@adammcarter/use-cases 0.1.0

package/packages/core/dist/markers/cli/scan.js

@@ -0,0 +1,233 @@
+import { validateEvidenceLedger } from "../evidenceLedger.js";
+import { deriveFreshness } from "../freshness.js";
+import { validateBindingsJsonl } from "../registry.js";
+import { formatInferredSwiftSpanReport, scanFiles } from "../scanner.js";
+import { readBaseRefFile } from "../appendOnly.js";
+import { computeRowVerificationContextHash } from "../verificationContextHash.js";
+import { join } from "node:path";
+import { nodeMarkerFs } from "./io.js";
+import { collectSourceInputs, loadMarkerRows } from "./shared.js";
+// The conventional location of the UNSIGNED verification-results ledger, one row
+// per line, that `verify --out` writes. Scan auto-discovers it here (under the
+// data root's .use-cases dir) so the keyless daily loop — bind -> verify -> scan
+// -> VERIFIED_LOCAL — needs no key, no CI, and no extra flags.
+export const DEFAULT_VERIFICATION_RESULTS_FILENAME = "verification-results.jsonl";
+// Parse the unsigned verification-results ledger (JSONL of
+// `ucase-verification-result-v1` records) into the minimal shape freshness's
+// keyless tier consumes. Unreadable/blank/malformed content yields an empty list
+// (the keyless signal is best-effort and NEVER blocks the read-only scan).
+function loadLocalVerificationResults(text) {
+    const results = [];
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (line === "") {
+            continue;
+        }
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            continue; // skip a malformed line rather than failing the whole scan
+        }
+        if (typeof record !== "object" || record === null) {
+            continue;
+        }
+        const value = record;
+        const rowId = value.row_id;
+        const contextHash = value.verification_context_hash;
+        const bindingSetHash = value.binding_set_hash;
+        const status = value.status;
+        if (typeof rowId !== "string" ||
+            typeof contextHash !== "string" ||
+            typeof bindingSetHash !== "string" ||
+            typeof status !== "string") {
+            continue;
+        }
+        results.push({
+            row_id: rowId,
+            context_hash: contextHash,
+            binding_set_hash: bindingSetHash,
+            passed: status === "pass"
+        });
+    }
+    return results;
+}
+// Shared pipeline used by both `scan` and `prove` (prove runs scan first).
+export function prepareScan(options) {
+    const fs = options.fs ?? nodeMarkerFs;
+    const loaded = loadMarkerRows(options.context);
+    // Registry (append-only binding log) -> validate + materialize. Append-only
+    // discipline vs a base ref is validate-ledger's authority (spec 8.4); scan only
+    // validates the materialized registry here.
+    const bindingsText = fs.readText(options.bindingsPath) ?? "";
+    const registryResult = validateBindingsJsonl(bindingsText, loaded.rowIds);
+    const registryErrors = [...registryResult.errors];
+    // Evidence ledger -> validate signatures/schema/policy/internal hashes.
+    const evidenceText = fs.readText(options.evidencePath) ?? "";
+    const baseRefOldText = options.baseRef !== undefined
+        ? readBaseRefFile(options.baseRef, options.evidencePath, {
+            cwd: options.repoCwd,
+            runner: options.gitRunner
+        })
+        : undefined;
+    const evidenceResult = validateEvidenceLedger(evidenceText, {
+        publicKeyResolver: options.publicKeyResolver,
+        yamlRowIds: loaded.rowIds,
+        baseRefOldText
+    });
+    // Scan product source for markers.
+    const inputs = collectSourceInputs(options.productRoot, {
+        fs,
+        config: options.commentConfig,
+        skipPaths: [options.context.data_root]
+    });
+    const scan = scanFiles(inputs, { config: options.commentConfig });
+    // Derive freshness. Registry/ledger validation failures become global
+    // integrity errors so guard_ok flips and they surface in the status object.
+    const globalIntegrity = [
+        ...registryErrors.map((error) => ({
+            code: error.code,
+            line: error.line ?? undefined,
+            message: error.message,
+            binding_slug: error.binding_slug
+        })),
+        ...evidenceResult.errors.map((error) => ({
+            code: error.code,
+            line: error.line ?? undefined,
+            message: error.message,
+            event_id: error.event_id
+        }))
+    ];
+    // Freshly recompute each row's verification context hash from the CURRENT
+    // resolved verifier + declared-input contents + lockfile. Threaded into
+    // freshness so a proof minted against a now-weakened verifier is no longer
+    // FRESH. Computed identically to `prove` (same root + fs), so a just-minted
+    // proof's embedded hash matches its recomputed value.
+    const contextRoot = options.repoCwd ?? options.productRoot;
+    const currentContextHashes = new Map();
+    for (const row of loaded.rows) {
+        currentContextHashes.set(row.row_id, computeRowVerificationContextHash({
