@cassiomc1/forgeloop 0.1.14 → 0.1.15

package/src/core/bundles.js

@@ -4,6 +4,8 @@ import { ARTIFACT_PATHS, readJsonArtifact, writeJsonArtifact } from "./artifacts
 import { readContract, validateContract } from "./contract.js";
 import { assertSafePath, ensureWithin, fileExists, readBytes, writeFileAtomic } from "./filesystem.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
+import { validateChecksExecutionProvenance } from "./completion-artifacts.js";
+import { readExecutionArtifact } from "./execution.js";
 
 export const BUNDLE_SCHEMA_VERSION = 1;
 const BUNDLE_ROOT = ".forgeloop/tasks";
@@ -37,6 +39,34 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
   safeTaskId(taskId);
   const directory = bundleDirectory(taskId);
   const artifacts = [];
+  const stateSource = await readJsonArtifact(target, ARTIFACT_PATHS.state, "work-state", packageRoot);
+  let receiptSource = null;
+  try {
+    receiptSource = await readJsonArtifact(target, ARTIFACT_PATHS.receipt, "execution-receipt", packageRoot);
+  } catch (error) {
+    if (error.code !== "ARTIFACT_MISSING") throw error;
+  }
+  const provenanceErrors = [
+    ...(await validateChecksExecutionProvenance(stateSource.value.checks, {
+      target,
+      packageRoot,
+      taskId,
+      artifactPath: ARTIFACT_PATHS.state,
+    })),
+    ...(await validateChecksExecutionProvenance(receiptSource?.value?.checks, {
+      target,
+      packageRoot,
+      taskId,
+      artifactPath: ARTIFACT_PATHS.receipt,
+    })),
+  ];
+  if (provenanceErrors.length > 0) {
+    const first = provenanceErrors[0];
+    const error = new Error(first.message);
+    error.code = first.code;
+    error.artifacts = first.artifacts;
+    throw error;
+  }
   const required = [
     [ARTIFACT_PATHS.contract, "contract.json", "current-contract"],
     [ARTIFACT_PATHS.route, "route.json", "routing-result"],
@@ -64,6 +94,16 @@ export async function exportTaskBundle(target, taskId, packageRoot) {
     const copied = await copyJson(target, sourcePath, `${directory}/${destinationName}`, schemaName, packageRoot, artifacts, destinationName);
     if (copied && !artifacts.includes(destinationName)) artifacts.push(destinationName);
   }
+  const executionRefs = [...new Set([
+    ...(stateSource.value.checks ?? []),
+    ...(receiptSource?.value?.checks ?? []),
+  ].map((check) => check?.executionRef).filter(Boolean))].sort();
+  for (const executionRef of executionRefs) {
+    const execution = await readExecutionArtifact({ target, executionRef, packageRoot });
+    const destination = `${directory}/executions/${execution.value.executionId}.json`;
+    await writeJsonArtifact(target, destination, execution.value, "execution", packageRoot);
+    artifacts.push(`executions/${execution.value.executionId}.json`);
+  }
   const eventsPath = ensureWithin(target, ARTIFACT_PATHS.events);
   if (await fileExists(eventsPath)) {
     await assertSafePath(target, `${directory}/events.ndjson`);
@@ -107,7 +147,13 @@ export async function readTaskBundle(target, taskId, packageRoot) {
     "sources.json": ["sources", "source-registry"],
     "config.json": ["config", "config"],
   };
+  const executions = {};
   for (const artifact of manifest.value.artifacts) {
+    if (artifact.startsWith("executions/") && artifact.endsWith(".json")) {
+      const execution = await readJsonArtifact(target, `${directory}/${artifact}`, "execution", packageRoot);
+      executions[execution.value.executionId] = execution.value;
+      continue;
+    }
     const mapping = mappings[artifact];
     if (!mapping) continue;
     const loadedArtifact = await readJsonArtifact(target, `${directory}/${artifact}`, mapping[1], packageRoot);
@@ -116,5 +162,31 @@ export async function readTaskBundle(target, taskId, packageRoot) {
     }
     loaded[mapping[0]] = loadedArtifact.value;
   }
+  if (Object.keys(executions).length > 0) loaded.executions = executions;
+  const provenanceErrors = [
+    ...(await validateChecksExecutionProvenance(loaded.state?.checks, {
+      target,
+      packageRoot,
+      taskId,
+      executionArtifacts: executions,
+      allowForeignCwd: true,
+      artifactPath: "state.json",
+    })),
+    ...(await validateChecksExecutionProvenance(loaded.receipt?.checks, {
+      target,
+      packageRoot,
+      taskId,
+      executionArtifacts: executions,
+      allowForeignCwd: true,
+      artifactPath: "receipt.json",
+    })),
+  ];
+  if (provenanceErrors.length > 0) {
+    const first = provenanceErrors[0];
+    const error = new Error(first.message);
+    error.code = first.code;
+    error.artifacts = first.artifacts;
+    throw error;
+  }
   return { manifest: manifest.value, artifacts: loaded };
 }

