@cassiomc1/forgeloop 0.1.12 → 0.1.14

package/src/core/completion-artifacts.js

@@ -11,7 +11,7 @@ import { completionEvidenceForGuides } from "./guide-metadata.js";
 import { createCheck } from "./checks.js";
 import { createEvidence } from "./evidence.js";
 import { coverageForRequirements } from "./coverage.js";
-import { assertCompletionRelationships } from "./completion-relationships.js";
+import { assertCompletionRelationships, assertStateIdentity } from "./completion-relationships.js";
 import { evaluatePreflight } from "./preflight.js";
 import { currentChangedPaths } from "./repository.js";
 import { readPersistedRoute } from "./route-artifact.js";
@@ -19,6 +19,7 @@ import { createReceipt, validateReceipt } from "./receipt.js";
 import { readWorkState, writeWorkState } from "./work-state.js";
 import { assertExecutionPrerequisites, hasExecutionStarted } from "./execution-prerequisites.js";
 import { normalizeRequirements, classifyRequirement } from "./evidence-readiness.js";
+import { classifyCommandResolution, validateVerificationAuthority } from "./verification-capability.js";
 
 function artifactError(code, message, artifacts = []) {
   const error = new Error(message);
@@ -69,7 +70,7 @@ export async function requiredEvidenceForTarget({ target, contract, route, packa
   ])].sort();
 }
 
-export async function prepareCompletion({ target, packageRoot }) {
+export async function prepareCompletion({ target, packageRoot, authorityContext, runtimeContext }) {
   const contract = await readContract(target, packageRoot);
   const route = await readPersistedRoute(target, packageRoot);
   const state = await readWorkState(target, packageRoot);
@@ -83,7 +84,12 @@ export async function prepareCompletion({ target, packageRoot }) {
   let existing = null;
   try {
     existing = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
-    await validateReceipt(existing.value, packageRoot);
+    await validateReceipt(existing.value, packageRoot, {
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
+    });
   } catch (error) {
     if (error.code !== "ARTIFACT_MISSING") throw error;
   }
@@ -97,17 +103,19 @@ export async function prepareCompletion({ target, packageRoot }) {
     additionalEvidence: preflight.policy?.requiredEvidence ?? [],
   });
   const existingValue = existing?.value ?? {};
-  assertCompletionRelationships({
-    contract,
-    route,
-    state,
-    receipt: existingValue.taskId ? existingValue : null,
-    requiredEvidence,
-    requireRequiredChecks: false,
-  });
-  const changedPaths = existing
-    ? [...(existingValue.changedPaths ?? [])]
-    : (await currentChangedPaths(target) ?? []);
+  if (existingValue.taskId && existingValue.taskId !== contract.value.taskId) {
+    throw artifactError("E_RECEIPT_TASK_MISMATCH", "Execution receipt does not belong to the current contract task", [ARTIFACT_PATHS.receipt]);
+  }
+  if (existing && existingValue.stateFingerprint === undefined) {
+    throw artifactError("E_RECEIPT_STATE_MISMATCH", "Execution receipt requires the current work-state fingerprint", [ARTIFACT_PATHS.receipt]);
+  }
+  assertStateIdentity({ contract, route, state });
+  const observedPaths = await currentChangedPaths(target);
+  const changedPaths = observedPaths !== null
+    ? [...observedPaths]
+    : existing
+      ? [...(existingValue.changedPaths ?? [])]
+      : [];
   const checks = existing ? [...existingValue.checks] : [...state.checks];
   const evidence = existing ? [...(existingValue.evidence ?? [])] : [...state.verificationEvidence];
   const receipt = await createReceipt({
@@ -126,7 +134,11 @@ export async function prepareCompletion({ target, packageRoot }) {
     changedPaths,
     checks,
     evidence,
-    evidenceCoverage: coverageForRequirements(requiredEvidence, checks),
+    evidenceCoverage: coverageForRequirements(requiredEvidence, checks, {
+      target,
+      taskId: contract.value.taskId,
+      options: { authorityContext, runtimeContext },
+    }),
     review: existingValue.review ?? { status: "not-run", independent: false },
     limitations: [...(existingValue.limitations ?? [])],
     publication: existingValue.publication ?? {
@@ -135,7 +147,24 @@ export async function prepareCompletion({ target, packageRoot }) {
       pullRequest: null,
       deployed: false,
     },
-  }, packageRoot);
+  }, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
+  assertCompletionRelationships({
+    contract,
+    route,
+    state,
+    receipt,
+    requiredEvidence,
+    requireRequiredChecks: false,
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
   const written = await writeJsonArtifact(
     target,
     ARTIFACT_PATHS.receipt,
@@ -179,6 +208,8 @@ export async function recordCheck({
   result,
   exitCode,
   details,
+  authorityContext,
+  runtimeContext,
 }) {
   requiredString(id, "check id");
   requiredString(kind, "check kind");
@@ -199,6 +230,8 @@ export async function recordCheck({
     throw artifactError("E_CHECK_INVALID", "record-check requires --command or --result");
   }
 
