@agentskit/harness 0.1.0

package/dist/cli.js

@@ -0,0 +1,1308 @@
+#!/usr/bin/env node
+import { createPrivateKey, createPublicKey, sign, verify, createHash } from 'crypto';
+import { readFileSync, mkdirSync, writeFileSync, existsSync, openSync, writeSync, appendFileSync, closeSync, unlinkSync, mkdtempSync, renameSync, rmSync, lstatSync, readdirSync } from 'fs';
+import { Command } from 'commander';
+import { resolve, dirname, relative, join, sep } from 'path';
+import { execFile, spawn } from 'child_process';
+import { promisify } from 'util';
+import { tmpdir } from 'os';
+
+// src/constants.ts
+var STATES = [
+  "CLARIFYING",
+  "PLANNED",
+  "IMPLEMENTING",
+  "VERIFYING",
+  "AWAITING_HUMAN_APPROVAL",
+  "AWAITING_AUTHORIZATION",
+  "COMPLETE",
+  "BLOCKED",
+  "STALE",
+  "CANCELLED",
+  "SUPERSEDED"
+];
+var LEGAL_TRANSITIONS = {
+  CLARIFYING: ["PLANNED", "BLOCKED", "CANCELLED"],
+  PLANNED: ["IMPLEMENTING", "CLARIFYING", "STALE", "CANCELLED"],
+  IMPLEMENTING: ["VERIFYING", "CLARIFYING", "STALE", "CANCELLED"],
+  VERIFYING: ["AWAITING_HUMAN_APPROVAL", "BLOCKED", "STALE", "CANCELLED"],
+  AWAITING_HUMAN_APPROVAL: ["AWAITING_AUTHORIZATION", "COMPLETE", "BLOCKED", "IMPLEMENTING", "STALE", "CANCELLED"],
+  AWAITING_AUTHORIZATION: ["COMPLETE", "BLOCKED", "IMPLEMENTING", "STALE", "CANCELLED"],
+  COMPLETE: ["STALE", "SUPERSEDED"],
+  BLOCKED: ["SUPERSEDED"],
+  STALE: ["SUPERSEDED", "PLANNED"],
+  CANCELLED: ["SUPERSEDED"],
+  SUPERSEDED: []
+};
+var REAL_CATEGORIES = /* @__PURE__ */ new Set(["endpoint", "database", "cli", "mcp", "ui"]);
+var DECISIONS = /* @__PURE__ */ new Set(["approved", "approve", "yes", "ok", "rejected", "reject", "no"]);
+
+// src/errors.ts
+var HarnessError = class extends Error {
+  code;
+  constructor(message, code = "HARNESS_ERROR") {
+    super(message);
+    this.name = "HarnessError";
+    this.code = code;
+  }
+};
+var fail = (message, code = "HARNESS_ERROR") => {
+  throw new HarnessError(message, code);
+};
+
+// src/profiles.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record = (value, label) => {
+  if (!isRecord(value)) fail(`${label} must be an object.`, "INVALID_CONFIG");
+  return value;
+};
+var id = (value, label) => {
+  if (typeof value !== "string" || !value.trim()) fail(`${label} must be a non-empty string.`, "INVALID_CONFIG");
+  return value;
+};
+var parents = (value, label) => value === void 0 ? [] : Array.isArray(value) ? value.map((item, index2) => id(item, `${label}[${index2}]`)) : [id(value, label)];
+var merge = (base, overlay) => {
+  const result = { ...base };
+  for (const key of ["surfaces", "budget", "cleanup"]) {
+    if (overlay[key] !== void 0) result[key] = { ...isRecord(result[key]) ? result[key] : {}, ...record(overlay[key], `profile.${key}`) };
+  }
+  if (overlay["checkOverrides"] !== void 0) {
+    if (!Array.isArray(overlay["checkOverrides"])) fail("profile.checkOverrides must be an array.", "INVALID_CONFIG");
+    const checks = Array.isArray(result["checks"]) ? [...result["checks"]] : [];
+    for (const [index2, value] of overlay["checkOverrides"].entries()) {
+      const override = record(value, `profile.checkOverrides[${index2}]`);
+      const checkId = id(override["id"], `profile.checkOverrides[${index2}].id`);
+      const checkIndex = checks.findIndex((check) => isRecord(check) && check["id"] === checkId);
+      if (checkIndex < 0) fail(`profile.checkOverrides references unknown check: ${checkId}.`, "INVALID_CONFIG");
+      checks[checkIndex] = { ...checks[checkIndex], ...override };
+    }
+    result["checks"] = checks;
+  }
+  return result;
+};
+var resolveProfile = (root) => {
+  if (root["profiles"] === void 0) return root;
+  const profileMap = record(root["profiles"], "profiles");
+  const selected = id(root["profile"], "profile");
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Map();
+  const resolve6 = (name) => {
+    const cached = visited.get(name);
+    if (cached) return cached;
+    if (visiting.has(name)) fail(`Profile inheritance cycle includes ${name}.`, "INVALID_CONFIG");
+    const definition = record(profileMap[name], `profiles.${name}`);
+    visiting.add(name);
+    let result = { ...root };
+    for (const parent of parents(definition["extends"], `profiles.${name}.extends`)) result = merge(result, resolve6(parent));
+    result = merge(result, definition);
+    visiting.delete(name);
+    visited.set(name, result);
+    return result;
+  };
+  return resolve6(selected);
+};
+var sha256 = (value) => createHash("sha256").update(value).digest("hex");
+var hashJson = (value) => sha256(JSON.stringify(value));
+var readJson = (path) => JSON.parse(readFileSync(path, "utf8"));
+var writeJson = (path, value) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+};
+var pathInside = (root, candidate) => {
+  const rel = relative(resolve(root), resolve(candidate));
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !rel.startsWith(sep);
+};
+var latestPath = (stateDir) => join(stateDir, "latest.json");
+var runPath = (stateDir, runId) => join(stateDir, "runs", runId, "run.json");
+var saveRun = (stateDir, run) => writeJson(runPath(stateDir, run.runId), run);
+var readRun = (stateDir, runId) => readJson(runPath(stateDir, runId));
+var loadLatestRun = (stateDir) => {
+  if (!existsSync(latestPath(stateDir))) return null;
+  const pointer = readJson(latestPath(stateDir));
+  return readRun(stateDir, pointer.runId);
+};
+var setLatest = (stateDir, run) => writeJson(latestPath(stateDir), {
+  runId: run.runId,
+  path: relative(resolve(stateDir, "..", ".."), runPath(stateDir, run.runId)),
+  updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+});
+var cleanConfiguredArtifacts = (loaded) => {
+  const roots = loaded.config.cleanup?.roots ?? [];
+  for (const root of roots) {
+    const target = resolve(loaded.root, root);
+    if (!pathInside(loaded.root, target)) fail(`Cleanup root escapes project root: ${root}`, "INVALID_CONFIG");
+    if (existsSync(target)) for (const entry of readdirSync(target)) rmSync(join(target, entry), { recursive: true, force: true });
+  }
+  return { cleaned: roots };
+};
+var fileContents = (path) => readFileSync(path, "utf8");
+
+// src/types.ts
+var SURFACE_NAMES = ["logic", "endpoint", "database", "cli", "mcp", "ui", "docs"];
+var CHECK_CATEGORIES = ["build", "test", "lint", ...SURFACE_NAMES, "custom"];
+var RUN_STATES = [
+  "CLARIFYING",
+  "PLANNED",
+  "IMPLEMENTING",
+  "VERIFYING",
+  "AWAITING_HUMAN_APPROVAL",
+  "AWAITING_AUTHORIZATION",
+  "COMPLETE",
+  "BLOCKED",
+  "STALE",
+  "CANCELLED",
+  "SUPERSEDED"
+];
+
+// src/config.ts
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var stringValue = (value, label) => {
+  if (typeof value !== "string") return fail(`${label} is required.`, "INVALID_CONFIG");
+  const result = value.trim();
+  if (!result) return fail(`${label} is required.`, "INVALID_CONFIG");
+  return result;
+};
+var stringArray = (value, label) => {
+  if (!Array.isArray(value)) fail(`${label} must be an array of non-empty strings.`, "INVALID_CONFIG");
+  const items = value;
+  if (!items.every((item) => typeof item === "string" && Boolean(item.trim()))) fail(`${label} must be an array of non-empty strings.`, "INVALID_CONFIG");
+  return items.map((item) => stringValue(item, label));
+};
+var asRecord = (value, label) => {
+  if (!isRecord2(value)) fail(`${label} must be an object.`, "INVALID_CONFIG");
+  return value;
+};
+var surface = (value, name) => {
+  if (typeof value === "boolean") return value ? { required: true } : { required: false, reason: `${name} is not applicable.` };
+  const record3 = asRecord(value, `surfaces.${name}`);
+  if (typeof record3["required"] !== "boolean") fail(`surfaces.${name}.required must be boolean.`, "INVALID_CONFIG");
+  if (!record3["required"] && typeof record3["reason"] !== "string") fail(`surfaces.${name}.reason is required when not applicable.`, "INVALID_CONFIG");
+  return { required: record3["required"], ...typeof record3["reason"] === "string" ? { reason: record3["reason"] } : {} };
+};
+var parseCheck = (value, index2) => {
+  const record3 = asRecord(value, `checks[${index2}]`);
+  const id2 = stringValue(record3["id"], `checks[${index2}].id`);
+  const category = stringValue(record3["category"], `checks[${index2}].category`);
+  if (!CHECK_CATEGORIES.includes(category)) fail(`checks[${index2}].category is invalid.`, "INVALID_CONFIG");
+  const command = stringValue(record3["command"], `checks[${index2}].command`);
+  if (REAL_CATEGORIES.has(category) && record3["execution"] !== "real") fail(`checks[${index2}] must declare execution: real.`, "INVALID_CONFIG");
+  if (record3["evidence"] !== "structured") fail(`checks[${index2}] must declare evidence: structured.`, "INVALID_CONFIG");
+  if (record3["capabilities"] !== void 0 && (!Array.isArray(record3["capabilities"]) || !record3["capabilities"].every((item) => typeof item === "string"))) fail(`checks[${index2}].capabilities must be strings.`, "INVALID_CONFIG");
+  const capabilities = Array.isArray(record3["capabilities"]) ? record3["capabilities"].filter((item) => typeof item === "string") : void 0;
+  if (category === "ui" && !capabilities?.includes("real-browser")) fail(`checks[${index2}] must declare real-browser.`, "INVALID_CONFIG");
+  if (category === "ui" && !capabilities?.includes("screenshot")) fail(`checks[${index2}] must declare screenshot.`, "INVALID_CONFIG");
+  if (record3["required"] !== void 0 && typeof record3["required"] !== "boolean") fail(`checks[${index2}].required must be boolean.`, "INVALID_CONFIG");
+  if (record3["timeoutMs"] !== void 0 && (!Number.isInteger(record3["timeoutMs"]) || typeof record3["timeoutMs"] !== "number" || record3["timeoutMs"] < 1)) fail(`checks[${index2}].timeoutMs must be positive.`, "INVALID_CONFIG");
+  return { id: id2, category, command, required: record3["required"] !== false, timeoutMs: typeof record3["timeoutMs"] === "number" ? record3["timeoutMs"] : 12e4, ...record3["execution"] === "real" ? { execution: "real" } : {}, ...capabilities ? { capabilities } : {}, evidence: "structured" };
+};
+var parseOutcome = (value, index2, checks) => {
+  const record3 = asRecord(value, `contract.outcomes[${index2}]`);
+  const id2 = stringValue(record3["id"], `contract.outcomes[${index2}].id`);
+  const statement = stringValue(record3["statement"], `contract.outcomes[${index2}].statement`);
+  const ids = stringArray(record3["checks"], `contract.outcomes[${index2}].checks`);
+  if (ids.some((checkId) => !checks.some((check) => check.id === checkId))) fail(`contract.outcomes[${index2}] references an unknown check.`, "INVALID_CONFIG");
+  return { id: id2, statement, checks: [...new Set(ids)] };
+};
+var validateConfig = (rawValue) => {
+  const raw = resolveProfile(asRecord(rawValue, "verification config"));
+  if (raw["schemaVersion"] !== 1) fail("verification config schemaVersion must be 1.", "INVALID_CONFIG");
+  const project = stringValue(raw["project"], "verification config project");
+  const contractRaw = asRecord(raw["contract"], "contract");
+  const rawChecks = raw["checks"];
+  const checks = Array.isArray(rawChecks) ? rawChecks.map(parseCheck) : fail("checks must be a non-empty array.", "INVALID_CONFIG");
+  if (!checks.length || new Set(checks.map((check) => check.id)).size !== checks.length) fail("check ids must be unique.", "INVALID_CONFIG");
+  const scopeRaw = asRecord(contractRaw["scope"], "contract.scope");
+  const scope = { inScope: stringArray(scopeRaw["inScope"], "contract.scope.inScope"), outOfScope: stringArray(scopeRaw["outOfScope"], "contract.scope.outOfScope") };
+  const ambiguities = stringArray(contractRaw["ambiguities"], "contract.ambiguities");
+  const rawOutcomes = contractRaw["outcomes"];
+  const outcomes = Array.isArray(rawOutcomes) ? rawOutcomes.map((outcome, index2) => parseOutcome(outcome, index2, checks)) : fail("contract.outcomes must be a non-empty array.", "INVALID_CONFIG");
+  if (!outcomes.length || new Set(outcomes.map((outcome) => outcome.id)).size !== outcomes.length) fail("outcome ids must be unique.", "INVALID_CONFIG");
+  const mapped = new Set(outcomes.flatMap((outcome) => outcome.checks));
+  if (checks.some((check) => check.required && !mapped.has(check.id))) fail("every required check must map to an outcome.", "INVALID_CONFIG");
+  const rawSurfaces = isRecord2(raw["surfaces"]) ? raw["surfaces"] : void 0;
+  const surfaces = Object.fromEntries(SURFACE_NAMES.map((name) => [name, surface(rawSurfaces?.[name] ?? name === "logic", name)]));
+  for (const name of SURFACE_NAMES) if (surfaces[name].required && !checks.some((check) => check.required && check.category === name)) fail(`required surface ${name} has no required check.`, "INVALID_CONFIG");
+  const trackingRaw = isRecord2(raw["tracking"]) ? raw["tracking"] : { required: false, reason: "tracking is not configured for this run." };