package/src/core/checks.js

@@ -4,6 +4,7 @@ import { validateVerificationAuthority } from "./verification-capability.js";
 export const CHECK_SCHEMA_VERSION = 1;
 export const CHECK_STATUSES = Object.freeze(["passed", "failed", "blocked", "not-run"]);
 export const CHECK_EVIDENCE_KINDS = Object.freeze(["OBSERVED", "INFERRED", "NOT_VERIFIED", "BLOCKED"]);
+export const CHECK_PROVENANCE = Object.freeze(["FORGELOOP_EXECUTED", "ACTOR_REPORTED", "MANUAL_OBSERVATION"]);
 
 function checkError(code, message, artifacts = []) {
   const error = new Error(message);
@@ -60,6 +61,8 @@ export function createCheck(input = {}, options = {}) {
     ...(input.timestamp !== undefined ? { timestamp: input.timestamp } : {}),
     ...(input.repositoryFingerprint !== undefined ? { repositoryFingerprint: input.repositoryFingerprint } : {}),
     ...(input.viewport !== undefined ? { viewport: structuredClone(input.viewport) } : {}),
+    ...(input.executionRef !== undefined ? { executionRef: input.executionRef } : {}),
+    ...(input.provenance !== undefined ? { provenance: input.provenance } : {}),
     ...(input.details !== undefined ? { details: structuredClone(input.details) } : {}),
   };
   return assertCheck(check, "check", options);
@@ -76,6 +79,19 @@ export function assertCheck(value, label = "check", options = {}) {
   string(value.kind, `${label}.kind`);
   string(value.requirement, `${label}.requirement`);
   string(value.source, `${label}.source`);
+  optionalString(value.executionRef, `${label}.executionRef`);
+  if (value.provenance !== undefined && !CHECK_PROVENANCE.includes(value.provenance)) {
+    throw checkError("E_CHECK_INVALID", `${label}.provenance must be one of ${CHECK_PROVENANCE.join(", ")}`);
+  }
+  if (options.requireCommandProvenance === true
+    && value.kind === "command"
+    && value.evidenceKind === "OBSERVED"
+    && (value.executionRef === undefined || value.provenance !== "FORGELOOP_EXECUTED")) {
+    throw checkError(
+      "E_COMMAND_PROVENANCE_UNATTESTED",
+      `${label} observed command evidence requires ForgeLoop execution provenance`,
+    );
+  }
   if (!CHECK_STATUSES.includes(value.status)) {
     throw checkError("E_CHECK_INVALID", `${label}.status must be one of ${CHECK_STATUSES.join(", ")}`);
   }

package/src/core/completion-artifacts.js

@@ -8,7 +8,7 @@ import {
 import { readContract } from "./contract.js";
 import { appendProtocolEvent, validateEventLedger } from "./events.js";
 import { completionEvidenceForGuides } from "./guide-metadata.js";
-import { createCheck } from "./checks.js";
+import { CHECK_PROVENANCE, createCheck } from "./checks.js";
 import { createEvidence } from "./evidence.js";
 import { coverageForRequirements } from "./coverage.js";
 import { assertCompletionRelationships, assertStateIdentity } from "./completion-relationships.js";
@@ -20,6 +20,7 @@ import { readWorkState, writeWorkState } from "./work-state.js";
 import { assertExecutionPrerequisites, hasExecutionStarted } from "./execution-prerequisites.js";
 import { normalizeRequirements, classifyRequirement } from "./evidence-readiness.js";
 import { classifyCommandResolution, validateVerificationAuthority } from "./verification-capability.js";
+import { readExecutionArtifact, validateExecutionBinding } from "./execution.js";
 
 function artifactError(code, message, artifacts = []) {
   const error = new Error(message);
@@ -59,6 +60,102 @@ async function readOptionalConfig(target, packageRoot) {
   }
 }
 
