@cassiomc1/forgeloop 0.1.13 → 0.1.14

package/src/core/completion-relationships.js

@@ -3,6 +3,7 @@ import { assertCheckList } from "./checks.js";
 import { assertCoverageList, coverageForRequirements } from "./coverage.js";
 import { assertEvidenceList } from "./evidence.js";
 import { evaluateRequiredEvidence } from "./evidence-readiness.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 function issue(code, message, artifacts = [], details = {}) {
   return { code, message, artifacts, ...details };
@@ -65,10 +66,23 @@ export function completionRelationshipErrors({
   requiredEvidence = [],
   requireReceiptStateFingerprint = true,
   requireRequiredChecks = true,
+  target,
+  taskId,
+  authorities,
+  authorityContext,
+  runtimeContext,
 } = {}) {
   const errors = stateIdentityErrors({ contract, route, state });
   const contractValue = contract?.value ?? contract;
   const contractFingerprint = contract?.fingerprint;
+  const effectiveTaskId = taskId ?? contractValue?.taskId ?? state?.taskId ?? receipt?.taskId;
+  const authOptions = {
+    ...(target ? { target } : {}),
+    ...(effectiveTaskId ? { taskId: effectiveTaskId } : {}),
+    ...(authorities ? { authorities } : {}),
+    ...(authorityContext ? { authorityContext } : {}),
+    ...(runtimeContext ? { runtimeContext } : {}),
+  };
   if (contractValue && receipt && contractValue.taskId !== receipt.taskId) {
     errors.push(issue("E_RECEIPT_TASK_MISMATCH", "Execution receipt does not belong to the current contract task", [ARTIFACT_PATHS.contract, ARTIFACT_PATHS.receipt]));
   }
@@ -80,14 +94,30 @@ export function completionRelationshipErrors({
   }
 
   if (state) {
-    addAssertion(errors, () => assertCheckList(state.checks, "work-state.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.state]);
+    addAssertion(errors, () => assertCheckList(state.checks, "work-state.checks", authOptions), "E_CHECK_INVALID", [ARTIFACT_PATHS.state]);
     addAssertion(errors, () => assertEvidenceList(state.verificationEvidence, "work-state.verificationEvidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.state]);
+    for (const check of state.checks ?? []) {
+      if (check.status === "passed") {
+        const auth = validateVerificationAuthority(check, authOptions);
+        if (!auth.valid) {
+          errors.push(issue(auth.error.code, auth.error.message, [ARTIFACT_PATHS.state]));
+        }
+      }
+    }
   }
   if (receipt) {
-    addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
+    addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks", authOptions), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
     addAssertion(errors, () => assertEvidenceList(receipt.evidence ?? [], "receipt.evidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.receipt]);
+    for (const check of receipt.checks ?? []) {
+      if (check.status === "passed") {
+        const auth = validateVerificationAuthority(check, authOptions);
+        if (!auth.valid) {
+          errors.push(issue(auth.error.code, auth.error.message, [ARTIFACT_PATHS.receipt]));
+        }
+      }
+    }
     if (requireRequiredChecks) {
-      const readiness = evaluateRequiredEvidence({ requirements: requiredEvidence, checks: receipt.checks });
+      const readiness = evaluateRequiredEvidence({ requirements: requiredEvidence, checks: receipt.checks, options: authOptions });
       for (const requirement of readiness.missing) {
         errors.push(issue("E_EVIDENCE_REQUIRED", `Required check is missing: ${requirement.text}`, [ARTIFACT_PATHS.receipt], { requirementId: requirement.id }));
       }
@@ -100,7 +130,12 @@ export function completionRelationshipErrors({
     }
   }
 
-  const expectedCoverage = state ? coverageForRequirements(requiredEvidence, state.checks) : [];
+  const expectedCoverage = state ? coverageForRequirements(requiredEvidence, state.checks, {
+    target,
+    taskId: effectiveTaskId,
+    authorities,
+    options: authOptions,
+  }) : [];
   if (state?.evidenceCoverage !== undefined) {
     addAssertion(errors, () => assertCoverageList(state.evidenceCoverage, "work-state.evidenceCoverage"), "E_EVIDENCE_COVERAGE_INVALID", [ARTIFACT_PATHS.state]);
     if (!sameValue(state.evidenceCoverage, expectedCoverage)) {