+  const commandSpec = typeof command === "string" && command.trim() !== "" ? command.trim() : undefined;
+
   const state = await readWorkState(target, packageRoot);
   if (!state) throw artifactError("E_STATE_MISSING", "Work state is required before recording a check", [ARTIFACT_PATHS.state]);
   if (["COMPLETE", "BLOCKED"].includes(state.phase)) {
@@ -235,9 +268,20 @@ export async function recordCheck({
   }
 
   const existingReceipt = await readCurrentReceipt(target, packageRoot);
-  await validateReceipt(existingReceipt.value, packageRoot);
-  const source = command?.trim() || `check:${id}`;
-  const recordedResult = result?.trim() || `recorded command: ${command.trim()}`;
+  await validateReceipt(existingReceipt.value, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
+  const source = commandSpec || `check:${id}`;
+  const recordedResult = result?.trim() || `recorded command: ${commandSpec || source}`;
+  const classification = commandSpec !== undefined ? classifyCommandResolution(commandSpec) : null;
+  const installationAuthorized = Boolean(
+    details?.installationAuthorized
+    || details?.authority?.softwareInstallation === "AUTHORIZED"
+    || details?.execution?.installationAuthorized
+  );
   const check = createCheck({
     id,
     kind,
@@ -252,7 +296,20 @@ export async function recordCheck({
       ...(result === undefined ? {} : { result }),
       ...(details === undefined ? {} : details),
       verificationCycle: state.verificationCycle ?? 1,
+      ...(classification ? {
+        execution: {
+          resolutionMode: classification.resolutionMode,
+          mayInstall: classification.mayInstall,
+          installationAuthorized,
+        },
+      } : {}),
     },
+  }, {
+    target,
+    taskId: contract.value.taskId,
+    packageRoot,
+    authorityContext,
+    runtimeContext,
   });
   const evidence = createEvidence({
     kind: evidenceKind,
@@ -265,6 +322,19 @@ export async function recordCheck({
     },
   });
 
+  if (status === "passed") {
+    const auth = validateVerificationAuthority(check, {
+      target,
+      taskId: contract.value.taskId,
+      packageRoot,
+      authorityContext,
+      runtimeContext,
+    });
+    if (!auth.valid) {
+      throw artifactError(auth.error.code, auth.error.message, [ARTIFACT_PATHS.receipt]);
+    }
+  }
+
   const checks = mergeByCheckId(existingReceipt.value.checks ?? [], check);
   const evidenceList = appendUniqueEvidence(existingReceipt.value.evidence ?? [], evidence);
   assertCompletionRelationships({
@@ -274,6 +344,10 @@ export async function recordCheck({
     receipt: existingReceipt.value,
     requiredEvidence,
     requireRequiredChecks: false,
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
   });
   const ledger = await validateEventLedger(target, packageRoot);
   if (!ledger.valid) {
@@ -287,7 +361,11 @@ export async function recordCheck({
       [ARTIFACT_PATHS.events],
     );
   }
-  const coverage = coverageForRequirements(requiredEvidence, checks);
+  const coverage = coverageForRequirements(requiredEvidence, checks, {
+    target,
+    taskId: contract.value.taskId,
+    options: { authorityContext, runtimeContext },
+  });
   const nextState = {
     ...state,
     checks,
@@ -302,7 +380,12 @@ export async function recordCheck({
     evidenceCoverage: coverage,
     stateFingerprint: canonicalFingerprint(nextState),
     verificationCycle: state.verificationCycle ?? 1,
-  }, packageRoot);
+  }, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
 
