@aiwg/cli 2026.9.20 → 2026.9.21

package/dist/src/decision/qualification/release.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+/** D30 compile/prefix cache, D03 receipt replay and D15 result cache evidence, each a verified evidence manifest. */
+export const QUALIFICATION_CACHE_LAYERS = ['compilePrefixCache', 'receiptReplay', 'resultCache'];
+const REQUIRED_PINS = [
+    'definition', 'ruleset', 'binding', 'adapter', 'requestedModel', 'servedModel',
+    'policy', 'calibration', 'dataset', 'split', 'seed', 'priceCatalog',
+    'compilePrefixCache', 'receiptReplay', 'resultCache',
+];
+/**
+ * Derives the three cache-layer pins from verified evidence manifests. Each
+ * manifest must contain only executable, passing, digest-bound evidence, and
+ * the three layers must come from different runs.
+ */
+export function deriveCacheLayerPins(layers) {
+    const pins = {};
+    for (const layer of QUALIFICATION_CACHE_LAYERS) {
+        const evidence = layers[layer];
+        if (!evidence || evidence.manifest.schemaVersion !== 'decision-qualification-evidence-manifest/v1'
+            || !/^sha256:[0-9a-f]{64}$/.test(evidence.digest) || !evidence.manifest.evidence.length
+            || evidence.manifest.evidence.some(item => !item.executable || item.outcome !== 'pass'
+                || !/^sha256:[0-9a-f]{64}$/.test(item.artifact.digest) || !item.sourceGoldens.length)) {
+            throw new Error(`cache layer evidence is not verified: ${layer}`);
+        }
+        pins[layer] = evidence.digest;
+    }
+    if (new Set(QUALIFICATION_CACHE_LAYERS.map(layer => layers[layer].manifest.runId)).size !== QUALIFICATION_CACHE_LAYERS.length) {
+        throw new Error('compile/prefix, receipt replay and result cache evidence must come from distinct runs');
+    }
+    return pins;
+}
+/** A release record cannot upgrade a HOLD/ROLLBACK from #2037/#2048 integrity. */
+export function buildQualificationReleaseRecord(executed, input) {
+    const { manifest, report, verification } = executed;
+    if (!manifest.runId || !manifest.sourceCommit || !input.environment.trim() || !input.commands.length
+        || input.commands.some(command => !command.trim()) || input.integrity.sample_n < 0) {
+        throw new Error('incomplete qualification release metadata');
+    }
+    const derived = input.cacheLayers ? deriveCacheLayerPins(input.cacheLayers) : {};
+    for (const [layer, pin] of Object.entries(derived)) {
+        if (input.pins[layer] !== undefined && input.pins[layer] !== pin)
+            throw new Error(`release pin ${layer} does not match its evidence`);
+    }
+    const pinned = { ...input.pins, ...derived };
+    for (const pin of REQUIRED_PINS) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(pinned[pin] ?? ''))
+            throw new Error(`missing release pin: ${pin}`);
+    }
+    if (new Set([pinned.compilePrefixCache, pinned.receiptReplay, pinned.resultCache]).size !== 3) {
+        throw new Error('compile/prefix, receipt replay and result cache evidence must be distinct');
+    }
+    for (const [name, value] of [...Object.entries(input.budgets), ...Object.entries(input.actuals)]) {
+        if (!name || !Number.isFinite(value) || value < 0)
+            throw new Error('invalid qualification resource bound');
+    }
+    const verified = new Map(verification.map(item => [item.caseId, item.verified]));
+    const suites = manifest.evidence.map(item => ({
+        caseId: item.caseId, outcome: item.outcome, evidenceHash: item.digest, verified: verified.get(item.caseId) === true,
+    })).sort((a, b) => a.caseId.localeCompare(b.caseId));
+    const releaseDecision = input.integrity.release_gate.decision;
+    const withinBudgets = Object.entries(input.budgets).length > 0
+        && Object.keys(input.actuals).length === Object.keys(input.budgets).length
+        && Object.entries(input.budgets).every(([name, limit]) => input.actuals[name] !== undefined && input.actuals[name] <= limit);
+    const integrityVerified = input.integrity.integrity_state === 'verified'
+        && input.integrity.integrity_mode !== 'standard'
+        && input.integrity.trusted_score_source !== 'local-unverified'
+        && input.integrity.compromise_labels.length === 0
+        && input.integrity.sample_n > 0 && input.integrity.uncertainty !== null;
+    const benchmark = input.benchmark;
