@cassiomc1/forgeloop 0.1.10 → 0.1.12

package/src/core/next-action.js

@@ -11,10 +11,12 @@ import { assertCheckList } from "./checks.js";
 import { completionRelationshipErrors } from "./completion-relationships.js";
 import { classifyLoadedWorkState, readWorkState } from "./work-state.js";
 import { sha256 } from "./manifest.js";
+import { evaluateRequiredEvidence, authoritativeChecksForRequirements, ordinaryLeafRequirements, classifyRequirement } from "./evidence-readiness.js";
 import {
   evaluateStartExecutionPrerequisites,
   PREFLIGHT_ROUTE_IDENTITY_ERROR_MESSAGE,
 } from "./execution-prerequisites.js";
+import { validateEventLedger, validateCompletionRecoveryAuthorization } from "./events.js";
 
 export const NEXT_ACTIONS = Object.freeze({
   DISCOVER: "DISCOVER",
@@ -29,6 +31,7 @@ export const NEXT_ACTIONS = Object.freeze({
   DIAGNOSE: "DIAGNOSE",
   CORRECT: "CORRECT",
   ENTER_REVIEWING: "ENTER_REVIEWING",
+  RECORD_TERMINAL_RESULT: "RECORD_TERMINAL_RESULT",
   PREPARE_COMPLETION: "PREPARE_COMPLETION",
   RUN_COMPLETE: "RUN_COMPLETE",
   RESOLVE_STALE_ROUTE: "RESOLVE_STALE_ROUTE",
@@ -99,6 +102,7 @@ function commandFor(action) {
     [NEXT_ACTIONS.DIAGNOSE]: "forgeloop advance --to DIAGNOSING",
     [NEXT_ACTIONS.CORRECT]: "forgeloop advance --to CORRECTING",
     [NEXT_ACTIONS.ENTER_REVIEWING]: "forgeloop advance --to REVIEWING",
+    [NEXT_ACTIONS.RECORD_TERMINAL_RESULT]: "forgeloop record-terminal-result",
     [NEXT_ACTIONS.PREPARE_COMPLETION]: "forgeloop prepare-completion --json",
     [NEXT_ACTIONS.RUN_COMPLETE]: "forgeloop complete --json",
   }[action];
@@ -120,6 +124,23 @@ function recordCheckCommandSpec(requirement) {
   };
 }
 
+function recordTerminalResultCommandSpec(requirement) {
+  const reqId = requirement.id ?? requirement;
+  const type = requirement.type ?? "PUBLICATION";
+  const status = requirement.requiredPublicationStatus ?? (type === "PUBLICATION" ? "published" : "ready");
+  return {
+    commandId: "record-terminal-result",
+    executable: "forgeloop",
+    subcommand: "record-terminal-result",
+    argv: ["record-terminal-result", `--requirement=${reqId}`, `--type=${type}`, `--status=${status}`],
+    requiredInputs: [
+      { name: "source", option: "--source=<text>" },
+      { name: "result", option: "--result=<text>" },
+      { name: "details", option: "--details=<json>", optional: true },
+    ],
+  };
+}
+
 function decision(input, action, reason, requiredArtifacts = [], missingArtifacts = []) {
   const command = commandFor(action);
   return result({
@@ -138,10 +159,6 @@ function missingArtifact(error, fallback) {
     : [];
 }
 
-function allCoverageCovered(coverage) {
-  return coverage.every((item) => item.status === "COVERED");
-}
-
 function staleReasons(state, contract, route) {
   const reasons = [];
   if (state.contractFingerprint !== contract.fingerprint) {
@@ -230,7 +247,11 @@ async function requirementsAndCoverage({ target, packageRoot, contract, route, c
   return { requirements, coverage: coverageForRequirements(requirements, checks) };
 }
 
