@agent-delivery-harness/conformance 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (101) hide show
  1. package/LICENSE +202 -0
  2. package/NOTICE +5 -0
  3. package/README.md +159 -0
  4. package/fixtures/repo-config-adapter.ts +250 -0
  5. package/package.json +24 -0
  6. package/src/generate.ts +1013 -0
  7. package/src/index.ts +36 -0
  8. package/src/json-schema.ts +222 -0
  9. package/src/runner.ts +687 -0
  10. package/vectors/context/environment.json +21 -0
  11. package/vectors/context/repo-config.json +22 -0
  12. package/vectors/kit.json +1250 -0
  13. package/vectors/vectors/accept/a-completed-order-differs.json +112 -0
  14. package/vectors/vectors/accept/a-cost-fractional.json +116 -0
  15. package/vectors/vectors/accept/a-cost-tokens.json +120 -0
  16. package/vectors/vectors/accept/a-deferred-expansion.json +124 -0
  17. package/vectors/vectors/accept/a-idempotent-resubmission.json +115 -0
  18. package/vectors/vectors/accept/a-minimal-green.json +97 -0
  19. package/vectors/vectors/accept/a-resolved-and-advisory.json +129 -0
  20. package/vectors/vectors/accept/a-three-reviewers.json +113 -0
  21. package/vectors/vectors/reject/env-1-unregistered-provider.json +114 -0
  22. package/vectors/vectors/reject/env-10-artifact-duplicate.json +103 -0
  23. package/vectors/vectors/reject/env-10-artifact-missing-file.json +104 -0
  24. package/vectors/vectors/reject/env-10-artifact-traversal.json +99 -0
  25. package/vectors/vectors/reject/env-11-artifact-digest-mismatch.json +98 -0
  26. package/vectors/vectors/reject/env-12-unknown-attestation-level.json +114 -0
  27. package/vectors/vectors/reject/env-13-nonempty-signatures.json +118 -0
  28. package/vectors/vectors/reject/env-14-duplicate-claim.json +149 -0
  29. package/vectors/vectors/reject/env-14-no-claims.json +78 -0
  30. package/vectors/vectors/reject/env-14-unconfigured-obligation.json +114 -0
  31. package/vectors/vectors/reject/env-14-unsupported-payload-spec.json +114 -0
  32. package/vectors/vectors/reject/env-2-run-id-1.json +114 -0
  33. package/vectors/vectors/reject/env-2-run-id-2.json +114 -0
  34. package/vectors/vectors/reject/env-2-run-id-3.json +114 -0
  35. package/vectors/vectors/reject/env-2-run-id-4.json +114 -0
  36. package/vectors/vectors/reject/env-2-run-id-5.json +114 -0
  37. package/vectors/vectors/reject/env-4-unsupported-vcs.json +114 -0
  38. package/vectors/vectors/reject/env-5-malformed-object-id.json +114 -0
  39. package/vectors/vectors/reject/env-6-missing-identity.json +111 -0
  40. package/vectors/vectors/reject/env-6-unknown-identity-version.json +114 -0
  41. package/vectors/vectors/reject/env-8-repository-required.json +116 -0
  42. package/vectors/vectors/reject/env-9-empty-run-history.json +107 -0
  43. package/vectors/vectors/reject/env-9-final-pass-mismatch.json +110 -0
  44. package/vectors/vectors/reject/env-9-final-tree-mismatch.json +110 -0
  45. package/vectors/vectors/reject/gen-1-legacy-count-field.json +115 -0
  46. package/vectors/vectors/reject/gen-1-unknown-envelope-member.json +117 -0
  47. package/vectors/vectors/reject/gen-2-unsupported-spec.json +114 -0
