@cassiomc1/forgeloop 0.1.13 → 0.1.15

package/src/core/completion.js

@@ -1,5 +1,5 @@
 import { ARTIFACT_PATHS, canonicalFingerprint, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
-import { requiredEvidenceForTarget } from "./completion-artifacts.js";
+import { requiredEvidenceForTarget, validateChecksExecutionProvenance } from "./completion-artifacts.js";
 import { appendProtocolEvent, LIFECYCLE_MILESTONES, validateEventLedger, validateStateLedgerCoherence } from "./events.js";
 import { evaluatePreflight } from "./preflight.js";
 import { readContract } from "./contract.js";
@@ -42,6 +42,9 @@ function repairNext(error) {
     case "E_CHECK_INVALID":
     case "E_CHECK_STATUS_CONTRADICTION":
       return "Run forgeloop record-check with compatible observed evidence for the named requirement.";
+    case "E_COMMAND_PROVENANCE_UNATTESTED":
+    case "E_EXECUTION_REF_INVALID":
+      return "Run forgeloop run-check with the exact argv, or record the result as manual/NOT_VERIFIED evidence without claiming command execution.";
     case "E_EVIDENCE_PARTIAL":
       return "Run or finish the missing component checks and record observed evidence.";
     case "E_EVIDENCE_INVALID":
@@ -77,6 +80,13 @@ function repairNext(error) {
       return "Satisfy or refresh the named gate, then rerun forgeloop preflight.";
     case "E_PROFILE_UNVERIFIED":
       return "Use Standard mode for a fresh target, or verify PROJECT_PROFILE.md before Strict completion.";
+    case "E_INSTALLATION_AUTHORITY_REQUIRED":
+    case "E_AUTHORITY_INVALID":
+    case "E_AUTHORITY_SCOPE_MISMATCH":
+    case "E_AUTHORITY_UNTRUSTED_SOURCE":
+      return "Do not execute installation-capable verification commands without explicit scoped installation authority; use local equivalents or record NOT_VERIFIED.";
+    case "E_VERIFICATION_TOOL_UNAVAILABLE":
+      return "Use an available local verifier, an existing equivalent, or record NOT_VERIFIED if installation was not authorized.";
     default:
       return "Resolve this validator finding in the named artifact before retrying completion.";
   }
@@ -151,7 +161,7 @@ async function validateLedger(target, taskId, state, errors, packageRoot) {
   return ledger;
 }
 
-export async function evaluateCompletion({ target, packageRoot, strict = false } = {}) {
+export async function evaluateCompletion({ target, packageRoot, strict = false, authorityContext, runtimeContext } = {}) {
   const errors = [];
   const preflight = await evaluatePreflight({ target, packageRoot, strict });
   errors.push(...preflight.errors);
@@ -198,12 +208,32 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
 
   if (receipt) {
     try {
-      await validateReceipt(receipt.value, packageRoot);
+      await validateReceipt(receipt.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       errors.push(issue(error.code ?? "E_RECEIPT_INVALID", `Execution receipt is invalid: ${error.message}`, [ARTIFACT_PATHS.receipt]));
     }
   }
 
+  if (contract) {
+    errors.push(...await validateChecksExecutionProvenance(state?.checks, {
+      target,
+      packageRoot,
+      taskId: contract.value.taskId,
+      artifactPath: ARTIFACT_PATHS.state,
+    }));
+    errors.push(...await validateChecksExecutionProvenance(receipt?.value?.checks, {
+      target,
+      packageRoot,
+      taskId: contract.value.taskId,
+      artifactPath: ARTIFACT_PATHS.receipt,
+    }));
+  }
+
   if (state && !["REVIEWING", "COMPLETE"].includes(state.phase)) {
     errors.push(issue("E_PHASE_PREREQUISITE_MISSING", `Completion requires REVIEWING or COMPLETE state, found ${state.phase}`, [ARTIFACT_PATHS.state]));
   }
@@ -223,6 +253,10 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
       state,
       receipt: receipt?.value,
       requiredEvidence,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     errors.push(...relationshipErrors);
     coverage = receipt?.value?.evidenceCoverage ?? [];
@@ -290,12 +324,18 @@ export async function evaluateCompletion({ target, packageRoot, strict = false }
   };
 }
 
