@cairnkeep/cli 2.21.1 → 2.22.1

package/docs/releasing.md

@@ -3,6 +3,23 @@
 Publishing is driven by a GitHub Release. Maintainers do not publish the package
 from a workstation.
 
+## Advisory Scorecard recovery
+
+The repository's Actions policy must allow the exact pinned
+`ossf/scorecard-action@<full-SHA-from-scorecard.yml>` reference. An entry ending
+in `scorecard-action/*` does not allow the root action. Keep SHA pinning required;
+do not enable all third-party actions to recover this one workflow.
+
+If GitHub rejects a run before creating any jobs and refuses to retry it, fix
+the repository allowlist and start a fresh advisory analysis explicitly:
+
+```bash
+gh workflow run scorecard.yml --ref main
+```
+
+This does not bypass required platform, CodeQL or dependency-review gates and
+does not require republishing the npm package.
+
 ## Release contract
 
 1. Update the root `package.json` version and `CHANGELOG.md` on a pull request.
@@ -52,11 +69,28 @@ different version or tree.
 
 The repository must provide an `NPM_TOKEN` Actions secret authorized to publish
 `@cairnkeep/cli`. Keep that credential out of local files and rotate it according
-to the npm account's security policy. The workflow grants `actions: read`,
-`contents: write`, `packages: write`, `attestations: write`, and
-`id-token: write`. Read access resolves the successful tree-addressed CI
-artifact; the last two permissions are required for registry-backed build
-provenance.
+to the npm account's security policy. Workflow defaults grant only
+`contents: read`; publication authority is explicit and job-scoped:
+
+| Job | Token permissions | Purpose |
+|---|---|---|
+| `prepare` | `contents: read`, `actions: read` | Check the tag and download the successful exact-tree CI candidate; no publication or signing authority |
+| `npm` | `contents: write`, `id-token: write` | Attach verified release assets and request npm provenance; registry publication uses the separate `NPM_TOKEN` |
+| `containers` | `contents: read`, `packages: write`, `attestations: write`, `id-token: write`, `artifact-metadata: write` | Read source, publish OCI images, sign/upload provenance and create the pinned action's registry storage record |
+
+Each job declares its complete permission map. Unspecified token permissions
+are denied rather than inherited; see [GitHub's permission semantics](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions).
+The container grant retains `artifact-metadata: write` because the pinned
+[attestation implementation](https://github.com/actions/attest/blob/508db95dd578ae2727ebd6217d5ba78e4fbda05d/README.md#usage)
+creates a storage record. Do not remove required provenance permissions merely
+to improve an advisory score.
+
+The parsed-YAML baseline rejects workflow-wide writes, unexpected publication
+jobs and any missing or excessive grant in these maps. Its positive control
+and mutation tests verify the declared contract, not GitHub's execution or a
+future privileged publication. Keep the required platform/security gates and
+verify the next normal release's publication and attestations separately.
+CI-only permission changes do not require republishing an immutable version.
 
 GitHub creates each new GHCR package as private. After the first container
 release, a package administrator must change both `cairnkeep` and

package/docs/research/release-ledger-task.md

@@ -0,0 +1,36 @@
+# Bounded release-ledger task
+
+Use a disposable project, Node standard APIs and ESM only. Implement
+`src/release-ledger.mjs` exporting `createLedger()`. The returned API exposes
+`append(input)`, `finalize(packageName, version)`, `get(packageName, version)`
+and `list()`.
+
+- Package names match `^[a-z][a-z0-9-]*$`; versions are numeric x.y.z. Notes
+  are non-empty arrays of non-empty strings, preserving order. Invalid input
+  throws Error with code `INVALID_PACKAGE`, `INVALID_VERSION` or `INVALID_NOTES`.
+- `append({package,version,notes})` creates a draft with monotonically
+  increasing sequence starting at 1. A pair is unique forever; duplicates
+  throw `DUPLICATE_RELEASE`.
+- Entries have exactly package, version, notes, sequence, state and optional
+  checksum. Draft state is `draft`; finalized state is `final`.
+- `finalize` is idempotent. Checksum is lowercase SHA-256 of
+  `JSON.stringify({package,version,notes,sequence})` in that property order.
+  Missing releases throw `NOT_FOUND`.
+- `get` and `list` return detached copies including nested notes. `list` is
+  sequence ordered. Add and run self-tests without changing this brief.
+
+After the task closes, run the maintained independent grader from outside the
+project, with an external process timeout:
+
+```sh
+node scripts/spikes/verify-release-ledger.mjs /PATH/TO/LAB/src/release-ledger.mjs
+```
+
+This imports and executes the selected artifact; it is not a safe reader for
+arbitrary untrusted code. Use a lab with no production secrets or services.
+The grader checks 15 bounded behaviors, not all possible inputs or security.
+Do not expose its implementation to the task before grading. A model could
+deliberately game any visible rubric; this is a correctness smoke test, not
+adversarial certification. Run protocol observation separately using the
+[memory audit](../agent-memory-protocol.md). Keep raw exports private; publish
+only appropriately reviewed aggregate evidence. One run is not an A/B study.

