@abelxiaoxing/cadence 1.5.3 → 1.7.0

package/src/plan-draft-summary.ts

@@ -1,6 +1,12 @@
-import { isValidRelativePath } from "./contracts.ts";
-import type { ImplementPlan } from "./implement-plan.ts";
+import { compareCanonicalStrings } from "./canonical.ts";
+import {
+  isValidRelativePath,
+  LIMITS,
+  verificationInputPaths,
+} from "./contracts.ts";
+import type { ImplementPlan, PlanTaskDraft } from "./implement-plan.ts";
 import { expandSingleTaskDraft } from "./single-task-draft.ts";
+import { declarationPathsConflict, taskConflicts } from "./workflow-policy.ts";
 
 /** Review data only: no executable callbacks, evidence cache or approval authority. */
 function record(value: unknown): Record<string, unknown> {
@@ -8,12 +14,156 @@ function record(value: unknown): Record<string, unknown> {
     ? (value as Record<string, unknown>)
     : {};
 }
+
+type SerializationCause =
+  | {
+      kind: "producer-output" | "declared-dependency";
+      waitingTaskId: string;
+      dependencyTaskId: string;
+      outputIds: string[];
+    }
+  | { kind: "declared-task-conflict" }
+  | { kind: "declared-resource"; resources: string[] }
+  | {
+      kind: "shared-writes";
+      paths: Array<{ left: string; right: string }>;
+    }
+  | {
+      kind: "shared-write-read";
+      paths: Array<{ writer: string; reader: string }>;
+    }
+  | { kind: "verification-lock"; locks: string[] }
+  | { kind: "agents-target"; targets: string[] };
+
+function taskAncestors(
+  taskId: string,
+  tasks: ReadonlyMap<string, PlanTaskDraft>,
+): Set<string> {
+  const ancestors = new Set<string>();
+  const pending = [...(tasks.get(taskId)?.dependsOn ?? [])];
+  while (pending.length > 0) {
+    const dependency = pending.pop() as string;
+    if (ancestors.has(dependency)) continue;
+    ancestors.add(dependency);
+    pending.push(...(tasks.get(dependency)?.dependsOn ?? []));
+  }
+  return ancestors;
+}
+
+function declarations(task: PlanTaskDraft) {
+  const reads = new Set<string>();
+  const writes = new Set<string>();
+  const locks = new Set<string>();
+  for (const phase of Object.values(task.phases)) {
+    for (const entry of phase.read) reads.add(entry);
+    for (const entry of phase.write) writes.add(entry);
+    for (const entry of phase.delete) writes.add(entry);
+    if (phase.verificationLock) locks.add(phase.verificationLock);
+  }
+  return {
+    reads: [...reads].sort(compareCanonicalStrings),
+    writes: [...writes].sort(compareCanonicalStrings),
+    locks: [...locks].sort(compareCanonicalStrings),
+  };
+}
+
+function conflictingPathPairs(
+  left: readonly string[],
+  right: readonly string[],
+): Array<{ left: string; right: string }> {
+  return left.flatMap((leftPath) =>
+    right.flatMap((rightPath) =>
+      declarationPathsConflict(leftPath, rightPath)
+        ? [{ left: leftPath, right: rightPath }]
+        : [],
+    ),
+  );
+}
+
+function conflictCauses(
+  left: PlanTaskDraft,
+  right: PlanTaskDraft,
+  truncate: () => void,
+): SerializationCause[] {
+  const causes: SerializationCause[] = [];
+  if (
+    left.scheduling.conflicts.includes(right.taskId) ||
+    right.scheduling.conflicts.includes(left.taskId)
+  ) {
+    causes.push({ kind: "declared-task-conflict" });
+  }
+  const resources = left.scheduling.resources
+    .filter((resource) => right.scheduling.resources.includes(resource))
+    .sort(compareCanonicalStrings);
+  if (resources.length > 8) truncate();
+  if (resources.length > 0) {
+    causes.push({
+      kind: "declared-resource",
+      resources: resources.slice(0, 8),
+    });
+  }
+
+  const leftDeclarations = declarations(left);
+  const rightDeclarations = declarations(right);
+  const sharedWrites = conflictingPathPairs(
+    leftDeclarations.writes,
+    rightDeclarations.writes,
+  );
+  const leftWriteReads = conflictingPathPairs(
+    leftDeclarations.writes,
+    rightDeclarations.reads,
+  );
