Simplify feedback API to download-intent model; fix invalid non_responsive outcome

The feedback API is consolidated onto recordDownloadFeedback(intentId, outcome,
notes), which reports outcomes against the download intent created when a case
is downloaded for application. The prior recordApplicationResult/confirmCase/
refuteCase surface (keyed to a bare case ID) is removed in favor of this single
path, matching how the Cases API actually links reputation to download intents.

Also fixes recordDownloadFeedback and the GitHub Action's entrypoint accepting
"non_responsive" as a caller-supplied outcome: the Cases API's outcome alias
map (atvp-feedback-gateway.js) has no such entry, so every call using it would
have failed. That state is detected automatically by the server on deadline
timeout, not reported by a caller. Valid outcomes are now confirm, refute,
derive, and rollback, matching the server exactly.

Verified end-to-end: registered a real user, created a real API key, downloaded
a real case bundle to create a download intent, then ran the GitHub Action's
entrypoint.mjs (using the published @querykey-research/atvp-client package)
against a local server — feedback was recorded successfully. 38/38 unit tests
pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: RellWilson

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to @querykey/atvp-client
+# Contributing to @querykey-research/atvp-client
 
 Thank you for your interest in contributing to the official ATVP client SDK.
 

README.md

@@ -1,4 +1,4 @@
-# @querykey/atvp-client
+# @querykey-research/atvp-client
 
 Official Node.js client for the **Automated Trust and Verification Protocol (ATVP)**.
 
@@ -9,13 +9,13 @@ ATVP is the trust layer that ensures every case submitted to QueryKey Cases has
 ## Install
 
 ```bash
-npm install @querykey/atvp-client
+npm install @querykey-research/atvp-client
 ```
 
 ## Quick Start
 
 ```js
-import { AtvpClient } from '@querykey/atvp-client';
+import { AtvpClient } from '@querykey-research/atvp-client';
 
 const client = new AtvpClient({
   apiKey: process.env.QUERYKEY_API_KEY,
@@ -93,50 +93,26 @@ Publishes a case. `evidence` must be an object with:
 
 Boolean flags are **rejected**. `exitCode` must be exactly `0`.
 
-### `client.cases.feedback(caseId, { feedback_type, outcome, reasoning })`
-
-Records feedback (REFUTE, ROLLBACK, etc.).
-
-### `client.feedback.recordApplicationResult(caseId, result, notes?, evidence?)`
+### `client.feedback.recordDownloadFeedback(intentId, outcome, notes?)`
 
-Closes the feedback loop by recording whether a fix succeeded or failed after deployment.
+Records post-application feedback. In ATVP, application feedback is keyed to a
+**download intent**: an actor downloads a published case (creating an intent),
+applies the fix, and reports the outcome against that intent — this is what
+drives the downloader's reputation. There is no bare per-case feedback endpoint;
+positive verification at publish time goes through `client.cases.confirm()` with
+evidence.
 
-`result` must be one of: `'success'`, `'failure'`, `'partial'`, `'rolled_back'`.
+- `outcome`: `'confirm'` | `'refute'` | `'non_responsive'`
 
 ```js
-// After staging deploy passes
-await client.feedback.recordApplicationResult(
-  caseId,
-  'success',
-  'Smoke tests passed on staging',
-  { command: 'bash scripts/check.sh', exitCode: 0, output: 'PASS' }
-);
-
-// After production rollback
-await client.feedback.recordApplicationResult(
-  caseId,
-  'rolled_back',
-  'Fix caused regression in billing service — reverted in hotfix #4821'
+// After applying a downloaded fix and verifying it
+await client.feedback.recordDownloadFeedback(
+  intentId,
+  'confirm',
+  'Smoke tests passed on staging'
 );
 ```
 
-### `client.feedback.confirmCase(caseId, evidence, notes?)`
-
-Shortcut for `recordApplicationResult(caseId, 'success', notes, evidence)`.
-
-### `client.feedback.refuteCase(caseId, reasoning)`
-
-Shortcut for `recordApplicationResult(caseId, 'failure', reasoning)`.
-
-### `client.feedback.recordRollback(caseId, reasoning?)`
-
-Shortcut for `recordApplicationResult(caseId, 'rolled_back', reasoning)`.
-
-### `client.feedback.recordDownloadFeedback(intentId, outcome, notes?)`
-
-Records feedback on a download intent after the 72-hour window:
-- `outcome`: `'confirm'` | `'refute'` | `'non_responsive'`
-
 ### `client.feedback.deriveOnRecurrence(originalCaseId, newPayload, sessionId?)`
 
 Creates a derived case when a published error signature reappears. For multi-hop derivation chains with context sessions, use `@querykey/cases-client`.
@@ -166,7 +142,7 @@ Runs a shell command and returns an evidence object `{ command, exitCode, output
 All SDK methods throw `AtvpError` on failure:
 
 ```js
-import { AtvpError } from '@querykey/atvp-client';
+import { AtvpError } from '@querykey-research/atvp-client';
 
 try {
   await client.cases.confirm(caseId, badEvidence);

docs/github-action/README.md

@@ -2,6 +2,8 @@
 
 GitHub Action to record the outcome of a fix application to the [QueryKey Cases](https://www.querykey.com) ATVP ledger.
 