  48. package/vectors/vectors/reject/rg-1-edited-after-final-pass.json +114 -0
  49. package/vectors/vectors/reject/rg-1-not-finalized.json +114 -0
  50. package/vectors/vectors/reject/rg-1-verdict-not-green.json +114 -0
  51. package/vectors/vectors/reject/rg-10-cost-by-reviewer-exceeds-total.json +115 -0
  52. package/vectors/vectors/reject/rg-10-cost-empty-reported-by.json +111 -0
  53. package/vectors/vectors/reject/rg-10-cost-empty-unit.json +111 -0
  54. package/vectors/vectors/reject/rg-10-cost-missing-unit.json +110 -0
  55. package/vectors/vectors/reject/rg-10-cost-negative-by-reviewer.json +114 -0
  56. package/vectors/vectors/reject/rg-10-cost-negative-total.json +111 -0
  57. package/vectors/vectors/reject/rg-10-cost-null-total.json +111 -0
  58. package/vectors/vectors/reject/rg-10-cost-unknown-reviewer-in-breakdown.json +114 -0
  59. package/vectors/vectors/reject/rg-2-duplicate-selected.json +99 -0
  60. package/vectors/vectors/reject/rg-3-completed-missing.json +96 -0
  61. package/vectors/vectors/reject/rg-3-completed-unrelated.json +99 -0
  62. package/vectors/vectors/reject/rg-3-failed-reviewer.json +100 -0
  63. package/vectors/vectors/reject/rg-3-timed-out-reviewer.json +100 -0
  64. package/vectors/vectors/reject/rg-4-approval-extra.json +104 -0
  65. package/vectors/vectors/reject/rg-4-approval-malformed.json +98 -0
  66. package/vectors/vectors/reject/rg-4-approval-missing.json +100 -0
  67. package/vectors/vectors/reject/rg-4-approval-not-approved.json +98 -0
  68. package/vectors/vectors/reject/rg-4-approval-wrong-candidate.json +98 -0
  69. package/vectors/vectors/reject/rg-4-approval-wrong-pass.json +98 -0
  70. package/vectors/vectors/reject/rg-4-approval-wrong-provider.json +98 -0
  71. package/vectors/vectors/reject/rg-4-approval-wrong-reviewer.json +98 -0
  72. package/vectors/vectors/reject/rg-4-approval-wrong-run.json +98 -0
  73. package/vectors/vectors/reject/rg-4-approval-wrong-workspace.json +98 -0
  74. package/vectors/vectors/reject/rg-5-duplicate-finding-id.json +131 -0
  75. package/vectors/vectors/reject/rg-5-unknown-disposition.json +123 -0
  76. package/vectors/vectors/reject/rg-5-unknown-scope.json +123 -0
  77. package/vectors/vectors/reject/rg-5-unknown-severity.json +123 -0
  78. package/vectors/vectors/reject/rg-6-actionable-ignored.json +123 -0
  79. package/vectors/vectors/reject/rg-6-actionable-unresolved.json +123 -0
  80. package/vectors/vectors/reject/rg-6-blocking-finding.json +123 -0
  81. package/vectors/vectors/reject/rg-7-defer-adjacent.json +126 -0
  82. package/vectors/vectors/reject/rg-7-defer-blocking.json +126 -0
  83. package/vectors/vectors/reject/rg-7-defer-in-contract.json +126 -0
  84. package/vectors/vectors/reject/rg-7-defer-lowercase-issue-id.json +126 -0
  85. package/vectors/vectors/reject/rg-7-defer-missing-issue-id.json +125 -0
  86. package/vectors/vectors/reject/rg-7-defer-non-actionable.json +126 -0
  87. package/vectors/vectors/reject/rg-7-defer-p0.json +126 -0
  88. package/vectors/vectors/reject/rg-7-defer-p1.json +126 -0
  89. package/vectors/vectors/reject/rg-7-defer-placeholder-issue-id.json +126 -0
  90. package/vectors/vectors/reject/rg-7-issue-id-on-resolved.json +124 -0