package/src/core/completion.js

@@ -77,6 +77,13 @@ function repairNext(error) {
       return "Satisfy or refresh the named gate, then rerun forgeloop preflight.";
     case "E_PROFILE_UNVERIFIED":
       return "Use Standard mode for a fresh target, or verify PROJECT_PROFILE.md before Strict completion.";
+    case "E_INSTALLATION_AUTHORITY_REQUIRED":
+    case "E_AUTHORITY_INVALID":
+    case "E_AUTHORITY_SCOPE_MISMATCH":
+    case "E_AUTHORITY_UNTRUSTED_SOURCE":
+      return "Do not execute installation-capable verification commands without explicit scoped installation authority; use local equivalents or record NOT_VERIFIED.";
+    case "E_VERIFICATION_TOOL_UNAVAILABLE":
+      return "Use an available local verifier, an existing equivalent, or record NOT_VERIFIED if installation was not authorized.";
     default:
       return "Resolve this validator finding in the named artifact before retrying completion.";
   }
@@ -151,7 +158,7 @@ async function validateLedger(target, taskId, state, errors, packageRoot) {
   return ledger;
 }
 
-export async function evaluateCompletion({ target, packageRoot, strict = false } = {}) {
+export async function evaluateCompletion({ target, packageRoot, strict = false, authorityContext, runtimeContext } = {}) {
   const errors = [];
   const preflight = await evaluatePreflight({ target, packageRoot, strict });
   errors.push(...preflight.errors);
@@ -198,7 +205,12 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
 
   if (receipt) {
     try {
-      await validateReceipt(receipt.value, packageRoot);
+      await validateReceipt(receipt.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       errors.push(issue(error.code ?? "E_RECEIPT_INVALID", `Execution receipt is invalid: ${error.message}`, [ARTIFACT_PATHS.receipt]));
     }
@@ -223,6 +235,10 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
       state,
       receipt: receipt?.value,
       requiredEvidence,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     errors.push(...relationshipErrors);
     coverage = receipt?.value?.evidenceCoverage ?? [];
@@ -290,12 +306,18 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
   };
 }
 
-export async function runComplete({ target, packageRoot, strict = false, persist = true } = {}) {
-  const result = await evaluateCompletion({ target, packageRoot, strict });
+export async function runComplete({ target, packageRoot, strict = false, persist = true, authorityContext, runtimeContext } = {}) {
+  const result = await evaluateCompletion({ target, packageRoot, strict, authorityContext, runtimeContext });
   const rejectionCodes = [...new Set(result.errors.map((error) => error.code))].sort();
   const evidenceOnlyRejection = rejectionCodes.length > 0
     && rejectionCodes.every(isRecoverableCompletionEvidenceCode);
-  if (persist && result.status === "REJECTED" && evidenceOnlyRejection) {
+  const authorityRejection = rejectionCodes.some((code) => [
+    "E_INSTALLATION_AUTHORITY_REQUIRED",
+    "E_AUTHORITY_INVALID",
+    "E_AUTHORITY_SCOPE_MISMATCH",
+    "E_AUTHORITY_UNTRUSTED_SOURCE",
+  ].includes(code));
+  if (persist && result.status === "REJECTED" && evidenceOnlyRejection && !authorityRejection) {
     const state = await readWorkState(target, packageRoot);
     if (state?.phase === "REVIEWING") {
       const reasonCodes = rejectionCodes;
@@ -335,7 +357,7 @@ export async function runComplete({ target, packageRoot, strict = false, persist
           ...receipt.value,
           stateFingerprint: canonicalFingerprint(next),
           verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-        }, packageRoot);
+        }, packageRoot, { target, taskId: state.taskId, authorityContext, runtimeContext });
         await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
       }
       const ledger = await validateEventLedger(target, packageRoot);
@@ -380,7 +402,7 @@ export async function runComplete({ target, packageRoot, strict = false, persist
         ...receipt.value,
         stateFingerprint: canonicalFingerprint(next),
         verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-      }, packageRoot);
+      }, packageRoot, { target, taskId: state.taskId, authorityContext, runtimeContext });
       await writeWorkState(target, next, { packageRoot });
       await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
     }

package/src/core/coverage.js

@@ -73,10 +73,23 @@ export function assertCoverageList(value, label = "evidenceCoverage") {
   return value;
 }
 
