M1-05: Add tokenOut mismatch STOP fixture

Fallback owner: Qy

协作与发布：
Implementation may begin immediately.
Merge order is controlled by Qy through the Merge Gate.
If a prerequisite has not merged, keep the PR as Draft or rebase
before final review.

范围：

新增完整且合法的 STOP Fixture。
模拟可成功，但 Intent 的 tokenOut 与模拟 Outcome tokenOut 不一致。
最终状态必须为 STOP。

验收：

Fixture 能通过 M1-02 Schema。
tokenOut Alignment 为 FAIL。
Decision Engine 输出 STOP 且包含可检查原因。
测试证明“模拟成功”不会覆盖 Intent mismatch。
Fixture 明确标注为开发数据。

docs: accept PreflightReport v0.1 schema contract (#13)

Planning sync (2026-07-29): this Issue is moved to Project Blocked and remains blocked by merged completion of #6. The status update does not change this fixture's accepted scope or evidence requirements.

DEPENDENCY_GATE_CLEARED

Issue #6 has been squash-merged into main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1.
The merged-main push quality-gate is SUCCESS: https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30833497929/job/91752910028

Issue #8 may now proceed under its existing tokenOut mismatch synthetic/FIXTURE scope and must use this latest main baseline.

The next permitted step is a closed Work Plan and Maintainer scope confirmation. Ready or In Progress does not mean SCOPE_CONFIRMED, QA PASS, Review, Merge Gate, or merge authorization. Do not modify the Decision Engine, ADR, Schema contract, protection rules, or use live-chain evidence.

BUILDER_CLAIM_ACCEPTED

Maintainer accepts Qy as the execution owner for the planning phase of Issue #8.

Base: origin/main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1
Planned branch: codex/issue-8-tokenout-mismatch-stop-fixture
Planned worktree: an isolated worktree for that branch; no branch or worktree is created by this status operation
Unique target: deterministic synthetic/FIXTURE tokenOut mismatch STOP fixture
Proposed writable paths, subject to separate scope confirmation: approved report-schema fixture files, the corresponding fixture test, and approved fixture documentation only
First evidence: a closed Work Plan and a main-baseline fact list

The fixture must keep provenance FIXTURE, allow simulation SUCCESS only as synthetic evidence, force critical tokenOut alignment FAIL, and produce STOP with exact reason code and raw SourceReferences. It must not modify the Decision Engine, Schema contract, ADR, protection rules, or use real addresses, protocols, RPC, wallets, signing, transactions, or live-chain evidence.

Issue #8 is In Progress for planning only. This is not SCOPE_CONFIRMED, QA PASS, Maintainer Review, Merge Gate, or merge authorization.

Final Implementation Work Plan - Awaiting Maintainer Scope Confirmation

1. Source, dependency gate, and planning status

This closed Work Plan is submitted by Builder Qy under the accepted planning claim:
#8 (comment)

Dependency evidence:

Issue M1-03: Implement fail-closed decision engine #6: Closed / Project Done
PR M1-03: implement fail-closed Decision Engine v0.1 #66: squash merged by the Maintainer
Accepted M1-03: Implement fail-closed decision engine #6 head: 25f895cd2a1278bd864670afbe4b0f735dc62c2b
Current exact main baseline and M1-03: Implement fail-closed decision engine #6 squash commit: aa7ea761b2ac5e78535387e0a7d04d45485cdfb1
M1-03: Implement fail-closed decision engine #6 merged-main quality-gate: SUCCESS
https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30833497929
Issue M1-05: Add tokenOut mismatch STOP fixture #8 dependency release:
M1-05: Add tokenOut mismatch STOP fixture #8 (comment)
Open conflicting PRs at planning time: none

Issue #8 is In Progress for planning only. This comment requests SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED; it does not claim that gate, create an implementation branch, or begin implementation.

2. Exact implementation identity

Issue: M1-05: Add tokenOut mismatch STOP fixture #8, M1-05 Add tokenOut mismatch STOP fixture
Proposed branch: codex/issue-8-tokenout-mismatch-stop-fixture
Proposed isolated worktree: /Users/qy/Documents/moss-mini-demo-issue-8
Required base: exact latest origin/main; if main differs from aa7ea761b2ac5e78535387e0a7d04d45485cdfb1 after scope confirmation, Builder must rescan the new main before creating the branch
Proposed Draft PR title: M1-05: add tokenOut mismatch STOP fixture
PR linkage: Closes #8

The branch and worktree will not be created until an independent Maintainer records scope confirmation.

3. Exact writable scope

Only these three paths may be changed:

packages/report-schema/fixtures/token-out-mismatch.v0.1.json
packages/report-schema/test/token-out-mismatch.fixture.test.ts
packages/report-schema/fixtures/README.md

No wildcard path is requested. Any fourth path requires a new Maintainer Scope Gate.

4. Main-baseline fact list

The plan is based only on files merged at main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1:

@moss-mini-demo/report-schema publicly exports PreflightReportSchema and DecisionInputV0_1Schema.
@moss-mini-demo/decision-engine publicly exports runtime evaluateDecisionV0_1 and DecisionInputErrorV0_1; DecisionV0_1 and StopReasonCodeV0_1 are type-only exports.
The merged manual-review-success.v0.1.json supplies the structural starting point and already establishes provenance: FIXTURE, synthetic raw payloads, available successful evidence, and the non-authorization boundary.
The Decision Engine copies validated critical Alignment underlying references into CRITICAL_ALIGNMENT_FAIL, aggregates them, and orders them deterministically.
ADR 0004 corrects ADR 0003 where stated; critical Alignment reasons must reference validated underlying intent, quotes, selection, capability, or simulation data, never /alignment, decision, limitations, prose, display data, or schema-owned reference metadata.
Root pnpm check builds report-schema before decision-engine and runs both public package import smoke tests.

