@cassiomc1/forgeloop 0.1.1 → 0.1.3

package/src/core/profile.js

@@ -0,0 +1,48 @@
+import { readFile } from "node:fs/promises";
+
+import { ARTIFACT_PATHS, readJsonArtifact } from "./artifacts.js";
+import { assertSafePath, ensureWithin, fileExists } from "./filesystem.js";
+import { assertSourceProvenance } from "./sources.js";
+
+const SOURCE_ID_PATTERN = /\b(?:USER|FILE|CMD|DECISION|OBS|INFER|UNKNOWN)-[A-Z0-9_-]+\b/g;
+const DIRECTIVE_PATTERN = /forgeloop-source:\s*([A-Z0-9_-]+)\s+kind=([a-z-]+)/gi;
+
+function issue(code, message, artifacts = []) {
+  return { code, message, artifacts };
+}
+
+export async function validateProfileSources(target, packageRoot) {
+  const profilePath = "PROJECT_PROFILE.md";
+  await assertSafePath(target, profilePath);
+  const absolutePath = ensureWithin(target, profilePath);
+  if (!(await fileExists(absolutePath))) {
+    return { status: "missing", refs: [], errors: [] };
+  }
+  const text = await readFile(absolutePath, "utf8");
+  const refs = [...new Set(text.match(SOURCE_ID_PATTERN) ?? [])].sort();
+  const directives = [...text.matchAll(DIRECTIVE_PATTERN)].map((match) => ({ id: match[1], kind: match[2] }));
+  if (refs.length === 0 && directives.length === 0) {
+    return { status: "not-referenced", refs: [], errors: [] };
+  }
+  const errors = [];
+  let registry;
+  try {
+    registry = (await readJsonArtifact(target, ARTIFACT_PATHS.sources, "source-registry", packageRoot)).value;
+  } catch (error) {
+    errors.push(issue("E_PROFILE_SOURCE_MISSING", error.message, [ARTIFACT_PATHS.sources]));
+    return { status: "invalid", refs, errors };
+  }
+  try {
+    assertSourceProvenance(registry, refs);
+  } catch (error) {
+    errors.push(issue(error.code ?? "E_PROFILE_SOURCE_UNKNOWN", error.message, [ARTIFACT_PATHS.sources]));
+  }
+  for (const directive of directives) {
+    try {
+      assertSourceProvenance(registry, [directive.id], { expectedKind: directive.kind });
+    } catch (error) {
+      errors.push(issue(error.code ?? "E_PROFILE_SOURCE_MISCLASSIFIED", error.message, [ARTIFACT_PATHS.sources]));
+    }
+  }
+  return { status: errors.length === 0 ? "valid" : "invalid", refs, errors };
+}

package/src/core/protocol.js

@@ -15,6 +15,40 @@ export const FAILURE_CLASSES = Object.freeze([
   "STALE_STATE_FAILURE",
 ]);
 
+export const FAILURE_CODES = Object.freeze([
+  "E_PREFLIGHT_NOT_READY",
+  "E_CONTRACT_MISSING",
+  "E_CONTRACT_INVALID",
+  "E_CONTRACT_UNRESOLVED_DECISION",
+  "E_CONTRACT_STALE",
+  "E_ROUTE_MISSING",
+  "E_ROUTE_INVALID",
+  "E_ROUTE_STALE",
+  "E_ROUTE_GUIDE_MISMATCH",
+  "E_ROUTE_REASON_MISSING",
+  "E_GATE_REQUIRED",
+  "E_GATE_UNVERIFIED",
+  "E_GATE_STALE",
+  "E_PHASE_TRANSITION_INVALID",
+  "E_PHASE_PREREQUISITE_MISSING",
+  "E_PHASE_CHRONOLOGY_INVALID",
+  "E_EVIDENCE_REQUIRED",
+  "E_EVIDENCE_KIND_INVALID",
+  "E_EVIDENCE_STALE",
+  "E_EVIDENCE_COVERAGE_PARTIAL",
+  "E_CHECK_STATUS_CONTRADICTION",
+  "E_PROFILE_SOURCE_MISSING",
+  "E_PROFILE_SOURCE_UNKNOWN",
+  "E_PROFILE_SOURCE_MISCLASSIFIED",
+  "E_RECEIPT_ROUTE_MISMATCH",
+  "E_RECEIPT_STATE_MISMATCH",
+  "E_RECEIPT_CONTRACT_MISMATCH",
+  "E_RECEIPT_PATH_MISMATCH",
+  "E_COMPLETION_REJECTED",
+  "E_PUBLICATION_CLAIM_UNVERIFIED",
+  "E_PRODUCTION_READINESS_UNVERIFIED",
+]);
+
 export const WORK_PHASES = Object.freeze([
   "RECEIVED",
   "DISCOVERING",

