@cassiomc1/forgeloop 0.1.12 → 0.1.14

package/.cursor/rules/project-loop.mdc

@@ -16,7 +16,7 @@ Do not treat ForgeLoop as vendor-specific, optional, or to follow only "in spiri
 4. Respect higher-level and local instructions and the latest request.
 5. Make the minimum change, run specific checks, and run proportional regression checks.
 6. Diagnose failures before fixing them; do not repeat attempts without new evidence.
-7. Request authority for unrelated actions, installations, and publications. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
+7. Request authority for unrelated actions, installations, and publications. Do not install a missing verification tool merely to satisfy a check. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
 8. After implementation begins, do not return a final result in `EXECUTING`: advance through `VERIFYING` → structured evidence → `REVIEWING` → execution receipt → validator-backed `COMPLETE`. If closure cannot be reached, report `BLOCKED` or `PARTIALLY VERIFIED`.
 
 After implementation work for the current task is complete, run `forgeloop next` before returning a final result. Follow the returned lifecycle action until ForgeLoop reaches a terminal state or an explicit blocker.

package/.github/copilot-instructions.md

@@ -13,7 +13,7 @@ Use these instructions across the repository while preserving local rules.
 - Respect the latest request, scope, and higher-level instructions.
 - Make the smallest coherent change; validate with specific and regression checks.
 - Diagnose causes before fixing failures; do not make unverified attempts.
-- Do not install software, publish, delete, or alter external state without authority. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
+- Do not install software, publish, delete, or alter external state without authority. Do not install a missing verification tool merely to satisfy a check. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
 - After implementation begins, do not return a final result in `EXECUTING`: advance through `VERIFYING` → structured evidence → `REVIEWING` → execution receipt → validator-backed `COMPLETE`. If closure cannot be reached, report `BLOCKED` or `PARTIALLY VERIFIED`.
 
 After implementation work for the current task is complete, run `forgeloop next` before returning a final result. Follow the returned lifecycle action until ForgeLoop reaches a terminal state or an explicit blocker.

package/AGENTS.md

@@ -11,7 +11,7 @@ Do not treat ForgeLoop as vendor-specific, optional, or to follow only "in spiri
 1. Use [`GUIDE_ROUTER.md`](./GUIDE_ROUTER.md) to select relevant guides and report activated guide IDs.
 1. Make the smallest coherent change, run specific checks, and proportional regression checks.
 1. Diagnose failures before fixing; do not repeat attempts without new evidence.
-1. Do not install software, publish, delete, or migrate data without authority. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
+1. Do not install software, publish, delete, or migrate data without authority. Do not install a missing verification tool merely to satisfy a check. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
 1. Before implementation, create/validate `.forgeloop/current-contract.json`, persist routing, satisfy gates, and require `forgeloop preflight` to return `READY`.
 1. Before claiming `COMPLETE`, require `forgeloop complete` to return `VALID`; otherwise report completion as not protocol-verified.
 1. After implementation begins, do not return a final result in `EXECUTING`: advance through `VERIFYING` → structured evidence → `REVIEWING` → execution receipt → validator-backed `COMPLETE`. If closure cannot be reached, report `BLOCKED` or `PARTIALLY VERIFIED`.

package/CLAUDE.md

@@ -13,7 +13,7 @@ When working in this repository:
 1. Consult [`GUIDE_ROUTER.md`](./GUIDE_ROUTER.md), select relevant guides, and announce their IDs.
 1. Make small changes, run specific checks, and run proportional regression checks.
 1. Investigate root causes before fixing failures; do not make unverified attempts.
-1. Request authority for unrelated installations, publications, deletions, or migrations. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
+1. Request authority for unrelated installations, publications, deletions, or migrations. Do not install a missing verification tool merely to satisfy a check. For missing Qwen-MM-Plugins, follow `LOOP_ENGINEERING.md`.
 1. After implementation begins, do not return a final result in `EXECUTING`: advance through `VERIFYING` → structured evidence → `REVIEWING` → execution receipt → validator-backed `COMPLETE`. If closure cannot be reached, report `BLOCKED` or `PARTIALLY VERIFIED`.
 1. After implementation work for the current task is complete, run `forgeloop next` before returning a final result. Follow the returned lifecycle action until ForgeLoop reaches a terminal state or an explicit blocker.
 1. Report current evidence, limitations, and publication state without claiming checks that were not run.

package/LOOP_ENGINEERING.md

@@ -68,6 +68,79 @@ If the required CLI/API capability cannot be resolved:
 Report the corresponding ForgeLoop dimension as `NOT_VERIFIED` with
 `E_FORGELOOP_CLI_UNAVAILABLE`.
 