   assertCompletionRelationships({
     contract,
@@ -311,6 +394,10 @@ export async function recordCheck({
     receipt: nextReceipt,
     requiredEvidence,
     requireRequiredChecks: false,
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
   });
 
   await writeWorkState(target, nextState, { packageRoot });
@@ -351,6 +438,8 @@ export async function recordTerminalResult({
   source,
   result,
   details = {},
+  authorityContext,
+  runtimeContext,
 } = {}) {
   if (!target || !requirement || !type || !status || !source || !result) {
     throw artifactError("E_CHECK_INVALID", "record-terminal-result requires target, requirement, type, status, source, and result", [ARTIFACT_PATHS.state]);
@@ -413,7 +502,12 @@ export async function recordTerminalResult({
   }
 
   const existingReceipt = await readCurrentReceipt(target, packageRoot);
-  await validateReceipt(existingReceipt.value, packageRoot);
+  await validateReceipt(existingReceipt.value, packageRoot, {
+    target,
+    taskId: contract?.value?.taskId,
+    authorityContext,
+    runtimeContext,
+  });
 
   if (type === "PUBLICATION") {
     const rank = {
@@ -540,7 +634,12 @@ export async function recordTerminalResult({
   const nextReceipt = await createReceipt({
     ...receiptUpdates,
     stateFingerprint: canonicalFingerprint(nextState),
-  }, packageRoot);
+  }, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
 
   await writeWorkState(target, nextState, { packageRoot });
   await writeJsonArtifact(

package/src/core/completion-recovery.js

@@ -8,6 +8,10 @@ export const RECOVERABLE_COMPLETION_EVIDENCE_CODES = Object.freeze([
   "E_VERIFICATION_CHECK_REQUIRED",
   "E_CHECK_REQUIRED",
   "E_CHECK_INVALID",
+  "E_INSTALLATION_AUTHORITY_REQUIRED",
+  "E_AUTHORITY_INVALID",
+  "E_AUTHORITY_SCOPE_MISMATCH",
+  "E_AUTHORITY_UNTRUSTED_SOURCE",
 ]);
 
 export function isRecoverableCompletionEvidenceCode(code) {

package/src/core/completion-relationships.js

@@ -3,6 +3,7 @@ import { assertCheckList } from "./checks.js";
 import { assertCoverageList, coverageForRequirements } from "./coverage.js";
 import { assertEvidenceList } from "./evidence.js";
 import { evaluateRequiredEvidence } from "./evidence-readiness.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 function issue(code, message, artifacts = [], details = {}) {
   return { code, message, artifacts, ...details };
@@ -65,10 +66,23 @@ export function completionRelationshipErrors({
   requiredEvidence = [],
   requireReceiptStateFingerprint = true,
   requireRequiredChecks = true,
+  target,
+  taskId,
+  authorities,
+  authorityContext,
+  runtimeContext,
 } = {}) {
   const errors = stateIdentityErrors({ contract, route, state });
   const contractValue = contract?.value ?? contract;
   const contractFingerprint = contract?.fingerprint;
+  const effectiveTaskId = taskId ?? contractValue?.taskId ?? state?.taskId ?? receipt?.taskId;
+  const authOptions = {
+    ...(target ? { target } : {}),
+    ...(effectiveTaskId ? { taskId: effectiveTaskId } : {}),
+    ...(authorities ? { authorities } : {}),
+    ...(authorityContext ? { authorityContext } : {}),
+    ...(runtimeContext ? { runtimeContext } : {}),
+  };
   if (contractValue && receipt && contractValue.taskId !== receipt.taskId) {
     errors.push(issue("E_RECEIPT_TASK_MISMATCH", "Execution receipt does not belong to the current contract task", [ARTIFACT_PATHS.contract, ARTIFACT_PATHS.receipt]));
   }
@@ -80,14 +94,30 @@ export function completionRelationshipErrors({
   }
 
