@cassiomc1/forgeloop 0.1.13 → 0.1.15

package/src/core/completion-artifacts.js

@@ -8,10 +8,10 @@ import {
 import { readContract } from "./contract.js";
 import { appendProtocolEvent, validateEventLedger } from "./events.js";
 import { completionEvidenceForGuides } from "./guide-metadata.js";
-import { createCheck } from "./checks.js";
+import { CHECK_PROVENANCE, createCheck } from "./checks.js";
 import { createEvidence } from "./evidence.js";
 import { coverageForRequirements } from "./coverage.js";
-import { assertCompletionRelationships } from "./completion-relationships.js";
+import { assertCompletionRelationships, assertStateIdentity } from "./completion-relationships.js";
 import { evaluatePreflight } from "./preflight.js";
 import { currentChangedPaths } from "./repository.js";
 import { readPersistedRoute } from "./route-artifact.js";
@@ -19,6 +19,8 @@ import { createReceipt, validateReceipt } from "./receipt.js";
 import { readWorkState, writeWorkState } from "./work-state.js";
 import { assertExecutionPrerequisites, hasExecutionStarted } from "./execution-prerequisites.js";
 import { normalizeRequirements, classifyRequirement } from "./evidence-readiness.js";
+import { classifyCommandResolution, validateVerificationAuthority } from "./verification-capability.js";
+import { readExecutionArtifact, validateExecutionBinding } from "./execution.js";
 
 function artifactError(code, message, artifacts = []) {
   const error = new Error(message);
@@ -58,6 +60,102 @@ async function readOptionalConfig(target, packageRoot) {
   }
 }
 
+function formatArgv(argv) {
+  return argv.map((argument) => /[\s"']/u.test(argument)
+    ? JSON.stringify(argument)
+    : argument).join(" ");
+}
+
+function commandProvenanceError(message = "Observed command evidence requires a ForgeLoop execution artifact") {
+  return artifactError("E_COMMAND_PROVENANCE_UNATTESTED", message, [ARTIFACT_PATHS.receipt]);
+}
+
+/**
+ * Revalidate the ForgeLoop-owned execution artifact behind an observed command
+ * check. This is intentionally asynchronous so completion and audit can verify
+ * the artifact instead of trusting duplicated check metadata.
+ */
+export async function validateCheckExecutionProvenance(check, {
+  target,
+  packageRoot,
+  taskId,
+  executionArtifacts,
+  allowForeignCwd = false,
+} = {}) {
+  if (check?.kind !== "command" || check.evidenceKind !== "OBSERVED") return null;
+  if (check.provenance !== "FORGELOOP_EXECUTED" || !check.executionRef) {
+    throw commandProvenanceError();
+  }
+  const artifact = executionArtifacts
+    ? { value: executionArtifacts[check.executionRef] }
+    : await readExecutionArtifact({
+      target,
+      executionRef: check.executionRef,
+      packageRoot,
+    });
+  if (!artifact.value) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution reference does not resolve to an execution artifact in this bundle",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  const execution = validateExecutionBinding({
+    execution: artifact.value,
+    taskId,
+    checkId: check.id,
+    requirement: check.requirement,
+    verificationCycle: check.details?.verificationCycle ?? 1,
+  });
+  if (!allowForeignCwd && path.resolve(execution.cwd) !== path.resolve(target)) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution artifact cwd does not match the current target",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (check.status === "passed" && (execution.status !== "passed" || execution.exitCode !== 0)) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "A passed command check must reference a successful execution artifact",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (check.status === "failed" && execution.status !== "failed") {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "A failed command check must reference a failed execution artifact",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (check.exitCode !== undefined && check.exitCode !== execution.exitCode) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Check exitCode does not match its execution artifact",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  return execution;
+}
+
+export async function validateChecksExecutionProvenance(checks, options = {}) {
+  const errors = [];
+  for (const check of Array.isArray(checks) ? checks : []) {
+    try {
+      await validateCheckExecutionProvenance(check, options);
+    } catch (error) {
+      errors.push({
+        code: error.code ?? "E_EXECUTION_REF_INVALID",
+        message: error.message,
+        artifacts: error.artifacts ?? [options.artifactPath ?? ARTIFACT_PATHS.receipt],
+        checkId: check?.id,
+        requirementId: check?.requirement,
+      });
+    }
+  }
+  return errors;
+}
+
 export async function requiredEvidenceForTarget({ target, contract, route, packageRoot, additionalEvidence = [] }) {
   const config = await readOptionalConfig(target, packageRoot);
   const guideEvidence = await completionEvidenceForGuides(route.value.guides, packageRoot);
@@ -69,7 +167,7 @@ export async function requiredEvidenceForTarget({ target, contract, route, packa
   ])].sort();
 }
 
