@abelxiaoxing/cadence 1.6.0 → 1.8.0

package/src/change-verification.ts

@@ -1,9 +1,13 @@
 import { createHash } from "node:crypto";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync } from "node:fs";
 import path from "node:path";
 import { verifyCumulativeRevision } from "./apply-transaction.ts";
 import type { ArtifactStore } from "./artifact-store.ts";
-import type { StructuredVerificationContract } from "./contracts.ts";
+import { canonicalJson } from "./canonical.ts";
+import {
+  type StructuredVerificationContract,
+  verificationInputPaths,
+} from "./contracts.ts";
 import type { PlanTaskDraft } from "./delivery-compiler.ts";
 import type {
   DurableAffectedResult,
@@ -17,11 +21,14 @@ import type {
   DurableVerificationObservation,
   DurableWorkflowEngineOptions,
 } from "./durable-contracts.ts";
+import { isExecutionRetained } from "./execution-retention.ts";
+import { removePathSync } from "./remove-path.ts";
 
 import { observeSafePath } from "./safe-path.ts";
 
 import type { TaskLedger } from "./task-ledger.ts";
 import {
+  baselineRecoveryKey,
   type DurableVerificationScope,
   hash,
   hasVerificationLifecycle,
@@ -30,15 +37,70 @@ import {
   SHA256,
   type WorkflowAttemptOutcome,
   type WorkflowChangeVerifier,
+  type WorkflowVerificationPrerequisite,
 } from "./workflow-policy.ts";
 import type { WorkspaceRevision } from "./workspace-store.ts";
 export function sha256Bytes(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
+
+function verificationContractIdentity(
+  verification: StructuredVerificationContract,
+): string {
+  const executionSemantics = (
+    contract: StructuredVerificationContract,
+  ): unknown => {
+    if (contract.kind === "steps") {
+      return {
+        kind: contract.kind,
+        steps: contract.steps.map((step) => executionSemantics(step)),
+      };
+    }
+    const {
+      id: _id,
+      classification: _classification,
+      expectedFailure: _expectedFailure,
+      ...semantics
+    } = contract;
+    return semantics;
+  };
+  return hash(
+    "verification-contract-v1",
+    canonicalJson(executionSemantics(verification)),
+  );
+}
+
+const BASELINE_CAPABILITY_CODES = new Set([
+  "dependency-path-unsafe",
+  "isolation-backend-launch-failed",
+  "isolation-backend-unavailable",
+  "isolation-termination-unconfirmed",
+  "local-executable-missing",
+  "runner-missing",
+  "sandbox-runtime-unavailable",
+  "verification-environment-changed",
+  "verification-environment-requires-trusted-mode",
+  "verification-environment-unavailable",
+  "verification-runner-launch-failed",
+  "workspace-dependency-missing",
+]);
+
+function hasExactKeys(
+  value: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[] = [],
+): boolean {
+  const keys = Object.keys(value);
+  const allowed = new Set([...required, ...optional]);
+  return (
+    required.every((key) => Object.hasOwn(value, key)) &&
+    keys.every((key) => allowed.has(key))
+  );
+}
+
 function verificationIdentities(
   result: DurableChangeVerificationResult,
-  verification: StructuredVerificationContract,
-  scope: DurableVerificationScope,
+  contractIdentity: string,
 ): string[] {
   // Keep the complete comparison set; only Worker/status summaries are bounded.
