675 simulation data

.changeset/cli-runner-fetch-resilience.md

@@ -0,0 +1,9 @@
+---
+'@walkeros/cli': patch
+---
+
+The managed flow runner now retries its bundle, config, and secret fetches on
+transient failures (timeouts, network errors, 5xx) with bounded, jittered
+backoff capped well inside the container health window, and the secret fetch is
+now bounded by a timeout. A brief outage while a flow container starts no longer
+hard-fails the run.

.changeset/cli-runtime-log-rings.md

@@ -0,0 +1,8 @@
+---
+'@walkeros/cli': patch
+---
+
+The managed flow runner now reports its recent errors and recent log output in
+its heartbeat, so deployed flows can surface runtime errors and logs in the app
+without any external log tooling. Secrets are redacted before leaving the
+runner.

.changeset/cli-runtime-observe-frozen-env.md

@@ -0,0 +1,9 @@
+---
+'@walkeros/cli': patch
+---
+
+`walkeros run` reads two new environment variables. `WALKEROS_OBSERVE_LEVEL`
+sets the runtime's baseline telemetry level (`off`, `standard`, or `trace`).
+`WALKEROS_CONFIG_FROZEN` (`1` or `true`) serves the bundle as an immutable
+snapshot: secrets are still injected at boot, but config hot-swap and heartbeat
+are disabled.

.changeset/cli-simulate-data-injection.md

@@ -0,0 +1,10 @@
+---
+'@walkeros/cli': patch
+---
+
+All four simulate functions (`simulateSource`, `simulateTransformer`,
+`simulateCollector`, `simulateDestination`) accept a new `data` option to run an
+existing bundle with updated configuration values, without rebundling. The new
+`buildDataPayload`, `classifyStepProperties`, and `containsCodeMarkers` exports
+build and inspect that payload. Destination simulation results now include
+`mappingKey`, the entity-action key of the matched mapping rule.

.changeset/collector-consent-init-gate.md

@@ -0,0 +1,9 @@
+---
+'@walkeros/collector': patch
+---
+
+Enforce consent gating on destination initialization. A destination that
+declares a consent requirement is never initialized while that consent is
+denied, including the path that flushes queued `on` (consent) signals.
+Initialization is now fail-closed: it requires an affirmative consent decision
+from the caller, so a destination cannot load or send under denied consent.

.changeset/core-simulation-mapping-key.md

@@ -0,0 +1,7 @@
+---
+'@walkeros/core': patch
+---
+
+Simulation step results gain an optional `mappingKey` field reporting the
+entity-action key of the mapping rule a destination matched during simulation.
+The field is additive and present only when a rule matched.

.changeset/session-ungated-run-emit.md

@@ -0,0 +1,9 @@
+---
+'@walkeros/web-source-session': patch
+---
+
+Fix `session start` being dropped when the collector starts with `run: false`
+and no consent requirement. Without a consent rule the source emitted during
+init, before the collector was allowed, so the event never reached destinations.
+The emit now waits for the run lifecycle, matching the browser source's page
+view timing, so it lands reliably once the collector runs.

.changeset/usercentrics-official-consent.md

@@ -0,0 +1,10 @@
+---
+'@walkeros/web-source-cmp-usercentrics': patch
+---
+
+Use the official Usercentrics events (UC_UI_INITIALIZED, UC_UI_CMP_EVENT) and
+consent getters so a returning visitor's prior choice is applied on load and
+first-visit defaults stay suppressed under explicitOnly. The configurable
+eventName data-layer setting is removed; the source now uses the always-emitted
+official events. Fixes consent-change events being dropped on the current
+Usercentrics Web CMP.

.github/workflows/test.yml

@@ -3,7 +3,7 @@ name: Build and test
 on:
   push:
     branches:
-      - '*'
+      - main
     paths-ignore:
       - '**/*.md'
       - '**/*.mdx'
@@ -39,7 +39,19 @@ jobs:
         with:
           node-version: '24.15.0'
           cache: 'npm'
-      - run: npm ci
+      - name: Cache node_modules
+        id: node_modules_cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            node_modules
+            packages/*/node_modules
+            packages/**/node_modules
+            apps/*/node_modules
+          key: nm-${{ runner.os }}-node24.15.0-${{ hashFiles('package-lock.json') }}
+      - name: Install dependencies
+        if: steps.node_modules_cache.outputs.cache-hit != 'true'
+        run: npm ci
       # Drift gate: the committed CLI api.gen.d.ts (and spec.json) must equal a
       # fresh, prettier-formatted generate:types run. Prevents stale/unformatted
       # generated API types from being committed (the recurring eternal-diff).
@@ -59,8 +71,7 @@ jobs:
         if: github.event_name != 'pull_request'
         run: npx turbo run typecheck lint test
       - name: Run integration tests
-        if:
-          github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
+        if: github.event_name != 'pull_request'
         run: npm run test:integration
       - name: Upload test results on failure
         if: failure()

apps/explorer/turbo.json

@@ -2,7 +2,7 @@
   "extends": ["//"],
   "tasks": {
     "test": {
-      "dependsOn": ["build"],
+      "dependsOn": ["build", "^build"],
       "inputs": ["$TURBO_DEFAULT$", "dist/**"]
     }
   }

package.json

@@ -49,7 +49,7 @@
     "verify:touched": "bash scripts/verify-touched.sh",
     "verify:affected": "turbo run typecheck lint test --filter='[origin/main]'",
     "verify:force": "turbo run test --filter='[origin/main]' --force",
-    "// scripts": "verify:touched <pkg> for L1, verify:affected for L2, test:smoke for L3, test+lint+typecheck for L4, verify:force = uncached test run after a core-runtime change (turbo test cache hashes only own src). See /workspaces/developer/AGENT.md rule 11.",
+    "// scripts": "verify:touched <pkg> for L1, verify:affected for L2, test:smoke for L3, test+lint+typecheck for L4, verify:force = rarely needed escape hatch for a fully uncached test run; the turbo test task depends on ^build, so an upstream change busts downstream test caches automatically. See /workspaces/developer/AGENT.md rule 11.",
     "prepare": "husky || true",
     "validate:links": "npx tsx apps/scripts/validate-links.ts",
     "validate:docs": "npx tsx apps/scripts/validate-docs.ts",