   if (state) {
-    addAssertion(errors, () => assertCheckList(state.checks, "work-state.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.state]);
+    addAssertion(errors, () => assertCheckList(state.checks, "work-state.checks", authOptions), "E_CHECK_INVALID", [ARTIFACT_PATHS.state]);
     addAssertion(errors, () => assertEvidenceList(state.verificationEvidence, "work-state.verificationEvidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.state]);
+    for (const check of state.checks ?? []) {
+      if (check.status === "passed") {
+        const auth = validateVerificationAuthority(check, authOptions);
+        if (!auth.valid) {
+          errors.push(issue(auth.error.code, auth.error.message, [ARTIFACT_PATHS.state]));
+        }
+      }
+    }
   }
   if (receipt) {
-    addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
+    addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks", authOptions), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
     addAssertion(errors, () => assertEvidenceList(receipt.evidence ?? [], "receipt.evidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.receipt]);
+    for (const check of receipt.checks ?? []) {
+      if (check.status === "passed") {
+        const auth = validateVerificationAuthority(check, authOptions);
+        if (!auth.valid) {
+          errors.push(issue(auth.error.code, auth.error.message, [ARTIFACT_PATHS.receipt]));
+        }
+      }
+    }
     if (requireRequiredChecks) {
-      const readiness = evaluateRequiredEvidence({ requirements: requiredEvidence, checks: receipt.checks });
+      const readiness = evaluateRequiredEvidence({ requirements: requiredEvidence, checks: receipt.checks, options: authOptions });
       for (const requirement of readiness.missing) {
         errors.push(issue("E_EVIDENCE_REQUIRED", `Required check is missing: ${requirement.text}`, [ARTIFACT_PATHS.receipt], { requirementId: requirement.id }));
       }
@@ -100,7 +130,12 @@ export function completionRelationshipErrors({
     }
   }
 
-  const expectedCoverage = state ? coverageForRequirements(requiredEvidence, state.checks) : [];
+  const expectedCoverage = state ? coverageForRequirements(requiredEvidence, state.checks, {
+    target,
+    taskId: effectiveTaskId,
+    authorities,
+    options: authOptions,
+  }) : [];
   if (state?.evidenceCoverage !== undefined) {
     addAssertion(errors, () => assertCoverageList(state.evidenceCoverage, "work-state.evidenceCoverage"), "E_EVIDENCE_COVERAGE_INVALID", [ARTIFACT_PATHS.state]);
     if (!sameValue(state.evidenceCoverage, expectedCoverage)) {

package/src/core/completion.js

@@ -77,6 +77,13 @@ function repairNext(error) {
       return "Satisfy or refresh the named gate, then rerun forgeloop preflight.";
     case "E_PROFILE_UNVERIFIED":
       return "Use Standard mode for a fresh target, or verify PROJECT_PROFILE.md before Strict completion.";
+    case "E_INSTALLATION_AUTHORITY_REQUIRED":
+    case "E_AUTHORITY_INVALID":
+    case "E_AUTHORITY_SCOPE_MISMATCH":
+    case "E_AUTHORITY_UNTRUSTED_SOURCE":
+      return "Do not execute installation-capable verification commands without explicit scoped installation authority; use local equivalents or record NOT_VERIFIED.";
+    case "E_VERIFICATION_TOOL_UNAVAILABLE":
+      return "Use an available local verifier, an existing equivalent, or record NOT_VERIFIED if installation was not authorized.";
     default:
       return "Resolve this validator finding in the named artifact before retrying completion.";
   }
@@ -151,7 +158,7 @@ async function validateLedger(target, taskId, state, errors, packageRoot) {
   return ledger;
 }
 