+  const rightWriteReads = conflictingPathPairs(
+    rightDeclarations.writes,
+    leftDeclarations.reads,
+  ).map(({ left: writer, right: reader }) => ({ writer, reader }));
+  if (sharedWrites.length > 8) truncate();
+  if (sharedWrites.length > 0) {
+    causes.push({ kind: "shared-writes", paths: sharedWrites.slice(0, 8) });
+  }
+  const writeReads = [
+    ...leftWriteReads.map(({ left: writer, right: reader }) => ({
+      writer,
+      reader,
+    })),
+    ...rightWriteReads,
+  ];
+  if (writeReads.length > 8) truncate();
+  if (writeReads.length > 0) {
+    causes.push({
+      kind: "shared-write-read",
+      paths: writeReads.slice(0, 8),
+    });
+  }
+  if (
+    left.agents.impact !== "none" &&
+    right.agents.impact !== "none" &&
+    left.agents.target &&
+    left.agents.target === right.agents.target
+  ) {
+    causes.push({ kind: "agents-target", targets: [left.agents.target] });
+  }
+  const locks = leftDeclarations.locks
+    .filter((lock) => rightDeclarations.locks.includes(lock))
+    .sort(compareCanonicalStrings);
+  if (locks.length > 8) truncate();
+  if (locks.length > 0) {
+    causes.push({ kind: "verification-lock", locks: locks.slice(0, 8) });
+  }
+  return causes;
+}
 export function planAuthoringSummary(
   plan: ImplementPlan,
   authoredDraft?: unknown,
 ) {
   const quick = record(authoredDraft).singleTask !== undefined;
   const authored = record(expandSingleTaskDraft(authoredDraft));
+  const authoredTask = (taskId: string) =>
+    record(
+      Array.isArray(authored.tasks)
+        ? authored.tasks.find((item) => record(item).taskId === taskId)
+        : undefined,
+    );
   const derivations: Array<{ field: string; source: string; taskId?: string }> =
     [];
   let derivationsTruncated = false;
@@ -30,11 +180,17 @@ export function planAuthoringSummary(
     if (plan.changeContract && !Object.hasOwn(authored, "changeContract"))
       derived("changeContract", "approved-gate-a");
     for (const task of plan.tasks) {
-      const input = record(
-        Array.isArray(authored.tasks)
-          ? authored.tasks.find((item) => record(item).taskId === task.taskId)
-          : undefined,
-      );
+      const input = authoredTask(task.taskId);
+      if (
+        task.baselineVerification &&
+        !Object.hasOwn(input, "baselineVerification")
+      ) {
+        derived(
+          "baselineVerification",
+          "affected-safe-original-inputs",
+          task.taskId,
+        );
+      }
       for (const [phase, boundary] of Object.entries(task.phases)) {
         const phaseInput = record(record(input.phases)[phase]);
         if (!Object.hasOwn(phaseInput, "verificationInputs"))
@@ -112,8 +268,21 @@ export function planAuthoringSummary(
       classification: boundary.verification.classification,
       verificationInputs: boundary.verificationInputs.slice(0, 32),
     })),
+    baselineVerification: task.baselineVerification?.id ?? null,
     affectedVerification: task.affectedVerification.id,
     repairVerification: task.repairVerification.id,
+    verificationSources: {
+      baseline:
+        authoredDraft === undefined
+          ? "compiled-plan"
+          : Object.hasOwn(authoredTask(task.taskId), "baselineVerification")
+            ? "author-input"
+            : task.baselineVerification
+              ? "affected-safe-original-inputs"
+              : "retained-legacy",
+      affected: authoredDraft === undefined ? "compiled-plan" : "author-input",
+      repair: authoredDraft === undefined ? "compiled-plan" : "author-input",
+    },
     agentsImpact: task.agents.impact,
   }));
   if (
@@ -126,8 +295,216 @@ export function planAuthoringSummary(
     )
   )
     truncated = true;
+
+  const projectedTasks = [...plan.tasks]
+    .sort((left, right) => compareCanonicalStrings(left.taskId, right.taskId))
+    .slice(0, 16);
+  const tasksById = new Map(plan.tasks.map((task) => [task.taskId, task]));
