@cassiomc1/forgeloop 0.1.13 → 0.1.15

package/src/cli.js

@@ -24,6 +24,7 @@ import { formatPolicyResult, runPolicy } from "./commands/policy.js";
 import { formatBundleResult, runBundle } from "./commands/bundle.js";
 import { formatPrepareCompletionResult, runPrepareCompletion } from "./commands/prepare-completion.js";
 import { formatRecordCheckResult, runRecordCheck } from "./commands/record-check.js";
+import { formatRunCheckResult, runCheck } from "./commands/run-check.js";
 import { formatRecordTerminalResult, runRecordTerminalResult } from "./commands/record-terminal-result.js";
 import { formatNextActionResult, runNext } from "./commands/next.js";
 import { resolveTarget } from "./core/filesystem.js";
@@ -31,7 +32,7 @@ import { getPackageRoot } from "./core/templates.js";
 import { ARTIFACT_PATHS } from "./core/artifacts.js";
 
 function usage(command = null) {
-  const commands = "init|doctor|update|activate|route|preflight|advance|next|prepare-completion|record-check|record-terminal-result|complete|audit|report|policy|bundle|inspect|status|validate-state|clear-state|validate-receipt|validate-protocol";
+  const commands = "init|doctor|update|activate|route|preflight|advance|next|prepare-completion|run-check|record-check|record-terminal-result|complete|audit|report|policy|bundle|inspect|status|validate-state|clear-state|validate-receipt|validate-protocol";
   const options = ["  --path <directory>  target project directory (default: current directory)"];
   if (!command || command === "init" || command === "update") {
     options.push("  --dry-run           show planned writes without changing files");
@@ -53,7 +54,7 @@ function usage(command = null) {
   if (!command || command === "advance") {
     options.push("  --to <phase>        destination workflow phase");
   }
-  if (!command || ["activate", "advance", "next", "prepare-completion", "record-check", "record-terminal-result", "preflight", "complete", "audit", "report", "policy", "bundle", "inspect", "status", "validate-state", "clear-state", "validate-receipt", "validate-protocol"].includes(command)) {
+  if (!command || ["activate", "advance", "next", "prepare-completion", "run-check", "record-check", "record-terminal-result", "preflight", "complete", "audit", "report", "policy", "bundle", "inspect", "status", "validate-state", "clear-state", "validate-receipt", "validate-protocol"].includes(command)) {
     options.push("  --json              emit structured output as JSON");
   }
   if (!command || ["preflight", "complete", "audit", "report"].includes(command)) {
@@ -78,16 +79,23 @@ function usage(command = null) {
   if (!command || command === "validate-receipt") {
     options.push("  --file <path>       receipt file relative to target");
   }
-  if (!command || command === "record-check") {
+  if (!command || command === "record-check" || command === "run-check") {
     options.push("  --id <id>            stable check identifier");
-    options.push("  --kind <kind>        check kind (default: command)");
     options.push("  --requirement <id>   completion requirement covered by the check");
+    options.push("  --details <json>     additional structured check details");
+  }
+  if (!command || command === "record-check") {
+    options.push("  --kind <kind>        check kind (default: command; use manual-review for manual evidence)");
     options.push("  --status <status>    passed, failed, blocked, or not-run");
     options.push("  --evidence-kind <kind> OBSERVED, INFERRED, NOT_VERIFIED, or BLOCKED");
-    options.push("  --command <text>     command already run by the agent (recorded only)");
-    options.push("  --result <text>      observed result supplied by the agent");
+    options.push("  --command <text>     recorded only as metadata; it is never executed");
+    options.push("  --result <text>      observed result supplied by the actor");
     options.push("  --exit-code <number> observed process exit code");
-    options.push("  --details <json>     additional structured check details");
+    options.push("  --execution-ref <id> ForgeLoop execution artifact reference");
+    options.push("  --provenance <value> FORGELOOP_EXECUTED, ACTOR_REPORTED, or MANUAL_OBSERVATION");
+  }
+  if (!command || command === "run-check") {
+    options.push("  -- <argv>            exact command argv to classify, execute, and attest");
   }
   if (!command || command === "record-terminal-result") {
     options.push("  --requirement <id>   terminal requirement covered by the result");
@@ -133,6 +141,9 @@ export function parseArgs(argv) {
     checkResult: null,
     checkExitCode: null,
     checkDetails: null,
+    checkExecutionRef: null,
+    checkProvenance: null,
+    commandArgv: [],
     checkType: null,
     checkSource: null,
     policy: null,
@@ -144,7 +155,7 @@ export function parseArgs(argv) {
 
   for (let index = 0; index < argv.length; index += 1) {
     const argument = argv[index];
-    if (["init", "doctor", "update", "activate", "route", "preflight", "advance", "next", "prepare-completion", "record-check", "record-terminal-result", "complete", "audit", "report", "policy", "bundle", "inspect", "status", "validate-state", "clear-state", "validate-receipt", "validate-protocol"].includes(argument)) {
+    if (["init", "doctor", "update", "activate", "route", "preflight", "advance", "next", "prepare-completion", "run-check", "record-check", "record-terminal-result", "complete", "audit", "report", "policy", "bundle", "inspect", "status", "validate-state", "clear-state", "validate-receipt", "validate-protocol"].includes(argument)) {
       if (command) throw new Error(`Multiple commands are not supported: ${argument}`);
       command = argument;
     } else if (argument === "--help" || argument === "-h") {
@@ -304,6 +315,19 @@ export function parseArgs(argv) {
         throw new Error("--details must be a JSON object");
       }
       index += 1;
+    } else if (argument === "--execution-ref") {
+      const executionRef = argv[index + 1];
+      if (!executionRef || executionRef.startsWith("-")) throw new Error("--execution-ref requires an execution ID");
+      options.checkExecutionRef = executionRef;
+      index += 1;
+    } else if (argument === "--provenance") {
+      const provenance = argv[index + 1];
+      if (!provenance || provenance.startsWith("-")) throw new Error("--provenance requires a provenance value");
+      options.checkProvenance = provenance;
+      index += 1;
+    } else if (argument === "--" && command === "run-check") {
+      options.commandArgv = argv.slice(index + 1);
+      break;
     } else if (argument === "--path") {
       options.path = argv[index + 1];
       if (!options.path || options.path.startsWith("-")) throw new Error("--path requires a directory");
@@ -324,7 +348,7 @@ export function parseArgs(argv) {
 
   if (!command) return { command: null, options };
 
-  const jsonCommands = ["doctor", "route", "activate", "advance", "next", "prepare-completion", "record-check", "record-terminal-result", "preflight", "complete", "audit", "report", "policy", "bundle", "inspect", "status", "validate-state", "clear-state", "validate-receipt", "validate-protocol"];
+  const jsonCommands = ["doctor", "route", "activate", "advance", "next", "prepare-completion", "run-check", "record-check", "record-terminal-result", "preflight", "complete", "audit", "report", "policy", "bundle", "inspect", "status", "validate-state", "clear-state", "validate-receipt", "validate-protocol"];
   if (!jsonCommands.includes(command) && options.json) {
     throw new Error(`Option --json is not valid for ${command}`);
   }
@@ -377,8 +401,10 @@ export function parseArgs(argv) {
     options.checkResult,
     options.checkExitCode,
     options.checkDetails,
+    options.checkExecutionRef,
+    options.checkProvenance,
   ];
-  if (command !== "record-check" && checkOptions.some((value) => value !== null)) {
+  if (!["record-check", "run-check"].includes(command) && checkOptions.some((value) => value !== null)) {
     throw new Error(`Check recording options are not valid for ${command}`);
   }
   if (command === "record-check" && !options.help) {
@@ -388,6 +414,17 @@ export function parseArgs(argv) {
     if (!options.checkEvidenceKind) throw new Error("record-check requires --evidence-kind");
     if (!options.checkCommand && !options.checkResult) throw new Error("record-check requires --command or --result");
   }
+  if (command === "run-check" && !options.help) {
+    if (!options.checkId) throw new Error("run-check requires --id");
+    if (!options.checkRequirement) throw new Error("run-check requires --requirement");
+    if (options.checkKind || options.checkStatus || options.checkEvidenceKind || options.checkCommand
+      || options.checkResult || options.checkExitCode !== null || options.checkExecutionRef || options.checkProvenance) {
+      throw new Error("run-check accepts only --id, --requirement, --details, and -- <argv>");
+    }
+    if (!Array.isArray(options.commandArgv) || options.commandArgv.length === 0) {
+      throw new Error("run-check requires -- followed by an exact command argv");
+    }
+  }
   return { command, options };
 }
 
@@ -490,6 +527,19 @@ export async function main(argv = process.argv.slice(2)) {
       return 0;
     }
 
