@cassiomc1/forgeloop 0.1.13 → 0.1.15

package/.forgeloop/forgeloop.gitignore

@@ -1,2 +1,3 @@
 # Local resumable task state is untrusted, target-specific data.
 work-state.json
+executions/

package/LOOP_ENGINEERING.md

@@ -52,6 +52,7 @@ the supported ForgeLoop lifecycle commands or canonical ForgeLoop APIs:
 - `.forgeloop/work-state.json`
 - `.forgeloop/events.ndjson`
 - `.forgeloop/execution-receipt.json`
+- `.forgeloop/executions/<executionId>.json`
 - completion recovery metadata
 - canonical check/evidence state
 - terminal-result lifecycle state
@@ -108,6 +109,60 @@ rules permit it.
 A missing checker must never be converted into environmental mutation merely
 to make verification pass.
 
+### Verification command resolution modes and validator enforcement
+
+Every verification command path is classified by resolution mode:
+
+| Mode | Examples | May install software | Authority required |
+| --- | --- | --- | --- |
+| `LOCAL_EXECUTABLE` | `node scripts/test.js`, `python3 -m unittest`, `./bin/check` | No | No |
+| `LOCAL_PACKAGE_BINARY` | `./node_modules/.bin/tool`, `npm test`, `pnpm test`, `yarn test` | No | No |
+| `NON_INSTALLING_RESOLUTION` | `npx --no-install tool`, `npx --no tool` | No | No |
+| `INSTALL_CAPABLE_RESOLUTION` | `npx tool`, `npm exec tool`, `npm x tool`, `pnpm dlx tool`, `yarn dlx tool`, `bunx tool`, `uvx tool`, `pipx run tool` | Yes | Yes (`E_INSTALLATION_AUTHORITY_REQUIRED`) |
+| `EXPLICIT_INSTALLATION` | `npm install tool`, `pnpm add tool`, `pip install tool`, `cargo install tool` | Yes | Yes (`E_INSTALLATION_AUTHORITY_REQUIRED`) |
+
+**Validator-enforced rule**: Any verification command executed via an installation-capable or explicit-installation resolution mode without a valid canonical installation authority grant is rejected by `record-check`, `audit`, and `complete` with error code `E_INSTALLATION_AUTHORITY_REQUIRED`, `E_AUTHORITY_INVALID`, `E_AUTHORITY_SCOPE_MISMATCH`, or `E_AUTHORITY_UNTRUSTED_SOURCE` and cannot contribute to `VALID` completion.
+
+Recognized command dispatchers (such as `npm test`, `npm start`, `npm stop`, `npm restart`, `npm run <script>`, `npm run-script <script>`, `npm rum <script>`, `npm urn <script>`) are classified by their effective package resolution behavior across recognized lifecycle scripts before process launch. npm invocation parsing recognizes options (e.g. `--silent`, `--loglevel=error`) before the subcommand. Recognized npm-script dispatch is resolved recursively before process launch. `npm restart` uses npm's restart-specific lifecycle semantics (`prerestart`, `prestop`, `stop`, `poststop`, `prestart`, `start`, `poststart`, `postrestart` when `restart` is absent; `prerestart`, `restart`, `postrestart` when `restart` is present) rather than generic pre/main/post handling. ForgeLoop fails closed (`mayInstall: true`) when recursive npm-script resolution encounters a cycle or exceeds its maximum resolution depth (16). ForgeLoop does not resolve npm workspace selection in `run-check` for `0.1.15`. npm script executions using `--workspace`, `-w`, `--workspaces`, or `--ws` fail closed (`E_COMMAND_RESOLUTION_AMBIGUOUS`) because the effective `package.json` execution context may differ from the current ForgeLoop target. Run ForgeLoop against the selected workspace directory directly instead. If any nested lifecycle script invokes an installation-capable command (such as `npx`, `npm exec`, or `pnpm dlx`), the execution is elevated to `INSTALL_CAPABLE_RESOLUTION` and blocked before launch without authority.
+
+**npm Classification Model**: npm classification is semantic and fail-closed. Unknown npm commands are not assumed safe. The classifier specifically identifies install-capable families including: `exec`/`x`, `install` aliases, `ci` aliases, `install-test` families, `install-ci-test` families, `update` aliases, `audit fix`, and conditional `init`/`create`/`innit` invocations. Unknown or ambiguous semantics fail closed (`E_COMMAND_RESOLUTION_AMBIGUOUS`).
