@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/{chunk-4YNA3CM6.js → chunk-SSFS4NCH.js}

@@ -1,15 +1,151 @@
 // src/lib/verification-evidence.ts
 import { execFileSync } from "child_process";
 
+// src/shared/observation-anchoring.ts
+var ANCHOR_MIN_SHARED_TOKENS = 2;
+var ANCHOR_MIN_TOKEN_CHARS = 4;
+var ANCHOR_DIGIT = /[0-9]/;
+var ANCHOR_MIN_OUTPUT_NUMBER_CHARS = 2;
+var ANCHOR_STOPWORDS = /* @__PURE__ */ new Set([
+  "that",
+  "this",
+  "these",
+  "those",
+  "with",
+  "from",
+  "have",
+  "has",
+  "had",
+  "been",
+  "being",
+  "does",
+  "done",
+  "then",
+  "than",
+  "when",
+  "where",
+  "which",
+  "while",
+  "there",
+  "their",
+  "them",
+  "they",
+  "what",
+  "were",
+  "was",
+  "into",
+  "over",
+  "under",
+  "only",
+  "also",
+  "still",
+  "just",
+  "more",
+  "most",
+  "some",
+  "such",
+  "each",
+  "both",
+  "after",
+  "before",
+  "again",
+  "does",
+  "will",
+  "would",
+  "could",
+  "should",
+  "must",
+  "shall",
+  "here",
+  "about",
+  "because",
+  "since",
+  "until",
+  "during",
+  "through",
+  "without",
+  "within",
+  "above",
+  "below",
+  "same",
+  "other",
+  "another",
+  "every",
+  "very",
+  "much",
+  "many",
+  "like",
+  "make",
+  "made",
+  "take",
+  "used",
+  "using",
+  "note",
+  "true",
+  "false",
+  "null",
+  "none"
+]);
+function str(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function anchorTokens(text, minChars = ANCHOR_MIN_TOKEN_CHARS, keepGrammarWords = false) {
+  const tokens = /* @__PURE__ */ new Set();
+  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (!raw) continue;
+    if (ANCHOR_DIGIT.test(raw)) {
+      tokens.add(raw);
+      continue;
+    }
+    if (raw.length < minChars) continue;
+    if (!keepGrammarWords && ANCHOR_STOPWORDS.has(raw)) continue;
+    tokens.add(raw.endsWith("s") && raw.length > ANCHOR_MIN_TOKEN_CHARS ? raw.slice(0, -1) : raw);
+  }
+  return tokens;
+}
+function outputAnchorTokens(output) {
+  const full = anchorTokens(output);
+  if (full.size > 0) return full;
+  const whole = anchorTokens(output, 1, true);
+  return whole.size === 1 ? whole : full;
+}
+function isObservationAnchored(observation, probes) {
+  if (!Array.isArray(probes)) return false;
+  const outputAnchors = /* @__PURE__ */ new Set();
+  const outputNumbers = /* @__PURE__ */ new Set();
+  for (const probe of probes) {
+    if (!isRecord(probe)) continue;
+    for (const token of outputAnchorTokens(str(probe.output))) {
+      outputAnchors.add(token);
+      if (ANCHOR_DIGIT.test(token) && token.length >= ANCHOR_MIN_OUTPUT_NUMBER_CHARS) {
+        outputNumbers.add(token);
+      }
+    }
+  }
+  if (outputAnchors.size === 0) return false;
+  const bar = Math.min(ANCHOR_MIN_SHARED_TOKENS, outputAnchors.size);
+  let shared = 0;
+  for (const token of anchorTokens(observation, 1, true)) {
+    if (!outputAnchors.has(token)) continue;
+    if (outputNumbers.has(token)) return true;
+    shared += 1;
+    if (shared >= bar) return true;
+  }
+  return false;
+}
+
 // src/shared/attribution.ts
 var ok = { ok: true, code: "ok", message: "attributed" };
 function deny(code, message) {
   return { ok: false, code, message };
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function str(value) {
+function str2(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 var PLACEHOLDER_IDENTITIES = /* @__PURE__ */ new Set([
@@ -87,7 +223,7 @@ var MODEL_FAMILIES = [
 var MODEL_SHAPE = /^[a-z][a-z0-9]*(?:[-._][a-z0-9]+)*$/i;