+### Missing verification tool policy
+
+A missing verification tool does not grant authority to install it.
+
+When a verification command or checker is unavailable:
+
+1. Try only already-installed or explicitly non-installing resolution paths.
+2. Prefer an already available equivalent when it can verify the same requirement.
+3. If no suitable local capability exists, request explicit installation authority
+   only when the missing verification is genuinely required.
+4. If authority is unavailable or the check is non-critical, record the affected
+   verification dimension as `NOT_VERIFIED` with `E_VERIFICATION_TOOL_UNAVAILABLE`.
+
+Do not retry a failed non-installing lookup with a command that implicitly
+downloads or installs the missing package.
+
+Examples of forbidden escalation without authority:
+
+```text
+npx --no-install TOOL → missing
+npx TOOL              → implicit install
+```
+
+```text
+command -v TOOL → missing
+package-manager install TOOL
+```
+
+```text
+local executable missing
+curl | sh
+```
+
+Automatic installation is allowed only when an explicit ForgeLoop rule grants
+that exact task-scoped installation authority and higher-priority platform/user
+rules permit it.
+
+A missing checker must never be converted into environmental mutation merely
+to make verification pass.
+
+### Verification command resolution modes and validator enforcement
+
+Every verification command path is classified by resolution mode:
+
+| Mode | Examples | May install software | Authority required |
+| --- | --- | --- | --- |
+| `LOCAL_EXECUTABLE` | `node scripts/test.js`, `python3 -m unittest`, `./bin/check` | No | No |
+| `LOCAL_PACKAGE_BINARY` | `./node_modules/.bin/tool`, `npm test`, `pnpm test`, `yarn test` | No | No |
+| `NON_INSTALLING_RESOLUTION` | `npx --no-install tool`, `npx --no tool` | No | No |
+| `INSTALL_CAPABLE_RESOLUTION` | `npx tool`, `pnpm dlx tool`, `yarn dlx tool`, `bunx tool`, `uvx tool`, `pipx run tool` | Yes | Yes (`E_INSTALLATION_AUTHORITY_REQUIRED`) |
+| `EXPLICIT_INSTALLATION` | `npm install tool`, `pnpm add tool`, `pip install tool`, `cargo install tool` | Yes | Yes (`E_INSTALLATION_AUTHORITY_REQUIRED`) |
+
+**Validator-enforced rule**: Any verification command executed via an installation-capable or explicit-installation resolution mode without a valid canonical installation authority grant is rejected by `record-check`, `audit`, and `complete` with error code `E_INSTALLATION_AUTHORITY_REQUIRED`, `E_AUTHORITY_INVALID`, `E_AUTHORITY_SCOPE_MISMATCH`, or `E_AUTHORITY_UNTRUSTED_SOURCE` and cannot contribute to `VALID` completion.
+
+Authority cannot be self-issued by the actor consuming it. Boolean fields inside verification evidence (such as `installationAuthorized: true`) are not sufficient proof of installation authority. Installation authority must be established via a canonical authority grant supplied by a host/operator trust boundary and referenced via `installationAuthorityRef`.
+
+The runtime authority context has two modes:
+
+- `NONE` is the default for the actor-facing standalone CLI. `FORGELOOP_AUTHORITY_FILE` and `FORGELOOP_AUTHORITY_DIR` may select candidate source metadata for compatibility and diagnostics, but they do not make a source trusted. An environment-selected source is rejected with `E_AUTHORITY_UNTRUSTED_SOURCE` when it is used for an installation-capable verification.
+- `HOST_ATTESTED` is an internal integration context supplied by a host-owned wrapper, embedded API, or equivalent boundary. It may select a trusted authority file, directory, or in-memory provider only when the actor cannot replace that context at command invocation time. The CLI exposes no flag that promotes a source to `HOST_ATTESTED`.
+
+External path is not equivalent to external authority ownership. The host-attested source must still resolve outside the actor-writable target, and a project-local `.forgeloop/authorities/` artifact remains an untrusted reference, cache, diagnostic, or mirror by default. A local claim such as `source: operator` is not proof of operator authority.
+
+ForgeLoop validates authority semantics, while the host defines the trust boundary. If the host grants the actor write access to the configured attested source, the host boundary is compromised and ForgeLoop cannot distinguish operator authority from actor fabrication without a stronger external trust anchor.
+
+### Stale receipt recovery invariant
+
+Every recovery action returned by `forgeloop next` must be executable from the state that produced it. When work state changes legitimately after preparing a completion receipt, `forgeloop prepare-completion` refreshes the receipt and re-binds it to current state and changed paths without requiring manual deletion of `.forgeloop/execution-receipt.json`.
+
+### Conformance profile escalation policy
+
+A run started in Standard conformance must not be silently escalated to Strict after validator-backed completion. Strict validation is a separate conformance profile. If Strict revalidation is performed after Standard `COMPLETE`, it is treated as a distinct revalidation cycle and does not retroactively invalidate a valid Standard result.
+
 ## Blocking vs Non-Blocking Decisions
 
