@cassiomc1/forgeloop 0.1.9 → 0.1.10

package/README.md

@@ -61,11 +61,17 @@ flowchart TB
   root --> entry["native adapters<br/>+ .forgeloop/kit/"]
   entry --> migration{"target<br/>layout"}
   migration -->|legacy v1| plan["validate paths<br/>+ build plan"]
-  plan --> hidden["write + verify<br/>hidden kit"]
-  hidden --> authority["atomic manifest<br/>authority switch"]
+  plan --> hidden["write hidden<br/>kit"]
+  hidden --> verified["verify hidden<br/>bytes"]
+  verified --> authority["atomic manifest<br/>authority switch"]
   authority --> cleanup["hash-checked<br/>legacy cleanup"]
   cleanup --> recovered["healthy or<br/>recoverable"]
+  hidden -. interruption .-> incomplete["doctor: E_MIGRATION_INCOMPLETE"]
+  verified -. interruption .-> incomplete
+  authority -. interruption .-> incomplete
+  cleanup -. interruption .-> incomplete
   migration -->|layout v2| retry["update + retry<br/>owned cleanup"]
+  incomplete --> retry
   entry --> discovery["discovery +<br/>project profile"]
   discovery --> contract["current<br/>contract"]
   contract --> routing["deterministic<br/>route"]
@@ -115,7 +121,7 @@ flowchart TB
 