+
+Use `forgeloop run-check --id <id> --requirement <requirement> -- <argv>` for
+observed command evidence. ForgeLoop preserves the exact argv vector, target
+cwd, resolution classification, timestamps, exit status, and task/check
+binding in `.forgeloop/executions/<executionId>.json` before recording the
+check. Resolution is classified before process launch; install-capable
+resolution is rejected without a valid host-attested authority, while
+`npx --no-install` remains a non-installing path and may fail honestly when a
+tool is absent. `run-check` launches the supplied argv without a shell.
+
+`forgeloop record-check` is serialization-only. Its `--command` value is
+metadata and is never executed. A `kind: command`, `evidenceKind: OBSERVED`
+check must carry `provenance: FORGELOOP_EXECUTED` and a valid `executionRef`;
+manual or actor-reported observations must use an explicit non-command kind or
+provenance and must not be upgraded to command execution evidence. Completion,
+audit, protocol validation, and bundles revalidate the referenced artifact and
+its task, check, requirement, cycle, cwd, status, and exit-code binding.
+
+Authority cannot be self-issued by the actor consuming it. Boolean fields inside verification evidence (such as `installationAuthorized: true`) are not sufficient proof of installation authority. Installation authority must be established via a canonical authority grant supplied by a host/operator trust boundary and referenced via `installationAuthorityRef`.
+
+The runtime authority context has two modes:
+
+- `NONE` is the default for the actor-facing standalone CLI. `FORGELOOP_AUTHORITY_FILE` and `FORGELOOP_AUTHORITY_DIR` may select candidate source metadata for compatibility and diagnostics, but they do not make a source trusted. An environment-selected source is rejected with `E_AUTHORITY_UNTRUSTED_SOURCE` when it is used for an installation-capable verification.
+- `HOST_ATTESTED` is an internal integration context supplied by a host-owned wrapper, embedded API, or equivalent boundary. It may select a trusted authority file, directory, or in-memory provider only when the actor cannot replace that context at command invocation time. The CLI exposes no flag that promotes a source to `HOST_ATTESTED`.
+
+External path is not equivalent to external authority ownership. The host-attested source must still resolve outside the actor-writable target, and a project-local `.forgeloop/authorities/` artifact remains an untrusted reference, cache, diagnostic, or mirror by default. A local claim such as `source: operator` is not proof of operator authority.
+
+ForgeLoop validates authority semantics, while the host defines the trust boundary. If the host grants the actor write access to the configured attested source, the host boundary is compromised and ForgeLoop cannot distinguish operator authority from actor fabrication without a stronger external trust anchor.
+
+### Stale receipt recovery invariant
+
+Every recovery action returned by `forgeloop next` must be executable from the state that produced it. When work state changes legitimately after preparing a completion receipt, `forgeloop prepare-completion` refreshes the receipt and re-binds it to current state and changed paths without requiring manual deletion of `.forgeloop/execution-receipt.json`.
+
+### Conformance profile escalation policy
+
+A run started in Standard conformance must not be silently escalated to Strict after validator-backed completion. Strict validation is a separate conformance profile. If Strict revalidation is performed after Standard `COMPLETE`, it is treated as a distinct revalidation cycle and does not retroactively invalidate a valid Standard result.
+
 ## Blocking vs Non-Blocking Decisions
 