+function formatArgv(argv) {
+  return argv.map((argument) => /[\s"']/u.test(argument)
+    ? JSON.stringify(argument)
+    : argument).join(" ");
+}
+
+function commandProvenanceError(message = "Observed command evidence requires a ForgeLoop execution artifact") {
+  return artifactError("E_COMMAND_PROVENANCE_UNATTESTED", message, [ARTIFACT_PATHS.receipt]);
+}
+
+/**
+ * Revalidate the ForgeLoop-owned execution artifact behind an observed command
+ * check. This is intentionally asynchronous so completion and audit can verify
+ * the artifact instead of trusting duplicated check metadata.
+ */
+export async function validateCheckExecutionProvenance(check, {
+  target,
+  packageRoot,
+  taskId,
+  executionArtifacts,
+  allowForeignCwd = false,
+} = {}) {
+  if (check?.kind !== "command" || check.evidenceKind !== "OBSERVED") return null;
+  if (check.provenance !== "FORGELOOP_EXECUTED" || !check.executionRef) {
+    throw commandProvenanceError();
+  }
+  const artifact = executionArtifacts
+    ? { value: executionArtifacts[check.executionRef] }
+    : await readExecutionArtifact({
+      target,
+      executionRef: check.executionRef,
+      packageRoot,
+    });
+  if (!artifact.value) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution reference does not resolve to an execution artifact in this bundle",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  const execution = validateExecutionBinding({
+    execution: artifact.value,
+    taskId,
+    checkId: check.id,
+    requirement: check.requirement,
+    verificationCycle: check.details?.verificationCycle ?? 1,
+  });
+  if (!allowForeignCwd && path.resolve(execution.cwd) !== path.resolve(target)) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution artifact cwd does not match the current target",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (check.status === "passed" && (execution.status !== "passed" || execution.exitCode !== 0)) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "A passed command check must reference a successful execution artifact",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (check.status === "failed" && execution.status !== "failed") {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "A failed command check must reference a failed execution artifact",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (check.exitCode !== undefined && check.exitCode !== execution.exitCode) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Check exitCode does not match its execution artifact",
+      [ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  return execution;
+}
+
+export async function validateChecksExecutionProvenance(checks, options = {}) {
+  const errors = [];
+  for (const check of Array.isArray(checks) ? checks : []) {
+    try {
+      await validateCheckExecutionProvenance(check, options);
+    } catch (error) {
+      errors.push({
+        code: error.code ?? "E_EXECUTION_REF_INVALID",
+        message: error.message,
+        artifacts: error.artifacts ?? [options.artifactPath ?? ARTIFACT_PATHS.receipt],
+        checkId: check?.id,
+        requirementId: check?.requirement,
+      });
+    }
+  }
+  return errors;
+}
+
 export async function requiredEvidenceForTarget({ target, contract, route, packageRoot, additionalEvidence = [] }) {
   const config = await readOptionalConfig(target, packageRoot);
   const guideEvidence = await completionEvidenceForGuides(route.value.guides, packageRoot);
@@ -196,42 +293,20 @@ function appendUniqueEvidence(evidence, nextEvidence) {
   return exists ? [...evidence] : [...evidence, nextEvidence];
 }
 