   class root root;
   class entry,discovery,delegation entry;
-  class migration,plan,hidden,authority,cleanup,recovered,retry migration;
+  class migration,plan,hidden,verified,authority,cleanup,recovered,retry,incomplete migration;
   class routing,preflight,ready routing;
   class state,events,lifecycle state;
   class checks,receipt,audit evidence;
@@ -127,9 +133,11 @@ flowchart TB
 ```
 
 Equivalent reading for text-only environments: adapters load the canonical kit;
-an older target follows validate paths → write and verify hidden files → switch
-manifest authority → hash-checked cleanup, while an interrupted migration is
-diagnosed and retried by `doctor`/`update`;
+an older target follows validate paths → write hidden files → verify their bytes
+→ switch manifest authority atomically → hash-checked cleanup. An interruption
+after hidden writes, after verification, after the authority switch, or during
+cleanup is diagnosed by `doctor` as `E_MIGRATION_INCOMPLETE` and retried by
+`update`; modified or unmanaged residual files remain preserved;
 discovery creates the contract and deterministic route; contract, route, and
 required gates must produce `PREFLIGHT_READY` before the resumable state and
 append-only event ledger authorize the lifecycle. Verification produces
@@ -150,6 +158,37 @@ Antigravity, OpenCode, Hermes, Pi, Command Code, and Freebuff use the shared
 documents; see [`AGENT_COMPATIBILITY.md`](./AGENT_COMPATIBILITY.md) for the
 official sources and precedence notes.
 
+### Migration recovery and release freeze
+
+Legacy layout migration keeps `.forgeloop/kit/` as the canonical layout and
+does not make `layoutVersion: 2` authoritative until every planned hidden file
+has been written and byte-verified. Cleanup runs only after the manifest switch
+and only for legacy files whose recorded ownership hash still matches when
+ForgeLoop revalidates it immediately before deletion. A modified, unmanaged,
+or `preserve=true` file is retained for manual review.
+
+The interruption vocabulary is test-only and is not a runtime state machine:
+
+```text
+VALIDATED → HIDDEN_WRITTEN → HIDDEN_VERIFIED → MANIFEST_SWITCHED
+          → LEGACY_CLEANED → COMPLETE
+```
+
+The regression suite injects failures at these boundaries and verifies that
+`doctor` explains the incomplete migration before a later `update` recovers
+owned cleanup. The frozen published installation under
+[`tests/fixtures/legacy-0.1.6/`](./tests/fixtures/legacy-0.1.6/) is derived
+from the real npm tarball, includes provenance and digests, and is copied into
+tests locally; CI does not download npm packages.
+
+The current published baseline for a reproducible blind run is
+`@cassiomc1/forgeloop@0.1.9`. The supplied hardening brief's `0.1.8` reference
+is historical; never move `v0.1.8` or `v0.1.9`, and use the read-only release
+identity verifier before a live run. The repository candidate is `0.1.10`, but
+it is not published: its completion-validation and cleanup TOCTOU fixes are not
+part of the frozen `0.1.9` tarball. Publish, tag, and repeat identity
+verification before a blind run that needs those executable changes.
+
 ### Use with npm
 
 The npm CLI targets Node.js 20 or newer and installs the kit into an existing

package/THREAT_MODEL.md

@@ -13,6 +13,7 @@ remaining trust boundaries and their executable evidence.
 | Path traversal | Writes or reads outside the selected target | Target path and every managed relative path | `ensureWithin`, safe-path checks, realpath containment, Windows-drive rejection | A separately privileged process can change the filesystem after validation | `tests/core.test.js`, `tests/portability.test.js`, `tests/fixtures/protocol/invalid/path-traversal.json` |
 | Symlink escape | Redirects a managed path to another directory | Existing target parents and artifact paths | Reject symlinked targets, parents, and destinations before access | The check is not a filesystem lock | `tests/core.test.js`, `tests/portability.test.js`, `tests/fixtures/protocol/invalid/symlink-target.json` |
 | Malicious manifest | Causes unsafe update or false ownership claims | `.forgeloop/manifest.json` | Schema, managed/legacy hash, safe-path, and preserve-flag validation; incomplete migration remains visible | A trusted operator can still deliberately edit the manifest | `tests/cli.test.js`, `tests/core.test.js`, `tests/hidden-layout.test.js` |
+| Interrupted or concurrent migration cleanup | Leaves a new hidden kit, an old manifest, residual legacy files, or mutates a legacy file after planning | Hidden kit, manifest authority, and legacy root cleanup | Validate all paths, write and verify the hidden plan, atomically switch authority, then revalidate safe paths and recorded ownership hashes immediately before unlink; mismatches are preserved and `doctor` reports `E_MIGRATION_INCOMPLETE` | Hash-before-unlink narrows but cannot eliminate the final OS-level race without filesystem locking; a separately privileged process remains outside the trust boundary | `tests/hidden-layout.test.js`, `README.md` |
 | Malicious work-state | Resumes stale, secret-bearing, or invalid work | `.forgeloop/work-state.json` | Schema/semantic checks, version checks, transition checks, contract/HEAD/artifact freshness, secret scan, size/depth bounds | Freshness cannot prove that an external process did not alter a file immediately afterward | `tests/work-state.test.js`, `tests/checkpoint-freshness.test.js`, `tests/security-limits.test.js` |