+  if (trackingRaw["required"] === true && typeof trackingRaw["target"] !== "string") fail("tracking.target is required when tracking is enabled.", "INVALID_CONFIG");
+  if (trackingRaw["required"] !== true && typeof trackingRaw["reason"] !== "string") fail("tracking.reason is required when tracking is disabled.", "INVALID_CONFIG");
+  const budgetRaw = raw["budget"] === void 0 ? void 0 : asRecord(raw["budget"], "budget");
+  if (budgetRaw && budgetRaw["maxDurationMs"] !== void 0 && (!Number.isInteger(budgetRaw["maxDurationMs"]) || typeof budgetRaw["maxDurationMs"] !== "number" || budgetRaw["maxDurationMs"] < 1)) fail("budget.maxDurationMs must be positive.", "INVALID_CONFIG");
+  const cleanupRaw = raw["cleanup"] === void 0 ? void 0 : asRecord(raw["cleanup"], "cleanup");
+  const cleanup = cleanupRaw ? { roots: cleanupRaw["roots"] === void 0 ? void 0 : stringArray(cleanupRaw["roots"], "cleanup.roots") } : void 0;
+  const benchmarkRaw = raw["benchmark"] === void 0 ? void 0 : asRecord(raw["benchmark"], "benchmark");
+  const benchmark2 = benchmarkRaw ? { suiteId: stringValue(benchmarkRaw["suiteId"], "benchmark.suiteId"), taskId: stringValue(benchmarkRaw["taskId"], "benchmark.taskId"), mode: benchmarkRaw["mode"] === "harness" ? "harness" : fail("benchmark.mode must be harness.", "INVALID_CONFIG") } : void 0;
+  const contract = { intent: stringValue(contractRaw["intent"], "contract.intent"), scope, ambiguities, outcomes };
+  const tracking = { required: trackingRaw["required"] === true, ...typeof trackingRaw["target"] === "string" ? { target: trackingRaw["target"] } : {}, ...typeof trackingRaw["reason"] === "string" ? { reason: trackingRaw["reason"] } : {} };
+  return { schemaVersion: 1, project, ...typeof raw["root"] === "string" ? { root: raw["root"] } : {}, ...typeof raw["stateDir"] === "string" ? { stateDir: raw["stateDir"] } : {}, profile: typeof raw["profile"] === "string" ? raw["profile"] : "strict", contract, surfaces, checks, tracking, ...budgetRaw ? { budget: { maxDurationMs: budgetRaw["maxDurationMs"] } } : {}, ...cleanup ? { cleanup } : {}, ...benchmark2 ? { benchmark: benchmark2 } : {} };
+};
+var loadConfig = (configPath = ".codex/verification.json") => {
+  const absolute = resolve(configPath);
+  const raw = readJson(absolute);
+  const rawRecord = asRecord(raw, "verification config");
+  const root = resolve(dirname(absolute), typeof rawRecord["root"] === "string" ? rawRecord["root"] : ".");
+  const stateDir = resolve(root, typeof rawRecord["stateDir"] === "string" ? rawRecord["stateDir"] : ".codex/verification");
+  if (!pathInside(root, stateDir)) fail("stateDir must be inside the project root.", "INVALID_CONFIG");
+  const config = validateConfig(raw);
+  return { absolute, root, stateDir, config, configHash: hashJson(config) };
+};
+
+// src/state-machine.ts
+var transition = (run, to, reason, actor = "harness") => {
+  if (!STATES.includes(to)) fail(`Unknown state ${to}.`, "INVALID_STATE");
+  if (run.state !== to && !LEGAL_TRANSITIONS[run.state].some((state) => state === to)) fail(`Illegal transition ${run.state} -> ${to}.`, "INVALID_STATE");
+  const event = { from: run.state, to, at: (/* @__PURE__ */ new Date()).toISOString(), actor, ...reason ? { reason } : {} };
+  return { ...run, state: to, transitions: [...run.transitions, event] };
+};
+var assertHuman = (actor) => {
+  if (actor !== "human") fail("This action requires --by human.", "HUMAN_APPROVAL_REQUIRED");
+};
+var approvedDecision = (decision) => {
+  if (!DECISIONS.has(decision)) fail("Decision must be approved or rejected.", "INVALID_INPUT");
+  return ["approved", "approve", "yes", "ok"].includes(decision);
+};
+var HARNESS_EVENT_SCHEMA_VERSION = 1;
+var EVENT_LOG_GENESIS = "GENESIS";
+var HARNESS_EVENT_TYPES = ["run.created", "state.transitioned", "context.attached", "verification.completed", "approval.recorded", "authorization.recorded", "session.started", "session.resumed", "agent.turn.started", "policy.evaluated", "tool.approval.requested", "tool.approval.recorded", "tool.requested", "tool.execution.started", "tool.recovery.recorded", "tool.blocked", "tool.completed", "tool.failed", "session.ended"];
+var SESSION_EVENT_TYPES = /* @__PURE__ */ new Set(["session.started", "session.resumed", "agent.turn.started", "policy.evaluated", "tool.approval.requested", "tool.approval.recorded", "tool.requested", "tool.execution.started", "tool.recovery.recorded", "tool.blocked", "tool.completed", "tool.failed", "session.ended"]);
+var eventPath = (stateDir, runId) => join(stateDir, "runs", runId, "events.ndjson");
+var lockPath = (stateDir, runId) => `${eventPath(stateDir, runId)}.lock`;
+var parseLock = (value) => {
+  try {
+    const record3 = JSON.parse(value);
+    if (!Number.isInteger(record3["pid"]) || record3["pid"] <= 0 || typeof record3["at"] !== "string" || !Number.isFinite(Date.parse(record3["at"]))) fail("Event log lock metadata is invalid.", "HARNESS_ERROR");
+    return { pid: record3["pid"], at: record3["at"] };
+  } catch (error) {
+    if (error instanceof SyntaxError) fail("Event log lock metadata is invalid.", "HARNESS_ERROR");
+    throw error;
+  }
+};
+var readLock = (stateDir, runId) => {
+  const path = lockPath(stateDir, runId);
+  return existsSync(path) ? parseLock(readFileSync(path, "utf8")) : null;
+};
+var isEventType = (value) => typeof value === "string" && HARNESS_EVENT_TYPES.includes(value);
+var digest = (value) => /^[a-f0-9]{64}$/.test(value);
+var eventBody = (event) => {
+  const { eventHash: _eventHash, ...body2 } = event;
+  return body2;
+};
+var eventDigest = (event) => sha256(JSON.stringify(eventBody(event)));
+var parseEvent = (value, expectedSequence) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) fail("Event log contains a non-object record.", "HARNESS_ERROR");
+  const record3 = value;
+  if (record3["schemaVersion"] !== HARNESS_EVENT_SCHEMA_VERSION || typeof record3["runId"] !== "string" || typeof record3["sequence"] !== "number" || record3["sequence"] !== expectedSequence || typeof record3["at"] !== "string" || typeof record3["sourceRevision"] !== "string" || typeof record3["configHash"] !== "string" || !isEventType(record3["type"]) || typeof record3["payload"] !== "object" || record3["payload"] === null || record3["sessionId"] !== void 0 && (typeof record3["sessionId"] !== "string" || !record3["sessionId"].trim()) || SESSION_EVENT_TYPES.has(record3["type"]) && typeof record3["sessionId"] !== "string") fail("Event log is invalid or out of order.", "HARNESS_ERROR");
+  const hasPreviousHash = record3["previousHash"] !== void 0;
+  const hasEventHash = record3["eventHash"] !== void 0;
+  if (hasPreviousHash !== hasEventHash || hasPreviousHash && (typeof record3["previousHash"] !== "string" || record3["previousHash"] !== EVENT_LOG_GENESIS && !digest(record3["previousHash"]) || typeof record3["eventHash"] !== "string" || !digest(record3["eventHash"]))) fail("Event log integrity metadata is invalid.", "HARNESS_ERROR");
+  return record3;
+};
+var validateChain = (events2) => {
+  const current = events2.filter((event) => event.eventHash !== void 0);
+  if (!current.length) return { status: "legacy", eventCount: events2.length };
+  if (current.length !== events2.length) fail("Event log mixes legacy and hashed records.", "HARNESS_ERROR");
+  let previous = EVENT_LOG_GENESIS;
+  for (const event of events2) {
+    const eventHash = event.eventHash ?? fail("Event log hash chain is invalid.", "HARNESS_ERROR");
+    if (event.previousHash !== previous || eventHash !== eventDigest(event)) fail("Event log hash chain is invalid.", "HARNESS_ERROR");
+    previous = eventHash;
+  }
+  return { status: "verified", eventCount: events2.length, ...events2.length ? { headHash: previous } : {} };
+};
+var FileEventStore = class {
+  constructor(stateDir) {
+    this.stateDir = stateDir;
+  }
+  stateDir;
+  append(event) {
+    if (!event.runId.trim()) fail("Event runId is required.", "INVALID_INPUT");
+    if (!event.sourceRevision.trim() || !event.configHash.trim()) fail("Event sourceRevision and configHash are required.", "INVALID_INPUT");
+    if (!isEventType(event.type)) fail("Event type is invalid.", "INVALID_INPUT");
+    if (SESSION_EVENT_TYPES.has(event.type) && (!event.sessionId || !event.sessionId.trim())) fail("Session events require a sessionId.", "INVALID_INPUT");
+    if (event.sessionId !== void 0 && !event.sessionId.trim()) fail("Event sessionId cannot be empty.", "INVALID_INPUT");
+    const path = eventPath(this.stateDir, event.runId);
+    const lock = lockPath(this.stateDir, event.runId);
+    mkdirSync(join(this.stateDir, "runs", event.runId), { recursive: true });
+    let lockFd;
+    try {
+      lockFd = openSync(lock, "wx");
+      writeSync(lockFd, JSON.stringify({ pid: process.pid, at: (/* @__PURE__ */ new Date()).toISOString() }));
+    } catch (error) {
+      if (error.code === "EEXIST") fail("Event log is busy; retry the operation.", "HARNESS_ERROR");
+      throw error;
+    }
+    try {
+      const events2 = this.readUnlocked(event.runId);
+      const previous = events2.at(-1);
+      const body2 = { schemaVersion: HARNESS_EVENT_SCHEMA_VERSION, sequence: events2.length + 1, at: (/* @__PURE__ */ new Date()).toISOString(), runId: event.runId, sourceRevision: event.sourceRevision, configHash: event.configHash, ...event.sessionId ? { sessionId: event.sessionId } : {}, ...previous?.eventHash ? { previousHash: previous.eventHash } : events2.length ? {} : { previousHash: EVENT_LOG_GENESIS }, type: event.type, payload: event.payload };
+      const record3 = events2.length && !previous?.eventHash ? body2 : { ...body2, eventHash: eventDigest(body2) };
+      appendFileSync(path, `${JSON.stringify(record3)}
+`, "utf8");
+      return record3;
+    } finally {
+      closeSync(lockFd);
+      unlinkSync(lock);
+    }
+  }
+  readUnlocked(runId) {
+    const path = eventPath(this.stateDir, runId);
+    if (!existsSync(path)) return [];
+    const events2 = readFileSync(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line, index2) => {
+      try {
+        return parseEvent(JSON.parse(line), index2 + 1);
+      } catch (error) {
+        if (error instanceof SyntaxError) fail("Event log contains invalid JSON.", "HARNESS_ERROR");
+        throw error;
+      }
+    });
+    validateChain(events2);
+    return events2;
+  }
+  read(runId) {
+    if (existsSync(lockPath(this.stateDir, runId))) fail("Event log is busy; retry the operation.", "HARNESS_ERROR");
+    return this.readUnlocked(runId);
+  }
+  verify(runId) {
+    return validateChain(this.read(runId));
+  }
+};
+var inspectEventLogLock = (stateDir, runId) => {
+  const path = lockPath(stateDir, runId);
+  const lock = readLock(stateDir, runId);
+  return lock ? { status: "locked", path, lock } : { status: "unlocked", path };
+};
+var recoverEventLogLock = ({ stateDir, runId, actor, maxAgeMs = 3e5 }) => {
+  if (actor !== "human") fail("Event log lock recovery requires a human actor.", "HUMAN_APPROVAL_REQUIRED");
+  if (!Number.isInteger(maxAgeMs) || maxAgeMs < 0) fail("maxAgeMs must be a non-negative integer.", "INVALID_INPUT");
+  const path = lockPath(stateDir, runId);
+  const lock = readLock(stateDir, runId);
+  if (!lock) return { status: "unlocked", path };
+  const ageMs = Date.now() - Date.parse(lock.at);
+  if (ageMs < maxAgeMs) fail("Event log lock is not old enough to recover.", "HARNESS_ERROR");
+  try {
+    process.kill(lock.pid, 0);
+  } catch (error) {
+    if (error.code !== "ESRCH") fail("Event log lock owner cannot be proven dead.", "HARNESS_ERROR");
+    unlinkSync(path);
+    return { status: "recovered", path, lock };
+  }
+  return fail("Event log lock owner is still alive.", "HARNESS_ERROR");
+};
+
+// src/plugins.ts
+var createPluginSlot = (id2) => {
+  if (!id2.trim()) fail("Plugin slot id is required.", "INVALID_INPUT");
+  return { id: id2 };
+};
+
+// src/context.ts
+var hashContextSnapshot = ({ providerId, query, references, sourceHash: sourceHash2 }) => hashJson({ providerId, query, references, sourceHash: sourceHash2 });
+var hashContextSnapshots = (snapshots) => hashJson(snapshots.map(({ providerId, query, references, sourceHash: sourceHash2, snapshotHash }) => ({ providerId, query, references, sourceHash: sourceHash2, snapshotHash })));
+var record2 = (value, label) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) fail(`${label} must be an object.`, "INVALID_INPUT");
+  return value;
+};
+var requiredString = (value, label) => {
+  if (typeof value !== "string" || !value.trim()) fail(`${label} must be a non-empty string.`, "INVALID_INPUT");
+  return value;
+};
+var validateContextSnapshot = (value, index2 = 0) => {
+  const raw = record2(value, `context snapshot ${index2}`);
+  const rawQuery = record2(raw["query"], `context snapshot ${index2}.query`);
+  const rawReferences = raw["references"];
+  if (!Array.isArray(rawReferences)) fail(`context snapshot ${index2}.references must be an array.`, "INVALID_INPUT");
+  const references = rawReferences.map((reference, referenceIndex) => {
+    const rawReference = record2(reference, `context snapshot ${index2}.references[${referenceIndex}]`);
+    return {
+      id: requiredString(rawReference["id"], `context snapshot ${index2}.references[${referenceIndex}].id`),
+      uri: requiredString(rawReference["uri"], `context snapshot ${index2}.references[${referenceIndex}].uri`),
+      ...typeof rawReference["title"] === "string" ? { title: rawReference["title"] } : {},
+      ...typeof rawReference["version"] === "string" ? { version: rawReference["version"] } : {},
+      ...typeof rawReference["contentHash"] === "string" ? { contentHash: rawReference["contentHash"] } : {}
+    };
+  });
+  const scope = rawQuery["scope"] === void 0 ? void 0 : Array.isArray(rawQuery["scope"]) && rawQuery["scope"].every((item) => typeof item === "string") ? rawQuery["scope"] : fail(`context snapshot ${index2}.query.scope must be an array of strings.`, "INVALID_INPUT");
+  const snapshot = {
+    providerId: requiredString(raw["providerId"], `context snapshot ${index2}.providerId`),
+    query: { query: requiredString(rawQuery["query"], `context snapshot ${index2}.query.query`), ...scope ? { scope } : {}, ...typeof rawQuery["sourceRevision"] === "string" ? { sourceRevision: rawQuery["sourceRevision"] } : {} },
+    references,
+    sourceHash: requiredString(raw["sourceHash"], `context snapshot ${index2}.sourceHash`),
+    snapshotHash: requiredString(raw["snapshotHash"], `context snapshot ${index2}.snapshotHash`),
+    resolvedAt: requiredString(raw["resolvedAt"], `context snapshot ${index2}.resolvedAt`)
+  };
+  if (snapshot.snapshotHash !== hashContextSnapshot(snapshot)) fail(`context snapshot ${index2}.snapshotHash does not match its contents.`, "INVALID_INPUT");
+  return snapshot;
+};
+var readContextSnapshots = (path) => {
+  const value = JSON.parse(readFileSync(path, "utf8"));
+  return (Array.isArray(value) ? value : [value]).map((snapshot, index2) => validateContextSnapshot(snapshot, index2));
+};
+var validateContextSnapshots = (snapshots) => snapshots.map((snapshot, index2) => validateContextSnapshot(snapshot, index2));
+createPluginSlot("context.provider");
+
+// src/runs.ts
+var now = () => (/* @__PURE__ */ new Date()).toISOString();
+var newRunId = () => `${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+var saveRun2 = (stateDir, run) => {
+  saveRun(stateDir, run);
+  const store = new FileEventStore(stateDir);
+  const events2 = store.read(run.runId);
+  if (!events2.some((event) => event.type === "run.created")) store.append({ runId: run.runId, sourceRevision: run.sourceRevision, configHash: run.configHash, type: "run.created", payload: { project: run.project, baselineRevision: run.baseline.revision, baselineStatusHash: run.baseline.statusHash } });
+  const loggedTransitions = new Set(events2.filter((event) => event.type === "state.transitioned").map((event) => event.payload.transitionIndex));
+  run.transitions.forEach((transition2, transitionIndex) => {
+    if (loggedTransitions.has(transitionIndex)) return;
+    store.append({ runId: run.runId, sourceRevision: run.sourceRevision, configHash: run.configHash, type: "state.transitioned", payload: { from: transition2.from, to: transition2.to, actor: transition2.actor ?? "harness", ...transition2.reason ? { reason: transition2.reason } : {}, transitionIndex } });
+  });
+  const loggedSnapshots = new Set(events2.filter((event) => event.type === "context.attached").map((event) => event.payload.snapshotHash));
+  for (const snapshot of run.contextSnapshots ?? []) {
+    if (loggedSnapshots.has(snapshot.snapshotHash)) continue;
+    store.append({ runId: run.runId, sourceRevision: run.sourceRevision, configHash: run.configHash, type: "context.attached", payload: { providerId: snapshot.providerId, sourceHash: snapshot.sourceHash, snapshotHash: snapshot.snapshotHash, query: snapshot.query } });
+  }
+};
+var createRun = async ({ loaded, baseline, supersedes, dirtyBaselineAuthorized, contextSnapshots = [], planner = "human" }) => {
+  const contractHash = hashJson(loaded.config.contract);
+  const run = {
+    type: "agentskit-harness-run",
+    schemaVersion: 1,
+    runId: newRunId(),
+    project: loaded.config.project,
+    state: "PLANNED",
+    configHash: loaded.configHash,
+    contractHash,
+    sourceRevision: baseline.revision,
+    sourceStatusHash: baseline.statusHash,
+    baseline,
+    ...planner === "human" ? { contractApproval: { actor: "human", at: now(), contractHash } } : { contractPreparation: { actor: "ci", at: now(), contractHash } },
+    checks: loaded.config.checks.map(({ id: id2, category }) => ({ id: id2, category, status: "pending" })),
+    contextSnapshots,
+    ...contextSnapshots.length ? { contextHash: hashContextSnapshots(contextSnapshots) } : {},
+    ...loaded.config.benchmark ? { benchmark: loaded.config.benchmark } : {},
+    outcomes: loaded.config.contract.outcomes.map(({ id: id2, statement, checks }) => ({ id: id2, statement, checks, status: "pending" })),
+    transitions: [{ from: null, to: "PLANNED", at: now(), actor: planner }],
+    evidenceReferences: [],
+    ...supersedes ? { supersedes } : {},
+    ...dirtyBaselineAuthorized ? { dirtyBaselineAuthorized: true } : {}
+  };
+  saveRun2(loaded.stateDir, run);
+  setLatest(loaded.stateDir, run);
+  return run;
+};
+var parseStructuredEvidence = (stdout) => {
+  for (const line of stdout.split(/\r?\n/).map((item) => item.trim()).filter(Boolean).reverse()) {
+    try {
+      const value = JSON.parse(line);
+      if (typeof value === "object" && value !== null && !Array.isArray(value) && typeof value["status"] === "string") return value;
+    } catch {
+    }
+  }
+  return null;
+};
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var viewportValid = (viewport) => typeof viewport === "string" || isRecord3(viewport) && typeof viewport["width"] === "number" && viewport["width"] > 0 && typeof viewport["height"] === "number" && viewport["height"] > 0;
+var validateEvidence = (root, check, evidence, outcomeIds) => {
+  if (!evidence || evidence.status !== "passed") return ["structured evidence did not pass"];
+  if (!Array.isArray(evidence.criteria) || !evidence.criteria.every((id2) => typeof id2 === "string") || outcomeIds.some((id2) => !evidence.criteria.includes(id2))) return [`evidence must map criteria: ${outcomeIds.join(", ")}`];
+  const failures = [];
+  if (check.category === "ui") {
+    if (evidence.capability !== "real-browser") failures.push("UI evidence must declare capability real-browser");
+    if (!Array.isArray(evidence.artifacts) || evidence.artifacts.length === 0) failures.push("UI evidence requires screenshot artifacts");
+  }
+  const artifacts = Array.isArray(evidence.artifacts) ? evidence.artifacts : [];
+  for (const artifactValue of artifacts) {
+    if (!isRecord3(artifactValue) || typeof artifactValue["path"] !== "string" || typeof artifactValue["sha256"] !== "string") {
+      failures.push("artifact requires string path and sha256");
+      continue;
+    }
+    const artifact = artifactValue;
+    const artifactPath = join(root, artifact.path);
+    if (!pathInside(root, artifactPath)) failures.push(`artifact path escapes project root: ${artifact.path}`);
+    else if (!existsSync(artifactPath) || sha256(readFileSync(artifactPath)) !== artifact.sha256) failures.push(`artifact hash mismatch: ${artifact.path}`);
+    if (check.category === "ui" && (artifact.type !== "screenshot" || !viewportValid(artifact.viewport))) failures.push(`UI artifact requires type=screenshot and viewport: ${artifact.path}`);
+  }
+  return failures;
+};
+var execFileAsync = promisify(execFile);
+var git = async (root, args) => {
+  try {
+    return (await execFileAsync("git", ["-C", root, ...args], { encoding: "utf8" })).stdout.trim();
+  } catch {
+    return "";
+  }
+};
+var sourceSnapshot = async (root, stateDir) => {
+  const revision = await git(root, ["rev-parse", "HEAD"]);
+  const stateRelative = relative(root, stateDir).replaceAll("\\", "/");
+  const pathspec = ["--", "."];
+  if (stateRelative && stateRelative !== ".." && !stateRelative.startsWith("../")) pathspec.push(`:(exclude)${stateRelative}`);
+  const status = await git(root, ["status", "--porcelain=v1", "--untracked-files=all", ...pathspec]);
+  const diff = await git(root, ["diff", "--no-ext-diff", "--binary", "HEAD", ...pathspec]);
+  const untrackedPaths = (await git(root, ["ls-files", "--others", "--exclude-standard", "-z"])).split("\0").filter(Boolean).filter((path) => !stateRelative || path !== stateRelative && !path.startsWith(`${stateRelative}/`));
+  const untracked = untrackedPaths.flatMap((path) => {
+    const absolute = resolve(root, path);
+    try {
+      return lstatSync(absolute).isFile() ? [{ path, hash: sha256(readFileSync(absolute)) }] : [];
+    } catch {
+      return [];
+    }
+  });
+  const fingerprint = { revision, status, diff, untracked };
+  return { revision: revision || `content:${hashJson(fingerprint)}`, status, statusHash: hashJson(fingerprint) };
+};
+
+// src/verification.ts
+var now2 = () => (/* @__PURE__ */ new Date()).toISOString();
+var requireRun = (run) => run ?? fail("No verification run exists.", "NO_RUN");
+var verificationProjection = (run) => ({ checks: run.checks, outcomes: run.outcomes, metrics: run.metrics });
+var verificationDigest = (run) => hashJson(verificationProjection(run));
+var runCommand = (check, cwd) => new Promise((resolveResult) => {
+  const started = Date.now();
+  const child = spawn(check.command, { cwd, shell: true, env: process.env });
+  let stdout = "";
+  let stderr = "";
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    child.kill("SIGTERM");
+  }, check.timeoutMs);
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString();
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  child.on("close", (exitCode) => {
+    clearTimeout(timer);
+    resolveResult({ exitCode: exitCode ?? 1, timedOut, stdout, stderr, durationMs: Date.now() - started });
+  });
+});
+var currentBinding = async (loaded) => ({ source: await sourceSnapshot(loaded.root, loaded.stateDir), configHash: loaded.configHash });
+var staleRun = (loaded, run, reason) => {
+  const stale = transition(run, "STALE", reason);
+  saveRun2(loaded.stateDir, stale);
+  setLatest(loaded.stateDir, stale);
+  return fail(reason, "STALE");
+};
+var isFresh = async (loaded, run) => {
+  const current = await currentBinding(loaded);
+  return current.configHash === run.configHash && current.source.revision === run.sourceRevision && current.source.statusHash === run.sourceStatusHash;
+};
+var planRun = async ({ configPath, decision, actor = "human", allowDirty = false, contextSnapshots = [] }) => {
+  const automatedPreparation = actor === "ci" && decision === "prepared";
+  if (!automatedPreparation) {
+    assertHuman(actor);
+    if (!approvedDecision(decision)) fail("Contract was not approved.", "CLARIFYING");
+  }
+  const loaded = loadConfig(configPath);
+  if (loaded.config.contract.ambiguities.length) fail(`Unresolved ambiguities remain: ${loaded.config.contract.ambiguities.join(" | ")}`, "CLARIFYING");
+  const validatedContextSnapshots = validateContextSnapshots(contextSnapshots);
+  const baseline = await sourceSnapshot(loaded.root, loaded.stateDir);
+  const configRelative = relative(loaded.root, loaded.absolute);
+  const meaningful = baseline.status.split("\n").filter(Boolean).filter((line) => !line.endsWith(` ${configRelative}`) && !line.endsWith(` ${configRelative.replaceAll("/", "\\")}`));
+  if (meaningful.length && !allowDirty) fail(`Worktree is dirty before planning:
+${meaningful.join("\n")}
+Use --allow-dirty only with explicit human authorization.`, "WORKTREE_DIRTY");
+  const previous = loadLatestRun(loaded.stateDir);
+  if (previous && !["STALE", "SUPERSEDED"].includes(previous.state)) fail(`An active run already exists: ${previous.runId} (${previous.state}).`, "ACTIVE_RUN");
+  return createRun({ loaded, baseline, supersedes: previous?.runId, dirtyBaselineAuthorized: allowDirty, contextSnapshots: validatedContextSnapshots, planner: automatedPreparation ? "ci" : "human" });
+};
+var startRun = (loaded) => {
+  const run = requireRun(loadLatestRun(loaded.stateDir));
+  const next = transition(run, "IMPLEMENTING", "Implementation started.", "agent");
+  saveRun2(loaded.stateDir, next);
+  setLatest(loaded.stateDir, next);
+  return next;
+};
+var cancelRun = async ({ configPath, runId, reason = "Run cancelled by a human.", actor = "human" }) => {
+  assertHuman(actor);
+  const loaded = loadConfig(configPath);
+  const run = requireRun(runId ? readRun(loaded.stateDir, runId) : loadLatestRun(loaded.stateDir));
+  const next = transition(run, "CANCELLED", reason, "human");
+  saveRun2(loaded.stateDir, next);
+  setLatest(loaded.stateDir, next);
+  return next;
+};
+var verifyRun = async ({ configPath }) => {
+  const loaded = loadConfig(configPath);
+  const run = requireRun(loadLatestRun(loaded.stateDir));
+  if (!["IMPLEMENTING", "VERIFYING"].includes(run.state)) {
+    if (["AWAITING_HUMAN_APPROVAL", "AWAITING_AUTHORIZATION", "COMPLETE"].includes(run.state) && !await isFresh(loaded, run)) staleRun(loaded, run, "Run is stale because source or contract changed.");
+    fail(`Cannot verify from ${run.state}.`, "INVALID_STATE");
+  }
+  if (run.configHash !== loaded.configHash) staleRun(loaded, run, "Run is stale because the verification contract changed.");
+  const binding = await currentBinding(loaded);
+  let current = { ...transition(run, "VERIFYING", "Verification started.", "agent"), sourceRevision: binding.source.revision, sourceStatusHash: binding.source.statusHash };
+  saveRun2(loaded.stateDir, current);
+  const checkDir = join(loaded.stateDir, "runs", current.runId, "checks");
+  mkdirSync(checkDir, { recursive: true });
+  const outcomesByCheck = new Map(loaded.config.checks.map((check) => [check.id, loaded.config.contract.outcomes.filter((outcome) => outcome.checks.includes(check.id)).map((outcome) => outcome.id)]));
+  let totalDurationMs = 0;
+  for (const check of loaded.config.checks) {
+    const result = await runCommand(check, loaded.root);
+    totalDurationMs += result.durationMs;
+    const stdoutPath = join(checkDir, `${check.id}.stdout`);
+    const stderrPath = join(checkDir, `${check.id}.stderr`);
+    writeFileSync(stdoutPath, result.stdout, "utf8");
+    writeFileSync(stderrPath, result.stderr, "utf8");
+    const evidence = parseStructuredEvidence(result.stdout);
+    const failures = result.exitCode === 0 && !result.timedOut && evidence ? validateEvidence(loaded.root, check, evidence, outcomesByCheck.get(check.id) ?? []) : [result.timedOut ? "check timed out" : result.exitCode !== 0 ? `exit code ${result.exitCode}` : "missing final structured evidence"];
+    const nextCheck = { id: check.id, category: check.category, status: failures.length ? "failed" : "passed", exitCode: result.exitCode, durationMs: result.durationMs, ...evidence ? { evidence } : {}, ...failures.length ? { failures } : {} };
+    current = { ...current, evidenceReferences: [...current.evidenceReferences, { checkId: check.id, stdout: relative(loaded.stateDir, stdoutPath), stderr: relative(loaded.stateDir, stderrPath) }], checks: current.checks.map((item) => item.id === check.id ? nextCheck : item) };
+    saveRun2(loaded.stateDir, current);
+  }
+  const statuses = new Map(current.checks.map((check) => [check.id, check.status]));
+  const budgetExceeded = loaded.config.budget?.maxDurationMs !== void 0 && totalDurationMs > loaded.config.budget.maxDurationMs;
+  const allPassed = loaded.config.checks.every((check) => statuses.get(check.id) === "passed") && !budgetExceeded;
+  current = { ...current, outcomes: current.outcomes.map((outcome) => ({ ...outcome, status: outcome.checks.every((id2) => statuses.get(id2) === "passed") ? "passed" : "failed" })), metrics: { totalDurationMs, budgetExceeded } };
+  const digest2 = verificationDigest(current);
+  current = { ...current, verificationDigest: digest2 };
+  saveRun2(loaded.stateDir, current);
+  new FileEventStore(loaded.stateDir).append({ runId: current.runId, sourceRevision: current.sourceRevision, configHash: current.configHash, type: "verification.completed", payload: { verificationDigest: digest2, checkCount: current.checks.length, outcomeCount: current.outcomes.length, totalDurationMs, budgetExceeded } });
+  const nextState = allPassed ? "AWAITING_HUMAN_APPROVAL" : "BLOCKED";
+  current = { ...transition(current, nextState, allPassed ? "All configured checks passed; human approval is required." : budgetExceeded ? "Verification budget was exceeded." : "A configured check failed or lacked structured evidence.", "harness") };
+  saveRun2(loaded.stateDir, current);
+  setLatest(loaded.stateDir, current);
+  return current;
+};
+var assertFresh = async (loaded, run) => {
+  if (!await isFresh(loaded, run)) staleRun(loaded, run, "Run is stale because source or worktree changed after verification.");
+};
+var assertVerificationAttestation = (loaded, run) => {
+  const expected = verificationDigest(run);
+  if (run.verificationDigest !== expected) fail("Verification projection attestation does not match run.json.", "HARNESS_ERROR");
+  const event = new FileEventStore(loaded.stateDir).read(run.runId).filter((item) => item.type === "verification.completed").at(-1);
+  if (!event || event.payload.verificationDigest !== expected || event.sourceRevision !== run.sourceRevision || event.configHash !== run.configHash) fail("Verification projection attestation is missing from the event log.", "HARNESS_ERROR");
+};
+var plannerForRetry = (loaded, run) => {
+  if (run.contractPreparation) return "ci";
+  if (!run.supersedes) return "human";
+  return plannerForRetry(loaded, readRun(loaded.stateDir, run.supersedes));
+};
+var recordDecision = (loaded, run, type, payload) => {
+  new FileEventStore(loaded.stateDir).append({ runId: run.runId, sourceRevision: run.sourceRevision, configHash: run.configHash, type, payload: type === "authorization.recorded" ? { ...payload, target: payload.target ?? fail("tracking.target is required when authorizing.", "INVALID_CONFIG") } : payload });
+};
+var assertDecisionProjection = (run, decision, expectedState) => {
+  if (decision.decision !== "approved" || decision.resultingState !== expectedState || decision.verificationDigest !== run.verificationDigest || decision.sourceRevision !== run.sourceRevision || decision.contractHash !== run.contractHash) fail("Terminal decision attestation does not match the run projection.", "HARNESS_ERROR");
+};
+var reconcileRun = async ({ configPath, runId }) => {
+  const loaded = loadConfig(configPath);
+  const run = requireRun(runId ? readRun(loaded.stateDir, runId) : loadLatestRun(loaded.stateDir));
+  await assertFresh(loaded, run);
+  const store = new FileEventStore(loaded.stateDir);
+  const eventLog = store.verify(run.runId);
+  const events2 = store.read(run.runId);
+  if (events2.some((event) => event.runId !== run.runId || event.configHash !== run.configHash)) fail("Run event log is not bound to the current run projection.", "HARNESS_ERROR");
+  const requiresVerification = ["AWAITING_HUMAN_APPROVAL", "AWAITING_AUTHORIZATION", "COMPLETE"].includes(run.state);
+  if (requiresVerification) {
+    if (eventLog.status !== "verified") fail("Terminal run requires a verified event log.", "HARNESS_ERROR");
+    assertVerificationAttestation(loaded, run);
+  }
+  if (run.state === "AWAITING_AUTHORIZATION" || run.state === "COMPLETE") {
+    const approval = events2.filter((event) => event.type === "approval.recorded").at(-1) ?? fail("Terminal run is missing its human approval event.", "HARNESS_ERROR");
+    assertDecisionProjection(run, approval.payload, run.state === "COMPLETE" && !loaded.config.tracking.required ? "COMPLETE" : "AWAITING_AUTHORIZATION");
+    if (!run.humanApproval || run.humanApproval.actor !== "human" || run.humanApproval.verificationDigest !== run.verificationDigest || run.humanApproval.sourceRevision !== run.sourceRevision || run.humanApproval.contractHash !== run.contractHash) fail("Human approval projection is inconsistent with its audit event.", "HARNESS_ERROR");
+  }
+  if (run.state === "COMPLETE" && loaded.config.tracking.required) {
+    const authorization = events2.filter((event) => event.type === "authorization.recorded").at(-1) ?? fail("Complete tracked run is missing its authorization event.", "HARNESS_ERROR");
+    assertDecisionProjection(run, authorization.payload, "COMPLETE");
+    if (!run.authorization || run.authorization.actor !== "human" || run.authorization.verificationDigest !== run.verificationDigest || run.authorization.target !== authorization.payload.target || run.authorization.sourceRevision !== run.sourceRevision || run.authorization.contractHash !== run.contractHash) fail("Authorization projection is inconsistent with its audit event.", "HARNESS_ERROR");
+  }
+  return { status: "verified", runId: run.runId, state: run.state, eventCount: eventLog.eventCount, ...eventLog.headHash ? { headHash: eventLog.headHash } : {}, ...run.verificationDigest ? { verificationDigest: run.verificationDigest } : {} };
+};
+var approveRun = async ({ configPath, runId, decision, actor = "human" }) => {
+  assertHuman(actor);
+  const loaded = loadConfig(configPath);
+  const run = requireRun(runId ? readRun(loaded.stateDir, runId) : loadLatestRun(loaded.stateDir));
+  if (run.state !== "AWAITING_HUMAN_APPROVAL") fail(`Cannot approve from ${run.state}.`, "INVALID_STATE");
+  await assertFresh(loaded, run);
+  assertVerificationAttestation(loaded, run);
+  if (!approvedDecision(decision)) {
+    const blocked = transition(run, "BLOCKED", "Human rejected the verification result.", "human");
+    saveRun2(loaded.stateDir, blocked);
+    recordDecision(loaded, run, "approval.recorded", { decision: "rejected", resultingState: blocked.state, verificationDigest: run.verificationDigest, actor: "human", sourceRevision: run.sourceRevision, contractHash: run.contractHash });
+    setLatest(loaded.stateDir, blocked);
+    return blocked;
+  }
+  const nextState = loaded.config.tracking.required ? "AWAITING_AUTHORIZATION" : "COMPLETE";
+  const next = { ...transition(run, nextState, "Human approved the verification result.", "human"), humanApproval: { actor: "human", at: now2(), sourceRevision: run.sourceRevision, contractHash: run.contractHash, verificationDigest: run.verificationDigest } };
+  saveRun2(loaded.stateDir, next);
+  recordDecision(loaded, run, "approval.recorded", { decision: "approved", resultingState: nextState, verificationDigest: run.verificationDigest, actor: "human", sourceRevision: run.sourceRevision, contractHash: run.contractHash });
+  setLatest(loaded.stateDir, next);
+  return next;
+};
+var authorizeRun = async ({ configPath, runId, decision, actor = "human" }) => {
+  assertHuman(actor);
+  const loaded = loadConfig(configPath);
+  const run = requireRun(runId ? readRun(loaded.stateDir, runId) : loadLatestRun(loaded.stateDir));
+  if (run.state !== "AWAITING_AUTHORIZATION") fail(`Cannot authorize from ${run.state}.`, "INVALID_STATE");
+  await assertFresh(loaded, run);
+  assertVerificationAttestation(loaded, run);
+  if (!approvedDecision(decision)) {
+    const blocked = transition(run, "BLOCKED", "Human rejected external tracking authorization.", "human");
+    saveRun2(loaded.stateDir, blocked);
+    recordDecision(loaded, run, "authorization.recorded", { decision: "rejected", resultingState: blocked.state, verificationDigest: run.verificationDigest, actor: "human", target: loaded.config.tracking.target ?? "", sourceRevision: run.sourceRevision, contractHash: run.contractHash });
+    setLatest(loaded.stateDir, blocked);
+    return blocked;
+  }
+  if (!loaded.config.tracking.target) fail("tracking.target is required when authorizing.", "INVALID_CONFIG");
+  const next = { ...transition(run, "COMPLETE", "External tracking was authorized.", "human"), authorization: { actor: "human", at: now2(), target: loaded.config.tracking.target, sourceRevision: run.sourceRevision, contractHash: run.contractHash, verificationDigest: run.verificationDigest } };
+  saveRun2(loaded.stateDir, next);
+  recordDecision(loaded, run, "authorization.recorded", { decision: "approved", resultingState: "COMPLETE", verificationDigest: run.verificationDigest, actor: "human", target: loaded.config.tracking.target, sourceRevision: run.sourceRevision, contractHash: run.contractHash });
+  setLatest(loaded.stateDir, next);
+  return next;
+};
+var retryRun = async ({ configPath }) => {
+  const loaded = loadConfig(configPath);
+  const previous = loadLatestRun(loaded.stateDir);
+  const previousRun = requireRun(previous);
+  if (!["BLOCKED", "STALE", "CANCELLED"].includes(previousRun.state)) fail(`Cannot retry from ${previousRun.state}.`, "INVALID_STATE");
+  const baseline = await sourceSnapshot(loaded.root, loaded.stateDir);
+  const superseded = transition(previousRun, "SUPERSEDED", "Retry superseded the previous run.", "harness");
+  saveRun2(loaded.stateDir, superseded);
+  const run = await createRun({ loaded, baseline, supersedes: previousRun.runId, dirtyBaselineAuthorized: previousRun.dirtyBaselineAuthorized, planner: plannerForRetry(loaded, previousRun) });
+  const next = transition(run, "IMPLEMENTING", "Retry started after a previous attempt.", "agent");
+  saveRun2(loaded.stateDir, next);
+  setLatest(loaded.stateDir, next);
+  return next;
+};
+var cleanTaskArtifacts = (configPath) => cleanConfiguredArtifacts(loadConfig(configPath));
+var index = (root, indexPath) => JSON.parse(readFileSync(resolve(root, indexPath), "utf8"));
+var text = (entry) => [entry.id, entry.type, entry.title, entry.path, entry.description, entry.body, ...Array.isArray(entry.tags) ? entry.tags : []].filter((value) => typeof value === "string").join(" ").toLowerCase();
+var sourceHash = (document) => typeof document.contentHash === "string" && document.contentHash.length > 0 ? document.contentHash : hashJson(document);
+var matches = (entry, query) => {
+  const needle = query.query.trim().toLowerCase();
+  const scopes = query.scope?.map((scope) => scope.toLowerCase()) ?? [];
+  const value = text(entry);
+  return Boolean(needle && value.includes(needle) && (scopes.length === 0 || scopes.some((scope) => value.includes(scope))));
+};
+var createDocBridgeContextProvider = ({ root, indexPath = ".doc-bridge/index.json" }) => ({
+  id: "doc-bridge",
+  version: "1.0.0",
+  resolve: async (query) => {
+    const document = index(root, indexPath);
+    const contentHash = sourceHash(document);
+    const entries = Array.isArray(document.knowledge) ? document.knowledge.filter((value) => typeof value === "object" && value !== null && !Array.isArray(value)).filter((entry) => matches(entry, query)).sort((left, right) => String(left.id ?? "").localeCompare(String(right.id ?? ""))).slice(0, 8) : [];
+    const references = entries.flatMap((entry) => typeof entry.id === "string" && typeof entry.path === "string" ? [{ id: entry.id, uri: `doc-bridge://${entry.path}`, ...typeof entry.title === "string" ? { title: entry.title } : {}, contentHash }] : []);
+    return { providerId: "doc-bridge", query, references, sourceHash: contentHash, snapshotHash: hashContextSnapshot({ providerId: "doc-bridge", query, references, sourceHash: contentHash }), resolvedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+});
+var BENCHMARK_SCHEMA_VERSION = 1;
+var percentage = (part, total) => total ? Number((part / total).toFixed(4)) : null;
+var DEFAULT_POLICY = { minComparableTasks: 3, maxDurationRegressionRate: 0.2, minCompletedRunsPerTask: 3, minBaselineSamplesPerTask: 3, requireZeroEscapedIncomplete: true };
+var improvementRate = (baseline, current) => baseline === void 0 || current === void 0 || baseline === 0 ? null : Number(((baseline - current) / baseline).toFixed(4));
+var increaseRate = (baseline, current) => baseline === void 0 || current === void 0 || baseline === 0 ? null : Number(((current - baseline) / baseline).toFixed(4));
+var increaseDelta = (baseline, current) => baseline === void 0 || current === null ? null : Number((current - baseline).toFixed(4));
+var increaseDirection = (rate2, delta) => delta === null ? improvementDirection(rate2) : delta > 0 ? "improved" : delta < 0 ? "regressed" : "unchanged";
+var improvementDirection = (rate2) => rate2 === null ? "unavailable" : rate2 > 0 ? "improved" : rate2 < 0 ? "regressed" : "unchanged";
+var count = (items, predicate) => items.filter(predicate).length;
+var median = (values) => {
+  if (!values.length) return null;
+  const sorted = [...values].sort((left, right) => left - right);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 ? sorted[middle] ?? null : ((sorted[middle - 1] ?? 0) + (sorted[middle] ?? 0)) / 2;
+};
+var reviewMinutes = (run) => {
+  if (!run.humanApproval) return void 0;
+  const reviewStart = run.transitions.find((transition2) => transition2.to === "AWAITING_HUMAN_APPROVAL")?.at;
+  if (!reviewStart) return void 0;
+  const elapsed = Date.parse(run.humanApproval.at) - Date.parse(reviewStart);
+  return Number.isFinite(elapsed) && elapsed >= 0 ? Number((elapsed / 6e4).toFixed(2)) : void 0;
+};
+var confidence = (comparable, completedRuns, policy) => !comparable ? "insufficient" : completedRuns >= policy.minCompletedRunsPerTask ? "reliable" : "directional";
+var artifactAcceptanceRate = (run) => {
+  const rates = run.checks.flatMap((check) => {
+    const evidence = check.evidence;
+    if (!evidence) return [];
+    const direct = typeof evidence["artifactAcceptanceRate"] === "number" ? [evidence["artifactAcceptanceRate"]] : [];
+    const reports = Array.isArray(evidence["reports"]) ? evidence["reports"].flatMap((report) => typeof report === "object" && report !== null && typeof report["artifactAcceptanceRate"] === "number" ? [report["artifactAcceptanceRate"]] : []) : [];
+    return [...direct, ...reports].filter((rate2) => Number.isFinite(rate2) && rate2 >= 0 && rate2 <= 1);
+  });
+  return rates.length ? Number((rates.reduce((total, rate2) => total + rate2, 0) / rates.length).toFixed(4)) : void 0;
+};
+var projectRun = (run) => {
+  const checks = { total: run.checks.length, passed: count(run.checks, (check) => check.status === "passed"), failed: count(run.checks, (check) => check.status === "failed") };
+  const outcomes = { total: run.outcomes.length, passed: count(run.outcomes, (outcome) => outcome.status === "passed"), failed: count(run.outcomes, (outcome) => outcome.status === "failed") };
+  const evidence = { total: run.checks.length, attached: count(run.checks, (check) => check.evidence !== void 0) };
+  const acceptanceRate = artifactAcceptanceRate(run);
+  const humanReviewMinutes = reviewMinutes(run);
+  const escapedIncomplete = run.state === "COMPLETE" && checks.failed === 0 && outcomes.failed === 0 && evidence.attached === evidence.total ? 0 : void 0;
+  return { runId: run.runId, state: run.state, sourceRevision: run.sourceRevision, configHash: run.configHash, contractHash: run.contractHash, ...run.supersedes ? { supersedes: run.supersedes } : {}, ...run.metrics ? { durationMs: run.metrics.totalDurationMs } : {}, checks, outcomes, evidence, ...acceptanceRate === void 0 ? {} : { artifactAcceptanceRate: acceptanceRate }, ...escapedIncomplete === void 0 ? {} : { escapedIncomplete }, humanApproved: run.humanApproval !== void 0, ...humanReviewMinutes === void 0 ? {} : { humanReviewMinutes }, authorized: run.authorization !== void 0, ...run.benchmark ? { benchmark: run.benchmark } : {} };
+};
+var summarize = (runs) => {
+  const stateCounts = Object.fromEntries(RUN_STATES.map((state) => [state, count(runs, (run) => run.state === state)]));
+  const checksTotal = runs.reduce((total, run) => total + run.checks.total, 0);
+  const checksPassed = runs.reduce((total, run) => total + run.checks.passed, 0);
+  const outcomesTotal = runs.reduce((total, run) => total + run.outcomes.total, 0);
+  const outcomesPassed = runs.reduce((total, run) => total + run.outcomes.passed, 0);
+  const evidenceTotal = runs.reduce((total, run) => total + run.evidence.total, 0);
+  const evidenceAttached = runs.reduce((total, run) => total + run.evidence.attached, 0);
+  const firstAttempts = runs.filter((run) => !run.supersedes);
+  const superseded = new Set(runs.flatMap((run) => run.supersedes ? [run.supersedes] : []));
+  const effectiveRuns = runs.filter((run) => !superseded.has(run.runId));
+  const effectiveChecksTotal = effectiveRuns.reduce((total, run) => total + run.checks.total, 0);
+  const effectiveChecksPassed = effectiveRuns.reduce((total, run) => total + run.checks.passed, 0);
+  const effectiveOutcomesTotal = effectiveRuns.reduce((total, run) => total + run.outcomes.total, 0);
+  const effectiveOutcomesPassed = effectiveRuns.reduce((total, run) => total + run.outcomes.passed, 0);
+  const effectiveEvidenceTotal = effectiveRuns.reduce((total, run) => total + run.evidence.total, 0);
+  const effectiveEvidenceAttached = effectiveRuns.reduce((total, run) => total + run.evidence.attached, 0);
+  const durations = runs.flatMap((run) => run.durationMs === void 0 ? [] : [run.durationMs]);
+  return {
+    totalRuns: runs.length,
+    stateCounts,
+    completeRuns: stateCounts.COMPLETE,
+    retriedRuns: count(runs, (run) => run.supersedes !== void 0),
+    staleRuns: stateCounts.STALE,
+    firstAttemptRuns: firstAttempts.length,
+    humanApprovedRuns: count(runs, (run) => run.humanApproved),
+    authorizedRuns: count(runs, (run) => run.authorized),
+    effectiveRunCount: effectiveRuns.length,
+    effectiveCompleteRuns: count(effectiveRuns, (run) => run.state === "COMPLETE"),
+    effectiveCompletionRate: percentage(count(effectiveRuns, (run) => run.state === "COMPLETE"), effectiveRuns.length),
+    effectiveCheckPassRate: percentage(effectiveChecksPassed, effectiveChecksTotal),
+    effectiveOutcomePassRate: percentage(effectiveOutcomesPassed, effectiveOutcomesTotal),
+    effectiveEvidenceCoverageRate: percentage(effectiveEvidenceAttached, effectiveEvidenceTotal),
+    checkPassRate: percentage(checksPassed, checksTotal),
+    outcomePassRate: percentage(outcomesPassed, outcomesTotal),
+    evidenceCoverageRate: percentage(evidenceAttached, evidenceTotal),
+    firstAttemptApprovalRate: percentage(count(firstAttempts, (run) => run.humanApproved), firstAttempts.length),
+    retryRate: percentage(count(runs, (run) => run.supersedes !== void 0), runs.length),
+    staleRate: percentage(stateCounts.STALE, runs.length),
+    averageDurationMs: durations.length ? Math.round(durations.reduce((total, duration) => total + duration, 0) / durations.length) : null,
+    medianDurationMs: median(durations)
+  };
+};
+var readRuns = (stateDir) => {
+  const runsDir = join(stateDir, "runs");
+  if (!existsSync(runsDir)) return [];
+  return readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
+    try {
+      const candidate = readJson(join(runsDir, entry.name, "run.json"));
+      return candidate.type === "agentskit-harness-run" ? readRun(stateDir, entry.name) : void 0;
+    } catch (error) {
+      return fail(`Benchmark could not read run ${entry.name}: ${error instanceof Error ? error.message : String(error)}`, "HARNESS_ERROR");
+    }
+  }).filter((run) => run !== void 0);
+};
+var nonEmptyString = (value, label) => {
+  if (typeof value !== "string") return fail(`${label} must be a non-empty string.`, "INVALID_CONFIG");
+  const result = value.trim();
+  if (!result) return fail(`${label} must be a non-empty string.`, "INVALID_CONFIG");
+  return result;
+};
+var sha2562 = (value, label) => {
+  if (value === void 0) return void 0;
+  const result = nonEmptyString(value, label);
+  if (!/^[a-f0-9]{64}$/.test(result)) return fail(`${label} must be a lowercase SHA-256 digest.`, "INVALID_CONFIG");
+  return result;
+};
+var stringList = (value, label) => {
+  if (!Array.isArray(value)) return fail(`${label} must be a non-empty string array.`, "INVALID_CONFIG");
+  const items = value;
+  if (!items.length || !items.every((item) => typeof item === "string" && Boolean(item.trim()))) return fail(`${label} must be a non-empty string array.`, "INVALID_CONFIG");
+  return items.map((item) => String(item).trim());
+};
+var nonNegativeNumber = (value, label) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number") return fail(`${label} must be a non-negative number.`, "INVALID_CONFIG");
+  if (!Number.isFinite(value) || value < 0) return fail(`${label} must be a non-negative number.`, "INVALID_CONFIG");
+  const result = value;
+  return result;
+};
+var nonNegativeInteger = (value, label) => {
+  const result = nonNegativeNumber(value, label);
+  if (result !== void 0 && !Number.isInteger(result)) return fail(`${label} must be an integer.`, "INVALID_CONFIG");
+  return result;
+};
+var rate = (value, label) => {
+  const result = nonNegativeNumber(value, label);
+  if (result !== void 0 && result > 1) return fail(`${label} must be between 0 and 1.`, "INVALID_CONFIG");
+  return result;
+};
+var timestamp = (value, label) => {
+  const result = nonEmptyString(value, label);
+  if (!Number.isFinite(Date.parse(result))) return fail(`${label} must be a valid timestamp.`, "INVALID_CONFIG");
+  return result;
+};
+var relativePath = (value, label) => {
+  const result = nonEmptyString(value, label);
+  if (result.startsWith("/") || result.split("/").includes("..")) return fail(`${label} must be a repository-relative path.`, "INVALID_CONFIG");
+  return result;
+};
+var taskFile = (value, label) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(`${label} must be an object.`, "INVALID_CONFIG");
+  const raw = value;
+  return { path: relativePath(raw["path"], `${label}.path`), sha256: sha2562(raw["sha256"], `${label}.sha256`) ?? fail(`${label}.sha256 is required.`, "INVALID_CONFIG") };
+};
+var taskSource = (value, label) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(`${label} must be an object.`, "INVALID_CONFIG");
+  const raw = value;
+  return { repository: nonEmptyString(raw["repository"], `${label}.repository`), path: relativePath(raw["path"], `${label}.path`), revision: nonEmptyString(raw["revision"], `${label}.revision`) };
+};
+var suiteSource = (value, label) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(`${label} must be an object.`, "INVALID_CONFIG");
+  const raw = value;
+  return { repository: nonEmptyString(raw["repository"], `${label}.repository`), revision: nonEmptyString(raw["revision"], `${label}.revision`), taskDefinition: relativePath(raw["taskDefinition"], `${label}.taskDefinition`) };
+};
+var taskScope = (value, label) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(`${label} must be an object.`, "INVALID_CONFIG");
+  const raw = value;
+  return { read: stringList(raw["read"], `${label}.read`), write: stringList(raw["write"], `${label}.write`) };
+};
+var taskSurfaces = (value, label) => {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value) || !value.length) return fail(`${label} must be a non-empty array.`, "INVALID_CONFIG");
+  const surfaces = value.map((item, index2) => nonEmptyString(item, `${label}[${index2}]`));
+  if (surfaces.some((surface2) => !SURFACE_NAMES.includes(surface2))) fail(`${label} contains an unknown surface.`, "INVALID_CONFIG");
+  if (new Set(surfaces).size !== surfaces.length) fail(`${label} must contain unique surfaces.`, "INVALID_CONFIG");
+  return surfaces;
+};
+var benchmarkPolicy = (value) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return fail("benchmark.policy must be an object.", "INVALID_CONFIG");
+  const raw = value;
+  const minComparableTasks = nonNegativeInteger(raw["minComparableTasks"], "benchmark.policy.minComparableTasks");
+  const maxDurationRegressionRate = nonNegativeNumber(raw["maxDurationRegressionRate"], "benchmark.policy.maxDurationRegressionRate");
+  const minCompletedRunsPerTask = nonNegativeInteger(raw["minCompletedRunsPerTask"], "benchmark.policy.minCompletedRunsPerTask");
+  const minBaselineSamplesPerTask = nonNegativeInteger(raw["minBaselineSamplesPerTask"] ?? 1, "benchmark.policy.minBaselineSamplesPerTask");
+  if (minComparableTasks === void 0 || minComparableTasks < 1) return fail("benchmark.policy.minComparableTasks must be at least 1.", "INVALID_CONFIG");
+  if (maxDurationRegressionRate === void 0 || maxDurationRegressionRate > 1) return fail("benchmark.policy.maxDurationRegressionRate must be between 0 and 1.", "INVALID_CONFIG");
+  if (minCompletedRunsPerTask === void 0 || minCompletedRunsPerTask < 1) return fail("benchmark.policy.minCompletedRunsPerTask must be at least 1.", "INVALID_CONFIG");
+  if (minBaselineSamplesPerTask === void 0 || minBaselineSamplesPerTask < 1) return fail("benchmark.policy.minBaselineSamplesPerTask must be at least 1.", "INVALID_CONFIG");
+  if (typeof raw["requireZeroEscapedIncomplete"] !== "boolean") return fail("benchmark.policy.requireZeroEscapedIncomplete must be boolean.", "INVALID_CONFIG");
+  return { minComparableTasks, maxDurationRegressionRate, minCompletedRunsPerTask, minBaselineSamplesPerTask, requireZeroEscapedIncomplete: raw["requireZeroEscapedIncomplete"] };
+};
+var validateBenchmarkManifest = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) fail("benchmark manifest must be an object.", "INVALID_CONFIG");
+  const raw = value;
+  if (raw["type"] !== "agentskit-harness-benchmark-manifest" || raw["schemaVersion"] !== BENCHMARK_SCHEMA_VERSION) fail("benchmark manifest type or schemaVersion is invalid.", "INVALID_CONFIG");
+  const rawTasks = Array.isArray(raw["tasks"]) && raw["tasks"].length ? raw["tasks"] : fail("benchmark manifest tasks must be non-empty.", "INVALID_CONFIG");
+  const tasks = rawTasks.map((item, index2) => {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) fail(`benchmark.tasks[${index2}] must be an object.`, "INVALID_CONFIG");
+    const task = item;
+    const kind = task["kind"] === void 0 ? void 0 : nonEmptyString(task["kind"], `benchmark.tasks[${index2}].kind`);
+    const prompt = taskFile(task["prompt"], `benchmark.tasks[${index2}].prompt`);
+    const source = taskSource(task["source"], `benchmark.tasks[${index2}].source`);
+    const scope = taskScope(task["scope"], `benchmark.tasks[${index2}].scope`);
+    const surfaces = taskSurfaces(task["surfaces"], `benchmark.tasks[${index2}].surfaces`);
+    return { id: nonEmptyString(task["id"], `benchmark.tasks[${index2}].id`), title: nonEmptyString(task["title"], `benchmark.tasks[${index2}].title`), acceptanceCriteria: stringList(task["acceptanceCriteria"], `benchmark.tasks[${index2}].acceptanceCriteria`), ...surfaces === void 0 ? {} : { surfaces }, ...kind === void 0 ? {} : { kind }, ...prompt === void 0 ? {} : { prompt }, ...source === void 0 ? {} : { source }, ...scope === void 0 ? {} : { scope } };
+  });
+  if (new Set(tasks.map((task) => task.id)).size !== tasks.length) fail("benchmark task ids must be unique.", "INVALID_CONFIG");
+  const taskIds = new Set(tasks.map((task) => task.id));
+  const rawObservations = raw["observations"] === void 0 ? [] : Array.isArray(raw["observations"]) ? raw["observations"] : fail("benchmark.observations must be an array.", "INVALID_CONFIG");
+  const observations = rawObservations.map((item, index2) => {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) fail(`benchmark.observations[${index2}] must be an object.`, "INVALID_CONFIG");
+    const observation = item;
+    const status = observation["status"];
+    if (!["passed", "failed", "blocked", "not-run"].includes(String(status))) fail(`benchmark.observations[${index2}].status is invalid.`, "INVALID_CONFIG");
+    const taskId = nonEmptyString(observation["taskId"], `benchmark.observations[${index2}].taskId`);
+    if (!taskIds.has(taskId)) fail(`benchmark observation references unknown task: ${taskId}.`, "INVALID_CONFIG");
+    const task = tasks.find((candidate) => candidate.id === taskId) ?? fail(`benchmark observation references unknown task: ${taskId}.`, "INVALID_CONFIG");
+    const attempts = nonNegativeInteger(observation["attempts"], `benchmark.observations[${index2}].attempts`);
+    const durationMs = nonNegativeNumber(observation["durationMs"], `benchmark.observations[${index2}].durationMs`);
+    const durationSamplesMs = observation["durationSamplesMs"] === void 0 ? void 0 : Array.isArray(observation["durationSamplesMs"]) ? observation["durationSamplesMs"].map((sample, sampleIndex) => nonNegativeNumber(sample, `benchmark.observations[${index2}].durationSamplesMs[${sampleIndex}]`) ?? fail(`benchmark.observations[${index2}].durationSamplesMs must contain numbers.`, "INVALID_CONFIG")) : fail(`benchmark.observations[${index2}].durationSamplesMs must be an array.`, "INVALID_CONFIG");
+    if (durationSamplesMs && !durationSamplesMs.length) fail(`benchmark.observations[${index2}].durationSamplesMs must not be empty.`, "INVALID_CONFIG");
+    const artifactAcceptanceRate2 = rate(observation["artifactAcceptanceRate"], `benchmark.observations[${index2}].artifactAcceptanceRate`);
+    const protocolCompletionRate = rate(observation["protocolCompletionRate"], `benchmark.observations[${index2}].protocolCompletionRate`);
+    const reviewMinutes2 = nonNegativeNumber(observation["reviewMinutes"], `benchmark.observations[${index2}].reviewMinutes`);
+    const escapedIncomplete = nonNegativeInteger(observation["escapedIncomplete"], `benchmark.observations[${index2}].escapedIncomplete`);
+    const evidenceDigest = sha2562(observation["evidenceDigest"], `benchmark.observations[${index2}].evidenceDigest`);
+    const rawEvidence = observation["evidence"] === void 0 ? void 0 : Array.isArray(observation["evidence"]) ? observation["evidence"] : fail(`benchmark.observations[${index2}].evidence must be an array.`, "INVALID_CONFIG");
+    const evidence = rawEvidence?.map((item2, evidenceIndex) => {
+      if (typeof item2 !== "object" || item2 === null || Array.isArray(item2)) fail(`benchmark.observations[${index2}].evidence[${evidenceIndex}] must be an object.`, "INVALID_CONFIG");
+      const entry = item2;
+      const criterion = nonEmptyString(entry["criterion"], `benchmark.observations[${index2}].evidence[${evidenceIndex}].criterion`);
+      if (!task.acceptanceCriteria.includes(criterion)) fail(`benchmark evidence references unknown criterion: ${criterion}.`, "INVALID_CONFIG");
+      const evidenceStatus = entry["status"];
+      if (!["passed", "failed", "blocked", "not-run"].includes(String(evidenceStatus))) fail(`benchmark.observations[${index2}].evidence[${evidenceIndex}].status is invalid.`, "INVALID_CONFIG");
+      return { criterion, status: evidenceStatus, source: nonEmptyString(entry["source"], `benchmark.observations[${index2}].evidence[${evidenceIndex}].source`) };
+    });
+    if (evidence && new Set(evidence.map((entry) => entry.criterion)).size !== evidence.length) fail(`benchmark.observations[${index2}].evidence criteria must be unique.`, "INVALID_CONFIG");
+    return { taskId, mode: "baseline", status, source: nonEmptyString(observation["source"], `benchmark.observations[${index2}].source`), recordedAt: timestamp(observation["recordedAt"], `benchmark.observations[${index2}].recordedAt`), ...attempts === void 0 ? {} : { attempts }, ...durationMs === void 0 ? {} : { durationMs }, ...durationSamplesMs === void 0 ? {} : { durationSamplesMs }, ...artifactAcceptanceRate2 === void 0 ? {} : { artifactAcceptanceRate: artifactAcceptanceRate2 }, ...protocolCompletionRate === void 0 ? {} : { protocolCompletionRate }, ...reviewMinutes2 === void 0 ? {} : { reviewMinutes: reviewMinutes2 }, ...escapedIncomplete === void 0 ? {} : { escapedIncomplete }, ...evidence === void 0 ? {} : { evidence }, ...evidenceDigest === void 0 ? {} : { evidenceDigest } };
+  });
+  if (new Set(observations.map((observation) => observation.taskId)).size !== observations.length) fail("benchmark allows at most one baseline observation per task.", "INVALID_CONFIG");
+  const provenance = suiteSource(raw["provenance"], "benchmark.provenance");
+  const policy = benchmarkPolicy(raw["policy"]);
+  return { type: "agentskit-harness-benchmark-manifest", schemaVersion: BENCHMARK_SCHEMA_VERSION, suiteId: nonEmptyString(raw["suiteId"], "benchmark.suiteId"), name: nonEmptyString(raw["name"], "benchmark.name"), ...provenance === void 0 ? {} : { provenance }, tasks, observations, ...policy === void 0 ? {} : { policy } };
+};
+var loadBenchmarkManifest = (path) => {
+  try {
+    return validateBenchmarkManifest(JSON.parse(readFileSync(path, "utf8")));
+  } catch (error) {
+    if (error instanceof SyntaxError) return fail(`Invalid benchmark manifest JSON: ${error.message}`, "INVALID_CONFIG");
+    throw error;
+  }
+};
+var recordBenchmarkObservation = (path, input) => {
+  const originalContent = readFileSync(path, "utf8");
+  const manifest = loadBenchmarkManifest(path);
+  const taskId = nonEmptyString(input.taskId, "benchmark observation.taskId");
+  if (!manifest.tasks.some((task) => task.id === taskId)) fail(`benchmark observation references unknown task: ${taskId}.`, "INVALID_INPUT");
+  if (manifest.observations.some((observation2) => observation2.taskId === taskId)) fail(`benchmark already has an observation for task: ${taskId}.`, "INVALID_INPUT");
+  const observation = validateBenchmarkManifest({
+    ...manifest,
+    observations: [...manifest.observations, {
+      taskId,
+      mode: "baseline",
+      status: input.status,
+      source: input.source,
+      recordedAt: input.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      ...input.attempts === void 0 ? {} : { attempts: input.attempts },
+      ...input.durationMs === void 0 ? {} : { durationMs: input.durationMs },
+      ...input.durationSamplesMs === void 0 ? {} : { durationSamplesMs: input.durationSamplesMs },
+      ...input.artifactAcceptanceRate === void 0 ? {} : { artifactAcceptanceRate: input.artifactAcceptanceRate },
+      ...input.protocolCompletionRate === void 0 ? {} : { protocolCompletionRate: input.protocolCompletionRate },
+      ...input.reviewMinutes === void 0 ? {} : { reviewMinutes: input.reviewMinutes },
+      ...input.escapedIncomplete === void 0 ? {} : { escapedIncomplete: input.escapedIncomplete },
+      ...input.evidence === void 0 ? {} : { evidence: input.evidence },
+      ...input.evidenceDigest === void 0 ? {} : { evidenceDigest: input.evidenceDigest }
+    }]
+  });
+  const temporaryRoot = mkdtempSync(join(tmpdir(), "agentskit-harness-baseline-"));
+  const temporaryPath = join(temporaryRoot, "manifest.json");
+  try {
+    writeFileSync(temporaryPath, `${JSON.stringify(observation, null, 2)}
+`, "utf8");
+    if (readFileSync(path, "utf8") !== originalContent) fail("benchmark manifest changed while recording an observation.", "STALE");
+    renameSync(temporaryPath, path);
+  } finally {
+    rmSync(temporaryRoot, { recursive: true, force: true });
+  }
+  return observation;
+};
+var comparisons = (runs, manifest, policy) => manifest.tasks.map((task) => {
+  const taskRuns = runs.filter((run) => run.benchmark?.suiteId === manifest.suiteId && run.benchmark.taskId === task.id);
+  const latest = taskRuns.at(-1);
+  const baseline = manifest.observations.find((observation) => observation.taskId === task.id);
+  const coveredCriteria = new Set((baseline?.evidence ?? []).map((entry) => entry.criterion));
+  const baselineEvidenceCoverageRate = baseline ? percentage(coveredCriteria.size, task.acceptanceCriteria.length) : null;
+  const baselineEvidenceComplete = baselineEvidenceCoverageRate === 1;
+  const baselineEvidencePassed = baselineEvidenceComplete && (baseline?.evidence?.every((entry) => entry.status === "passed") ?? false);
+  const baselineDeliveryComplete = baseline?.status === "passed" && baselineEvidencePassed;
+  const baselineDurationSamples = baseline?.durationSamplesMs ?? (baseline?.durationMs === void 0 ? [] : [baseline.durationMs]);
+  const baselineMedianDurationMs = median(baselineDurationSamples);
+  const baselineSamplesSufficient = baselineDurationSamples.length >= policy.minBaselineSamplesPerTask;
+  const comparable = baseline !== void 0 && baseline.status !== "not-run" && baselineEvidenceComplete && baselineDeliveryComplete && baselineSamplesSufficient && latest?.state === "COMPLETE";
+  const comparability = comparable ? "comparable" : baseline === void 0 ? "missing-baseline" : baseline.status === "not-run" ? "baseline-not-run" : !baselineEvidenceComplete ? "baseline-evidence-missing" : latest === void 0 ? "harness-not-run" : latest.state !== "COMPLETE" ? "harness-not-complete" : !baselineDeliveryComplete ? "baseline-incomplete" : "baseline-samples-insufficient";
+  const completedTaskRuns = taskRuns.filter((run) => run.state === "COMPLETE");
+  const durationSamplesMs = completedTaskRuns.flatMap((run) => run.durationMs === void 0 ? [] : [run.durationMs]);
+  const medianDurationMs = median(durationSamplesMs);
+  const retryCount = count(taskRuns, (run) => run.supersedes !== void 0);
+  const attempts = retryCount + (taskRuns.length ? 1 : 0);
+  const durationRate = comparable ? improvementRate(baselineMedianDurationMs ?? void 0, medianDurationMs ?? void 0) : null;
+  const attemptsRate = comparable ? improvementRate(baseline?.attempts, attempts) : null;
+  const reviewRate = comparable ? improvementRate(baseline?.reviewMinutes, latest?.humanReviewMinutes) : null;
+  const acceptanceSamples = taskRuns.flatMap((run) => run.artifactAcceptanceRate === void 0 ? [] : [run.artifactAcceptanceRate]);
+  const harnessArtifactAcceptanceRate = acceptanceSamples.length ? Number((acceptanceSamples.reduce((total, rate2) => total + rate2, 0) / acceptanceSamples.length).toFixed(4)) : null;
+  const artifactAcceptanceImprovementRate = increaseRate(baseline?.artifactAcceptanceRate, harnessArtifactAcceptanceRate ?? void 0);
+  const artifactAcceptanceDelta = increaseDelta(baseline?.artifactAcceptanceRate, harnessArtifactAcceptanceRate);
+  const completedRuns = completedTaskRuns.length;
+  const harnessProtocolCompletionRate = taskRuns.length ? percentage(completedRuns, taskRuns.length) : null;
+  const protocolCompletionImprovementRate = increaseRate(baseline?.protocolCompletionRate, harnessProtocolCompletionRate ?? void 0);
+  const protocolCompletionDelta = increaseDelta(baseline?.protocolCompletionRate, harnessProtocolCompletionRate);
+  const escapedIncompleteRate = improvementRate(baseline?.escapedIncomplete, latest?.escapedIncomplete);
+  return { taskId: task.id, title: task.title, comparability, comparable, baselineDeliveryComplete, baselineEvidenceCoverageRate, baselineSampleCount: baselineDurationSamples.length, baselineArtifactAcceptanceRate: baseline?.artifactAcceptanceRate ?? null, baselineProtocolCompletionRate: baseline?.protocolCompletionRate ?? null, ...baselineMedianDurationMs === null ? {} : { baselineMedianDurationMs }, improvement: { durationRate, duration: improvementDirection(durationRate), attemptsRate, attempts: improvementDirection(attemptsRate), reviewRate, review: improvementDirection(reviewRate), artifactAcceptanceRate: artifactAcceptanceImprovementRate, artifactAcceptance: increaseDirection(artifactAcceptanceImprovementRate, artifactAcceptanceDelta), artifactAcceptanceDelta, protocolCompletionRate: protocolCompletionImprovementRate, protocolCompletion: increaseDirection(protocolCompletionImprovementRate, protocolCompletionDelta), protocolCompletionDelta, escapedIncompleteRate, escapedIncomplete: improvementDirection(escapedIncompleteRate) }, ...baseline ? { baseline } : {}, harness: { attempts, retryCount, completedRuns, durationSamplesMs, ...medianDurationMs === null ? {} : { medianDurationMs }, ...harnessArtifactAcceptanceRate === null ? {} : { artifactAcceptanceRate: harnessArtifactAcceptanceRate }, artifactAcceptanceSampleCount: acceptanceSamples.length, protocolCompletionRate: harnessProtocolCompletionRate, protocolCompletionSampleCount: taskRuns.length, latestState: latest?.state ?? "NOT_RUN", ...latest ? { latestRunId: latest.runId } : {}, ...latest?.durationMs === void 0 ? {} : { latestDurationMs: latest.durationMs }, checkPassRate: latest ? percentage(latest.checks.passed, latest.checks.total) : null, outcomePassRate: latest ? percentage(latest.outcomes.passed, latest.outcomes.total) : null, evidenceCoverageRate: latest ? percentage(latest.evidence.attached, latest.evidence.total) : null, ...latest?.escapedIncomplete === void 0 ? {} : { escapedIncomplete: latest.escapedIncomplete }, ...latest?.humanReviewMinutes === void 0 ? {} : { humanReviewMinutes: latest.humanReviewMinutes }, humanApproved: latest?.humanApproved ?? false }, confidence: confidence(comparable, completedRuns, policy), ...comparable && baselineMedianDurationMs !== null && medianDurationMs !== null ? { durationDeltaMs: medianDurationMs - baselineMedianDurationMs } : {}, ...comparable && baseline?.attempts !== void 0 ? { attemptDelta: attempts - baseline.attempts } : {}, ...comparable && baseline?.reviewMinutes !== void 0 && latest?.humanReviewMinutes !== void 0 ? { reviewDeltaMinutes: latest.humanReviewMinutes - baseline.reviewMinutes } : {}, ...baseline?.escapedIncomplete !== void 0 && latest?.escapedIncomplete !== void 0 ? { escapedIncompleteDelta: latest.escapedIncomplete - baseline.escapedIncomplete } : {} };
+});
+var benchmarkRuns = (stateDir, manifest) => {
+  const runs = readRuns(stateDir).map(projectRun).sort((left, right) => left.runId.localeCompare(right.runId));
+  const policy = manifest?.policy ?? DEFAULT_POLICY;
+  const reportComparisons = manifest ? comparisons(runs, manifest, policy) : [];
+  const comparable = reportComparisons.filter((comparison) => comparison.comparable);
+  const durationRegressionTaskIds = comparable.filter((comparison) => (comparison.improvement.durationRate ?? 0) < -policy.maxDurationRegressionRate).map((comparison) => comparison.taskId);
+  const escapedIncompleteTaskIds = comparable.filter((comparison) => comparison.harness.escapedIncomplete !== 0).map((comparison) => comparison.taskId);
+  const reasons = [];
+  if (comparable.length < policy.minComparableTasks) reasons.push(`requires at least ${policy.minComparableTasks} comparable tasks`);
+  const incompleteBaselineTaskIds = reportComparisons.filter((comparison) => comparison.comparability === "baseline-incomplete").map((comparison) => comparison.taskId);
+  if (incompleteBaselineTaskIds.length) reasons.push(`baseline delivery incomplete: ${incompleteBaselineTaskIds.join(", ")}`);
+  const baselineSampleGaps = reportComparisons.filter((comparison) => comparison.baselineSampleCount < policy.minBaselineSamplesPerTask).map((comparison) => `${comparison.taskId} (${comparison.baselineSampleCount}/${policy.minBaselineSamplesPerTask})`);
+  if (baselineSampleGaps.length) reasons.push(`requires ${policy.minBaselineSamplesPerTask} baseline samples per task: ${baselineSampleGaps.join(", ")}`);
+  if (durationRegressionTaskIds.length) reasons.push(`duration regression exceeds ${policy.maxDurationRegressionRate * 100}%: ${durationRegressionTaskIds.join(", ")}`);
+  if (policy.requireZeroEscapedIncomplete && escapedIncompleteTaskIds.length) reasons.push(`escaped incomplete delivery: ${escapedIncompleteTaskIds.join(", ")}`);
+  const confidenceLevel = comparable.length < policy.minComparableTasks ? "insufficient" : comparable.every((comparison) => comparison.confidence === "reliable") ? "reliable" : "directional";
+  const qualityGate = { status: comparable.length < policy.minComparableTasks ? "insufficient-data" : reasons.length ? "failed" : "passed", confidence: confidenceLevel, comparableTaskCount: comparable.length, policy, durationRegressionTaskIds, escapedIncompleteTaskIds, reasons };
+  return { type: "agentskit-harness-benchmark", schemaVersion: BENCHMARK_SCHEMA_VERSION, stateDir, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), runs, summary: summarize(runs), comparisons: reportComparisons, qualityGate, ...manifest ? { manifest: { suiteId: manifest.suiteId, taskCount: manifest.tasks.length, baselineCount: manifest.observations.length, comparableTaskCount: comparable.length } } : {} };
+};
+var EVIDENCE_BUNDLE_SCHEMA_VERSION = 1;
+var body = (bundle) => {
+  const { payloadHash: _payloadHash, signature: _signature, ...unsigned } = bundle;
+  return unsigned;
+};
+var parseBundle = (path) => {
+  try {
+    return JSON.parse(fileContents(path));
+  } catch (error) {
+    return fail(`Invalid evidence bundle JSON: ${error instanceof Error ? error.message : String(error)}`, "INVALID_INPUT");
+  }
+};
+var validDigest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+var validKeyId = (value) => typeof value === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(value);
+var requireRun2 = (run) => run ?? fail("No verification run exists.", "NO_RUN");
+var bundleFile = (stateDir, path) => {
+  const absolute = resolve(stateDir, path);
+  if (!pathInside(stateDir, absolute)) fail(`Evidence path escapes state directory: ${path}`, "HARNESS_ERROR");
+  const content = readFileSync(absolute);
+  return { path: relative(stateDir, absolute).split(sep).join("/"), sha256: sha256(content), contentBase64: content.toString("base64") };
+};
+var exportEvidenceBundle = async ({ configPath, runId, outputPath, privateKeyPath, keyId }) => {
+  if (!validKeyId(keyId)) fail("keyId must contain only letters, numbers, dot, underscore, colon, or hyphen.", "INVALID_INPUT");
+  const loaded = loadConfig(configPath);
+  const run = requireRun2(runId ? readJson(join(loaded.stateDir, "runs", runId, "run.json")) : loadLatestRun(loaded.stateDir));
+  const reconciliation = await reconcileRun({ configPath, runId: run.runId });
+  const digest2 = run.verificationDigest ?? fail("Only a reconciled COMPLETE run can be exported.", "INVALID_STATE");
+  if (reconciliation.state !== "COMPLETE") fail("Only a reconciled COMPLETE run can be exported.", "INVALID_STATE");
+  const eventLog = new FileEventStore(loaded.stateDir);
+  eventLog.read(run.runId);
+  const eventVerification = eventLog.verify(run.runId);
+  const paths = /* @__PURE__ */ new Set(["runs/" + run.runId + "/run.json", "runs/" + run.runId + "/events.ndjson"]);
+  for (const reference of run.evidenceReferences) {
+    paths.add(reference.stdout);
+    paths.add(reference.stderr);
+  }
+  const files = [...paths].map((path) => {
+    if (!existsSync(resolve(loaded.stateDir, path))) fail(`Evidence file is missing: ${path}`, "HARNESS_ERROR");
+    return bundleFile(loaded.stateDir, path);
+  });
+  const privateKey = createPrivateKey(readFileSync(privateKeyPath));
+  const unsigned = { type: "agentskit-harness-evidence-bundle", schemaVersion: EVIDENCE_BUNDLE_SCHEMA_VERSION, runId: run.runId, signerKeyId: keyId, sourceRevision: run.sourceRevision, configHash: run.configHash, contractHash: run.contractHash, verificationDigest: digest2, eventLog: eventVerification, files };
+  const payloadHash = sha256(JSON.stringify(unsigned));
+  const publicKeyPem = createPublicKey(privateKey).export({ type: "spki", format: "pem" }).toString();
+  const bundle = { ...unsigned, payloadHash, signature: { algorithm: "ed25519", keyId, publicKeyPem, signatureBase64: sign(null, Buffer.from(payloadHash), privateKey).toString("base64") } };
+  writeFileSync(outputPath, `${JSON.stringify(bundle, null, 2)}
+`, "utf8");
+  return bundle;
+};
+var verifyEvidenceBundle = (path, { trustedKeys = [] } = {}) => {
+  const bundle = parseBundle(path);
+  if (bundle.type !== "agentskit-harness-evidence-bundle" || bundle.schemaVersion !== EVIDENCE_BUNDLE_SCHEMA_VERSION || !bundle.runId || !validKeyId(bundle.signerKeyId) || !validDigest(bundle.payloadHash) || bundle.signature?.algorithm !== "ed25519" || bundle.signature.keyId !== bundle.signerKeyId || typeof bundle.signature.publicKeyPem !== "string" || typeof bundle.signature.signatureBase64 !== "string" || !Array.isArray(bundle.files)) fail("Evidence bundle metadata is invalid.", "HARNESS_ERROR");
+  if (trustedKeys.length) {
+    const trusted = trustedKeys.find((key) => key.keyId === bundle.signerKeyId);
+    if (!trusted) return fail(`Evidence bundle key is not trusted: ${bundle.signerKeyId}`, "HARNESS_ERROR");