   const supplied = result.failureIdentities;
@@ -51,7 +113,7 @@ function verificationIdentities(
     return [...new Set(supplied)].sort();
   }
   if (result.ok) return [];
-  return [hash("verification-failure", scope, verification.id, result.code)];
+  return [hash("verification-failure-v2", contractIdentity, result.code)];
 }
 export function verificationBaselineFact(
   baseline: DurableVerificationBaseline,
@@ -97,7 +159,10 @@ export function parseVerificationBaseline(
     observation.failureIdentities.every((identity) => SHA256.test(identity)) &&
     (observation.code === undefined || typeof observation.code === "string") &&
     (observation.attributionReliable === undefined ||
-      typeof observation.attributionReliable === "boolean");
+      typeof observation.attributionReliable === "boolean") &&
+    (observation.contractIdentity === undefined ||
+      (typeof observation.contractIdentity === "string" &&
+        SHA256.test(observation.contractIdentity)));
   if (
     !baseline.targetContracts.every(
       (entry) =>
@@ -159,6 +224,94 @@ export class ChangeVerification {
     this.#options = options;
     this.#services = services;
   }
+
+  #originalBaselineRevisionId(resources: DurableExecutionResources): string {
+    return (
+      (
+        resources as DurableExecutionResources & {
+          originalBaselineRevisionId?: string;
+        }
+      ).originalBaselineRevisionId ?? resources.baselineRevisionId
+    );
+  }
+
+  #observedEnvironmentIdentity(resources: DurableExecutionResources): string {
+    const identity = resources.environmentIdentity;
+    if (!identity) return "unobserved";
+    return SHA256.test(identity)
+      ? identity
+      : hash("verification-environment-identity-v1", identity);
+  }
+
+  #baselinePrerequisite(input: {
+    resources: DurableExecutionResources;
+    root: string;
+    revisionId: string;
+    scope: "baseline-task-affected" | "baseline-full-suite";
+    verification: StructuredVerificationContract;
+    result: Extract<DurableChangeVerificationResult, { ok: false }>;
+    taskId?: string;
+  }): WorkflowVerificationPrerequisite {
+    const originalRevisionId = this.#originalBaselineRevisionId(
+      input.resources,
+    );
+    if (input.revisionId !== originalRevisionId) {
+      throw new Error("workflow-verification-baseline-conflict");
+    }
+    const base = {
+      kind: "verification-prerequisite" as const,
+      scope: input.scope,
+      verificationId: input.verification.id,
+      contractIdentity: verificationContractIdentity(input.verification),
+      originalRevisionId,
+      environmentIdentity: this.#observedEnvironmentIdentity(input.resources),
+      ...(input.taskId ? { taskId: input.taskId } : {}),
+    };
+    const observedInputs = verificationInputPaths(input.verification).map(
+      (relative) => ({
+        relative,
+        observation: observeSafePath(input.root, relative),
+      }),
+    );
+    const unsafe = observedInputs.find(
+      ({ observation }) =>
+        observation.kind !== "file" && observation.kind !== "absent",
+    );
+    if (unsafe) {
+      return {
+        ...base,
+        cause: "unsafe-input",
+        input: { path: unsafe.relative, kind: "unsafe" },
+      };
+    }
+    const absent = observedInputs.find(
+      ({ observation }) => observation.kind === "absent",
+    );
+    if (absent) {
+      const output = input.resources.plan.outputs.find(
+        (candidate) => candidate.path === absent.relative,
+      );
+      return output
+        ? {
+            ...base,
+            cause: "future-output",
+            input: { path: absent.relative, kind: "absent" },
+            producer: structuredClone(output.producer),
+          }
+        : {
+            ...base,
+            cause: "missing-input",
+            input: { path: absent.relative, kind: "absent" },
+          };
+    }
+    return {
+      ...base,
+      cause: BASELINE_CAPABILITY_CODES.has(input.result.code)
+        ? "capability"
+        : "unknown",
+    };
+  }
+
   async #refreshEnvironment(
     resources: DurableExecutionResources,
     signal: AbortSignal,
@@ -298,6 +451,7 @@ export class ChangeVerification {
       };
     }
     const root = mkdtempSync(path.join(input.resources.root, "verification-"));
+    const contractIdentity = verificationContractIdentity(input.verification);
     try {
       await input.resources.workspaces.materializeAsync(
         input.revisionId,
@@ -320,11 +474,8 @@ export class ChangeVerification {
           observation: {
             status: "passed",
             verificationId: input.verification.id,
-            failureIdentities: verificationIdentities(
-              result,
-              input.verification,
-              input.scope,
-            ),
+            failureIdentities: verificationIdentities(result, contractIdentity),