package/src/core/receipt.js

@@ -2,6 +2,8 @@ import { GUIDE_IDS, PROTOCOL_VERSION } from "./protocol.js";
 import { assertSchema, readSchema } from "./schema-validation.js";
 import { assertEvidenceList, evidenceMatches } from "./evidence.js";
 import { assertJsonLimits } from "./json-safety.js";
+import { assertCheck, assertCheckList } from "./checks.js";
+import { assertCoverageList } from "./coverage.js";
 
 const RECEIPT_SCHEMA_VERSION = 1;
 const SECRET_WORDS = new Set(["token", "password", "secret", "credential"]);
@@ -59,6 +61,10 @@ export function assertReceiptSemantics(receipt) {
   assertEvidenceList(evidence, "receipt.evidence");
 
   for (const [index, check] of receipt.checks.entries()) {
+    if (check?.schemaVersion !== undefined || check?.id !== undefined || check?.evidenceKind !== undefined) {
+      assertCheck(check, `receipt.checks[${index}]`);
+      continue;
+    }
     if (check?.status === "passed") {
       const hasCommandOrResult = [check.command, check.result, check.name]
         .some((value) => typeof value === "string" && value.trim().length > 0);
@@ -68,6 +74,10 @@ export function assertReceiptSemantics(receipt) {
     }
   }
 
+  if (receipt.evidenceCoverage !== undefined) {
+    assertCoverageList(receipt.evidenceCoverage, "receipt.evidenceCoverage");
+  }
+
   if (receipt.status === "complete") {
     const verificationEvidence = evidence.filter((item) => ["OBSERVED", "INFERRED"].includes(item.kind));
     if (verificationEvidence.length === 0) {
@@ -82,10 +92,32 @@ export function assertReceiptSemantics(receipt) {
   ];
   for (const [claimed, terms, field, label] of publicationEvidence) {
     if (claimed && !evidenceMatches(evidence, terms)) {
-      throw new Error(`publication.${field} requires ${label} evidence`);
+      const error = new Error(`publication.${field} requires ${label} evidence`);
+      error.code = "E_PUBLICATION_CLAIM_UNVERIFIED";
+      throw error;
     }
   }
 