 | Forged preparation | Makes an agent's prose claim look like a completed preflight | Contract, route, gate, and preflight artifacts | Canonical SHA-256 fingerprints, guide-declared gate requirements, stale-artifact checks, and `E_*` failures | The CLI cannot stop a separate process from writing project files before preflight | `tests/protocol-artifacts.test.js`, `tests/preflight.test.js` |
 | Chronology rewrite | Hides execution before route, gates, or verification | `.forgeloop/events.ndjson` | Append-only local ledger, sequence numbers, hash chaining, and chronology validation without prompts or hidden reasoning | A privileged process can still replace the ledger after validation | `tests/lifecycle.test.js` |
@@ -23,6 +24,7 @@ remaining trust boundaries and their executable evidence.
 | Artifact content exposure | Sensitive material enters portable artifacts or diagnostics | State, receipt, delegation, evidence, and repository text | Nested key/value detection, shaped marker patterns, scanner coverage, no content echo in errors | Content scanners cannot prove that an unknown encoding is harmless | `tests/security-limits.test.js`, `tests/test_scan_secrets.py`, `scripts/scan_secrets.py` |
 | Stale checkpoint replay | Repeats work against a changed contract or material file | Resume boundary between a saved state and current target | Contract fingerprint, repository fingerprint, required-artifact hashes, protocol version, and conservative revalidation | A contract author must provide the current contract file for comparison | `tests/checkpoint-freshness.test.js`, `tests/cli.test.js` |
 | Unsafe publication claim | Local output is mistaken for push, PR, merge, or deployment | Receipt publication fields and evidence | Publication starts false; each true claim requires matching evidence; no CLI publication action | Remote provider state is outside local verification | `tests/receipt-semantics.test.js`, `README.md` |
+| Release identity drift | A blind run uses a package whose code, tag, commit, or tarball digest differs from the stated release | npm metadata, GitHub tag, and release commit | Read-only verifier requires package version, `gitHead`, tag, tarball URL, SHA-1, and SHA-512 to agree before the prompt starts | Registry and remote state require a fresh check for every release; a documentation commit is not a new npm package | `tests/release-identity.test.js`, `scripts/verify_release_identity.mjs`, `conformance/README.md` |
 | Schema confusion | A malformed or altered schema is treated as available | Shipped and target-local `schemas/` directory | Health checks parse every schema and classify valid, missing, invalid, or unsupported-version | Schema health does not replace review of semantic relationships | `tests/schema-health.test.js`, `src/core/schema-validation.js` |
 | Protocol-version confusion | Old/future artifacts are silently reinterpreted | Cross-artifact protocol boundary | Explicit v1 checks and conformance errors for unsupported or mixed versions | A future protocol needs a deliberate migration implementation | `tests/conformance.test.js`, `tests/fixtures/protocol/invalid/` |
 | Dependency-cycle denial of service | Coordination cannot make progress or spends unbounded work | Delegation dependency graph | Deterministic DFS cycle detection, unknown-reference rejection, and bounded JSON | A caller can still submit many valid tasks; host-level quotas remain external | `tests/delegation.test.js`, `tests/delegation-set.test.js` |
@@ -32,6 +34,9 @@ remaining trust boundaries and their executable evidence.
 
 - Safe paths are checked before reading or writing; no protocol field is a
   shell command.
+- A migration never treats `layoutVersion: 2` as authoritative before the
+  hidden kit is complete and verified; cleanup follows the authority switch and
+  is limited by recorded ownership hashes.
 - A `NOT_VERIFIED` or `BLOCKED` evidence record is never upgraded to observed
   success by a formatter.
 - Local checks do not imply remote publication, merge, deployment, or provider

package/conformance/README.md

@@ -8,6 +8,26 @@ The current published baseline for new runs is
 `@cassiomc1/forgeloop@0.1.9`. Pin that version when preparing a reproducible
 blind run; historical reports retain the exact package version they used.
 
+The frozen baseline was verified on 2026-08-13 with this identity:
+
+```text
+package: @cassiomc1/forgeloop@0.1.9
+npm gitHead: 0e48240894671ecda2458b15671020b0a7255e70
+release commit: 0e48240894671ecda2458b15671020b0a7255e70
+GitHub tag: v0.1.9 -> 0e48240894671ecda2458b15671020b0a7255e70
+tarball URL: https://registry.npmjs.org/@cassiomc1/forgeloop/-/forgeloop-0.1.9.tgz
+tarball SHA-1: fef7587ebd878e845e9746b4d049a6fe6ef333c5
+npm SHA-512 integrity: sha512-sCvPEDOYT1svNnA8+zw57dJ97N6sNCUH8eDbM6f3cS6eXLCIFFXRPkCAASA+ZPu5mAKbcNaU1TaFKjojbL3DEA==
+release identity: RELEASE_IDENTITY_VALID
+```
+
+The repository may contain documentation or executable commits after this
+frozen package. Those commits do not change the package used by the blind run;
+the repository's `0.1.10` candidate includes completion-validation and cleanup
+TOCTOU fixes that are not in `0.1.9`. If a blind run needs those executable
+changes, publish and tag the candidate, then repeat the complete identity check
+before starting the run.
+
 Run a scenario in a disposable target using the Standard profile first:
 