-export async function prepareCompletion({ target, packageRoot }) {
+export async function prepareCompletion({ target, packageRoot, authorityContext, runtimeContext }) {
   const contract = await readContract(target, packageRoot);
   const route = await readPersistedRoute(target, packageRoot);
   const state = await readWorkState(target, packageRoot);
@@ -83,7 +181,12 @@ export async function prepareCompletion({ target, packageRoot }) {
   let existing = null;
   try {
     existing = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
-    await validateReceipt(existing.value, packageRoot);
+    await validateReceipt(existing.value, packageRoot, {
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
+    });
   } catch (error) {
     if (error.code !== "ARTIFACT_MISSING") throw error;
   }
@@ -97,17 +200,19 @@ export async function prepareCompletion({ target, packageRoot }) {
     additionalEvidence: preflight.policy?.requiredEvidence ?? [],
   });
   const existingValue = existing?.value ?? {};
-  assertCompletionRelationships({
-    contract,
-    route,
-    state,
-    receipt: existingValue.taskId ? existingValue : null,
-    requiredEvidence,
-    requireRequiredChecks: false,
-  });
-  const changedPaths = existing
-    ? [...(existingValue.changedPaths ?? [])]
-    : (await currentChangedPaths(target) ?? []);
+  if (existingValue.taskId && existingValue.taskId !== contract.value.taskId) {
+    throw artifactError("E_RECEIPT_TASK_MISMATCH", "Execution receipt does not belong to the current contract task", [ARTIFACT_PATHS.receipt]);
+  }
+  if (existing && existingValue.stateFingerprint === undefined) {
+    throw artifactError("E_RECEIPT_STATE_MISMATCH", "Execution receipt requires the current work-state fingerprint", [ARTIFACT_PATHS.receipt]);
+  }
+  assertStateIdentity({ contract, route, state });
+  const observedPaths = await currentChangedPaths(target);
+  const changedPaths = observedPaths !== null
+    ? [...observedPaths]
+    : existing
+      ? [...(existingValue.changedPaths ?? [])]
+      : [];
   const checks = existing ? [...existingValue.checks] : [...state.checks];
   const evidence = existing ? [...(existingValue.evidence ?? [])] : [...state.verificationEvidence];
   const receipt = await createReceipt({
@@ -126,7 +231,11 @@ export async function prepareCompletion({ target, packageRoot }) {
     changedPaths,
     checks,
     evidence,
-    evidenceCoverage: coverageForRequirements(requiredEvidence, checks),
+    evidenceCoverage: coverageForRequirements(requiredEvidence, checks, {
+      target,
+      taskId: contract.value.taskId,
+      options: { authorityContext, runtimeContext },
+    }),
     review: existingValue.review ?? { status: "not-run", independent: false },
     limitations: [...(existingValue.limitations ?? [])],
     publication: existingValue.publication ?? {
@@ -135,7 +244,24 @@ export async function prepareCompletion({ target, packageRoot }) {
       pullRequest: null,
       deployed: false,
     },
-  }, packageRoot);
+  }, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
+  assertCompletionRelationships({
+    contract,
+    route,
+    state,
+    receipt,
+    requiredEvidence,
+    requireRequiredChecks: false,
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
   const written = await writeJsonArtifact(
     target,
     ARTIFACT_PATHS.receipt,
@@ -167,38 +293,20 @@ function appendUniqueEvidence(evidence, nextEvidence) {
   return exists ? [...evidence] : [...evidence, nextEvidence];
 }
 