-export async function evaluateCompletion({ target, packageRoot, strict = false } = {}) {
+export async function evaluateCompletion({ target, packageRoot, strict = false, authorityContext, runtimeContext } = {}) {
   const errors = [];
   const preflight = await evaluatePreflight({ target, packageRoot, strict });
   errors.push(...preflight.errors);
@@ -198,7 +205,12 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
 
   if (receipt) {
     try {
-      await validateReceipt(receipt.value, packageRoot);
+      await validateReceipt(receipt.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       errors.push(issue(error.code ?? "E_RECEIPT_INVALID", `Execution receipt is invalid: ${error.message}`, [ARTIFACT_PATHS.receipt]));
     }
@@ -223,6 +235,10 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
       state,
       receipt: receipt?.value,
       requiredEvidence,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     errors.push(...relationshipErrors);
     coverage = receipt?.value?.evidenceCoverage ?? [];
@@ -290,12 +306,18 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
   };
 }
 
-export async function runComplete({ target, packageRoot, strict = false, persist = true } = {}) {
-  const result = await evaluateCompletion({ target, packageRoot, strict });
+export async function runComplete({ target, packageRoot, strict = false, persist = true, authorityContext, runtimeContext } = {}) {
+  const result = await evaluateCompletion({ target, packageRoot, strict, authorityContext, runtimeContext });
   const rejectionCodes = [...new Set(result.errors.map((error) => error.code))].sort();
   const evidenceOnlyRejection = rejectionCodes.length > 0
     && rejectionCodes.every(isRecoverableCompletionEvidenceCode);
-  if (persist && result.status === "REJECTED" && evidenceOnlyRejection) {
+  const authorityRejection = rejectionCodes.some((code) => [
+    "E_INSTALLATION_AUTHORITY_REQUIRED",
+    "E_AUTHORITY_INVALID",
+    "E_AUTHORITY_SCOPE_MISMATCH",
+    "E_AUTHORITY_UNTRUSTED_SOURCE",
+  ].includes(code));
+  if (persist && result.status === "REJECTED" && evidenceOnlyRejection && !authorityRejection) {
     const state = await readWorkState(target, packageRoot);
     if (state?.phase === "REVIEWING") {
       const reasonCodes = rejectionCodes;
@@ -335,7 +357,7 @@ export async function runComplete({ target, packageRoot, strict = false, persist
           ...receipt.value,
           stateFingerprint: canonicalFingerprint(next),
           verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-        }, packageRoot);
+        }, packageRoot, { target, taskId: state.taskId, authorityContext, runtimeContext });
         await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
       }
       const ledger = await validateEventLedger(target, packageRoot);
@@ -380,7 +402,7 @@ export async function runComplete({ target, packageRoot, strict = false, persist
         ...receipt.value,
         stateFingerprint: canonicalFingerprint(next),
         verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-      }, packageRoot);
+      }, packageRoot, { target, taskId: state.taskId, authorityContext, runtimeContext });
       await writeWorkState(target, next, { packageRoot });
       await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
     }

package/src/core/conformance.js

@@ -23,6 +23,24 @@ function sortErrors(errors) {
     || left.message.localeCompare(right.message));
 }
 
+export function delegationIsInScope({
+  state = null,
+  receipt = null,
+  events = [],
+  taskBriefs = [],
+  delegatedResults = [],
+} = {}) {
+  if (taskBriefs && taskBriefs.length > 0) return true;
+  if (delegatedResults && delegatedResults.length > 0) return true;
+  if (state?.delegatedTasks && state.delegatedTasks.length > 0) return true;
+  if (state?.delegatedTaskIds && state.delegatedTaskIds.length > 0) return true;
+  if (receipt?.delegatedTasks && receipt.delegatedTasks.length > 0) return true;
+  if (Array.isArray(events) && events.some((event) => typeof event?.type === "string" && event.type.toLowerCase().includes("delegat"))) {
+    return true;
+  }
+  return false;
+}
+
 export function validateTaskArtifactSet({
   route = null,
   state = null,
@@ -30,6 +48,7 @@ export function validateTaskArtifactSet({
   receipt = null,
   taskBriefs = [],
   delegatedResults = [],
+  events = [],
 } = {}) {
   const errors = [];
   const incomplete = [];
@@ -62,6 +81,7 @@ export function validateTaskArtifactSet({
     errors.push(error("STATE_RECEIPT_GUIDES_MISMATCH", "execution-receipt.selectedGuides must equal work-state.selectedGuides", ["state", "receipt"]));
   }
 