+  if (["committed", "pushed", "published", "deployed"].includes(receipt.publicationStatus)) {
+    const requiredTerms = receipt.publicationStatus === "committed"
+      ? ["commit", "committed"]
+      : receipt.publicationStatus === "pushed"
+        ? ["git push", "pushed"]
+        : receipt.publicationStatus === "deployed"
+          ? ["deploy", "deployed", "deployment"]
+          : ["publish", "published", "release"];
+    if (!evidenceMatches(evidence, requiredTerms)) {
+      const error = new Error(`publicationStatus ${receipt.publicationStatus} requires publication evidence`);
+      error.code = "E_PUBLICATION_CLAIM_UNVERIFIED";
+      throw error;
+    }
+  }
+  if (receipt.productionReadiness === "ready" && !evidenceMatches(evidence, ["production readiness", "production validation", "deployment"])) {
+    const error = new Error("productionReadiness ready requires production evidence");
+    error.code = "E_PRODUCTION_READINESS_UNVERIFIED";
+    throw error;
+  }
+
   if (receipt.review.independent === true) {
     const implementer = receipt.review.implementerId;
     const reviewer = receipt.review.reviewerId;
@@ -111,11 +143,18 @@ export async function createReceipt(input, packageRoot) {
     protocolVersion: PROTOCOL_VERSION,
     taskId: input.taskId,
     contractFingerprint: input.contractFingerprint,
+    ...(input.routeFingerprint !== undefined ? { routeFingerprint: input.routeFingerprint } : {}),
+    ...(input.stateFingerprint !== undefined ? { stateFingerprint: input.stateFingerprint } : {}),
     status: input.status ?? "in-progress",
+    ...(input.taskStatus !== undefined ? { taskStatus: input.taskStatus } : {}),
+    ...(input.verificationStatus !== undefined ? { verificationStatus: input.verificationStatus } : {}),
+    ...(input.publicationStatus !== undefined ? { publicationStatus: input.publicationStatus } : {}),
+    ...(input.productionReadiness !== undefined ? { productionReadiness: input.productionReadiness } : {}),
     selectedGuides: [...(input.selectedGuides ?? [])],
     changedPaths: [...(input.changedPaths ?? [])],
     checks: [...(input.checks ?? [])],
     evidence: [...(input.evidence ?? [])],
+    ...(input.evidenceCoverage !== undefined ? { evidenceCoverage: [...input.evidenceCoverage] } : {}),
     review: input.review ?? { status: "not-run", independent: false },
     limitations: [...(input.limitations ?? [])],
     publication: input.publication ?? {

package/src/core/report.js

@@ -0,0 +1,49 @@
+import { readFile } from "node:fs/promises";
+
+import { evaluateAudit } from "./audit.js";
+import { fileExists, ensureWithin } from "./filesystem.js";
+
+async function profileStatus(target) {
+  const profilePath = ensureWithin(target, "PROJECT_PROFILE.md");
+  if (!(await fileExists(profilePath))) return "NOT_VERIFIED";
+  const text = await readFile(profilePath, "utf8");
+  return /^profile-status:\s*verified\s*$/m.test(text) ? "PASS" : "NOT_VERIFIED";
+}
+
+function section(id, label, status, details = null) {
+  return { id, label, status, ...(details ? { details } : {}) };
+}
+
+export async function evaluateReport({ target, packageRoot, strict = false } = {}) {
+  const audit = await evaluateAudit({ target, packageRoot, strict });
+  const completion = audit.completion;
+  const preflight = completion.preflight;
+  const errorCodes = new Set(audit.errors.map((error) => error.code));
+  const coverage = completion.coverage ?? [];
+  const coverageStatus = coverage.length === 0
+    ? "NOT_VERIFIED"
+    : coverage.every((item) => item.status === "COVERED") ? "PASS" : "PARTIAL";
+  const sections = [
+    section("installation", "Installation", audit.installation.status === "ready" ? "PASS" : "NOT_VERIFIED"),
+    section("profile", "Profile", await profileStatus(target)),
+    section("contract", "Contract", preflight.contract.status === "valid" ? "PASS" : "NOT_VERIFIED"),
+    section("routing", "Routing", preflight.routing.status === "valid" ? "PASS" : "NOT_VERIFIED"),
+    section("required-gates", "Required gates", preflight.requiredGates.length === preflight.satisfiedGates.length ? "PASS" : "BLOCKED"),
+    section("phase-chronology", "Phase chronology", completion.ledger.status === "valid" ? "PASS" : "INVALID"),
+    section("evidence-coverage", "Evidence coverage", coverageStatus),
+    section("receipt", "Receipt", errorCodes.has("E_RECEIPT_MISSING") || errorCodes.has("E_RECEIPT_INVALID") ? "NOT_VERIFIED" : "PASS"),
+    section("publication", "Publication state", audit.publicationStatus.toUpperCase().replaceAll("-", "_")),
+    section("production-readiness", "Production readiness", audit.productionReadiness.toUpperCase().replaceAll("-", "_")),
+  ];
+  return {
+    schemaVersion: 1,
+    protocolVersion: 1,
+    status: audit.status,
+    verdict: audit.status === "VALID" ? "VALID" : "INCOMPLETE",
+    sections,
+    publicationStatus: audit.publicationStatus,
+    productionReadiness: audit.productionReadiness,
+    errors: audit.errors,
+    warnings: audit.warnings,
+  };
+}