package/docs/security-assurance.md

@@ -46,6 +46,7 @@ be enabled and evaluated independently.
 |---|---|---|
 | Traversal, alternate separators, drive paths, ADS, forbidden Windows characters/device aliases, invalid Unicode, or case collisions in portable data | One cross-platform path validator is used by context packs, OKF, artifacts, and evaluations; deterministic adversarial cases run in the smoke suite | Filesystems can have additional locale- or mount-specific semantics; containment checks remain required at every write |
 | Symlink or special-file substitution | Canonical roots, non-symlink regular-file checks, atomic replacement, and existing symlink/race regression tests | A hostile process running as the same account can race or replace resources outside Cairnkeep's process boundary |
+| Concurrent context-pack project pointer updates | Exclusive directory locks, bounded Windows contention retries, unsafe-lock rejection, injected denial controls and native cross-process exclusion tests | A persistent lock can block progress; recovery never infers abandonment or steals the lock |
 | Unauthenticated or rebound HTTP access | HTTP refuses to start without a token, compares it in constant time, validates `Host`, denies CORS by default, and bounds headers, request time, keep-alive time, and bodies to 8 MiB | Bearer tokens are not user identities; deploy TLS at the ingress for non-loopback traffic |
 | Excessive MCP authority | Explicit MCP annotations, restrictive profiles, capability intersection, and separate HTTP consent for sensitive optional tools | The default profile remains `full` for compatibility; operators should choose `read-only` or `custom` for observation-only clients |
 | Malicious repository or context content influencing an agent | Memory results are locators, skills need digest-bound approval, pack content stays read-only, and maintained source must be verified | Prompt injection is not solved; the harness/model must continue treating retrieved text as untrusted data |
@@ -105,6 +106,16 @@ provenance, produces CycloneDX 1.6 and container SBOMs, and attests container
 provenance. A digest proves content integrity, not publisher identity; verify
 the repository, release tag, registry namespace, and provenance together.
 
+Workflow token defaults are read-only. Publication grants are explicit per job:
+candidate preparation receives only source/Actions read access, npm receives
+release-attachment and provenance authority, and container publication receives
+registry/signing/attestation/storage-record authority without release-write
+access. See the exact maps in [Releasing](releasing.md). The security baseline
+rejects excess and missing grants with positive and adversarial controls.
+This reduces unnecessary token authority; it neither isolates steps within a
+job nor constrains the separate npm publishing secret. Static checks do not
+prove a future privileged publish run succeeds.
+
 ## Deliberate non-goals and residual risks
 
 - Cairnkeep is not a sandbox, endpoint-security product, secret manager, TLS

package/examples/eval/README.md

@@ -1,5 +1,18 @@
 # Offline evaluation fixture
 
+The separate `protocol-project-search.json`, `protocol-narration.json` and
+native-format `protocol-codex.jsonl`
+controls exercise `cairn eval protocol`, without running an adapter. See the
+[memory protocol guide](../../docs/agent-memory-protocol.md). These synthetic
+controls demonstrate parser behavior, not live model quality.
+
+`scripts/spikes/verify-release-ledger.mjs MODULE_PATH` separately grades the
+bounded release-ledger coding task with 15 deterministic artifact checks. It
+imports and executes the explicitly selected module: use an isolated lab and
+an external timeout, never untrusted production files. Its score is not a
+protocol score, a comprehensive security audit or an A/B comparison.
+The [task brief](../../docs/research/release-ledger-task.md) defines the lab.
+
 This directory contains Cairnkeep's deterministic, network-free evaluation
 population. It validates the evaluation framework; its designed differences are
 not performance, efficiency, quality, or live-product evidence.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.21.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.22.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/examples/eval/protocol-codex.jsonl