 Classify every unresolved decision before deciding whether to ask the user.

package/LOOP_SYSTEM_DESIGN.md

@@ -10,11 +10,13 @@ The system should use every guide that materially helps the task without loading
 
 ## Primary decisions
 
-- The package supports Codex, Claude Code, Cursor, GitHub Copilot, Antigravity,
-  OpenCode, Hermes, Pi, Command Code, and Freebuff.
-- Codex, Claude Code, Cursor, and GitHub Copilot use native entry files; the
-  other six agents consume the shared `AGENTS.md` entry point.
-- The portable instruction layer uses Markdown and each agent's native instruction mechanism; the optional local Node CLI validates and installs the kit without an agent runtime or third-party dependency.
+- The protocol is vendor-neutral, project-scoped, and capability-based,
+  supporting any AI agent, coding assistant, IDE runtime, or developer workflow.
+- Common discovery surfaces (e.g. `AGENTS.md`, `CLAUDE.md`, `.cursor/rules/`,
+  `.github/copilot-instructions.md`) use project-local shims delegating to the
+  canonical protocol under `.forgeloop/kit/`, while other environments use the
+  shared `AGENTS.md` entry point or manual bootstrap.
+- The portable instruction layer uses Markdown and each environment's native instruction mechanism; the optional local Node CLI validates and installs the kit without an agent runtime or third-party dependency.
 - English is the only language used by repository content and guide metadata.
 - The agent uses all applicable guides, not every file indiscriminately.
 - Design, planning, test-first, and review process gates live in the canonical loop and scale with task risk instead of becoming unconditional boilerplate in every adapter or architecture note.
@@ -389,8 +391,8 @@ update practice.
 ## Acceptance criteria
 
 - The repository and its maintained content are English-only.
-- All ten supported agents have a documented entry into one canonical loop,
-  with native adapters distinguished from shared `AGENTS.md` compatibility.
+- Common project instruction surfaces and generic bootstrap mechanisms have a
+  documented entry into one canonical loop.
 - The router selects every relevant guide and excludes irrelevant guides in the six defined scenarios.
 - The profile contains verifiable facts, sources, and real commands without secrets.
 - The loop requires evidence before completion claims and exits safely when blocked.

package/PROTOCOL_INTEGRATION.md

@@ -140,6 +140,92 @@ If the required CLI or API capability cannot be resolved:
 
 Report the corresponding ForgeLoop dimension as `NOT_VERIFIED` / `E_FORGELOOP_CLI_UNAVAILABLE`.
 
+## Missing tool capability
+
+A missing tool is a capability gap, not installation authority.
+
+If an expected verifier, browser tool, linter, analyzer, or test dependency is
+not already available:
+
+- use a suitable existing local equivalent when possible;
+- otherwise request authority if installation is necessary and allowed;
+- otherwise report the affected verification dimension as not verified with
+  `E_VERIFICATION_TOOL_UNAVAILABLE`.
+
+Every verification command is classified by resolution mode (`LOCAL_EXECUTABLE`,
+`LOCAL_PACKAGE_BINARY`, `NON_INSTALLING_RESOLUTION`, `INSTALL_CAPABLE_RESOLUTION`,
+`EXPLICIT_INSTALLATION`). Any command that uses an install-capable or installation
+path without a valid canonical authority reference is rejected by `record-check`,
+`audit`, and `complete` with `E_INSTALLATION_AUTHORITY_REQUIRED`, `E_AUTHORITY_INVALID`,
+`E_AUTHORITY_SCOPE_MISMATCH`, or `E_AUTHORITY_UNTRUSTED_SOURCE`.
+
+```text
+capability ≠ authority
+evidence ≠ authority grant
+actor claim ≠ operator grant
+```
+
+Authority cannot be self-issued by the actor consuming it. Boolean fields inside
+verification evidence are not sufficient proof of installation authority.
+
+### Authority provenance
+
+Authority provenance is external to actor-authored project state. An external
+path is not equivalent to external authority ownership:
+
+```text
+outside target
+≠
+outside actor control
+```
+
+The standalone CLI uses `trustMode: NONE`. `FORGELOOP_AUTHORITY_FILE` and
+`FORGELOOP_AUTHORITY_DIR` select candidate authority sources, but they do not
+make a source trusted in actor-facing execution. Environment-selected sources
+are rejected with `E_AUTHORITY_UNTRUSTED_SOURCE` for install-capable checks.
+
+Trusted authority requires an explicit `HOST_ATTESTED` runtime context supplied
+through an integration boundary the active actor cannot replace at command
+invocation time. Configuration is not trust:
+
+```text
+environment-selected source
+≠
+host-attested source
+
+configuration
+≠
+trust
+```
+
+The host-attested source must still resolve outside the actor-writable target. A
+project-local authority reference may identify a grant, but it does not create
+the root of trust.
+
+```text
+actor-authored evidence
+≠
+trusted authority
+
+project-local file
+≠
+host grant
+
+declared provenance
+≠
+verified provenance
+```
+
+A local artifact claiming `source: operator` is not sufficient proof of operator
+authority. The actor-facing CLI must not expose an equivalent of
+`--authority-source-attested-by-host` or `--trusted-authority-file` that
+self-promotes a source. If the host exposes the attested source as writable to
+the actor, the host boundary has been compromised and ForgeLoop cannot provide
+cryptographic attestation by itself.
+
+Never convert `PROTOCOL_LIMITED` into environmental mutation by implicitly
+installing a package.
+
 ## Optional capability extensions
 