No Draft PR or feature-branch content is treated as a main fact.

5. Fixed synthetic Fixture data contract

The new Fixture will be a complete valid PreflightReport v0.1 with:

schemaVersion: "0.1"
provenance: "FIXTURE"
deterministic synthetic UUID: 88888888-8888-4888-8888-888888888888
deterministic synthetic time and eip155 network namespace
synthetic account and recipient values using digit-only EVM identifiers
synthetic protocol ID: synthetic-token-out-mismatch-protocol
synthetic Quote ID: synthetic-token-out-mismatch-quote-v0-1
every raw payload marked with origin: synthetic-development-fixture

The tokenOut mismatch is fixed as:

intended tokenOut at /intent/outputAsset/address:
0x1111111111111111111111111111111111111111
the successful Quote uses the same intended output asset so selection remains valid
observed simulated tokenOut at
/simulation/outcomes/items/0/raw/tokenOut/address:
0x2222222222222222222222222222222222222222
both values are deterministic synthetic development identifiers and are intentionally unequal

No real Moss, Monad, RPC, protocol, Quote, Receipt, Outcome, account, token, wallet, private key, API key, signing material, transaction, or chain data will be used.

6. Favorable evidence retained

The tokenOut mismatch must be the only STOP trigger:

selection is SELECTED and references the matching successful synthetic Quote
capability is AVAILABLE
simulation is AVAILABLE
simulation executionStatus is SUCCESS
Receipt evidence is AVAILABLE, non-empty, and every record is SUCCESS
Outcome evidence is AVAILABLE, non-empty, and every record is SUCCESS; its raw payload carries the mismatching observed tokenOut
Warnings are AVAILABLE with an empty items array
coverage is AVAILABLE with complete: true
ordering is AVAILABLE with valid: true
state continuity is AVAILABLE with continuous: true

A successful simulation cannot override the critical tokenOut mismatch.

7. Critical Alignment and Decision contract

The Fixture contains exactly one decision-critical tokenOut check:

checkId: synthetic-token-out-alignment
critical: true
status: FAIL
exact sourceReferences, in canonical order:
1. /intent/outputAsset/address
2. /simulation/outcomes/items/0/raw/tokenOut/address

The references resolve to the two underlying scalar values. They do not cite /alignment, decision, limitations, display/prose/extension data, or a sourceReferences metadata field.

The Fixture Decision is exactly:

{
  "status": "STOP",
  "reasons": [
    {
      "code": "CRITICAL_ALIGNMENT_FAIL",
      "sourceReferences": [
        "/intent/outputAsset/address",
        "/simulation/outcomes/items/0/raw/tokenOut/address"
      ]
    }
  ]
}

No explanation, severity, confidence, approval, signability, executability, or additional STOP code is permitted.

The Fixture limitations use a stable code such as SYNTHETIC_TOKEN_OUT_MISMATCH_FIXTURE_ONLY and explicitly state:

the file is only a synthetic development Fixture for Schema and Engine regression validation;
simulation SUCCESS does not override critical tokenOut mismatch;
it is not Moss, Monad, protocol, wallet, RPC, Quote, Receipt, simulation, or chain evidence;
MANUAL_REVIEW is not a safety conclusion, approval, authorization, execution guarantee, or permission to sign;
STOP is a structured fail-closed result, not a safety proof or transaction authorization.

8. Fixture test plan

token-out-mismatch.fixture.test.ts will use import.meta.glob to read the dedicated JSON and will import only public package names:

@moss-mini-demo/report-schema
@moss-mini-demo/decision-engine

It will not import either package's private src path and will not copy Schema or evaluator logic.

The test must prove:

The file exists and JSON.parse succeeds.
PreflightReportSchema.safeParse(fixture) succeeds.
provenance is exactly FIXTURE.
The fixed report, Quote, protocol, account, recipient, address, and raw values are deterministic synthetic development data.
selection is SELECTED and points to a matching successful Quote.
capability and simulation are AVAILABLE.
simulation executionStatus is SUCCESS.
Receipts and Outcomes are available, non-empty, and successful.
Warnings are available and empty; coverage, ordering, and continuity are favorable.
/intent/outputAsset/address equals the fixed 0x111...1111 string.
/simulation/outcomes/items/0/raw/tokenOut/address equals the fixed 0x222...2222 string.
The two tokenOut strings are unequal.
A critical Alignment check exists with status: FAIL.
Its references equal the two exact underlying pointers and contain no derived /alignment target.
The Fixture Decision is STOP with exactly one reason.
The only reason code is CRITICAL_ALIGNMENT_FAIL.
Its references exactly equal the critical Alignment references in canonical order.
Removing decision and limitations produces an input accepted by public DecisionInputV0_1Schema.
Public evaluateDecisionV0_1(input) deeply equals the Fixture Decision.
Repeated evaluation is deeply equal and simulation SUCCESS does not suppress STOP.
The limitation retains the synthetic-only and non-authorization statements.
The existing MANUAL_REVIEW success Fixture remains unchanged and valid.
Existing report-schema and decision-engine tests remain green.
No test performs network, RPC, wallet, signing, transaction, or other external behavior.