 ```bash
@@ -78,6 +98,21 @@ field, record `RELEASE_IDENTITY_NOT_VERIFIED` or
 The complete-website scenario deliberately fails when implementation starts
 before the contract, route, and required gates exist.
 
+## Migration compatibility evidence
+
+The real published `0.1.6` fixture at
+[`tests/fixtures/legacy-0.1.6/`](../tests/fixtures/legacy-0.1.6/) is frozen
+with package, tarball, SHA-1, SHA-512, `gitHead`, and extraction-date metadata.
+The migration tests run from those local bytes and cover interruptions after
+hidden writes, after hidden verification, after the manifest authority switch,
+and during legacy cleanup. An interrupted target must be diagnosed as
+`E_MIGRATION_INCOMPLETE`; a later `update` may retry only hash-owned cleanup.
+User-modified, unmanaged, and `preserve=true` files remain untouched even when
+that leaves a root residual. ForgeLoop revalidates the recorded ownership hash
+immediately before deleting each managed legacy file. This narrows the race
+window but does not provide OS-level filesystem locking against a separately
+privileged concurrent process.
+
 ## Autonomous blind-run isolation
 
 External workflows may help with local planning, review, tests, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Portable, verifiable instruction kit for AI agents and developers",
   "repository": {
     "type": "git",

package/src/commands/update.js

@@ -41,8 +41,8 @@ async function removeEmptyLegacyDirectory(target, relativePath, dryRun) {
   }
 }
 
-function addLegacyCleanup(cleanupFiles, cleanupDirectories, relativePath) {
-  cleanupFiles.add(relativePath);
+function addLegacyCleanup(cleanupFiles, cleanupDirectories, relativePath, expectedLegacySha256) {
+  cleanupFiles.set(relativePath, expectedLegacySha256);
   addLegacyCleanupDirectory(cleanupDirectories, relativePath);
 }
 
@@ -66,14 +66,25 @@ async function notifyStage(hooks, stage, context) {
   if (typeof hooks?.afterStage === "function") await hooks.afterStage(stage, context);
 }
 
-async function cleanupLegacyFiles({ target, dryRun, cleanupFiles, cleanupDirectories, hooks }) {
-  for (const relativePath of cleanupFiles) {
-    await assertSafePath(target, relativePath);
+async function cleanupLegacyFiles({ target, dryRun, cleanupFiles, cleanupDirectories, hooks, actions, conflicts }) {
+  for (const [relativePath, expectedLegacySha256] of cleanupFiles) {
     if (typeof hooks?.beforeCleanup === "function") {
       await hooks.beforeCleanup(relativePath);
     }
+    await assertSafePath(target, relativePath);
     const legacyPath = ensureWithin(target, relativePath);
-    if (!dryRun && await fileExists(legacyPath)) await unlink(legacyPath);
+    if (dryRun || !(await fileExists(legacyPath))) continue;
+    const currentLegacySha256 = sha256(await readBytes(legacyPath));
+    if (currentLegacySha256 !== expectedLegacySha256) {
+      conflicts.push(migrationConflict(
+        "E_LEGACY_FILE_MIGRATION_CONFLICT",
+        relativePath,
+        "Legacy file changed before cleanup; it was preserved.",
+      ));
+      actions.push({ action: "preserve-conflict", path: relativePath, reason: "changed-before-cleanup" });
+      continue;
+    }
+    await unlink(legacyPath);
   }
 
   for (const relativePath of cleanupDirectories) {
@@ -89,7 +100,7 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
   const actions = [];
   const conflicts = [];
   const writes = [];
-  const cleanupFiles = new Set();
+  const cleanupFiles = new Map();
   const cleanupDirectories = new Set();
 