 Classify every unresolved decision before deciding whether to ask the user.
@@ -476,7 +531,7 @@ prepare-completion
     ↓
 run applicable project checks
     ↓
-record observed results with record-check
+run commands with run-check; record manual observations with record-check
     ↓ forgeloop next
 advance --to REVIEWING
     ↓ forgeloop next
@@ -491,10 +546,11 @@ subsequent `record-check` operations; completion remains invalid until required
 observed evidence, review state, chronology, and validator requirements are
 satisfied.
 
-The host agent runs applicable checks after the receipt exists, records their
-observed results with `record-check`, and queries `forgeloop next` before each
-subsequent lifecycle action. `record-check` records results already observed by
-the agent; it never executes the supplied command text.
+The host agent runs applicable checks after the receipt exists, uses `run-check`
+for commands, and uses `record-check` for manual or non-command observations.
+`run-check` records exact command provenance; `record-check` records supplied
+metadata only and never executes its `--command` value. Query `forgeloop next`
+before each subsequent lifecycle action.
 
 Continue until the terminal outcome is either validator-backed `COMPLETE` or
 an explicitly reported `BLOCKED` / `PARTIALLY VERIFIED` result with exact

package/PROTOCOL_INTEGRATION.md

@@ -128,6 +128,7 @@ The following protocol artifacts are strictly owned by ForgeLoop:
 - `.forgeloop/work-state.json`
 - `.forgeloop/events.ndjson`
 - `.forgeloop/execution-receipt.json`
+- `.forgeloop/executions/<executionId>.json`
 - Canonical check, evidence, and terminal-result state
 
 If the required CLI or API capability cannot be resolved:
@@ -140,6 +141,38 @@ If the required CLI or API capability cannot be resolved:
 
 Report the corresponding ForgeLoop dimension as `NOT_VERIFIED` / `E_FORGELOOP_CLI_UNAVAILABLE`.
 
+## Trusted command provenance
+
+Command verification has two explicit paths:
+
+- `forgeloop run-check --id <id> --requirement <requirement> -- <argv>` owns
+  execution. It classifies the exact argv before launch, uses a non-shell
+  process boundary, records the target cwd, resolution mode, timestamps,
+  exit status, and task/check binding in
+  `.forgeloop/executions/<executionId>.json`, then records an `OBSERVED` check
+  with `provenance: FORGELOOP_EXECUTED`.
+- `forgeloop record-check` owns serialization only. `--command` is metadata and
+  is never launched. A `kind: command` check with `evidenceKind: OBSERVED`
+  requires both `executionRef` and `FORGELOOP_EXECUTED`; manual or actor-reported
+  observations use their explicit non-command/provenance values and remain
+  distinguishable from process execution.
+
+`run-check` rejects install-capable resolution before process launch unless the
+host supplies a valid trusted authority context. `npm exec` and `npm x` are
+installation-capable resolution paths. Recognized command dispatchers (such as
+`npm test`, `npm restart`, `npm run`, `npm rum`, `npm urn`) are resolved
+recursively across recognized lifecycle scripts before launch with cycle
+detection, leading option normalization, and restart-specific lifecycle fallback.
+npm workspace script executions (`--workspace`, `-w`, `--workspaces`, `--ws`) fail
+closed before launch with `E_COMMAND_RESOLUTION_AMBIGUOUS` because the effective
+`package.json` context cannot be proven from the root target. Unknown npm command semantics are rejected before execution rather than downgraded to local execution. ForgeLoop uses an explicit non-installing allowlist instead of assuming that unrecognized npm commands are safe. `npx --no-install` is
+an allowed non-installing resolution and can return a normal failed result when
+the requested tool is unavailable. Completion, audit, `validate-protocol`, and task
+bundles revalidate execution references rather than trusting duplicated check
+metadata. Invalid or missing references return `E_EXECUTION_REF_INVALID`; an
+observed command without ForgeLoop provenance returns
+`E_COMMAND_PROVENANCE_UNATTESTED`.
+
 ## Missing tool capability
 
 A missing tool is a capability gap, not installation authority.
@@ -152,6 +185,77 @@ not already available:
 - otherwise report the affected verification dimension as not verified with
   `E_VERIFICATION_TOOL_UNAVAILABLE`.
 