+            contractIdentity,
           },
         };
       }
@@ -334,13 +485,10 @@ export class ChangeVerification {
           observation: {
             status: "failed",
             verificationId: input.verification.id,
-            failureIdentities: verificationIdentities(
-              result,
-              input.verification,
-              input.scope,
-            ),
+            failureIdentities: verificationIdentities(result, contractIdentity),
             code: result.code,
             attributionReliable: result.attributionReliable,
+            contractIdentity,
           },
         };
       }
@@ -356,12 +504,34 @@ export class ChangeVerification {
           outcome: { kind: "operation-cancelled", code: "cancelled" },
         };
       }
+      const baselineScope =
+        input.scope === "baseline-task-affected" ||
+        input.scope === "baseline-full-suite"
+          ? input.scope
+          : undefined;
       return {
         ok: false,
-        outcome: { kind: "paused", code: result.code },
+        outcome: {
+          kind: "paused",
+          code: result.code,
+          ...(baselineScope
+            ? {
+                prerequisite: this.#baselinePrerequisite({
+                  resources: input.resources,
+                  root,
+                  revisionId: input.revisionId,
+                  scope: baselineScope,
+                  verification: input.verification,
+                  result,
+                  ...(input.taskId ? { taskId: input.taskId } : {}),
+                }),
+              }
+            : {}),
+        },
       };
     } finally {
-      rmSync(root, { recursive: true, force: true });
+      if (!isExecutionRetained(root))
+        removePathSync(root, { recursive: true, force: true });
     }
   }
 
@@ -369,48 +539,97 @@ export class ChangeVerification {
     resources: DurableExecutionResources;
     ledger: TaskLedger;
     signal: AbortSignal;
+    taskId?: string;
   }): Promise<DurableBaselineResult> {
-    const environmentIdentity = input.resources.environmentIdentity;
-    const stored = input.ledger.durableFact(
+    const aggregateFactKey = this.#aggregateBaselineFactKey(input.resources);
+    for (const factKey of [
+      aggregateFactKey,
       this.baselineFactKey(input.resources),
-    );
-    if (stored !== undefined) {
+    ]) {
+      const stored = input.ledger.durableFact(factKey);
+      if (stored === undefined) continue;
       const baseline = parseVerificationBaseline(
         stored,
         input.resources.artifacts,
       );
-      if (baseline.revisionId !== input.resources.baselineRevisionId) {
+      if (
+        baseline.revisionId !==
+        this.#originalBaselineRevisionId(input.resources)
+      ) {
         throw new Error("workflow-verification-baseline-conflict");
       }
-      return { ok: true, baseline };
+      // Legacy aggregates remain inspectable, but do not bind the complete
+      // verification contract and therefore cannot authorize evidence reuse.
+      if (factKey !== aggregateFactKey) continue;
+      const compatible = this.#compatibleAggregateBaseline(
+        baseline,
+        input.resources.plan,
+      );
+      if (!compatible) continue;
+      if (!input.taskId) return { ok: true, baseline };
+      const affected = baseline.affected.filter(
+        (entry) => entry.taskId === input.taskId,
+      );
+      if (affected.length === 1) {
+        return { ok: true, baseline: { ...baseline, affected } };
+      }
     }
     const plan = input.resources.plan;
-    const affected: DurableVerificationBaseline["affected"] = [];
-    for (const task of plan.tasks) {
-      const observed = await this.#observeVerification({
+    const tasks = input.taskId
+      ? plan.tasks.filter((task) => task.taskId === input.taskId)
+      : plan.tasks;
+    if (tasks.length !== (input.taskId ? 1 : plan.tasks.length)) {
+      throw new Error("workflow-task-baseline-unavailable");
+    }
+    const pendingAffected = tasks.map(async (task) => {
+      const observed = await this.#captureBaselineObservation({
         resources: input.resources,
-        revisionId: input.resources.baselineRevisionId,
+        ledger: input.ledger,
+        verification: task.baselineVerification ?? task.affectedVerification,
         scope: "baseline-task-affected",
-        verification: task.affectedVerification,
         taskId: task.taskId,
         signal: input.signal,
       });
-      if (!observed.ok) return observed;
-      affected.push({
-        taskId: task.taskId,
-        observation: observed.observation,
-      });
-    }
-    const fullSuite = await this.#observeVerification({
+      return { taskId: task.taskId, observed };
+    });
+    const pendingFullSuite = this.#captureBaselineObservation({