 The installed loop directs the active actor to inspect native model and harness
@@ -150,6 +236,19 @@ through native mechanisms or upstream installers, then verify it before use.
 API credentials, system packages, and unrelated environment changes remain
 separately gated.
 
+## Delegation scope
+
+Delegation is optional.
+
+A run that contains no delegation events, no delegated task references, and no
+delegation artifacts is a valid single-actor run.
+
+Missing delegation artifacts must not make such a run incomplete. For a purely
+local single-actor lifecycle, the delegation dimension is `NOT_APPLICABLE`.
+
+Once delegation is observed in canonical state, receipt, or event history, the
+required delegation artifacts become mandatory.
+
 ## Instruction precedence
 
 When multiple instruction layers exist, follow standard precedence:

package/README.md

@@ -1,26 +1,18 @@
-# ForgeLoop — Instruction Guides for AI Agents
+# ForgeLoop — Verifiable Engineering Protocol
 
 [![Docs quality](https://github.com/cassiomc1/forgeloop/actions/workflows/docs-quality.yml/badge.svg?branch=main)](https://github.com/cassiomc1/forgeloop/actions/workflows/docs-quality.yml)
 
-An English-only collection of operational guides for AI agents and developers.
-It covers product strategy, code, testing, security, performance,
-accessibility, design, and web games across web, mobile, and desktop projects.
+ForgeLoop is a portable, verifiable engineering protocol for AI-assisted development and developer workflows.
 
-The files are Markdown and can be used as references, as a foundation for
-`AGENTS.md`, `CLAUDE.md`, `.cursor/rules`, and
-`.github/copilot-instructions.md`. The integration contract and capability levels are documented
-in [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md). Adopt only the guides
-relevant to the target project.
+It is project-scoped, capability-based, and vendor-neutral. It turns intent into contract-driven execution with deterministic routing, resumable state, evidence-backed verification, recovery, and validator-backed completion.
 
-ForgeLoop is a portable, verifiable engineering protocol for AI coding environments
-and developer workflows. It turns intent into contract-driven execution with
-deterministic routing, resumable state, evidence-backed verification, recovery, and
-validator-backed completion.
+ForgeLoop does not depend on a specific model, provider, agent product, IDE, or orchestration runtime.
 
-The npm package also ships the local `forgeloop` CLI. In a target project it
-installs canonical documents under `.forgeloop/kit/`, keeps only small native
-discovery shims at the root, and stores mutable protocol artifacts under
-`.forgeloop/`.
+The repository also provides an English-only collection of operational engineering guides covering product strategy, clean code, testing, security, performance, accessibility, visual design, and web games across web, mobile, and desktop projects.
+
+Project-local discovery surfaces (`AGENTS.md`, `CLAUDE.md`, `.cursor/rules/project-loop.mdc`, `.github/copilot-instructions.md`) and manual bootstrap paths delegate to the same canonical protocol in `.forgeloop/kit/`. The capability levels and integration contract are documented in [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md). Adopt only the guides relevant to the target project.
+
+The npm package also ships the local `forgeloop` CLI. In a target project it installs canonical documents under `.forgeloop/kit/`, keeps only small native discovery shims at the root, and stores mutable protocol artifacts under `.forgeloop/`.
 