9. Fixture README update

packages/report-schema/fixtures/README.md will be minimally revised to describe both merged Fixture files:

manual-review-success.v0.1.json: existing synthetic Schema-validation success case
token-out-mismatch.v0.1.json: synthetic critical tokenOut mismatch with simulation SUCCESS and CRITICAL_ALIGNMENT_FAIL STOP

The obsolete sentence saying the existing Fixture must not be used for the #8 case will be replaced with a stable separation statement: the success file must not be modified or presented as the STOP case; the new file owns that scenario.

The README will retain that all identifiers/raw payloads use provenance FIXTURE, neither file is real or mocked protocol/chain evidence, and neither MANUAL_REVIEW, STOP, green CI, nor a Fixture is a safety conclusion or authorization to sign.

It will not mention PR, Draft, review, Merge Gate, or other lifecycle state.

10. Explicit non-goals

This implementation will not:

implement a tokenOut Alignment evaluator;
modify the success Fixture;
create the M1-09: Add amountIn mismatch STOP fixture #20 amountIn Fixture or any additional success/STOP Fixture;
modify report-schema source, Decision Engine source/tests, package metadata, lockfile, workspace, ADR, STOP presentation, root README, Real-versus-Mock, workflow, protection, required checks, Issue/Project state, Milestone, labels, or permissions;
add dependencies, public exports, runtime Schema, UI, frontend, backend, RPC, Moss, Monad, protocol adapter, wallet, signing, transaction, Clear402, deployment, real address, or live-chain evidence;
interpret simulation SUCCESS as safety, approval, authorization, signability, executability, or evidence completeness beyond the validated synthetic input.

Issue #20 and Issue #9 remain outside this task and will not be claimed or started.

11. Implementation sequence after authorization

Re-fetch and verify exact latest origin/main, Issue M1-05: Add tokenOut mismatch STOP fixture #8 state, no conflicting PR, and Node/pnpm versions.
Create the proposed branch and isolated worktree from that exact main.
Add the JSON Fixture using the fixed synthetic contract.
Add the public-boundary Vitest regression.
Update only the Fixture README.
Verify the diff contains exactly the three approved paths.
Run focused Schema and Decision Engine tests, then the full local quality gate.
Commit once, push the branch, and create one Draft PR linked with Closes #8.
Wait for quality-gate SUCCESS on the exact current head.
Update the PR description, publish an Implementation Report, publish a separate Pre-PR QA handoff, freeze the exact head, and stop Builder work.

12. Required local verification

Use Node 22.23.1 and pnpm 11.16.0:

node --version
pnpm --version
pnpm install --frozen-lockfile
pnpm build
pnpm exec vitest run packages/report-schema/test/token-out-mismatch.fixture.test.ts
pnpm exec vitest run packages/report-schema/test
pnpm exec vitest run packages/decision-engine/test
pnpm test:package-import
pnpm format:check
pnpm lint
pnpm typecheck
pnpm test
pnpm check
git diff --check
git diff --name-only origin/main...HEAD
git status --short

Boundary scans:

rg -n '"provenance": "FIXTURE"' packages/report-schema/fixtures
rg -n 'LIVE_SOURCE|privateKey|apiKey|fetch\(|wallet|sign|transaction|Clear402|clear402' \
  packages/report-schema/fixtures/token-out-mismatch.v0.1.json \
  packages/report-schema/test/token-out-mismatch.fixture.test.ts

Acceptance requires:

all commands pass under Node 22 / pnpm 11;
public package-name imports pass;
the full repository test count is recorded from the implementation head, not copied from historical PR evidence;
git diff --check passes;
exact diff contains only the three confirmed paths;
no dist, node_modules, coverage, or temporary file is tracked.

13. Draft PR and exact-head evidence

The Draft PR must include:

Closes #8;
this Work Plan and the later Scope Confirmation links;
exact base and head SHAs;
M1-03: Implement fail-closed decision engine #6 merge/main and merged-main CI evidence;
exact three-file list;
fixed intended and observed synthetic tokenOut values and pointers;
Schema validation and Decision Engine recomputation evidence;
proof that simulation SUCCESS still produces STOP;
focused and full validation results and actual test counts;
exact-head quality-gate URL;
synthetic/FIXTURE and non-authorization boundaries;
explicit absence of M1-09: Add amountIn mismatch STOP fixture #20/M1-06: Document M1 evidence boundary and completion criteria #9, Schema/Engine changes, Moss, Monad, RPC, UI, wallet, signing, transaction, Clear402, secrets, or real-chain data.

The PR remains Draft/Open/unmerged for independent Pre-PR QA and Maintainer review. Builder Qy will not execute Review, Ready, Merge Gate, merge, or control-plane changes.

14. Risks and rollback

Risks requiring review:

a pointer could target derived Alignment output rather than source-owned evidence;
a Quote/output asset mismatch could make the input invalid before the intended Alignment STOP;
an unintended unfavorable component could add another STOP reason;
a synthetic Fixture could be mistaken for protocol or chain evidence;
test code could bypass public package boundaries or duplicate evaluator logic.

The fixed values, two exact raw pointers, favorable-evidence assertions, complete Schema parse, Engine recomputation, single-reason assertion, public package imports, and Fixture README boundary address these risks.

Rollback is one independent Fixture commit or the future squash merge revert. It must not be implemented by weakening Schema, Decision Engine, ADR, or evidence ownership.