+Every verification command is classified by resolution mode (`LOCAL_EXECUTABLE`,
+`LOCAL_PACKAGE_BINARY`, `NON_INSTALLING_RESOLUTION`, `INSTALL_CAPABLE_RESOLUTION`,
+`EXPLICIT_INSTALLATION`). Any command that uses an install-capable or installation
+path without a valid canonical authority reference is rejected by `record-check`,
+`audit`, and `complete` with `E_INSTALLATION_AUTHORITY_REQUIRED`, `E_AUTHORITY_INVALID`,
+`E_AUTHORITY_SCOPE_MISMATCH`, or `E_AUTHORITY_UNTRUSTED_SOURCE`.
+
+```text
+capability ≠ authority
+evidence ≠ authority grant
+actor claim ≠ operator grant
+```
+
+Authority cannot be self-issued by the actor consuming it. Boolean fields inside
+verification evidence are not sufficient proof of installation authority.
+
+### Authority provenance
+
+Authority provenance is external to actor-authored project state. An external
+path is not equivalent to external authority ownership:
+
+```text
+outside target
+≠
+outside actor control
+```
+
+The standalone CLI uses `trustMode: NONE`. `FORGELOOP_AUTHORITY_FILE` and
+`FORGELOOP_AUTHORITY_DIR` select candidate authority sources, but they do not
+make a source trusted in actor-facing execution. Environment-selected sources
+are rejected with `E_AUTHORITY_UNTRUSTED_SOURCE` for install-capable checks.
+
+Trusted authority requires an explicit `HOST_ATTESTED` runtime context supplied
+through an integration boundary the active actor cannot replace at command
+invocation time. Configuration is not trust:
+
+```text
+environment-selected source
+≠
+host-attested source
+
+configuration
+≠
+trust
+```
+
+The host-attested source must still resolve outside the actor-writable target. A
+project-local authority reference may identify a grant, but it does not create
+the root of trust.
+
+```text
+actor-authored evidence
+≠
+trusted authority
+
+project-local file
+≠
+host grant
+
+declared provenance
+≠
+verified provenance
+```
+
+A local artifact claiming `source: operator` is not sufficient proof of operator
+authority. The actor-facing CLI must not expose an equivalent of
+`--authority-source-attested-by-host` or `--trusted-authority-file` that
+self-promotes a source. If the host exposes the attested source as writable to
+the actor, the host boundary has been compromised and ForgeLoop cannot provide
+cryptographic attestation by itself.
+
 Never convert `PROTOCOL_LIMITED` into environmental mutation by implicitly
 installing a package.
 

package/README.md

@@ -109,11 +109,15 @@ The regression suite injects failures at these boundaries and verifies that
 owned cleanup. The frozen published installation under
 [`tests/fixtures/legacy-0.1.6/`](./tests/fixtures/legacy-0.1.6/) is derived
 from the real npm tarball, includes provenance and digests, and is copied into
-The current published release is `@cassiomc1/forgeloop@0.1.13`.
-Earlier `0.1.8`, `0.1.9`, `0.1.10`, `0.1.11`, and `0.1.12` references are historical; never move
-their tags or `v0.1.10`. Version `0.1.13` enforces the missing verification tool
-policy, conditional single-actor delegation validation, and a universal
-vendor-neutral engineering protocol positioning.
+The latest verified published npm release is `@cassiomc1/forgeloop@0.1.14`.
+The repository package candidate is `@cassiomc1/forgeloop@0.1.15`; it is not
+published yet.
+Earlier `0.1.8`, `0.1.9`, `0.1.10`, `0.1.11`, `0.1.12`, and `0.1.13` references are historical; never move
+their tags or `v0.1.10`. Release `0.1.14` enforces verification installation
+authority, provides recoverable stale receipt lifecycle in `prepare-completion`,
+and validates single-actor protocol runs. The `0.1.15` candidate adds trusted
+command execution provenance without changing the v1 lifecycle or authority
+boundary.
 
 ## How to prompt ForgeLoop
 
@@ -203,12 +207,14 @@ project without overwriting local instructions. When the package is available
 in the npm registry, use the commands below; otherwise use the repository
 checkout fallback.
 