  91. package/vectors/vectors/reject/rg-8-counts-contradict-findings.json +126 -0
  92. package/vectors/vectors/reject/rg-8-deferral-count-disagrees.json +124 -0
  93. package/vectors/vectors/reject/rg-8-deferral-ids-disagree.json +126 -0
  94. package/vectors/vectors/reject/rg-9-iteration-count-mismatch.json +114 -0
  95. package/vectors/vectors/reject/sub-1-base-tip-moved.json +131 -0
  96. package/vectors/vectors/reject/sub-1-deliverable-changed.json +131 -0
  97. package/vectors/vectors/reject/sub-1-merge-base-moved.json +131 -0
  98. package/vectors/vectors/reject/sub-1-raw-tree-changed.json +131 -0
  99. package/vectors/vectors/reject/sub-2-unprepared.json +117 -0
  100. package/vectors/vectors/reject/sub-3-manifest-outside-run-root.json +117 -0
  101. package/vectors/vectors/reject/sub-4-record-conflict.json +220 -0
package/vectors/vectors/reject/rg-5-unknown-severity.json ADDED
@@ -0,0 +1,123 @@
1
+ {
2
+ "vectorVersion": 1,
3
+ "id": "rg-5-unknown-severity",
4
+ "title": "Finding with unknown severity",
5
+ "rules": [
6
+ "RG-5"
7
+ ],
8
+ "provenance": "athena:scripts/harness-review-evidence.test.ts \"rejects a finding with ...\"",
9
+ "expect": {
10
+ "result": "rejected",
11
+ "codes": [
12
+ "finding_invalid"
13
+ ]
14
+ },
15
+ "artifacts": {
16
+ "reviewers/correctness.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"correctness\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
17
+ "reviewers/security.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"security\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
18
+ "reviewers/tests.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"tests\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n"
19
+ },
20
+ "manifest": {
21
+ "spec": "delivery-evidence/1",
22
+ "provider": {
23
+ "id": "claude-code.ce-code-review",
24
+ "version": "1.0.0",
25
+ "runId": "r-conformance-01",
26
+ "finalPassId": "pass-2"
27
+ },
28
+ "candidate": {
29
+ "vcs": "git",
30
+ "treeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
31
+ "headSha": "31740476c0227fc5c77b00c37aff24d03d692e47",
32
+ "deliverable": {
33
+ "digest": "c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9",
34
+ "identity": "deliverable-tree/v1"
35
+ },
36
+ "base": {
37
+ "ref": "origin/main",
38
+ "tipSha": "8248f1bc1cf32509843ef77387841c8ea06245cb",
39
+ "mergeBaseSha": "892135fcf4acee18bebcefd8398192fd0faf1293"
40
+ },
41
+ "workspaceId": "w-0dcf2d98505da17d"
42
+ },
43
+ "repository": null,
44
+ "runHistory": [
45
+ {
46
+ "preparedTreeSha": "132c7f8efa52032271d4f06fc0cb9e264a05e0e1",
47
+ "evaluatedInPassId": "pass-1"
48
+ },
49
+ {
50
+ "preparedTreeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
51
+ "evaluatedInPassId": "pass-2"
52
+ }
53
+ ],
54
+ "artifacts": [
55
+ {
56
+ "path": "reviewers/correctness.json",
57
+ "sha256": "128b2a9756c778c36ce29b4390e944c2f05438904d1953a0bed4027f55e1ede8",
58
+ "role": "reviewer-approval"
59
+ },
60
+ {
61
+ "path": "reviewers/security.json",
62
+ "sha256": "4933efc56d9e3fe6173f31b703ba7c41cb7490cbd2f5538b5b5ef2a7cc8fa03e",
63
+ "role": "reviewer-approval"
64
+ },
65
+ {
66
+ "path": "reviewers/tests.json",