15. Requested Maintainer confirmation

Please confirm exactly:

base planning contract anchored at main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1, with mandatory recheck if main advances;
the exact three writable paths;
the fixed 0x111...1111 intended and 0x222...2222 observed tokenOut values;
the two exact underlying SourceReferences and their order;
the single CRITICAL_ALIGNMENT_FAIL STOP reason;
the public-package-only test plan and full verification list;
the Fixture README stable-fact update;
all explicit non-goals and Contributor/Maintainer boundaries.

Requested next state:

WORK_PLAN_SUBMITTED / AWAITING_MAINTAINER_SCOPE_CONFIRMATION

Until an independent Maintainer records SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED, Builder Qy will not create the branch/worktree, edit files, commit, push, or open a PR.

SCOPE_CHANGES_REQUESTED

Reviewed Work Plan:
#8 (comment)

Reviewed baseline: main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1

The tokenOut mismatch data contract, single CRITICAL_ALIGNMENT_FAIL result, two underlying SourceReferences, favorable simulation evidence, synthetic/FIXTURE boundary, and three-file intent are consistent with the merged Schema and Decision Engine. Scope confirmation is blocked by one package-boundary defect in the proposed test location.

[P1] The proposed report-schema test cannot resolve decision-engine by public package name

The Work Plan places the integration test at:

packages/report-schema/test/token-out-mismatch.fixture.test.ts

and requires that test to import both @moss-mini-demo/report-schema and @moss-mini-demo/decision-engine by public package name.

That dependency direction is not available on the accepted main baseline:

@moss-mini-demo/decision-engine depends on @moss-mini-demo/report-schema;
@moss-mini-demo/report-schema does not and must not depend on decision-engine;
pnpm creates no decision-engine link under packages/report-schema/node_modules or the repository root;
an exact-baseline runtime import from both the root and packages/report-schema/test fails with ERR_MODULE_NOT_FOUND;
adding decision-engine to report-schema metadata would invert the package boundary, create an architectural cycle, require package/lockfile changes, and exceed the requested three-file scope.

The root zero-dist order also runs typecheck before decision-engine is built, so a normal static import through decision-engine's dist export is not a valid clean-checkout workaround.

Required minimal Work Plan v2 correction

Keep the three-file limit, but replace the proposed test path with:

packages/decision-engine/test/token-out-mismatch.fixture.test.ts

The revised test may load the Fixture with an explicit relative import.meta.glob path such as:

../../report-schema/fixtures/token-out-mismatch.v0.1.json

From the decision-engine package context, both public package names resolve after the normal root build because the engine owns its self-reference and declares report-schema as a dependency. To preserve the clean zero-dist typecheck order, use the established computed dynamic package-name import pattern rather than a static type-resolved import of decision-engine's unbuilt dist entry. Do not add dependencies, metadata, lockfile changes, aliases, private cross-package imports, or a report-schema -> decision-engine edge.

The revised plan must explicitly retain:

the Fixture JSON path and Fixture README path;
the fixed intended and observed tokenOut values;
the exact two underlying SourceReferences in canonical order;
complete PreflightReportSchema validation;
removal of decision and limitations followed by DecisionInputV0_1Schema validation;
public evaluateDecisionV0_1 recomputation and repeated deterministic equality;
exact single CRITICAL_ALIGNMENT_FAIL output;
focused Schema/Engine tests, zero-dist clean-checkout ordering, full pnpm check, exact three-file diff, and exact-head CI.

No branch, worktree, file edit, commit, push, or PR is authorized yet. Submit a superseding closed Work Plan v2 for a new Maintainer Scope Gate.

Current conclusion: WORK_PLAN_REVIEWED / SCOPE_CHANGES_REQUESTED / IMPLEMENTATION_NOT_AUTHORIZED.

Final Implementation Work Plan v2 - Decision-Engine Test Boundary Fixed - Awaiting Maintainer Scope Confirmation

1. Supersession, source, and planning status

This Work Plan v2 fully supersedes the original Work Plan without deleting its history:
#8 (comment)

It resolves the Maintainer SCOPE_CHANGES_REQUESTED finding:
#8 (comment)

Builder claim and dependency records:

Planning owner record:
M1-05: Add tokenOut mismatch STOP fixture #8 (comment)
M1-03: Implement fail-closed decision engine #6 dependency release:
M1-05: Add tokenOut mismatch STOP fixture #8 (comment)
Issue M1-03: Implement fail-closed decision engine #6: Closed / Project Done
PR M1-03: implement fail-closed Decision Engine v0.1 #66: squash merged by the Maintainer
Accepted M1-03: Implement fail-closed decision engine #6 head: 25f895cd2a1278bd864670afbe4b0f735dc62c2b
Current exact main baseline and M1-03: Implement fail-closed decision engine #6 squash commit: aa7ea761b2ac5e78535387e0a7d04d45485cdfb1
M1-03: Implement fail-closed decision engine #6 merged-main quality-gate: SUCCESS
https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30833497929
Open conflicting PRs at v2 planning time: none

Issue #8 remains In Progress for planning only. This v2 requests a new SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED decision. It does not claim authorization or begin implementation.

2. Exact implementation identity

Issue: M1-05: Add tokenOut mismatch STOP fixture #8, M1-05 Add tokenOut mismatch STOP fixture
Proposed branch: codex/issue-8-tokenout-mismatch-stop-fixture
Proposed isolated worktree: /Users/qy/Documents/moss-mini-demo-issue-8
Required base: exact latest origin/main; if main advances beyond aa7ea761b2ac5e78535387e0a7d04d45485cdfb1 before authorization, Builder must rescan the new main before creating the branch
Proposed Draft PR title: M1-05: add tokenOut mismatch STOP fixture
PR linkage: Closes #8

No branch or worktree will be created until an independent Maintainer confirms this v2 scope.