-export async function runComplete({ target, packageRoot, strict = false, persist = true } = {}) {
-  const result = await evaluateCompletion({ target, packageRoot, strict });
+export async function runComplete({ target, packageRoot, strict = false, persist = true, authorityContext, runtimeContext } = {}) {
+  const result = await evaluateCompletion({ target, packageRoot, strict, authorityContext, runtimeContext });
   const rejectionCodes = [...new Set(result.errors.map((error) => error.code))].sort();
   const evidenceOnlyRejection = rejectionCodes.length > 0
     && rejectionCodes.every(isRecoverableCompletionEvidenceCode);
-  if (persist && result.status === "REJECTED" && evidenceOnlyRejection) {
+  const authorityRejection = rejectionCodes.some((code) => [
+    "E_INSTALLATION_AUTHORITY_REQUIRED",
+    "E_AUTHORITY_INVALID",
+    "E_AUTHORITY_SCOPE_MISMATCH",
+    "E_AUTHORITY_UNTRUSTED_SOURCE",
+  ].includes(code));
+  if (persist && result.status === "REJECTED" && evidenceOnlyRejection && !authorityRejection) {
     const state = await readWorkState(target, packageRoot);
     if (state?.phase === "REVIEWING") {
       const reasonCodes = rejectionCodes;
@@ -335,7 +375,7 @@ export async function runComplete({ target, packageRoot, strict = false, persist
           ...receipt.value,
           stateFingerprint: canonicalFingerprint(next),
           verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-        }, packageRoot);
+        }, packageRoot, { target, taskId: state.taskId, authorityContext, runtimeContext });
         await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
       }
       const ledger = await validateEventLedger(target, packageRoot);
@@ -380,7 +420,7 @@ export async function runComplete({ target, packageRoot, strict = false, persist
         ...receipt.value,
         stateFingerprint: canonicalFingerprint(next),
         verificationCycle: next.verificationCycle ?? receipt.value.verificationCycle ?? 1,
-      }, packageRoot);
+      }, packageRoot, { target, taskId: state.taskId, authorityContext, runtimeContext });
       await writeWorkState(target, next, { packageRoot });
       await writeJsonArtifact(target, ARTIFACT_PATHS.receipt, nextReceipt, "execution-receipt", packageRoot);
     }

package/src/core/coverage.js

@@ -73,10 +73,23 @@ export function assertCoverageList(value, label = "evidenceCoverage") {
   return value;
 }
 
-export function coverageForRequirements(requirements, checks, { blockedIds = [] } = {}) {
+export function coverageForRequirements(requirements, checks, {
+  blockedIds = [],
+  target,
+  taskId,
+  authorities,
+  options = {},
+} = {}) {
   const normalizedRequirements = normalizeRequirements(requirements ?? []);
   const normalizedChecks = Array.isArray(checks) ? checks : [];
-  const readiness = evaluateRequiredEvidence({ requirements: normalizedRequirements, checks: normalizedChecks });
+  const readiness = evaluateRequiredEvidence({
+    requirements: normalizedRequirements,
+    checks: normalizedChecks,
+    target,
+    taskId,
+    authorities,
+    options,
+  });
   const covered = new Set(readiness.covered.map((item) => item.id));
   const partial = new Set(readiness.partial.map((item) => item.id));
   const invalid = new Set(readiness.invalid.map((item) => item.id));

package/src/core/evidence-readiness.js

@@ -1,4 +1,23 @@
 import { sha256 } from "./manifest.js";
+import { validateVerificationAuthority } from "./verification-capability.js";
+
+export const E_COMMAND_PROVENANCE_UNATTESTED = "E_COMMAND_PROVENANCE_UNATTESTED";
+
+export function validateCommandProvenance(check) {
+  if (check?.kind !== "command" || check.evidenceKind !== "OBSERVED") {
+    return { valid: true, error: null };
+  }
+  if (check.provenance !== "FORGELOOP_EXECUTED" || typeof check.executionRef !== "string" || check.executionRef.trim() === "") {
+    return {
+      valid: false,
+      error: {
+        code: E_COMMAND_PROVENANCE_UNATTESTED,
+        message: "Observed command evidence requires a ForgeLoop execution artifact",
+      },
+    };
+  }
+  return { valid: true, error: null };
+}
 
 export const REQUIREMENT_TYPES = Object.freeze([
   "PRODUCT",
@@ -246,7 +265,7 @@ export function authoritativeChecksForRequirements({ requirements = [], checks =
   });
 }
 