 ## Catalog
 
@@ -88,13 +80,13 @@ Request → discovery → profile → routing → plan → execution
               └ evidence-only rejection / next cycle
 ```
 
-ForgeLoop is project-scoped, capability-based, and vendor-neutral. Thin
-native adapters support common discovery surfaces including Codex, Claude Code,
-Cursor, and GitHub Copilot, while Antigravity, OpenCode, Hermes, Pi, Command Code,
-Freebuff, custom agents, and developer workflows discover the shared `AGENTS.md`
-entry point or manual bootstrap. All environments delegate to the same canonical
-protocol; see [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md) for
-capability levels, degradation rules, and precedence notes.
+ForgeLoop is project-scoped, capability-based, and vendor-neutral.
+
+Project-local discovery surfaces delegate to the same canonical ForgeLoop protocol. Execution environments that automatically discover one of those instruction surfaces can use it directly, while custom runtimes, automation systems, and developer workflows can use the manual bootstrap path.
+
+Capabilities determine execution. Runtime names do not determine protocol applicability.
+
+See [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md) for discovery, capability levels, degradation rules, and precedence.
 
 ### Migration recovery and release freeze
 
@@ -117,12 +109,12 @@ The regression suite injects failures at these boundaries and verifies that
 owned cleanup. The frozen published installation under
 [`tests/fixtures/legacy-0.1.6/`](./tests/fixtures/legacy-0.1.6/) is derived
 from the real npm tarball, includes provenance and digests, and is copied into
-The current published release is `@cassiomc1/forgeloop@0.1.11`.
-Earlier `0.1.8`, `0.1.9`, and `0.1.10` references are historical; never move
-their tags or `v0.1.10`. Version `0.1.11` adds canonical evidence readiness,
-requirement-specific terminal result recording, legal repeated verification
-cycles, future-result and compound-evidence safeguards, and lifecycle-ledger
-divergence detection.
+The latest verified published npm release is `@cassiomc1/forgeloop@0.1.14`.
+The repository release is `0.1.14`.
+Earlier `0.1.8`, `0.1.9`, `0.1.10`, `0.1.11`, `0.1.12`, and `0.1.13` references are historical; never move
+their tags or `v0.1.10`. Release `0.1.14` enforces verification installation
+authority, provides recoverable stale receipt lifecycle in `prepare-completion`,
+and validates single-actor protocol runs.
 
 ## How to prompt ForgeLoop
 
@@ -212,12 +204,13 @@ project without overwriting local instructions. When the package is available
 in the npm registry, use the commands below; otherwise use the repository
 checkout fallback.
 
-The current published release is `@cassiomc1/forgeloop@0.1.11`.
-Pin this version when a reproducible blind run or release-identity check is
-required:
+The current repository package is `@cassiomc1/forgeloop@0.1.14`.
+The latest verified published npm release is `@cassiomc1/forgeloop@0.1.14`.
+For reproducible published-package runs or release-identity checks,
+pin the published version:
 
 ```bash
-npx @cassiomc1/forgeloop@0.1.11 --version
+npx @cassiomc1/forgeloop@0.1.14 --version
 npx @cassiomc1/forgeloop init
 npx @cassiomc1/forgeloop doctor
 npx @cassiomc1/forgeloop update
@@ -314,11 +307,13 @@ cross-artifact relationships plus the same derived freshness classification
 used by `inspect` and `status`. Supply `--contract-file` to compare the saved
 contract fingerprint with the current contract; omitting it leaves contract
 freshness as `NOT_VERIFIED` and a complete artifact set requires revalidation.
-When delegation is in scope, also supply the matching repeated
-`--task-brief <path>` and `--delegated-result <path>` inputs. Without those
-inputs it reports `INCOMPLETE` with
-`task briefs and delegated results were not supplied`; that classification is
-separate from a local `complete --json` result of `VALID`.
+Delegation artifacts are required only when delegation is present in the
+canonical execution history or explicitly supplied as part of a delegated run.
+For a purely local single-actor lifecycle, the delegation dimension is
+`NOT_APPLICABLE` and does not require task briefs or delegated results. When
+delegation is in scope, also supply the matching repeated
+`--task-brief <path>` and `--delegated-result <path>` inputs; omitting them in a
+delegated run reports `INCOMPLETE`.
 It returns `VALID`, `INCOMPLETE`, `STALE`, `INCONSISTENT`, or `INVALID` with
 exact invariant codes and derived stale reasons. The persisted
 `.forgeloop/work-state.json` schema is unchanged: `status`, `stale`, and `fresh`
@@ -379,12 +374,17 @@ target project. Its main threat boundaries are:
 | Data exposure | Receipts and checkpoints reject secret-like keys and values; examples use placeholders, and the repository secret scanner runs in CI. |
 | Unsafe update overwrite | `update` preserves locally modified files and the target's `.forgeloop/kit/PROJECT_PROFILE.md`; adoption and writes remain bounded to the selected target. |
 | Dependency supply chain | Runtime code uses Node built-ins only; the package does not install agents, providers, plugins, or remote services. |
+| Installation authority provenance | Standalone CLI uses `trustMode: NONE`: environment-selected `FORGELOOP_AUTHORITY_FILE`/`FORGELOOP_AUTHORITY_DIR` sources are untrusted candidates; only an internal `HOST_ATTESTED` context may select a trusted source outside the actor-writable target. Project-local authority claims remain untrusted. |
 | Stale replay | Work state records contract and repository fingerprints; drift requires revalidation and never reruns destructive or publication actions automatically. |
 | Unverified publication | Receipts carry explicit publication booleans; local success never implies a push, pull request, merge, release, or deployment. |
 