67
+ "sha256": "3ec8364e062dcfc9f631262d9d36afc750f49080483755767345fcc22c1b1e42",
68
+ "role": "reviewer-approval"
69
+ }
70
+ ],
71
+ "attestation": {
72
+ "level": "self",
73
+ "signatures": []
74
+ },
75
+ "recordedAt": "2026-08-25T00:00:00Z",
76
+ "claims": [
77
+ {
78
+ "obligation": "review.green",
79
+ "payloadSpec": "review.green/1",
80
+ "payload": {
81
+ "verdict": "green",
82
+ "finalized": true,
83
+ "editedAfterFinalPass": false,
84
+ "reviewers": {
85
+ "selected": [
86
+ "correctness",
87
+ "security",
88
+ "tests"
89
+ ],
90
+ "completed": [
91
+ "correctness",
92
+ "security",
93
+ "tests"
94
+ ],
95
+ "failed": [],
96
+ "timedOut": []
97
+ },
98
+ "findings": [
99
+ {
100
+ "id": "f-1",
101
+ "severity": "P9",
102
+ "scope": "in_contract",
103
+ "actionable": true,
104
+ "blocking": false,
105
+ "disposition": "resolved"
106
+ }
107
+ ],
108
+ "telemetry": {
109
+ "iterationCount": 2,
110
+ "findingCounts": {
111
+ "P0": 0,
112
+ "P1": 0,
113
+ "P2": 1,
114
+ "P3": 0
115
+ },
116
+ "deferredExpansionCount": 0,
117
+ "deferredIssueIds": []
118
+ }
119
+ }
120
+ }
121
+ ]
122
+ }
123
+ }
package/vectors/vectors/reject/rg-6-actionable-ignored.json ADDED
@@ -0,0 +1,123 @@
1
+ {
2
+ "vectorVersion": 1,
3
+ "id": "rg-6-actionable-ignored",
4
+ "title": "Actionable finding left ignored despite green verdict",
5
+ "rules": [
6
+ "RG-6"
7
+ ],
8
+ "provenance": "athena:scripts/harness-review-evidence.test.ts \"rejects an ignored actionable finding despite zero summary counts\"",
9
+ "expect": {
10
+ "result": "rejected",
11
+ "codes": [
12
+ "actionable_unresolved"
13
+ ]
14
+ },
15
+ "artifacts": {
16
+ "reviewers/correctness.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"correctness\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
17
+ "reviewers/security.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"security\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
18
+ "reviewers/tests.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"tests\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n"
19
+ },
20
+ "manifest": {
21
+ "spec": "delivery-evidence/1",
22
+ "provider": {
23
+ "id": "claude-code.ce-code-review",
24
+ "version": "1.0.0",
25
+ "runId": "r-conformance-01",
26
+ "finalPassId": "pass-2"
27
+ },
28
+ "candidate": {
29
+ "vcs": "git",
30
+ "treeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
31
+ "headSha": "31740476c0227fc5c77b00c37aff24d03d692e47",
32
+ "deliverable": {
33
+ "digest": "c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9",
34
+ "identity": "deliverable-tree/v1"
35
+ },
36
+ "base": {
37
+ "ref": "origin/main",
38
+ "tipSha": "8248f1bc1cf32509843ef77387841c8ea06245cb",
39
+ "mergeBaseSha": "892135fcf4acee18bebcefd8398192fd0faf1293"
40
+ },
41
+ "workspaceId": "w-0dcf2d98505da17d"
42
+ },
43
+ "repository": null,
44
+ "runHistory": [
45
+ {
46
+ "preparedTreeSha": "132c7f8efa52032271d4f06fc0cb9e264a05e0e1",
47
+ "evaluatedInPassId": "pass-1"
48
+ },
49
+ {
50
+ "preparedTreeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
51
+ "evaluatedInPassId": "pass-2"
52
+ }
53
+ ],
54
+ "artifacts": [
55
+ {
56
+ "path": "reviewers/correctness.json",