-export async function recordCheck({
+/**
+ * Read-only lifecycle checks shared by run-check and record-check. Keeping
+ * these checks before process launch prevents a command from running when the
+ * target is not ready to receive verification evidence.
+ */
+export async function assertRecordCheckPrerequisites({
   target,
   packageRoot,
-  id,
-  kind = "command",
   requirement,
   status,
   evidenceKind,
-  command,
-  result,
-  exitCode,
-  details,
-}) {
-  requiredString(id, "check id");
-  requiredString(kind, "check kind");
-  requiredString(requirement, "check requirement");
-  requiredString(status, "check status");
-  requiredString(evidenceKind, "evidence kind");
-  if (command !== undefined && typeof command !== "string") {
-    throw artifactError("E_CHECK_INVALID", "command must be a string when supplied");
-  }
-  if (result !== undefined && typeof result !== "string") {
-    throw artifactError("E_CHECK_INVALID", "result must be a string when supplied");
-  }
-  if (details !== undefined && (!details || typeof details !== "object" || Array.isArray(details))) {
-    throw artifactError("E_CHECK_INVALID", "check details must be a JSON object");
-  }
-  if ((typeof command !== "string" || command.trim() === "")
-    && (typeof result !== "string" || result.trim() === "")) {
-    throw artifactError("E_CHECK_INVALID", "record-check requires --command or --result");
-  }
-
+  authorityContext,
+  runtimeContext,
+} = {}) {
   const state = await readWorkState(target, packageRoot);
   if (!state) throw artifactError("E_STATE_MISSING", "Work state is required before recording a check", [ARTIFACT_PATHS.state]);
   if (["COMPLETE", "BLOCKED"].includes(state.phase)) {
@@ -235,9 +343,125 @@ export async function recordCheck({
   }
 