       resources: input.resources,
-      revisionId: input.resources.baselineRevisionId,
-      scope: "baseline-full-suite",
+      ledger: input.ledger,
       verification: plan.verification.baseline.fullSuite,
+      scope: "baseline-full-suite",
       signal: input.signal,
     });
+    const settled = await Promise.allSettled([
+      ...pendingAffected,
+      pendingFullSuite,
+    ]);
+    const rejected = settled.find(
+      (result): result is PromiseRejectedResult => result.status === "rejected",
+    );
+    if (rejected) throw rejected.reason;
+    const fulfilled = settled as Array<
+      PromiseFulfilledResult<
+        | Awaited<(typeof pendingAffected)[number]>
+        | Awaited<typeof pendingFullSuite>
+      >
+    >;
+    const affectedResults = fulfilled
+      .slice(0, pendingAffected.length)
+      .map((result) => result.value) as Awaited<
+      (typeof pendingAffected)[number]
+    >[];
+    const fullSuiteResult = fulfilled.at(-1);
+    if (!fullSuiteResult) {
+      throw new Error("workflow-verification-baseline-unavailable");
+    }
+    const fullSuite = fullSuiteResult.value as Awaited<typeof pendingFullSuite>;
+    const affectedFailure = affectedResults.find((entry) => !entry.observed.ok);
+    if (affectedFailure && !affectedFailure.observed.ok) {
+      return affectedFailure.observed;
+    }
     if (!fullSuite.ok) return fullSuite;
     const baseline: DurableVerificationBaseline = {
-      revisionId: input.resources.baselineRevisionId,
+      revisionId: this.#originalBaselineRevisionId(input.resources),
       targetContracts: plan.tasks
         .filter(
           (task) =>
@@ -425,25 +644,503 @@ export class ChangeVerification {
                 task.phases.red.verification.id)
               : task.phases.red.verification.id,
         })),
-      affected,
+      affected: affectedResults.map((entry) => {
+        if (!entry.observed.ok) {
+          throw new Error("workflow-task-baseline-unavailable");
+        }
+        return {
+          taskId: entry.taskId,
+          observation: entry.observed.observation,
+        };
+      }),
       fullSuite: fullSuite.observation,
     };
-    if (environmentIdentity !== input.resources.environmentIdentity)
+    if (!input.taskId) {
+      input.ledger.putDurableFact(
+        this.#aggregateBaselineFactKey(input.resources),
+        verificationBaselineFact(baseline, input.resources.artifacts),
+      );
+    }
+    return { ok: true, baseline };
+  }
+
+  #compatibleAggregateBaseline(
+    baseline: DurableVerificationBaseline,
+    plan: DurableExecutionResources["plan"],
+  ): boolean {
+    const matches = (
+      observation: DurableVerificationObservation,
+      contract: StructuredVerificationContract,
+    ): boolean =>
+      observation.verificationId === contract.id &&
+      observation.contractIdentity === verificationContractIdentity(contract);
+    return (
+      matches(baseline.fullSuite, plan.verification.baseline.fullSuite) &&
+      baseline.affected.length === plan.tasks.length &&
+      plan.tasks.every((task) => {
+        const entries = baseline.affected.filter(
+          (entry) => entry.taskId === task.taskId,
+        );
+        const [entry] = entries;
+        return (
+          entries.length === 1 &&
+          entry !== undefined &&
+          matches(
+            entry.observation,
+            task.baselineVerification ?? task.affectedVerification,
+          )
+        );
+      })
+    );
+  }
+
+  #aggregateBaselineFactKey(resources: DurableExecutionResources): string {
+    return `${this.baselineFactKey(resources)}-all-${hash(
+      this.#originalBaselineRevisionId(resources),
+      canonicalJson({
+        tasks: resources.plan.tasks.map((task) => ({
+          taskId: task.taskId,
+          verification: task.baselineVerification ?? task.affectedVerification,
+        })),
+        fullSuite: resources.plan.verification.baseline.fullSuite,
+      }),
+    ).slice(0, 40)}`;
+  }
+
+  #baselineOwnerIdentity(
+    resources: DurableExecutionResources,
+    scope: "baseline-task-affected" | "baseline-full-suite",
+    taskId?: string,
+  ): string {
+    if (scope === "baseline-full-suite") {
+      if (taskId !== undefined)
+        throw new Error("workflow-verification-baseline-failure-invalid");
+      return hash("baseline-observation-owner-v1", "global");
+    }
+    if (!taskId)
+      throw new Error("workflow-verification-baseline-failure-invalid");
+    const tasks = resources.plan.tasks.filter((task) => task.taskId === taskId);
+    const task = tasks[0];
+    if (!task || tasks.length !== 1)
+      throw new Error("workflow-verification-baseline-failure-invalid");
+    return baselineRecoveryKey(task, "red");
+  }
+
+  #baselineObservationFactKey(
+    resources: DurableExecutionResources,