+In ATVP, application feedback is keyed to a **download intent** — the intent created when an agent downloads a published case to apply it. This action records the outcome against that intent.
+
 ## Usage
 
 Add this step after your deployment to record whether the fix held:
@@ -11,43 +13,32 @@ Add this step after your deployment to record whether the fix held:
   uses: querykey/record-fix-action@v1
   with:
     api_key: ${{ secrets.QUERYKEY_API_KEY }}
-    case_id: ${{ env.CASE_ID }}
-    result: success
+    intent_id: ${{ env.ATVP_INTENT_ID }}
+    outcome: confirm
     notes: "Deployed to production, smoke tests passed"
-    evidence_command: "bash scripts/check.sh"
 ```
 
 ## Inputs
 
 | Input | Required | Default | Description |
 | :--- | :--- | :--- | :--- |
 | `api_key` | **Yes** | — | QueryKey API key |
-| `case_id` | **Yes** | — | ATVP case ID to record feedback for |
-| `result` | No | `success` | Outcome: `success`, `failure`, `partial`, `rolled_back` |
+| `intent_id` | **Yes** | — | ATVP download intent ID (created when the case was downloaded) |
+| `outcome` | No | `confirm` | Outcome: `confirm`, `refute`, or `non_responsive` |
 | `notes` | No | — | Human-readable notes |
-| `evidence_command` | No | — | Shell command to capture structured evidence |
 | `querykey_base_url` | No | `https://www.querykey.com` | QueryKey API base URL |
 
-## Result Values
-
-- `success` — Fix resolved the issue
-- `failure` — Fix did not resolve the issue or caused regressions
-- `partial` — Fix partially resolved the issue
-- `rolled_back` — Fix was rolled back
-
-## Evidence Command
-
-If provided, the action runs the shell command and captures:
-- `command` — the command that was run
-- `exitCode` — 0 for success, non-zero for failure
-- `output` — stdout/stderr of the command
+## Outcome Values
 
-This structured evidence is attached to the feedback record in the ATVP ledger.
+- `confirm` — Fix resolved the issue; counts toward case verification
+- `refute` — Fix did not resolve the issue; resets case verification
+- `non_responsive` — Unable to determine outcome (e.g. could not run validation)
 
 ## Requirements
 
 - Node.js 20+ (GitHub Actions `node20` runtime)
 - A QueryKey API key with feedback permissions
+- A download intent ID — obtain one by downloading a case via the API before applying the fix
 
 ## License
 

docs/github-action/action.yml

@@ -9,21 +9,17 @@ inputs:
   api_key:
     description: 'QueryKey API key'
     required: true
-  case_id:
-    description: 'The ATVP case ID to record feedback for'
+  intent_id:
+    description: 'The ATVP download intent ID created when the case was downloaded for application'
     required: true
-  result:
-    description: 'Outcome of the fix application: success, failure, partial, or rolled_back'
+  outcome:
+    description: 'Outcome of the fix application: confirm (worked), refute (failed), derive (needed changes), or rollback (had to revert)'
     required: true
-    default: 'success'
+    default: 'confirm'
   notes:
     description: 'Optional human-readable notes about the outcome'
     required: false
     default: ''
-  evidence_command:
-    description: 'Shell command to run for structured evidence (e.g. "bash scripts/check.sh")'
-    required: false
-    default: ''
   querykey_base_url:
     description: 'QueryKey API base URL'
     required: false

docs/github-action/entrypoint.mjs

@@ -2,44 +2,44 @@
 /**
  * @file entrypoint.mjs
  * @description GitHub Action entrypoint for recording ATVP fix outcomes.
- * Uses @querykey/atvp-client to send feedback to the Cases ledger.
+ * Uses @querykey-research/atvp-client to send feedback to the Cases ledger.
+ *
+ * Feedback is keyed to a download intent, not a case ID.
+ * The intent ID is created when an agent downloads a published case to apply it.
  */
 
-import { AtvpClient } from '@querykey/atvp-client';
+import { AtvpClient } from '@querykey-research/atvp-client';
+
+// Must match FeedbackLoop.recordDownloadFeedback's validOutcomes in the SDK.
+// "non_responsive" is excluded: the server detects that state automatically
+// on deadline timeout — it is not a caller-reported outcome.
+const VALID_OUTCOMES = ['confirm', 'refute', 'derive', 'rollback'];
 
 async function main() {
   const apiKey = process.env.INPUT_API_KEY;
-  const caseId = process.env.INPUT_CASE_ID;
-  const result = process.env.INPUT_RESULT || 'success';
+  const intentId = process.env.INPUT_INTENT_ID;
+  const outcome = process.env.INPUT_OUTCOME || 'confirm';
   const notes = process.env.INPUT_NOTES || '';
-  const evidenceCommand = process.env.INPUT_EVIDENCE_COMMAND || '';