 var HAS_VERSION = /\d/;
 function assessModel(raw) {
-  const model = str(raw).toLowerCase();
+  const model = str2(raw).toLowerCase();
   if (!model) {
     return deny("attribution_model_missing", "attribution requires the model that produced this record");
   }
@@ -117,7 +253,7 @@ function assessModel(raw) {
 }
 var FUTURE_SKEW_MS = 5 * 60 * 1e3;
 function assessObservedAt(raw, now) {
-  const text = str(raw);
+  const text = str2(raw);
   if (!text) {
     return deny(
       "attribution_observed_at_missing",
@@ -149,10 +285,10 @@ function assessAttribution(raw, purpose, context = {}) {
       return deny("attribution_malformed", "attribution must be valid JSON");
     }
   }
-  if (!isRecord(attribution)) {
+  if (!isRecord2(attribution)) {
     return deny("attribution_malformed", "attribution must be an object");
   }
-  const agent = str(attribution.agent);
+  const agent = str2(attribution.agent);
   if (!agent) {
     return deny("attribution_agent_missing", "attribution requires the agent identity that produced this record");
   }
@@ -174,7 +310,7 @@ function assessAttribution(raw, purpose, context = {}) {
   const observedResult = assessObservedAt(attribution.observed_at, now);
   if (!observedResult.ok) return observedResult;
   if (purpose === "verdict") {
-    const ref = str(attribution.evidence_ref);
+    const ref = str2(attribution.evidence_ref);
     if (!ref) {
       return deny(
         "attribution_evidence_ref_missing",
@@ -187,18 +323,18 @@ function assessAttribution(raw, purpose, context = {}) {
   }
   const second = attribution.second_opinion;
   if (second !== void 0 && second !== null && second !== "") {
-    if (!isRecord(second)) {
+    if (!isRecord2(second)) {
       return deny("second_opinion_malformed", "second_opinion must be an object with model and verdict");
     }
     const secondModel = assessModel(second.model);
     if (!secondModel.ok) {
       return deny("second_opinion_malformed", `second_opinion model: ${secondModel.message}`);
     }
-    const verdict = str(second.verdict);
+    const verdict = str2(second.verdict);
     if (verdict !== "confirmed" && verdict !== "refuted") {
       return deny("second_opinion_malformed", "second_opinion.verdict must be 'confirmed' or 'refuted'");
     }
-    if (str(second.model).toLowerCase() === str(attribution.model).toLowerCase()) {
+    if (str2(second.model).toLowerCase() === str2(attribution.model).toLowerCase()) {
       return deny(
         "second_opinion_same_model",
         "second_opinion.model must differ from the model that produced the record \u2014 a model confirming itself is not an adversarial review"
@@ -225,17 +361,17 @@ function deny2(code, message) {
 }
 var HEX_SHA2 = /^[0-9a-f]{7,64}$/i;
 var MIN_OBSERVATION_CHARS = 40;
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function str2(value) {
+function str3(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function num(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 function isSubstantiveCommit(substance) {
-  if (!isRecord2(substance)) return false;
+  if (!isRecord3(substance)) return false;
   const added = num(substance.added);
   const deleted = num(substance.deleted);
   const substantive = num(substance.substantive_added);
@@ -248,7 +384,7 @@ function isSubstantiveCommit(substance) {
   return true;
 }
 function isSubstantiveTestFix(substance) {
-  if (!isRecord2(substance)) return false;
