feat(orchestrator): observe Page Data validation

services/orchestrator/shadow-observer.test.mjs

@@ -179,6 +179,7 @@ test('shadow observer sends a control-plane-only RunSpec without user content or
     userId: 'user-2',
     sessionId: 'session-2',
     taskType: 'code-change',
+    pageDataRequired: true,
     userMessage: {
       content: [{ type: 'text', text: 'Implement the service boundary' }],
     },
@@ -192,6 +193,7 @@ test('shadow observer sends a control-plane-only RunSpec without user content or
   assert.equal(body.policy.executionMode, 'observe-only');
   assert.equal(body.policy.sideEffectsAllowed, false);
   assert.equal(body.input.instruction, '[shadow-control-plane-only]');
+  assert.equal(body.input.pageDataRequired, true);
   assert.equal('sessionRef' in body.input, false);
   assert.deepEqual(body.subject, { tenantId: null, userId: null });
   assert.equal(body.metadata.configVersion, 7);
@@ -270,6 +272,37 @@ test('isolated Portal shadow flow reaches LangGraph over HTTP and removes all te
   assert.equal(checkpointJson.includes('private-user-id'), false);
   assert.equal(checkpointJson.includes('private-session-id'), false);
 
+  const validation = await observer.observeValidation({
+    runId: 'isolated-shadow-run-1',
+    requestId: 'isolated-shadow-request-1',
+    userId: 'private-user-id',
+    workflowName: 'code-run-v1',
+    observation: {
+      idempotencyKey: 'isolated-shadow-run-1:page-data-delivery:v1',
+      taskType: 'page_data_dev_complex',
+      required: true,
+      checks: [
+        { id: 'agent_run_completion', status: 'passed' },
+        { id: 'page_data_binding', status: 'passed' },
+        { id: 'page_data_storage_policy', status: 'passed' },
+      ],
+      metrics: { pageCount: 2, publicationCount: 1 },
+      source: 'portal-agent-run',
+      observedAt: 123,
+      sensitive: {
+        workspacePath: '/private/workspace',
+        instruction: secretUserContent,
+      },
+    },
+  });
+  assert.equal(validation.observed, true);
+  assert.equal(validation.validation.verdict, 'passed');
+  const validatedState = await runtime.getState('isolated-shadow-run-1');
+  assert.equal(validatedState.validation.verdict, 'passed');
+  const validatedJson = JSON.stringify(validatedState.validation);
+  assert.equal(validatedJson.includes('/private/workspace'), false);
+  assert.equal(validatedJson.includes(secretUserContent), false);
+
   const deleted = await fetch(`${server.baseUrl}/v1/runs/isolated-shadow-run-1`, {
     method: 'DELETE',
     headers: { authorization: 'Bearer isolated-shadow-token' },