-The current published release is `@cassiomc1/forgeloop@0.1.13`.
-Pin this version when a reproducible blind run or release-identity check is
-required:
+The current repository package candidate is `@cassiomc1/forgeloop@0.1.15` and is
+not yet published.
+The latest verified published npm release is `@cassiomc1/forgeloop@0.1.14`.
+For reproducible published-package runs or release-identity checks,
+pin the published version:
 
 ```bash
-npx @cassiomc1/forgeloop@0.1.13 --version
+npx @cassiomc1/forgeloop@0.1.14 --version
 npx @cassiomc1/forgeloop init
 npx @cassiomc1/forgeloop doctor
 npx @cassiomc1/forgeloop update
@@ -231,7 +237,8 @@ npx @cassiomc1/forgeloop advance --to PLANNED
 npx @cassiomc1/forgeloop advance --to EXECUTING
 npx @cassiomc1/forgeloop advance --to VERIFYING
 npx @cassiomc1/forgeloop prepare-completion --json
-npx @cassiomc1/forgeloop record-check --id tests --requirement tests --status passed --evidence-kind OBSERVED --command "npm test" --result "exit 0" --exit-code 0 --json
+npx @cassiomc1/forgeloop run-check --json --id tests --requirement tests -- npm test
+npx @cassiomc1/forgeloop record-check --id docs-review --kind manual-review --requirement "documentation synchronized" --status passed --evidence-kind OBSERVED --provenance MANUAL_OBSERVATION --result "reviewed" --json
 npx @cassiomc1/forgeloop record-terminal-result --requirement "Package published" --type PUBLICATION --status published --source "npm publish" --result "Published package to npm" --json
 npx @cassiomc1/forgeloop advance --to REVIEWING
 npx @cassiomc1/forgeloop audit --json
@@ -261,7 +268,7 @@ implementation
 → forgeloop next
 → prepare-completion
 → forgeloop next
-→ checks + record-check
+→ checks + run-check/record-check
 → forgeloop next
 → advance --to REVIEWING
 → forgeloop next
@@ -285,10 +292,15 @@ Before implementation, write the canonical contract, persist the route, create
 required gate artifacts under `.forgeloop/gates/`, and require `preflight` to
 return `READY`. `advance` enforces legal phase transitions; it never runs the
 project's commands. After implementation, advance to `VERIFYING`, use
-`prepare-completion` to create a safe receipt skeleton, and use `record-check`
-to serialize results that the agent has already observed. `record-check` never
-executes the supplied command text. Advance to `REVIEWING` before running
-`audit` and `complete`.
+`prepare-completion` to create a safe receipt skeleton, use `run-check` for
+commands, and use `record-check` for manual or non-command observations.
+`run-check` accepts the exact argv after `--`, classifies resolution before
+launch, blocks install-capable resolution without trusted host authority, and
+writes `.forgeloop/executions/<executionId>.json` before recording the check.
+`record-check` never executes `--command`; that option is metadata only. A
+command check with `OBSERVED` evidence must reference a ForgeLoop execution
+artifact with `provenance: FORGELOOP_EXECUTED`. Advance to `REVIEWING` before
+running `audit` and `complete`.
 `audit` is a read-only consistency check. `complete` validates the final
 contract, route, gates, phase ledger, structured evidence, coverage, receipt,
 and freshness before it can return `VALID`. `report` renders the same result as
@@ -372,12 +384,18 @@ target project. Its main threat boundaries are:
 | Data exposure | Receipts and checkpoints reject secret-like keys and values; examples use placeholders, and the repository secret scanner runs in CI. |
 | Unsafe update overwrite | `update` preserves locally modified files and the target's `.forgeloop/kit/PROJECT_PROFILE.md`; adoption and writes remain bounded to the selected target. |
 | Dependency supply chain | Runtime code uses Node built-ins only; the package does not install agents, providers, plugins, or remote services. |
+| Installation authority provenance | Standalone CLI uses `trustMode: NONE`: environment-selected `FORGELOOP_AUTHORITY_FILE`/`FORGELOOP_AUTHORITY_DIR` sources are untrusted candidates; only an internal `HOST_ATTESTED` context may select a trusted source outside the actor-writable target. Project-local authority claims remain untrusted. |
 | Stale replay | Work state records contract and repository fingerprints; drift requires revalidation and never reruns destructive or publication actions automatically. |
 | Unverified publication | Receipts carry explicit publication booleans; local success never implies a push, pull request, merge, release, or deployment. |
+| Unattested observed command | `record-check --command` is metadata only; command `OBSERVED` evidence requires a bound ForgeLoop execution artifact. `run-check` preserves exact argv, target cwd, resolution mode, timestamps, and exit status, and rejects install-capable resolution before launch without trusted host authority. |
 
 The full boundary inventory, residual limitations, and executable evidence are
 in [`THREAT_MODEL.md`](./THREAT_MODEL.md).
 
+An external path is not equivalent to external authority ownership. Actor-controlled