-export function coverageForRequirements(requirements, checks, { blockedIds = [] } = {}) {
+export function coverageForRequirements(requirements, checks, {
+  blockedIds = [],
+  target,
+  taskId,
+  authorities,
+  options = {},
+} = {}) {
   const normalizedRequirements = normalizeRequirements(requirements ?? []);
   const normalizedChecks = Array.isArray(checks) ? checks : [];
-  const readiness = evaluateRequiredEvidence({ requirements: normalizedRequirements, checks: normalizedChecks });
+  const readiness = evaluateRequiredEvidence({
+    requirements: normalizedRequirements,
+    checks: normalizedChecks,
+    target,
+    taskId,
+    authorities,
+    options,
+  });
   const covered = new Set(readiness.covered.map((item) => item.id));
   const partial = new Set(readiness.partial.map((item) => item.id));
   const invalid = new Set(readiness.invalid.map((item) => item.id));

package/src/core/evidence-readiness.js

@@ -1,4 +1,5 @@
 import { sha256 } from "./manifest.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 export const REQUIREMENT_TYPES = Object.freeze([
   "PRODUCT",
@@ -246,7 +247,7 @@ export function authoritativeChecksForRequirements({ requirements = [], checks =
   });
 }
 
-function componentStatus(check, requirement, allChecks = []) {
+function componentStatus(check, requirement, allChecks = [], options = {}) {
   if (requirement.operator !== "ALL" || !requirement.requirements?.length) return null;
   const components = check?.details?.components;
   const statuses = requirement.requirements.map((child) => {
@@ -254,10 +255,19 @@ function componentStatus(check, requirement, allChecks = []) {
       const matchingComp = components.filter((item) => (
         item?.requirementId === child.id || item?.requirement === child.text
       )).at(-1);
-      if (matchingComp) return matchingComp;
+      if (matchingComp) {
+        const auth = validateVerificationAuthority(matchingComp, options);
+        if (!auth.valid) return { ...matchingComp, status: "failed", reasonCode: auth.error.code };
+        return matchingComp;
+      }
     }
     const childCandidates = allChecks.filter((candidate) => matchesRequirement(candidate, child));
-    return latestAuthoritativeCheck(childCandidates);
+    const childCheck = latestAuthoritativeCheck(childCandidates);
+    if (childCheck) {
+      const auth = validateVerificationAuthority(childCheck, options);
+      if (!auth.valid) return { ...childCheck, status: "failed", reasonCode: auth.error.code };
+    }
+    return childCheck;
   });
   if (statuses.some((item) => !item)) return "MISSING";
   if (statuses.some((item) => item.status === "failed")) return "INVALID";
@@ -265,7 +275,20 @@ function componentStatus(check, requirement, allChecks = []) {
   return "COVERED";
 }
 
-export function evaluateRequiredEvidence({ requirements = [], checks = [] } = {}) {
+export function evaluateRequiredEvidence({
+  requirements = [],
+  checks = [],
+  target,
+  taskId,
+  authorities,
+  options = {},
+} = {}) {
+  const authOptions = {
+    ...(target ? { target } : {}),
+    ...(taskId ? { taskId } : {}),
+    ...(authorities ? { authorities } : {}),
+    ...options,
+  };
   const normalized = normalizeRequirements(requirements);
   const result = {
     ready: true,
@@ -291,8 +314,11 @@ export function evaluateRequiredEvidence({ requirements = [], checks = [] } = {}
     }
     const candidates = checks.filter((check) => matchesRequirement(check, requirement));
     const check = latestAuthoritativeCheck(candidates);
-    const compound = componentStatus(check, requirement, checks);
-    if (compound === "INVALID" || check?.status === "failed") {
+    const auth = check ? validateVerificationAuthority(check, authOptions) : { valid: true };
+    const compound = componentStatus(check, requirement, checks, authOptions);
+    if (!auth.valid) {
+      result.invalid.push({ ...requirement, reasonCode: auth.error.code });
+    } else if (compound === "INVALID" || check?.status === "failed") {
       result.invalid.push(requirement);
     } else if (compound === "PARTIAL") {
       result.partial.push(requirement);

package/src/core/inspect.js

@@ -8,6 +8,7 @@ import { createEvidence } from "./evidence.js";
 import { runDoctor } from "../commands/doctor.js";
 import { findProfilePath } from "./profile.js";
 import { FORGELOOP_KIT_DIR } from "./target-layout.js";
+import { trustedAuthorityConfiguration } from "./trusted-authority.js";
 
 function profileMetadata(bytes) {
   const text = bytes.toString("utf8");
@@ -17,7 +18,7 @@ function profileMetadata(bytes) {
   };
 }
 