+    const benchmarkVerified = benchmark !== undefined && benchmark.decision === 'pass'
+        && /^sha256:[0-9a-f]{64}$/.test(benchmark.planDigest)
+        && benchmark.planDigest === benchmark.trustedPlanDigest
+        && Number.isSafeInteger(benchmark.sampleN) && Number.isSafeInteger(benchmark.minimumN)
+        && benchmark.minimumN > 0 && benchmark.sampleN >= benchmark.minimumN;
+    const snapshot = input.integritySnapshot;
+    const snapshotVerified = snapshot !== undefined && /^sha256:[0-9a-f]{64}$/.test(snapshot.digest)
+        && Number.isSafeInteger(snapshot.artifactCount) && snapshot.artifactCount > 0;
+    const metricsRecorded = input.metrics !== undefined && input.metrics.overall.sampleN > 0;
+    const complete = withinBudgets && integrityVerified && benchmarkVerified && snapshotVerified && metricsRecorded && !manifest.dirty && input.reviewer !== null && input.reviewer.trim().length > 0
+        && suites.length === manifest.cases.length && suites.every(item => item.outcome === 'pass' && item.verified)
+        && report.gates.length === 7 && report.gates.every(gate => gate.status === 'pass')
+        && report.decision === 'PROMOTE';
+    const decision = releaseDecision === 'ROLLBACK'
+        || report.decision === 'ROLLBACK' || input.integrity.integrity_state === 'compromised' || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK'
+        : complete && releaseDecision === 'PROMOTE' ? 'PROMOTE' : 'HOLD';
+    const fields = {
+        schemaVersion: 'decision-qualification-release/v1',
+        runId: manifest.runId, sourceCommit: manifest.sourceCommit, dirty: manifest.dirty,
+        environment: input.environment, commands: [...input.commands],
+        pins: Object.fromEntries(Object.entries(pinned).sort(([a], [b]) => a.localeCompare(b))),
+        budgets: Object.fromEntries(Object.entries(input.budgets).sort(([a], [b]) => a.localeCompare(b))),
+        actuals: Object.fromEntries(Object.entries(input.actuals).sort(([a], [b]) => a.localeCompare(b))),
+        reviewer: input.reviewer, suites, gates: [...report.gates].sort((a, b) => a.id.localeCompare(b.id)),
+        integrity: input.integrity, benchmark: benchmark ?? null,
+        metrics: input.metrics ?? null, integritySnapshot: snapshot ?? null,
+        cacheLayers: input.cacheLayers ? Object.fromEntries(QUALIFICATION_CACHE_LAYERS.map(layer => [layer, {
+                runId: input.cacheLayers[layer].manifest.runId, digest: input.cacheLayers[layer].digest,
+                caseIds: input.cacheLayers[layer].manifest.evidence.map(item => item.caseId).sort()
+            }])) : null,
+        decision,
+    };
+    return { ...fields, digest: `sha256:${createHash('sha256').update(JSON.stringify(fields)).digest('hex')}` };
+}
+/** Deliberately excludes private callback details, stdout/stderr and raw captures. */
+export function qualificationReleaseSummary(record) {
+    return [
+        `# Qualification ${record.runId}`,
+        `- Decision: ${record.decision}`,
+        `- Commit: ${record.sourceCommit}${record.dirty ? ' (dirty)' : ''}`,
+        `- Integrity: ${record.integrity.integrity_state}; sample_n=${record.integrity.sample_n}; snapshot=${record.integritySnapshot?.digest ?? 'missing'}`,
+        `- Held-out: ${record.metrics ? `n=${record.metrics.overall.sampleN}, selective risk=${record.metrics.overall.selectiveRisk ?? 'n/a'}, review rate=${record.metrics.overall.reviewRate}` : 'missing'}`,
+        `- Gates: ${record.gates.map(gate => `${gate.id}=${gate.status}`).join(', ')}`,
+        `- Evidence: ${record.suites.filter(item => item.verified).length}/${record.suites.length} verified`,
+        `- Manifest: ${record.digest}`,
+    ].join('\n');
+}
+//# sourceMappingURL=release.js.map

package/dist/src/decision/qualification/runner.js

@@ -0,0 +1,408 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname, resolve, sep } from 'node:path';
+import { evaluateQualification } from './gates.js';
+import { deriveGateEvidence, DERIVED_GATE_EVIDENCE, GATE_ARTIFACT_FLAGS, GATE_ARTIFACT_SCHEMAS, validateGateArtifact, } from './gate-evidence.js';
+import { scanQualificationPrivacy } from './privacy.js';
+/** Named master-test-plan suites plus the M01-M11 amendment IDs. */
+export const QUALIFICATION_EVIDENCE_ID = /^(?:CON|POL|BCH|CTX|CNC|CAN|RTY|REC|SEC|PRV|CAL|DRF|CCP|M(?:0[1-9]|1[01]))-[A-Z0-9][A-Z0-9._-]*$/;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_ARTIFACT_BYTES = 256 * 1024;