 The full boundary inventory, residual limitations, and executable evidence are
 in [`THREAT_MODEL.md`](./THREAT_MODEL.md).
 
+An external path is not equivalent to external authority ownership. Actor-controlled
+environment configuration is not sufficient proof of host/operator authority;
+trusted authority requires a host-attested integration boundary.
+
 The CLI cannot protect a target from a separately privileged or hostile process
 that changes the filesystem after validation. Consumers must still review
 permissions, package provenance, and external actions before granting authority.
@@ -575,8 +575,8 @@ installed automatically.
 
 ## Optional multimodal capabilities
 
-[Qwen-MM-Plugins](https://github.com/QwenLM/Qwen-MM-Plugins) can extend a
-supported agent harness with skills and optional MCP servers. Before using a
+[Qwen-MM-Plugins](https://github.com/QwenLM/Qwen-MM-Plugins) can extend an
+execution environment with skills and optional MCP servers. Before using a
 multimodal or media operation, the agent checks the model and harness for a
 callable native capability. If the task requires a missing keyless capability,
 the agent installs only the smallest matching `qwen-mm-plugins-<cap>` capability

package/THREAT_MODEL.md

@@ -33,6 +33,12 @@ remaining trust boundaries and their executable evidence.
 | Runtime self-exemption | An execution environment discovers ForgeLoop but decides that the protocol does not apply because the environment is not named in documentation | Project adapter discovery and runtime interpretation | Universal applicability marker, capability-based integration, explicit unknown-runtime rule, no finite eligibility allowlist | A non-compliant runtime can ignore project instructions entirely | `tests/discovery-surfaces.test.js`, `tests/test_workflow_policy.py` |
 | Blind oracle exposure | The system under test reads expected route/gate/evidence answers from the installed package and contaminates a blind conformance run | Published npm package and agent-readable target workspace | Exclude conformance oracles from npm package, tarball leak scan in `pack:check`, external harness-owned oracle | A misconfigured external harness may still copy oracle material into target | `tests/package.test.js`, `conformance/README.md` |
 | Lifecycle simulation after CLI resolution failure | A runtime manually writes protocol-owned JSON and falsely claims conformance when the CLI is unresolved | Lifecycle-owned protocol state and CLI availability | CLI-owned artifact policy, universal adapter prohibition, validator-backed completion, append-only ledger hash chain | A privileged local process can tamper with local files; ForgeLoop detects consistency, not remote attestation | `tests/discovery-surfaces.test.js`, `tests/lifecycle.test.js`, `LOOP_ENGINEERING.md` |
+| Unauthorized verification dependency installation | The active actor mutates the environment by downloading or installing a missing checker merely to satisfy verification | Verification capability discovery and installation authority | Missing verification tool policy, non-installing resolution first, explicit installation authority, equivalent-check fallback, NOT_VERIFIED degradation | A privileged external process may still install tools outside ForgeLoop's control | `tests/verification-capability.test.js`, `tests/discovery-surfaces.test.js`, `LOOP_ENGINEERING.md` |
+| False delegation requirement | A valid single-actor run is incorrectly reported as incomplete because a validator demands artifacts for delegation that never occurred | Validator delegation scope resolution | Canonical delegationIsInScope predicate, conditional delegation validation in validateTaskArtifactSet and validate-protocol | Malformed or externally injected artifacts may require INCONSISTENT classification | `tests/conformance.test.js`, `tests/validate-protocol-cli.test.js` |
+| Self-asserted authority bypass | The active actor supplies `installationAuthorized=true` inside its own verification evidence and thereby grants itself authority | Authority provenance and verification evidence | Boolean claims are ignored; scoped authority references, task/type/tool validation, and validator revalidation in `record-check`/`audit`/`complete` require a trusted source | A host-controlled source is still a semantic trust boundary and is not cryptographic attestation | `tests/verification-capability.test.js`, `tests/authority.test.js`, `tests/stale-receipt-recovery.test.js` |
