@cassiomc1/forgeloop 1.0.0 → 1.1.0

package/src/commands/task-scope.js

@@ -0,0 +1,75 @@
+import { resolveTaskContext } from "../core/task-context.js";
+import { readTaskDescriptor, writeTaskDescriptor } from "../core/task-descriptor.js";
+import { normalizeWriteClaims, assertNoScopeConflicts, assertScopeClean, assertScopeNotFrozen } from "../core/task-scope.js";
+import { discoverTasks } from "../core/task-discovery.js";
+import { readWorkState } from "../core/work-state.js";
+import { withProjectClaimsLock, withTaskLock } from "../core/task-lock.js";
+import { E_TASK_NOT_FOUND } from "../core/error-codes.js";
+
+function taskError(code, message, artifacts = []) {
+  const error = new Error(message);
+  error.code = code;
+  error.artifacts = artifacts;
+  return error;
+}
+
+export async function runTaskScope({ target, packageRoot, taskId, claims } = {}) {
+  const context = await resolveTaskContext(target, { taskId, packageRoot, explicitRequired: true });
+  const effectiveTaskId = context.taskId;
+
+  let descriptorArtifact;
+  try {
+    descriptorArtifact = await readTaskDescriptor(target, effectiveTaskId, packageRoot);
+  } catch (error) {
+    if (error.code === "ARTIFACT_MISSING") {
+      throw taskError(E_TASK_NOT_FOUND, `Task descriptor not found for task: ${effectiveTaskId}`);
+    }
+    throw error;
+  }
+
+  const descriptor = descriptorArtifact.value;
+
+  if (claims !== undefined && claims !== null) {
+    return withProjectClaimsLock(target, async () => {
+      return withTaskLock(target, effectiveTaskId, "task-scope", async () => {
+        const state = await readWorkState(target, { packageRoot, taskId: effectiveTaskId });
+        if (state?.phase) {
+          assertScopeNotFrozen(state.phase);
+        }
+
+        const normalizedClaims = normalizeWriteClaims(claims);
+        const allTasks = await discoverTasks(target, packageRoot);
+        assertNoScopeConflicts(normalizedClaims, allTasks, effectiveTaskId);
+        if (normalizedClaims.length > 0) {
+          await assertScopeClean(target, normalizedClaims);
+        }
+
+        const updatedDescriptor = {
+          ...descriptor,
+          writeClaims: normalizedClaims,
+          updatedAt: new Date().toISOString(),
+        };
+        await writeTaskDescriptor(target, updatedDescriptor, packageRoot);
+        return {
+          taskId: effectiveTaskId,
+          taskKey: context.taskKey,
+          writeClaims: updatedDescriptor.writeClaims,
+          updated: true,
+        };
+      });
+    });
+  }
+
+  return {
+    taskId: effectiveTaskId,
+    taskKey: context.taskKey,
+    writeClaims: descriptor.writeClaims ?? [],
+    updated: false,
+  };
+}
+
+export function formatTaskScopeResult(result) {
+  const claims = result.writeClaims.length === 0 ? "none" : result.writeClaims.join(", ");
+  const action = result.updated ? "updated scope" : "current scope";
+  return `${action} for ${result.taskId}: ${claims}\n`;
+}