   // Validate every path before creating the migration plan or touching data.
@@ -163,7 +174,7 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
         && legacyRecord
         && currentHash === legacyHash) {
         actions.push({ action: "skip", path: entry.relativePath, reason: "profile-move-resumed" });
-        addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath);
+        addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath, legacyHash);
         nextManifest.files[entry.relativePath] = manifestRecord(currentHash, true, legacyHash);
         continue;
       }
@@ -177,7 +188,7 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
         addAction(actions, dryRun, "preserve-conflict", entry.relativePath, { reason: "hidden-unmanaged" });
       } else if (hiddenMatchesSource && legacyExists && unchangedManagedLegacy) {
         actions.push({ action: "skip", path: entry.relativePath, reason: "hidden-ready" });
-        addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath);
+        addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath, legacyHash);
         nextManifest.files[entry.relativePath] = manifestRecord(
           sourceHash,
           entry.sourcePath === PROFILE_PATH,
@@ -224,7 +235,7 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
     if (entry.sourcePath === PROFILE_PATH && legacyRecord) {
       addAction(actions, dryRun, "move-profile", entry.legacyRelativePath, { to: entry.relativePath });
       writes.push({ destination, bytes: legacyBytes });
-      addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath);
+      addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath, legacyHash);
       nextManifest.files[entry.relativePath] = manifestRecord(legacyHash, true, legacyHash);
       continue;
     }
@@ -232,7 +243,7 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
     if (legacyRecord?.preserve && unchangedManaged) {
       addAction(actions, dryRun, "move-preserved", entry.legacyRelativePath, { to: entry.relativePath });
       writes.push({ destination, bytes: legacyBytes });
-      addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath);
+      addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath, legacyHash);
       nextManifest.files[entry.relativePath] = manifestRecord(legacyHash, true, legacyHash);
       continue;
     }
@@ -240,7 +251,7 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
     if (unchangedManaged) {
       addAction(actions, dryRun, "migrate", entry.legacyRelativePath, { to: entry.relativePath });
       writes.push({ destination, bytes: entry.bytes });
-      addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath);
+      addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath, legacyHash);
       nextManifest.files[entry.relativePath] = manifestRecord(sourceHash, false, legacyHash);
       continue;
     }
@@ -278,10 +289,10 @@ async function migrateLegacyLayout({ target, dryRun, packageVersion, currentMani
   // Atomic manifest replacement is the authority switch. Cleanup follows it and
   // remains recoverable because managed legacy hashes are retained in the record.
   await writeManifest(target, nextManifest, { dryRun });
-  await notifyStage(hooks, "MANIFEST_SWITCHED", { cleanupFiles: [...cleanupFiles] });
-  await cleanupLegacyFiles({ target, dryRun, cleanupFiles, cleanupDirectories, hooks });
-  await notifyStage(hooks, "LEGACY_CLEANED", { cleanupFiles: [...cleanupFiles] });
-  await notifyStage(hooks, "COMPLETE", { cleanupFiles: [...cleanupFiles] });
+  await notifyStage(hooks, "MANIFEST_SWITCHED", { cleanupFiles: [...cleanupFiles.keys()] });
+  await cleanupLegacyFiles({ target, dryRun, cleanupFiles, cleanupDirectories, hooks, actions, conflicts });
+  await notifyStage(hooks, "LEGACY_CLEANED", { cleanupFiles: [...cleanupFiles.keys()] });
+  await notifyStage(hooks, "COMPLETE", { cleanupFiles: [...cleanupFiles.keys()] });
   return { actions, conflicts, manifest: nextManifest };
 }
 
@@ -300,7 +311,7 @@ export async function runUpdate({ target, dryRun, packageRoot, packageVersion, h
   const actions = [];
   const conflicts = [];
   const plans = [];
-  const cleanupFiles = new Set();
+  const cleanupFiles = new Map();
   const cleanupDirectories = new Set();
   const pruneActions = [];
   const shippedPaths = new Set(entries.map((entry) => entry.relativePath));
@@ -333,7 +344,7 @@ export async function runUpdate({ target, dryRun, packageRoot, packageVersion, h
     if (hasLegacyAlternative && await fileExists(legacyDestination)) {
       const legacyHash = sha256(await readBytes(legacyDestination));
       if (record?.legacySha256 && legacyHash === record.legacySha256) {
-        addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath);
+        addLegacyCleanup(cleanupFiles, cleanupDirectories, entry.legacyRelativePath, record.legacySha256);
       } else {
         conflicts.push({
           code: "E_LEGACY_FILE_MIGRATION_CONFLICT",
@@ -412,6 +423,6 @@ export async function runUpdate({ target, dryRun, packageRoot, packageVersion, h
   nextManifest.packageName = PACKAGE_NAME;
   nextManifest.packageVersion = packageVersion;
   await writeManifest(target, nextManifest, { dryRun });
-  await cleanupLegacyFiles({ target, dryRun, cleanupFiles, cleanupDirectories, hooks });
+  await cleanupLegacyFiles({ target, dryRun, cleanupFiles, cleanupDirectories, hooks, actions, conflicts });
   return { actions, conflicts, manifest: nextManifest };
 }

package/src/core/checks.js

@@ -92,24 +92,35 @@ export function assertCheckList(value, label = "checks") {
   return value;
 }
 