+const DEFAULT_CONCURRENCY = 4;
+function boundedInteger(value, fallback, minimum, maximum) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`qualification bound must be an integer in [${minimum}, ${maximum}]`);
+    }
+    return value;
+}
+function safeSegment(value, label) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value))
+        throw new Error(`unsafe ${label}: ${value}`);
+    return value;
+}
+function canonicalJson(value) {
+    return `${JSON.stringify(value, (_key, item) => {
+        if (typeof item === 'bigint')
+            return item.toString();
+        return item;
+    })}\n`;
+}
+function digest(bytes) {
+    return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+}
+async function withTimeout(timeoutMs, operation) {
+    const controller = new AbortController();
+    let timer;
+    try {
+        return await Promise.race([
+            Promise.resolve().then(() => operation(controller.signal)),
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    reject(new Error(`qualification execution exceeded ${timeoutMs}ms`));
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function writeArtifact(root, runId, artifact, maxBytes) {
+    const relative = `${safeSegment(runId, 'run id')}/${safeSegment(artifact.caseId, 'case id')}.json`;
+    const target = resolve(root, relative);
+    const bytes = canonicalJson(artifact);
+    if (Buffer.byteLength(bytes) > maxBytes)
+        throw new Error(`qualification artifact exceeds ${maxBytes} bytes`);
+    await mkdir(dirname(target), { recursive: true });
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(temporary, bytes, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    await rename(temporary, target);
+    return {
+        caseId: artifact.caseId,
+        executable: artifact.outcome !== 'skip',
+        outcome: artifact.outcome,
+        artifact: relative,
+        digest: digest(bytes),
+        testEvidenceIds: [...artifact.testEvidenceIds],
+    };
+}
+async function executeCase(item, plan, timeoutMs, maxBytes) {
+    const started = Date.now();
+    const testEvidenceIds = [...(item.evidenceIds ?? [])];
+    if (testEvidenceIds.some(id => !QUALIFICATION_EVIDENCE_ID.test(id))
+        || new Set(testEvidenceIds).size !== testEvidenceIds.length)
+        throw new Error(`invalid named qualification evidence for ${item.id}`);
+    testEvidenceIds.sort();
+    const executor = plan.executors[item.id];
+    let result = { outcome: 'fail' };
+    let error;
+    // A generic callback carries no authenticated provider or served-model proof.
+    // Never let an offline/mock executor manufacture an artifact labelled live.
+    if (!executor || plan.manifest.mode === 'live') {
+        return writeArtifact(plan.artifactRoot, plan.manifest.runId, {
+            schemaVersion: 'decision-qualification-artifact/v1', runId: plan.manifest.runId,
+            caseId: item.id, outcome: 'skip', durationMs: 0, testEvidenceIds,
+            error: plan.manifest.mode === 'live' ? 'live-evidence-unavailable' : 'executor-not-registered',
+        }, maxBytes);
+    }
+    try {
+        result = await withTimeout(timeoutMs, signal => executor({ caseId: item.id, runId: plan.manifest.runId, signal }));
+        if (result.outcome !== 'pass' && result.outcome !== 'fail')
+            throw new Error('executor returned an invalid outcome');
+    }
+    catch {
+        result = { outcome: 'fail' };
+        // Executor exceptions can include private provider bodies or input state.
+        // Keep diagnostic text out of persistent artifacts and exported reports.
+        error = 'executor-failed';
+    }
+    let publicDetails;
+    if (result.details !== undefined && plan.sanitizeDetails) {
+        try {
+            publicDetails = plan.sanitizeDetails(result.details, item.id);
+        }
+        catch {
+            // A broken sanitizer cannot convert a private payload into release evidence.
+            result = { outcome: 'fail' };
+            error = 'details-sanitization-failed';
+        }
+    }
+    // Check the serialized representation (not just string-valued leaves): JSON
+    // escaping must not let a canary bypass the privacy gate. Do not include the
+    // offending value or its index in the artifact or any thrown diagnostic.