-export async function getNextAction({ target, packageRoot } = {}) {
+export async function getNextAction(targetOrOptions = {}, packageRootOption) {
+  const normalized = typeof targetOrOptions === "string"
+    ? { target: targetOrOptions, packageRoot: packageRootOption }
+    : targetOrOptions;
+  const { target, packageRoot } = normalized ?? {};
   const workState = await loadArtifact(
     () => readWorkState(target, packageRoot),
     ARTIFACT_PATHS.state,
@@ -516,20 +537,32 @@ export async function getNextAction({ target, packageRoot } = {}) {
         requiredArtifacts,
       });
     }
-    const failed = state.checks.find((check) => check?.status === "failed");
+    const evidence = await requirementsAndCoverage({
+      target,
+      packageRoot,
+      contract,
+      route,
+      checks: state.checks,
+      additionalEvidence: preflight.policy?.requiredEvidence ?? [],
+    });
+    const authoritative = authoritativeChecksForRequirements({
+      requirements: ordinaryLeafRequirements(evidence.requirements),
+      checks: state.checks,
+    });
+    const failed = authoritative.find(({ check }) => check?.status === "failed");
     if (failed) {
       return decision(
         context,
         NEXT_ACTIONS.DIAGNOSE,
-        artifactError("E_CHECK_FAILED", `Observed check failed: ${failed.id}`, [ARTIFACT_PATHS.state]),
+        artifactError("E_CHECK_FAILED", `Observed check failed: ${failed.check.id}`, [ARTIFACT_PATHS.state]),
       );
     }
-    const blocked = state.checks.find((check) => check?.status === "blocked");
+    const blocked = authoritative.find(({ check }) => check?.status === "blocked");
     if (blocked) {
       return decision(
         context,
         NEXT_ACTIONS.RESOLVE_BLOCKER,
-        artifactError("E_CHECK_BLOCKED", `Observed check is blocked: ${blocked.id}`, [ARTIFACT_PATHS.state]),
+        artifactError("E_CHECK_BLOCKED", `Observed check is blocked: ${blocked.check.id}`, [ARTIFACT_PATHS.state]),
       );
     }
     const receipt = await loadArtifact(
@@ -563,14 +596,7 @@ export async function getNextAction({ target, packageRoot } = {}) {
         [...requiredArtifacts, ARTIFACT_PATHS.receipt],
       );
     }
-    const evidence = await requirementsAndCoverage({
-      target,
-      packageRoot,
-      contract,
-      route,
-      checks: state.checks,
-      additionalEvidence: preflight.policy?.requiredEvidence ?? [],
-    });
+    const readiness = evaluateRequiredEvidence({ requirements: evidence.requirements, checks: state.checks });
     const receiptRelationships = completionRelationshipErrors({
       contract,
       route,
@@ -587,18 +613,22 @@ export async function getNextAction({ target, packageRoot } = {}) {
         requiredArtifacts: [...requiredArtifacts, ARTIFACT_PATHS.receipt],
       });
     }
-    if (allCoverageCovered(evidence.coverage)) {
+    if (readiness.ready) {
       return decision(context, NEXT_ACTIONS.ENTER_REVIEWING, artifactError("EVIDENCE_COVERED", "All required observed verification evidence is covered"));
     }
-    const uncovered = evidence.coverage.filter((item) => item.status !== "COVERED");
+    const uncovered = [...readiness.invalid, ...readiness.partial, ...readiness.missing];
     return result({
       ...context,
       nextAction: NEXT_ACTIONS.RECORD_VERIFICATION,
       commands: ["forgeloop record-check"],
-      commandSpecs: uncovered.map((item) => recordCheckCommandSpec(item.requirement)),
+      commandSpecs: uncovered.map((item) => recordCheckCommandSpec(item.text)),
       reasons: uncovered
         .map((item) => artifactError(
-          "E_EVIDENCE_REQUIRED",
+          readiness.invalid.some((candidate) => candidate.id === item.id)
+            ? "E_EVIDENCE_INVALID"