package/src/commands/task-show.js

@@ -0,0 +1,81 @@
+import { resolveTaskContext } from "../core/task-context.js";
+import { readTaskDescriptor } from "../core/task-descriptor.js";
+import { readLockInfo } from "../core/task-lock.js";
+import { taskDirectory, taskArtifactPath } from "../core/task-paths.js";
+import { readWorkState } from "../core/work-state.js";
+import { readContract } from "../core/contract.js";
+import { fileExists, ensureWithin } from "../core/filesystem.js";
+import { E_TASK_NOT_FOUND } from "../core/error-codes.js";
+
+function taskError(code, message, artifacts = []) {
+  const error = new Error(message);
+  error.code = code;
+  error.artifacts = artifacts;
+  return error;
+}
+
+export async function runTaskShow({ target, packageRoot, taskId } = {}) {
+  const context = await resolveTaskContext(target, { taskId, packageRoot, explicitRequired: true });
+  const effectiveTaskId = context.taskId;
+
+  let descriptor = null;
+  try {
+    const descArtifact = await readTaskDescriptor(target, effectiveTaskId, packageRoot);
+    descriptor = descArtifact.value;
+  } catch (error) {
+    if (error.code === "ARTIFACT_MISSING") {
+      throw taskError(E_TASK_NOT_FOUND, `Task descriptor not found for task: ${effectiveTaskId}`);
+    }
+    throw error;
+  }
+
+  const state = await readWorkState(target, { packageRoot, taskId: effectiveTaskId });
+  let contract = null;
+  try {
+    const contractArtifact = await readContract(target, packageRoot, { taskId: effectiveTaskId });
+    contract = contractArtifact.value;
+  } catch {
+    // contract may not be present
+  }
+
+  const lockInfo = await readLockInfo(target, effectiveTaskId);
+  const artifacts = {};
+  for (const name of ["contract", "route", "state", "preflight", "receipt", "continuity", "events"]) {
+    const rel = taskArtifactPath(effectiveTaskId, name);
+    artifacts[name] = {
+      path: rel,
+      exists: await fileExists(ensureWithin(target, rel)),
+    };
+  }
+
+  return {
+    taskId: effectiveTaskId,
+    taskKey: context.taskKey,
+    directory: taskDirectory(effectiveTaskId),
+    phase: state?.phase ?? "UNINITIALIZED",
+    writeClaims: descriptor.writeClaims ?? [],
+    lock: lockInfo,
+    contract: contract ? { title: contract.title ?? null, taskType: contract.taskType ?? null } : null,
+    artifacts,
+    createdAt: descriptor.createdAt,
+    updatedAt: descriptor.updatedAt,
+  };
+}
+
+export function formatTaskShowResult(result) {
+  const claims = result.writeClaims.length === 0 ? "none" : result.writeClaims.join(", ");
+  const lockStatus = result.lock
+    ? `locked by PID ${result.lock.pid ?? "unknown"} since ${result.lock.acquiredAt ?? "unknown"}`
+    : "unlocked";
+  const lines = [
+    `Task: ${result.taskId}`,
+    `Key: ${result.taskKey}`,
+    `Directory: ${result.directory}`,
+    `Phase: ${result.phase}`,
+    `Write Claims: ${claims}`,
+    `Lock: ${lockStatus}`,
+    `Created: ${result.createdAt}`,
+    `Updated: ${result.updatedAt}`,
+  ];
+  return `${lines.join("\n")}\n`;
+}

package/src/commands/task-unlock.js

@@ -0,0 +1,35 @@
+import { resolveTaskContext } from "../core/task-context.js";
+import { forceUnlockTask, readLockInfo } from "../core/task-lock.js";
+
+export async function runTaskUnlock({ target, packageRoot, taskId, force = false } = {}) {
+  const context = await resolveTaskContext(target, { taskId, packageRoot, explicitRequired: true });
+  const effectiveTaskId = context.taskId;
+
+  const lockInfo = await readLockInfo(target, effectiveTaskId);
+  if (!lockInfo) {
+    return {
+      taskId: effectiveTaskId,
+      taskKey: context.taskKey,
+      unlocked: false,
+      message: "Task is not locked",
+    };
+  }
+
+  if (!force) {
+    const error = new Error(`Task ${effectiveTaskId} is locked by operation "${lockInfo.operation ?? "unknown"}" (PID ${lockInfo.pid ?? "unknown"}). Use --force to unlock.`);
+    error.code = "E_TASK_LOCKED";
+    throw error;
+  }
+
+  await forceUnlockTask(target, effectiveTaskId);
+  return {
+    taskId: effectiveTaskId,
+    taskKey: context.taskKey,
+    unlocked: true,
+    message: `Released lock for task ${effectiveTaskId}`,
+  };
+}
+
+export function formatTaskUnlockResult(result) {
+  return `${result.message}\n`;
+}

package/src/commands/validate-protocol.js

@@ -43,6 +43,9 @@ async function readArtifact(target, relativePath, label) {
   }
 }
 