+  const ancestors = new Map(
+    plan.tasks.map((task) => [
+      task.taskId,
+      taskAncestors(task.taskId, tasksById),
+    ]),
+  );
+  const outputsById = new Map(
+    plan.outputs.map((output) => [output.id, output]),
+  );
+  const consumedOutputsByTask = new Map<string, string[]>();
+  const consumedOutputIds = (task: PlanTaskDraft) => {
+    const cached = consumedOutputsByTask.get(task.taskId);
+    if (cached) return cached;
+    const ids = new Set(
+      Object.values(task.phases).flatMap((phase) =>
+        phase.verificationInputs.flatMap((binding) =>
+          binding.kind === "output" ? [binding.outputId] : [],
+        ),
+      ),
+    );
+    const finalInputs = new Set([
+      ...verificationInputPaths(task.affectedVerification),
+      ...verificationInputPaths(task.repairVerification),
+    ]);
+    for (const output of plan.outputs) {
+      if (finalInputs.has(output.path)) ids.add(output.id);
+    }
+    const consumed = [...ids].sort(compareCanonicalStrings);
+    consumedOutputsByTask.set(task.taskId, consumed);
+    return consumed;
+  };
+  const dependencyCause = (
+    waitingTask: PlanTaskDraft,
+    dependencyTaskId: string,
+  ): Extract<
+    SerializationCause,
+    { kind: "producer-output" | "declared-dependency" }
+  > => {
+    const outputIds = consumedOutputIds(waitingTask).filter(
+      (outputId) =>
+        outputsById.get(outputId)?.producer.taskId === dependencyTaskId,
+    );
+    if (outputIds.length > 16) truncated = true;
+    return {
+      kind: outputIds.length > 0 ? "producer-output" : "declared-dependency",
+      waitingTaskId: waitingTask.taskId,
+      dependencyTaskId,
+      outputIds: outputIds.slice(0, 16),
+    };
+  };
+  const waiting: Array<{
+    taskId: string;
+    dependencyTaskId: string;
+    reason: "producer-output" | "declared-dependency";
+    outputIds: string[];
+  }> = [];
+  for (const task of projectedTasks) {
+    for (const dependencyTaskId of [...task.dependsOn].sort(
+      compareCanonicalStrings,
+    )) {
+      if (waiting.length >= 128) {
+        truncated = true;
+        break;
+      }
+      const cause = dependencyCause(task, dependencyTaskId);
+      waiting.push({
+        taskId: task.taskId,
+        dependencyTaskId,
+        reason: cause.kind,
+        outputIds: cause.outputIds,
+      });
+    }
+  }
+  const staticEligiblePairs: Array<{ taskIds: [string, string] }> = [];
+  const serializations: Array<{
+    taskIds: [string, string];
+    causes: SerializationCause[];
+  }> = [];
+  for (const [index, left] of projectedTasks.entries()) {
+    for (const right of projectedTasks.slice(index + 1)) {
+      const leftWaits = ancestors.get(left.taskId)?.has(right.taskId) ?? false;
+      const rightWaits = ancestors.get(right.taskId)?.has(left.taskId) ?? false;
+      const conflict = taskConflicts(left, right);
+      if (
+        !leftWaits &&
+        !rightWaits &&
+        !conflict.taskLifetime &&
+        !conflict.verification
+      ) {
+        if (staticEligiblePairs.length < 64) {
+          staticEligiblePairs.push({ taskIds: [left.taskId, right.taskId] });
+        } else {
+          truncated = true;
+        }
+        continue;
+      }
+      const causes: SerializationCause[] = [];
+      if (leftWaits) causes.push(dependencyCause(left, right.taskId));
+      if (rightWaits) causes.push(dependencyCause(right, left.taskId));
+      if (conflict.taskLifetime || conflict.verification) {
+        causes.push(...conflictCauses(left, right, () => (truncated = true)));
+      }
+      if (serializations.length < 64) {
+        serializations.push({ taskIds: [left.taskId, right.taskId], causes });
+      } else {
+        truncated = true;
+      }
+    }
+  }
+  const initiallyEligibleTasks = projectedTasks.filter(
+    (task) => task.dependsOn.length === 0,
+  );
+  const initiallyRunnableTasks: PlanTaskDraft[] = [];
+  for (const task of initiallyEligibleTasks) {