+            : readiness.partial.some((candidate) => candidate.id === item.id)
+              ? "E_EVIDENCE_PARTIAL"
+              : "E_EVIDENCE_REQUIRED",
           "Run the required check and record observed evidence through the structured command specification.",
           [ARTIFACT_PATHS.state],
         )),
@@ -641,15 +671,41 @@ export async function getNextAction({ target, packageRoot } = {}) {
       checks: state.checks,
       additionalEvidence: preflight.policy?.requiredEvidence ?? [],
     });
-    if (!allCoverageCovered(evidence.coverage)) {
+    const readiness = evaluateRequiredEvidence({ requirements: evidence.requirements, checks: state.checks });
+    if (!readiness.ready) {
+      let recoveryAuthorized = false;
+      if (state.lastCompletionAttempt?.status === "REJECTED") {
+        try {
+          const ledger = await validateEventLedger(target, packageRoot);
+          let currentReceipt = null;
+          try {
+            const receiptArtifact = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
+            currentReceipt = receiptArtifact?.value;
+          } catch {}
+          const recoveryAuth = validateCompletionRecoveryAuthorization({
+            state,
+            receipt: currentReceipt,
+            events: ledger.events,
+          });
+          recoveryAuthorized = recoveryAuth.authorized;
+        } catch {
+          recoveryAuthorized = false;
+        }
+      }
       return result({
         ...context,
-        nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER,
-        reasons: evidence.coverage
-          .filter((item) => item.status !== "COVERED")
+        nextAction: recoveryAuthorized
+          ? NEXT_ACTIONS.ENTER_VERIFYING
+          : NEXT_ACTIONS.RESOLVE_BLOCKER,
+        commands: recoveryAuthorized
+          ? [commandFor(NEXT_ACTIONS.ENTER_VERIFYING)]
+          : [],
+        reasons: [...readiness.invalid, ...readiness.partial, ...readiness.missing]
           .map((item) => artifactError(
-            "E_EVIDENCE_COVERAGE_PARTIAL",
-            `Evidence coverage is ${item.status}: ${item.requirement}`,
+            readiness.missing.some((candidate) => candidate.id === item.id)
+              ? "E_EVIDENCE_REQUIRED"
+              : item.reasonCode ?? "E_EVIDENCE_PARTIAL",
+            `Evidence is not ready: ${item.text}`,
             [ARTIFACT_PATHS.state],
           )),
         requiredArtifacts,
@@ -707,6 +763,26 @@ export async function getNextAction({ target, packageRoot } = {}) {
     }
     const completion = await evaluateCompletion({ target, packageRoot });
     if (completion.status !== "VALID") {
+      const terminalPendingErrors = completion.errors.filter((err) => (
+        err.code === "E_PUBLICATION_REQUIREMENT_PENDING" || err.code === "E_PRODUCTION_REQUIREMENT_PENDING"
+      ));
+      if (terminalPendingErrors.length > 0 && terminalPendingErrors.length === completion.errors.length) {
+        const terminalPendingReqs = terminalPendingErrors.map((err) => {
+          const reqId = err.requirementId;
+          const matchingReq = evidence.requirements.find((r) => r.id === reqId)
+            ?? evidence.requirements.find((r) => r.text === reqId)
+            ?? classifyRequirement(reqId ?? err.message);
+          return matchingReq;
+        });
+        return result({
+          ...context,
+          nextAction: NEXT_ACTIONS.RECORD_TERMINAL_RESULT,
+          commands: ["forgeloop record-terminal-result"],
+          commandSpecs: terminalPendingReqs.map(recordTerminalResultCommandSpec),
+          reasons: completion.errors,
+          requiredArtifacts: [...requiredArtifacts, ARTIFACT_PATHS.receipt, ARTIFACT_PATHS.events],
+        });
+      }
       return result({
         ...context,
         nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER,