-export async function recordCheck({
+/**
+ * Read-only lifecycle checks shared by run-check and record-check. Keeping
+ * these checks before process launch prevents a command from running when the
+ * target is not ready to receive verification evidence.
+ */
+export async function assertRecordCheckPrerequisites({
   target,
   packageRoot,
-  id,
-  kind = "command",
   requirement,
   status,
   evidenceKind,
-  command,
-  result,
-  exitCode,
-  details,
   authorityContext,
   runtimeContext,
-}) {
-  requiredString(id, "check id");
-  requiredString(kind, "check kind");
-  requiredString(requirement, "check requirement");
-  requiredString(status, "check status");
-  requiredString(evidenceKind, "evidence kind");
-  if (command !== undefined && typeof command !== "string") {
-    throw artifactError("E_CHECK_INVALID", "command must be a string when supplied");
-  }
-  if (result !== undefined && typeof result !== "string") {
-    throw artifactError("E_CHECK_INVALID", "result must be a string when supplied");
-  }
-  if (details !== undefined && (!details || typeof details !== "object" || Array.isArray(details))) {
-    throw artifactError("E_CHECK_INVALID", "check details must be a JSON object");
-  }
-  if ((typeof command !== "string" || command.trim() === "")
-    && (typeof result !== "string" || result.trim() === "")) {
-    throw artifactError("E_CHECK_INVALID", "record-check requires --command or --result");
-  }
-
-  const commandSpec = typeof command === "string" && command.trim() !== "" ? command.trim() : undefined;
-
+} = {}) {
   const state = await readWorkState(target, packageRoot);
   if (!state) throw artifactError("E_STATE_MISSING", "Work state is required before recording a check", [ARTIFACT_PATHS.state]);
   if (["COMPLETE", "BLOCKED"].includes(state.phase)) {
@@ -274,9 +349,114 @@ export async function recordCheck({
     authorityContext,
     runtimeContext,
   });
-  const source = commandSpec || `check:${id}`;
-  const recordedResult = result?.trim() || `recorded command: ${commandSpec || source}`;
-  const classification = commandSpec !== undefined ? classifyCommandResolution(commandSpec) : null;
+  const ledger = await validateEventLedger(target, packageRoot);
+  if (!ledger.valid) {
+    const first = ledger.errors[0];
+    throw artifactError(first.code, first.message, [ARTIFACT_PATHS.events]);
+  }
+  if (!ledger.events.some((event) => event.taskId === state.taskId && event.event === "VERIFICATION_STARTED")) {
+    throw artifactError(
+      "E_PHASE_CHRONOLOGY_INVALID",
+      "record-check requires VERIFICATION_STARTED in the current task ledger",
+      [ARTIFACT_PATHS.events],
+    );
+  }
+  return {
+    state,
+    contract,
+    route,
+    preflight,
+    requiredEvidence,
+    existingReceipt,
+    ledger,
+  };
+}
+
+export async function recordCheck({
+  target,
+  packageRoot,
+  id,
+  kind = "command",
+  requirement,
+  status,
+  evidenceKind,
+  command,
+  result,
+  exitCode,
+  details,
+  executionRef,
+  provenance,
+  authorityContext,
+  runtimeContext,
+}) {
+  requiredString(id, "check id");
+  requiredString(kind, "check kind");
+  requiredString(requirement, "check requirement");
+  requiredString(status, "check status");
+  requiredString(evidenceKind, "evidence kind");
+  if (command !== undefined && typeof command !== "string") {
+    throw artifactError("E_CHECK_INVALID", "command must be a string when supplied");
+  }
+  if (result !== undefined && typeof result !== "string") {
+    throw artifactError("E_CHECK_INVALID", "result must be a string when supplied");
+  }
+  if (details !== undefined && (!details || typeof details !== "object" || Array.isArray(details))) {
+    throw artifactError("E_CHECK_INVALID", "check details must be a JSON object");
+  }
+  if (executionRef !== undefined && (typeof executionRef !== "string" || executionRef.trim() === "")) {
+    throw artifactError("E_EXECUTION_REF_INVALID", "executionRef must be a non-empty string when supplied");
+  }
+  if (provenance !== undefined && !CHECK_PROVENANCE.includes(provenance)) {
+    throw artifactError("E_CHECK_INVALID", `provenance must be one of ${CHECK_PROVENANCE.join(", ")}`);
+  }
+  if ((typeof command !== "string" || command.trim() === "")
+    && (typeof result !== "string" || result.trim() === "")) {
+    throw artifactError("E_CHECK_INVALID", "record-check requires --command or --result");
+  }
+
+  const context = await assertRecordCheckPrerequisites({
+    target,
+    packageRoot,
+    requirement,
+    status,
+    evidenceKind,
+    authorityContext,
+    runtimeContext,
+  });
+  const {
+    state,
+    contract,
+    route,
+    requiredEvidence,
+    existingReceipt,
+  } = context;
+
+  const commandSpec = typeof command === "string" && command.trim() !== "" ? command.trim() : undefined;
+  const observedCommand = kind === "command" && evidenceKind === "OBSERVED";
+  if (observedCommand && (!executionRef || provenance !== "FORGELOOP_EXECUTED")) {
+    throw commandProvenanceError();
+  }
+  const execution = executionRef
+    ? await validateCheckExecutionProvenance({
+      kind,
+      evidenceKind,
+      provenance,
+      executionRef,
+      status,
+      exitCode,
+      id,
+      requirement,
+      details: { ...(details ?? {}), verificationCycle: state.verificationCycle ?? 1 },
+    }, {
+      target,
+      packageRoot,
+      taskId: contract.value.taskId,
+    })
+    : null;
+  const effectiveCommand = execution ? formatArgv(execution.argv) : commandSpec;
+  const source = effectiveCommand || `check:${id}`;
+  const recordedResult = result?.trim() || `recorded command: ${effectiveCommand || source}`;
+  const classification = execution?.resolution ?? (effectiveCommand !== undefined ? classifyCommandResolution(effectiveCommand) : null);
   const installationAuthorized = Boolean(
     details?.installationAuthorized
     || details?.authority?.softwareInstallation === "AUTHORIZED"
@@ -289,15 +469,28 @@ export async function recordCheck({
     status,
     evidenceKind,
     source,
+    ...(executionRef === undefined ? {} : { executionRef }),
+    ...(provenance === undefined ? {} : { provenance }),
     timestamp: new Date().toISOString(),
-    ...(exitCode === undefined ? {} : { exitCode }),
+    ...(execution?.exitCode !== null && execution?.exitCode !== undefined
+      ? { exitCode: execution.exitCode }
+      : exitCode === undefined ? {} : { exitCode }),
     details: {
-      ...(command === undefined ? {} : { command }),
+      ...(effectiveCommand === undefined ? {} : { command: effectiveCommand }),
       ...(result === undefined ? {} : { result }),
       ...(details === undefined ? {} : details),
       verificationCycle: state.verificationCycle ?? 1,
       ...(classification ? {
         execution: {
+          ...(details?.execution ?? {}),
+          ...(execution ? {
+            executionRef: execution.executionId,
+            argv: [...execution.argv],
+            cwd: execution.cwd,
+            resolution: execution.resolution,
+            status: execution.status,
+            exitCode: execution.exitCode,
+          } : {}),
           resolutionMode: classification.resolutionMode,
           mayInstall: classification.mayInstall,
           installationAuthorized,
@@ -310,6 +503,7 @@ export async function recordCheck({
     packageRoot,
     authorityContext,
     runtimeContext,
+    requireCommandProvenance: observedCommand,
   });
   const evidence = createEvidence({
     kind: evidenceKind,
@@ -349,18 +543,6 @@ export async function recordCheck({
     authorityContext,
     runtimeContext,
   });
-  const ledger = await validateEventLedger(target, packageRoot);
-  if (!ledger.valid) {
-    const first = ledger.errors[0];
-    throw artifactError(first.code, first.message, [ARTIFACT_PATHS.events]);
-  }
-  if (!ledger.events.some((event) => event.taskId === state.taskId && event.event === "VERIFICATION_STARTED")) {
-    throw artifactError(
-      "E_PHASE_CHRONOLOGY_INVALID",
-      "record-check requires VERIFICATION_STARTED in the current task ledger",
-      [ARTIFACT_PATHS.events],
-    );
-  }
   const coverage = coverageForRequirements(requiredEvidence, checks, {
     target,
     taskId: contract.value.taskId,