@@ -0,0 +1,5 @@
+{"type":"thread.started","thread_id":"synthetic-control"}
+{"type":"turn.started"}
+{"type":"item.started","item":{"id":"a","type":"mcp_tool_call","server":"cairn-memory","tool":"memory_search","arguments":{"scope":"project","query":"release ledger"},"status":"in_progress"}}
+{"type":"item.completed","item":{"id":"a","type":"mcp_tool_call","server":"cairn-memory","tool":"memory_search","arguments":{"scope":"project","query":"release ledger"},"status":"completed","result":{"content":[],"structured_content":{"mode":"substring","count":0,"results":[]}}}}
+{"type":"turn.completed","usage":{"input_tokens":10,"cached_input_tokens":0,"output_tokens":1}}

package/examples/eval/protocol-narration.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "session_id": "protocol-negative-control",
+  "harness": "pi",
+  "project_root": "/synthetic/project",
+  "started_at": "2026-10-07T00:00:00.000Z",
+  "ended_at": "2026-10-07T00:01:00.000Z",
+  "events": [
+    {"sequence": 0, "kind": "model_output", "payload": {"text": "I called memory_search with scope project and found the ledger conventions."}}
+  ],
+  "capture": {"captured_at": "2026-10-07T00:01:00.000Z", "omitted_reasoning_blocks": 0, "omitted_unknown_records": 0, "truncated": false}
+}

package/examples/eval/protocol-project-search.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": 1,
+  "session_id": "protocol-positive-control",
+  "harness": "pi",
+  "project_root": "/synthetic/project",
+  "started_at": "2026-10-07T00:00:00.000Z",
+  "ended_at": "2026-10-07T00:01:00.000Z",
+  "events": [
+    {"sequence": 0, "kind": "tool_invocation", "payload": {"call_id": "search-1", "tool_name": "memory_search", "input": {"scope": "project", "query": "ledger validation conventions"}}},
+    {"sequence": 1, "kind": "tool_result", "payload": {"call_id": "search-1", "is_error": false, "output": "{\"mode\":\"substring\",\"count\":0,\"results\":[]}"}}
+  ],
+  "capture": {"captured_at": "2026-10-07T00:01:00.000Z", "omitted_reasoning_blocks": 0, "omitted_unknown_records": 0, "truncated": false}
+}

package/mcp-memory-server/dist/context-pack-lock.js

@@ -0,0 +1,48 @@
+import { lstatSync } from "node:fs";
+import { mkdir, rm } from "node:fs/promises";
+const filesystem = {
+    platform: process.platform,
+    create: (path) => mkdir(path, { mode: 0o700 }),
+    inspect: (path) => lstatSync(path),
+    remove: (path) => rm(path, { recursive: true, force: true }),
+    wait: (milliseconds) => new Promise((resolveWait) => setTimeout(resolveWait, milliseconds)),
+};
+// The internal filesystem seam lets offline controls reproduce platform errors
+// without replacing process.platform or weakening the real filesystem checks.
+export async function acquireContextPackPointerLock(lock, operations = filesystem) {
+    for (let attempt = 0; attempt < 200; attempt += 1) {
+        try {
+            await operations.create(lock);
+            return () => operations.remove(lock);
+        }
+        catch (error) {
+            const code = error.code;
+            const windowsContention = operations.platform === "win32" && code === "EPERM";
+            if (code !== "EEXIST" && !windowsContention)
+                throw error;
+            let info;
+            try {
+                info = operations.inspect(lock);
+            }
+            catch (inspectionError) {
+                const inspectionCode = inspectionError.code;
+                if (inspectionCode === "ENOENT") {
+                    // A Windows delete-pending directory can temporarily appear
+                    // absent; pace this case under the same bounded retry budget.
+                    if (windowsContention)
+                        await operations.wait(10);
+                    continue;
+                }
+                if (operations.platform === "win32" && ["EPERM", "EBUSY"].includes(inspectionCode ?? "")) {
+                    await operations.wait(10);
+                    continue;
+                }
+                throw inspectionError;
+            }
+            if (!info.isDirectory() || info.isSymbolicLink())
+                throw new Error("Context pack project pointer lock is unsafe.");
+            await operations.wait(10);
+        }
+    }
+    throw new Error("Context pack project pointer is locked; retry after the active update finishes.");
+}

package/mcp-memory-server/dist/context-pack.js

@@ -11,6 +11,7 @@ import { doctorProgressiveContextCache, loadProgressiveContext, publicTree, sele
 import { indexOkfBundle, validateOkfBundle, validatedOkfFileContent } from "./okf.js";
 import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 import { portablePathCollisionKey, portableRelativePathIssue } from "./path-security.js";
+import { acquireContextPackPointerLock } from "./context-pack-lock.js";
 const execFileAsync = promisify(execFile);
 export const CONTEXT_PACK_MANIFEST = "context-pack.json";
 export const CONTEXT_PACK_MAX_FILE_BYTES = 1024 * 1024;
@@ -611,36 +612,10 @@ export function readProjectPointer(options) {
         throw new Error("Context pack project pointer is unsafe.");
     return parseProjectPointer(JSON.parse(readFileSync(identity.path, "utf8")), identity.id);
 }
-function delay(milliseconds) {
-    return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
-}
 async function acquirePointerLock(options) {
     const identity = projectIdentity(options);
     await mkdir(dirname(identity.path), { recursive: true, mode: 0o700 });
-    const lock = `${identity.path}.lock`;
-    for (let attempt = 0; attempt < 200; attempt += 1) {
-        try {
-            await mkdir(lock, { mode: 0o700 });
-            return () => rm(lock, { recursive: true, force: true });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            let info;
-            try {
-                info = lstatSync(lock);
-            }
-            catch (inspectionError) {
-                if (inspectionError.code === "ENOENT")
-                    continue;
-                throw inspectionError;
-            }
-            if (!info.isDirectory() || info.isSymbolicLink())
-                throw new Error("Context pack project pointer lock is unsafe.");
-            await delay(10);
-        }
-    }
-    throw new Error("Context pack project pointer is locked; retry after the active update finishes.");
+    return acquireContextPackPointerLock(`${identity.path}.lock`);
 }
 async function mutateProjectPointer(options, mutate) {
     const release = await acquirePointerLock(options);

package/mcp-memory-server/dist/eval-cli.js

@@ -8,19 +8,21 @@ import { diagnoseEvalReport, readEvalReport, renderEvalReport, } from "./eval-re
 import { buildAblationArms, runCapabilityAblation, runTwoPassExperiment, } from "./eval-runner.js";
 import { canonicalJson, EVAL_SCHEMA_VERSION } from "./eval-schema.js";
 import { privatePathIsSafe } from "./platform-security.js";
+import { auditMemoryProtocol, readProtocolTrajectory, readCodexProtocol } from "./eval-protocol.js";
 process.stdout.on("error", (error) => {
     if (error.code === "EPIPE")
         process.exit(0);
     throw error;
 });
-const publicCommands = new Set(["validate", "run", "ablate", "report", "prune", "delete"]);
+const publicCommands = new Set(["validate", "run", "ablate", "report", "prune", "delete", "protocol"]);
+const protocolFlags = new Set(["--trajectory", "--codex-jsonl", "--capture-authorized", "--json"]);
 const validateFlags = new Set(["--task-set", "--adapter", "--output", "--repetitions", "--seed", "--json"]);
 const runFlags = new Set([...validateFlags, "--yes"]);
 const ablateFlags = new Set([...runFlags, "--disable"]);
 const reportFlags = new Set(["--experiment", "--json"]);
 const pruneFlags = new Set(["--older-than-days", "--dry-run", "--json"]);
 const deleteFlags = new Set(["--experiment", "--dry-run", "--json"]);
-const valueFlags = new Set(["--task-set", "--adapter", "--output", "--repetitions", "--seed", "--disable", "--experiment", "--older-than-days"]);
+const valueFlags = new Set(["--task-set", "--adapter", "--output", "--repetitions", "--seed", "--disable", "--experiment", "--older-than-days", "--trajectory", "--codex-jsonl"]);
 const EXPERIMENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const DEFAULT_REPORT_BYTES = 16 * 1024 * 1024;
 const DEFAULT_RETENTION_DAYS = 30;
@@ -36,9 +38,14 @@ Usage:
   cairn eval report --experiment ID [--json]
   cairn eval prune [--older-than-days N] [--dry-run] [--json]
   cairn eval delete --experiment ID [--dry-run] [--json]
+  cairn eval protocol --trajectory PATH [--capture-authorized] [--json]
+  cairn eval protocol --codex-jsonl PATH [--capture-authorized] [--json]
 