package/src/core/phase.js

@@ -1,6 +1,12 @@
 import { ARTIFACT_PATHS, canonicalFingerprint, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
 import { readContract } from "./contract.js";
-import { appendProtocolEvent, LIFECYCLE_MILESTONES, validateEventLedger } from "./events.js";
+import {
+  appendProtocolEvent,
+  LIFECYCLE_MILESTONES,
+  validateCompletionRecoveryAuthorization,
+  validateEventLedger,
+  validateStateLedgerCoherence,
+} from "./events.js";
 import { readPersistedRoute } from "./route-artifact.js";
 import { assertWorkPhase, isValidTransition } from "./protocol.js";
 import { readWorkState, writeWorkState } from "./work-state.js";
@@ -25,6 +31,7 @@ const PHASE_EVENTS = Object.freeze({
   PLANNED: "PLAN_RECORDED",
   EXECUTING: "EXECUTION_STARTED",
   VERIFYING: "VERIFICATION_STARTED",
+  REVIEWING: "REVIEW_STARTED",
   COMPLETE: "COMPLETION_VALIDATED",
 });
 
@@ -127,7 +134,9 @@ async function assertPhasePrerequisites(target, state, toPhase, packageRoot) {
   }
 }
 
-export async function advanceWorkState(target, toPhase, { packageRoot, now = new Date().toISOString() } = {}) {
+export async function advanceWorkState(target, toPhase, options = {}) {
+  const normalizedOptions = typeof options === "string" ? { packageRoot: options } : options;
+  const { packageRoot, now = new Date().toISOString() } = normalizedOptions;
   assertWorkPhase(toPhase);
   const state = await readWorkState(target, packageRoot);
   if (!state) throw phaseError("E_PHASE_PREREQUISITE_MISSING", "Cannot advance without work state", [ARTIFACT_PATHS.state]);
@@ -148,11 +157,50 @@ export async function advanceWorkState(target, toPhase, { packageRoot, now = new
       [ARTIFACT_PATHS.events, ARTIFACT_PATHS.state],
     );
   }
+  const coherenceErrors = validateStateLedgerCoherence(state, ledger.events);
+  if (coherenceErrors.length > 0) {
+    throw phaseError(coherenceErrors[0].code, coherenceErrors[0].message, [ARTIFACT_PATHS.state, ARTIFACT_PATHS.events]);
+  }
   const eventType = PHASE_EVENTS[toPhase];
-  if (eventType && ledger.events.some((event) => event.taskId === state.taskId && event.event === eventType)) {
+  const reenteringVerification = toPhase === "VERIFYING" && ["CORRECTING", "REVIEWING"].includes(state.phase);
+  if (toPhase === "VERIFYING" && state.phase === "REVIEWING") {
+    let currentReceipt = null;
+    try {
+      const receiptArtifact = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
+      currentReceipt = receiptArtifact?.value;
+    } catch {
+      // If receipt is not present, pass null
+    }
+    const recoveryAuth = validateCompletionRecoveryAuthorization({
+      state,
+      receipt: currentReceipt,
+      events: ledger.events,
+    });
+    if (!recoveryAuth.authorized) {
+      const firstError = recoveryAuth.errors[0] ?? {};
+      throw phaseError(
+        firstError.code ?? "E_COMPLETION_RECOVERY_UNAUTHORIZED",
+        firstError.message ?? "REVIEWING -> VERIFYING requires authorized completion recovery",
+        [ARTIFACT_PATHS.state, ARTIFACT_PATHS.events],
+      );
+    }
+  }
+  if (toPhase === "VERIFYING" && state.phase === "CORRECTING") {
+    if (typeof state.diagnosedHypothesis !== "string" || !state.diagnosedHypothesis.trim()) {
+      throw phaseError(
+        "E_PHASE_PREREQUISITE_MISSING",
+        "CORRECTING -> VERIFYING requires a diagnosed hypothesis",
+        [ARTIFACT_PATHS.state],
+      );
+    }
+  }
+  const repeatedReview = state.phase === "VERIFYING" && toPhase === "REVIEWING"
+    && ledger.events.some((event) => event.taskId === state.taskId && event.event === "REVIEW_STARTED");
+  if (eventType && !reenteringVerification && !repeatedReview
+    && ledger.events.some((event) => event.taskId === state.taskId && event.event === eventType)) {
     throw phaseError("E_PHASE_CHRONOLOGY_INVALID", `Lifecycle milestone already exists: ${eventType}`, [ARTIFACT_PATHS.events]);
   }
-  const milestoneIndex = LIFECYCLE_MILESTONES.indexOf(eventType);
+  const milestoneIndex = reenteringVerification || repeatedReview ? -1 : LIFECYCLE_MILESTONES.indexOf(eventType);
   if (milestoneIndex >= 0) {
     const lastMilestone = ledger.events.reduce((last, event) => Math.max(last, LIFECYCLE_MILESTONES.indexOf(event.event)), -1);
     if (lastMilestone !== milestoneIndex - 1) {
@@ -166,6 +214,10 @@ export async function advanceWorkState(target, toPhase, { packageRoot, now = new
     phase: toPhase,
     lastUpdated: now,
   };
+  if (toPhase === "VERIFYING") {
+    next.verificationCycle = reenteringVerification ? (state.verificationCycle ?? 1) + 1 : (state.verificationCycle ?? 1);
+  }
+  if (reenteringVerification) delete next.lastCompletionAttempt;
   let nextReceipt = null;
   try {
     const receipt = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
@@ -187,10 +239,12 @@ export async function advanceWorkState(target, toPhase, { packageRoot, now = new
       receipt: receipt.value,
       requiredEvidence,
       requireRequiredChecks: false,
+      requireReceiptStateFingerprint: false,
     });
     nextReceipt = await createReceipt({
       ...receipt.value,
       stateFingerprint: canonicalFingerprint(next),
+      verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
     }, packageRoot);
     assertCompletionRelationships({
       contract,
@@ -207,6 +261,15 @@ export async function advanceWorkState(target, toPhase, { packageRoot, now = new
   if (nextReceipt) {
     await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
   }
-  if (eventType) await appendProtocolEvent(target, { taskId: state.taskId, event: eventType, at: now }, packageRoot);
+  if (eventType) await appendProtocolEvent(target, {
+    taskId: state.taskId,
+    event: eventType,
+    at: now,
+    details: eventType === "VERIFICATION_STARTED"
+      ? { verificationCycle: next.verificationCycle }
+      : eventType === "REVIEW_STARTED"
+        ? { verificationCycle: next.verificationCycle ?? 1 }
+        : undefined,
+  }, packageRoot);
   return next;
 }