+    const canaries = plan.privacyCanaries ?? [];
+    if (canaries.some(value => typeof value !== 'string' || value.length === 0)) {
+        throw new Error('privacy canaries must be nonempty strings');
+    }
+    if (publicDetails !== undefined && canaries.length) {
+        try {
+            const serialized = JSON.stringify(publicDetails);
+            if (canaries.some(value => serialized.includes(value) || serialized.includes(JSON.stringify(value).slice(1, -1)))) {
+                result = { outcome: 'fail' };
+                publicDetails = undefined;
+                error = 'privacy-canary-detected';
+            }
+        }
+        catch {
+            result = { outcome: 'fail' };
+            publicDetails = undefined;
+            error = 'details-sanitization-failed';
+        }
+    }
+    return writeArtifact(plan.artifactRoot, plan.manifest.runId, {
+        schemaVersion: 'decision-qualification-artifact/v1', runId: plan.manifest.runId,
+        caseId: item.id, outcome: result.outcome, durationMs: Math.max(0, Date.now() - started), testEvidenceIds,
+        ...(publicDetails === undefined ? {} : { details: publicDetails }), ...(error ? { error } : {}),
+    }, maxBytes);
+}
+async function mapConcurrent(items, concurrency, work) {
+    const output = new Array(items.length);
+    let cursor = 0;
+    async function worker() {
+        while (cursor < items.length) {
+            const index = cursor++;
+            output[index] = await work(items[index]);
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, worker));
+    return output;
+}
+/** Executes cases and gate checks; neither evidence outcomes nor flags are accepted from the caller. */
+export async function executeQualificationPlan(plan) {
+    const timeoutMs = boundedInteger(plan.timeoutMs, DEFAULT_TIMEOUT_MS, 1, 10 * 60_000);
+    const concurrency = boundedInteger(plan.concurrency, DEFAULT_CONCURRENCY, 1, 32);
+    const maxBytes = boundedInteger(plan.maxArtifactBytes, DEFAULT_MAX_ARTIFACT_BYTES, 256, 4 * 1024 * 1024);
+    const evidence = await mapConcurrent(plan.manifest.cases, concurrency, item => executeCase(item, plan, timeoutMs, maxBytes));
+    const derivedNames = new Set(DERIVED_GATE_EVIDENCE);
+    const checkEntries = Object.entries(plan.evidenceChecks ?? {})
+        .filter(([name]) => !derivedNames.has(name))
+        .sort(([left], [right]) => left.localeCompare(right));
+    const flagValues = await mapConcurrent(checkEntries, concurrency, async ([name, check]) => {
+        try {
+            const passed = await withTimeout(timeoutMs, signal => check({ runId: plan.manifest.runId, signal }));
+            return [name, passed === true];
+        }
+        catch {
+            return [name, false];
+        }
+    });
+    const evidenceFlags = Object.fromEntries(flagValues);
+    // Caller-provided positive flags cannot impersonate a complete privacy scan.
+    // Missing captures or canaries remain false, even if a callback returns true.
+    try {
+        evidenceFlags['privacy-scan-clean'] = plan.privacyCaptures && plan.privacyCanaries
+            ? scanQualificationPrivacy(plan.privacyCaptures, plan.privacyCanaries).clean : false;
+    }
+    catch {
+        evidenceFlags['privacy-scan-clean'] = false;
+    }
+    const gateArtifacts = await attachGateArtifacts(plan, evidence, maxBytes);
+    const manifest = { ...plan.manifest, evidence, evidenceFlags,
+        ...(Object.keys(gateArtifacts).length ? { gateArtifacts } : {}) };
+    // Record the derived values for readers; the evaluator recomputes them and
+    // never trusts these entries. Hash verification is only known after re-reading.
+    for (const [name, value] of Object.entries(deriveGateEvidence(manifest))) {
+        if (name !== 'evidence-hashes-verified')
+            evidenceFlags[name] = value;
+    }
+    return manifest;
+}
+async function readBoundedFile(path, maxBytes) {
+    try {
+        const stat = await lstat(path);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return 'not-file';
+        if (stat.size > maxBytes)
+            return 'too-large';
+        return await readFile(path);
+    }
+    catch {
+        return 'missing';
+    }
+}
+function parseJson(bytes) {
+    try {
+        return JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function attachGateArtifacts(plan, evidence, maxBytes) {
+    const refs = {};
+    const context = { manifest: { ...plan.manifest, evidence }, accepted: {} };
+    // Fixed order: calibration evidence binds to the accepted split plan.
+    for (const flag of GATE_ARTIFACT_FLAGS) {
+        const source = plan.gateArtifacts?.[flag];
+        if (!source)
+            continue;
+        const bytes = await readBoundedFile(resolve(source), maxBytes);
+        if (!Buffer.isBuffer(bytes))
+            continue;
+        const parsed = parseJson(bytes);
+        if (!validateGateArtifact(flag, parsed, context))
+            continue;
+        const relative = `${safeSegment(plan.manifest.runId, 'run id')}/gates/${flag}.json`;
+        const target = resolve(plan.artifactRoot, relative);
+        await mkdir(dirname(target), { recursive: true });
+        const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+        await writeFile(temporary, bytes, { flag: 'wx', mode: 0o600 });
+        await rename(temporary, target);
+        refs[flag] = { artifact: relative, digest: digest(bytes), schemaVersion: GATE_ARTIFACT_SCHEMAS[flag] };
+        context.accepted[flag] = parsed;
+    }
+    return refs;
+}
+/** Re-reads gate artifacts from the artifact root and re-validates their content against the run. */
+export async function verifyQualificationGateArtifacts(manifest, artifactRoot, maxArtifactBytes = DEFAULT_MAX_ARTIFACT_BYTES) {
+    const maxBytes = boundedInteger(maxArtifactBytes, DEFAULT_MAX_ARTIFACT_BYTES, 256, 4 * 1024 * 1024);
+    const refs = manifest.gateArtifacts ?? {};
+    const known = new Set(GATE_ARTIFACT_FLAGS);
+    const results = [];
+    const context = { manifest, accepted: {} };
+    for (const flag of Object.keys(refs).filter(name => !known.has(name)).sort()) {
+        results.push({ flag, verified: false, reason: 'unknown-flag' });
+    }
+    for (const flag of GATE_ARTIFACT_FLAGS) {
+        const ref = refs[flag];
+        if (!ref)
+            continue;
+        const path = containedArtifactPath(artifactRoot, ref.artifact);
+        if (!path || !ref.artifact.startsWith(`${manifest.runId}/gates/`)) {
+            results.push({ flag, verified: false, reason: 'unsafe-path' });
+            continue;
+        }
+        const bytes = await readBoundedFile(path, maxBytes);
+        if (!Buffer.isBuffer(bytes)) {
+            results.push({ flag, verified: false, reason: bytes });
+            continue;
+        }
+        if (digest(bytes) !== ref.digest) {
+            results.push({ flag, verified: false, reason: 'digest-mismatch' });
+            continue;
+        }
+        const parsed = parseJson(bytes);
+        if (ref.schemaVersion !== GATE_ARTIFACT_SCHEMAS[flag] || !validateGateArtifact(flag, parsed, context)) {
+            results.push({ flag, verified: false, reason: 'invalid-artifact' });
+            continue;
+        }
+        context.accepted[flag] = parsed;
+        results.push({ flag, verified: true });
+    }
+    return results;
+}
+/**
+ * Derives `privacy-scan-clean` for an executed run from surfaces captured
+ * around the whole run (see `captureQualificationLifetime`). The value comes
+ * from the scanner, as with `privacyCaptures`; it is never taken from the caller.
+ */
+export function withQualificationPrivacyScan(manifest, captures, canaries) {
+    let clean = false;
+    try {
+        clean = scanQualificationPrivacy(captures, canaries).clean;
+    }
+    catch {
+        clean = false;
+    }
+    return { ...manifest, evidenceFlags: { ...manifest.evidenceFlags, 'privacy-scan-clean': clean } };
+}
+function containedArtifactPath(root, relative) {
+    if (relative.startsWith('/') || relative.includes('\\'))
+        return null;
+    const rootPath = resolve(root);
+    const candidate = resolve(rootPath, relative);
+    return candidate.startsWith(`${rootPath}${sep}`) ? candidate : null;
+}
+async function verifiedSource(root, relative) {
+    const path = containedArtifactPath(root, relative);
+    if (!path)
+        throw new Error(`unsafe qualification evidence source: ${relative}`);
+    const stat = await lstat(path);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error(`qualification evidence source is not a regular file: ${relative}`);
+    return { path: relative, digest: digest(await readFile(path)) };
+}
+/**
+ * Builds D11's evidence linkage only from runner-produced artifacts that still
+ * verify and checked-in source goldens that can be independently hashed.
+ */
+export async function createQualificationEvidenceManifest(manifest, artifactRoot, sourceRoot, sources) {
+    const verification = await verifyQualificationArtifacts(manifest, artifactRoot);
+    const verified = new Map(verification.map(item => [item.caseId, item.verified]));
+    const evidence = await Promise.all(manifest.evidence.map(async (item) => {
+        if (!item.executable || !item.artifact || !item.digest || verified.get(item.caseId) !== true) {
+            throw new Error(`qualification evidence is not executable and verified: ${item.caseId}`);
+        }
+        const sourcePaths = sources[item.caseId];
+        if (!sourcePaths?.length)
+            throw new Error(`qualification evidence has no source golden: ${item.caseId}`);
+        return {
+            caseId: item.caseId,
+            testEvidenceIds: [...(item.testEvidenceIds ?? [])],
+            executable: true,
+            outcome: item.outcome,
+            artifact: { path: item.artifact, digest: item.digest },
+            sourceGoldens: await Promise.all(sourcePaths.map(path => verifiedSource(sourceRoot, path))),
+        };
+    }));
+    return {
+        schemaVersion: 'decision-qualification-evidence-manifest/v1',
+        runId: manifest.runId,
+        sourceCommit: manifest.sourceCommit,
+        evidence,
+    };
+}
+/** Persists the evidence linkage beside the runner artifacts for CI/release collection. */
+export async function writeQualificationEvidenceManifest(manifest, artifactRoot, sourceRoot, sources) {
+    const evidenceManifest = await createQualificationEvidenceManifest(manifest, artifactRoot, sourceRoot, sources);
+    const relative = `${safeSegment(manifest.runId, 'run id')}/evidence-manifest.json`;
+    const target = resolve(artifactRoot, relative);
+    const bytes = canonicalJson(evidenceManifest);
+    if (Buffer.byteLength(bytes) > DEFAULT_MAX_ARTIFACT_BYTES) {
+        throw new Error(`qualification evidence manifest exceeds ${DEFAULT_MAX_ARTIFACT_BYTES} bytes`);
+    }
+    await mkdir(dirname(target), { recursive: true });
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(temporary, bytes, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    await rename(temporary, target);
+    return { manifest: evidenceManifest, artifact: relative, digest: digest(bytes) };
+}
+/** Re-reads artifacts and verifies containment, file type, content, and exact SHA-256. */
+export async function verifyQualificationArtifacts(manifest, artifactRoot, maxArtifactBytes = DEFAULT_MAX_ARTIFACT_BYTES) {
+    const maxBytes = boundedInteger(maxArtifactBytes, DEFAULT_MAX_ARTIFACT_BYTES, 256, 4 * 1024 * 1024);
+    return Promise.all(manifest.evidence.map(async (item) => {
+        if (!item.artifact || !item.digest)
+            return { caseId: item.caseId, verified: false, reason: 'missing' };
+        const path = containedArtifactPath(artifactRoot, item.artifact);
+        if (!path)
+            return { caseId: item.caseId, verified: false, reason: 'unsafe-path' };
+        try {
+            const stat = await lstat(path);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                return { caseId: item.caseId, verified: false, reason: 'not-file' };
+            if (stat.size > maxBytes)
+                return { caseId: item.caseId, verified: false, reason: 'too-large' };
+            const bytes = await readFile(path);
+            if (digest(bytes) !== item.digest)
+                return { caseId: item.caseId, verified: false, reason: 'digest-mismatch' };
+            const parsed = JSON.parse(bytes.toString('utf8'));
+            if (parsed.schemaVersion !== 'decision-qualification-artifact/v1' || parsed.runId !== manifest.runId
+                || parsed.caseId !== item.caseId || parsed.outcome !== item.outcome
+                || JSON.stringify(parsed.testEvidenceIds) !== JSON.stringify(item.testEvidenceIds ?? [])) {
+                return { caseId: item.caseId, verified: false, reason: 'invalid-artifact' };
+            }
+            return { caseId: item.caseId, verified: true };
+        }
+        catch (error) {
+            return { caseId: item.caseId, verified: false, reason: error instanceof SyntaxError ? 'invalid-artifact' : 'missing' };
+        }
+    }));
+}
+/** Promotion-capable evaluation that fails closed when any artifact cannot be independently verified. */
+export async function evaluateExecutedQualification(manifest, artifactRoot, maxArtifactBytes) {
+    const verification = await verifyQualificationArtifacts(manifest, artifactRoot, maxArtifactBytes);
+    const gateVerification = await verifyQualificationGateArtifacts(manifest, artifactRoot, maxArtifactBytes);
+    const verified = new Map(verification.map(item => [item.caseId, item.verified]));