57
+ "sha256": "128b2a9756c778c36ce29b4390e944c2f05438904d1953a0bed4027f55e1ede8",
58
+ "role": "reviewer-approval"
59
+ },
60
+ {
61
+ "path": "reviewers/security.json",
62
+ "sha256": "4933efc56d9e3fe6173f31b703ba7c41cb7490cbd2f5538b5b5ef2a7cc8fa03e",
63
+ "role": "reviewer-approval"
64
+ },
65
+ {
66
+ "path": "reviewers/tests.json",
67
+ "sha256": "3ec8364e062dcfc9f631262d9d36afc750f49080483755767345fcc22c1b1e42",
68
+ "role": "reviewer-approval"
69
+ }
70
+ ],
71
+ "attestation": {
72
+ "level": "self",
73
+ "signatures": []
74
+ },
75
+ "recordedAt": "2026-08-25T00:00:00Z",
76
+ "claims": [
77
+ {
78
+ "obligation": "review.green",
79
+ "payloadSpec": "review.green/1",
80
+ "payload": {
81
+ "verdict": "green",
82
+ "finalized": true,
83
+ "editedAfterFinalPass": false,
84
+ "reviewers": {
85
+ "selected": [
86
+ "correctness",
87
+ "security",
88
+ "tests"
89
+ ],
90
+ "completed": [
91
+ "correctness",
92
+ "security",
93
+ "tests"
94
+ ],
95
+ "failed": [],
96
+ "timedOut": []
97
+ },
98
+ "findings": [
99
+ {
100
+ "id": "f-1",
101
+ "severity": "P2",
102
+ "scope": "in_contract",
103
+ "actionable": true,
104
+ "blocking": false,
105
+ "disposition": "ignored"
106
+ }
107
+ ],
108
+ "telemetry": {
109
+ "iterationCount": 2,
110
+ "findingCounts": {
111
+ "P0": 0,
112
+ "P1": 0,
113
+ "P2": 1,
114
+ "P3": 0
115
+ },
116
+ "deferredExpansionCount": 0,
117
+ "deferredIssueIds": []
118
+ }
119
+ }
120
+ }
121
+ ]
122
+ }
123
+ }
package/vectors/vectors/reject/rg-6-actionable-unresolved.json ADDED
@@ -0,0 +1,123 @@
1
+ {
2
+ "vectorVersion": 1,
3
+ "id": "rg-6-actionable-unresolved",
4
+ "title": "Actionable finding left unresolved despite green verdict",
5
+ "rules": [
6
+ "RG-6"
7
+ ],
8
+ "provenance": "athena:scripts/harness-review-evidence.test.ts \"rejects an unresolved actionable finding despite zero summary counts\"",
9
+ "expect": {
10
+ "result": "rejected",
11
+ "codes": [
12
+ "actionable_unresolved"
13
+ ]
14
+ },
15
+ "artifacts": {
16
+ "reviewers/correctness.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"correctness\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
17
+ "reviewers/security.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"security\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
18
+ "reviewers/tests.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"tests\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n"
19
+ },
20
+ "manifest": {
21
+ "spec": "delivery-evidence/1",
22
+ "provider": {
23
+ "id": "claude-code.ce-code-review",
24
+ "version": "1.0.0",
25
+ "runId": "r-conformance-01",
26
+ "finalPassId": "pass-2"
27
+ },
28
+ "candidate": {
29
+ "vcs": "git",
30
+ "treeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
31
+ "headSha": "31740476c0227fc5c77b00c37aff24d03d692e47",
32
+ "deliverable": {
33
+ "digest": "c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9",
34
+ "identity": "deliverable-tree/v1"
35
+ },
36
+ "base": {
37
+ "ref": "origin/main",
38
+ "tipSha": "8248f1bc1cf32509843ef77387841c8ea06245cb",
39
+ "mergeBaseSha": "892135fcf4acee18bebcefd8398192fd0faf1293"
40
+ },
41
+ "workspaceId": "w-0dcf2d98505da17d"