+| Forged local authority artifact | The active actor creates `.forgeloop/authorities/auth-modlens.json`, claims `source=operator`, and uses the reference to authorize its own installation-capable check | Host/operator authority source versus actor-writable project state | Resolve grants only from an explicit `HOST_ATTESTED` runtime context with an external source outside the target; reject project-local grants with `E_AUTHORITY_UNTRUSTED_SOURCE`; revalidate in `record-check`/`audit`/`complete` | If the host exposes the attested source as writable to the actor, ForgeLoop cannot distinguish genuine grants from actor fabrication without a stronger trust anchor | Local fake rejection, host-attested external acceptance, inside-target rejection, post-record removal and revocation tests |
+| Environment-injected trust root | The active actor creates an authority file outside the project target and sets `FORGELOOP_AUTHORITY_FILE` or `FORGELOOP_AUTHORITY_DIR` when invoking ForgeLoop | Actor-controlled process environment versus host-attested runtime authority | Standalone CLI uses `trustMode: NONE`; environment-selected sources are metadata/candidates only and fail with `E_AUTHORITY_UNTRUSTED_SOURCE`; trusted authority requires an internal `HOST_ATTESTED` context not exposed as a self-assertable CLI option | If the host integration allows the actor to mutate or replace the attested source/context, the host trust boundary is compromised | Environment-injection rejection, standalone audit/complete rejection, host-attested positive path |
+| Stale receipt recovery dead-end | Work state changes after preparing a receipt, leaving a mismatch that cannot be refreshed because the old receipt is rejected during re-preparation | Preparation lifecycle and recovery action resolution | Recoverable stale receipt binding in `prepareCompletion`, executable `PREPARE_COMPLETION` return from `next`, atomic refresh of stateFingerprint and changedPaths | Manual file corruption outside CLI commands requires manual diagnostic recovery | `tests/stale-receipt-recovery.test.js`, `tests/next-executability.test.js` |
 
 ## Boundary rules
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Portable, verifiable engineering protocol for AI coding environments and developer workflows",
   "repository": {
     "type": "git",

package/schemas/authority.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/authority.schema.json",
+  "title": "ForgeLoop installation authority grant",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "protocolVersion",
+    "authorityId",
+    "taskId",
+    "type",
+    "status",
+    "scope",
+    "source"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "authorityId": { "type": "string", "minLength": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "type": { "enum": ["SOFTWARE_INSTALLATION"] },
+    "status": { "enum": ["AUTHORIZED", "REVOKED", "EXPIRED"] },
+    "scope": {
+      "type": "object",
+      "required": ["tool"],
+      "properties": {
+        "tool": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
+    },
+    "source": { "enum": ["operator", "host", "project-policy"] }
+  },
+  "additionalProperties": false
+}

package/src/commands/inspect.js

@@ -8,6 +8,8 @@ export function formatInspectResult(report) {
     `Manifest: ${report.manifest.status}`,
     `Profile: ${report.profile.mode ?? "unknown"}/${report.profile.status ?? "unknown"}`,
     `Protocol: v${report.protocol.version}`,
+    `Authority source: ${report.authority.sourceType ?? "none configured"} / ${report.authority.trusted ? "TRUSTED" : report.authority.trustMode === "NONE" ? "UNATTESTED" : "UNTRUSTED"}`,
+    `Authority trust: ${report.authority.trustMode}`,
     `State: ${report.state.status}`,
     `Adapters: ${report.adapters.detected.length} detected`,
     `Findings: ${report.findings.length}`,

package/src/commands/prepare-completion.js

@@ -2,8 +2,8 @@ import { prepareCompletion as prepareCompletionArtifacts } from "../core/complet
 
 export { prepareCompletionArtifacts as prepareCompletion };
 