+import { taskArtifactPath } from "../core/task-paths.js";
+import { withResolvedTask } from "../core/task-command.js";
+
 export async function runValidateProtocol({
   target,
   packageRoot,
@@ -53,12 +56,24 @@ export async function runValidateProtocol({
   continuityFile = null,
   taskBriefFiles = [],
   delegatedResultFiles = [],
+  taskId = null,
+  task = null,
 }) {
+  return withResolvedTask(target, { taskId: taskId ?? task, packageRoot }, async (ctx) => {
+    const effectiveTaskId = ctx?.taskId ?? null;
+    const effectiveRouteFile = routeFile ?? (effectiveTaskId ? taskArtifactPath(effectiveTaskId, "route") : ARTIFACT_PATHS.route);
+    const effectiveStateFile = stateFile ?? (effectiveTaskId ? taskArtifactPath(effectiveTaskId, "state") : ARTIFACT_PATHS.state);
+    const effectiveReceiptFile = receiptFile ?? (effectiveTaskId ? taskArtifactPath(effectiveTaskId, "receipt") : ARTIFACT_PATHS.receipt);
+    const effectiveContractFile = contractFile ?? (effectiveTaskId ? taskArtifactPath(effectiveTaskId, "contract") : null);
+    const effectiveContinuityFile = continuityFile ?? (effectiveTaskId ? taskArtifactPath(effectiveTaskId, "continuity") : null);
+    const effectiveEventsFile = effectiveTaskId ? taskArtifactPath(effectiveTaskId, "events") : ARTIFACT_PATHS.events;
+    const effectivePreflightFile = effectiveTaskId ? taskArtifactPath(effectiveTaskId, "preflight") : ARTIFACT_PATHS.preflight;
+
   const descriptors = [
-    ["route", routeFile],
-    ["state", stateFile],
-    ["receipt", receiptFile],
-    ["continuity", continuityFile],
+    ["route", effectiveRouteFile],
+    ["state", effectiveStateFile],
+    ["receipt", effectiveReceiptFile],
+    ["continuity", effectiveContinuityFile],
     ...taskBriefFiles.map((file) => [`task brief:${file}`, file]),
     ...delegatedResultFiles.map((file) => [`delegated result:${file}`, file]),
   ];
@@ -117,19 +132,20 @@ export async function runValidateProtocol({
   for (const item of loaded.filter((candidate) => candidate.label.startsWith("delegated result:"))) {
     await validateLoaded(item, "delegated-result", async (value) => validateDelegatedResult(value, packageRoot));
   }
-  const stateValidationError = schemaErrors.some((error) => error.artifacts.includes(stateFile));
+  const stateValidationError = schemaErrors.some((error) => error.artifacts.includes(effectiveStateFile));
   const stateClassification = state && readErrors.length === 0 && !stateValidationError
-    ? await classifyLoadedWorkState({ target, state, contractFile })
+    ? await classifyLoadedWorkState({ target, state, contractFile: effectiveContractFile, taskId: effectiveTaskId })
     : null;
   let readyConsistencyErrors = [];
   try {
-    const persistedPreflight = await readJsonArtifact(target, ARTIFACT_PATHS.preflight, "preflight", packageRoot);
+    const persistedPreflight = await readJsonArtifact(target, effectivePreflightFile, "preflight", packageRoot);
     if (persistedPreflight.value.status === "READY") {
       readyConsistencyErrors = await validateReadyProtocolConsistency({
         target,
         packageRoot,
         persisted: persistedPreflight.value,
-        current: await evaluatePreflight({ target, packageRoot }),
+        current: await evaluatePreflight({ target, packageRoot, taskId: effectiveTaskId }),
+        taskId: effectiveTaskId,
       });
     }
   } catch {
@@ -138,13 +154,13 @@ export async function runValidateProtocol({
   let ledgerEvents = [];
   let ledgerErrors = [];
   if (state && !stateValidationError) {
-    const ledger = await validateEventLedger(target, packageRoot);
+    const ledger = await validateEventLedger(target, packageRoot, { taskId: effectiveTaskId, eventsPath: effectiveEventsFile });
     ledgerEvents = ledger.events ?? [];
     ledgerErrors = [
-      ...ledger.errors.map((error) => ({ ...error, artifacts: [ARTIFACT_PATHS.events] })),
+      ...ledger.errors.map((error) => ({ ...error, artifacts: [effectiveEventsFile] })),
       ...validateStateLedgerCoherence(state, ledger.events).map((error) => ({
         ...error,
-        artifacts: [ARTIFACT_PATHS.state, ARTIFACT_PATHS.events],
+        artifacts: [effectiveStateFile, effectiveEventsFile],
       })),
     ];
   }
@@ -166,15 +182,16 @@ export async function runValidateProtocol({
     delegatedResults,
     events: ledgerEvents,
   });
-  if (readErrors.length > 0 || schemaErrors.length > 0 || readyConsistencyErrors.length > 0 || ledgerErrors.length > 0) {
-    return {
-      ...result,
-      status: "INVALID",
-      errors: [...result.errors, ...readErrors, ...schemaErrors, ...readyConsistencyErrors, ...ledgerErrors]
-        .sort((left, right) => left.code.localeCompare(right.code) || left.message.localeCompare(right.message)),
-    };
-  }
-  return result;
+    if (readErrors.length > 0 || schemaErrors.length > 0 || readyConsistencyErrors.length > 0 || ledgerErrors.length > 0) {
+      return {
+        ...result,
+        status: "INVALID",
+        errors: [...result.errors, ...readErrors, ...schemaErrors, ...readyConsistencyErrors, ...ledgerErrors]
+          .sort((left, right) => left.code.localeCompare(right.code) || left.message.localeCompare(right.message)),
+      };
+    }
+    return result;
+  });
 }
 