-export async function inspectTarget({ target, packageRoot, contractFile = null }) {
+export async function inspectTarget({ target, packageRoot, contractFile = null, authorityContext, runtimeContext }) {
   let manifest = null;
   let manifestError = null;
   try {
@@ -91,6 +92,7 @@ export async function inspectTarget({ target, packageRoot, contractFile = null }
   ];
   return {
     target: { path: target },
+    authority: trustedAuthorityConfiguration({ target, authorityContext, runtimeContext }),
     manifest: {
       present: manifest !== null,
       status: manifestError ? "invalid" : manifest ? "ready" : "missing",

package/src/core/next-action.js

@@ -236,7 +236,16 @@ async function loadArtifact(loader, fallback) {
   }
 }
 
-async function requirementsAndCoverage({ target, packageRoot, contract, route, checks, additionalEvidence = [] }) {
+async function requirementsAndCoverage({
+  target,
+  packageRoot,
+  contract,
+  route,
+  checks,
+  additionalEvidence = [],
+  authorityContext,
+  runtimeContext,
+}) {
   const requirements = await requiredEvidenceForTarget({
     target,
     contract,
@@ -244,14 +253,21 @@ async function requirementsAndCoverage({ target, packageRoot, contract, route, c
     packageRoot,
     additionalEvidence,
   });
-  return { requirements, coverage: coverageForRequirements(requirements, checks) };
+  return {
+    requirements,
+    coverage: coverageForRequirements(requirements, checks, {
+      target,
+      taskId: contract?.value?.taskId,
+      options: { authorityContext, runtimeContext },
+    }),
+  };
 }
 
 export async function getNextAction(targetOrOptions = {}, packageRootOption) {
   const normalized = typeof targetOrOptions === "string"
     ? { target: targetOrOptions, packageRoot: packageRootOption }
     : targetOrOptions;
-  const { target, packageRoot } = normalized ?? {};
+  const { target, packageRoot, authorityContext, runtimeContext } = normalized ?? {};
   const workState = await loadArtifact(
     () => readWorkState(target, packageRoot),
     ARTIFACT_PATHS.state,
@@ -544,6 +560,8 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       route,
       checks: state.checks,
       additionalEvidence: preflight.policy?.requiredEvidence ?? [],
+      authorityContext,
+      runtimeContext,
     });
     const authoritative = authoritativeChecksForRequirements({
       requirements: ordinaryLeafRequirements(evidence.requirements),
@@ -587,7 +605,12 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       );
     }
     try {
-      await validateReceipt(receipt.value.value, packageRoot);
+      await validateReceipt(receipt.value.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       return decision(
         context,
@@ -596,7 +619,13 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
         [...requiredArtifacts, ARTIFACT_PATHS.receipt],
       );
     }
-    const readiness = evaluateRequiredEvidence({ requirements: evidence.requirements, checks: state.checks });
+    const readiness = evaluateRequiredEvidence({
+      requirements: evidence.requirements,
+      checks: state.checks,
+      target,
+      taskId: contract?.value?.taskId,
+      options: { authorityContext, runtimeContext },
+    });
     const receiptRelationships = completionRelationshipErrors({
       contract,
       route,
@@ -604,8 +633,26 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       receipt: receipt.value.value,
       requiredEvidence: evidence.requirements,
       requireRequiredChecks: false,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     if (receiptRelationships.length > 0) {
+      if (receiptRelationships.some((err) => (
+        err.code === "E_RECEIPT_STATE_MISMATCH"
+        || err.code === "E_RECEIPT_CYCLE_MISMATCH"
+        || err.code === "E_RECEIPT_CONTRACT_MISMATCH"
+        || err.code === "E_ROUTE_GUIDE_MISMATCH"
+        || err.code === "E_EVIDENCE_COVERAGE_INVALID"
+      ))) {
+        return decision(
+          context,
+          NEXT_ACTIONS.PREPARE_COMPLETION,
+          artifactError("E_RECEIPT_STATE_MISMATCH", "Run forgeloop prepare-completion to refresh the execution receipt with current state", [ARTIFACT_PATHS.receipt]),
+          [...requiredArtifacts, ARTIFACT_PATHS.receipt],
+        );
+      }
       return result({
         ...context,
         nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER,
@@ -670,8 +717,16 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       route,
       checks: state.checks,
       additionalEvidence: preflight.policy?.requiredEvidence ?? [],
+      authorityContext,
+      runtimeContext,
+    });
+    const readiness = evaluateRequiredEvidence({
+      requirements: evidence.requirements,
+      checks: state.checks,
+      target,
+      taskId: contract?.value?.taskId,
+      options: { authorityContext, runtimeContext },
     });
-    const readiness = evaluateRequiredEvidence({ requirements: evidence.requirements, checks: state.checks });
     if (!readiness.ready) {
       let recoveryAuthorized = false;
       if (state.lastCompletionAttempt?.status === "REJECTED") {
@@ -737,7 +792,12 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       );
     }
     try {
-      await validateReceipt(receipt.value.value, packageRoot);
+      await validateReceipt(receipt.value.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       return decision(
         context,
@@ -752,8 +812,26 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       state,
       receipt: receipt.value.value,
       requiredEvidence: evidence.requirements,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     if (receiptRelationships.length > 0) {
+      if (receiptRelationships.some((err) => (
+        err.code === "E_RECEIPT_STATE_MISMATCH"
+        || err.code === "E_RECEIPT_CYCLE_MISMATCH"
+        || err.code === "E_RECEIPT_CONTRACT_MISMATCH"
+        || err.code === "E_ROUTE_GUIDE_MISMATCH"
+        || err.code === "E_EVIDENCE_COVERAGE_INVALID"
+      ))) {
+        return decision(
+          context,
+          NEXT_ACTIONS.PREPARE_COMPLETION,
+          artifactError("E_RECEIPT_STATE_MISMATCH", "Run forgeloop prepare-completion to refresh the execution receipt with current state", [ARTIFACT_PATHS.receipt]),
+          [...requiredArtifacts, ARTIFACT_PATHS.receipt],
+        );
+      }
       return result({
         ...context,
         nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER,
@@ -761,7 +839,7 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
         requiredArtifacts: [...requiredArtifacts, ARTIFACT_PATHS.receipt],
       });
     }
-    const completion = await evaluateCompletion({ target, packageRoot });
+    const completion = await evaluateCompletion({ target, packageRoot, authorityContext, runtimeContext });
     if (completion.status !== "VALID") {
       const terminalPendingErrors = completion.errors.filter((err) => (
         err.code === "E_PUBLICATION_REQUIREMENT_PENDING" || err.code === "E_PRODUCTION_REQUIREMENT_PENDING"
@@ -793,7 +871,7 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
     return decision(context, NEXT_ACTIONS.RUN_COMPLETE, artifactError("COMPLETION_READY", "Completion artifacts and cross-artifact validation are valid"));
   }
   if (state.phase === "COMPLETE") {
-    const completion = await evaluateCompletion({ target, packageRoot });
+    const completion = await evaluateCompletion({ target, packageRoot, authorityContext, runtimeContext });
     if (completion.status === "VALID") {
       return decision(context, NEXT_ACTIONS.NONE, artifactError("PHASE_COMPLETE", "Completion is validator-backed and terminal"));
     }