   const existingReceipt = await readCurrentReceipt(target, packageRoot);
-  await validateReceipt(existingReceipt.value, packageRoot);
-  const source = command?.trim() || `check:${id}`;
-  const recordedResult = result?.trim() || `recorded command: ${command.trim()}`;
+  await validateReceipt(existingReceipt.value, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
+  const ledger = await validateEventLedger(target, packageRoot);
+  if (!ledger.valid) {
+    const first = ledger.errors[0];
+    throw artifactError(first.code, first.message, [ARTIFACT_PATHS.events]);
+  }
+  if (!ledger.events.some((event) => event.taskId === state.taskId && event.event === "VERIFICATION_STARTED")) {
+    throw artifactError(
+      "E_PHASE_CHRONOLOGY_INVALID",
+      "record-check requires VERIFICATION_STARTED in the current task ledger",
+      [ARTIFACT_PATHS.events],
+    );
+  }
+  return {
+    state,
+    contract,
+    route,
+    preflight,
+    requiredEvidence,
+    existingReceipt,
+    ledger,
+  };
+}
+
+export async function recordCheck({
+  target,
+  packageRoot,
+  id,
+  kind = "command",
+  requirement,
+  status,
+  evidenceKind,
+  command,
+  result,
+  exitCode,
+  details,
+  executionRef,
+  provenance,
+  authorityContext,
+  runtimeContext,
+}) {
+  requiredString(id, "check id");
+  requiredString(kind, "check kind");
+  requiredString(requirement, "check requirement");
+  requiredString(status, "check status");
+  requiredString(evidenceKind, "evidence kind");
+  if (command !== undefined && typeof command !== "string") {
+    throw artifactError("E_CHECK_INVALID", "command must be a string when supplied");
+  }
+  if (result !== undefined && typeof result !== "string") {
+    throw artifactError("E_CHECK_INVALID", "result must be a string when supplied");
+  }
+  if (details !== undefined && (!details || typeof details !== "object" || Array.isArray(details))) {
+    throw artifactError("E_CHECK_INVALID", "check details must be a JSON object");
+  }
+  if (executionRef !== undefined && (typeof executionRef !== "string" || executionRef.trim() === "")) {
+    throw artifactError("E_EXECUTION_REF_INVALID", "executionRef must be a non-empty string when supplied");
+  }
+  if (provenance !== undefined && !CHECK_PROVENANCE.includes(provenance)) {
+    throw artifactError("E_CHECK_INVALID", `provenance must be one of ${CHECK_PROVENANCE.join(", ")}`);
+  }
+  if ((typeof command !== "string" || command.trim() === "")
+    && (typeof result !== "string" || result.trim() === "")) {
+    throw artifactError("E_CHECK_INVALID", "record-check requires --command or --result");
+  }
+
+  const context = await assertRecordCheckPrerequisites({
+    target,
+    packageRoot,
+    requirement,
+    status,
+    evidenceKind,
+    authorityContext,
+    runtimeContext,
+  });
+  const {
+    state,
+    contract,
+    route,
+    requiredEvidence,
+    existingReceipt,
+  } = context;
+
+  const commandSpec = typeof command === "string" && command.trim() !== "" ? command.trim() : undefined;
+  const observedCommand = kind === "command" && evidenceKind === "OBSERVED";
+  if (observedCommand && (!executionRef || provenance !== "FORGELOOP_EXECUTED")) {
+    throw commandProvenanceError();
+  }
+  const execution = executionRef
+    ? await validateCheckExecutionProvenance({
+      kind,
+      evidenceKind,
+      provenance,
+      executionRef,
+      status,
+      exitCode,
+      id,
+      requirement,
+      details: { ...(details ?? {}), verificationCycle: state.verificationCycle ?? 1 },
+    }, {
+      target,
+      packageRoot,
+      taskId: contract.value.taskId,
+    })
+    : null;
+  const effectiveCommand = execution ? formatArgv(execution.argv) : commandSpec;
+  const source = effectiveCommand || `check:${id}`;
+  const recordedResult = result?.trim() || `recorded command: ${effectiveCommand || source}`;
+  const classification = execution?.resolution ?? (effectiveCommand !== undefined ? classifyCommandResolution(effectiveCommand) : null);
+  const installationAuthorized = Boolean(
+    details?.installationAuthorized
+    || details?.authority?.softwareInstallation === "AUTHORIZED"
+    || details?.execution?.installationAuthorized
+  );
   const check = createCheck({
     id,
     kind,
@@ -245,14 +469,41 @@ export async function recordCheck({
     status,
     evidenceKind,
     source,
+    ...(executionRef === undefined ? {} : { executionRef }),
+    ...(provenance === undefined ? {} : { provenance }),
     timestamp: new Date().toISOString(),
-    ...(exitCode === undefined ? {} : { exitCode }),
+    ...(execution?.exitCode !== null && execution?.exitCode !== undefined
+      ? { exitCode: execution.exitCode }
+      : exitCode === undefined ? {} : { exitCode }),
     details: {
-      ...(command === undefined ? {} : { command }),
+      ...(effectiveCommand === undefined ? {} : { command: effectiveCommand }),
       ...(result === undefined ? {} : { result }),
       ...(details === undefined ? {} : details),
       verificationCycle: state.verificationCycle ?? 1,
+      ...(classification ? {
+        execution: {
+          ...(details?.execution ?? {}),
+          ...(execution ? {
+            executionRef: execution.executionId,
+            argv: [...execution.argv],
+            cwd: execution.cwd,
+            resolution: execution.resolution,
+            status: execution.status,
+            exitCode: execution.exitCode,
+          } : {}),
+          resolutionMode: classification.resolutionMode,
+          mayInstall: classification.mayInstall,
+          installationAuthorized,
+        },
+      } : {}),
     },
+  }, {
+    target,
+    taskId: contract.value.taskId,
+    packageRoot,
+    authorityContext,
+    runtimeContext,
+    requireCommandProvenance: observedCommand,
   });
   const evidence = createEvidence({
     kind: evidenceKind,
@@ -265,6 +516,19 @@ export async function recordCheck({
     },
   });
 
+  if (status === "passed") {
+    const auth = validateVerificationAuthority(check, {
+      target,
+      taskId: contract.value.taskId,
+      packageRoot,
+      authorityContext,
+      runtimeContext,
+    });
+    if (!auth.valid) {
+      throw artifactError(auth.error.code, auth.error.message, [ARTIFACT_PATHS.receipt]);
+    }
+  }
+
   const checks = mergeByCheckId(existingReceipt.value.checks ?? [], check);
   const evidenceList = appendUniqueEvidence(existingReceipt.value.evidence ?? [], evidence);
   assertCompletionRelationships({
@@ -274,20 +538,16 @@ export async function recordCheck({
     receipt: existingReceipt.value,
     requiredEvidence,
     requireRequiredChecks: false,
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
+  const coverage = coverageForRequirements(requiredEvidence, checks, {
+    target,
+    taskId: contract.value.taskId,
+    options: { authorityContext, runtimeContext },
   });
-  const ledger = await validateEventLedger(target, packageRoot);
-  if (!ledger.valid) {
-    const first = ledger.errors[0];
-    throw artifactError(first.code, first.message, [ARTIFACT_PATHS.events]);
-  }
-  if (!ledger.events.some((event) => event.taskId === state.taskId && event.event === "VERIFICATION_STARTED")) {
-    throw artifactError(
-      "E_PHASE_CHRONOLOGY_INVALID",
-      "record-check requires VERIFICATION_STARTED in the current task ledger",
-      [ARTIFACT_PATHS.events],
-    );
-  }
-  const coverage = coverageForRequirements(requiredEvidence, checks);
   const nextState = {
     ...state,
     checks,
@@ -302,7 +562,12 @@ export async function recordCheck({
     evidenceCoverage: coverage,
     stateFingerprint: canonicalFingerprint(nextState),
     verificationCycle: state.verificationCycle ?? 1,
-  }, packageRoot);
+  }, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
 
   assertCompletionRelationships({
     contract,
@@ -311,6 +576,10 @@ export async function recordCheck({
     receipt: nextReceipt,
     requiredEvidence,
     requireRequiredChecks: false,
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
   });
 
   await writeWorkState(target, nextState, { packageRoot });
@@ -351,6 +620,8 @@ export async function recordTerminalResult({
   source,
   result,
   details = {},
+  authorityContext,
+  runtimeContext,
 } = {}) {
   if (!target || !requirement || !type || !status || !source || !result) {
     throw artifactError("E_CHECK_INVALID", "record-terminal-result requires target, requirement, type, status, source, and result", [ARTIFACT_PATHS.state]);
@@ -413,7 +684,12 @@ export async function recordTerminalResult({
   }
 
   const existingReceipt = await readCurrentReceipt(target, packageRoot);
-  await validateReceipt(existingReceipt.value, packageRoot);
+  await validateReceipt(existingReceipt.value, packageRoot, {
+    target,
+    taskId: contract?.value?.taskId,
+    authorityContext,
+    runtimeContext,
+  });
 
   if (type === "PUBLICATION") {
     const rank = {
@@ -540,7 +816,12 @@ export async function recordTerminalResult({
   const nextReceipt = await createReceipt({
     ...receiptUpdates,
     stateFingerprint: canonicalFingerprint(nextState),
-  }, packageRoot);
+  }, packageRoot, {
+    target,
+    taskId: contract.value.taskId,
+    authorityContext,
+    runtimeContext,
+  });
 
   await writeWorkState(target, nextState, { packageRoot });
   await writeJsonArtifact(

package/src/core/completion-recovery.js

@@ -8,6 +8,10 @@ export const RECOVERABLE_COMPLETION_EVIDENCE_CODES = Object.freeze([
   "E_VERIFICATION_CHECK_REQUIRED",
   "E_CHECK_REQUIRED",
   "E_CHECK_INVALID",
+  "E_INSTALLATION_AUTHORITY_REQUIRED",
+  "E_AUTHORITY_INVALID",
+  "E_AUTHORITY_SCOPE_MISMATCH",
+  "E_AUTHORITY_UNTRUSTED_SOURCE",
 ]);
 
 export function isRecoverableCompletionEvidenceCode(code) {

package/src/core/completion-relationships.js

@@ -3,6 +3,7 @@ import { assertCheckList } from "./checks.js";
 import { assertCoverageList, coverageForRequirements } from "./coverage.js";
 import { assertEvidenceList } from "./evidence.js";
 import { evaluateRequiredEvidence } from "./evidence-readiness.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
 