 export function formatValidateProtocolResult(result) {

package/src/commands/validate-state.js

@@ -1,27 +1,33 @@
 import { readWorkState, WORK_STATE_PATH } from "../core/work-state.js";
+import { withResolvedTask } from "../core/task-command.js";
+import { taskArtifactPath } from "../core/task-paths.js";
 
-export async function runValidateState({ target, packageRoot }) {
-  try {
-    const state = await readWorkState(target, packageRoot);
-    if (!state) {
+export async function runValidateState({ target, packageRoot, taskId, task } = {}) {
+  return withResolvedTask(target, { taskId: taskId ?? task, packageRoot }, async (ctx) => {
+    const effectiveTaskId = ctx?.taskId ?? null;
+    const path = effectiveTaskId ? taskArtifactPath(effectiveTaskId, "state") : WORK_STATE_PATH;
+    try {
+      const state = await readWorkState(target, { packageRoot, taskId: effectiveTaskId });
+      if (!state) {
+        return {
+          ok: true,
+          path,
+          state: null,
+          errors: [],
+          warnings: ["No work-state checkpoint is present."],
+        };
+      }
+      return { ok: true, path, state, errors: [], warnings: [] };
+    } catch (error) {
       return {
-        ok: true,
-        path: WORK_STATE_PATH,
+        ok: false,
+        path,
         state: null,
-        errors: [],
-        warnings: ["No work-state checkpoint is present."],
+        errors: [error.message],
+        warnings: [],
       };
     }
-    return { ok: true, path: WORK_STATE_PATH, state, errors: [], warnings: [] };
-  } catch (error) {
-    return {
-      ok: false,
-      path: WORK_STATE_PATH,
-      state: null,
-      errors: [error.message],
-      warnings: [],
-    };
-  }
+  });
 }
 