+            slug: row.row_id,
+            verificationPolicy: row.verification_policy,
+            rootDir: contextRoot,
+            fs,
+            workspaceVerifiers: options.context.verifiers
+        }));
+    }
+    // Keyless local tier: auto-discover the UNSIGNED verification-results ledger
+    // (what `verify --out` writes) under the data root, or use the caller override.
+    // Read-only and best-effort: an absent/unreadable file simply yields no local
+    // results, and the local tier is reported as UNVERIFIED_LOCAL for bound rows.
+    const resultsPath = options.resultsPath ??
+        join(options.context.data_root, ".use-cases", DEFAULT_VERIFICATION_RESULTS_FILENAME);
+    const resultsText = fs.readText(resultsPath);
+    const localResults = resultsText == null ? [] : loadLocalVerificationResults(resultsText);
+    const status = deriveFreshness({
+        rows: loaded.rows,
+        registry: registryResult.registry,
+        scan,
+        evidence: evidenceResult.events,
+        policy_mode: options.policyMode,
+        generated_at: options.generatedAt,
+        product_root: options.productRoot,
+        current_context_hashes: currentContextHashes,
+        local_results: localResults,
+        global_integrity_errors: globalIntegrity,
+        // OPTIONAL CI-neutral release-gate authority requirement from workspace
+        // config (off by default). Only consulted in release mode by deriveFreshness.
+        release_gate: options.context.release_gate
+    });
+    return {
+        loaded,
+        registry: registryResult.registry,
+        registryErrors,
+        evidence: evidenceResult.events,
+        evidenceErrors: evidenceResult.errors,
+        scan,
+        status
+    };
+}
+export function runScanCommand(options) {
+    const prepared = prepareScan(options);
+    const registryValid = prepared.registryErrors.length === 0;
+    const evidenceValid = prepared.evidenceErrors.length === 0;
+    // Inferred Swift spans, for the CI human report (spec 8.2 "must print").
+    const inferredSpans = prepared.scan.bindings
+        .map((binding) => formatInferredSwiftSpanReport(binding))
+        .filter((report) => report !== null);
+    const baseExitCode = scanExitCode(prepared.status, registryValid, evidenceValid);
+    // Opt-in gate: escalate an otherwise-passing scan (exit 0) to exit 1 when a
+    // required row is below the bar. It NEVER lowers a higher-precedence failure
+    // (4 ledger/registry, 3 binding integrity) — those already surface real
+    // problems and outrank a freshness gate. Without --gate, nothing changes.
+    let gate;
+    let exitCode = baseExitCode;
+    if (options.gate) {
+        gate = evaluateScanGate(prepared.status, options.policyMode);
+        if (gate.blocked && exitCode === 0) {
+            exitCode = 1;
+        }
+    }
+    return {
+        exit_code: exitCode,
+        ok: exitCode === 0,
+        status: prepared.status,
+        registry_valid: registryValid,
+        evidence_valid: evidenceValid,
+        inferred_spans: inferredSpans,
+        registry_errors: prepared.registryErrors,
+        evidence_errors: prepared.evidenceErrors,
+        ...(gate !== undefined ? { gate } : {})
+    };
+}
+// True iff a row meets the acceptable bar for `policyMode`. FRESH always passes
+// (it strictly outranks the keyless local tier).
+function rowMeetsGateBar(row, policyMode) {
+    if (row.status === "FRESH") {
+        return true;
+    }
+    if (policyMode === "release") {
+        return false; // release bar is FRESH; nothing else clears it.
+    }
+    return row.local_status === "VERIFIED_LOCAL";
+}
+// Pure gate decision over an already-derived FreshnessStatus. Never mutates the
+// status and never changes the signed `status` — it only reads it.
+export function evaluateScanGate(status, policyMode) {
+    const offending = [];
+    for (const row of status.rows) {
+        if (row.required_for_release !== true) {
+            continue; // only required rows are gated
+        }
+        if (!rowMeetsGateBar(row, policyMode)) {
+            offending.push({
+                row_id: row.row_id,
+                status: row.status,
+                local_status: row.local_status ?? null
+            });
+        }
+    }
+    return {
+        blocked: offending.length > 0,
+        policy_mode: policyMode,
+        required_bar: policyMode === "release" ? "FRESH" : "VERIFIED_LOCAL",
+        offending_rows: offending
+    };
+}
+// Exit-code precedence (spec 8.2): 4 ledger/registry > 3 binding integrity (any
+// INVALID row) > 1 freshness policy block (a non-INVALID row the policy blocks).
+export function scanExitCode(status, registryValid, evidenceValid) {
+    if (!registryValid || !evidenceValid) {
+        return 4;
+    }
+    if (status.summary.invalid > 0) {
+        return 3;
+    }
+    const policyBlockNonInvalid = status.rows.some((row) => row.policy_block && row.status !== "INVALID");
+    if (policyBlockNonInvalid) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=scan.js.map

package/packages/core/dist/markers/cli/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/markers/cli/scan.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,sBAAsB,EAGvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,qBAAqB,EAGtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,SAAS,EAEV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAkB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAiB,MAAM,SAAS,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAG,4BAA4B,CAAC;AAElF,2DAA2D;AAC3D,6EAA6E;AAC7E,iFAAiF;AACjF,2EAA2E;AAC3E,SAAS,4BAA4B,CAAC,IAAY;IAChD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,2DAA2D;QACvE,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAiC,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,yBAAyB,CAAC;QACpD,MAAM,cAAc,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,WAAW,KAAK,QAAQ;YAC/B,OAAO,cAAc,KAAK,QAAQ;YAClC,OAAO,MAAM,KAAK,QAAQ,EAC1B,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,KAAK;YACb,YAAY,EAAE,WAAW;YACzB,gBAAgB,EAAE,cAAc;YAChC,MAAM,EAAE,MAAM,KAAK,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAqCD,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/C,4EAA4E;IAC5E,gFAAgF;IAChF,4CAA4C;IAC5C,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAElD,wEAAwE;IACxE,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,cAAc,GAClB,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;YACrD,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,MAAM,EAAE,OAAO,CAAC,SAAS;SAC1B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,EAAE;QAC1D,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,cAAc;KACf,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE;QACtD,EAAE;QACF,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAElE,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,eAAe,GAAG;QACtB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;KACJ,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,sDAAsD;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAC3D,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,oBAAoB,CAAC,GAAG,CACtB,GAAG,CAAC,MAAM,EACV,iCAAiC,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,MAAM;YAChB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,OAAO,EAAE,WAAW;YACpB,EAAE;YACF,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;SAC9C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW;QACnB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,qCAAqC,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,YAAY,GAChB,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,IAAI;QACJ,QAAQ,EAAE,cAAc,CAAC,MAAM;QAC/B,WAAW,EAAE,OAAO,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,sBAAsB,EAAE,oBAAoB;QAC5C,aAAa,EAAE,YAAY;QAC3B,uBAAuB,EAAE,eAAe;QACxC,wEAAwE;QACxE,8EAA8E;QAC9E,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,cAAc;QACd,QAAQ,EAAE,cAAc,CAAC,MAAM;QAC/B,cAAc,EAAE,cAAc,CAAC,MAAM;QACrC,IAAI;QACJ,MAAM;KACP,CAAC;AACJ,CAAC;AAiBD,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAE3D,yEAAyE;IACzE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ;SACzC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IAEjF,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,IAAgC,CAAC;IACrC,IAAI,QAAQ,GAAG,YAAY,CAAC;IAC5B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnC,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,EAAE,EAAE,QAAQ,KAAK,CAAC;QAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,QAAQ,CAAC,cAAc;QACxC,eAAe,EAAE,QAAQ,CAAC,cAAc;QACxC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AA0BD,gFAAgF;AAChF,iDAAiD;AACjD,SAAS,eAAe,CACtB,GAAoC,EACpC,UAAsB;IAEtB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,gDAAgD;IAChE,CAAC;IACD,OAAO,GAAG,CAAC,YAAY,KAAK,gBAAgB,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,UAAsB;IAEtB,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACtC,SAAS,CAAC,+BAA+B;QAC3C,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;YACtC,SAAS,CAAC,IAAI,CAAC;gBACb,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC;QAC7B,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;QACnE,cAAc,EAAE,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,aAAsB,EACtB,aAAsB;IAEtB,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CACtD,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/packages/core/dist/markers/cli/shared.d.ts

@@ -0,0 +1,25 @@
+import type { ResolvedWorkspaceContext } from "../../roots.js";
+import type { MatrixSnapshot } from "../../useCases/types.js";
+import type { FreshnessInputRow } from "../freshness.js";
+import type { PemOrKeyObject, PublicKeyResolver } from "../proofSignature.js";
+import { type CommentPrefixConfig } from "../commentPrefix.js";
+import type { CurrentBindingRecord, ScanInput } from "../scanner.js";
+import { type MarkerFs } from "./io.js";
+export interface LoadedMarkerRows {
+    rows: FreshnessInputRow[];
+    rowIds: Set<string>;
+    snapshot: MatrixSnapshot;
+}
+export declare function loadMarkerRows(context: ResolvedWorkspaceContext): LoadedMarkerRows;
+export declare function findRow(rows: ReadonlyArray<FreshnessInputRow>, rowId: string): FreshnessInputRow | undefined;
+export interface CollectSourceOptions {
+    fs?: MarkerFs;
+    config?: CommentPrefixConfig;
+    skipPaths?: string[];
+}
+export declare function collectSourceInputs(productRoot: string, options?: CollectSourceOptions): ScanInput[];
+export declare function toPosix(path: string): string;
+export declare function resolveUnderRoot(root: string, value: string): string;
+export declare function singleKeyResolver(publicKey: PemOrKeyObject, keyId?: string): PublicKeyResolver;
+export declare function registeredBindingsForRow(bindings: ReadonlyArray<CurrentBindingRecord>, rowId: string, registeredSlugs: ReadonlySet<string>): CurrentBindingRecord[];
+//# sourceMappingURL=shared.d.ts.map

package/packages/core/dist/markers/cli/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/shared.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAMtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,wBAAwB,GAAG,gBAAgB,CAYlF;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE5G;AA4BD,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAMD,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,SAAS,EAAE,CA4CxG;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAMD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAO9F;AAID,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,CAAC,EAC7C,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,GACnC,oBAAoB,EAAE,CAIxB"}

package/packages/core/dist/markers/cli/shared.js

@@ -0,0 +1,123 @@
+// Shared inputs for the Phase 7 CLI command cores.
+//
+// Loads marker "rows" from the existing use-case YAML loader (REUSING
+// loadUseCaseMatrix rather than a parallel parser), walks product source for
+// marker-bearing files, and resolves trusted-CI public keys. Everything here is
+// deterministic given its inputs; clocks/ids/verification are injected by callers.
+import { isAbsolute, join, relative } from "node:path";
+import { loadUseCaseMatrix } from "../../useCases/loadUseCaseMatrix.js";
+import { resolveCommentPrefix } from "../commentPrefix.js";
+import { nodeMarkerFs } from "./io.js";
+export function loadMarkerRows(context) {
+    const snapshot = loadUseCaseMatrix({ context });
+    const rows = snapshot.addressableUseCases.map((useCase) => {
+        const value = useCase.value;
+        return {
+            ...value,
+            row_id: useCase.value.id,
+            verification_policy: value.verification_policy ?? null,
+            approval_policy: value.approval_policy ?? null
+        };
+    });
+    return { rows, rowIds: new Set(rows.map((row) => row.row_id)), snapshot };
+}
+export function findRow(rows, rowId) {
+    return rows.find((row) => row.row_id === rowId);
+}
+// Directory names never walked for markers: VCS/deps, the data dir itself, and
+// common build-output dirs. Build output (e.g. tsc's dist/) can carry COPIES of
+// a marker comment from source, which would otherwise read as a duplicate slug.
+const DEFAULT_SKIP_DIRS = new Set([
+    ".git",
+    // Agent/session state — notably .claude/worktrees holds full repo COPIES whose
+    // source markers would otherwise read as duplicate slugs and poison the scan.
+    ".claude",
+    "node_modules",
+    ".use-cases",
+    "dist",
+    "dist-ts",
+    "build",
+    "out",
+    "coverage",
+    ".next",
+    ".turbo",
+    ".svelte-kit",
+    // Sample/nested example projects ship their OWN matrix + markers (a nested
+    // workspace). Their markers reference the example's rows, not the parent's, so
+    // scanning them from the parent repo would read as INVALID. Skip by default;
+    // the example's own `scan --repo examples/<name>` has no `examples/` subtree
+    // and is unaffected. (examples/ is not part of the published package either.)
+    "examples"
+]);
+// Walk the product root and read every file that has a configured comment prefix
+// (so the scanner only sees files that could legally carry a marker). Returns
+// ScanInput records keyed by a posix path relative to productRoot, so binding
+// records and span hashes are stable regardless of where the repo lives on disk.
+export function collectSourceInputs(productRoot, options = {}) {
+    const fs = options.fs ?? nodeMarkerFs;
+    const skip = new Set((options.skipPaths ?? []).map((path) => path));
+    const inputs = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.listDir(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isSymlink) {
+                continue; // never follow symlinks
+            }
+            const full = join(dir, entry.name);
+            if (entry.isDirectory) {
+                if (DEFAULT_SKIP_DIRS.has(entry.name) || skip.has(full)) {
+                    continue;
+                }
+                walk(full);
+                continue;
+            }
+            if (!entry.isFile) {
+                continue;
+            }
+            const relPath = toPosix(relative(productRoot, full));
+            const contents = fs.readText(full);
+            if (contents === null) {
+                continue;
+            }
+            // Resolve with contents so extensionless shebang scripts (e.g.
+            // hooks/session-start) are recognised, not silently skipped.
+            if (resolveCommentPrefix(relPath, options.config, contents) === null) {
+                continue; // no configured prefix => cannot carry a marker
+            }
+            inputs.push({ file_path: relPath, contents });
+        }
+    };
+    walk(productRoot);
+    inputs.sort((left, right) => (left.file_path < right.file_path ? -1 : left.file_path > right.file_path ? 1 : 0));
+    return inputs;
+}
+export function toPosix(path) {
+    return path.split("\\").join("/");
+}
+export function resolveUnderRoot(root, value) {
+    return isAbsolute(value) ? value : join(root, value);
+}
+// Build a PublicKeyResolver from a single trusted public key. Because v1 trusts
+// exactly one key file, any key_id resolves to it (a tampered signature still
+// fails BAD_SIGNATURE; an unknown alg still fails before resolution). Callers that
+// need strict key_id matching can pass `keyId`.
+export function singleKeyResolver(publicKey, keyId) {
+    return (requestedKeyId) => {
+        if (keyId !== undefined && requestedKeyId !== keyId) {
+            return undefined;
+        }
+        return publicKey;
+    };
+}
+// Recompute the current, registered binding records for one row from a scan,
+// filtered to the slugs the registry actually knows (spec 7: C(row)).
+export function registeredBindingsForRow(bindings, rowId, registeredSlugs) {
+    return bindings.filter((binding) => binding.row_id === rowId && registeredSlugs.has(binding.binding_slug));
+}
+//# sourceMappingURL=shared.js.map

package/packages/core/dist/markers/cli/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/markers/cli/shared.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,gFAAgF;AAChF,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAIxE,OAAO,EACL,oBAAoB,EAErB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAiB,MAAM,SAAS,CAAC;AAYtD,MAAM,UAAU,cAAc,CAAC,OAAiC;IAC9D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAwB,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAC;QACvD,OAAO;YACL,GAAG,KAAK;YACR,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;YACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,IAAI;YACtD,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;SAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAsC,EAAE,KAAa;IAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,+EAA+E;IAC/E,8EAA8E;IAC9E,SAAS;IACT,cAAc;IACd,YAAY;IACZ,MAAM;IACN,SAAS;IACT,OAAO;IACP,KAAK;IACL,UAAU;IACV,OAAO;IACP,QAAQ;IACR,aAAa;IACb,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,UAAU;CACX,CAAC,CAAC;AASH,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,UAAgC,EAAE;IACzF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,SAAS,CAAC,wBAAwB;YACpC,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,+DAA+D;YAC/D,6DAA6D;YAC7D,IAAI,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBACrE,SAAS,CAAC,gDAAgD;YAC5D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,WAAW,CAAC,CAAC;IAClB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,mFAAmF;AACnF,gDAAgD;AAChD,MAAM,UAAU,iBAAiB,CAAC,SAAyB,EAAE,KAAc;IACzE,OAAO,CAAC,cAAsB,EAAE,EAAE;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CACtC,QAA6C,EAC7C,KAAa,EACb,eAAoC;IAEpC,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CACnF,CAAC;AACJ,CAAC"}

package/packages/core/dist/markers/cli/validateLedger.d.ts

@@ -0,0 +1,38 @@
+import type { ResolvedWorkspaceContext } from "../../roots.js";
+import { type GitRunner } from "../appendOnly.js";
+import type { PublicKeyResolver } from "../proofSignature.js";
+import { type MarkerFs } from "./io.js";
+export interface ValidateLedgerCommandOptions {
+    context: ResolvedWorkspaceContext;
+    evidencePath: string;
+    bindingsPath: string;
+    publicKeyResolver: PublicKeyResolver;
+    baseRef?: string;
+    gitRunner?: GitRunner;
+    repoCwd?: string;
+    fs?: MarkerFs;
+}
+export interface LedgerErrorOut {
+    scope: "evidence" | "registry";
+    code: string;
+    line: number | null;
+    message: string;
+}
+export interface ValidateLedgerCommandResult {
+    exit_code: number;
+    ok: boolean;
+    command: "validate-ledger";
+    evidence_valid: boolean;
+    registry_valid: boolean;
+    append_only: boolean;
+    proof_events_checked: number;
+    registry_events_checked: number;
+    chain: {
+        ok: boolean;
+        verified_entries: number;
+        legacy_prefix_count: number;
+    };
+    errors: LedgerErrorOut[];
+}
+export declare function runValidateLedgerCommand(options: ValidateLedgerCommandOptions): ValidateLedgerCommandResult;
+//# sourceMappingURL=validateLedger.d.ts.map

package/packages/core/dist/markers/cli/validateLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateLedger.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/validateLedger.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGtD,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,wBAAwB,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,iBAAiB,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAGhC,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,4BAA4B,GACpC,2BAA2B,CA8E7B"}

package/packages/core/dist/markers/cli/validateLedger.js

@@ -0,0 +1,81 @@
+import { appendOnly, readBaseRefFile, splitJsonlLines } from "../appendOnly.js";
+import { readEvidenceJsonl, validateEvidenceLedger, verifyLedgerChain } from "../evidenceLedger.js";
+import { validateBindingsJsonl } from "../registry.js";
+import { nodeMarkerFs } from "./io.js";
+import { loadMarkerRows } from "./shared.js";
+export function runValidateLedgerCommand(options) {
+    const fs = options.fs ?? nodeMarkerFs;
+    const loaded = loadMarkerRows(options.context);
+    const errors = [];
+    // --- Evidence ledger (spec 8.4 steps 1,3,4,6-9) ---
+    const evidenceText = fs.readText(options.evidencePath) ?? "";
+    const evidenceBaseText = options.baseRef !== undefined
+        ? readBaseRefFile(options.baseRef, options.evidencePath, {
+            cwd: options.repoCwd,
+            runner: options.gitRunner
+        })
+        : undefined;
+    const evidenceResult = validateEvidenceLedger(evidenceText, {
+        publicKeyResolver: options.publicKeyResolver,
+        yamlRowIds: loaded.rowIds,
+        baseRefOldText: evidenceBaseText
+    });
+    for (const error of evidenceResult.errors) {
+        errors.push({ scope: "evidence", code: error.code, line: error.line, message: error.message });
+    }
+    // --- Tamper-evident hash chain (v1 ledger chain, Piece 2) ---
+    // Verify the contiguous chained suffix, tolerating a leading legacy prefix.
+    // Operates over the same parsed-JSONL line ordering the chain was minted on.
+    const chainResult = verifyLedgerChain(readEvidenceJsonl(evidenceText).lines);
+    for (const error of chainResult.errors) {
+        errors.push({ scope: "evidence", code: error.code, line: error.line, message: error.message });
+    }
+    // --- Binding registry (spec 8.4 steps 2,3,5,10-12) ---
+    const bindingsText = fs.readText(options.bindingsPath) ?? "";
+    const registryResult = validateBindingsJsonl(bindingsText, loaded.rowIds);
+    for (const error of registryResult.errors) {
+        errors.push({ scope: "registry", code: error.code, line: error.line, message: error.message });
+    }
+    // Registry append-only vs base ref (spec 8.4 step 5).
+    let registryAppendOnly = true;
+    if (options.baseRef !== undefined) {
+        const oldText = readBaseRefFile(options.baseRef, options.bindingsPath, {
+            cwd: options.repoCwd,
+            runner: options.gitRunner
+        });
+        const check = appendOnly(splitJsonlLines(oldText), splitJsonlLines(bindingsText));
+        if (!check.ok) {
+            registryAppendOnly = false;
+            errors.push({
+                scope: "registry",
+                code: "APPEND_ONLY_VIOLATION",
+                line: check.violation.index + 1,
+                message: check.violation.message
+            });
+        }
+    }
+    const evidenceValid = evidenceResult.errors.length === 0 && chainResult.ok;
+    const registryValid = registryResult.errors.length === 0 && registryAppendOnly;
+    const appendOnlyOk = evidenceResult.append_only && registryAppendOnly;
+    const ok = evidenceValid && registryValid;
+    return {
+        exit_code: ok ? 0 : 4,
+        ok,
+        command: "validate-ledger",
+        evidence_valid: evidenceValid,
+        registry_valid: registryValid,
+        append_only: appendOnlyOk,
+        proof_events_checked: evidenceResult.summary.proof_events_checked,
+        registry_events_checked: countJsonlLines(bindingsText),
+        chain: {
+            ok: chainResult.ok,
+            verified_entries: chainResult.verified_entries,
+            legacy_prefix_count: chainResult.legacy_prefix_count
+        },
+        errors
+    };
+}
+function countJsonlLines(text) {
+    return splitJsonlLines(text).filter((line) => line.trim() !== "").length;
+}
+//# sourceMappingURL=validateLedger.js.map

package/packages/core/dist/markers/cli/validateLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateLedger.js","sourceRoot":"","sources":["../../../src/markers/cli/validateLedger.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,UAAU,EACV,eAAe,EACf,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAiB,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAuC7C,MAAM,UAAU,wBAAwB,CACtC,OAAqC;IAErC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,qDAAqD;IACrD,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,gBAAgB,GACpB,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;YACrD,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,MAAM,EAAE,OAAO,CAAC,SAAS;SAC1B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,EAAE;QAC1D,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,+DAA+D;IAC/D,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,wDAAwD;IACxD,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,sDAAsD;IACtD,IAAI,kBAAkB,GAAG,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;YACrE,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,MAAM,EAAE,OAAO,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,kBAAkB,GAAG,KAAK,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC;gBAC/B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC;IAC3E,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC;IAC/E,MAAM,YAAY,GAAG,cAAc,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACtE,MAAM,EAAE,GAAG,aAAa,IAAI,aAAa,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,EAAE;QACF,OAAO,EAAE,iBAAiB;QAC1B,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,YAAY;QACzB,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,oBAAoB;QACjE,uBAAuB,EAAE,eAAe,CAAC,YAAY,CAAC;QACtD,KAAK,EAAE;YACL,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;SACrD;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;AAC3E,CAAC"}

package/packages/core/dist/markers/cli/verify.d.ts

@@ -0,0 +1,65 @@
+import type { ResolvedWorkspaceContext } from "../../roots.js";
+import type { CommentPrefixConfig } from "../commentPrefix.js";
+import type { PublicKeyResolver } from "../proofSignature.js";
+import type { GitRunner } from "../appendOnly.js";
+import { type MarkerFs } from "./io.js";
+export declare const VERIFICATION_RESULT_SCHEMA_ID = "ucase-verification-result-v1";
+export interface VerifySpawnRequest {
+    command: string[];
+    cwd: string;
+    timeout_seconds?: number;
+}
+export interface VerifySpawnResult {
+    exit_code: number;
+    timed_out: boolean;
+    stdout: string;
+    stderr: string;
+}
+export type VerifySpawnRunner = (request: VerifySpawnRequest) => VerifySpawnResult;
+export interface VerificationResultRecord {
+    schema: typeof VERIFICATION_RESULT_SCHEMA_ID;
+    row_id: string;
+    slug: string;
+    status: "pass" | "fail" | "blocked";
+    evidence_kind: string | null;
+    verifier_id: string | null;
+    verifier_kind: string | null;
+    exit_code: number | null;
+    row_hash: string;
+    binding_set_hash: string;
+    span_sha256s: string[];
+    verification_context_hash: string;
+    stdout_sha256: string | null;
+    stderr_sha256: string | null;
+    created_at: string;
+}
+export interface VerifyCommandOptions {
+    context: ResolvedWorkspaceContext;
+    productRoot: string;
+    bindingsPath: string;
+    evidencePath: string;
+    publicKeyResolver: PublicKeyResolver;
+    generatedAt: string;
+    all?: boolean;
+    rowId?: string;
+    outPath?: string;
+    spawnRunner?: VerifySpawnRunner;
+    fs?: MarkerFs;
+    commentConfig?: CommentPrefixConfig;
+    baseRef?: string;
+    gitRunner?: GitRunner;
+    repoCwd?: string;
+}
+export interface VerifyCommandResult {
+    exit_code: number;
+    ok: boolean;
+    command: "verify";
+    results: VerificationResultRecord[];
+    out_path: string | null;
+    errors: Array<{
+        code: string;
+        message: string;
+    }>;
+}
+export declare function runVerifyCommand(options: VerifyCommandOptions): VerifyCommandResult;
+//# sourceMappingURL=verify.d.ts.map

package/packages/core/dist/markers/cli/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/verify.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKtD,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAG5E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,iBAAiB,CAAC;AAMnF,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,6BAA6B,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yBAAyB,EAAE,MAAM,CAAC;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAqCD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAuNnF"}