+  if (!isRecord3(substance)) return false;
   const added = num(substance.added);
   const deleted = num(substance.deleted);
   const testFiles = num(substance.test_files);
@@ -263,7 +399,7 @@ function isSubstantiveTestFix(substance) {
 var VERDICT_ONLY_OBSERVATION = /^(?:it(?:'s| is)? |the bug (?:is|was) |this (?:is|was) )?(?:fixed|resolved|working|done|good|ok|verified|closed)\b/i;
 var HEDGED_OBSERVATION = /\b(?:looks?|look|seems?|appears?)\s+(?:to\s+be\s+)?(?:fine|good|ok|okay|right|healthy|correct|normal)\b|\ball\s+(?:good|fine|clear)\b|\bno\s+issues\b|\bseems?\s+fine\b/i;
 function assessObservation(raw) {
-  const observation = str2(raw).replace(/\s+/g, " ");
+  const observation = str3(raw).replace(/\s+/g, " ");
   if (observation.length < MIN_OBSERVATION_CHARS) {
     return deny2(
       "manual_observation_too_thin",
@@ -279,7 +415,7 @@ function assessObservation(raw) {
   return ok2;
 }
 function assessVerifier(raw, context) {
-  const verifier = str2(raw);
+  const verifier = str3(raw);
   if (!verifier) {
     return deny2("manual_verifier_missing", "this close requires a named verifier");
   }
@@ -289,7 +425,7 @@ function assessVerifier(raw, context) {
       `"${verifier}" is a role, not an identity. Records attested by "admin" are exactly why past verdicts cannot be traced to anyone \u2014 name the actual person or employee`
     );
   }
-  const authors = (context.authorIdentities ?? []).map((a) => str2(a).toLowerCase()).filter(Boolean);
+  const authors = (context.authorIdentities ?? []).map((a) => str3(a).toLowerCase()).filter(Boolean);
   if (authors.includes(verifier.toLowerCase())) {
     return deny2(
       "manual_verifier_is_author",
@@ -299,7 +435,7 @@ function assessVerifier(raw, context) {
   return ok2;
 }
 function parseTimestamp(raw) {
-  const text = str2(raw);
+  const text = str3(raw);
   if (!text) return null;
   const ms = Date.parse(text);
   return Number.isFinite(ms) ? ms : null;
@@ -315,19 +451,19 @@ function assessProbes(raw, claimType) {
   for (let i = 0; i < raw.length; i += 1) {
     const probe = raw[i];
     const where = `probe ${i + 1}`;
-    if (!isRecord2(probe)) {
+    if (!isRecord3(probe)) {
       return deny2("ops_probe_malformed", `${where} is not an object`);
     }
-    if (!str2(probe.command)) {
+    if (!str3(probe.command)) {
       return deny2("ops_probe_malformed", `${where} has no command \u2014 record the command verbatim, as typed`);
     }
-    if (!str2(probe.output)) {
+    if (!str3(probe.output)) {
       return deny2(
         "ops_probe_malformed",
         `${where} has no command output \u2014 paste the output verbatim; a probe with nothing to show is a summary, not evidence`
       );
     }
-    if (!str2(probe.host)) {
+    if (!str3(probe.host)) {
       return deny2("ops_probe_malformed", `${where} does not name the host or system it ran against`);
     }
     const ts = parseTimestamp(probe.ran_at);
@@ -359,17 +495,17 @@ function assessVerificationArtifact(raw, context = {}) {
       return deny2("artifact_malformed", "verification artifact must be valid JSON");
     }
   }
-  if (!isRecord2(artifact)) {
+  if (!isRecord3(artifact)) {
     return deny2("artifact_malformed", "verification artifact must be an object");
   }
-  const kind = str2(artifact.kind);
+  const kind = str3(artifact.kind);
   if (kind !== "regression_test" && kind !== "manual" && kind !== "ops_transcript") {