+environment configuration is not sufficient proof of host/operator authority;
+trusted authority requires a host-attested integration boundary.
+
 The CLI cannot protect a target from a separately privileged or hostile process
 that changes the filesystem after validation. Consumers must still review
 permissions, package provenance, and external actions before granting authority.
@@ -642,7 +660,7 @@ adoption. Local rendering requires Node.js 22+ and FFmpeg.
 The source repository keeps canonical documents at the root for package
 development and validation. A bootstrapped target uses the hidden-kit layout
 shown above; mutable contract, route, state, gate, event, preflight, and
-receipt artifacts remain directly under `.forgeloop/`.
+receipt and execution artifacts remain directly under `.forgeloop/`.
 
 ## Maintenance
 

package/THREAT_MODEL.md

@@ -20,6 +20,7 @@ remaining trust boundaries and their executable evidence.
 | Lifecycle artifact repair | Direct state or receipt edits fabricate a legal recovery or terminal phase | Work state, receipt, evidence checks, and event ledger | New verification cycles record phase events and fingerprints; validators reject state/ledger divergence and future lifecycle evidence | Local artifacts are detection-oriented, not cryptographically tamper-proof against a privileged process rewriting every linked artifact | `tests/lifecycle-evidence-recovery.test.js`, `tests/completion-ergonomics.test.js` |
 | Unsupported profile fact | Turns an agent decision into a durable user fact | `PROJECT_PROFILE.md` and `.forgeloop/sources.json` | Source IDs, source-kind validation, unknown-reference rejection, and explicit misclassification failures | Arbitrary Markdown semantics still require a human or host-specific parser | `tests/profile-provenance.test.js`, `src/core/profile.js` |
 | Weak verification | Treats a vague or inferred claim as observed evidence | Receipt checks and coverage | Versioned check schema, contradictory-status rejection, observed-evidence requirements, and coverage matrix | Evidence remains local and declarative; it is not a remote attestation service | `tests/evidence-coverage.test.js`, `tests/completion.test.js` |
+| Unattested observed command | An actor supplies `--command "..."` or forged command metadata and makes an unrun process appear to be observed evidence | Check provenance, execution artifact, and process boundary | `run-check` captures exact argv, cwd, resolution, timestamps, exit status, and task/check binding; it classifies before launch, uses `shell: false`, and rejects install-capable resolution without trusted authority. `record-check --command` is metadata only; command `OBSERVED` checks require `FORGELOOP_EXECUTED` plus a valid `executionRef`; completion, audit, protocol validation, and bundles revalidate it | The local execution artifact is not cryptographic remote attestation, and a separately privileged process can alter the target after execution | `tests/run-check.test.js`, `tests/completion-cli.test.js`, `tests/verification-capability.test.js`, `tests/validate-protocol-cli.test.js` |
 | Malicious receipt | Turns local claims into false publication or completion claims | Execution receipt JSON | Semantic evidence checks for completion, checks, review, push, commit, and deployment; explicit publication booleans | Evidence text is declarative and must still be reviewed for provenance | `tests/receipt-semantics.test.js`, `tests/observability.test.js` |
 | Malicious task brief | Grants a child task more authority than intended | Delegation brief JSON and host harness | Relative path boundaries, guide/verification/authority checks, secret-free validation, set validation, parent integration ownership | The host harness remains responsible for OS permissions and execution policy | `tests/delegation.test.js`, `tests/delegation-set.test.js` |
 | Artifact content exposure | Sensitive material enters portable artifacts or diagnostics | State, receipt, delegation, evidence, and repository text | Nested key/value detection, shaped marker patterns, scanner coverage, no content echo in errors | Content scanners cannot prove that an unknown encoding is harmless | `tests/security-limits.test.js`, `tests/test_scan_secrets.py`, `scripts/scan_secrets.py` |
@@ -35,6 +36,14 @@ remaining trust boundaries and their executable evidence.
 | Lifecycle simulation after CLI resolution failure | A runtime manually writes protocol-owned JSON and falsely claims conformance when the CLI is unresolved | Lifecycle-owned protocol state and CLI availability | CLI-owned artifact policy, universal adapter prohibition, validator-backed completion, append-only ledger hash chain | A privileged local process can tamper with local files; ForgeLoop detects consistency, not remote attestation | `tests/discovery-surfaces.test.js`, `tests/lifecycle.test.js`, `LOOP_ENGINEERING.md` |