package/src/core/completion.js

@@ -1,5 +1,5 @@
 import { ARTIFACT_PATHS, canonicalFingerprint, readJsonArtifact, writeJsonArtifact } from "./artifacts.js";
-import { requiredEvidenceForTarget } from "./completion-artifacts.js";
+import { requiredEvidenceForTarget, validateChecksExecutionProvenance } from "./completion-artifacts.js";
 import { appendProtocolEvent, LIFECYCLE_MILESTONES, validateEventLedger, validateStateLedgerCoherence } from "./events.js";
 import { evaluatePreflight } from "./preflight.js";
 import { readContract } from "./contract.js";
@@ -42,6 +42,9 @@ function repairNext(error) {
     case "E_CHECK_INVALID":
     case "E_CHECK_STATUS_CONTRADICTION":
       return "Run forgeloop record-check with compatible observed evidence for the named requirement.";
+    case "E_COMMAND_PROVENANCE_UNATTESTED":
+    case "E_EXECUTION_REF_INVALID":
+      return "Run forgeloop run-check with the exact argv, or record the result as manual/NOT_VERIFIED evidence without claiming command execution.";
     case "E_EVIDENCE_PARTIAL":
       return "Run or finish the missing component checks and record observed evidence.";
     case "E_EVIDENCE_INVALID":
@@ -216,6 +219,21 @@ export async function evaluateCompletion({ target, packageRoot, strict = false,
     }
   }
 