     return deny2("artifact_unknown_kind", "verification artifact kind must be regression_test, manual or ops_transcript");
   }
   if (kind === "ops_transcript") {
     return assessOpsTranscript(artifact, context);
   }
-  const declaredLayer = str2(artifact.defect_layer) || "production";
+  const declaredLayer = str3(artifact.defect_layer) || "production";
   if (declaredLayer !== "production" && declaredLayer !== "test_harness") {
     return deny2("artifact_malformed", "defect_layer must be production or test_harness");
   }
@@ -380,13 +516,13 @@ function assessVerificationArtifact(raw, context = {}) {
         "defect_layer=test_harness was declared, but the fix commit changes no executable test/harness code (comment-only, whitespace-only or docs-only diffs are not fixes at any layer)"
       );
     }
-    if (!str2(artifact.test_id)) {
+    if (!str3(artifact.test_id)) {
       return deny2(
         "test_fix_missing_assertion",
-        "defect_layer=test_harness requires test_id \u2014 name the test whose behaviour is the evidence"
+        "defect_layer=test_harness requires regression_test_id \u2014 name the test whose behaviour is the evidence"
       );
     }
-    if (str2(artifact.reverted_result) !== "fail") {
+    if (str3(artifact.reverted_result) !== "fail") {
       return deny2(
         "test_fix_missing_assertion",
         "defect_layer=test_harness requires reverted_result='fail' \u2014 the observed result of re-running the named test with the fix reverted. A test-only diff that does not go red when removed evidences nothing"
@@ -395,38 +531,44 @@ function assessVerificationArtifact(raw, context = {}) {
   } else if (!isSubstantiveCommit(artifact.substance)) {
     return deny2(
       "commit_not_substantive",
-      "the fix commit changes no executable production source (comment-only, whitespace-only, or test-only diffs are not fixes). If the DEFECT ITSELF is in the test/harness layer, declare defect_layer='test_harness' and supply test_id and reverted_result"
+      "the fix commit changes no executable production source (comment-only, whitespace-only, or test-only diffs are not fixes). If the DEFECT ITSELF is in the test/harness layer, declare defect_layer='test_harness' and supply regression_test_id and reverted_result"
     );
   }
   if (kind === "regression_test") {
-    const testId = str2(artifact.test_id);
-    const fixCommit = str2(artifact.fix_commit);
-    const parentCommit = str2(artifact.parent_commit);
+    const testId = str3(artifact.test_id);
+    const fixCommit = str3(artifact.fix_commit);
+    const parentCommit = str3(artifact.parent_commit);
     if (!testId || !HEX_SHA2.test(fixCommit) || !HEX_SHA2.test(parentCommit)) {
-      return deny2("artifact_malformed", "regression_test requires test_id, fix_commit and parent_commit");
+      return deny2(
+        "artifact_malformed",
+        "regression_test requires regression_test_id and fix_commit. (The parent commit is not a parameter \u2014 it is derived from fix_commit's first parent.)"
+      );
     }
     if (fixCommit.toLowerCase() === parentCommit.toLowerCase()) {
-      return deny2("parent_equals_fix", "parent_commit must be the commit BEFORE the fix");
+      return deny2(
+        "parent_equals_fix",
+        "the parent resolved to the same commit as fix_commit. The parent is derived from fix_commit's first parent, so this means fix_commit is not the commit the fix landed in \u2014 name the fix commit, not its parent."