package/src/core/protocol.js

@@ -36,16 +36,35 @@ export const FAILURE_CODES = Object.freeze([
   "E_EVIDENCE_REQUIRED",
   "E_EVIDENCE_KIND_INVALID",
   "E_EVIDENCE_STALE",
+  "E_EVIDENCE_PARTIAL",
+  "E_EVIDENCE_INVALID",
+  "E_FUTURE_LIFECYCLE_EVIDENCE",
+  "E_CIRCULAR_COMPLETION_REQUIREMENT",
+  "E_MIXED_TERMINAL_REQUIREMENT",
   "E_EVIDENCE_COVERAGE_PARTIAL",
+  "E_EVIDENCE_COVERAGE_INVALID",
+  "E_CHECK_INVALID",
   "E_CHECK_STATUS_CONTRADICTION",
   "E_PROFILE_SOURCE_MISSING",
   "E_PROFILE_SOURCE_UNKNOWN",
   "E_PROFILE_SOURCE_MISCLASSIFIED",
+  "E_PROFILE_UNVERIFIED",
+  "E_RECEIPT_MISSING",
+  "E_RECEIPT_INVALID",
+  "E_RECEIPT_TASK_MISMATCH",
   "E_RECEIPT_ROUTE_MISMATCH",
   "E_RECEIPT_STATE_MISMATCH",
   "E_RECEIPT_CONTRACT_MISMATCH",
   "E_RECEIPT_PATH_MISMATCH",
+  "E_RECEIPT_CYCLE_MISMATCH",
   "E_COMPLETION_REJECTED",
+  "E_COMPLETION_RECOVERY_UNAUTHORIZED",
+  "E_COMPLETION_REJECTION_LEDGER_MISMATCH",
+  "E_COMPLETION_REJECTION_STATE_FINGERPRINT_MISMATCH",
+  "E_COMPLETION_REJECTION_RECEIPT_FINGERPRINT_MISMATCH",
+  "E_STATE_MISSING",
+  "E_STATE_TASK_MISMATCH",
+  "E_STATE_LEDGER_DIVERGENCE",
   "E_PUBLICATION_CLAIM_UNVERIFIED",
   "E_PRODUCTION_READINESS_UNVERIFIED",
   "E_STATE_MISSING_AFTER_PREFLIGHT_READY",
@@ -54,6 +73,14 @@ export const FAILURE_CODES = Object.freeze([
   "E_PREFLIGHT_EVENT_MISSING",
   "E_PREFLIGHT_GATE_EVENT_MISSING",
   "E_PREFLIGHT_GATES_STALE",
+  "E_TERMINAL_REQUIREMENT_PENDING",
+  "E_PUBLICATION_REQUIREMENT_PENDING",
+  "E_PRODUCTION_REQUIREMENT_PENDING",
+  "E_FUTURE_TERMINAL_EVIDENCE",
+  "E_TERMINAL_REQUIREMENT_UNKNOWN",
+  "E_TERMINAL_REQUIREMENT_NOT_TERMINAL",
+  "E_TERMINAL_REQUIREMENT_TYPE_MISMATCH",
+  "E_TERMINAL_STATUS_REGRESSION",
 ]);
 