package/src/core/phase.js

@@ -101,7 +101,7 @@ function reconcileImplementationStep(state, toPhase) {
   };
 }
 
-async function assertPhasePrerequisites(target, state, toPhase, packageRoot) {
+async function assertPhasePrerequisites(target, state, toPhase, packageRoot, authorityContext, runtimeContext) {
   if (toPhase === "CONTRACT_READY" || toPhase === "ROUTED" || toPhase === "EXECUTING") {
     try {
       await readContract(target, packageRoot);
@@ -127,7 +127,7 @@ async function assertPhasePrerequisites(target, state, toPhase, packageRoot) {
     throw phaseError("E_PHASE_EVIDENCE_MISSING", "COMPLETE requires verification evidence");
   }
   if (toPhase === "COMPLETE") {
-    const completion = await evaluateCompletion({ target, packageRoot, persist: false });
+    const completion = await evaluateCompletion({ target, packageRoot, persist: false, authorityContext, runtimeContext });
     if (completion.status !== "VALID") {
       throw phaseError("E_COMPLETION_REJECTED", "COMPLETE requires a valid completion audit", completion.errors.flatMap((error) => error.artifacts ?? []));
     }
@@ -136,11 +136,16 @@ async function assertPhasePrerequisites(target, state, toPhase, packageRoot) {
 
 export async function advanceWorkState(target, toPhase, options = {}) {
   const normalizedOptions = typeof options === "string" ? { packageRoot: options } : options;
-  const { packageRoot, now = new Date().toISOString() } = normalizedOptions;
+  const {
+    packageRoot,
+    now = new Date().toISOString(),
+    authorityContext,
+    runtimeContext,
+  } = normalizedOptions;
   assertWorkPhase(toPhase);
   const state = await readWorkState(target, packageRoot);
   if (!state) throw phaseError("E_PHASE_PREREQUISITE_MISSING", "Cannot advance without work state", [ARTIFACT_PATHS.state]);
-  await assertPhasePrerequisites(target, state, toPhase, packageRoot);
+  await assertPhasePrerequisites(target, state, toPhase, packageRoot, authorityContext, runtimeContext);
   await assertPersistedStateIdentity(target, state, toPhase, packageRoot);
   if (!isValidTransition(state.phase, toPhase)) {
     throw phaseError("E_PHASE_TRANSITION_INVALID", `Invalid work-state transition: ${state.phase} -> ${toPhase}`);
@@ -231,7 +236,12 @@ export async function advanceWorkState(target, toPhase, options = {}) {
       packageRoot,
       additionalEvidence: preflight.policy?.requiredEvidence ?? [],
     });
-    await validateReceipt(receipt.value, packageRoot);
+    await validateReceipt(receipt.value, packageRoot, {
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
+    });
     assertCompletionRelationships({
       contract,
       route,
@@ -240,12 +250,21 @@ export async function advanceWorkState(target, toPhase, options = {}) {
       requiredEvidence,
       requireRequiredChecks: false,
       requireReceiptStateFingerprint: false,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     nextReceipt = await createReceipt({
       ...receipt.value,
       stateFingerprint: canonicalFingerprint(next),
       verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-    }, packageRoot);
+    }, packageRoot, {
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
+    });
     assertCompletionRelationships({
       contract,
       route,
@@ -253,6 +272,10 @@ export async function advanceWorkState(target, toPhase, options = {}) {
       receipt: nextReceipt,
       requiredEvidence,
       requireRequiredChecks: false,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
   } catch (error) {
     if (error.code !== "ARTIFACT_MISSING") throw error;

package/src/core/protocol.js

@@ -81,6 +81,11 @@ export const FAILURE_CODES = Object.freeze([
   "E_TERMINAL_REQUIREMENT_NOT_TERMINAL",
   "E_TERMINAL_REQUIREMENT_TYPE_MISMATCH",
   "E_TERMINAL_STATUS_REGRESSION",
+  "E_INSTALLATION_AUTHORITY_REQUIRED",
+  "E_AUTHORITY_INVALID",
+  "E_AUTHORITY_SCOPE_MISMATCH",
+  "E_AUTHORITY_UNTRUSTED_SOURCE",
+  "E_VERIFICATION_TOOL_UNAVAILABLE",
 ]);
 
 export const WORK_PHASES = Object.freeze([

package/src/core/receipt.js

@@ -56,7 +56,7 @@ function assertKnownGuides(guides) {
   if (new Set(guides).size !== guides.length) throw new Error("Receipt selectedGuides must not contain duplicates");
 }
 
-export function assertReceiptSemantics(receipt) {
+export function assertReceiptSemantics(receipt, options = {}) {
   const evidence = receipt.evidence ?? [];
   if (receipt.verificationCycle !== undefined
     && (!Number.isInteger(receipt.verificationCycle) || receipt.verificationCycle < 1)) {
@@ -66,7 +66,7 @@ export function assertReceiptSemantics(receipt) {
 
   for (const [index, check] of receipt.checks.entries()) {
     if (check?.schemaVersion !== undefined || check?.id !== undefined || check?.evidenceKind !== undefined) {
-      assertCheck(check, `receipt.checks[${index}]`);
+      assertCheck(check, `receipt.checks[${index}]`, options);
       continue;
     }
     if (check?.status === "passed") {
@@ -132,15 +132,15 @@ export function assertReceiptSemantics(receipt) {
   return receipt;
 }
 
-export async function validateReceipt(receipt, packageRoot) {
+export async function validateReceipt(receipt, packageRoot, options = {}) {
   assertSecretFree(receipt);
   const schema = await readSchema("execution-receipt", packageRoot);
   assertSchema(receipt, schema, "execution receipt");
   assertKnownGuides(receipt.selectedGuides);
-  return assertReceiptSemantics(receipt);
+  return assertReceiptSemantics(receipt, options);
 }
 
-export async function createReceipt(input, packageRoot) {
+export async function createReceipt(input, packageRoot, options = {}) {
   assertSecretFree(input);
   const receipt = {
     schemaVersion: RECEIPT_SCHEMA_VERSION,
@@ -169,5 +169,5 @@ export async function createReceipt(input, packageRoot) {
       deployed: false,
     },
   };
-  return validateReceipt(receipt, packageRoot);
+  return validateReceipt(receipt, packageRoot, options);
 }