 export function formatValidateStateResult(result) {

package/src/config/guides.json

@@ -0,0 +1,42 @@
+{
+  "premium": {
+    "path": "ENG/premium-sites-studio-eng.md",
+    "install": true
+  },
+  "clean": {
+    "path": "ENG/clean-code-eng.md",
+    "install": true
+  },
+  "test": {
+    "path": "ENG/test-code-eng.md",
+    "install": true
+  },
+  "security": {
+    "path": "ENG/sec-code-eng.md",
+    "install": true
+  },
+  "design": {
+    "path": "ENG/design-code-eng.md",
+    "install": true
+  },
+  "taste": {
+    "path": "ENG/taste-frontend-eng.md",
+    "install": true
+  },
+  "performance": {
+    "path": "ENG/perf-code-eng.md",
+    "install": true
+  },
+  "accessibility": {
+    "path": "ENG/accessibility-eng.md",
+    "install": true
+  },
+  "games": {
+    "path": "ENG/games-code-design-web-eng.md",
+    "install": true
+  },
+  "documentation": {
+    "path": "ENG/documentation-quality-eng.md",
+    "install": true
+  }
+}

package/src/core/activation.js

@@ -2,15 +2,19 @@ import { randomUUID } from "node:crypto";
 
 import { ARTIFACT_PATHS, writeJsonArtifact } from "./artifacts.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
+import { sessionArtifactPath } from "./task-paths.js";
 
 export async function activateSession(target, packageRoot, options = {}) {
+  const sessionId = options.sessionId ?? randomUUID();
   const value = {
     schemaVersion: 1,
     protocolVersion: PROTOCOL_VERSION,
-    sessionId: randomUUID(),
-    activationMarker: `forgeloop-${randomUUID()}`,
+    sessionId,
+    activationMarker: options.activationMarker ?? `forgeloop-${randomUUID()}`,
     createdAt: options.createdAt ?? new Date().toISOString(),
   };
-  const written = await writeJsonArtifact(target, ARTIFACT_PATHS.session, value, "activation", packageRoot, options);
-  return written.value;
+  const relativePath = sessionArtifactPath(sessionId);
+  const written = await writeJsonArtifact(target, relativePath, value, "activation", packageRoot, options);
+  await writeJsonArtifact(target, ARTIFACT_PATHS.session, value, "activation", packageRoot, options).catch(() => {});
+  return { ...written.value, path: relativePath };
 }

package/src/core/artifact-registry.js

@@ -0,0 +1,166 @@
+import { TASK_STATE_ROOT, TASK_ARTIFACT_FILES, PROJECT_ARTIFACT_PATHS, SESSIONS_ROOT } from "./task-paths.js";
+
+/**
+ * Canonical registry of ForgeLoop artifacts, defining filesystem paths,
+ * schema bindings, ownership, mutability, trust classifications, and scopes.
+ *
+ * Schema field shapes remain strictly owned by JSON schemas in `schemas/`.
+ */
+export const ARTIFACT_REGISTRY = Object.freeze({
+  descriptor: Object.freeze({
+    key: "descriptor",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.descriptor}`,
+    schema: "task-descriptor",
+    owner: "PROTOCOL_MANAGED",
+    mutability: "MUTABLE_BEFORE_EXECUTION",
+    trustRole: "TASK_DESCRIPTOR",
+    isPublic: true,
+    isPersisted: true,
+    description: "Canonical task descriptor declaring task ID, hash key, timestamps, and write claims.",
+  }),
+  contract: Object.freeze({
+    key: "contract",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.contract}`,
+    schema: "current-contract",
+    owner: "AGENT_AUTHORED",
+    mutability: "MUTABLE_BEFORE_EXECUTION",
+    trustRole: "OPERATIONAL_SPECIFICATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Current task contract defining objectives, deliverables, constraints, and success criteria.",
+  }),
+  route: Object.freeze({
+    key: "route",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.route}`,
+    schema: "routing-result",
+    owner: "PROTOCOL_GENERATED",
+    mutability: "MUTABLE_ON_REROUTE",
+    trustRole: "GUIDE_ROUTING_SPECIFICATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Deterministic engineering guide routing result bound to current contract.",
+  }),
+  preflight: Object.freeze({
+    key: "preflight",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.preflight}`,
+    schema: "preflight",
+    owner: "PROTOCOL_GENERATED",
+    mutability: "OVERWRITTEN_ON_PREFLIGHT",
+    trustRole: "READINESS_ATTESTATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Preflight readiness report verifying profile, contract, routing, and gates.",
+  }),
+  sources: Object.freeze({
+    key: "sources",
+    scope: "PROJECT",
+    path: PROJECT_ARTIFACT_PATHS.sources,
+    schema: "source-registry",
+    owner: "OPERATOR_OR_AGENT",
+    mutability: "MUTABLE_ON_DISCOVERY",
+    trustRole: "SOURCE_ATTESTATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Registry of discovered project facts, platforms, runtimes, and dependencies.",
+  }),
+  events: Object.freeze({
+    key: "events",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.events}`,
+    schema: "event",
+    owner: "PROTOCOL_APPENDED",
+    mutability: "APPEND_ONLY",
+    trustRole: "AUDIT_LEDGER",
+    isPublic: true,
+    isPersisted: true,
+    description: "Append-only cryptographic hash-chained event ledger.",
+  }),
+  session: Object.freeze({
+    key: "session",
+    scope: "SESSION",
+    path: `${SESSIONS_ROOT}/<session-id>.json`,
+    schema: "activation",
+    owner: "PROTOCOL_GENERATED",
+    mutability: "OVERWRITTEN_ON_ACTIVATE",
+    trustRole: "SESSION_MARKER",
+    isPublic: true,
+    isPersisted: true,
+    description: "Active harness session marker recording session ID and activation marker.",
+  }),
+  config: Object.freeze({
+    key: "config",
+    scope: "PROJECT",
+    path: PROJECT_ARTIFACT_PATHS.config,
+    schema: "config",
+    owner: "OPERATOR_OR_AGENT",
+    mutability: "MUTABLE_CONFIGURATION",
+    trustRole: "PROJECT_CONFIGURATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Local ForgeLoop configuration settings and overrides.",
+  }),
+  gates: Object.freeze({
+    key: "gates",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/gates/<gate>.json`,
+    schema: "gate",
+    owner: "AGENT_AUTHORED_OR_REVIEWER",
+    mutability: "OVERWRITTEN_ON_GATE_SATISFACTION",
+    trustRole: "GATE_APPROVAL_ATTESTATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Preflight gate satisfaction artifacts recording gate decisions, artifacts, and evidence.",
+  }),
+  state: Object.freeze({
+    key: "state",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.state}`,
+    schema: "work-state",
+    owner: "PROTOCOL_MANAGED",
+    mutability: "ATOMIC_STATE_TRANSITIONS",
+    trustRole: "CANONICAL_LIFECYCLE_STATE",
+    isPublic: true,
+    isPersisted: true,
+    description: "Canonical lifecycle work state recording active phase, checks, blockers, and fingerprints.",
+  }),
+  continuity: Object.freeze({
+    key: "continuity",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.continuity}`,
+    schema: "continuity",
+    owner: "AGENT_OR_HARNESS",
+    mutability: "MUTABLE_HANDOFF_NOTES",
+    trustRole: "NON_EVIDENCE_HANDOFF",
+    isPublic: true,
+    isPersisted: true,
+    description: "Cross-harness non-evidence handoff notes containing focus, remaining work, and inspect first targets.",
+  }),
+  receipt: Object.freeze({
+    key: "receipt",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/${TASK_ARTIFACT_FILES.receipt}`,
+    schema: "execution-receipt",
+    owner: "PROTOCOL_COMPILED",
+    mutability: "ATOMIC_COMPILATION",
+    trustRole: "EVIDENCE_COMPILATION",
+    isPublic: true,
+    isPersisted: true,
+    description: "Cryptographically bound verification receipt summarizing evidence coverage and publication readiness.",
+  }),
+  executions: Object.freeze({
+    key: "executions",
+    scope: "TASK",
+    path: `${TASK_STATE_ROOT}/<task-key>/executions/exec-<id>.json`,
+    schema: "execution",
+    owner: "PROTOCOL_EXECUTED",
+    mutability: "IMMUTABLE_ONCE_WRITTEN",
+    trustRole: "EXECUTION_PROVENANCE",
+    isPublic: true,
+    isPersisted: true,
+    description: "Attested command execution provenance recording argv, cwd, resolution, status, and exit code.",
+  }),
+});