package/src/core/repository.js

@@ -17,3 +17,21 @@ export async function currentRepositoryFingerprint(target) {
     return { branch: null, head: null };
   }
 }
+
+export async function currentChangedPaths(target) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", target, "status", "--porcelain=v1", "--untracked-files=all"],
+      { windowsHide: true },
+    );
+    return stdout
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .map((line) => line.slice(3).trim())
+      .filter((relativePath) => relativePath && !relativePath.startsWith(".forgeloop/"))
+      .sort();
+  } catch {
+    return null;
+  }
+}

package/src/core/route-artifact.js

@@ -0,0 +1,33 @@
+import { assertRouteInvariants } from "./router.js";
+import { ARTIFACT_PATHS, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
+import { readContract } from "./contract.js";
+
+export async function persistRoute(target, route, packageRoot, options = {}) {
+  assertRouteInvariants(route);
+  let { contractFingerprint, ...writeOptions } = options;
+  if (contractFingerprint === undefined) {
+    try {
+      contractFingerprint = (await readContract(target, packageRoot)).fingerprint;
+    } catch (error) {
+      if (error.code !== "ARTIFACT_MISSING") throw error;
+    }
+  }
+  const value = contractFingerprint === undefined
+    ? route
+    : { ...route, contractFingerprint };
+  assertRouteInvariants(value);
+  return writeJsonArtifact(
+    target,
+    ARTIFACT_PATHS.route,
+    value,
+    "routing-result",
+    packageRoot,
+    writeOptions,
+  );
+}
+
+export async function readPersistedRoute(target, packageRoot) {
+  const artifact = await readJsonArtifact(target, ARTIFACT_PATHS.route, "routing-result", packageRoot);
+  assertRouteInvariants(artifact.value);
+  return artifact;
+}