42
+ },
43
+ "repository": null,
44
+ "runHistory": [
45
+ {
46
+ "preparedTreeSha": "132c7f8efa52032271d4f06fc0cb9e264a05e0e1",
47
+ "evaluatedInPassId": "pass-1"
48
+ },
49
+ {
50
+ "preparedTreeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
51
+ "evaluatedInPassId": "pass-2"
52
+ }
53
+ ],
54
+ "artifacts": [
55
+ {
56
+ "path": "reviewers/correctness.json",
57
+ "sha256": "128b2a9756c778c36ce29b4390e944c2f05438904d1953a0bed4027f55e1ede8",
58
+ "role": "reviewer-approval"
59
+ },
60
+ {
61
+ "path": "reviewers/security.json",
62
+ "sha256": "4933efc56d9e3fe6173f31b703ba7c41cb7490cbd2f5538b5b5ef2a7cc8fa03e",
63
+ "role": "reviewer-approval"
64
+ },
65
+ {
66
+ "path": "reviewers/tests.json",
67
+ "sha256": "3ec8364e062dcfc9f631262d9d36afc750f49080483755767345fcc22c1b1e42",
68
+ "role": "reviewer-approval"
69
+ }
70
+ ],
71
+ "attestation": {
72
+ "level": "self",
73
+ "signatures": []
74
+ },
75
+ "recordedAt": "2026-08-25T00:00:00Z",
76
+ "claims": [
77
+ {
78
+ "obligation": "review.green",
79
+ "payloadSpec": "review.green/1",
80
+ "payload": {
81
+ "verdict": "green",
82
+ "finalized": true,
83
+ "editedAfterFinalPass": false,
84
+ "reviewers": {
85
+ "selected": [
86
+ "correctness",
87
+ "security",
88
+ "tests"
89
+ ],
90
+ "completed": [
91
+ "correctness",
92
+ "security",
93
+ "tests"
94
+ ],
95
+ "failed": [],
96
+ "timedOut": []
97
+ },
98
+ "findings": [
99
+ {
100
+ "id": "f-1",
101
+ "severity": "P2",
102
+ "scope": "in_contract",
103
+ "actionable": true,
104
+ "blocking": false,
105
+ "disposition": "unresolved"
106
+ }
107
+ ],
108
+ "telemetry": {
109
+ "iterationCount": 2,
110
+ "findingCounts": {
111
+ "P0": 0,
112
+ "P1": 0,
113
+ "P2": 1,
114
+ "P3": 0
115
+ },
116
+ "deferredExpansionCount": 0,
117
+ "deferredIssueIds": []
118
+ }
119
+ }
120
+ }
121
+ ]
122
+ }
123
+ }
package/vectors/vectors/reject/rg-6-blocking-finding.json ADDED
@@ -0,0 +1,123 @@
1
+ {
2
+ "vectorVersion": 1,
3
+ "id": "rg-6-blocking-finding",
4
+ "title": "A blocking finding in a green manifest",
5
+ "rules": [
6
+ "RG-6"
7
+ ],
8
+ "provenance": "athena:scripts/harness-review-evidence.test.ts \"rejects blocking findings\"",
9
+ "expect": {
10
+ "result": "rejected",
11
+ "codes": [
12
+ "blocking_finding_present"
13
+ ]
14
+ },
15
+ "artifacts": {
16
+ "reviewers/correctness.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"correctness\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
17
+ "reviewers/security.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"security\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
18
+ "reviewers/tests.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"tests\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n"
19
+ },
20
+ "manifest": {
21
+ "spec": "delivery-evidence/1",
22
+ "provider": {
23
+ "id": "claude-code.ce-code-review",
24
+ "version": "1.0.0",
25
+ "runId": "r-conformance-01",
26
+ "finalPassId": "pass-2"
27
+ },
28
+ "candidate": {
29
+ "vcs": "git",
30
+ "treeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
31
+ "headSha": "31740476c0227fc5c77b00c37aff24d03d692e47",
32
+ "deliverable": {
33
+ "digest": "c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9",