-function componentStatus(check, requirement, allChecks = []) {
+function componentStatus(check, requirement, allChecks = [], options = {}) {
   if (requirement.operator !== "ALL" || !requirement.requirements?.length) return null;
   const components = check?.details?.components;
   const statuses = requirement.requirements.map((child) => {
@@ -254,10 +273,23 @@ function componentStatus(check, requirement, allChecks = []) {
       const matchingComp = components.filter((item) => (
         item?.requirementId === child.id || item?.requirement === child.text
       )).at(-1);
-      if (matchingComp) return matchingComp;
+      if (matchingComp) {
+        const provenance = validateCommandProvenance(matchingComp);
+        if (!provenance.valid) return { ...matchingComp, status: "failed", reasonCode: provenance.error.code };
+        const auth = validateVerificationAuthority(matchingComp, options);
+        if (!auth.valid) return { ...matchingComp, status: "failed", reasonCode: auth.error.code };
+        return matchingComp;
+      }
     }
     const childCandidates = allChecks.filter((candidate) => matchesRequirement(candidate, child));
-    return latestAuthoritativeCheck(childCandidates);
+    const childCheck = latestAuthoritativeCheck(childCandidates);
+    if (childCheck) {
+      const provenance = validateCommandProvenance(childCheck);
+      if (!provenance.valid) return { ...childCheck, status: "failed", reasonCode: provenance.error.code };
+      const auth = validateVerificationAuthority(childCheck, options);
+      if (!auth.valid) return { ...childCheck, status: "failed", reasonCode: auth.error.code };
+    }
+    return childCheck;
   });
   if (statuses.some((item) => !item)) return "MISSING";
   if (statuses.some((item) => item.status === "failed")) return "INVALID";
@@ -265,7 +297,20 @@ function componentStatus(check, requirement, allChecks = []) {
   return "COVERED";
 }
 
-export function evaluateRequiredEvidence({ requirements = [], checks = [] } = {}) {
+export function evaluateRequiredEvidence({
+  requirements = [],
+  checks = [],
+  target,
+  taskId,
+  authorities,
+  options = {},
+} = {}) {
+  const authOptions = {
+    ...(target ? { target } : {}),
+    ...(taskId ? { taskId } : {}),
+    ...(authorities ? { authorities } : {}),
+    ...options,
+  };
   const normalized = normalizeRequirements(requirements);
   const result = {
     ready: true,
@@ -291,8 +336,14 @@ export function evaluateRequiredEvidence({ requirements = [], checks = [] } = {}
     }
     const candidates = checks.filter((check) => matchesRequirement(check, requirement));
     const check = latestAuthoritativeCheck(candidates);
-    const compound = componentStatus(check, requirement, checks);
-    if (compound === "INVALID" || check?.status === "failed") {
+    const provenance = check ? validateCommandProvenance(check) : { valid: true };
+    const auth = provenance.valid
+      ? (check ? validateVerificationAuthority(check, authOptions) : { valid: true })
+      : provenance;
+    const compound = componentStatus(check, requirement, checks, authOptions);
+    if (!auth.valid) {
+      result.invalid.push({ ...requirement, reasonCode: auth.error.code });
+    } else if (compound === "INVALID" || check?.status === "failed") {
       result.invalid.push(requirement);
     } else if (compound === "PARTIAL") {
       result.partial.push(requirement);