3. Exact writable scope

Only these three paths may be changed:

packages/report-schema/fixtures/token-out-mismatch.v0.1.json
packages/decision-engine/test/token-out-mismatch.fixture.test.ts
packages/report-schema/fixtures/README.md

The test path from v1 is removed from scope:

packages/report-schema/test/token-out-mismatch.fixture.test.ts

No wildcard path is requested. Any fourth path requires a new Maintainer Scope Gate.

4. Corrected package and clean-checkout boundary

The integration test belongs to the decision-engine package because dependency direction is strictly:

@moss-mini-demo/report-schema
              |
              v
@moss-mini-demo/decision-engine

The implementation will not add a report-schema -> decision-engine dependency, package metadata, lockfile entry, alias, TypeScript path, or private cross-package source import.

The new decision-engine test reads the report-schema-owned Fixture with one explicit compile-time glob path:

import.meta.glob(
  "../../report-schema/fixtures/token-out-mismatch.v0.1.json",
  { eager: true, query: "?raw", import: "default" },
)

Both runtime packages are loaded using computed dynamic public package names:

const REPORT_SCHEMA_PACKAGE = ["@moss-mini-demo", "report-schema"].join("/");
const DECISION_ENGINE_PACKAGE = ["@moss-mini-demo", "decision-engine"].join("/");

const { PreflightReportSchema, DecisionInputV0_1Schema } =
  await import(REPORT_SCHEMA_PACKAGE);
const { evaluateDecisionV0_1 } = await import(DECISION_ENGINE_PACKAGE);

There will be no static import of @moss-mini-demo/decision-engine, no import from either package's private src path, and no copied Schema or evaluator logic.

This preserves the zero-product ordering:

A fresh checkout starts with no node_modules or dist.
pnpm install --frozen-lockfile creates workspace links only.
Standalone pnpm typecheck builds report-schema, then checks TypeScript before decision-engine has been built.
The computed dynamic decision-engine package name prevents TypeScript from eagerly resolving the unbuilt dist export during step 3.
pnpm build then builds report-schema followed by decision-engine.
Focused Vitest and full tests run after build, so both computed public package imports resolve at runtime through normal package exports.
Root pnpm check remains the unchanged CI entry and repeats the authorized build/test order.

Tests will not perform a build internally and no lifecycle script will be added.

5. Main-baseline fact list

The plan relies only on files merged at main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1:

@moss-mini-demo/report-schema publicly exports PreflightReportSchema and DecisionInputV0_1Schema.
@moss-mini-demo/decision-engine publicly exports runtime evaluateDecisionV0_1 and DecisionInputErrorV0_1; DecisionV0_1 and StopReasonCodeV0_1 are type-only exports.
The merged manual-review-success.v0.1.json establishes the Fixture structure, provenance: FIXTURE, synthetic raw payloads, favorable evidence, and non-authorization language.
The merged Decision Engine converts validated critical Alignment FAIL references into deterministic CRITICAL_ALIGNMENT_FAIL output.
ADR 0004 governs its corrections to ADR 0003: critical Alignment reasons use underlying intent, quotes, selection, capability, or simulation references, never /alignment, decision, limitations, prose, display data, or schema-owned reference metadata.
Root scripts build report-schema before decision-engine and run both package-name smoke tests.

No Draft PR, feature branch, or historical test count is treated as a current main fact.

6. Fixed synthetic Fixture data contract

The Fixture is a complete valid PreflightReport v0.1 with:

schemaVersion: "0.1"
provenance: "FIXTURE"
deterministic synthetic UUID: 88888888-8888-4888-8888-888888888888
deterministic synthetic time and eip155 network namespace
digit-only synthetic account and recipient EVM identifiers
protocol ID: synthetic-token-out-mismatch-protocol
Quote ID: synthetic-token-out-mismatch-quote-v0-1
every raw payload marked with origin: synthetic-development-fixture

The exact mismatch is:

intended tokenOut at /intent/outputAsset/address:
0x1111111111111111111111111111111111111111
the successful Quote uses that same intended output asset, preserving selection validity
observed simulated tokenOut at
/simulation/outcomes/items/0/raw/tokenOut/address:
0x2222222222222222222222222222222222222222
the two deterministic synthetic strings are intentionally unequal

No real address, Moss, Monad, RPC, protocol, Quote, Receipt, Outcome, wallet, private key, API key, signing material, transaction, or chain data is used.

7. Favorable evidence retained

The tokenOut mismatch is the only STOP trigger:

selection is SELECTED and references a matching successful synthetic Quote
capability is AVAILABLE
simulation is AVAILABLE with executionStatus: SUCCESS
Receipts are AVAILABLE, non-empty, and all SUCCESS
Outcomes are AVAILABLE, non-empty, and all SUCCESS; Outcome raw contains the observed mismatching tokenOut
Warnings are AVAILABLE with empty items
coverage is AVAILABLE with complete: true
ordering is AVAILABLE with valid: true
state continuity is AVAILABLE with continuous: true

Simulation SUCCESS cannot override the critical tokenOut mismatch.

8. Critical Alignment and Decision contract

The Fixture contains exactly one decision-critical tokenOut Alignment check:

checkId: synthetic-token-out-alignment
critical: true
status: FAIL
exact canonical sourceReferences:
1. /intent/outputAsset/address
2. /simulation/outcomes/items/0/raw/tokenOut/address

Both pointers resolve to underlying source values. They do not target /alignment, decision, limitations, presentation data, extension data, or schema-owned sourceReferences metadata.