-export async function runPrepareCompletion({ target, packageRoot }) {
-  return prepareCompletionArtifacts({ target, packageRoot });
+export async function runPrepareCompletion({ target, packageRoot, authorityContext, runtimeContext }) {
+  return prepareCompletionArtifacts({ target, packageRoot, authorityContext, runtimeContext });
 }
 
 export function formatPrepareCompletionResult(result) {

package/src/commands/validate-protocol.js

@@ -97,14 +97,6 @@ export async function runValidateProtocol({
   const stateClassification = state && readErrors.length === 0 && !stateValidationError
     ? await classifyLoadedWorkState({ target, state, contractFile })
     : null;
-  const result = validateTaskArtifactSet({
-    route,
-    state,
-    stateClassification,
-    receipt,
-    taskBriefs,
-    delegatedResults,
-  });
   let readyConsistencyErrors = [];
   try {
     const persistedPreflight = await readJsonArtifact(target, ARTIFACT_PATHS.preflight, "preflight", packageRoot);
@@ -119,9 +111,11 @@ export async function runValidateProtocol({
   } catch {
     // A missing or invalid preflight is already outside the optional protocol set.
   }
+  let ledgerEvents = [];
   let ledgerErrors = [];
   if (state && !stateValidationError) {
     const ledger = await validateEventLedger(target, packageRoot);
+    ledgerEvents = ledger.events ?? [];
     ledgerErrors = [
       ...ledger.errors.map((error) => ({ ...error, artifacts: [ARTIFACT_PATHS.events] })),
       ...validateStateLedgerCoherence(state, ledger.events).map((error) => ({
@@ -130,6 +124,15 @@ export async function runValidateProtocol({
       })),
     ];
   }
+  const result = validateTaskArtifactSet({
+    route,
+    state,
+    stateClassification,
+    receipt,
+    taskBriefs,
+    delegatedResults,
+    events: ledgerEvents,
+  });
   if (readErrors.length > 0 || schemaErrors.length > 0 || readyConsistencyErrors.length > 0 || ledgerErrors.length > 0) {
     return {
       ...result,

package/src/core/audit.js

@@ -34,8 +34,8 @@ async function compareChangedPaths(target, packageRoot) {
   };
 }
 
-export async function evaluateAudit({ target, packageRoot, strict = false } = {}) {
-  const completion = await evaluateCompletion({ target, packageRoot, strict });
+export async function evaluateAudit({ target, packageRoot, strict = false, authorityContext, runtimeContext } = {}) {
+  const completion = await evaluateCompletion({ target, packageRoot, strict, authorityContext, runtimeContext });
   let manifest = null;
   let manifestError = null;
   try {

package/src/core/checks.js

@@ -1,4 +1,5 @@
 import { PROTOCOL_VERSION } from "./protocol.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 export const CHECK_SCHEMA_VERSION = 1;
 export const CHECK_STATUSES = Object.freeze(["passed", "failed", "blocked", "not-run"]);
@@ -45,7 +46,7 @@ function assertCompoundStatus(value, label) {
   }
 }
 
-export function createCheck(input = {}) {
+export function createCheck(input = {}, options = {}) {
   const check = {
     schemaVersion: CHECK_SCHEMA_VERSION,
     protocolVersion: PROTOCOL_VERSION,
@@ -61,10 +62,10 @@ export function createCheck(input = {}) {
     ...(input.viewport !== undefined ? { viewport: structuredClone(input.viewport) } : {}),
     ...(input.details !== undefined ? { details: structuredClone(input.details) } : {}),
   };
-  return assertCheck(check);
+  return assertCheck(check, "check", options);
 }
 
-export function assertCheck(value, label = "check") {
+export function assertCheck(value, label = "check", options = {}) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw checkError("E_CHECK_INVALID", `${label} must be an object`);
   }
@@ -97,15 +98,21 @@ export function assertCheck(value, label = "check") {
   if (value.status === "not-run" && value.evidenceKind !== "NOT_VERIFIED") {
     throw contradiction(`${label} not-run must use NOT_VERIFIED evidence`);
   }
+  if (value.status === "passed") {
+    const auth = validateVerificationAuthority(value, options);
+    if (!auth.valid) {
+      throw checkError(auth.error.code, auth.error.message);
+    }
+  }
   assertCompoundStatus(value, label);
   return value;
 }
 
-export function assertCheckList(value, label = "checks") {
+export function assertCheckList(value, label = "checks", options = {}) {
   if (!Array.isArray(value)) throw checkError("E_CHECK_INVALID", `${label} must be an array`);
   const ids = new Set();
   value.forEach((item, index) => {
-    assertCheck(item, `${label}[${index}]`);
+    assertCheck(item, `${label}[${index}]`, options);
     if (ids.has(item.id)) throw checkError("E_CHECK_INVALID", `${label} contains duplicate id ${item.id}`);
     ids.add(item.id);
   });