34
+ "identity": "deliverable-tree/v1"
35
+ },
36
+ "base": {
37
+ "ref": "origin/main",
38
+ "tipSha": "8248f1bc1cf32509843ef77387841c8ea06245cb",
39
+ "mergeBaseSha": "892135fcf4acee18bebcefd8398192fd0faf1293"
40
+ },
41
+ "workspaceId": "w-0dcf2d98505da17d"
42
+ },
43
+ "repository": null,
44
+ "runHistory": [
45
+ {
46
+ "preparedTreeSha": "132c7f8efa52032271d4f06fc0cb9e264a05e0e1",
47
+ "evaluatedInPassId": "pass-1"
48
+ },
49
+ {
50
+ "preparedTreeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
51
+ "evaluatedInPassId": "pass-2"
52
+ }
53
+ ],
54
+ "artifacts": [
55
+ {
56
+ "path": "reviewers/correctness.json",
57
+ "sha256": "128b2a9756c778c36ce29b4390e944c2f05438904d1953a0bed4027f55e1ede8",
58
+ "role": "reviewer-approval"
59
+ },
60
+ {
61
+ "path": "reviewers/security.json",
62
+ "sha256": "4933efc56d9e3fe6173f31b703ba7c41cb7490cbd2f5538b5b5ef2a7cc8fa03e",
63
+ "role": "reviewer-approval"
64
+ },
65
+ {
66
+ "path": "reviewers/tests.json",
67
+ "sha256": "3ec8364e062dcfc9f631262d9d36afc750f49080483755767345fcc22c1b1e42",
68
+ "role": "reviewer-approval"
69
+ }
70
+ ],
71
+ "attestation": {
72
+ "level": "self",
73
+ "signatures": []
74
+ },
75
+ "recordedAt": "2026-08-25T00:00:00Z",
76
+ "claims": [
77
+ {
78
+ "obligation": "review.green",
79
+ "payloadSpec": "review.green/1",
80
+ "payload": {
81
+ "verdict": "green",
82
+ "finalized": true,
83
+ "editedAfterFinalPass": false,
84
+ "reviewers": {
85
+ "selected": [
86
+ "correctness",
87
+ "security",
88
+ "tests"
89
+ ],
90
+ "completed": [
91
+ "correctness",
92
+ "security",
93
+ "tests"
94
+ ],
95
+ "failed": [],
96
+ "timedOut": []
97
+ },
98
+ "findings": [
99
+ {
100
+ "id": "f-1",
101
+ "severity": "P1",
102
+ "scope": "in_contract",
103
+ "actionable": true,
104
+ "blocking": true,
105
+ "disposition": "resolved"
106
+ }
107
+ ],
108
+ "telemetry": {
109
+ "iterationCount": 2,
110
+ "findingCounts": {
111
+ "P0": 0,
112
+ "P1": 1,
113
+ "P2": 0,
114
+ "P3": 0
115
+ },
116
+ "deferredExpansionCount": 0,
117
+ "deferredIssueIds": []
118
+ }
119
+ }
120
+ }
121
+ ]
122
+ }
123
+ }
package/vectors/vectors/reject/rg-7-defer-adjacent.json ADDED
@@ -0,0 +1,126 @@
1
+ {
2
+ "vectorVersion": 1,
3
+ "id": "rg-7-defer-adjacent",
4
+ "title": "Illegal deferral: adjacent",
5
+ "rules": [
6
+ "RG-7"
7
+ ],
8
+ "provenance": "athena:scripts/harness-review-evidence.test.ts \"refuses to defer ... machine-checked rather than trusted\"",
9
+ "expect": {
10
+ "result": "rejected",
11
+ "codes": [
12
+ "illegal_deferral"
13
+ ]
14
+ },
15
+ "artifacts": {
16
+ "reviewers/correctness.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"correctness\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
17
+ "reviewers/security.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"security\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n",
18