The complete Decision is exactly:

{
  "status": "STOP",
  "reasons": [
    {
      "code": "CRITICAL_ALIGNMENT_FAIL",
      "sourceReferences": [
        "/intent/outputAsset/address",
        "/simulation/outcomes/items/0/raw/tokenOut/address"
      ]
    }
  ]
}

No explanation, severity, confidence, approval, signability, executability, or additional STOP reason is added.

The Fixture limitation uses SYNTHETIC_TOKEN_OUT_MISMATCH_FIXTURE_ONLY and states that:

the file is only a synthetic development Fixture for Schema and Engine regression validation;
simulation SUCCESS does not override critical tokenOut mismatch;
it is not Moss, Monad, protocol, wallet, RPC, Quote, Receipt, simulation, or chain evidence;
MANUAL_REVIEW is not a safety conclusion, approval, authorization, execution guarantee, or permission to sign;
STOP is a structured fail-closed result, not a safety proof or transaction authorization.

9. Decision-engine integration test plan

packages/decision-engine/test/token-out-mismatch.fixture.test.ts will use the explicit relative import.meta.glob path and computed dynamic public package names described in section 4.

It must prove:

The Fixture exists and JSON.parse succeeds.
Public PreflightReportSchema.safeParse(fixture) succeeds.
provenance is exactly FIXTURE.
The report, Quote, protocol, account, recipient, address, and raw values equal their fixed synthetic values.
selection is SELECTED and points to the matching successful Quote.
capability and simulation are AVAILABLE.
simulation execution is SUCCESS.
Receipts and Outcomes are available, non-empty, and successful.
Warnings are available and empty; coverage, ordering, and continuity are favorable.
the intended tokenOut equals fixed 0x111...1111.
Outcome raw tokenOut equals fixed 0x222...2222.
the two tokenOut strings are unequal.
a critical Alignment check exists with status: FAIL.
its references equal the two exact underlying pointers and contain no /alignment target.
Fixture Decision is STOP with exactly one reason.
the only code is CRITICAL_ALIGNMENT_FAIL.
reason references exactly equal the critical Alignment references in canonical order.
removing decision and limitations creates an input accepted by public DecisionInputV0_1Schema.
computed public package import evaluateDecisionV0_1(input) deeply equals the Fixture Decision.
repeated evaluation is deeply equal.
simulation SUCCESS remains true and does not suppress STOP.
the limitation preserves synthetic-only and non-authorization statements.
the existing success Fixture remains unchanged and passes existing report-schema tests.
all existing report-schema and decision-engine tests remain green.
no test performs network, RPC, wallet, signing, transaction, or other external behavior.

The test does not implement tokenOut Alignment calculation. It validates a Fixture that already contains a synthetic, critical FAIL and proves the public Engine fails closed on that validated input.

10. Fixture README update

packages/report-schema/fixtures/README.md will minimally describe both files:

manual-review-success.v0.1.json: existing synthetic Schema-validation success scenario
token-out-mismatch.v0.1.json: synthetic tokenOut mismatch where simulation is successful but critical Alignment fails and Decision is CRITICAL_ALIGNMENT_FAIL STOP

The obsolete statement that the existing Fixture must not be used for the #8 case will be replaced with a stable separation: the success Fixture remains unchanged and is not the STOP Fixture; the new file exclusively owns the mismatch scenario.

The README retains that:

every Fixture uses provenance FIXTURE and synthetic identifiers/raw payloads;
neither file is Moss, Monad, protocol, wallet, RPC, Quote, Receipt, simulation, or chain evidence;
neither MANUAL_REVIEW, STOP, a green CI run, nor a Fixture is a safety conclusion or authorization to sign.

It contains no PR, Draft, review, Merge Gate, or lifecycle wording.

11. Exact non-goals

This implementation does not:

implement a tokenOut Alignment evaluator;
modify the success Fixture;
create M1-09: Add amountIn mismatch STOP fixture #20 or another success/STOP Fixture;
modify report-schema source/tests, Decision Engine source or existing tests, package metadata, lockfile, workspace, ADR, STOP presentation, root README, Real-versus-Mock, workflow, protection, required checks, Issue/Project state, Milestone, labels, or permissions;
add dependencies, package edges, aliases, TypeScript paths, lifecycle scripts, public exports, runtime Schema, or committed dist;
add UI, frontend, backend, RPC, Moss, Monad, protocol adapter, wallet, signing, transaction, Clear402, deployment, secret, real address, or live-chain evidence;
treat simulation SUCCESS, MANUAL_REVIEW, STOP, CI, or Fixture provenance as safety, approval, authorization, signability, or executability.

Issue #20 and Issue #9 remain outside this task and will not be claimed or started.

12. Implementation sequence after authorization

Fetch and verify exact latest origin/main, Issue M1-05: Add tokenOut mismatch STOP fixture #8 state, no conflicting PR, clean workspace, and Node/pnpm versions.
Create the proposed branch and isolated worktree from exact latest main.
Add the JSON Fixture with the fixed contract.
Add the decision-engine package integration test using the explicit cross-package glob and computed dynamic public imports.
Update only the Fixture README.
Confirm the diff contains exactly the three authorized paths.
Execute zero-dist ordering, focused tests, package import smoke tests, and full quality gate.
Create one Fixture commit, push, and open one Draft PR with Closes #8.
Wait for quality-gate SUCCESS on the exact current head.
Update the PR description, publish an Implementation Report, publish a separate Pre-PR QA handoff, freeze the exact head, and stop Builder work.