+    const gateVerified = new Set(gateVerification.filter(item => item.verified).map(item => item.flag));
+    const hardened = {
+        ...manifest,
+        evidence: manifest.evidence.map(item => verified.get(item.caseId) === true ? item : { ...item, executable: false }),
+        gateArtifacts: Object.fromEntries(Object.entries(manifest.gateArtifacts ?? {}).filter(([flag]) => gateVerified.has(flag))),
+    };
+    const caseIds = new Set(manifest.cases.map(item => item.id));
+    const artifactsVerified = verification.length > 0 && verification.length === caseIds.size
+        && verification.every(item => item.verified && caseIds.has(item.caseId))
+        && gateVerification.every(item => item.verified);
+    return { manifest, verification, gateVerification,
+        report: evaluateQualification(hardened, undefined, { artifactsVerified }) };
+}
+/** Executes, persists, verifies, and evaluates in one promotion-capable pipeline. */
+export async function executeAndEvaluateQualification(plan) {
+    const manifest = await executeQualificationPlan(plan);
+    return evaluateExecutedQualification(manifest, plan.artifactRoot, plan.maxArtifactBytes);
+}
+//# sourceMappingURL=runner.js.map

package/dist/src/decision/qualification/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/decision/receipts.js

@@ -2,6 +2,9 @@ import { createHash, createHmac, randomUUID, timingSafeEqual } from 'node:crypto
 import { link, mkdir, open, readFile, readdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { canonicalJson } from '../security/artifact-trust.js';
+import { assertNoPortableSecretMaterial } from './portable-secrets.js';
+import { assertDecisionResultWriterVersion } from './validate.js';
+import { isTraceparent } from './telemetry/context.js';
 export function decisionInvocationFingerprint(input) {
     return `sha256:${createHash('sha256').update(canonicalJson({
         invocationId: input.invocationId, input: input.value, definitions: input.definitions,
@@ -44,13 +47,31 @@ export function validateReceipt(receipt, invocationId, projectId) {
             || !Array.isArray(receipt.pending.attempts)))
         || (receipt.state === 'completed' && (!receipt.result || receipt.result.spec.invocationId !== invocationId
             || receipt.result.spec.status === 'error' && receipt.result.spec.reason === 'execution-uncertain'))
-        || (receipt.state !== 'completed' && receipt.result !== undefined)) {
+        || (receipt.state !== 'completed' && receipt.result !== undefined)
+        || (receipt.traceParent !== undefined && !isTraceparent(receipt.traceParent))) {
         throw new DecisionReceiptIntegrityError('Invalid decision receipt');
     }
+    assertReceiptPortable(receipt);
+}
+/** Receipts are portable artifacts: handles and payloads must never carry secret material. */
+function assertReceiptPortable(receipt) {
+    const reject = (message) => new DecisionReceiptIntegrityError(message);
+    receipt.remoteHandles.forEach(handle => assertNoPortableSecretMaterial(handle, 'Decision receipt remote handle', reject));
+    assertNoPortableSecretMaterial(receipt.evaluations, 'Decision receipt evaluations', reject);
+    assertNoPortableSecretMaterial(receipt.pending, 'Decision receipt pending evaluation', reject);
+    if (receipt.result !== undefined)
+        assertNoPortableSecretMaterial(receipt.result, 'Decision receipt result', reject);
 }
 export function nextReceipt(previous, state, extra = {}) {
     if (!allowed[previous.state].includes(state))
         throw new DecisionReceiptIntegrityError('Illegal receipt transition');
+    // Receipt payloads are result writers: newly written results pass the v1alpha2 writer gate.
+    if (extra.result !== undefined)
+        assertDecisionResultWriterVersion(extra.result);
+    for (const [alias, result] of Object.entries(extra.evaluations ?? {})) {
+        if (!Object.hasOwn(previous.evaluations, alias))
+            assertDecisionResultWriterVersion(result);
+    }
     const updatedAtEpochMs = Math.max(previous.updatedAtEpochMs, extra.updatedAtEpochMs ?? Date.now());
     const next = { ...structuredClone(previous), ...structuredClone(extra), state, revision: previous.revision + 1,
         updatedAtEpochMs, ...(state === 'completed' ? { completedAtEpochMs: extra.completedAtEpochMs ?? updatedAtEpochMs } : {}) };
@@ -63,10 +84,12 @@ export function nextReceipt(previous, state, extra = {}) {
     validateReceipt(next, previous.invocationId, previous.projectId);
     return next;
 }
-function initial(invocationId, projectId, fingerprint) {
+function initial(invocationId, projectId, fingerprint, options = {}) {
     const acquiredAtEpochMs = Date.now();
+    // traceParent is fixed at acquisition: nextReceipt() copies it and transitions cannot supply it.