+      );
     }
-    if (str2(artifact.parent_result) !== "fail") {
+    if (str3(artifact.parent_result) !== "fail") {
       return deny2(
         "test_did_not_fail_at_parent",
         "the named test must FAIL at the parent commit \u2014 a test that already passed does not detect the defect"
       );
     }
-    if (str2(artifact.fix_result) !== "pass") {
+    if (str3(artifact.fix_result) !== "pass") {
       return deny2("test_did_not_pass_at_fix", "the named test must PASS at the fix commit");
     }
     return ok2;
   }
   const verifierResult = assessVerifier(artifact.verifier, context);
   if (!verifierResult.ok) return verifierResult;
-  if (!str2(artifact.method)) {
+  if (!str3(artifact.method)) {
     return deny2("artifact_malformed", "manual verification requires a method");
   }
   const observationResult = assessObservation(artifact.observation);
   if (!observationResult.ok) return observationResult;
-  if (!HEX_SHA2.test(str2(artifact.fix_commit))) {
+  if (!HEX_SHA2.test(str3(artifact.fix_commit))) {
     return deny2("artifact_malformed", "manual verification requires a fix_commit");
   }
   return ok2;
@@ -434,7 +576,7 @@ function assessVerificationArtifact(raw, context = {}) {
 function assessOpsTranscript(artifact, context) {
   const verifierResult = assessVerifier(artifact.verifier, context);
   if (!verifierResult.ok) return verifierResult;
-  const claimType = str2(artifact.claim_type);
+  const claimType = str3(artifact.claim_type);
   if (claimType !== "point_in_time" && claimType !== "ongoing_state") {
     return deny2(
       "artifact_malformed",
@@ -445,14 +587,26 @@ function assessOpsTranscript(artifact, context) {
   if (!probeResult.ok) return probeResult;
   const observationResult = assessObservation(artifact.observation);
   if (!observationResult.ok) return observationResult;
-  const fixCommit = str2(artifact.fix_commit);
+  if (!isObservationAnchored(str3(artifact.observation), artifact.probes)) {
+    return deny2(
+      "observation_not_anchored",
+      "the observation does not quote anything the probes actually returned. State what the output SHOWS that makes the defect absent, in the output's own words \u2014 a description of the activity ('probing whether ...', 'testing if ...') or of the change made is not an observation of absence"
+    );
+  }
+  const fixCommit = str3(artifact.fix_commit);
   if (fixCommit && !HEX_SHA2.test(fixCommit)) {
     return deny2("artifact_malformed", "ops_transcript fix_commit, when supplied, must be a commit sha");
   }
+  if (fixCommit && !isSubstantiveCommit(artifact.substance)) {
+    return deny2(
+      "commit_not_substantive",
+      "this ops_transcript names a fix_commit whose diff changes no executable production source (comment-only, whitespace-only, test-only or docs-only diffs are not fixes). Either name the commit that carries the fix, or omit fix_commit \u2014 an ops transcript does not require one"
+    );
+  }
   return ok2;
 }
 function assessDisposition(disposition, input) {
-  const reason = str2(input.disposition_reason).replace(/\s+/g, " ");
+  const reason = str3(input.disposition_reason).replace(/\s+/g, " ");
   if (!reason) {
     return deny2(
       "disposition_reason_missing",
@@ -478,7 +632,7 @@ function assessDisposition(disposition, input) {
     );
   }
   if (disposition === "superseded") {
-    if (!str2(input.superseded_by)) {
+    if (!str3(input.superseded_by)) {
       return deny2(
         "superseded_by_missing",
         "closing as superseded requires superseded_by \u2014 name the record that replaces this one, so the claim is checkable"
@@ -508,7 +662,7 @@ function assessSupersedingCoverage(input) {
   if (thin.length > 0) {
     return deny2(
       "superseded_coverage_evidence_missing",
-      `${thin.length} symptom(s) are listed as covered with no evidence naming WHERE ${str2(input.superseded_by)} covers them: ${thin.map((e) => e.id).join(", ")}`
+      `${thin.length} symptom(s) are listed as covered with no evidence naming WHERE ${str3(input.superseded_by)} covers them: ${thin.map((e) => e.id).join(", ")}`
     );
   }
   const covered = new Set(entries.map((e) => e.id));
@@ -516,7 +670,7 @@ function assessSupersedingCoverage(input) {
   if (survivors.length > 0) {
     return deny2(
       "superseded_coverage_incomplete",
-      `${survivors.length} of ${declared.length} symptoms are NOT covered by ${str2(input.superseded_by)}: ${survivors.join(", ")}. Partial coverage supersedes nothing \u2014 keep this record open with those symptoms as its remaining scope, or supply coverage evidence for each`
+      `${survivors.length} of ${declared.length} symptoms are NOT covered by ${str3(input.superseded_by)}: ${survivors.join(", ")}. Partial coverage supersedes nothing \u2014 keep this record open with those symptoms as its remaining scope, or supply coverage evidence for each`
     );
   }
   return ok2;
@@ -534,10 +688,10 @@ function parseCoverageEntries(raw) {
   if (!Array.isArray(value)) return [];
   const entries = [];
   for (const entry of value) {
-    if (!isRecord2(entry)) continue;
-    const id = str2(entry.id);
+    if (!isRecord3(entry)) continue;
+    const id = str3(entry.id);
     if (!id) continue;
-    entries.push({ id, evidence: str2(entry.evidence) });
+    entries.push({ id, evidence: str3(entry.evidence) });
   }
   return entries;
 }
@@ -555,7 +709,7 @@ function parseSymptomIds(raw) {
   const ids = [];
   for (const entry of value) {
     if (typeof entry === "string" && entry.trim()) ids.push(entry.trim());
-    else if (isRecord2(entry) && str2(entry.id)) ids.push(str2(entry.id));
+    else if (isRecord3(entry) && str3(entry.id)) ids.push(str3(entry.id));
   }
   return ids;
 }
@@ -563,13 +717,14 @@ function parseSymptomIds(raw) {
 // src/lib/verification-evidence.ts
 var TEST_PATH = /(?:^|\/)(?:tests?|__tests__|__mocks__|e2e|fixtures)\//i;
 var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/i;
-var NON_SOURCE_FILE = /\.(?:md|mdx|txt|rst|adoc|snap|lock)$/i;
+var NON_SOURCE_FILE = /\.(?:md|mdx|txt|rst|adoc|snap)$/i;
+var DERIVED_PATH = /(?:^|\/)(?:docs|exe\/output)\//i;
 var COMMENT_LINE = /^(?:\/\/|\/\*|\*\/|\*(?!\/)|#|--|<!--|-->)/;
 function isTestPath(path) {
   return TEST_PATH.test(path) || TEST_FILE.test(path);
 }
 function isNonSourcePath(path) {
-  return NON_SOURCE_FILE.test(path);
+  return NON_SOURCE_FILE.test(path) || DERIVED_PATH.test(path);
 }
 function isCommentOrBlank(line) {
   const trimmed = line.trim();
@@ -700,6 +855,32 @@ function resolveCommit(sha, cwd) {
     return null;
   }
 }
+function repoField(cwd) {
+  const name = cwd ? resolveRepoName(cwd) : null;
+  return name ? { repo: name } : {};
+}
+function resolveRepoName(cwd) {
+  try {
+    const remote = execFileSync("git", ["remote", "get-url", "origin"], {
+      cwd,
+      encoding: "utf8",
+      timeout: 1e4,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    let remotePath;
+    if (/^(?:https|ssh):\/\//i.test(remote)) {
+      remotePath = new URL(remote).pathname;
+    } else {
+      const scp = /^(?:[^/@:\s]+@)?[^/:\s]+:(.+)$/.exec(remote);
+      if (!scp) return null;
+      remotePath = scp[1];
+    }
+    const name = remotePath.replace(/\/+$/, "").split("/").pop()?.replace(/\.git$/, "");
+    return name && /^[A-Za-z0-9._-]{1,64}$/.test(name) ? name : null;
+  } catch {
+    return null;
+  }
+}
 function checkVerifierName(raw) {
   const verifier = (raw ?? "").trim();
   if (!verifier) {
@@ -740,6 +921,29 @@ function buildOpsTranscript(request, context) {
       "the observation must describe what the output SHOWS that makes the defect absent \u2014 not that the bug is 'fixed'"
     );
   }
+  let substance = { added: 0, deleted: 0, substantive_added: 0, source_files: 0 };
+  const declaredCommit = (request.fix_commit ?? "").trim();
+  if (declaredCommit) {
+    const repo = (request.repo_path ?? "").trim();
+    if (!repo) {
+      return fail(
+        "repo_path_missing",
+        "repo_path is required when an ops_transcript names a fix_commit: a commit offered as the fix is measured, not described. Omit fix_commit if the work was not a commit."
