, and verifies the resolver in `tests/protocolCommercialBoundary.test.ts`. Local `pnpm run build` from `uapi` now passes. |
+| Vercel deployment build | pass after fix | Latest deployment failed because the formal `@bitcode/protocol` package exported `packages/protocol/src/index.js`, but the runtime JS source files under `packages/protocol/src/**` were still ignored as generic TS build output and therefore absent from clean Vercel clones. V28 now unignores the protocol package runtime JS and package-boundary tests, verifies required runtime files are present and not ignored, and clean-repro builds pass after those files are present. |
 | Mock top chrome during 1A | pass | Manual reconfirmation on 2026-05-08 accepted the fixed mock balance, notification, and profile posture. V28 now treats master mock mode as sufficient for auxillaries mock data in client and server code, explicitly exposes public mock flags through Next config, and revalidates stale module-level user data on new mount so lane transitions cannot keep anonymous/zero cached data. |
 | Dual-lane dev artifact isolation | pass | Manual reconfirmation on 2026-05-08 accepted the mock/testnet-readiness separation. V28 QA servers use lane-specific `NEXT_DIST_DIR` values so public mock env compilation is isolated per lane. |
 | Mock Terminal data classification | pass | Manual QA clarified that the currently visible Terminal data is mock data because the operator is in the mock lane. This evidence remains mock-lane evidence only, not testnet-readiness evidence. |
@@ -216,9 +216,9 @@ Automated verification after this implementation pass:
 - `npm --prefix protocol-demonstration run test:v28-commercial-mvp-qa`: 8 passed after adding the boundary-separation checks.
 - `pnpm -C uapi exec jest --runInBand tests/demonstrationWitnessMount.test.tsx tests/demonstrationWitnessScopedStylesRoute.test.ts tests/terminalPreservedShellSurface.test.tsx tests/terminalShellBridge.test.tsx tests/marketingLandingPage.test.tsx tests/api/needReviewProtocolParity.test.ts tests/api/bitcodeAppContextOptions.test.ts tests/protocolCommercialBoundary.test.ts`: 18 passed after the formal protocol package split.
 - `node --test --test-force-exit protocol-demonstration/test/v28-boundary-separation.test.js`: 2 passed after the formal package split.
-- `pnpm -C packages/protocol test`: 1 passed after the formal package split.
+- `pnpm -C packages/protocol test`: 2 passed after the formal package split and protocol runtime-source deployment fix.
 - `pnpm -C packages/protocol run typecheck`: pass after adding the formal package typecheck config.
-- `pnpm -C uapi exec jest --runInBand tests/protocolCommercialBoundary.test.ts`: 3 passed after the formal package split.
+- `pnpm -C uapi exec jest --runInBand tests/protocolCommercialBoundary.test.ts`: 5 passed after adding the formal protocol deployment-source boundary check.
 - `pnpm -C uapi exec jest --runInBand tests/useUserDataHydration.test.tsx tests/featureFlagsMockMode.test.ts tests/protocolCommercialBoundary.test.ts`: 11 passed after the mock top-chrome cache/flag fix, JavaScript companion parity check, and protocol package resolver check.
 - Playwright dual-lane browser verification after lane-specific `NEXT_DIST_DIR` restart: mock lane shows `0.042 BTC`, `1,200 BTD`, mock review state, reviewer profile, and populated notifications; testnet-readiness lane shows no mock balances, no mock review state, and the Connect Wallet prerequisite controls; both lanes have no product console/page errors.
 

packages/protocol/src/attestation-model.js

@@ -0,0 +1,29 @@
+import { sha256, nowIso } from './bitcode-core.js';
+
+export function buildAttestationSnapshot() {
+  const gitCommit = 'demo-cff6dc9';
+  const imageDigest = `sha256:${sha256('bitcode-demo-image')}`;
+  const policyDigest = `sha256:${sha256('bitcode-policy-release-v1')}`;
+  const verifierDigest = `sha256:${sha256('bitcode-demo-verifier')}`;
+
+  return {
+    deploymentId: `deploy_${sha256(`${gitCommit}:${imageDigest}`).slice(0, 10)}`,
+    builtAt: nowIso(),
+    gitCommit,
+    imageDigest,
+    verifierDigest,
+    policyDigest,
+    provenance: {
+      buildSystem: 'github-actions (modeled)',
+      predicateType: 'https://slsa.dev/provenance/v1',
+      sourceRepo: 'workspace/bitcode',
+      builderIdentity: 'github-actions/demo-workflow',
+      attestationStatus: 'modeled-demo'
+    },
+    runtimeClaims: [
+      'Receipts reference the current deployment id.',
+      'Measurement logic is deterministic within this prototype shell.',
+      'Private bundle content is disclosed only on licensed issuance responses.'
+    ]
+  };
+}

packages/protocol/src/benchmark-model.js

@@ -0,0 +1,48 @@
+import { clampBp } from './bitcode-core.js';
+import { telemetrySpan } from './telemetry.js';
+
+/**
+ * @param {any} input
+ * @returns {any}
+ */
+export function buildBenchmarkComparison({ bundleId, benchmark, baselineBp, treatmentBp }) {
+  return telemetrySpan('bitcode.buildBenchmarkComparison', {
+    bundleId,
+    benchmark,
+    baselineBp,
+    treatmentBp
+  }, () => {
+    const upliftBp = clampBp(Number(treatmentBp) - Number(baselineBp));
+    const improved = upliftBp > 0;
+
+    return {
+      bundleId,
+      benchmark,
+      task: 'Recover a production monorepo auth migration with issuer mismatch while preserving session validity and rollback safety.',
+      baselineBp: clampBp(baselineBp),
+      treatmentBp: clampBp(treatmentBp),
+      upliftBp,
+      baselineOutcome: improved
+        ? 'Without the licensed bundle, the remediation system proposes a generic rollback that misses issuer compatibility sequencing and audit guardrails.'
+        : 'Without the licensed bundle, the remediation system performs roughly the same as treatment.' ,
+      treatmentOutcome: improved
+        ? 'With the licensed bundle, the remediation system restores verifier configuration in the right order, preserves session invariants, and emits the expected audit steps.'
+        : 'With the licensed bundle, the remediation system does not materially outperform baseline in this run.',
+      whyItHelped: improved
+        ? 'The licensed bundle supplied specific rollback sequencing, issuer-mismatch diagnosis, and proof-backed validator patch guidance that the baseline system lacked.'
+        : 'The licensed bundle did not add enough task-specific knowledge to create measurable lift in this run.',
+      businessImpact: improved
+        ? 'Higher confidence incident recovery, faster safe rollback, and lower risk of releasing an auth fix that breaks live sessions.'
+        : 'No measurable buyer impact established in this run.',
+      interpretation: improved
+        ? 'Licensed bundle improved the reader system\'s remediation performance on the target task.'
+        : 'No measurable lift detected in this run.',
+      checks: [
+        'same task family',
+        'baseline without licensed bundle',
+        'treatment with licensed bundle',
+        'scored in basis points for simple comparability'
+      ]
+    };
+  });
+}