 function issue(code, message, artifacts = [], details = {}) {
   return { code, message, artifacts, ...details };
@@ -65,10 +66,23 @@ export function completionRelationshipErrors({
   requiredEvidence = [],
   requireReceiptStateFingerprint = true,
   requireRequiredChecks = true,
+  target,
+  taskId,
+  authorities,
+  authorityContext,
+  runtimeContext,
 } = {}) {
   const errors = stateIdentityErrors({ contract, route, state });
   const contractValue = contract?.value ?? contract;
   const contractFingerprint = contract?.fingerprint;
+  const effectiveTaskId = taskId ?? contractValue?.taskId ?? state?.taskId ?? receipt?.taskId;
+  const authOptions = {
+    ...(target ? { target } : {}),
+    ...(effectiveTaskId ? { taskId: effectiveTaskId } : {}),
+    ...(authorities ? { authorities } : {}),
+    ...(authorityContext ? { authorityContext } : {}),
+    ...(runtimeContext ? { runtimeContext } : {}),
+  };
   if (contractValue && receipt && contractValue.taskId !== receipt.taskId) {
     errors.push(issue("E_RECEIPT_TASK_MISMATCH", "Execution receipt does not belong to the current contract task", [ARTIFACT_PATHS.contract, ARTIFACT_PATHS.receipt]));
   }
@@ -80,14 +94,30 @@ export function completionRelationshipErrors({
   }
 
   if (state) {
-    addAssertion(errors, () => assertCheckList(state.checks, "work-state.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.state]);
+    addAssertion(errors, () => assertCheckList(state.checks, "work-state.checks", authOptions), "E_CHECK_INVALID", [ARTIFACT_PATHS.state]);
     addAssertion(errors, () => assertEvidenceList(state.verificationEvidence, "work-state.verificationEvidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.state]);
+    for (const check of state.checks ?? []) {
+      if (check.status === "passed") {
+        const auth = validateVerificationAuthority(check, authOptions);
+        if (!auth.valid) {
+          errors.push(issue(auth.error.code, auth.error.message, [ARTIFACT_PATHS.state]));
+        }
+      }
+    }
   }
   if (receipt) {
-    addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
+    addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks", authOptions), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
     addAssertion(errors, () => assertEvidenceList(receipt.evidence ?? [], "receipt.evidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.receipt]);
+    for (const check of receipt.checks ?? []) {
+      if (check.status === "passed") {
+        const auth = validateVerificationAuthority(check, authOptions);
+        if (!auth.valid) {
+          errors.push(issue(auth.error.code, auth.error.message, [ARTIFACT_PATHS.receipt]));
+        }
+      }
+    }
     if (requireRequiredChecks) {
-      const readiness = evaluateRequiredEvidence({ requirements: requiredEvidence, checks: receipt.checks });
+      const readiness = evaluateRequiredEvidence({ requirements: requiredEvidence, checks: receipt.checks, options: authOptions });
       for (const requirement of readiness.missing) {
         errors.push(issue("E_EVIDENCE_REQUIRED", `Required check is missing: ${requirement.text}`, [ARTIFACT_PATHS.receipt], { requirementId: requirement.id }));
       }
@@ -100,7 +130,12 @@ export function completionRelationshipErrors({
     }
   }
 
-  const expectedCoverage = state ? coverageForRequirements(requiredEvidence, state.checks) : [];
+  const expectedCoverage = state ? coverageForRequirements(requiredEvidence, state.checks, {
+    target,
+    taskId: effectiveTaskId,
+    authorities,
+    options: authOptions,
+  }) : [];
   if (state?.evidenceCoverage !== undefined) {
     addAssertion(errors, () => assertCoverageList(state.evidenceCoverage, "work-state.evidenceCoverage"), "E_EVIDENCE_COVERAGE_INVALID", [ARTIFACT_PATHS.state]);
     if (!sameValue(state.evidenceCoverage, expectedCoverage)) {