package/src/core/execution.js

@@ -0,0 +1,185 @@
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+
+import {
+  ARTIFACT_PATHS,
+  executionArtifactPath,
+  readJsonArtifact,
+  writeJsonArtifact,
+} from "./artifacts.js";
+import {
+  classifyCommandResolution,
+  resolveExecutionResolution,
+  validateVerificationAuthority,
+  E_COMMAND_RESOLUTION_AMBIGUOUS,
+} from "./verification-capability.js";
+
+export { E_COMMAND_RESOLUTION_AMBIGUOUS };
+export const EXECUTION_KIND = "COMMAND_EXECUTION";
+
+function executionError(code, message, artifacts = []) {
+  const error = new Error(message);
+  error.code = code;
+  error.artifacts = artifacts;
+  return error;
+}
+
+function normalizeArgv(argv) {
+  if (!Array.isArray(argv) || argv.length === 0 || argv.some((item) => typeof item !== "string" || item.trim() === "")) {
+    throw executionError("E_EXECUTION_INVALID", "Execution argv must contain at least one non-empty string");
+  }
+  return [...argv];
+}
+
+function validateAuthorityBeforeLaunch({ target, taskId, argv, resolution, details, authorityContext, runtimeContext }) {
+  if (!resolution.mayInstall) return;
+  const check = {
+    kind: "command",
+    source: argv[0],
+    details: {
+      ...(details ?? {}),
+      execution: { resolution },
+    },
+  };
+  const authority = validateVerificationAuthority(check, {
+    target,
+    taskId,
+    authorityContext,
+    runtimeContext,
+  });
+  if (!authority.valid) {
+    throw executionError(authority.error.code ?? "E_INSTALLATION_AUTHORITY_REQUIRED", authority.error.message);
+  }
+}
+
+function executeProcess(argv, cwd) {
+  return new Promise((resolve) => {
+    let spawnError = null;
+    try {
+      const child = spawn(argv[0], argv.slice(1), {
+        cwd,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      child.stdout?.resume();
+      child.stderr?.resume();
+      child.once("error", (error) => {
+        spawnError = error;
+      });
+      child.once("close", (exitCode) => {
+        resolve({ exitCode, spawnError });
+      });
+    } catch (error) {
+      resolve({ exitCode: null, spawnError: error });
+    }
+  });
+}
+
+export async function runCommandExecution({
+  target,
+  packageRoot,
+  taskId,
+  checkId,
+  requirement,
+  verificationCycle = 1,
+  argv,
+  details,
+  authorityContext,
+  runtimeContext,
+} = {}) {
+  const commandArgv = normalizeArgv(argv);
+  const resolution = await resolveExecutionResolution({
+    argv: commandArgv,
+    cwd: target,
+  });
+
+  if (
+    resolution.resolutionMode === "UNKNOWN"
+    && resolution.mayInstall === true
+    && (
+      resolution.reason === "NPM_WORKSPACE_SCRIPT_UNRESOLVED"
+      || resolution.reason === "NPM_SUBCOMMAND_AMBIGUOUS"
+      || resolution.reason === "NPM_COMMAND_UNCLASSIFIED"
+      || resolution.reason === "NPM_OPTION_VALUE_AMBIGUOUS"
+    )
+  ) {
+    const error = new Error(
+      resolution.reason === "NPM_WORKSPACE_SCRIPT_UNRESOLVED"
+        ? "npm workspace script execution cannot be proven from the current target. Run ForgeLoop against the selected workspace directory."
+        : "Command execution context could not be proven safe before launch."
+    );
+    error.code = E_COMMAND_RESOLUTION_AMBIGUOUS;
+    error.resolution = resolution;
+    throw error;
+  }
+
+  validateAuthorityBeforeLaunch({
+    target,
+    taskId,
+    argv: commandArgv,
+    resolution,
+    details,
+    authorityContext,
+    runtimeContext,
+  });
+
+  const executionId = `exec-${randomUUID()}`;
+  const startedAt = new Date().toISOString();
+  const processResult = await executeProcess(commandArgv, target);
+  const finishedAt = new Date().toISOString();
+  const execution = {
+    schemaVersion: 1,
+    protocolVersion: 1,
+    executionId,
+    taskId,
+    checkId,
+    requirement,
+    verificationCycle,
+    kind: EXECUTION_KIND,
+    argv: commandArgv,
+    cwd: target,
+    resolution: {
+      resolutionMode: resolution.resolutionMode,
+      mayInstall: resolution.mayInstall,
+      installer: resolution.installer,
+      tool: resolution.tool,
+    },
+    ...(resolution.dispatch ? { dispatch: resolution.dispatch } : {}),
+    startedAt,
+    finishedAt,
+    status: processResult.exitCode === 0 && !processResult.spawnError ? "passed" : "failed",
+    exitCode: processResult.exitCode,
+  };
+  const path = executionArtifactPath(executionId);
+  const written = await writeJsonArtifact(target, path, execution, "execution", packageRoot);
+  return {
+    path: written.path,
+    execution: written.value,
+    result: processResult.spawnError
+      ? "process failed to start"
+      : `process exited with code ${processResult.exitCode}`,
+  };
+}
+
+export async function readExecutionArtifact({ target, executionRef, packageRoot } = {}) {
+  let relativePath;
+  try {
+    relativePath = executionArtifactPath(executionRef);
+    const artifact = await readJsonArtifact(target, relativePath, "execution", packageRoot);
+    return artifact;
+  } catch (error) {
+    if (error.code === "E_EXECUTION_REF_INVALID") throw error;
+    throw executionError("E_EXECUTION_REF_INVALID", "Execution reference does not resolve to a valid ForgeLoop artifact", [relativePath ?? ARTIFACT_PATHS.executionDirectory]);
+  }
+}
+
+export function validateExecutionBinding({ execution, taskId, checkId, requirement, verificationCycle = 1 } = {}) {
+  if (!execution || execution.kind !== EXECUTION_KIND
+    || execution.taskId !== taskId
+    || execution.checkId !== checkId
+    || execution.requirement !== requirement
+    || execution.verificationCycle !== undefined && execution.verificationCycle !== verificationCycle) {
+    throw executionError("E_EXECUTION_REF_INVALID", "Execution artifact does not match the current check binding", [ARTIFACT_PATHS.executionDirectory]);
+  }
+  return execution;
+}