+    if (command === "run-check") {
+      const result = await runCheck({
+        target,
+        packageRoot,
+        id: options.checkId,
+        requirement: options.checkRequirement,
+        argv: options.commandArgv,
+        details: options.checkDetails ?? undefined,
+      });
+      console.log(options.json ? JSON.stringify(result, null, 2) : formatRunCheckResult(result));
+      return result.check.status === "passed" ? 0 : 1;
+    }
+
     if (command === "record-check") {
       const result = await runRecordCheck({
         target,
@@ -501,8 +551,10 @@ export async function main(argv = process.argv.slice(2)) {
         evidenceKind: options.checkEvidenceKind,
         command: options.checkCommand ?? undefined,
         result: options.checkResult ?? undefined,
-        exitCode: options.checkExitCode,
+        ...(options.checkExitCode === null ? {} : { exitCode: options.checkExitCode }),
         details: options.checkDetails ?? undefined,
+        executionRef: options.checkExecutionRef ?? undefined,
+        provenance: options.checkProvenance ?? undefined,
       });
       console.log(options.json ? JSON.stringify(result, null, 2) : formatRecordCheckResult(result));
       return 0;
@@ -606,7 +658,7 @@ export async function main(argv = process.argv.slice(2)) {
     }
     return result.conflicts.length === 0 ? 0 : 1;
   } catch (error) {
-    console.error(`error: ${error.message}`);
+    console.error(`error: ${error.code ? `${error.code}: ` : ""}${error.message}`);
     return 1;
   }
 }

package/src/commands/inspect.js

@@ -8,6 +8,8 @@ export function formatInspectResult(report) {
     `Manifest: ${report.manifest.status}`,
     `Profile: ${report.profile.mode ?? "unknown"}/${report.profile.status ?? "unknown"}`,
     `Protocol: v${report.protocol.version}`,
+    `Authority source: ${report.authority.sourceType ?? "none configured"} / ${report.authority.trusted ? "TRUSTED" : report.authority.trustMode === "NONE" ? "UNATTESTED" : "UNTRUSTED"}`,
+    `Authority trust: ${report.authority.trustMode}`,
     `State: ${report.state.status}`,
     `Adapters: ${report.adapters.detected.length} detected`,
     `Findings: ${report.findings.length}`,

package/src/commands/prepare-completion.js

@@ -2,8 +2,8 @@ import { prepareCompletion as prepareCompletionArtifacts } from "../core/complet
 
 export { prepareCompletionArtifacts as prepareCompletion };
 
-export async function runPrepareCompletion({ target, packageRoot }) {
-  return prepareCompletionArtifacts({ target, packageRoot });
+export async function runPrepareCompletion({ target, packageRoot, authorityContext, runtimeContext }) {
+  return prepareCompletionArtifacts({ target, packageRoot, authorityContext, runtimeContext });
 }
 
 export function formatPrepareCompletionResult(result) {

package/src/commands/run-check.js

@@ -0,0 +1,83 @@
+import {
+  assertRecordCheckPrerequisites,
+  recordCheck as recordCheckArtifact,
+} from "../core/completion-artifacts.js";
+import { runCommandExecution } from "../core/execution.js";
+
+export async function runCheck({
+  target,
+  packageRoot,
+  id,
+  requirement,
+  argv,
+  details,
+  authorityContext,
+  runtimeContext,
+}) {
+  if (typeof id !== "string" || id.trim() === "" || typeof requirement !== "string" || requirement.trim() === "") {
+    const error = new Error("run-check requires non-empty id and requirement");
+    error.code = "E_CHECK_INVALID";
+    throw error;
+  }
+  const ready = await assertRecordCheckPrerequisites({
+    target,
+    packageRoot,
+    requirement,
+    status: "passed",
+    evidenceKind: "OBSERVED",
+    authorityContext,
+    runtimeContext,
+  });
+  const verificationCycle = ready.state.verificationCycle ?? 1;
+  const execution = await runCommandExecution({
+    target,
+    packageRoot,
+    taskId: ready.contract.value.taskId,
+    checkId: id,
+    requirement,
+    verificationCycle,
+    argv,
+    details,
+    authorityContext,
+    runtimeContext,
+  });
+  const status = execution.execution.status === "passed" ? "passed" : "failed";
+  const recorded = await recordCheckArtifact({
+    target,
+    packageRoot,
+    id,
+    kind: "command",
+    requirement,
+    status,
+    evidenceKind: "OBSERVED",
+    command: execution.execution.argv.join(" "),
+    result: execution.result,
+    ...(execution.execution.exitCode === null ? {} : { exitCode: execution.execution.exitCode }),
+    details,
+    executionRef: execution.execution.executionId,
+    provenance: "FORGELOOP_EXECUTED",
+    authorityContext,
+    runtimeContext,
+  });
+  return {
+    ...recorded,
+    execution: execution.execution,
+    executionPath: execution.path,
+  };
+}
+
+export function formatRunCheckResult(result) {
+  return [
+    "FORGELOOP CHECK EXECUTED",
+    `id: ${result.check.id}`,
+    `requirement: ${result.check.requirement}`,
+    `status: ${result.check.status}`,
+    `execution: ${result.execution.executionId}`,
+    `argv: ${result.execution.argv.join(" ")}`,
+    `exit code: ${result.execution.exitCode ?? "not-started"}`,
+    `artifact: ${result.executionPath}`,
+    `coverage: ${result.coverage.find((item) => item.requirement === result.check.requirement)?.status ?? "NOT_VERIFIED"}`,
+    `receipt: ${result.path}`,
+    "",
+  ].join("\n");
+}

package/src/commands/validate-protocol.js

@@ -9,6 +9,7 @@ import { validateTaskBrief, validateDelegatedResult } from "../core/delegation.j
 import { ARTIFACT_PATHS, readJsonArtifact } from "../core/artifacts.js";
 import { evaluatePreflight, validateReadyProtocolConsistency } from "../core/preflight.js";
 import { validateEventLedger, validateStateLedgerCoherence } from "../core/events.js";
+import { validateChecksExecutionProvenance } from "../core/completion-artifacts.js";
 
 async function readArtifact(target, relativePath, label) {
   if (!relativePath) return null;
@@ -87,6 +88,23 @@ export async function runValidateProtocol({
   await validateLoaded(loaded.find((item) => item.label === "route"), "routing-result", async (value) => assertRouteInvariants(value));
   await validateLoaded(loaded.find((item) => item.label === "state"), "work-state", async (value) => assertWorkStateSemantics(value));
   await validateLoaded(loaded.find((item) => item.label === "receipt"), "execution-receipt", async (value) => validateReceipt(value, packageRoot));
+  for (const [value, artifactPath] of [
+    [state, stateFile],
+    [receipt, receiptFile],
+  ]) {
+    if (!value) continue;
+    const provenanceErrors = await validateChecksExecutionProvenance(value.checks, {
+      target,
+      packageRoot,
+      taskId: value.taskId,
+      artifactPath,
+    });
+    schemaErrors.push(...provenanceErrors.map((error) => ({
+      ...error,
+      message: `Command provenance validation failed: ${error.message}`,
+      artifacts: [artifactPath, ...(error.artifacts ?? [])],
+    })));
+  }
   for (const item of loaded.filter((candidate) => candidate.label.startsWith("task brief:"))) {
     await validateLoaded(item, "task-brief", async (value) => validateTaskBrief(value, packageRoot));
   }

package/src/core/artifacts.js

@@ -17,8 +17,16 @@ export const ARTIFACT_PATHS = Object.freeze({
   gates: ".forgeloop/gates",
   state: ".forgeloop/work-state.json",
   receipt: ".forgeloop/execution-receipt.json",
+  executionDirectory: ".forgeloop/executions",
 });
 
+export function executionArtifactPath(executionId) {
+  if (typeof executionId !== "string" || !/^exec-[A-Za-z0-9_-]+$/.test(executionId)) {
+    throw new ArtifactError("E_EXECUTION_REF_INVALID", "Execution reference must be a simple execution ID");
+  }
+  return `${ARTIFACT_PATHS.executionDirectory}/${executionId}.json`;
+}
+
 export class ArtifactError extends Error {
   constructor(code, message, artifacts = []) {
     super(message);

package/src/core/audit.js

@@ -34,8 +34,8 @@ async function compareChangedPaths(target, packageRoot) {
   };
 }
 
-export async function evaluateAudit({ target, packageRoot, strict = false } = {}) {
-  const completion = await evaluateCompletion({ target, packageRoot, strict });
+export async function evaluateAudit({ target, packageRoot, strict = false, authorityContext, runtimeContext } = {}) {
+  const completion = await evaluateCompletion({ target, packageRoot, strict, authorityContext, runtimeContext });
   let manifest = null;
   let manifestError = null;
   try {

package/src/core/bundles.js

@@ -4,6 +4,8 @@ import { ARTIFACT_PATHS, readJsonArtifact, writeJsonArtifact } from "./artifacts
 import { readContract, validateContract } from "./contract.js";
 import { assertSafePath, ensureWithin, fileExists, readBytes, writeFileAtomic } from "./filesystem.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
+import { validateChecksExecutionProvenance } from "./completion-artifacts.js";
+import { readExecutionArtifact } from "./execution.js";
 
 export const BUNDLE_SCHEMA_VERSION = 1;
 const BUNDLE_ROOT = ".forgeloop/tasks";
@@ -37,6 +39,34 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
   safeTaskId(taskId);
   const directory = bundleDirectory(taskId);
   const artifacts = [];
+  const stateSource = await readJsonArtifact(target, ARTIFACT_PATHS.state, "work-state", packageRoot);
+  let receiptSource = null;
+  try {
+    receiptSource = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
+  } catch (error) {
+    if (error.code !== "ARTIFACT_MISSING") throw error;
+  }
+  const provenanceErrors = [
+    ...(await validateChecksExecutionProvenance(stateSource.value.checks, {
+      target,
+      packageRoot,
+      taskId,
+      artifactPath: ARTIFACT_PATHS.state,
+    })),
+    ...(await validateChecksExecutionProvenance(receiptSource?.value?.checks, {
+      target,
+      packageRoot,
+      taskId,
+      artifactPath: ARTIFACT_PATHS.receipt,
+    })),
+  ];
+  if (provenanceErrors.length > 0) {
+    const first = provenanceErrors[0];
+    const error = new Error(first.message);
+    error.code = first.code;
+    error.artifacts = first.artifacts;
+    throw error;
+  }
   const required = [
     [ARTIFACT_PATHS.contract, "contract.json", "current-contract"],
     [ARTIFACT_PATHS.route, "route.json", "routing-result"],
@@ -64,6 +94,16 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
     const copied = await copyJson(target, sourcePath, `${directory}/${destinationName}`, schemaName, packageRoot, artifacts, destinationName);
     if (copied && !artifacts.includes(destinationName)) artifacts.push(destinationName);
   }
+  const executionRefs = [...new Set([
+    ...(stateSource.value.checks ?? []),
+    ...(receiptSource?.value?.checks ?? []),
+  ].map((check) => check?.executionRef).filter(Boolean))].sort();
+  for (const executionRef of executionRefs) {
+    const execution = await readExecutionArtifact({ target, executionRef, packageRoot });
+    const destination = `${directory}/executions/${execution.value.executionId}.json`;
+    await writeJsonArtifact(target, destination, execution.value, "execution", packageRoot);
+    artifacts.push(`executions/${execution.value.executionId}.json`);
+  }
   const eventsPath = ensureWithin(target, ARTIFACT_PATHS.events);
   if (await fileExists(eventsPath)) {
     await assertSafePath(target, `${directory}/events.ndjson`);
@@ -107,7 +147,13 @@ export async function readTaskBundle(target, taskId, packageRoot) {
     "sources.json": ["sources", "source-registry"],
     "config.json": ["config", "config"],
   };
+  const executions = {};
   for (const artifact of manifest.value.artifacts) {
+    if (artifact.startsWith("executions/") && artifact.endsWith(".json")) {
+      const execution = await readJsonArtifact(target, `${directory}/${artifact}`, "execution", packageRoot);
+      executions[execution.value.executionId] = execution.value;
+      continue;
+    }
     const mapping = mappings[artifact];
     if (!mapping) continue;
     const loadedArtifact = await readJsonArtifact(target, `${directory}/${artifact}`, mapping[1], packageRoot);
@@ -116,5 +162,31 @@ export async function readTaskBundle(target, taskId, packageRoot) {
     }
     loaded[mapping[0]] = loadedArtifact.value;
   }
+  if (Object.keys(executions).length > 0) loaded.executions = executions;
+  const provenanceErrors = [
+    ...(await validateChecksExecutionProvenance(loaded.state?.checks, {
+      target,
+      packageRoot,
+      taskId,
+      executionArtifacts: executions,
+      allowForeignCwd: true,
+      artifactPath: "state.json",
+    })),
+    ...(await validateChecksExecutionProvenance(loaded.receipt?.checks, {
+      target,
+      packageRoot,
+      taskId,
+      executionArtifacts: executions,
+      allowForeignCwd: true,
+      artifactPath: "receipt.json",
+    })),
+  ];
+  if (provenanceErrors.length > 0) {
+    const first = provenanceErrors[0];
+    const error = new Error(first.message);
+    error.code = first.code;
+    error.artifacts = first.artifacts;
+    throw error;
+  }
   return { manifest: manifest.value, artifacts: loaded };
 }

package/src/core/checks.js

@@ -1,8 +1,10 @@
 import { PROTOCOL_VERSION } from "./protocol.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 export const CHECK_SCHEMA_VERSION = 1;
 export const CHECK_STATUSES = Object.freeze(["passed", "failed", "blocked", "not-run"]);
 export const CHECK_EVIDENCE_KINDS = Object.freeze(["OBSERVED", "INFERRED", "NOT_VERIFIED", "BLOCKED"]);
+export const CHECK_PROVENANCE = Object.freeze(["FORGELOOP_EXECUTED", "ACTOR_REPORTED", "MANUAL_OBSERVATION"]);
 
 function checkError(code, message, artifacts = []) {
   const error = new Error(message);
@@ -45,7 +47,7 @@ function assertCompoundStatus(value, label) {
   }
 }
 
-export function createCheck(input = {}) {
+export function createCheck(input = {}, options = {}) {
   const check = {
     schemaVersion: CHECK_SCHEMA_VERSION,
     protocolVersion: PROTOCOL_VERSION,
@@ -59,12 +61,14 @@ export function createCheck(input = {}) {
     ...(input.timestamp !== undefined ? { timestamp: input.timestamp } : {}),
     ...(input.repositoryFingerprint !== undefined ? { repositoryFingerprint: input.repositoryFingerprint } : {}),
     ...(input.viewport !== undefined ? { viewport: structuredClone(input.viewport) } : {}),
+    ...(input.executionRef !== undefined ? { executionRef: input.executionRef } : {}),
+    ...(input.provenance !== undefined ? { provenance: input.provenance } : {}),
     ...(input.details !== undefined ? { details: structuredClone(input.details) } : {}),
   };
-  return assertCheck(check);
+  return assertCheck(check, "check", options);
 }
 
-export function assertCheck(value, label = "check") {
+export function assertCheck(value, label = "check", options = {}) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw checkError("E_CHECK_INVALID", `${label} must be an object`);
   }
@@ -75,6 +79,19 @@ export function assertCheck(value, label = "check") {
   string(value.kind, `${label}.kind`);
   string(value.requirement, `${label}.requirement`);
   string(value.source, `${label}.source`);
+  optionalString(value.executionRef, `${label}.executionRef`);
+  if (value.provenance !== undefined && !CHECK_PROVENANCE.includes(value.provenance)) {
+    throw checkError("E_CHECK_INVALID", `${label}.provenance must be one of ${CHECK_PROVENANCE.join(", ")}`);
+  }
+  if (options.requireCommandProvenance === true
+    && value.kind === "command"
+    && value.evidenceKind === "OBSERVED"
+    && (value.executionRef === undefined || value.provenance !== "FORGELOOP_EXECUTED")) {
+    throw checkError(
+      "E_COMMAND_PROVENANCE_UNATTESTED",
+      `${label} observed command evidence requires ForgeLoop execution provenance`,
+    );
+  }
   if (!CHECK_STATUSES.includes(value.status)) {
     throw checkError("E_CHECK_INVALID", `${label}.status must be one of ${CHECK_STATUSES.join(", ")}`);
   }
@@ -97,15 +114,21 @@ export function assertCheck(value, label = "check") {
   if (value.status === "not-run" && value.evidenceKind !== "NOT_VERIFIED") {
     throw contradiction(`${label} not-run must use NOT_VERIFIED evidence`);
   }
+  if (value.status === "passed") {
+    const auth = validateVerificationAuthority(value, options);
+    if (!auth.valid) {
+      throw checkError(auth.error.code, auth.error.message);
+    }
+  }
   assertCompoundStatus(value, label);
   return value;
 }
 
-export function assertCheckList(value, label = "checks") {
+export function assertCheckList(value, label = "checks", options = {}) {
   if (!Array.isArray(value)) throw checkError("E_CHECK_INVALID", `${label} must be an array`);
   const ids = new Set();
   value.forEach((item, index) => {
-    assertCheck(item, `${label}[${index}]`);
+    assertCheck(item, `${label}[${index}]`, options);
     if (ids.has(item.id)) throw checkError("E_CHECK_INVALID", `${label} contains duplicate id ${item.id}`);
     ids.add(item.id);
   });