+ "reviewers/tests.json": "{\n \"schemaVersion\": 1,\n \"reviewerId\": \"tests\",\n \"result\": \"approved\",\n \"provider\": {\n \"id\": \"claude-code.ce-code-review\",\n \"runId\": \"r-conformance-01\",\n \"finalPassId\": \"pass-2\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\",\n \"candidate\": {\n \"vcs\": \"git\",\n \"treeSha\": \"3dd16b56e3035a4c9f3d591f55edde08a4107990\",\n \"headSha\": \"31740476c0227fc5c77b00c37aff24d03d692e47\",\n \"deliverable\": {\n \"digest\": \"c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9\",\n \"identity\": \"deliverable-tree/v1\"\n },\n \"base\": {\n \"ref\": \"origin/main\",\n \"tipSha\": \"8248f1bc1cf32509843ef77387841c8ea06245cb\",\n \"mergeBaseSha\": \"892135fcf4acee18bebcefd8398192fd0faf1293\"\n },\n \"workspaceId\": \"w-0dcf2d98505da17d\"\n }\n}\n"
19
+ },
20
+ "manifest": {
21
+ "spec": "delivery-evidence/1",
22
+ "provider": {
23
+ "id": "claude-code.ce-code-review",
24
+ "version": "1.0.0",
25
+ "runId": "r-conformance-01",
26
+ "finalPassId": "pass-2"
27
+ },
28
+ "candidate": {
29
+ "vcs": "git",
30
+ "treeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
31
+ "headSha": "31740476c0227fc5c77b00c37aff24d03d692e47",
32
+ "deliverable": {
33
+ "digest": "c63b4981ab1c11a6e19a0225d596ecd59a399e2fdf06cffbb8da69bace6b9db9",
34
+ "identity": "deliverable-tree/v1"
35
+ },
36
+ "base": {
37
+ "ref": "origin/main",
38
+ "tipSha": "8248f1bc1cf32509843ef77387841c8ea06245cb",
39
+ "mergeBaseSha": "892135fcf4acee18bebcefd8398192fd0faf1293"
40
+ },
41
+ "workspaceId": "w-0dcf2d98505da17d"
42
+ },
43
+ "repository": null,
44
+ "runHistory": [
45
+ {
46
+ "preparedTreeSha": "132c7f8efa52032271d4f06fc0cb9e264a05e0e1",
47
+ "evaluatedInPassId": "pass-1"
48
+ },
49
+ {
50
+ "preparedTreeSha": "3dd16b56e3035a4c9f3d591f55edde08a4107990",
51
+ "evaluatedInPassId": "pass-2"
52
+ }
53
+ ],
54
+ "artifacts": [
55
+ {
56
+ "path": "reviewers/correctness.json",
57
+ "sha256": "128b2a9756c778c36ce29b4390e944c2f05438904d1953a0bed4027f55e1ede8",
58
+ "role": "reviewer-approval"
59
+ },
60
+ {
61
+ "path": "reviewers/security.json",
62
+ "sha256": "4933efc56d9e3fe6173f31b703ba7c41cb7490cbd2f5538b5b5ef2a7cc8fa03e",
63
+ "role": "reviewer-approval"
64
+ },
65
+ {
66
+ "path": "reviewers/tests.json",
67
+ "sha256": "3ec8364e062dcfc9f631262d9d36afc750f49080483755767345fcc22c1b1e42",
68
+ "role": "reviewer-approval"
69
+ }
70
+ ],
71
+ "attestation": {
72
+ "level": "self",
73
+ "signatures": []
74
+ },
75
+ "recordedAt": "2026-08-25T00:00:00Z",
76
+ "claims": [
77
+ {
78
+ "obligation": "review.green",
79
+ "payloadSpec": "review.green/1",
80
+ "payload": {
81
+ "verdict": "green",
82
+ "finalized": true,
83
+ "editedAfterFinalPass": false,
84
+ "reviewers": {
85
+ "selected": [
86
+ "correctness",
87
+ "security",
88
+ "tests"
89
+ ],
90
+ "completed": [
91
+ "correctness",
92
+ "security",
93
+ "tests"
94
+ ],
95
+ "failed": [],
96
+ "timedOut": []
97
+ },
98
+ "findings": [
99
+ {
100
+ "id": "f-def-1",
101
+ "severity": "P2",
102
+ "scope": "adjacent",
103
+ "actionable": true,
104
+ "blocking": false,
105
+ "disposition": "deferred",
106
+ "deferredIssueId": "EX-1300"
107
+ }
108
+ ],
109
+ "telemetry": {
110
+ "iterationCount": 2,
111
+ "findingCounts": {
112
+ "P0": 0,
113
+ "P1": 0,
114
+ "P2": 1,
115
+ "P3": 0
116
+ },
117
+ "deferredExpansionCount": 1,
118
+ "deferredIssueIds": [
119
+ "EX-1300"
120
+ ]
121
+ }
122
+ }
123
+ }
124
+ ]
125
+ }
126
+ }