+    verification: StructuredVerificationContract,
+    scope: "baseline-task-affected" | "baseline-full-suite",
+    taskId?: string,
+  ): string {
+    return `${this.baselineFactKey(resources)}-o-${hash(
+      this.#originalBaselineRevisionId(resources),
+      verificationContractIdentity(verification),
+      scope,
+      this.#baselineOwnerIdentity(resources, scope, taskId),
+    ).slice(0, 40)}`;
+  }
+
+  #baselineFailureFactKey(input: {
+    resources: DurableExecutionResources;
+    verification: StructuredVerificationContract;
+    scope: "baseline-task-affected" | "baseline-full-suite";
+    taskId?: string;
+  }): string {
+    return `verification-baseline-failure-${hash(
+      this.#originalBaselineRevisionId(input.resources),
+      verificationContractIdentity(input.verification),
+      input.scope,
+      this.#baselineOwnerIdentity(input.resources, input.scope, input.taskId),
+      this.#observedEnvironmentIdentity(input.resources),
+      this.#options.verificationPolicy ?? "legacy",
+    ).slice(0, 40)}`;
+  }
+
+  #legacyBaselineFailureFactKey(input: {
+    resources: DurableExecutionResources;
+    verification: StructuredVerificationContract;
+    scope: "baseline-task-affected" | "baseline-full-suite";
+    taskId?: string;
+  }): string {
+    return `verification-baseline-failure-${hash(
+      this.#originalBaselineRevisionId(input.resources),
+      verificationContractIdentity(input.verification),
+      input.scope,
+      input.taskId ?? "global",
+      this.#observedEnvironmentIdentity(input.resources),
+      this.#options.verificationPolicy ?? "legacy",
+    ).slice(0, 40)}`;
+  }
+
+  #projectBaselineFailure(
+    code: string,
+    observation: { path: string; kind: "absent" | "unsafe" } | undefined,
+    input: {
+      resources: DurableExecutionResources;
+      verification: StructuredVerificationContract;
+      scope: "baseline-task-affected" | "baseline-full-suite";
+      taskId?: string;
+    },
+  ): Extract<DurableObservedVerification, { ok: false }> {
+    const prerequisite: WorkflowVerificationPrerequisite = {
+      kind: "verification-prerequisite",
+      scope: input.scope,
+      cause: BASELINE_CAPABILITY_CODES.has(code) ? "capability" : "unknown",
+      verificationId: input.verification.id,
+      contractIdentity: verificationContractIdentity(input.verification),
+      originalRevisionId: this.#originalBaselineRevisionId(input.resources),
+      environmentIdentity: this.#observedEnvironmentIdentity(input.resources),
+      ...(input.taskId ? { taskId: input.taskId } : {}),
+    };
+    if (observation?.kind === "unsafe") {
+      prerequisite.cause = "unsafe-input";
+      prerequisite.input = observation;
+    } else if (observation?.kind === "absent") {
+      const outputs = input.resources.plan.outputs.filter(
+        (output) => output.path === observation.path,
+      );
+      if (outputs.length > 1)
+        throw new Error("workflow-verification-baseline-failure-invalid");
+      prerequisite.cause =
+        outputs.length === 1 ? "future-output" : "missing-input";
+      prerequisite.input = observation;
+      if (outputs[0])
+        prerequisite.producer = structuredClone(outputs[0].producer);
+    }
+    return {
+      ok: false,
+      outcome: { kind: "paused", code, prerequisite },
+    };
+  }
+
+  #storedBaselineFailure(
+    value: unknown,
+    input: {
+      resources: DurableExecutionResources;
+      verification: StructuredVerificationContract;
+      scope: "baseline-task-affected" | "baseline-full-suite";
+      taskId?: string;
+    },
+  ): Extract<DurableObservedVerification, { ok: false }> {
+    if (!isRecord(value))
+      throw new Error("workflow-verification-baseline-failure-invalid");
+    const contractIdentity = verificationContractIdentity(input.verification);
+    const originalRevisionId = this.#originalBaselineRevisionId(
+      input.resources,
+    );
+    const environmentIdentity = this.#observedEnvironmentIdentity(
+      input.resources,
+    );
+    const ownerIdentity = this.#baselineOwnerIdentity(
+      input.resources,
+      input.scope,
+      input.taskId,
+    );
+    const declaredPaths = verificationInputPaths(input.verification);
+    let observation: { path: string; kind: "absent" | "unsafe" } | undefined;
+    if (value.kind === "baseline-observation-failure-v2") {
+      if (
+        !hasExactKeys(
+          value,
+          [
+            "kind",
+            "policyIdentity",
+            "ownerIdentity",
+            "scope",
+            "contractIdentity",
+            "originalRevisionId",
+            "environmentIdentity",
+            "code",
+          ],
+          ["observation"],
+        ) ||
+        value.policyIdentity !==
+          hash(
+            "verification-failure-policy-v2",