13. Required clean-checkout and local verification

Use Node 22.23.1 and pnpm 11.16.0. Validation must start in a checkout with no node_modules and no package dist directories:

node --version
pnpm --version
pnpm install --frozen-lockfile
pnpm typecheck
pnpm build
pnpm exec vitest run packages/decision-engine/test/token-out-mismatch.fixture.test.ts
pnpm exec vitest run packages/report-schema/test
pnpm exec vitest run packages/decision-engine/test
pnpm test:package-import
pnpm format:check
pnpm lint
pnpm test
pnpm check
git diff --check
git diff --name-only origin/main...HEAD
git status --short

Required ordering evidence:

no decision-engine dist exists before standalone pnpm typecheck;
standalone pnpm typecheck succeeds because the new test uses computed dynamic package names;
pnpm build then produces report-schema and decision-engine public entries in dependency order;
the focused test succeeds only after that explicit build;
both public package imports and both package test suites pass;
root pnpm check uses the unchanged workflow entry.

Boundary scans:

rg -n '"provenance": "FIXTURE"' packages/report-schema/fixtures
rg -n 'LIVE_SOURCE|privateKey|apiKey|fetch\(|wallet|sign|transaction|Clear402|clear402' \
  packages/report-schema/fixtures/token-out-mismatch.v0.1.json \
  packages/decision-engine/test/token-out-mismatch.fixture.test.ts
rg -n 'from\s+["'"']@moss-mini-demo|import\(["'"']@moss-mini-demo' \
  packages/decision-engine/test/token-out-mismatch.fixture.test.ts

The last scan must find no static package import. The test must visibly contain the computed join("/") package-name construction and dynamic import(variable) calls.

Acceptance requires:

all commands pass under Node 22 / pnpm 11;
standalone zero-dist pnpm typecheck succeeds;
runtime imports resolve only after explicit root build;
actual full test counts are recorded from the implementation head;
git diff --check passes;
exact diff contains only the three confirmed paths;
no dist, node_modules, coverage, or temporary file is tracked.

14. Draft PR and exact-head evidence

The Draft PR must include:

Closes #8;
this Work Plan v2 and the later Scope Confirmation links;
exact base and head SHAs;
M1-03: Implement fail-closed decision engine #6 merge/main and merged-main CI evidence;
exact three-file list;
package-direction and computed-dynamic-import evidence;
zero-dist standalone typecheck evidence;
fixed intended and observed synthetic tokenOut values and pointers;
Schema validation and public Engine recomputation evidence;
proof that simulation SUCCESS still produces the single STOP reason;
focused and full validation results and actual test counts;
exact-head quality-gate URL;
synthetic/FIXTURE and non-authorization boundaries;
explicit absence of M1-09: Add amountIn mismatch STOP fixture #20/M1-06: Document M1 evidence boundary and completion criteria #9, Schema/Engine source changes, dependencies, Moss, Monad, RPC, UI, wallet, signing, transaction, Clear402, secrets, or real-chain data.

The PR remains Draft/Open/unmerged for independent Pre-PR QA and Maintainer review. Builder Qy does not execute Review, Ready, Merge Gate, merge, or control-plane changes.

15. Risks and rollback

Risks:

placing the integration test in report-schema would invert or fake package dependency direction;
a static decision-engine import would fail zero-dist typecheck before its dist exists;
a pointer could target derived Alignment output instead of underlying evidence;
a Quote/output mismatch could invalidate input before the intended Alignment STOP;
another unfavorable component could create an extra STOP reason;
a synthetic Fixture could be mistaken for protocol or chain evidence.

The decision-engine test location, computed dynamic package names, explicit build order, fixed values/pointers, complete Schema validation, Engine recomputation, single-reason assertion, and README boundary address these risks.

Rollback is one independent Fixture commit or future squash-merge revert. It must not be implemented by weakening package direction, Schema, Decision Engine, ADR, or evidence ownership.

16. Requested Maintainer confirmation

Please confirm exactly:

Work Plan v2 supersedes v1 and resolves finding #5169416001;
planning baseline main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1, with mandatory rescan if main advances;
exact three writable paths, including the corrected decision-engine test path;
explicit relative Fixture glob and computed dynamic public package import strategy;
zero-dist typecheck-before-build validation order;
fixed 0x111...1111 intended and 0x222...2222 observed values;
exact two underlying SourceReferences and single CRITICAL_ALIGNMENT_FAIL reason;
public Schema validation, public Engine recomputation, full test plan, README update, non-goals, and Contributor/Maintainer boundaries.

Requested next state:

WORK_PLAN_V2_SUBMITTED / AWAITING_MAINTAINER_SCOPE_CONFIRMATION

Until an independent Maintainer records SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED, Builder Qy will not create the branch/worktree, edit files, commit, push, or open a PR.

SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED

Reviewed Work Plan v2:
#8 (comment)

Authorized baseline: main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1

Work Plan v2 supersedes v1 and resolves the package-boundary finding recorded in:
#8 (comment)

Confirmed scope

Implementation is authorized for exactly these three writable paths:

packages/report-schema/fixtures/token-out-mismatch.v0.1.json
packages/decision-engine/test/token-out-mismatch.fixture.test.ts
packages/report-schema/fixtures/README.md

No fourth path is authorized. There may be no dependency, pnpm-lock.yaml, package metadata, workspace, alias, TypeScript path, lifecycle script, public export, committed dist, Schema source, Decision Engine source, existing test, ADR, workflow, protection, or governance change.