+      );
+    }
+    const resolved = resolveCommit(declaredCommit, repo);
+    if (!resolved) {
+      return fail(
+        "fix_commit_unresolvable",
+        `fix_commit ${declaredCommit} is not a commit in ${repo} \u2014 verification evidence cannot be measured, and will not be guessed`
+      );
+    }
+    const measured = measureCommitSubstance(resolved, repo);
+    if (!measured) {
+      return fail("commit_not_measurable", `git could not diff ${resolved} in ${repo}`);
+    }
+    substance = measured;
+  }
   const artifact = {
     kind: "ops_transcript",
     verifier: verifierCheck.verifier,
@@ -751,15 +955,12 @@ function buildOpsTranscript(request, context) {
       ran_at: (p?.ran_at ?? "").trim()
     })),
     observation,
-    ...request.fix_commit?.trim() ? { fix_commit: request.fix_commit.trim() } : {}
+    // Bug cc539242: a sha is only resolvable evidence alongside the repo it lives in.
+    ...declaredCommit ? { fix_commit: declaredCommit, substance, ...repoField((request.repo_path ?? "").trim()) } : {}
   };
   const assessed = assessVerificationArtifact(artifact, context);
   if (!assessed.ok) return fail(assessed.code, assessed.message);
-  return {
-    ok: true,
-    artifact,
-    substance: { added: 0, deleted: 0, substantive_added: 0, source_files: 0 }
-  };
+  return { ok: true, artifact, substance };
 }
 function buildVerificationArtifact(request, context = {}) {
   if (request.kind === "ops_transcript") {
@@ -819,6 +1020,9 @@ function buildVerificationArtifact(request, context = {}) {
       kind: "regression_test",
       test_id: testId,
       fix_commit: fixCommit,
+      // Bug cc539242: record WHICH repo the sha is in, so a reader never resolves it
+      // against the repo the record happens to be filed under.
+      ...repoField(repo),
       parent_commit: parentCommit,
       parent_result: parentResult,
       fix_result: fixResult,
@@ -848,6 +1052,8 @@ function buildVerificationArtifact(request, context = {}) {
       method,
       observation,
       fix_commit: fixCommit,
+      // Bug cc539242 — see the regression_test branch.
+      ...repoField(repo),
       substance,
       ...defectLayer === "test_harness" ? { defect_layer: defectLayer, test_id: (request.test_id ?? "").trim(), reverted_result: revertedResult } : {}
     };

package/dist/{chunk-6FIC57PH.js → chunk-T4P2G3PO.js}

@@ -2,7 +2,7 @@ import {
   deleteKeychainSecret,
   getKeychainSecret,
   setKeychainSecret
-} from "./chunk-5U2IJBFV.js";
+} from "./chunk-TA3B4N24.js";
 
 // src/lib/consent-passphrase.ts
 import crypto from "crypto";

package/dist/{chunk-5U2IJBFV.js → chunk-TA3B4N24.js}

@@ -703,7 +703,7 @@ function parseRetiredMasterKeys(raw) {
 }
 async function retiredKeyShardUsage(hexKeys) {
   try {
-    const { countShardsPerKey } = await import("./shard-manager-HHHHV2KZ.js");
+    const { countShardsPerKey } = await import("./shard-manager-C7LYX6E4.js");
     return await countShardsPerKey(hexKeys);
   } catch {
     return null;