 export const WORK_PHASES = Object.freeze([
@@ -97,7 +124,7 @@ export const WORK_TRANSITIONS = Object.freeze({
   VERIFYING: ["DIAGNOSING", "REVIEWING"],
   DIAGNOSING: ["CORRECTING"],
   CORRECTING: ["VERIFYING"],
-  REVIEWING: ["COMPLETE", "CORRECTING"],
+  REVIEWING: ["COMPLETE", "CORRECTING", "VERIFYING"],
   COMPLETE: [],
   BLOCKED: [],
 });

package/src/core/receipt.js

@@ -58,6 +58,10 @@ function assertKnownGuides(guides) {
 
 export function assertReceiptSemantics(receipt) {
   const evidence = receipt.evidence ?? [];
+  if (receipt.verificationCycle !== undefined
+    && (!Number.isInteger(receipt.verificationCycle) || receipt.verificationCycle < 1)) {
+    throw new Error("receipt.verificationCycle must be a positive integer");
+  }
   assertEvidenceList(evidence, "receipt.evidence");
 
   for (const [index, check] of receipt.checks.entries()) {
@@ -145,6 +149,7 @@ export async function createReceipt(input, packageRoot) {
     contractFingerprint: input.contractFingerprint,
     ...(input.routeFingerprint !== undefined ? { routeFingerprint: input.routeFingerprint } : {}),
     ...(input.stateFingerprint !== undefined ? { stateFingerprint: input.stateFingerprint } : {}),
+    ...(input.verificationCycle !== undefined ? { verificationCycle: input.verificationCycle } : {}),
     status: input.status ?? "in-progress",
     ...(input.taskStatus !== undefined ? { taskStatus: input.taskStatus } : {}),
     ...(input.verificationStatus !== undefined ? { verificationStatus: input.verificationStatus } : {}),

package/src/core/schema-validation.js

@@ -48,7 +48,29 @@ function display(value) {
   return typeof value === "string" ? JSON.stringify(value) : String(value);
 }
 
-function validate(value, schema, location, errors) {
+function resolveRef(ref, rootSchema) {
+  if (typeof ref !== "string" || !rootSchema) return null;
+  if (ref.startsWith("#/")) {
+    const parts = ref.slice(2).split("/");
+    let target = rootSchema;
+    for (const part of parts) {
+      target = target?.[part];
+    }
+    return target ?? null;
+  }
+  return null;
+}
+
+function validate(value, schema, location, errors, rootSchema = schema) {
+  if (!schema || typeof schema !== "object") return;
+  if (schema.$ref) {
+    const target = resolveRef(schema.$ref, rootSchema);
+    if (target) {
+      validate(value, target, location, errors, rootSchema);
+      return;
+    }
+  }
+
   if (schema.const !== undefined && value !== schema.const) {
     errors.push(`${location}: expected ${display(schema.const)}`);
     return;
@@ -62,7 +84,7 @@ function validate(value, schema, location, errors) {
   if (schema.oneOf) {
     const matches = schema.oneOf.filter((candidate) => {
       const candidateErrors = [];
-      validate(value, candidate, location, candidateErrors);
+      validate(value, candidate, location, candidateErrors, rootSchema);
       return candidateErrors.length === 0;
     });
     if (matches.length !== 1) errors.push(`${location}: expected exactly one matching schema`);
@@ -91,7 +113,7 @@ function validate(value, schema, location, errors) {
       errors.push(`${location}: must contain at most ${schema.maxItems} items`);
     }
     if (schema.items) {
-      value.forEach((item, index) => validate(item, schema.items, `${location}[${index}]`, errors));
+      value.forEach((item, index) => validate(item, schema.items, `${location}[${index}]`, errors, rootSchema));
     }
   }
 
@@ -105,7 +127,7 @@ function validate(value, schema, location, errors) {
     const properties = schema.properties ?? {};
     for (const [key, child] of Object.entries(properties)) {
       if (Object.prototype.hasOwnProperty.call(value, key)) {
-        validate(value[key], child, `${location}.${key}`, errors);
+        validate(value[key], child, `${location}.${key}`, errors, rootSchema);
       }
     }
 