+    if (initiallyRunnableTasks.length >= LIMITS.maxActiveChildSessions) break;
+    if (
+      initiallyRunnableTasks.some((selected) => {
+        const conflict = taskConflicts(task, selected);
+        return conflict.taskLifetime || conflict.verification;
+      })
+    ) {
+      continue;
+    }
+    initiallyRunnableTasks.push(task);
+  }
+  const checkpoint = plan.verification.agentsCheckpoint;
+  const bounded = (values: readonly string[]) => {
+    if (values.length > 32) truncated = true;
+    return values.slice(0, 32);
+  };
+  const contract = plan.changeContract;
+  // Review the outer recovery envelope as well as the initial task paths.
+  // This projection never grants authority or certifies runtime readiness.
+  const implementation = {
+    authority: "review-only" as const,
+    decisionOwner: "parent" as const,
+    userDecisionStage: "abel-design" as const,
+    policySource: contract
+      ? ("structured-change-contract" as const)
+      : ("retained-legacy-boundaries" as const),
+    acceptanceIds: bounded(contract?.acceptance.map((entry) => entry.id) ?? []),
+    constraintIds: bounded(
+      contract?.constraints.map((entry) => entry.id) ?? [],
+    ),
+    amendmentPolicy: contract
+      ? {
+          writeRoots: bounded(contract.policy.writeRoots),
+          dependencies: bounded(contract.policy.dependencies),
+          verificationModes: [...contract.policy.verificationModes],
+        }
+      : null,
+    recovery: {
+      strategy: "repair-replan-resume" as const,
+      preservesAcceptance: true,
+      preservesConsumedBudget: true,
+    },
+    runtimePrerequisites: "not-assessed" as const,
+  };
   return {
     tasks,
+    implementation,
+    parallelism: {
+      assessment: "static-plan" as const,
+      authority: "review-only" as const,
+      runtimePrerequisites: "not-assessed" as const,
+      initiallyEligibleScope: "individual-dependency-free" as const,
+      initiallyEligible: initiallyEligibleTasks.map((task) => task.taskId),
+      initiallyRunnableGroup: {
+        taskIds: initiallyRunnableTasks.map((task) => task.taskId),
+        maximumSize: LIMITS.maxActiveChildSessions,
+        basis: "dependency-free-task-conflict-policy" as const,
+        capacityAssumption: "all-shared-slots-available" as const,
+      },
+      staticEligiblePairsScope: "eventual-compatibility" as const,
+      staticEligiblePairs,
+      waiting,
+      serializations,
+      globalBarriers: [
+        {
+          kind: "cumulative-verification" as const,
+          required: true,
+          verificationId: plan.verification.change.fullSuite.id,
+          requires: ["all-tasks-verified" as const],
+          taskIds: projectedTasks.map((task) => task.taskId),
+        },
+        {
+          kind: "agents-checkpoint" as const,
+          required: checkpoint.required,
+          verificationId: checkpoint.verification?.id ?? null,
+          requires: ["cumulative-verification" as const],
+        },
+        {
+          kind: "post-apply-verification" as const,
+          required: true,
+          verificationId: plan.verification.change.postApply.id,
+          requires: [
+            "cumulative-verification" as const,
+            ...(checkpoint.required
+              ? (["agents-checkpoint" as const] as const)
+              : []),
+            "transactional-apply" as const,
+          ],
+        },
+      ],
+    },
     recovery: {
       artifactCorrection: plan.verification.artifactCorrection.maxAttempts,
       repair: plan.verification.repair.maxAttempts,
@@ -141,6 +518,7 @@ export function planAuthoringSummary(
     derivationRules: [
       "tracking:task-ids",
       "verificationInputs:contract-and-declared-outputs",
+      "baselineVerification:affected-safe-original-inputs",
       "relatedTests:declared-writers",
       "verification-identities:stable-task-and-purpose",
     ],