package/src/core/router.js

@@ -259,31 +259,39 @@ export function evaluateRoute(input = {}) {
 }
 
 export function assertRouteInvariants(result) {
+  const invariantError = (code, message) => {
+    const error = new RouteInputError(message);
+    error.code = code;
+    return error;
+  };
   if (!result || typeof result !== "object" || Array.isArray(result)) {
-    throw new RouteInputError("Route result must be an object");
+    throw invariantError("E_ROUTE_INVALID", "Route result must be an object");
   }
   if (!Array.isArray(result.guides) || new Set(result.guides).size !== result.guides.length) {
-    throw new RouteInputError("Route result contains duplicate guides");
+    throw invariantError("E_ROUTE_INVALID", "Route result contains duplicate guides");
+  }
+  if (result.contractFingerprint !== undefined && !/^[a-f0-9]{64}$/.test(result.contractFingerprint)) {
+    throw invariantError("E_ROUTE_INVALID", "Route contractFingerprint must be a lowercase SHA-256 fingerprint");
   }
   for (const guide of result.guides) {
-    if (!GUIDE_IDS.includes(guide)) throw new RouteInputError(`Route result contains unknown guide: ${guide}`);
+    if (!GUIDE_IDS.includes(guide)) throw invariantError("E_ROUTE_INVALID", `Route result contains unknown guide: ${guide}`);
     if (!Array.isArray(result.reasons?.[guide]) || result.reasons[guide].length === 0) {
-      throw new RouteInputError(`Selected guide has no reason: ${guide}`);
+      throw invariantError("E_ROUTE_REASON_MISSING", `Selected guide has no reason: ${guide}`);
     }
   }
   for (const [guide, reasons] of Object.entries(result.excluded ?? {})) {
     if (guide !== "documentation" && !GUIDE_IDS.includes(guide)) {
-      throw new RouteInputError(`Route result contains unknown excluded guide: ${guide}`);
+      throw invariantError("E_ROUTE_INVALID", `Route result contains unknown excluded guide: ${guide}`);
     }
     if (result.guides.includes(guide)) {
-      throw new RouteInputError(`Guide cannot be selected and excluded: ${guide}`);
+      throw invariantError("E_ROUTE_INVALID", `Guide cannot be selected and excluded: ${guide}`);
     }
     if (!Array.isArray(reasons) || reasons.length === 0) {
-      throw new RouteInputError(`Excluded guide has no exclusion reason: ${guide}`);
+      throw invariantError("E_ROUTE_REASON_MISSING", `Excluded guide has no exclusion reason: ${guide}`);
     }
   }
   if (result.primary !== null && !result.guides.includes(result.primary)) {
-    throw new RouteInputError("Primary guide must be null or selected");
+    throw invariantError("E_ROUTE_INVALID", "Primary guide must be null or selected");
   }
   return result;
 }

package/src/core/schema-validation.js

@@ -13,6 +13,17 @@ export const SHIPPED_SCHEMA_NAMES = Object.freeze([
   "task-brief",
   "delegated-result",
   "evidence",
+  "current-contract",
+  "gate",
+  "source-registry",
+  "config",
+  "preflight",
+  "check",
+  "evidence-coverage",
+  "event",
+  "activation",
+  "policy",
+  "task-bundle",
 ]);
 
 export class SchemaValidationError extends Error {

package/src/core/sources.js

@@ -0,0 +1,86 @@
+import { PROTOCOL_VERSION } from "./protocol.js";
+
+export const SOURCE_REGISTRY_SCHEMA_VERSION = 1;
+export const SOURCE_KINDS = Object.freeze([
+  "user-request",
+  "repository-fact",
+  "observation",
+  "command",
+  "agent-decision",
+  "inference",
+  "unknown",
+]);
+
+export function createSourceRegistry(sources = {}) {
+  if (!sources || typeof sources !== "object" || Array.isArray(sources)) {
+    throw new Error("Source registry must be an object");
+  }
+  return {
+    schemaVersion: SOURCE_REGISTRY_SCHEMA_VERSION,
+    protocolVersion: PROTOCOL_VERSION,
+    sources: structuredClone(sources),
+  };
+}
+
+export function assertSourceKind(kind, label = "source.kind") {
+  if (!SOURCE_KINDS.includes(kind)) throw new Error(`${label} must be one of ${SOURCE_KINDS.join(", ")}`);
+  return kind;
+}
+
+export function assertSourceRefs(registry, refs = []) {
+  const ids = new Set(Object.keys(registry?.sources ?? {}));
+  for (const ref of refs) {
+    if (!ids.has(ref)) {
+      const error = new Error(`Unknown source ID: ${ref}`);
+      error.code = "E_PROFILE_SOURCE_UNKNOWN";
+      throw error;
+    }
+  }
+  return true;
+}
+
+export function assertSourceRegistry(registry) {
+  if (!registry || typeof registry !== "object" || Array.isArray(registry)) {
+    const error = new Error("Source registry must be an object");
+    error.code = "E_PROFILE_SOURCE_INVALID";
+    throw error;
+  }
+  if (registry.schemaVersion !== SOURCE_REGISTRY_SCHEMA_VERSION || registry.protocolVersion !== PROTOCOL_VERSION) {
+    const error = new Error("Source registry has an unsupported protocol version");
+    error.code = "E_PROFILE_SOURCE_INVALID";
+    throw error;
+  }
+  for (const [id, source] of Object.entries(registry.sources ?? {})) {
+    if (!id || !source || typeof source !== "object" || Array.isArray(source)) {
+      const error = new Error(`Invalid source entry: ${id}`);
+      error.code = "E_PROFILE_SOURCE_INVALID";
+      throw error;
+    }
+    assertSourceKind(source.kind, `sources.${id}.kind`);
+    if (typeof source.summary !== "string" || source.summary.trim() === "") {
+      const error = new Error(`Source summary is required: ${id}`);
+      error.code = "E_PROFILE_SOURCE_INVALID";
+      throw error;
+    }
+  }
+  return registry;
+}
+
+export function assertSourceProvenance(registry, refs = [], { expectedKind } = {}) {
+  assertSourceRegistry(registry);
+  assertSourceRefs(registry, refs);
+  const expectedKinds = expectedKind === undefined
+    ? null
+    : new Set(Array.isArray(expectedKind) ? expectedKind : [expectedKind]);
+  if (expectedKinds) {
+    for (const ref of refs) {
+      const source = registry.sources[ref];
+      if (!expectedKinds.has(source.kind)) {
+        const error = new Error(`Source ${ref} has kind ${source.kind}, expected ${[...expectedKinds].join(", ")}`);
+        error.code = "E_PROFILE_SOURCE_MISCLASSIFIED";
+        throw error;
+      }
+    }
+  }
+  return true;
+}