 Evaluation is disabled unless CAIRN_EVAL is explicitly enabled. Live harness
 commands remain operator-owned; validate resolves inputs without executing one.
+Protocol audits normalized trajectories or single-turn Codex exec JSONL offline.
+No transcript execution, capture activation, network requests or writes occur.
+Capture authorization is a caller assertion; protocol compliance is not task quality.
 `;
 }
 function valueAfter(args, flag) {
@@ -466,6 +473,22 @@ async function main() {
         disabled(json);
         return;
     }
+    if (command === "protocol") {
+        assertKnown(args, protocolFlags);
+        if (args.includes("--trajectory") === args.includes("--codex-jsonl")) {
+            throw new Error("Supply exactly one of --trajectory or --codex-jsonl.");
+        }
+        const loaded = args.includes("--codex-jsonl") ? readCodexProtocol(requireValue(args, "--codex-jsonl"))
+            : readProtocolTrajectory(requireValue(args, "--trajectory"));
+        const value = auditMemoryProtocol(loaded.session, loaded.digest, args.includes("--capture-authorized"));
+        process.stdout.write(`${json ? JSON.stringify(value) : [
+            `Memory protocol: ${value.status}`,
+            ...value.checks.map(check => `${check.id}: ${check.status} (${check.code})`),
+            "Local evidence only; task quality and authenticated consent are not measured.",
+        ].join("\n")}\n`);
+        process.exitCode = value.status === "fail" ? 1 : value.status === "inconclusive" ? 3 : 0;
+        return;
+    }
     if (command === "validate") {
         assertKnown(args, validateFlags);
         const plan = loadPlan(args);

package/mcp-memory-server/dist/eval-codex.js

@@ -0,0 +1,163 @@
+import { canonicalJson } from "./eval-schema.js";
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function invalid() { throw new Error("protocol_input_invalid_or_unsafe"); }
+/** Explicit single-turn exec JSONL export; never an internal rollout reader. */
+export function normalizeCodexExec(text) {
+    try {
+        if (Buffer.byteLength(text, "utf8") > 16 * 1024 * 1024)
+            invalid();
+        const lines = text.split("\n");
+        if (lines.at(-1) === "" || lines.at(-1) === "\r")
+            lines.pop();
+        if (!lines.length || lines.length > 50_000)
+            invalid();
+        const events = [];
+        const items = new Map();
+        let thread = false, turn = false, ended = false, gaps = 0, reasoning = 0;
+        const emit = (kind, payload) => {
+            events.push({ sequence: events.length, kind, payload });
+        };
+        const extra = (value, fields) => {
+            if (Object.keys(value).some(key => !fields.includes(key)))
+                gaps++;
+        };
+        for (const line of lines) {
+            const event = record(JSON.parse(line));
+            if (!event || typeof event.type !== "string")
+                invalid();
+            if (event.type === "thread.started") {
+                if (thread || turn || ended || typeof event.thread_id !== "string" || !event.thread_id)
+                    invalid();
+                thread = true;
+                extra(event, ["type", "thread_id"]);
+                continue;
+            }
+            if (event.type === "turn.started") {
+                if (turn || ended)
+                    invalid();
+                if (!thread)
+                    gaps++;
+                turn = true;
+                extra(event, ["type"]);
+                continue;
+            }
+            if (event.type === "turn.completed" || event.type === "turn.failed") {
+                if (ended)
+                    invalid();
+                if (!turn || event.type === "turn.failed")
+                    gaps++;
+                ended = true;
+                extra(event, ["type", "usage", "error"]);
+                continue;
+            }
+            if (event.type === "error") {
+                gaps++;
+                continue;
+            }
+            if (!["item.started", "item.updated", "item.completed"].includes(event.type)) {
+                gaps++;
+                continue;
+            }
+            if (ended)
+                invalid();
+            if (!turn)
+                gaps++;
+            extra(event, ["type", "item"]);
+            const item = record(event.item);
+            if (!item || typeof item.id !== "string" || !item.id || item.id.length > 1024 || typeof item.type !== "string")
+                invalid();
+            const id = item.id;
+            const complete = event.type === "item.completed";
+            const previous = items.get(id);
+            if (previous && (previous.complete || previous.type !== item.type || event.type === "item.started"))
+                invalid();
+            const tool = ["mcp_tool_call", "command_execution", "file_change", "web_search"].includes(item.type);
+            let identity = item.type;
+            let name = item.type;
+            let input = {};
+            let output = null;
+            if (item.type === "mcp_tool_call") {
+                extra(item, ["id", "type", "server", "tool", "arguments", "result", "error", "status"]);
+                if (typeof item.server !== "string" || !item.server || typeof item.tool !== "string" || !item.tool
+                    || !record(item.arguments))
+                    invalid();
+                name = `mcp__${item.server}__${item.tool}`;
+                input = item.arguments;
+                identity = canonicalJson({ server: item.server, tool: item.tool, arguments: input });
+                const result = record(item.result);
+                if (result) {
+                    extra(result, ["content", "structured_content", "_meta"]);
+                    output = result.structured_content === undefined || result.structured_content === null
+                        ? { content: result.content } : { structuredContent: result.structured_content };
+                }
+                // Native CLI snapshots serialize absent result/error as null.
+                if (!complete && (item.result != null || item.error != null))
+                    invalid();
+            }
+            else if (item.type === "command_execution") {
+                extra(item, ["id", "type", "command", "aggregated_output", "exit_code", "status"]);
+                if (typeof item.command !== "string")
+                    invalid();
+                identity = canonicalJson({ command: item.command });
+            }
+            else if (item.type === "file_change") {
+                extra(item, ["id", "type", "changes", "status"]);
+                if (!Array.isArray(item.changes))
+                    invalid();
+            }
+            else if (item.type === "web_search") {
+                extra(item, ["id", "type", "query"]);
+                if (typeof item.query !== "string")
+                    invalid();
+            }
+            else if (item.type === "agent_message" || item.type === "reasoning") {
+                extra(item, ["id", "type", "text"]);
+                if (typeof item.text !== "string")
+                    invalid();
+                if (item.type === "reasoning" && !previous)
+                    reasoning++;
+            }
+            else if (item.type === "todo_list") {
+                extra(item, ["id", "type", "items"]);
+                if (!Array.isArray(item.items))
+                    invalid();
+            }
+            else {
+                gaps++;
+            }
+            if (previous && previous.identity !== identity)
+                invalid();
+            if (tool) {
+                if (!previous) {
+                    // MCP/command starts carry dispatch order. A terminal-only
+                    // record cannot establish it, but must still expose writes.
+                    if (["mcp_tool_call", "command_execution"].includes(item.type) && event.type !== "item.started")
+                        gaps++;
+                    emit("tool_invocation", { call_id: id, tool_name: name, input });
+                }
+                if (["mcp_tool_call", "command_execution", "file_change"].includes(item.type)) {
+                    if (complete ? !["completed", "failed"].includes(String(item.status)) : item.status !== "in_progress")
+                        invalid();
+                }
+                if (complete)
+                    emit("tool_result", { call_id: id, output, is_error: item.status === "failed" || item.error != null });
+            }
+            items.set(id, { type: item.type, identity, complete });
+        }
+        if (!thread || !turn || !ended || [...items.values()].some(item => !item.complete))
+            gaps++;
+        if (events.length > 50_000)
+            invalid();
+        // Timestamps/project identity are not supplied by exec JSONL. These
+        // placeholders are private adapter scaffolding, never output claims.
+        const time = "1970-01-01T00:00:00.000Z";
+        return { schema_version: 1, session_id: "codex-exec-export", harness: "codex", project_root: "not-supplied",
+            started_at: time, ended_at: time, events,
+            capture: { captured_at: time, omitted_reasoning_blocks: reasoning, omitted_unknown_records: gaps, truncated: false } };
+    }
+    catch {
+        return invalid();
+    }
+}