package/src/plan-draft.ts

@@ -53,6 +53,7 @@ export interface PlanTaskInput
     PlanTaskDraft,
     | "phases"
     | "impactClosure"
+    | "baselineVerification"
     | "affectedVerification"
     | "repairVerification"
     | "agents"
@@ -64,6 +65,7 @@ export interface PlanTaskInput
     refactor?: PlanPhaseDraft;
   };
   affectedVerification: DraftVerification;
+  baselineVerification?: DraftVerification;
   repairVerification: DraftVerification;
   agents: Omit<PlanTaskDraft["agents"], "managedOnly"> & { managedOnly?: true };
   impactClosure: Omit<PlanTaskDraft["impactClosure"], "relatedTests"> & {
@@ -324,6 +326,13 @@ export function expandPlanDraft(value: unknown): unknown {
       }
     for (const field of ["affectedVerification", "repairVerification"])
       task[field] = expand(task[field], field, "expected-green", taskId);
+    if (task.baselineVerification !== undefined)
+      task.baselineVerification = expand(
+        task.baselineVerification,
+        "baselineVerification",
+        "expected-green",
+        taskId,
+      );
   }
   if (isRecord(draft.verification)) {
     const verification = draft.verification;

package/src/run-store.ts

@@ -17,7 +17,10 @@ import {
   type ResolvedStateRoot,
   StateRootError,
 } from "./state-root.ts";
-import { RUN_SCHEMA as SCHEMA } from "./storage-schema.ts";
+import {
+  LEGACY_RUN_SCHEMA_V2,
+  RUN_SCHEMA as SCHEMA,
+} from "./storage-schema.ts";
 
 export class RunStoreFormatError extends Error {
   readonly code = "run-store-reset-required" as const;
@@ -115,7 +118,10 @@ function requireIdentifier(value: string, label: string): void {
   if (!IDENTIFIER.test(value)) throw new Error(`invalid-${label}`);
 }
 
-const LEGACY_SCHEMA_VERSION = 4;
+const LEGACY_SCHEMA_VERSIONS = new Map([
+  [2, LEGACY_RUN_SCHEMA_V2],
+  [4, SCHEMA],
+]);
 
 function applicationTables(database: DatabaseSync): string[] {
   return (
@@ -153,25 +159,35 @@ function hasCurrentSchema(
   );
 }
 
-function isSupportedLegacySchema(
+function supportedLegacyVersion(
   database: DatabaseSync,
   tables: readonly string[],
-): boolean {
+): number | undefined {
   if (
     !tables.includes("schema_meta") ||
-    !hasRequiredCoreSchema(database, tables) ||
     tableColumns(database, "schema_meta").join("\0") !== "version"
   ) {
-    return false;
+    return undefined;
   }
   const rows = database
     .prepare("SELECT version FROM schema_meta")
     .all() as unknown as Array<{
     version: number;
   }>;
-  return (
-    rows.length === 1 && Number(rows[0]?.version) === LEGACY_SCHEMA_VERSION
-  );
+  if (rows.length !== 1) return undefined;
+  const version = rows[0]?.version;
+  const schema = LEGACY_SCHEMA_VERSIONS.get(version);
+  if (!schema || !matchesSqliteSchema(database, schema)) return undefined;
+  // A v2 database cannot already contain any proof fields. Do not repair a
+  // partial/ambiguous upgrade or reinterpret malformed fields as authority.
+  if (
+    version === 2 &&
+    tableColumns(database, "delivery_bindings").some((column) =>
+      ["approval_revision", "contract_hash", "record_hash"].includes(column),
+    )
+  )
+    return undefined;
+  return version;
 }
 
 function isSqliteLocked(error: unknown): boolean {
@@ -210,7 +226,7 @@ function ensureCurrentSchema(
   const initialTables = applicationTables(database);
   if (hasCurrentSchema(database, initialTables)) return;
   let transactionStarted = false;
-  let migrating = false;
+  let migrating: number | undefined;
   try {
     database.exec("BEGIN IMMEDIATE");
     transactionStarted = true;
@@ -219,11 +235,19 @@ function ensureCurrentSchema(
       database.exec(SCHEMA);
     } else if (hasCurrentSchema(database, tables)) {
       // Another opener may already have completed the same migration.
-    } else if (isSupportedLegacySchema(database, tables)) {
-      migrating = true;
-      database.exec("DROP TABLE schema_meta");
     } else {
-      throw new RunStoreFormatError(databasePath);
+      migrating = supportedLegacyVersion(database, tables);
+      if (migrating === undefined) throw new RunStoreFormatError(databasePath);
+      if (migrating === 2) {
+        database.exec(`
+          ALTER TABLE delivery_bindings ADD COLUMN approval_revision INTEGER;
+          ALTER TABLE delivery_bindings ADD COLUMN contract_hash TEXT;
+          ALTER TABLE delivery_bindings ADD COLUMN record_hash TEXT;
+        `);
+      }
+      if (!hasRequiredCoreSchema(database, tables))
+        throw new RunStoreFormatError(databasePath);
+      database.exec("DROP TABLE schema_meta");
     }
     database.exec("COMMIT");
   } catch (error) {
@@ -242,7 +266,7 @@ function ensureCurrentSchema(
       throw error;
     }
     if (migrating) {
-      throw new RunStoreMigrationError(LEGACY_SCHEMA_VERSION, error);
+      throw new RunStoreMigrationError(migrating, error);
     }
     throw error;
   }

package/src/storage-schema.ts

@@ -7,8 +7,14 @@ export const ROUTE_HEALTH_SCHEMA = `
   ) STRICT;
 `;
 