+  if (contract) {
+    errors.push(...await validateChecksExecutionProvenance(state?.checks, {
+      target,
+      packageRoot,
+      taskId: contract.value.taskId,
+      artifactPath: ARTIFACT_PATHS.state,
+    }));
+    errors.push(...await validateChecksExecutionProvenance(receipt?.value?.checks, {
+      target,
+      packageRoot,
+      taskId: contract.value.taskId,
+      artifactPath: ARTIFACT_PATHS.receipt,
+    }));
+  }
+
   if (state && !["REVIEWING", "COMPLETE"].includes(state.phase)) {
     errors.push(issue("E_PHASE_PREREQUISITE_MISSING", `Completion requires REVIEWING or COMPLETE state, found ${state.phase}`, [ARTIFACT_PATHS.state]));
   }

package/src/core/evidence-readiness.js

@@ -1,6 +1,24 @@
 import { sha256 } from "./manifest.js";
 import { validateVerificationAuthority } from "./verification-capability.js";
 
+export const E_COMMAND_PROVENANCE_UNATTESTED = "E_COMMAND_PROVENANCE_UNATTESTED";
+
+export function validateCommandProvenance(check) {
+  if (check?.kind !== "command" || check.evidenceKind !== "OBSERVED") {
+    return { valid: true, error: null };
+  }
+  if (check.provenance !== "FORGELOOP_EXECUTED" || typeof check.executionRef !== "string" || check.executionRef.trim() === "") {
+    return {
+      valid: false,
+      error: {
+        code: E_COMMAND_PROVENANCE_UNATTESTED,
+        message: "Observed command evidence requires a ForgeLoop execution artifact",
+      },
+    };
+  }
+  return { valid: true, error: null };
+}
+
 export const REQUIREMENT_TYPES = Object.freeze([
   "PRODUCT",
   "VERIFICATION",
@@ -256,6 +274,8 @@ function componentStatus(check, requirement, allChecks = [], options = {}) {
         item?.requirementId === child.id || item?.requirement === child.text
       )).at(-1);
       if (matchingComp) {
+        const provenance = validateCommandProvenance(matchingComp);
+        if (!provenance.valid) return { ...matchingComp, status: "failed", reasonCode: provenance.error.code };
         const auth = validateVerificationAuthority(matchingComp, options);
         if (!auth.valid) return { ...matchingComp, status: "failed", reasonCode: auth.error.code };
         return matchingComp;
@@ -264,6 +284,8 @@ function componentStatus(check, requirement, allChecks = [], options = {}) {
     const childCandidates = allChecks.filter((candidate) => matchesRequirement(candidate, child));
     const childCheck = latestAuthoritativeCheck(childCandidates);
     if (childCheck) {
+      const provenance = validateCommandProvenance(childCheck);
+      if (!provenance.valid) return { ...childCheck, status: "failed", reasonCode: provenance.error.code };
       const auth = validateVerificationAuthority(childCheck, options);
       if (!auth.valid) return { ...childCheck, status: "failed", reasonCode: auth.error.code };
     }
@@ -314,7 +336,10 @@ export function evaluateRequiredEvidence({
     }
     const candidates = checks.filter((check) => matchesRequirement(check, requirement));
     const check = latestAuthoritativeCheck(candidates);
-    const auth = check ? validateVerificationAuthority(check, authOptions) : { valid: true };
+    const provenance = check ? validateCommandProvenance(check) : { valid: true };
+    const auth = provenance.valid
+      ? (check ? validateVerificationAuthority(check, authOptions) : { valid: true })
+      : provenance;
     const compound = componentStatus(check, requirement, checks, authOptions);
     if (!auth.valid) {
       result.invalid.push({ ...requirement, reasonCode: auth.error.code });