package/src/core/inspect.js

@@ -8,6 +8,7 @@ import { createEvidence } from "./evidence.js";
 import { runDoctor } from "../commands/doctor.js";
 import { findProfilePath } from "./profile.js";
 import { FORGELOOP_KIT_DIR } from "./target-layout.js";
+import { trustedAuthorityConfiguration } from "./trusted-authority.js";
 
 function profileMetadata(bytes) {
   const text = bytes.toString("utf8");
@@ -17,7 +18,7 @@ function profileMetadata(bytes) {
   };
 }
 
-export async function inspectTarget({ target, packageRoot, contractFile = null }) {
+export async function inspectTarget({ target, packageRoot, contractFile = null, authorityContext, runtimeContext }) {
   let manifest = null;
   let manifestError = null;
   try {
@@ -91,6 +92,7 @@ export async function inspectTarget({ target, packageRoot, contractFile = null }
   ];
   return {
     target: { path: target },
+    authority: trustedAuthorityConfiguration({ target, authorityContext, runtimeContext }),
     manifest: {
       present: manifest !== null,
       status: manifestError ? "invalid" : manifest ? "ready" : "missing",

package/src/core/next-action.js

@@ -236,7 +236,16 @@ async function loadArtifact(loader, fallback) {
   }
 }
 
-async function requirementsAndCoverage({ target, packageRoot, contract, route, checks, additionalEvidence = [] }) {
+async function requirementsAndCoverage({
+  target,
+  packageRoot,
+  contract,
+  route,
+  checks,
+  additionalEvidence = [],
+  authorityContext,
+  runtimeContext,
+}) {
   const requirements = await requiredEvidenceForTarget({
     target,
     contract,
@@ -244,14 +253,21 @@ async function requirementsAndCoverage({ target, packageRoot, contract, route, c
     packageRoot,
     additionalEvidence,
   });
-  return { requirements, coverage: coverageForRequirements(requirements, checks) };
+  return {
+    requirements,
+    coverage: coverageForRequirements(requirements, checks, {
+      target,
+      taskId: contract?.value?.taskId,
+      options: { authorityContext, runtimeContext },
+    }),
+  };
 }
 