The dependency direction remains strictly report-schema -> decision-engine. The decision-engine integration test may read the report-schema-owned Fixture through the explicit relative import.meta.glob path and must load both runtime packages through computed dynamic public package-name imports. A report-schema -> decision-engine dependency, private src import, copied Schema, or copied evaluator is prohibited.

Required acceptance contract

The implementation and its test must retain all three independent gates:

complete public PreflightReportSchema validation;
removal of decision and limitations, followed by public DecisionInputV0_1Schema validation;
public evaluateDecisionV0_1 recomputation, repeated deterministically, deeply equal to the Fixture Decision.

The Fixture must preserve favorable evidence everywhere except the critical synthetic tokenOut mismatch. Its Decision must contain exactly one reason:

code: CRITICAL_ALIGNMENT_FAIL;
source reference 1: /intent/outputAsset/address;
source reference 2: /simulation/outcomes/items/0/raw/tokenOut/address.

Those two references are the underlying validated input references in canonical order. They may not be replaced by /alignment, decision, limitations, presentation data, extension data, prose, or schema-owned reference metadata. Simulation SUCCESS must remain true and must not suppress the STOP result.

All data must remain deterministic synthetic FIXTURE data. The implementation must preserve the zero-dist typecheck-before-build order, use Node 22 / pnpm 11, pass focused Schema and Engine tests, public-package smoke tests, full pnpm check, git diff --check, exact three-file diff verification, and exact-head GitHub quality-gate.

Authorization boundary

Builder Qy may create codex/issue-8-tokenout-mismatch-stop-fixture from the authorized baseline and open one Draft PR with Closes #8. If main advances before branch creation, stop and rescan the new baseline before implementation.

This record authorizes implementation of the fixed Work Plan v2 only. It is not QA PASS, Maintainer Review, READY_TO_MERGE, Merge Gate, or merge authorization. Any additional file, dependency edge, contract change, public API, or product integration requires a new Maintainer Scope Gate. Issue #20 remains Ready and unclaimed; Issue #9 remains Blocked.

M1-05: add tokenOut mismatch STOP fixture (#67)

POST_MERGE_AUDIT

PR: M1-05: add tokenOut mismatch STOP fixture #67
Accepted head: abacc7d2da7d7453644d7b190f452f3336e74fb5
Accepted base: main@aa7ea761b2ac5e78535387e0a7d04d45485cdfb1
Maintainer Merge Gate: M1-05: add tokenOut mismatch STOP fixture #67 (comment)
Exact-head quality-gate: https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30836879047/job/91764095893
Squash/main commit: c52384448e0016d36f2e723f8cdf37f10315e1c8
Merge time: 2026-08-04T01:54:16Z
Commit topology: one parent, aa7ea761b2ac5e78535387e0a7d04d45485cdfb1
Merged-main push quality-gate: SUCCESS, https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30870163331/job/91870347140
Feature branch deletion: confirmed; Git ref returns HTTP 404

PR #67 and Issue #8 are archived as Project Done. The merge used the exact-head squash endpoint. No auto-merge or admin bypass was used, and no protection or permission setting was changed.

This audit completes Issue #8 only. It does not claim or start #20 and does not open #9.

M1-09: add amountIn mismatch STOP fixture (#68)

M1-05: Add tokenOut mismatch STOP fixture #8

Description

Activity

pillowtalk-Qy commented on Jul 29, 2026

1 remaining item

pillowtalk-Qy commented on Aug 3, 2026

DEPENDENCY_GATE_CLEARED

pillowtalk-Qy commented on Aug 3, 2026

BUILDER_CLAIM_ACCEPTED

pillowtalk-Qy commented on Aug 3, 2026

Final Implementation Work Plan - Awaiting Maintainer Scope Confirmation

1. Source, dependency gate, and planning status

2. Exact implementation identity

3. Exact writable scope

4. Main-baseline fact list

5. Fixed synthetic Fixture data contract

6. Favorable evidence retained

7. Critical Alignment and Decision contract

8. Fixture test plan

9. Fixture README update

10. Explicit non-goals

11. Implementation sequence after authorization

12. Required local verification

13. Draft PR and exact-head evidence

14. Risks and rollback

15. Requested Maintainer confirmation

pillowtalk-Qy commented on Aug 3, 2026

SCOPE_CHANGES_REQUESTED

[P1] The proposed report-schema test cannot resolve decision-engine by public package name

Required minimal Work Plan v2 correction

pillowtalk-Qy commented on Aug 3, 2026

Final Implementation Work Plan v2 - Decision-Engine Test Boundary Fixed - Awaiting Maintainer Scope Confirmation

1. Supersession, source, and planning status

2. Exact implementation identity

3. Exact writable scope

4. Corrected package and clean-checkout boundary

5. Main-baseline fact list

6. Fixed synthetic Fixture data contract

7. Favorable evidence retained

8. Critical Alignment and Decision contract

9. Decision-engine integration test plan

10. Fixture README update

11. Exact non-goals

12. Implementation sequence after authorization

13. Required clean-checkout and local verification

14. Draft PR and exact-head evidence

15. Risks and rollback

16. Requested Maintainer confirmation

pillowtalk-Qy commented on Aug 3, 2026

SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED

Confirmed scope

Required acceptance contract

Authorization boundary

pillowtalk-Qy commented on Aug 4, 2026

POST_MERGE_AUDIT

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions