@agent-delivery-harness/cli 0.5.0 → 0.7.3

package/src/commands/runs.ts

@@ -31,13 +31,18 @@ import {
   describeRunEventPayload,
   evaluateRunJournal,
   type RunEventPayloadGrammar,
+  type RunEventPayloadMemberGrammar,
+  type RunEventValueGrammar,
   type RunEventVersion,
 } from "@agent-delivery-harness/kernel";
 import {
   READOUT_LABELS,
   detailOf,
+  durationLabel,
+  phaseRows,
   readoutRows,
   roundRows,
+  summarize,
 } from "../run-projection.ts";
 import { buildRunExport } from "../run-export.ts";
 import { startRunServer, type RunServerHandle } from "../run-server.ts";
@@ -195,11 +200,31 @@ function parseGrammarArgs(args: readonly string[]): GrammarParse {
   return { ok: true, args: { kind, version, json } };
 }
 
+/**
+ * One described value, and everything beneath it. Types, nested tables, array
+ * items and variants are printed rather than summarised: the whole point of
+ * this view is that a caller never has to open the validator to find out what
+ * a member holds.
+ */
+function renderValue(value: RunEventValueGrammar, indent: string, lead: string, context: ConfigFreeCommandContext): void {
+  context.write(`${indent}${lead}${value.type}  ${value.constraint}${value.values === undefined ? "" : `  values: ${value.values.join(", ")}`}`);
+  context.write(`${indent}  example: ${JSON.stringify(value.example)}`);
+  for (const member of value.members ?? []) renderMember(member, `${indent}  `, context);
+  if (value.items !== undefined) renderValue(value.items, `${indent}  `, "items  ", context);
+  for (const [index, variant] of (value.variants ?? []).entries()) {
+    renderValue(variant, `${indent}  `, `variant ${index + 1}  `, context);
+  }
+}
+
+function renderMember(member: RunEventPayloadMemberGrammar, indent: string, context: ConfigFreeCommandContext): void {
+  renderValue(member, indent, `${member.name}  ${member.required ? "required" : "optional"}  `, context);
+}
+
 function renderGrammar(grammar: RunEventPayloadGrammar, context: ConfigFreeCommandContext): void {
   context.write(`${grammar.kind} (${grammar.version})`);
-  for (const member of grammar.members) {
-    context.write(`  ${member.name}  ${member.required ? "required" : "optional"}${member.values === undefined ? "" : `  values: ${member.values.join(", ")}`}`);
-  }
+  for (const member of grammar.members) renderMember(member, "  ", context);
+  context.write("  example:");
+  context.write(JSON.stringify(grammar.example, null, 2));
 }
 
 function showGrammar(context: ConfigFreeCommandContext, args: readonly string[]): CommandResult {
@@ -330,12 +355,23 @@ async function sizeOf(runsDir: string, runId: string): Promise<number> {
   }
 }
 
-/** One run as both surfaces see it: the same five facts, rendered or serialized. */
+/** One run as both surfaces see it: the same six facts, rendered or serialized. */
 interface InventoryRow {
   readonly runId: string;
   readonly status: string;
   readonly open: boolean;
   readonly current: boolean;
+  /**
+   * The journal's own span in whole seconds, and `null` where there is no
+   * journal to take a span from.
+   *
+   * NULL, NEVER ZERO. An unreadable journal has no duration; a run that began
+   * and ended inside one second has a duration of zero. Spelling both `0` would
+   * make the listing's one cycle-time figure unreadable exactly where the
+   * status column already says something is wrong — and an agent summing the
+   * column would count the unreadable ones as instantaneous.
+   */
+  readonly durationSeconds: number | null;
   readonly bytes: number;
 }
 
@@ -367,11 +403,12 @@ async function inventoryOf(
             status: evaluateRunJournal(read.events).status,
             open: !read.events.some((event) => event.kind === "run.ended"),
             current: runId === currentRunId,
+            durationSeconds: summarize(read.events).durationSeconds,
             bytes,
           }
         : // Nothing was read, so no lifecycle or completeness state is claimed.
           // The worktree pointer and on-disk size are independent readable facts.
-          { runId, status: RUN_LIST_UNREADABLE, open: false, current: runId === currentRunId, bytes },
+          { runId, status: RUN_LIST_UNREADABLE, open: false, current: runId === currentRunId, durationSeconds: null, bytes },
     );
   }
   return { rows, currentRunId };
@@ -426,11 +463,16 @@ async function listRuns(surface: RunSurface, context: ConfigFreeCommandContext,
   // for first, before it knows which id to show; an unlabeled `complete` here
   // is the misreading the labels exist to prevent.
   const lines: string[] = [`runs in ${oneLine(surface.runsDir, 400)}`, `  (${READOUT_LABELS})`];
+  // The duration goes AHEAD of the size, which is the demotion this column was
+  // added for: an operator scanning this listing is asking which delivery took
+  // a day, and the journal's size on disk answers a question nobody has except
+  // when something is wrong with the file. The size stays, because it is the
+  // only readable fact about an unreadable journal.
   for (const row of shown) {
     lines.push(
-      row.status === RUN_LIST_UNREADABLE
+      row.status === RUN_LIST_UNREADABLE || row.durationSeconds === null
         ? `  ${row.runId}  ${RUN_LIST_UNREADABLE}  ${row.bytes} bytes`
-        : `  ${row.runId}  ${row.status}  ${row.open ? "open" : "ended"}${row.current ? " current" : ""}  ${row.bytes} bytes`,
+        : `  ${row.runId}  ${row.status}  ${row.open ? "open" : "ended"}${row.current ? " current" : ""}  ${durationLabel(row.durationSeconds)}  ${row.bytes} bytes`,
     );
   }
   lines.push(`total ${totalBytes} bytes across ${selected.length} run(s)`);
@@ -481,6 +523,10 @@ async function showRun(surface: RunSurface, context: ConfigFreeCommandContext, r
     context.write(`    ${event.seq}  ${event.at}  ${event.kind.padEnd(20)}  ${event.actor.role.padEnd(8)}  ${detailOf(event)}`);
   }
 
+  // The phase breakdown sits directly under the timeline, before the rounds it
+  // divides the run by, because it is the summary those rows are the detail of.
+  for (const row of phaseRows(events)) context.write(row);
+
   const rounds = roundRows(events);
   if (rounds.length > 0) {
     context.write("  rounds:");

package/src/commands/verify.ts

@@ -44,7 +44,8 @@ import {
 } from "@agent-delivery-harness/kernel";
 import { commandBlocker } from "../boundary.ts";
 import type { CommandContext, CommandDescriptor, CommandResult } from "../boundary.ts";
-import { oneLine, resolveRunJournalRow, runJournalRows } from "../run-surface.ts";
+import { RUN_JOURNAL_ADMISSION_ROW, oneLine, resolveRunJournalRow, resolveRunSpan, runJournalRows } from "../run-surface.ts";
+import { durationLabel } from "../run-projection.ts";
 
 const USAGE = "Usage: delivery-harness verify [--require-run-journal] [--mandated-lens <id>]...";
 
@@ -98,11 +99,61 @@ function parseArgs(args: readonly string[]): ArgParse {
 function runJournalBlocker(row: RunJournalRow) {
   const missing = row.missing.length === 0 ? "(none)" : row.missing.join(", ");
   const violations = row.violations === undefined || row.violations.length === 0 ? "(none)" : row.violations.join(", ");
+  // The same per-violation reasons the row prints. A refusal that named only
+  // the identifiers would make the operator run the command again with the
+  // flag dropped just to read why.
+  //
+  // EVERYTHING THE REMEDIATION NAMES COMES FIRST, BECAUSE A DETAIL IS CUT FROM
+  // THE END. A blocker's detail reaches a terminal through `renderBlockers`,
+  // which bounds it at 600 characters, so a journal with several warnings
+  // pushes whatever is last off the end. Two things must never be the
+  // casualty: the line saying none of this blocks admission, because a
+  // truncated list of violated constraints with no such line reads as a
+  // verdict; and the `missing:` list, because the remediation tells the
+  // operator to emit the run events this delivery did not journal and that
+  // list is the only place this refusal says which ones. So the identifiers,
+  // the missing list and the admission sentence all precede the per-warning
+  // reasons, which are the right thing to lose to the cap — the row on stdout,
+  // which is written line by line and is not bounded this way, always carries
+  // all of them. Inside a warning's own segment the `(a consequence of …)`
+  // clause goes before the reason for the same arithmetic: the reason is the
+  // long part, so a clause written after it is the first thing the cap
+  // destroys. With the clause after the reason it vanished from the
+  // reproduction shape once the run id reached 36 characters, and `runId` is
+  // accepted up to 128; with it before, it survives at every run id length
+  // through 128, as do the missing list and the admission sentence. Two
+  // warnings that restate one fact, printed as peers with nothing saying so,
+  // are the exact misreading this row exists to prevent.
+  //
+  // Do not read the 120 as making the whole detail fit. It never does on a
+  // journal with more than one warning: the reproduction's two render 733
+  // characters at this bound (753 at 130, 813 at 160, and 1045 at 400 and at
+  // every larger bound — the longer of its two reasons is 315 characters, so
+  // nothing above that is binding) against a 600-character cut, and the later
+  // warnings' reasons are lost at every one of them — that is what the
+  // unbounded stdout row is for.
+  //
+  // What 120 buys is narrower than it looks, and the narrowness is the point,
+  // because two earlier rounds of this delivery each shipped a confident and
+  // wrong statement about this budget. Measured on the reproduction's two
+  // warnings at the run id this store actually mints (`run-` + 16 hex = 20
+  // characters), the second warning's identifier begins inside the cut — as
+  // `round-not-bou…`, 13 of its 25 characters — and at 121 and above it does
+  // not. That is the whole of it. The margin is one character: at a 21-
+  // character run id, which `isLegalRunId` admits up to 128, it is already
+  // gone, and a journal carrying a third warning loses the later segments
+  // whatever the bound is. What a larger bound costs is a later warning's own
+  // SEGMENT, never its name: the `violations:` list and any `(a consequence
+  // of …)` clause naming it are ahead of the cut and survive regardless.
+  const why = (row.explanations ?? []).map(
+    (explanation) =>
+      `; ${oneLine(explanation.violation, 64)}${explanation.consequenceOf === undefined ? "" : ` (a consequence of ${oneLine(explanation.consequenceOf, 64)})`}: ${oneLine(explanation.because, 120)}`,
+  ).join("");
   return commandBlocker({
     code: "run_journal_incomplete",
     sourceId: "delivery-harness.cli.verify",
     summary: "The run journal for this candidate is not complete, and --require-run-journal was given.",
-    details: `status ${row.status}${row.runId === undefined ? "" : ` (run ${oneLine(row.runId, 128)})`}; missing: ${missing}; violations: ${violations}`,
+    details: `status ${row.status}${row.runId === undefined ? "" : ` (run ${oneLine(row.runId, 128)})`}; violations: ${violations}; missing: ${missing}; ${RUN_JOURNAL_ADMISSION_ROW}${why}`,
     remediations: [
       {
         id: "emit-the-missing-run-events",
@@ -113,6 +164,74 @@ function runJournalBlocker(row: RunJournalRow) {
   });
 }
 
+/**
+ * The record's own span, checked against the journal that binds its candidate.
+ *
+ * WHAT IS CHECKED, AND WHY THOSE TWO THINGS. `startedAt` must EQUAL the
+ * journal's first instant: a journal is append-only, so its first event never
+ * moves and a record that disagrees about when the delivery began is describing
+ * some other run. `endedAt` must lie inside the journal's span, because the
+ * journal keeps growing after the record is written — `verify`, `pr.opened` and
+ * `run.ended` all land later — so equality there would fail on every honest
+ * record, while an `endedAt` after the journal's last instant or before its
+ * first could not have been read off it at all.
+ *
+ * WHY A MISS IS NOT A REFUSAL. A journal is self-attested observability that
+ * anything the owner executes can append to, and this command runs in CI over
+ * checkouts that carry no run store whatever. So the refusal is available only
+ * where a journal BINDS this record's candidate — never on whichever run is
+ * current in the checkout someone verified from, and never as a demand that a
+ * journal exist. Where none binds it the span is reported unchecked, which is
+ * what `verify` could honestly say before this member existed too.
+ */
+async function runSpanRows(
+  rootDir: string,
+  record: { readonly runSpan?: { readonly startedAt: string; readonly endedAt: string }; readonly candidateBinding: { readonly treeSha: string } },
+): Promise<{ readonly rows: readonly string[]; readonly blocker?: ReturnType<typeof commandBlocker> }> {
+  const span = record.runSpan;
+  if (span === undefined) return { rows: [] };
+  const spent = (Date.parse(span.endedAt) - Date.parse(span.startedAt)) / 1000;
+  const recorded = `recorded run span: ${span.startedAt} to ${span.endedAt} (${durationLabel(spent)})`;
+  // `preferStartedAt` is what keeps a SECOND run in the same worktree — the one
+  // this verify is itself running under, say — from refusing a record whose own
+  // run reports exactly this span. A refusal stands only where no journal
+  // binding this candidate starts where the record says it did.
+  const journal = await resolveRunSpan({
+    cwd: rootDir,
+    treeSha: record.candidateBinding.treeSha,
+    preferStartedAt: span.startedAt,
+  });
+  if (journal === undefined) {
+    return { rows: [`${recorded}; unchecked: no run journal in this repository binds this candidate`] };
+  }
+  const disagreement =
+    span.startedAt !== journal.startedAt
+      ? `the record starts at ${span.startedAt} but run ${oneLine(journal.runId, 128)} starts at ${journal.startedAt}`
+      : span.endedAt > journal.endedAt
+        ? `the record ends at ${span.endedAt}, after the last instant run ${oneLine(journal.runId, 128)} reached (${journal.endedAt})`
+        : undefined;
+  if (disagreement === undefined) {
+    return { rows: [`${recorded}; checked against run ${oneLine(journal.runId, 128)}`] };
+  }
+  return {
+    rows: [],
+    blocker: commandBlocker({
+      code: "record_run_span_mismatch",
+      sourceId: "delivery-harness.cli.verify",
+      summary: "The delivery record's run span disagrees with the run journal that binds its candidate.",
+      details: disagreement,
+      remediations: [
+        {
+          id: "re-record-the-span",
+          kind: "command",
+          command: ["delivery-harness", "record"],
+          summary: "Re-record this candidate so its span is the one its own run journal reports.",
+        },
+      ],
+    }),
+  };
+}
+
 export const verifyCommand: CommandDescriptor = {
   name: "verify",
   sourceId: "delivery-harness.cli.verify",
@@ -230,6 +349,11 @@ export const verifyCommand: CommandDescriptor = {
       return { kind: "blocked", blockers: [runJournalBlocker(runJournal)] };
     }
 
+    // Judged in the same place and for the same reason: a record that fails its
+    // own verification is never told its span is the problem.
+    const span = await runSpanRows(context.rootDir, parsed.record);
+    if (span.blocker !== undefined) return { kind: "blocked", blockers: [span.blocker] };
+
     const relaxation = check.baseMovementRelaxed
       ? ` (base movement relaxed by policy: ${check.relaxedDriftClasses.join(", ")})`
       : "";
@@ -243,6 +367,7 @@ export const verifyCommand: CommandDescriptor = {
         `verified ${relativePath}${relaxation}; attestation: ${check.attestationLabel}`,
         `recorded base: ${oneLine(parsed.record.candidateBinding.baseRef, 256)} at ${parsed.record.candidateBinding.baseTipSha}`,
         `observed base: ${oneLine(base.ref, 256)} at ${base.tipSha}`,
+        ...span.rows,
         ...hostedCheckRow,
         ...runJournalRows(runJournal),
       ].join("\n"),

package/src/index.ts

@@ -102,3 +102,6 @@ export { resumeCommand } from "./commands/resume.ts";
 export function runCli(argv: readonly string[], runtime: CliRuntime): Promise<number> {
   return runCliBoundary(argv, COMMANDS, runtime);
 }
+
+export { readScopedCheckObservations, type ScopedCheckObservations } from "./scoped-observations.ts";
+export { readScopedCheckDiagnostics, type ScopedCheckDiagnostics, type ScopedAttemptDiagnostic, type RecordedScopedAttemptDiagnostic, type ScopedDiagnosticPhase, type ScopedDiagnosticFailureCode, type ScopedDiagnosticExecutionCode, type ScopedDiagnosticCommand, type ScopedDependencyDiagnostic } from "./scoped-diagnostics.ts";

package/src/main.ts

@@ -9,7 +9,7 @@
  * a Ctrl-C into the typed {@link CliInterruption} the boundary maps to exit 130.
  */
 import { createInterface } from "node:readline";
-import { CliInterruption, EXIT_POLICY, runCli, type CliRuntime } from "./index.ts";
+import { CliInterruption, EXIT_INTERRUPTED, EXIT_POLICY, runCli, type CliRuntime } from "./index.ts";
 import { invokedDirectly, type WaiverPrompt } from "@agent-delivery-harness/kernel";
 
 /**
@@ -35,23 +35,25 @@ import { invokedDirectly, type WaiverPrompt } from "@agent-delivery-harness/kern
  * would reject and then resolve, and a settled promise silently ignoring its
  * second settlement is exactly how this class of bug hides.
  */
-export function createWaiverPrompt(input: NodeJS.ReadableStream, output: NodeJS.WritableStream): WaiverPrompt {
+export function createWaiverPrompt(input: NodeJS.ReadableStream, output: NodeJS.WritableStream, signal?: AbortSignal): WaiverPrompt {
   return (decision, obligationIds) =>
     new Promise<Awaited<ReturnType<WaiverPrompt>>>((resolve, reject) => {
+      if (signal?.aborted) { reject(new CliInterruption()); return; }
       const rl = createInterface({ input, output });
       let settled = false;
       const settle = (action: () => void): void => {
         if (settled) return;
         settled = true;
+        signal?.removeEventListener("abort", interrupt);
         action();
       };
 
-      rl.on("SIGINT", () => {
-        settle(() => {
-          rl.close();
-          reject(new CliInterruption("Waiver prompt interrupted."));
-        });
+      const interrupt = () => settle(() => {
+        rl.close();
+        reject(new CliInterruption("Waiver prompt interrupted."));
       });
+      rl.on("SIGINT", interrupt);
+      signal?.addEventListener("abort", interrupt, { once: true });
       // Ctrl-D, a closed pipe, or any other end of input.
       rl.on("close", () => {
         settle(() => resolve(false));
@@ -93,20 +95,29 @@ export const readlineWaiverPrompt: WaiverPrompt = (decision, obligationIds) =>
  * reads as empty, and the store refuses the empty payload with a diagnostic,
  * which is a far better answer than silence.
  */
-export function readStdinText(input: NodeJS.ReadableStream & { isTTY?: boolean }): Promise<string> {
+export function readStdinText(input: NodeJS.ReadableStream & { isTTY?: boolean }, signal?: AbortSignal): Promise<string> {
+  if (signal?.aborted) return Promise.reject(new CliInterruption());
   if (input.isTTY === true) return Promise.resolve("");
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     let text = "";
+    const cleanup = () => {
+      input.removeListener("data", data);
+      input.removeListener("error", finish);
+      input.removeListener("end", finish);
+      signal?.removeEventListener("abort", interrupt);
+    };
+    const data = (chunk: string) => { text += chunk; };
+    const finish = () => { cleanup(); resolve(text); };
+    const interrupt = () => { cleanup(); input.pause(); reject(new CliInterruption()); };
     input.setEncoding("utf8");
-    input.on("data", (chunk: string) => {
-      text += chunk;
-    });
-    input.once("error", () => resolve(text));
-    input.once("end", () => resolve(text));
+    input.on("data", data);
+    input.once("error", finish);
+    input.once("end", finish);
+    signal?.addEventListener("abort", interrupt, { once: true });
   });
 }
 
-export function defaultRuntime(): CliRuntime {
+export function defaultRuntime(signal?: AbortSignal): CliRuntime {
   return {
     cwd: process.cwd(),
     env: process.env,
@@ -114,13 +125,20 @@ export function defaultRuntime(): CliRuntime {
     stdoutIsTTY: process.stdout.isTTY === true,
     stdout: (text) => process.stdout.write(text),
     stderr: (text) => process.stderr.write(text),
-    promptForWaiver: readlineWaiverPrompt,
-    readStdin: () => readStdinText(process.stdin),
+    ...(signal ? { signal } : {}),
+    promptForWaiver: createWaiverPrompt(process.stdin, process.stderr, signal),
+    readStdin: () => readStdinText(process.stdin, signal),
   };
 }
 
 export async function main(argv: readonly string[]): Promise<number> {
-  return runCli(argv, defaultRuntime());
+  const controller = new AbortController();
+  const interrupt = () => controller.abort();
+  process.on("SIGINT", interrupt);
+  try {
+    const code = await runCli(argv, defaultRuntime(controller.signal));
+    return controller.signal.aborted ? EXIT_INTERRUPTED : code;
+  } finally { process.removeListener("SIGINT", interrupt); }
 }
 
 if (invokedDirectly(process.argv[1], import.meta.url)) {

package/src/ordinary-context.ts

@@ -79,21 +79,5 @@ export async function installedRelease(rootDir: string) {
 
 export const policyDigest = (context: CommandContext) => digestCanonical({ config: context.config, policyBinding: context.policyBinding ?? null });
 
-/** Observed action outcomes are a host handoff, never permission to invoke an action. */
-export function reconciliationActions(events: readonly RunEvent[]) {
-  const actions = new Map<string, { actionId: string; operation?: unknown; reference: unknown; outcome: string; inconsistent?: boolean }>();
-  for (const event of events) {
-    const p = event.payload;
-    if (event.kind === "action.intent") {
-      const actionId = p["actionId"] as string;
-      const prior = actions.get(actionId);
-      actions.set(actionId, { actionId, operation: p["operation"], reference: p["reference"], outcome: "unknown", ...(prior ? { inconsistent: true } : {}) });
-    } else if (event.kind === "action.observed") {
-      const actionId = p["actionId"] as string;
-      const prior = actions.get(actionId);
-      actions.set(actionId, { ...prior, actionId, reference: p["reference"], outcome: p["outcome"] as string,
-        ...(!prior || prior.inconsistent || (prior.outcome !== "unknown" && prior.outcome !== p["outcome"]) ? { inconsistent: true } : {}) });
-    }
-  }
-  return [...actions.values()];
-}
+// One reduction is shared with the atomic journal append validator.
+export { reconciliationActions } from "@agent-delivery-harness/kernel";

package/src/run-export.ts

@@ -10,6 +10,7 @@ import {
   evaluateRunJournal,
   RUN_STORE_ID,
   validateRunEvent,
+  runActionReconciliationError,
   type RunEvent,
 } from "@agent-delivery-harness/kernel";
 import {
@@ -55,6 +56,37 @@ export function buildRunExport(input: {
   };
 }
 
+/**
+ * The readout members a stored export is CHECKED against.
+ *
+ * The per-violation sentences are derived from the same events by the same
+ * pass on every read, so an export never has to carry them and is never
+ * refused for lacking them: an archive written before the readout explained
+ * itself stays valid, and one carrying invented sentences gains nothing,
+ * because the value returned below is rebuilt from the recomputation either
+ * way. Compare what the events fix; recompute what they derive.
+ */
+function comparableReadout(readout: object): Record<string, unknown> {
+  const comparable: Record<string, unknown> = { ...readout };
+  delete comparable["explanations"];
+  return comparable;
+}
+
+/**
+ * The summary members a stored export is CHECKED against.
+ *
+ * `phases` is derived from the same events by the same pass on every read, for
+ * exactly the reason the readout's sentences are: an archive written before the
+ * phase breakdown existed stays valid, and one carrying invented phases gains
+ * nothing, because the value returned below is rebuilt from the recomputation
+ * either way. Compare what the events fix; recompute what they derive.
+ */
+function comparableSummary(summary: object): Record<string, unknown> {
+  const comparable: Record<string, unknown> = { ...summary };
+  delete comparable["phases"];
+  return comparable;
+}
+
 export type DeliveryRunExport = ReturnType<typeof buildRunExport> & {
   readonly attachments?: RunAttachments;
 };
@@ -103,6 +135,7 @@ export function parseRunExport(text: string): RunExportParseResult {
         : "costs,events,labels,readout,refusedAppends,runId,spec,summary")
     )
       return invalid;
+    const prefix: RunEvent[] = [];
     for (const [index, event] of value["events"].entries()) {
       if (
         !validateRunEvent(event).ok ||
@@ -112,6 +145,9 @@ export function parseRunExport(text: string): RunExportParseResult {
         event["version"] !== (v2 ? "run-event/2" : "run-event/1")
       )
         return invalid;
+      const validated = event as unknown as RunEvent;
+      if (runActionReconciliationError(prefix, validated)) return invalid;
+      prefix.push(validated);
     }
     if (
       hasAttachments &&
@@ -132,7 +168,8 @@ export function parseRunExport(text: string): RunExportParseResult {
     )
       return invalid;
     if (
-      canonicalize(value["summary"]) !== canonicalize(expected.summary) ||
+      !isRecord(value["summary"]) ||
+      canonicalize(comparableSummary(value["summary"])) !== canonicalize(comparableSummary(expected.summary)) ||
       canonicalize(value["costs"]) !== canonicalize(expected.costs)
     )
       return invalid;
@@ -141,7 +178,8 @@ export function parseRunExport(text: string): RunExportParseResult {
     const { note, ...readout } = value["readout"];
     if (
       (note !== undefined && typeof note !== "string") ||
-      canonicalize(readout) !== canonicalize(expected.readout)
+      canonicalize(comparableReadout(readout)) !==
+        canonicalize(comparableReadout(expected.readout))
     )
       return invalid;
     return {