package/src/core/templates.js

@@ -44,6 +44,17 @@ export const TEMPLATE_PATHS = [
   "schemas/task-brief.schema.json",
   "schemas/delegated-result.schema.json",
   "schemas/evidence.schema.json",
+  "schemas/current-contract.schema.json",
+  "schemas/gate.schema.json",
+  "schemas/source-registry.schema.json",
+  "schemas/config.schema.json",
+  "schemas/preflight.schema.json",
+  "schemas/check.schema.json",
+  "schemas/evidence-coverage.schema.json",
+  "schemas/event.schema.json",
+  "schemas/activation.schema.json",
+  "schemas/policy.schema.json",
+  "schemas/task-bundle.schema.json",
 ];
 
 export function getPackageRoot() {

package/src/core/work-state.js

@@ -16,6 +16,8 @@ import { getPackageRoot } from "./templates.js";
 import { currentRepositoryFingerprint } from "./repository.js";
 import { createEvidence } from "./evidence.js";
 import { assertJsonBytes } from "./json-safety.js";
+import { assertCoverageList } from "./coverage.js";
+import { canonicalFingerprint } from "./artifacts.js";
 
 export const WORK_STATE_PATH = ".forgeloop/work-state.json";
 
@@ -27,20 +29,8 @@ export class WorkStateError extends Error {
   }
 }
 
-function canonicalize(value) {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (value && typeof value === "object") {
-    return Object.fromEntries(
-      Object.keys(value).sort().map((key) => [key, canonicalize(value[key])]),
-    );
-  }
-  return value;
-}
-
 export function contractFingerprint(contract) {
-  return createHash("sha256")
-    .update(JSON.stringify(canonicalize(contract)))
-    .digest("hex");
+  return canonicalFingerprint(contract);
 }
 