     const receipt = { schema: 'decision-receipt/v2', revision: 1, acquiredAtEpochMs, updatedAtEpochMs: acquiredAtEpochMs,
-        projectId, invocationId, fingerprint, state: 'acquired', remoteHandles: [], evaluations: {}, pending: null };
+        projectId, invocationId, fingerprint, state: 'acquired', remoteHandles: [], evaluations: {}, pending: null,
+        ...(options.traceParent !== undefined ? { traceParent: options.traceParent } : {}) };
     validateReceipt(receipt, invocationId, projectId);
     return receipt;
 }
@@ -97,14 +120,14 @@ export class MemoryDecisionReceiptStore {
         validateReceipt(receipt, invocationId, projectId);
         return structuredClone(receipt);
     }
-    async acquire(invocationId, projectId, fingerprint) {
+    async acquire(invocationId, projectId, fingerprint, options = {}) {
         await this.check(projectId);
         const existing = this.receipts.get(invocationId);
         if (existing) {
             validateReceipt(existing, invocationId, projectId);
             return { owner: false, receipt: structuredClone(existing) };
         }
-        const receipt = initial(invocationId, projectId, fingerprint);
+        const receipt = initial(invocationId, projectId, fingerprint, options);
         this.receipts.set(invocationId, receipt);
         return { owner: true, receipt: structuredClone(receipt) };
     }
@@ -210,12 +233,12 @@ export class FileDecisionReceiptStore {
         }
         return structuredClone(previous);
     }
-    async acquire(invocationId, projectId, fingerprint) {
+    async acquire(invocationId, projectId, fingerprint, options = {}) {
         await this.check(projectId);
         const existing = await this.read(invocationId, projectId);
         if (existing)
             return { owner: false, receipt: existing };
-        const receipt = initial(invocationId, projectId, fingerprint);
+        const receipt = initial(invocationId, projectId, fingerprint, options);
         if (await this.persist(invocationId, receipt))
             return { owner: true, receipt };
         const winner = await this.read(invocationId, projectId);

package/dist/src/decision/result-cache/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './key.js';
+export * from './integrity.js';
+export * from './store.js';
+export * from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/src/decision/result-cache/integrity.js

@@ -0,0 +1,28 @@
+import { canonicalJson } from '../../security/artifact-trust.js';
+import { assertNoPortableSecretMaterial } from '../portable-secrets.js';
+import { resultCacheSha256 } from './key.js';
+export class ResultCacheIntegrityError extends Error {
+}
+export function entryIntegrityDigest(entry) {
+    return resultCacheSha256(canonicalJson(entry));
+}
+export function assertResultCacheEntry(entry) {
+    if (entry.schemaVersion !== 'decision-result-cache/v1' || entry.revision !== 1)
+        throw new ResultCacheIntegrityError('Unsupported cache entry schema');
+    const { integrityDigest, ...unsigned } = entry;
+    if (entryIntegrityDigest(unsigned) !== integrityDigest)
+        throw new ResultCacheIntegrityError('Cache entry integrity check failed');
+    if (entry.evidence.resultDigest !== resultCacheSha256(canonicalJson(entry.evidence.result)))
+        throw new ResultCacheIntegrityError('Cached result digest mismatch');
+    if (entry.expiresAtEpochMs <= entry.createdAtEpochMs)
+        throw new ResultCacheIntegrityError('Invalid cache freshness interval');
+    if (entry.evidence.durationMs < 0)
+        throw new ResultCacheIntegrityError('Invalid original duration');
+    if (entry.evidence.status === 'success' && entry.evidence.failureReason !== 'none')
+        throw new ResultCacheIntegrityError('Successful evidence has a failure reason');
+    if (entry.evidence.status === 'terminal-failure' && entry.evidence.failureReason !== 'invalid-input')
+        throw new ResultCacheIntegrityError('Unsafe negative cache entry');
+    // Cache entries are portable (export/replay); never admit or serve secret material.
+    assertNoPortableSecretMaterial(entry, 'Cache entry', message => new ResultCacheIntegrityError(message));
+}
+//# sourceMappingURL=integrity.js.map