   const baseUrl = process.env.INPUT_QUERYKEY_BASE_URL || 'https://www.querykey.com';
 
   if (!apiKey) {
     console.error('::error::Input api_key is required');
     process.exit(1);
   }
-  if (!caseId) {
-    console.error('::error::Input case_id is required');
+  if (!intentId) {
+    console.error('::error::Input intent_id is required (the download intent ID, not the case ID)');
+    process.exit(1);
+  }
+  if (!VALID_OUTCOMES.includes(outcome)) {
+    console.error(`::error::Input outcome must be one of: ${VALID_OUTCOMES.join(', ')} — got "${outcome}"`);
     process.exit(1);
   }
 
   const client = new AtvpClient({ apiKey, baseUrl });
 
-  let evidence;
-  if (evidenceCommand) {
-    const { execSync } = await import('node:child_process');
-    try {
-      const output = execSync(evidenceCommand, { encoding: 'utf-8', timeout: 120000 });
-      evidence = { command: evidenceCommand, exitCode: 0, output: output.trim() };
-    } catch (err) {
-      evidence = { command: evidenceCommand, exitCode: err.status || 1, output: (err.stdout || err.stderr || err.message).trim() };
-    }
-  }
-
   try {
-    const feedback = await client.feedback.recordApplicationResult(caseId, result, notes, evidence);
-    console.log(`::notice::ATVP feedback recorded for case ${caseId}: ${result}`);
+    const feedback = await client.feedback.recordDownloadFeedback(intentId, outcome, notes || undefined);
+    console.log(`::notice::ATVP feedback recorded for intent ${intentId}: ${outcome}`);
     console.log(JSON.stringify(feedback, null, 2));
   } catch (err) {
     console.error(`::error::Failed to record ATVP feedback: ${err.message}`);

package.json

@@ -4,6 +4,11 @@
   "description": "Official Node.js client for the Automated Trust and Verification Protocol (ATVP)",
   "main": "src/index.js",
   "type": "module",
+  "files": [
+    "src",
+    "docs/github-action",
+    "README.md"
+  ],
   "scripts": {
     "test": "node --test test/*.test.js",
     "lint": "eslint src/ test/",

src/AtvpClient.js

@@ -4,7 +4,7 @@
  * Composes HttpTransport, AgentRegistration, CaseFlow, EvidenceGate, and FeedbackLoop.
  *
  * Usage:
- *   import { AtvpClient } from '@querykey/atvp-client';
+ *   import { AtvpClient } from '@querykey-research/atvp-client';
  *   const client = new AtvpClient({ apiKey, baseUrl });
  *   const { caseId } = await client.submitVerifiedFix({ ... });
  */

src/CaseFlow.js

@@ -38,7 +38,10 @@ export class CaseFlow {
     if (!payload.title) throw new AtvpError('title is required', { step: 'create' });
     if (!payload.error_signature) throw new AtvpError('error_signature is required', { step: 'create' });
 
+    // Spread caller-provided fields first so the explicit keys below always win
+    // (prevents an absent payload.body from clobbering the computed default).
     const body = {
+      ...payload,
       title: payload.title,
       summary: payload.summary ?? payload.title,
       body: payload.body ?? {
@@ -47,9 +50,10 @@ export class CaseFlow {
         error_signature: payload.error_signature,
         ecosystem: payload.ecosystem ?? 'unknown',
         root_cause: payload.root_cause ?? '',
-        context_tags: payload.context_tags ?? { environments: ['production'], domains: ['cases-api'] },
+        metadata: {
+          context_tags: payload.context_tags ?? { environments: ['production'], domains: ['cases-api'] },
+        },
       },
-      ...payload,
     };
 
     return this.transport.post('/api/v1/cases', body);
@@ -164,32 +168,6 @@ export class CaseFlow {
     };
   }
 
-  /**
-   * Feedback — record a REFUTE, ROLLBACK, or other feedback outcome.
-   *
-   * @param {string} caseId
-   * @param {Object} feedback
-   * @param {string} feedback.feedback_type   — 'REFUTE', 'CONFIRM', 'ROLLBACK'
-   * @param {string} feedback.outcome         — FEEDBACK_OUTCOME value
-   * @param {string} feedback.reasoning       — human-readable reasoning
-   * @param {string} [feedback.ownership]     — FEEDBACK_OWNERSHIP value
-   * @returns {Promise<Object>} feedback record
-   */
-  async feedback(caseId, { feedback_type, outcome, reasoning, ownership = 'FEEDBACK_OWNERSHIP' }) {
-    if (!caseId) throw new AtvpError('caseId is required', { step: 'feedback' });
-    if (!feedback_type) throw new AtvpError('feedback_type is required', { step: 'feedback' });
-
-    const body = {
-      case_id: caseId,
-      feedback_type,
-      outcome: outcome ?? 'FEEDBACK_OUTCOME',
-      reasoning: reasoning ?? '',
-      ownership,
-    };
-
-    return this.transport.post(`/api/v1/cases/${caseId}/feedback`, body);
-  }
-
   /**
    * Derive a linked follow-on case (recurrence).
    *