Slice 6: compile recorded traces into recipes

[rvegajr]

Stacked on #9. Spec sentences are in docs/IMPLEMENTATION.md §4 Slice 6. This completes the product loop: learn → compile → run.

What

• Core
  • COMPILER_CARD: the prototype's measured rules, adapted to the v1 format. Eval code reads params; origins and domains; typed params; structural verification; ambiguity resolved by page signals; position params count the items themselves; self-test on ≥3 inputs.
  • compilerPrompt: the task and kept params go outside a random-nonce fence; every page-derived step and output goes inside it, labelled untrusted.
  • extractRecipeJson and checkCompiled: parse, lint, and require the recipe's origins to be ones the trace visited. The result is always stored as a draft.
  • compileTrace and a Compiler port.
• @tyto/compiler: ClaudeCodeCompiler runs claude -p in ~/.tyto/compile/<name>-*/:
  • ANTHROPIC_API_KEY removed, so it bills your Max plan;
  • only Bash(tyto compile-tool:*) allowed; Write, Edit, NotebookEdit, WebFetch, WebSearch and Task denied;
  • --strict-mcp-config;
  • a tyto shim on PATH.
• CLI
  • tyto compile <name>.
  • tyto compile-tool draft|test|ab, only usable inside a compile. ab runs in tyto-compile: Tyto's config (no logins), --allowed-domains, --content-boundaries, action policy.
  • tyto recipes approve <name> [--yes] shows the steps and asks for confirmation.

Verified

• End to end on Wikipedia:
  • Recorded once, compiled once (94 s, two drafts).
  • Run on six species against API ground truth: 6/6 correct with no model, 0.26–0.31 s warm (0.82 s cold), including Vulnerable and Endangered.
• Containment: Claude Code refused tyto compile-tool test d1 && touch …; touch … as a single permission denial. No file was created.

Tests

• npm run check: 17 files, 145 tests, typecheck clean, gitleaks clean.
• TYTO_LIVE_COMPILER=1 npm run test:live: 7 passed. The real compile against a loopback site took 84 s; the recipe answered two unseen inputs correctly.

🤖 Generated with Claude Code