+            this.#options.verificationPolicy ?? "legacy",
+          ) ||
+        value.ownerIdentity !== ownerIdentity ||
+        value.scope !== input.scope ||
+        value.contractIdentity !== contractIdentity ||
+        value.originalRevisionId !== originalRevisionId ||
+        value.environmentIdentity !== environmentIdentity
+      ) {
+        throw new Error("workflow-verification-baseline-failure-invalid");
+      }
+      if (value.observation !== undefined) {
+        if (
+          !isRecord(value.observation) ||
+          !hasExactKeys(value.observation, ["path", "kind"]) ||
+          typeof value.observation.path !== "string" ||
+          !declaredPaths.includes(value.observation.path) ||
+          !["absent", "unsafe"].includes(String(value.observation.kind))
+        )
+          throw new Error("workflow-verification-baseline-failure-invalid");
+        observation = {
+          path: value.observation.path,
+          kind: value.observation.kind as "absent" | "unsafe",
+        };
+      }
+    } else if (value.kind === "baseline-observation-failure-v1") {
+      const prerequisite = value.prerequisite;
+      if (
+        !hasExactKeys(value, [
+          "kind",
+          "policyIdentity",
+          "code",
+          "prerequisite",
+        ]) ||
+        value.policyIdentity !==
+          hash(
+            "verification-failure-policy-v1",
+            this.#options.verificationPolicy ?? "legacy",
+          ) ||
+        !isRecord(prerequisite) ||
+        !hasExactKeys(
+          prerequisite,
+          [
+            "kind",
+            "scope",
+            "cause",
+            "verificationId",
+            "contractIdentity",
+            "originalRevisionId",
+            "environmentIdentity",
+          ],
+          ["taskId", "input", "producer"],
+        ) ||
+        prerequisite.kind !== "verification-prerequisite" ||
+        prerequisite.scope !== input.scope ||
+        typeof prerequisite.verificationId !== "string" ||
+        !IDENTIFIER.test(prerequisite.verificationId) ||
+        prerequisite.contractIdentity !== contractIdentity ||
+        prerequisite.originalRevisionId !== originalRevisionId ||
+        prerequisite.environmentIdentity !== environmentIdentity ||
+        prerequisite.taskId !== input.taskId ||
+        ![
+          "future-output",
+          "missing-input",
+          "unsafe-input",
+          "capability",
+          "unknown",
+        ].includes(String(prerequisite.cause))
+      )
+        throw new Error("workflow-verification-baseline-failure-invalid");
+      if (prerequisite.input !== undefined) {
+        if (
+          !isRecord(prerequisite.input) ||
+          !hasExactKeys(prerequisite.input, ["path", "kind"]) ||
+          typeof prerequisite.input.path !== "string" ||
+          !declaredPaths.includes(prerequisite.input.path) ||
+          !["absent", "unsafe"].includes(String(prerequisite.input.kind))
+        )
+          throw new Error("workflow-verification-baseline-failure-invalid");
+        observation = {
+          path: prerequisite.input.path,
+          kind: prerequisite.input.kind as "absent" | "unsafe",
+        };
+      }
+      const cause = String(prerequisite.cause);
+      if (
+        ((cause === "future-output" || cause === "missing-input") &&
+          observation?.kind !== "absent") ||
+        (cause === "unsafe-input" && observation?.kind !== "unsafe") ||
+        ((cause === "capability" || cause === "unknown") &&
+          (observation !== undefined ||
+            prerequisite.producer !== undefined ||
+            (cause === "capability") !==
+              BASELINE_CAPABILITY_CODES.has(String(value.code))))
+      )
+        throw new Error("workflow-verification-baseline-failure-invalid");
+      if (prerequisite.producer !== undefined) {
+        if (
+          cause !== "future-output" ||
+          !isRecord(prerequisite.producer) ||
+          !hasExactKeys(prerequisite.producer, ["taskId", "phase"]) ||
+          typeof prerequisite.producer.taskId !== "string" ||
+          !IDENTIFIER.test(prerequisite.producer.taskId) ||
+          !["red", "green", "refactor"].includes(
+            String(prerequisite.producer.phase),
+          )
+        )
+          throw new Error("workflow-verification-baseline-failure-invalid");
+      } else if (cause === "future-output") {
+        throw new Error("workflow-verification-baseline-failure-invalid");
+      }
+    } else {
+      throw new Error("workflow-verification-baseline-failure-invalid");
+    }
+    if (
+      typeof value.code !== "string" ||
+      value.code.length < 1 ||
+      value.code.length > 256
+    )
+      throw new Error("workflow-verification-baseline-failure-invalid");
+    return this.#projectBaselineFailure(value.code, observation, input);