+    if (trusted.status === "revoked") fail(`Evidence bundle key is revoked: ${bundle.signerKeyId}`, "HARNESS_ERROR");
+    if (trusted.publicKeyPem !== bundle.signature.publicKeyPem) fail(`Evidence bundle key does not match trust store: ${bundle.signerKeyId}`, "HARNESS_ERROR");
+  }
+  const paths = /* @__PURE__ */ new Set();
+  for (const file of bundle.files) {
+    if (!file || typeof file.path !== "string" || paths.has(file.path) || !validDigest(file.sha256) || typeof file.contentBase64 !== "string") fail("Evidence bundle file metadata is invalid.", "HARNESS_ERROR");
+    paths.add(file.path);
+    const content = Buffer.from(file.contentBase64, "base64");
+    if (sha256(content) !== file.sha256) fail(`Evidence bundle file hash mismatch: ${file.path}`, "HARNESS_ERROR");
+  }
+  if (!paths.has(`runs/${bundle.runId}/run.json`) || !paths.has(`runs/${bundle.runId}/events.ndjson`)) fail("Evidence bundle is missing the run projection or event log.", "HARNESS_ERROR");
+  if (sha256(JSON.stringify(body(bundle))) !== bundle.payloadHash) fail("Evidence bundle payload hash mismatch.", "HARNESS_ERROR");
+  let valid = false;
+  try {
+    valid = verify(null, Buffer.from(bundle.payloadHash), createPublicKey(bundle.signature.publicKeyPem), Buffer.from(bundle.signature.signatureBase64, "base64"));
+  } catch {
+    valid = false;
+  }
+  if (!valid) fail("Evidence bundle signature is invalid.", "HARNESS_ERROR");
+  return { status: "verified", runId: bundle.runId, payloadHash: bundle.payloadHash, fileCount: bundle.files.length, signed: true };
+};
+var readEvidenceTrustStore = (path) => {
+  const value = readJson(path);
+  if (value.schemaVersion !== 1 || !Array.isArray(value.keys)) fail("Evidence trust store must contain schemaVersion 1 and a keys array.", "INVALID_INPUT");
+  return value.keys.map((key, index2) => {
+    if (typeof key !== "object" || key === null || Array.isArray(key) || !validKeyId(key["keyId"]) || typeof key["publicKeyPem"] !== "string" || key["status"] !== "active" && key["status"] !== "revoked") fail(`Invalid evidence trust store key at index ${index2}.`, "INVALID_INPUT");
+    return key;
+  });
+};
+
+// src/cli.ts
+var packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+var program = new Command();
+program.name("ak-harness").description("Portable, evidence-backed development harness for coding agents.").version(packageJson.version).option("-c, --config <path>", "verification contract path", ".codex/verification.json").option("--json", "emit machine-readable output");
+var options = () => program.opts();
+var print = (value) => {
+  if (options().json) console.log(JSON.stringify(value));
+  else console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
+};
+var readBenchmarkEvidence = (path) => {
+  try {
+    const content = readFileSync(path, "utf8");
+    const raw = JSON.parse(content);
+    const evidence = Array.isArray(raw) ? raw : typeof raw === "object" && raw !== null ? raw.evidence : void 0;
+    if (Array.isArray(evidence)) return { evidence, digest: createHash("sha256").update(content).digest("hex") };
+  } catch (error) {
+    fail(`Invalid benchmark evidence JSON: ${error instanceof Error ? error.message : String(error)}`, "INVALID_INPUT");
+  }
+  return fail("benchmark evidence file must contain an array or an object with an evidence array.", "INVALID_INPUT");
+};
+var decisionArgs = (first, second) => {
+  const decisions = /* @__PURE__ */ new Set(["approved", "approve", "yes", "ok", "rejected", "reject", "no"]);
+  return decisions.has(first) ? { decision: first, ...second ? { runId: second } : {} } : { decision: second ?? "", runId: first };
+};
+program.command("doctor").description("Validate the contract without starting a run.").action(() => print({ status: "passed", criteria: ["package"], config: loadConfig(options().config).config }));
+program.command("plan <decision>").description("Prepare or approve the frozen task contract and create a planned run.").option("--by <actor>", "planner: human approval or ci preparation", "human").option("--allow-dirty", "allow a human-authorized dirty worktree").option("--context-file <path>", "attach a context snapshot JSON file").action(async (decision, command) => print(await planRun({ configPath: options().config, decision, actor: command.by, allowDirty: command.allowDirty ?? false, contextSnapshots: command.contextFile ? readContextSnapshots(command.contextFile) : [] })));
+var context = program.command("context").description("Resolve portable, provenance-bearing context snapshots.");
+context.command("resolve <query>").description("Resolve a Doc Bridge snapshot from the local index.").option("--provider <provider>", "context provider", "doc-bridge").option("--scope <scope...>", "optional search scopes").option("--index <path>", "Doc Bridge index path", ".doc-bridge/index.json").action(async (query, command) => {
+  if (command.provider !== "doc-bridge") fail(`Unsupported context provider: ${command.provider}`, "INVALID_INPUT");
+  const loaded = loadConfig(options().config);
+  print(await createDocBridgeContextProvider({ root: loaded.root, indexPath: command.index }).resolve({ query, ...command.scope?.length ? { scope: command.scope } : {} }));
+});
+program.command("start").description("Move a planned run into implementation.").action(() => print(startRun(loadConfig(options().config))));
+program.command("verify").description("Execute every configured check and record evidence.").action(async () => print(await verifyRun({ configPath: options().config })));
+program.command("run").description("Alias for verify, compatible with the common protocol.").action(async () => print(await verifyRun({ configPath: options().config })));
+program.command("approve <run-id-or-decision> [decision-or-run-id]").description("Record human approval or rejection. Accepts <run-id> <decision> or <decision> <run-id>.").option("--by <actor>", "approval actor", "human").action(async (first, second, command) => {
+  const args = decisionArgs(first, second);
+  print(await approveRun({ configPath: options().config, ...args, actor: command.by }));
+});
+program.command("authorize <run-id-or-decision> [decision-or-run-id]").description("Authorize or reject declared external tracking. Accepts <run-id> <decision> or <decision> <run-id>.").option("--by <actor>", "approval actor", "human").action(async (first, second, command) => {
+  const args = decisionArgs(first, second);
+  print(await authorizeRun({ configPath: options().config, ...args, actor: command.by }));
+});
+program.command("retry").description("Create a new implementation attempt after a blocked or stale run.").action(async () => print(await retryRun({ configPath: options().config })));
+program.command("cancel [run-id]").description("Cancel an active run.").option("--by <actor>", "cancellation actor", "human").option("--reason <reason>", "cancellation reason", "Run cancelled by a human.").action(async (runId, command) => print(await cancelRun({ configPath: options().config, runId, reason: command.reason, actor: command.by })));
+program.command("status").description("Show the latest run after reconciling its audit evidence.").action(async () => {
+  const loaded = loadConfig(options().config);
+  print(loadLatestRun(loaded.stateDir) ? await reconcileRun({ configPath: options().config }) : { state: "CLARIFYING", message: "No run exists." });
+});
+program.command("audit [run-id]").description("Reconcile a run projection with its verified lifecycle decisions.").action(async (runId) => print(await reconcileRun({ configPath: options().config, runId })));
+var events = program.command("events").description("Inspect the lifecycle audit log.");
+events.command("verify [run-id]").description("Verify the latest or selected event log hash chain.").action((runId) => {
+  const loaded = loadConfig(options().config);
+  const run = runId ? { runId } : loadLatestRun(loaded.stateDir);
+  const selectedRunId = run?.runId ?? fail("No verification run exists.", "NO_RUN");
+  print(new FileEventStore(loaded.stateDir).verify(selectedRunId));
+});
+events.command("lock [run-id]").description("Inspect the latest or selected event-log lock.").action((runId) => {
+  const loaded = loadConfig(options().config);
+  const run = runId ? { runId } : loadLatestRun(loaded.stateDir);
+  const selectedRunId = run?.runId ?? fail("No verification run exists.", "NO_RUN");
+  print(inspectEventLogLock(loaded.stateDir, selectedRunId));
+});
+events.command("unlock [run-id]").description("Recover an old event-log lock after confirming its owner is dead.").option("--by <actor>", "recovery actor", "human").option("--max-age-ms <milliseconds>", "minimum lock age", (value) => Number(value), 3e5).action((runId, command) => {
+  const loaded = loadConfig(options().config);
+  const run = runId ? { runId } : loadLatestRun(loaded.stateDir);
+  const selectedRunId = run?.runId ?? fail("No verification run exists.", "NO_RUN");
+  print(recoverEventLogLock({ stateDir: loaded.stateDir, runId: selectedRunId, actor: command.by, maxAgeMs: command.maxAgeMs }));
+});
+events.command("export [run-id]").description("Export a reconciled COMPLETE run as a signed evidence bundle.").requiredOption("--output <path>", "bundle output path").requiredOption("--private-key <path>", "Ed25519 private key path").requiredOption("--key-id <id>", "stable signing key identity").action(async (runId, command) => print(await exportEvidenceBundle({ configPath: options().config, runId, outputPath: command.output, privateKeyPath: command.privateKey, keyId: command.keyId })));
+events.command("verify-bundle <path>").description("Verify an exported signed evidence bundle independently.").option("--trusted-key-store <path>", "JSON trust store with active or revoked public keys").action((path, command) => print(verifyEvidenceBundle(path, { trustedKeys: command.trustedKeyStore ? readEvidenceTrustStore(command.trustedKeyStore) : [] })));
+var benchmark = program.command("benchmark").description("Aggregate reproducible metrics from historical runs.").option("--manifest <path>", "benchmark manifest for baseline comparison").action((command) => {
+  const loaded = loadConfig(options().config);
+  print(benchmarkRuns(loaded.stateDir, command.manifest ? loadBenchmarkManifest(command.manifest) : void 0));
+});
+benchmark.command("baseline <taskId>").description("Record one controlled baseline observation in a benchmark manifest.").option("--manifest <path>", "benchmark manifest path").requiredOption("--status <status>", "passed, failed, blocked, or not-run").requiredOption("--source <source>", "baseline source or run reference").option("--evidence-file <path>", "JSON file with criterion-level baseline evidence").option("--recorded-at <timestamp>", "ISO-8601 timestamp").option("--attempts <count>", "attempt count", (value) => Number(value)).option("--duration-ms <milliseconds>", "duration in milliseconds", (value) => Number(value)).option("--review-minutes <minutes>", "human review time in minutes", (value) => Number(value)).option("--escaped-incomplete <count>", "incomplete deliveries discovered after handoff", (value) => Number(value)).action((taskId, command, cliCommand) => {
+  const manifest = command.manifest ?? cliCommand.parent?.opts().manifest;
+  const manifestPath = manifest ?? fail("baseline requires --manifest <path>.", "INVALID_INPUT");
+  const status = ["passed", "failed", "blocked", "not-run"].includes(command.status) ? command.status : fail("status must be passed, failed, blocked, or not-run.", "INVALID_INPUT");
+  const evidence = command.evidenceFile ? readBenchmarkEvidence(command.evidenceFile) : void 0;
+  print(recordBenchmarkObservation(manifestPath, { taskId, status, source: command.source, ...evidence ? { evidence: evidence.evidence, evidenceDigest: evidence.digest } : {}, ...command.recordedAt ? { recordedAt: command.recordedAt } : {}, ...command.attempts === void 0 ? {} : { attempts: command.attempts }, ...command.durationMs === void 0 ? {} : { durationMs: command.durationMs }, ...command.reviewMinutes === void 0 ? {} : { reviewMinutes: command.reviewMinutes }, ...command.escapedIncomplete === void 0 ? {} : { escapedIncomplete: command.escapedIncomplete } }));
+});
+program.command("clean").description("Remove only configured task-owned temporary artifacts.").action(() => print(cleanTaskArtifacts(options().config)));
+process.on("SIGINT", () => {
+  process.stderr.write("Cancelled.\n");
+  process.exitCode = 130;
+});
+try {
+  await program.parseAsync(process.argv);
+} catch (error) {
+  const value = error instanceof Error ? error : new Error(String(error));
+  process.stderr.write(`${"code" in value ? String(value.code) : "HARNESS_ERROR"}: ${value.message}
+`);
+  process.exitCode = "code" in value && value.code === "INVALID_INPUT" ? 2 : 1;
+}
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map