@@ -118,7 +140,7 @@ function validate(value, schema, location, errors) {
     } else if (schema.additionalProperties && typeof schema.additionalProperties === "object") {
       for (const key of Object.keys(value)) {
         if (!Object.prototype.hasOwnProperty.call(properties, key)) {
-          validate(value[key], schema.additionalProperties, `${location}.${key}`, errors);
+          validate(value[key], schema.additionalProperties, `${location}.${key}`, errors, rootSchema);
         }
       }
     }
@@ -128,7 +150,7 @@ function validate(value, schema, location, errors) {
 export function validateSchema(value, schema, { label = "$" } = {}) {
   assertJsonLimits(value, label);
   const errors = [];
-  validate(value, schema, label, errors);
+  validate(value, schema, label, errors, schema);
   return errors;
 }
 

package/src/core/templates.js

@@ -32,6 +32,7 @@ export const TEMPLATE_PATHS = [
   "ORCHESTRATOR_INTEGRATION.md",
   "THREAT_MODEL.md",
   "CONTRACT_COVERAGE.md",
+  "PROTOCOL_INTEGRATION.md",
   "AGENT_COMPATIBILITY.md",
   "THIRD_PARTY_NOTICES.md",
   "LICENSE",

package/src/core/work-state.js

@@ -159,6 +159,31 @@ export function assertWorkStateSemantics(state) {
       throw new WorkStateError(`Invalid work-state transition: ${state.previousPhase} -> ${state.phase}`);
     }
   }
+  if (state.verificationCycle !== undefined && (!Number.isInteger(state.verificationCycle) || state.verificationCycle < 1)) {
+    throw new WorkStateError("verificationCycle must be a positive integer");
+  }
+  if (state.lastCompletionAttempt !== undefined) {
+    if (!state.lastCompletionAttempt || typeof state.lastCompletionAttempt !== "object" || Array.isArray(state.lastCompletionAttempt)) {
+      throw new WorkStateError("lastCompletionAttempt must be an object");
+    }
+    if (state.lastCompletionAttempt.status !== "REJECTED") {
+      throw new WorkStateError("lastCompletionAttempt.status must be REJECTED");
+    }
+    if (!Array.isArray(state.lastCompletionAttempt.reasonCodes)
+      || state.lastCompletionAttempt.reasonCodes.some((code) => typeof code !== "string" || !code.trim())) {
+      throw new WorkStateError("lastCompletionAttempt.reasonCodes must be an array of non-empty strings");
+    }
+    if (!Array.isArray(state.lastCompletionAttempt.missingRequirementIds)
+      || state.lastCompletionAttempt.missingRequirementIds.some((id) => typeof id !== "string" || !id.trim())) {
+      throw new WorkStateError("lastCompletionAttempt.missingRequirementIds must be an array of non-empty strings");
+    }
+    if (!Number.isInteger(state.lastCompletionAttempt.verificationCycle) || state.lastCompletionAttempt.verificationCycle < 1) {
+      throw new WorkStateError("lastCompletionAttempt.verificationCycle must be a positive integer");
+    }
+    if (typeof state.lastCompletionAttempt.timestamp !== "string" || !state.lastCompletionAttempt.timestamp.trim()) {
+      throw new WorkStateError("lastCompletionAttempt.timestamp must be a non-empty string");
+    }
+  }
   for (const failure of state.failures) {
     if (failure?.failureClass !== undefined) assertFailureClass(failure.failureClass);
   }
@@ -191,6 +216,8 @@ export function createWorkState(input) {
     verificationEvidence: [...(input.verificationEvidence ?? [])],
     lastUpdated: input.lastUpdated ?? new Date().toISOString(),
   };
+  if (input.verificationCycle !== undefined) state.verificationCycle = input.verificationCycle;
+  if (input.lastCompletionAttempt !== undefined) state.lastCompletionAttempt = structuredClone(input.lastCompletionAttempt);
   if (input.previousPhase !== undefined) state.previousPhase = input.previousPhase;
   if (input.diagnosedHypothesis !== undefined) state.diagnosedHypothesis = input.diagnosedHypothesis;
   return assertWorkStateSemantics(state);