+  }
+
+  async #captureBaselineObservation(input: {
+    resources: DurableExecutionResources;
+    ledger: TaskLedger;
+    verification: StructuredVerificationContract;
+    scope: "baseline-task-affected" | "baseline-full-suite";
+    signal: AbortSignal;
+    taskId?: string;
+  }): Promise<DurableObservedVerification> {
+    const contractIdentity = verificationContractIdentity(input.verification);
+    const ledger = input.resources.baselineLedger ?? input.ledger;
+    const factKey = this.#baselineObservationFactKey(
+      input.resources,
+      input.verification,
+      input.scope,
+      input.taskId,
+    );
+    const failureFactKey = this.#baselineFailureFactKey(input);
+    const legacyFailureFactKey = this.#legacyBaselineFailureFactKey(input);
+    const stored = ledger.durableFact(factKey);
+    const storedFailures = [
+      ledger.durableFact(failureFactKey),
+      ledger.durableFact(legacyFailureFactKey),
+      ...(input.ledger === ledger
+        ? []
+        : [input.ledger.durableFact(legacyFailureFactKey)]),
+    ].filter((value) => value !== undefined);
+    if (storedFailures.length > 1)
+      throw new Error("workflow-verification-baseline-fact-conflict");
+    const storedFailure = storedFailures[0];
+    if (stored !== undefined && storedFailure !== undefined) {
+      throw new Error("workflow-verification-baseline-fact-conflict");
+    }
+    if (stored !== undefined) {
+      const baseline = parseVerificationBaseline(
+        stored,
+        input.resources.artifacts,
+      );
+      if (
+        baseline.revisionId !==
+        this.#originalBaselineRevisionId(input.resources)
+      ) {
+        throw new Error("workflow-verification-baseline-conflict");
+      }
+      if (
+        baseline.fullSuite.contractIdentity !== contractIdentity ||
+        baseline.targetContracts.length !== 0 ||
+        baseline.affected.length !== 0
+      ) {
+        throw new Error("workflow-verification-baseline-conflict");
+      }
       return {
-        ok: false,
-        outcome: { kind: "paused", code: "verification-environment-changed" },
+        ok: true,
+        observation: {
+          ...baseline.fullSuite,
+          verificationId: input.verification.id,
+        },
       };
-    input.ledger.putDurableFact(
-      this.baselineFactKey(input.resources),
-      verificationBaselineFact(baseline, input.resources.artifacts),
+    }
+    if (storedFailure !== undefined) {
+      return this.#storedBaselineFailure(storedFailure, input);
+    }
+    const pendingKey = `baseline-observation:${factKey}`;
+    let pending = input.resources.baselinePromises.get(pendingKey);
+    if (!pending) {
+      pending = this.#observeVerification({
+        resources: input.resources,
+        revisionId: this.#originalBaselineRevisionId(input.resources),
+        scope: input.scope,
+        verification: input.verification,
+        ...(input.taskId ? { taskId: input.taskId } : {}),
+        signal: input.signal,
+      }).then(
+        (observed): DurableBaselineResult =>
+          observed.ok
+            ? {
+                ok: true,
+                baseline: {
+                  revisionId: this.#originalBaselineRevisionId(input.resources),
+                  targetContracts: [],
+                  affected: [],
+                  fullSuite: observed.observation,
+                },
+              }
+            : observed,
+      );
+      const owned = pending;
+      pending = owned.then(
+        (result) => {
+          if (!result.ok) input.resources.baselinePromises.delete(pendingKey);
+          return result;
+        },
+        (error: unknown) => {
+          input.resources.baselinePromises.delete(pendingKey);
+          throw error;
+        },
+      );
+      input.resources.baselinePromises.set(pendingKey, pending);
+    }
+    const result = await pending;
+    if (!result.ok) {
+      if (result.outcome.kind === "paused") {
+        if (!result.outcome.prerequisite) {
+          throw new Error("workflow-verification-baseline-failure-invalid");
+        }
+        const prerequisite = result.outcome.prerequisite;
+        const storedFact = ledger.putDurableFact(failureFactKey, {
+          kind: "baseline-observation-failure-v2",
+          policyIdentity: hash(
+            "verification-failure-policy-v2",
+            this.#options.verificationPolicy ?? "legacy",
+          ),
+          ownerIdentity: this.#baselineOwnerIdentity(
+            input.resources,
+            input.scope,
+            input.taskId,
+          ),
+          scope: input.scope,
+          contractIdentity,
+          originalRevisionId: this.#originalBaselineRevisionId(input.resources),
+          environmentIdentity: this.#observedEnvironmentIdentity(
+            input.resources,
+          ),