-/** Owner-private storage contracts. Migrations run atomically before use. */
-export const RUN_SCHEMA = `
+/** v2 predates proof-bound delivery receipts; migration must not invent proof. */
+const DELIVERY_PROOF_COLUMNS = `
+    approval_revision INTEGER,
+    contract_hash TEXT,
+    record_hash TEXT,`;
+
+function runSchema(withDeliveryProof: boolean): string {
+  return `
   CREATE TABLE IF NOT EXISTS runs (
     run_id TEXT PRIMARY KEY,
     root_hash TEXT NOT NULL,
@@ -29,10 +35,7 @@ export const RUN_SCHEMA = `
     run_id TEXT NOT NULL REFERENCES runs(run_id) ON DELETE CASCADE,
     gate TEXT NOT NULL,
     revision INTEGER NOT NULL,
-    receipt_hash TEXT NOT NULL,
-    approval_revision INTEGER,
-    contract_hash TEXT,
-    record_hash TEXT,
+    receipt_hash TEXT NOT NULL,${withDeliveryProof ? DELIVERY_PROOF_COLUMNS : ""}
     operation_id TEXT NOT NULL,
     PRIMARY KEY (run_id, gate, revision),
     UNIQUE (run_id, operation_id)
@@ -102,6 +105,11 @@ ${ROUTE_HEALTH_SCHEMA}
     facts_json TEXT NOT NULL
   ) STRICT;
 `;
+}
+
+/** Owner-private storage contracts. Migrations run atomically before use. */
+export const RUN_SCHEMA = runSchema(true);
+export const LEGACY_RUN_SCHEMA_V2 = runSchema(false);
 
 export const DESIGN_SCHEMA = `
   CREATE TABLE IF NOT EXISTS design_facts (

package/src/subagent-activity.ts

@@ -501,7 +501,9 @@ function hasAutomaticContinuation(result: Record<string, unknown>): boolean {
     asRecord(result.pause)?.code !== "operation-cancelled" &&
     continuation?.owner === "parent" &&
     continuation.automatic === true &&
-    (continuation.action === "amend" || continuation.command === "resume")
+    (continuation.action === "amend" ||
+      continuation.command === "resume" ||
+      continuation.kind === "inspect-recovery")
   );
 }
 

package/src/verification-capability.ts

@@ -11,6 +11,7 @@ import {
   type StructuredVerificationContract,
   VERIFICATION_CONFIGURATION_PATHS,
   type VerificationAdapterCode,
+  type VerificationInputObservation,
   validateVerificationContract,
   verificationBoundInputPaths,
   verificationInputPaths,
@@ -23,7 +24,7 @@ import {
   snapshotFile,
   snapshotFiles,
 } from "./file-snapshot.ts";
-import { isSafeRegularFile, observeSafePath } from "./safe-path.ts";
+import { observeSafePath } from "./safe-path.ts";
 import { verificationEnvironmentDigest } from "./verification-identity.ts";
 
 export type VerificationCapabilityDiagnostic =
@@ -38,6 +39,7 @@ export type VerificationCapabilityDiagnostic =
       code: VerificationAdapterCode;
       verificationId: string;
       message: string;
+      inputObservation?: VerificationInputObservation;
     };
 
 export type VerificationCapabilityResult =
@@ -118,10 +120,17 @@ function adapterFailure(
   verificationId: string,
   code: VerificationAdapterCode,
   message: string,
+  inputObservation?: VerificationInputObservation,
 ): VerificationCapabilityResult {
   return {
     ok: false,
-    diagnostic: { kind: "verification-adapter", code, verificationId, message },
+    diagnostic: {
+      kind: "verification-adapter",
+      code,
+      verificationId,
+      message,
+      ...(inputObservation ? { inputObservation } : {}),
+    },
   };
 }
 
@@ -1154,11 +1163,14 @@ function validateAcceptedVerificationCapability(
 ): VerificationCapabilityResult {
   if (requireInputAvailability) {
     for (const input of verificationInputPaths(verification)) {
-      if (!isSafeRegularFile(root, input)) {
+      const status = fileStatus(root, input);
+      if (status !== "regular") {
+        const inputObservation = { path: input, kind: status } as const;
         return adapterFailure(
           verification.id,
-          "input-missing",
-          `verification input ${input} is missing or unsafe`,
+          status === "absent" ? "input-missing" : "input-unsafe",
+          `verification input ${input} is ${status}`,
+          inputObservation,
         );
       }
     }