+  const delegationActive = delegationIsInScope({ state, receipt, events, taskBriefs, delegatedResults });
   const briefIds = new Set();
   for (const brief of taskBriefs) {
     if (!brief?.taskId) continue;
@@ -86,13 +106,18 @@ export function validateTaskArtifactSet({
     }
   }
 
-  if (taskBriefs.length > 0) {
-    for (const taskId of [...briefIds].sort()) {
-      if (!delegatedIds.has(taskId)) incomplete.push(`missing delegated result: ${taskId}`);
+  if (delegationActive) {
+    if (taskBriefs.length > 0) {
+      for (const taskId of [...briefIds].sort()) {
+        if (!delegatedIds.has(taskId)) incomplete.push(`missing delegated result: ${taskId}`);
+      }
+    } else if (delegatedResults.length > 0) {
+      incomplete.push("task briefs are required when delegated results are supplied");
+    } else {
+      incomplete.push("task briefs and delegated results were not supplied for delegated task");
     }
-  } else if (delegatedResults.length === 0) {
-    incomplete.push("task briefs and delegated results were not supplied");
   }
+
   if (!route || !state || !receipt) incomplete.push("route, state, and receipt are all required for a complete artifact set");
 
   const sortedErrors = sortErrors(errors);
@@ -117,6 +142,22 @@ export function validateTaskArtifactSet({
     }
     : null;
 
+  const delegation = delegationActive
+    ? {
+      status: sortedErrors.some((e) => e.code.includes("DELEGAT") || e.code.includes("TASK"))
+        ? "INCONSISTENT"
+        : incomplete.some((i) => i.includes("delegat") || i.includes("brief"))
+          ? "INCOMPLETE"
+          : "VALID",
+      required: true,
+      errors: sortedErrors.filter((e) => e.code.includes("DELEGAT") || e.code.includes("TASK")),
+    }
+    : {
+      status: "NOT_APPLICABLE",
+      required: false,
+      errors: [],
+    };
+
   const evidenceKind = status === "VALID"
     ? "OBSERVED"
     : status === "INCOMPLETE"
@@ -131,6 +172,7 @@ export function validateTaskArtifactSet({
     errors: sortedErrors,
     incomplete: [...new Set(incomplete)].sort(),
     stale,
+    delegation,
     evidence: [createEvidence({
       kind: evidenceKind,
       source: "ForgeLoop protocol conformance",

package/src/core/coverage.js

@@ -73,10 +73,23 @@ export function assertCoverageList(value, label = "evidenceCoverage") {
   return value;
 }
 
-export function coverageForRequirements(requirements, checks, { blockedIds = [] } = {}) {
+export function coverageForRequirements(requirements, checks, {
+  blockedIds = [],
+  target,
+  taskId,
+  authorities,
+  options = {},
+} = {}) {
   const normalizedRequirements = normalizeRequirements(requirements ?? []);
   const normalizedChecks = Array.isArray(checks) ? checks : [];
-  const readiness = evaluateRequiredEvidence({ requirements: normalizedRequirements, checks: normalizedChecks });
+  const readiness = evaluateRequiredEvidence({
+    requirements: normalizedRequirements,
+    checks: normalizedChecks,
+    target,
+    taskId,
+    authorities,
+    options,
+  });
   const covered = new Set(readiness.covered.map((item) => item.id));
   const partial = new Set(readiness.partial.map((item) => item.id));
   const invalid = new Set(readiness.invalid.map((item) => item.id));

package/src/core/evidence-readiness.js

@@ -1,4 +1,5 @@
 import { sha256 } from "./manifest.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 export const REQUIREMENT_TYPES = Object.freeze([
   "PRODUCT",
@@ -246,7 +247,7 @@ export function authoritativeChecksForRequirements({ requirements = [], checks =
   });
 }
 