 export async function getNextAction(targetOrOptions = {}, packageRootOption) {
   const normalized = typeof targetOrOptions === "string"
     ? { target: targetOrOptions, packageRoot: packageRootOption }
     : targetOrOptions;
-  const { target, packageRoot } = normalized ?? {};
+  const { target, packageRoot, authorityContext, runtimeContext } = normalized ?? {};
   const workState = await loadArtifact(
     () => readWorkState(target, packageRoot),
     ARTIFACT_PATHS.state,
@@ -544,6 +560,8 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       route,
       checks: state.checks,
       additionalEvidence: preflight.policy?.requiredEvidence ?? [],
+      authorityContext,
+      runtimeContext,
     });
     const authoritative = authoritativeChecksForRequirements({
       requirements: ordinaryLeafRequirements(evidence.requirements),
@@ -587,7 +605,12 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       );
     }
     try {
-      await validateReceipt(receipt.value.value, packageRoot);
+      await validateReceipt(receipt.value.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       return decision(
         context,
@@ -596,7 +619,13 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
         [...requiredArtifacts, ARTIFACT_PATHS.receipt],
       );
     }
-    const readiness = evaluateRequiredEvidence({ requirements: evidence.requirements, checks: state.checks });
+    const readiness = evaluateRequiredEvidence({
+      requirements: evidence.requirements,
+      checks: state.checks,
+      target,
+      taskId: contract?.value?.taskId,
+      options: { authorityContext, runtimeContext },
+    });
     const receiptRelationships = completionRelationshipErrors({
       contract,
       route,
@@ -604,8 +633,26 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       receipt: receipt.value.value,
       requiredEvidence: evidence.requirements,
       requireRequiredChecks: false,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     if (receiptRelationships.length > 0) {
+      if (receiptRelationships.some((err) => (
+        err.code === "E_RECEIPT_STATE_MISMATCH"
+        || err.code === "E_RECEIPT_CYCLE_MISMATCH"
+        || err.code === "E_RECEIPT_CONTRACT_MISMATCH"
+        || err.code === "E_ROUTE_GUIDE_MISMATCH"
+        || err.code === "E_EVIDENCE_COVERAGE_INVALID"
+      ))) {
+        return decision(
+          context,
+          NEXT_ACTIONS.PREPARE_COMPLETION,
+          artifactError("E_RECEIPT_STATE_MISMATCH", "Run forgeloop prepare-completion to refresh the execution receipt with current state", [ARTIFACT_PATHS.receipt]),
+          [...requiredArtifacts, ARTIFACT_PATHS.receipt],
+        );
+      }
       return result({
         ...context,
         nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER,
@@ -670,8 +717,16 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       route,
       checks: state.checks,
       additionalEvidence: preflight.policy?.requiredEvidence ?? [],
+      authorityContext,
+      runtimeContext,
+    });
+    const readiness = evaluateRequiredEvidence({
+      requirements: evidence.requirements,
+      checks: state.checks,
+      target,
+      taskId: contract?.value?.taskId,
+      options: { authorityContext, runtimeContext },
     });
-    const readiness = evaluateRequiredEvidence({ requirements: evidence.requirements, checks: state.checks });
     if (!readiness.ready) {
       let recoveryAuthorized = false;
       if (state.lastCompletionAttempt?.status === "REJECTED") {
@@ -737,7 +792,12 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       );
     }
     try {
-      await validateReceipt(receipt.value.value, packageRoot);
+      await validateReceipt(receipt.value.value, packageRoot, {
+        target,
+        taskId: contract?.value?.taskId,
+        authorityContext,
+        runtimeContext,
+      });
     } catch (error) {
       return decision(
         context,
@@ -752,8 +812,26 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
       state,
       receipt: receipt.value.value,
       requiredEvidence: evidence.requirements,
+      target,
+      taskId: contract?.value?.taskId,
+      authorityContext,
+      runtimeContext,
     });
     if (receiptRelationships.length > 0) {
+      if (receiptRelationships.some((err) => (
+        err.code === "E_RECEIPT_STATE_MISMATCH"
+        || err.code === "E_RECEIPT_CYCLE_MISMATCH"
+        || err.code === "E_RECEIPT_CONTRACT_MISMATCH"
+        || err.code === "E_ROUTE_GUIDE_MISMATCH"
+        || err.code === "E_EVIDENCE_COVERAGE_INVALID"
+      ))) {
+        return decision(
+          context,
+          NEXT_ACTIONS.PREPARE_COMPLETION,
+          artifactError("E_RECEIPT_STATE_MISMATCH", "Run forgeloop prepare-completion to refresh the execution receipt with current state", [ARTIFACT_PATHS.receipt]),
+          [...requiredArtifacts, ARTIFACT_PATHS.receipt],
+        );
+      }
       return result({
         ...context,
         nextAction: NEXT_ACTIONS.RESOLVE_BLOCKER,
@@ -761,7 +839,7 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
         requiredArtifacts: [...requiredArtifacts, ARTIFACT_PATHS.receipt],
       });
     }
-    const completion = await evaluateCompletion({ target, packageRoot });
+    const completion = await evaluateCompletion({ target, packageRoot, authorityContext, runtimeContext });
     if (completion.status !== "VALID") {
       const terminalPendingErrors = completion.errors.filter((err) => (
         err.code === "E_PUBLICATION_REQUIREMENT_PENDING" || err.code === "E_PRODUCTION_REQUIREMENT_PENDING"
@@ -793,7 +871,7 @@ export async function getNextAction(targetOrOptions = {}, packageRootOption) {
     return decision(context, NEXT_ACTIONS.RUN_COMPLETE, artifactError("COMPLETION_READY", "Completion artifacts and cross-artifact validation are valid"));
   }
   if (state.phase === "COMPLETE") {
-    const completion = await evaluateCompletion({ target, packageRoot });
+    const completion = await evaluateCompletion({ target, packageRoot, authorityContext, runtimeContext });
     if (completion.status === "VALID") {
       return decision(context, NEXT_ACTIONS.NONE, artifactError("PHASE_COMPLETE", "Completion is validator-backed and terminal"));
     }