-export function requiredChecksSatisfied(checks, requiredIds, { allowInferred = false } = {}) {
+function requiredChecksSatisfiedBy(checks, requiredValues, selector, { allowInferred = false } = {}) {
   assertCheckList(checks);
-  if (!Array.isArray(requiredIds)) throw checkError("E_CHECK_INVALID", "requiredIds must be an array");
-  const byId = new Map(checks.map((check) => [check.id, check]));
+  if (!Array.isArray(requiredValues)) throw checkError("E_CHECK_INVALID", "required values must be an array");
   const errors = [];
-  for (const id of requiredIds) {
-    const check = byId.get(id);
+  for (const value of requiredValues) {
+    const candidates = checks.filter((check) => selector(check) === value);
+    const check = candidates.find((candidate) => candidate.status === "passed"
+      && (allowInferred || candidate.evidenceKind === "OBSERVED"))
+      ?? candidates.find((candidate) => candidate.status === "passed")
+      ?? candidates[0];
     if (!check) {
-      errors.push(checkError("E_EVIDENCE_REQUIRED", `Required check is missing: ${id}`, [id]));
+      errors.push(checkError("E_EVIDENCE_REQUIRED", `Required check is missing: ${value}`, [value]));
       continue;
     }
     if (check.status !== "passed") {
-      errors.push(checkError("E_EVIDENCE_REQUIRED", `Required check is not passed: ${id}`, [id]));
+      errors.push(checkError("E_EVIDENCE_REQUIRED", `Required check is not passed: ${value}`, [value]));
       continue;
     }
     if (!allowInferred && check.evidenceKind !== "OBSERVED") {
-      errors.push(checkError("E_EVIDENCE_KIND_INVALID", `Required check must be observed: ${id}`, [id]));
+      errors.push(checkError("E_EVIDENCE_KIND_INVALID", `Required check must be observed: ${value}`, [value]));
     }
   }
   return errors;
 }
+
+export function requiredChecksSatisfied(checks, requiredIds, options = {}) {
+  return requiredChecksSatisfiedBy(checks, requiredIds, (check) => check.id, options);
+}
+
+export function requiredChecksSatisfiedForRequirements(checks, requiredRequirements, options = {}) {
+  return requiredChecksSatisfiedBy(checks, requiredRequirements, (check) => check.requirement, options);
+}

package/src/core/completion-relationships.js

@@ -1,5 +1,5 @@
 import { ARTIFACT_PATHS, canonicalFingerprint } from "./artifacts.js";
-import { assertCheckList, requiredChecksSatisfied } from "./checks.js";
+import { assertCheckList, requiredChecksSatisfiedForRequirements } from "./checks.js";
 import { assertCoverageList, coverageForRequirements } from "./coverage.js";
 import { assertEvidenceList } from "./evidence.js";
 
@@ -86,7 +86,7 @@ export function completionRelationshipErrors({
     addAssertion(errors, () => assertCheckList(receipt.checks, "receipt.checks"), "E_CHECK_INVALID", [ARTIFACT_PATHS.receipt]);
     addAssertion(errors, () => assertEvidenceList(receipt.evidence ?? [], "receipt.evidence"), "E_EVIDENCE_INVALID", [ARTIFACT_PATHS.receipt]);
     if (requireRequiredChecks) {
-      for (const error of requiredChecksSatisfied(receipt.checks, requiredEvidence)) {
+      for (const error of requiredChecksSatisfiedForRequirements(receipt.checks, requiredEvidence)) {
         errors.push(issue(error.code, error.message, [ARTIFACT_PATHS.receipt]));
       }
     }