 function assertFingerprint(value, label) {
@@ -101,6 +91,7 @@ export function assertWorkStateSemantics(state) {
     throw new WorkStateError("Work state taskId is required");
   }
   assertFingerprint(state.contractFingerprint, "contractFingerprint");
+  if (state.routeFingerprint !== undefined) assertFingerprint(state.routeFingerprint, "routeFingerprint");
   if (!state.repositoryFingerprint || typeof state.repositoryFingerprint !== "object" || Array.isArray(state.repositoryFingerprint)) {
     throw new WorkStateError("repositoryFingerprint is required");
   }
@@ -117,6 +108,34 @@ export function assertWorkStateSemantics(state) {
   if (new Set(state.selectedGuides).size !== state.selectedGuides.length) {
     throw new WorkStateError("selectedGuides must not contain duplicates");
   }
+  for (const key of ["requiredGates", "satisfiedGates"]) {
+    if (state[key] !== undefined) {
+      assertStringArray(state[key], key);
+      if (new Set(state[key]).size !== state[key].length) {
+        throw new WorkStateError(`${key} must not contain duplicates`);
+      }
+    }
+  }
+  if (state.satisfiedGates?.some((gate) => !state.requiredGates?.includes(gate))) {
+    throw new WorkStateError("satisfiedGates must be a subset of requiredGates");
+  }
+  if (state.complianceMode !== undefined && !["advisory", "standard", "strict"].includes(state.complianceMode)) {
+    throw new WorkStateError(`Unknown compliance mode: ${state.complianceMode}`);
+  }
+  if (state.publicationStatus !== undefined
+    && !["not-published", "local-only", "committed", "pushed", "published", "deployed"].includes(state.publicationStatus)) {
+    throw new WorkStateError(`Unknown publication status: ${state.publicationStatus}`);
+  }
+  if (state.evidenceCoverage !== undefined && !Array.isArray(state.evidenceCoverage)) {
+    throw new WorkStateError("evidenceCoverage must be an array");
+  }
+  if (state.evidenceCoverage !== undefined) {
+    try {
+      assertCoverageList(state.evidenceCoverage);
+    } catch (error) {
+      throw new WorkStateError(error.message);
+    }
+  }
   assertStringArray(state.completedSteps, "completedSteps");
   assertStringArray(state.pendingSteps, "pendingSteps");
   normalizeRequiredArtifacts(state.requiredArtifacts);
@@ -126,6 +145,9 @@ export function assertWorkStateSemantics(state) {
   if (state.phase === "COMPLETE" && state.verificationEvidence.length === 0) {
     throw new WorkStateError("COMPLETE requires verification evidence");
   }
+  if (state.phase === "COMPLETE" && state.evidenceCoverage?.some((item) => item.status !== "COVERED")) {
+    throw new WorkStateError("COMPLETE requires covered evidence for every recorded criterion");
+  }
   if (state.phase === "BLOCKED" && state.blockers.length === 0) {
     throw new WorkStateError("BLOCKED requires a blocker");
   }
@@ -151,9 +173,15 @@ export function createWorkState(input) {
     protocolVersion: PROTOCOL_VERSION,
     taskId: input.taskId,
     contractFingerprint: input.contractFingerprint,
+    ...(input.routeFingerprint !== undefined ? { routeFingerprint: input.routeFingerprint } : {}),
     repositoryFingerprint: input.repositoryFingerprint ?? { branch: null, head: null },
     phase: input.phase,
     selectedGuides: [...(input.selectedGuides ?? [])],
+    ...(input.requiredGates !== undefined ? { requiredGates: [...input.requiredGates] } : {}),
+    ...(input.satisfiedGates !== undefined ? { satisfiedGates: [...input.satisfiedGates] } : {}),
+    ...(input.complianceMode !== undefined ? { complianceMode: input.complianceMode } : {}),
+    ...(input.evidenceCoverage !== undefined ? { evidenceCoverage: [...input.evidenceCoverage] } : {}),
+    ...(input.publicationStatus !== undefined ? { publicationStatus: input.publicationStatus } : {}),
     completedSteps: [...(input.completedSteps ?? [])],
     pendingSteps: [...(input.pendingSteps ?? [])],
     requiredArtifacts: normalizeRequiredArtifacts(input.requiredArtifacts),