+          code: result.outcome.code,
+          ...(prerequisite.input
+            ? { observation: structuredClone(prerequisite.input) }
+            : {}),
+        });
+        return this.#storedBaselineFailure(storedFact, input);
+      }
+      return result;
+    }
+    const fact = verificationBaselineFact(
+      result.baseline,
+      input.resources.artifacts,
     );
-    return { ok: true, baseline };
+    const storedFact = ledger.putDurableFact(factKey, fact);
+    const baseline = parseVerificationBaseline(
+      storedFact,
+      input.resources.artifacts,
+    );
+    if (
+      baseline.revisionId !==
+        this.#originalBaselineRevisionId(input.resources) ||
+      baseline.fullSuite.contractIdentity !== contractIdentity ||
+      baseline.targetContracts.length !== 0 ||
+      baseline.affected.length !== 0
+    )
+      throw new Error("workflow-verification-baseline-conflict");
+    return {
+      ok: true,
+      observation: {
+        ...baseline.fullSuite,
+        verificationId: input.verification.id,
+      },
+    };
   }
 
   async ensureVerificationBaseline(input: {
     resources: DurableExecutionResources;
     ledger: TaskLedger;
     signal: AbortSignal;
+    taskId?: string;
   }): Promise<DurableBaselineResult> {
     try {
       await this.#refreshEnvironment(input.resources, input.signal);
@@ -456,23 +1153,7 @@ export class ChangeVerification {
         },
       };
     }
-    const existing = input.resources.baselinePromises.get(
-      input.resources.deliveryRevision,
-    );
-    if (existing) return existing;
-    const pending = this.#captureVerificationBaseline(input).then((result) => {
-      if (!result.ok) {
-        input.resources.baselinePromises.delete(
-          input.resources.deliveryRevision,
-        );
-      }
-      return result;
-    });
-    input.resources.baselinePromises.set(
-      input.resources.deliveryRevision,
-      pending,
-    );
-    return pending;
+    return this.#captureVerificationBaseline(input);
   }
 
   async verifyTaskAffected(input: {
@@ -498,12 +1179,18 @@ export class ChangeVerification {
     if (current.observation.status === "passed") {
       return { kind: "verified", attribution: "none" };
     }
+    const comparable =
+      typeof baseline.observation.contractIdentity === "string" &&
+      baseline.observation.contractIdentity ===
+        current.observation.contractIdentity;
     if (
       current.observation.attributionReliable === false &&
       baseline.observation.status === "failed"
     )
       return { kind: "paused", code: "verification-attribution-unresolved" };
-    const prior = new Set(baseline.observation.failureIdentities);
+    const prior = new Set(
+      comparable ? baseline.observation.failureIdentities : [],
+    );
     const introduced = current.observation.failureIdentities.filter(
       (identity) => !prior.has(identity),
     );
@@ -742,6 +1429,10 @@ export class ChangeVerification {
                 };
         }
         if (current.observation.status === "failed") {
+          const comparable =
+            typeof baseline.observation.contractIdentity === "string" &&
+            baseline.observation.contractIdentity ===
+              current.observation.contractIdentity;
           if (
             current.observation.attributionReliable === false &&
             baseline.observation.status === "failed"
@@ -750,7 +1441,9 @@ export class ChangeVerification {
               kind: "paused",
               code: "verification-attribution-unresolved",
             };
-          const prior = new Set(baseline.observation.failureIdentities);
+          const prior = new Set(
+            comparable ? baseline.observation.failureIdentities : [],
+          );
           const introduced = current.observation.failureIdentities.filter(
             (identity) => !prior.has(identity),
           );
@@ -789,6 +1482,10 @@ export class ChangeVerification {
               };
       }
       if (fullSuite.observation.status === "failed") {
+        const comparable =
+          typeof captured.baseline.fullSuite.contractIdentity === "string" &&
+          captured.baseline.fullSuite.contractIdentity ===
+            fullSuite.observation.contractIdentity;
         if (
           fullSuite.observation.attributionReliable === false &&
           captured.baseline.fullSuite.status === "failed"
@@ -798,7 +1495,7 @@ export class ChangeVerification {
             code: "verification-attribution-unresolved",
           };
         const baselineFailures = new Set(
-          captured.baseline.fullSuite.failureIdentities,
+          comparable ? captured.baseline.fullSuite.failureIdentities : [],
         );
         const introduced = fullSuite.observation.failureIdentities.filter(
           (identity) => !baselineFailures.has(identity),