 | Unauthorized verification dependency installation | The active actor mutates the environment by downloading or installing a missing checker merely to satisfy verification | Verification capability discovery and installation authority | Missing verification tool policy, non-installing resolution first, explicit installation authority, equivalent-check fallback, NOT_VERIFIED degradation | A privileged external process may still install tools outside ForgeLoop's control | `tests/verification-capability.test.js`, `tests/discovery-surfaces.test.js`, `LOOP_ENGINEERING.md` |
 | False delegation requirement | A valid single-actor run is incorrectly reported as incomplete because a validator demands artifacts for delegation that never occurred | Validator delegation scope resolution | Canonical delegationIsInScope predicate, conditional delegation validation in validateTaskArtifactSet and validate-protocol | Malformed or externally injected artifacts may require INCONSISTENT classification | `tests/conformance.test.js`, `tests/validate-protocol-cli.test.js` |
+| Self-asserted authority bypass | The active actor supplies `installationAuthorized=true` inside its own verification evidence and thereby grants itself authority | Authority provenance and verification evidence | Boolean claims are ignored; scoped authority references, task/type/tool validation, and validator revalidation in `record-check`/`audit`/`complete` require a trusted source | A host-controlled source is still a semantic trust boundary and is not cryptographic attestation | `tests/verification-capability.test.js`, `tests/authority.test.js`, `tests/stale-receipt-recovery.test.js` |
+| Forged local authority artifact | The active actor creates `.forgeloop/authorities/auth-modlens.json`, claims `source=operator`, and uses the reference to authorize its own installation-capable check | Host/operator authority source versus actor-writable project state | Resolve grants only from an explicit `HOST_ATTESTED` runtime context with an external source outside the target; reject project-local grants with `E_AUTHORITY_UNTRUSTED_SOURCE`; revalidate in `record-check`/`audit`/`complete` | If the host exposes the attested source as writable to the actor, ForgeLoop cannot distinguish genuine grants from actor fabrication without a stronger trust anchor | Local fake rejection, host-attested external acceptance, inside-target rejection, post-record removal and revocation tests |
+| Environment-injected trust root | The active actor creates an authority file outside the project target and sets `FORGELOOP_AUTHORITY_FILE` or `FORGELOOP_AUTHORITY_DIR` when invoking ForgeLoop | Actor-controlled process environment versus host-attested runtime authority | Standalone CLI uses `trustMode: NONE`; environment-selected sources are metadata/candidates only and fail with `E_AUTHORITY_UNTRUSTED_SOURCE`; trusted authority requires an internal `HOST_ATTESTED` context not exposed as a self-assertable CLI option | If the host integration allows the actor to mutate or replace the attested source/context, the host trust boundary is compromised | Environment-injection rejection, standalone audit/complete rejection, host-attested positive path |
+| Stale receipt recovery dead-end | Work state changes after preparing a receipt, leaving a mismatch that cannot be refreshed because the old receipt is rejected during re-preparation | Preparation lifecycle and recovery action resolution | Recoverable stale receipt binding in `prepareCompletion`, executable `PREPARE_COMPLETION` return from `next`, atomic refresh of stateFingerprint and changedPaths | Manual file corruption outside CLI commands requires manual diagnostic recovery | `tests/stale-receipt-recovery.test.js`, `tests/next-executability.test.js` |
+| Recursive npm script dispatch | A recognized npm lifecycle script invokes another npm script, which later invokes an installation-capable resolver (e.g. `test` -> `npm run visual` -> `npx package`) | Recognized npm dispatcher semantics before ForgeLoop process launch | Recursive npm-script resolution with cycle detection, maximum depth (16), lifecycle hook inspection, restart special semantics, and fail-closed behavior when the resolver cannot prove the chain is non-installing | Opaque executables may spawn arbitrary descendants. Full descendant-process attestation requires host-level process controls and is outside this release | `tests/run-check.test.js`, `tests/verification-capability.test.js` |
+| npm invocation rewriting and workspace dispatch | npm configuration flags appear before the subcommand, or npm workspace selectors cause script execution to occur against a package.json different from the ForgeLoop target root | Raw npm argv versus effective npm command and execution context | Canonical npm invocation parsing, effective subcommand extraction, workspace flag detection across the full npm argv, and fail-closed workspace script handling when the selected package.json cannot be proven from the current target | ForgeLoop 0.1.15 intentionally does not implement full npm workspace resolution. Users should execute run-check from the selected workspace target directory | `tests/run-check.test.js`, `tests/verification-capability.test.js` |
+| Unclassified npm Install-Capable Command | The npm security classifier recognizes only a small denylist of package-mutating commands. Another official npm command or alias with install/update/bootstrap semantics falls through as a local package command | Effective npm command semantics versus ForgeLoop's command classifier | Semantic npm command classification with explicit install-capable families, explicit script-dispatch families, a deliberately small non-installing allowlist, and fail-closed behavior for unknown or ambiguous npm commands | Future npm commands are blocked until ForgeLoop explicitly classifies them | `tests/verification-capability.test.js`, `tests/run-check.test.js` |
+| npm Option Value Ambiguity | An unknown npm config option with a separate value appears before the effective subcommand, and a parser misinterprets the option value as the npm subcommand | Raw npm argv and unsupported config syntax | Recognize self-contained `--key=value`, explicitly supported options-with-value, and known boolean options. Unknown long option followed by a non-option token fails closed with `NPM_OPTION_VALUE_AMBIGUOUS` | Unsupported npm config grammar is intentionally rejected rather than guessed | `tests/verification-capability.test.js`, `tests/run-check.test.js` |
 
 ## Boundary rules
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Portable, verifiable engineering protocol for AI coding environments and developer workflows",
   "repository": {
     "type": "git",

package/schemas/authority.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/authority.schema.json",
+  "title": "ForgeLoop installation authority grant",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "protocolVersion",
+    "authorityId",
+    "taskId",
+    "type",
+    "status",
+    "scope",
+    "source"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "authorityId": { "type": "string", "minLength": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "type": { "enum": ["SOFTWARE_INSTALLATION"] },
+    "status": { "enum": ["AUTHORIZED", "REVOKED", "EXPIRED"] },
+    "scope": {
+      "type": "object",
+      "required": ["tool"],
+      "properties": {
+        "tool": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
+    },
+    "source": { "enum": ["operator", "host", "project-policy"] }
+  },
+  "additionalProperties": false
+}

package/schemas/check.schema.json

@@ -13,6 +13,8 @@
     "status": { "enum": ["passed", "failed", "blocked", "not-run"] },
     "evidenceKind": { "enum": ["OBSERVED", "INFERRED", "NOT_VERIFIED", "BLOCKED"] },
     "source": { "type": "string", "minLength": 1 },
+    "executionRef": { "type": "string", "minLength": 1 },
+    "provenance": { "enum": ["FORGELOOP_EXECUTED", "ACTOR_REPORTED", "MANUAL_OBSERVATION"] },
     "exitCode": { "type": "integer" },
     "timestamp": { "type": "string", "minLength": 1 },
     "repositoryFingerprint": { "type": "string", "pattern": "^[a-f0-9]{40}$" },

package/schemas/execution.schema.json

@@ -0,0 +1,63 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/execution.schema.json",
+  "title": "ForgeLoop command execution artifact",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "protocolVersion",
+    "executionId",
+    "taskId",
+    "checkId",
+    "requirement",
+    "verificationCycle",
+    "kind",
+    "argv",
+    "cwd",
+    "resolution",
+    "startedAt",
+    "finishedAt",
+    "status",
+    "exitCode"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "executionId": { "type": "string", "minLength": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "checkId": { "type": "string", "minLength": 1 },
+    "requirement": { "type": "string", "minLength": 1 },
+    "verificationCycle": { "type": "integer", "minimum": 1 },
+    "kind": { "const": "COMMAND_EXECUTION" },
+    "argv": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "cwd": { "type": "string", "minLength": 1 },
+    "resolution": {
+      "type": "object",
+      "required": ["resolutionMode", "mayInstall", "installer", "tool"],
+      "properties": {
+        "resolutionMode": { "type": "string", "minLength": 1 },
+        "mayInstall": { "type": "boolean" },
+        "installer": { "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] },
+        "tool": { "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] }
+      },
+      "additionalProperties": false
+    },
+    "dispatch": {
+      "type": "object",
+      "properties": {
+        "kind": { "type": "string", "minLength": 1 },
+        "scriptName": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
+    },
+    "startedAt": { "type": "string", "minLength": 1 },
+    "finishedAt": { "type": "string", "minLength": 1 },
+    "status": { "enum": ["passed", "failed"] },
+    "exitCode": { "oneOf": [{ "type": "integer", "minimum": 0 }, { "type": "null" }] }
+  },
+  "additionalProperties": false
+}