-function componentStatus(check, requirement, allChecks = []) {
+function componentStatus(check, requirement, allChecks = [], options = {}) {
   if (requirement.operator !== "ALL" || !requirement.requirements?.length) return null;
   const components = check?.details?.components;
   const statuses = requirement.requirements.map((child) => {
@@ -254,10 +255,19 @@ function componentStatus(check, requirement, allChecks = []) {
       const matchingComp = components.filter((item) => (
         item?.requirementId === child.id || item?.requirement === child.text
       )).at(-1);
-      if (matchingComp) return matchingComp;
+      if (matchingComp) {
+        const auth = validateVerificationAuthority(matchingComp, options);
+        if (!auth.valid) return { ...matchingComp, status: "failed", reasonCode: auth.error.code };
+        return matchingComp;
+      }
     }
     const childCandidates = allChecks.filter((candidate) => matchesRequirement(candidate, child));
-    return latestAuthoritativeCheck(childCandidates);
+    const childCheck = latestAuthoritativeCheck(childCandidates);
+    if (childCheck) {
+      const auth = validateVerificationAuthority(childCheck, options);
+      if (!auth.valid) return { ...childCheck, status: "failed", reasonCode: auth.error.code };
+    }
+    return childCheck;
   });
   if (statuses.some((item) => !item)) return "MISSING";
   if (statuses.some((item) => item.status === "failed")) return "INVALID";
@@ -265,7 +275,20 @@ function componentStatus(check, requirement, allChecks = []) {
   return "COVERED";
 }
 
-export function evaluateRequiredEvidence({ requirements = [], checks = [] } = {}) {
+export function evaluateRequiredEvidence({
+  requirements = [],
+  checks = [],
+  target,
+  taskId,
+  authorities,
+  options = {},
+} = {}) {
+  const authOptions = {
+    ...(target ? { target } : {}),
+    ...(taskId ? { taskId } : {}),
+    ...(authorities ? { authorities } : {}),
+    ...options,
+  };
   const normalized = normalizeRequirements(requirements);
   const result = {
     ready: true,
@@ -291,8 +314,11 @@ export function evaluateRequiredEvidence({ requirements = [], checks = [] } = {}
     }
     const candidates = checks.filter((check) => matchesRequirement(check, requirement));
     const check = latestAuthoritativeCheck(candidates);
-    const compound = componentStatus(check, requirement, checks);
-    if (compound === "INVALID" || check?.status === "failed") {
+    const auth = check ? validateVerificationAuthority(check, authOptions) : { valid: true };
+    const compound = componentStatus(check, requirement, checks, authOptions);
+    if (!auth.valid) {
+      result.invalid.push({ ...requirement, reasonCode: auth.error.code });
+    } else if (compound === "INVALID" || check?.status === "failed") {
       result.invalid.push(requirement);
     } else if (compound === "PARTIAL") {
       result.partial.push(requirement);

package/src/core/inspect.js

@@ -8,6 +8,7 @@ import { createEvidence } from "./evidence.js";
 import { runDoctor } from "../commands/doctor.js";
 import { findProfilePath } from "./profile.js";
 import { FORGELOOP_KIT_DIR } from "./target-layout.js";
+import { trustedAuthorityConfiguration } from "./trusted-authority.js";
 
 function profileMetadata(bytes) {
   const text = bytes.toString("utf8");
@@ -17,7 +18,7 @@ function profileMetadata(bytes) {
   };
 }
 
-export async function inspectTarget({ target, packageRoot, contractFile = null }) {
+export async function inspectTarget({ target, packageRoot, contractFile = null, authorityContext, runtimeContext }) {
   let manifest = null;
   let manifestError = null;
   try {
@@ -91,6 +92,7 @@ export async function inspectTarget({ target, packageRoot, contractFile = null }
   ];
   return {
     target: { path: target },
+    authority: trustedAuthorityConfiguration({ target, authorityContext, runtimeContext }),
     manifest: {
       present: manifest !== null,
       status: manifestError ? "invalid" : manifest ? "ready" : "missing",