@ccoalm/ccl-skills 0.16.0 → 0.18.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py

@@ -1,1183 +0,0 @@
-#!/usr/bin/env python3
-"""Validate a receipt-bound terminal ledger for an extraction review lane."""
-
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import os
-import re
-import stat
-import sys
-import unicodedata
-from datetime import datetime
-from pathlib import Path
-from typing import Any, NoReturn
-
-MAX_LEDGER_BYTES = 128_000
-MAX_RESULT_BYTES = 1_000_000
-MAX_EVIDENCE_BYTES = 128_000
-OBJECT_ID_RE = re.compile(r"(?:[0-9a-f]{40}|[0-9a-f]{64})")
-SHA256_RE = re.compile(r"[0-9a-f]{64}")
-RFC3339_RE = re.compile(
-    r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})"
-)
-TERMINAL_STATES = {
-    "ready_for_human_decision",
-    "continuation_authorization_required",
-    "baseline_race",
-}
-EXTERNAL_REVIEW_STATES = {"reviewed", "findings_pending", "post_review_budget"}
-KNOWN_REVIEW_STATES = EXTERNAL_REVIEW_STATES | {"self_reviewed"}
-# The extraction wrapper fixes the autonomous lane at one review plus one
-# challenge; every numeric bound below derives from these two constants so a
-# future budget change lands in exactly one place.
-WRAPPER_CHALLENGE_BUDGET = 1
-WRAPPER_AUTONOMOUS_ROUNDS = WRAPPER_CHALLENGE_BUDGET + 1
-# A fix that edits the reviewed owner package ends its chain by construction, so
-# the post-fix candidate is challenged in ONE succeeding chain rather than inside
-# the ended one. The lane therefore spans at most two chains: the wrapper-budget
-# chain plus a single succession challenge bound to the landing candidate.
-LANE_MAX_CHAINS = 2
-LANE_MAX_ROUNDS = WRAPPER_AUTONOMOUS_ROUNDS + 1
-DISPOSITIONS = {
-    "fixed",
-    "source_refuted",
-    "accepted_tradeoff",
-    "pre_existing_out_of_scope",
-    "needs_human_decision",
-    "open",
-}
-RESOLVED_DISPOSITIONS = {
-    "fixed",
-    "source_refuted",
-    "accepted_tradeoff",
-    "pre_existing_out_of_scope",
-}
-
-
-class StateError(Exception):
-    pass
-
-
-def fail(message: str) -> NoReturn:
-    raise StateError(message)
-
-
-def bounded_text(value: object, field: str, maximum: int = 1000) -> str:
-    if not isinstance(value, str) or value != value.strip() or not value:
-        fail(f"{field} must be a non-empty normalized string")
-    # Interior control characters would otherwise be echoed into stderr
-    # diagnostics (terminal-escape injection on the error path). C1 controls
-    # (NEL, CSI) and Unicode line/paragraph separators forge line breaks too.
-    if any(
-        ord(char) < 0x20 or 0x7F <= ord(char) <= 0x9F or char in "\u2028\u2029"
-        for char in value
-    ):
-        fail(f"{field} must not contain control characters")
-    # Default-ignorable format characters (ZWSP, word joiner, bidi controls)
-    # let visually identical class keys or predicates register as distinct,
-    # splitting one recurrence class below its sweep threshold.
-    if any(unicodedata.category(char) == "Cf" for char in value):
-        fail(f"{field} must not contain format characters")
-    try:
-        value.encode("utf-8")
-    except UnicodeEncodeError:
-        fail(f"{field} must be valid UTF-8 text")
-    if len(value) > maximum:
-        fail(f"{field} exceeds {maximum} characters")
-    return value
-
-
-def object_id(value: object, field: str) -> str:
-    text = bounded_text(value, field, 64)
-    if OBJECT_ID_RE.fullmatch(text) is None:
-        fail(f"{field} must be a lowercase 40- or 64-character hexadecimal object id")
-    return text
-
-
-def sha256(value: object, field: str) -> str:
-    text = bounded_text(value, field, 64)
-    if SHA256_RE.fullmatch(text) is None:
-        fail(f"{field} must be a lowercase 64-character SHA-256 digest")
-    return text
-
-
-def exact_object(value: object, fields: set[str], label: str) -> dict[str, Any]:
-    if not isinstance(value, dict) or set(value) != fields:
-        fail(f"{label} must contain exactly: {', '.join(sorted(fields))}")
-    return value
-
-
-def read_regular(path: Path, *, label: str, maximum: int) -> bytes:
-    if not hasattr(os, "O_NOFOLLOW") or not hasattr(os, "O_NONBLOCK"):
-        fail(f"platform cannot open {label} with no-follow and non-blocking safety")
-    try:
-        fd = os.open(
-            path,
-            os.O_RDONLY
-            | os.O_NOFOLLOW
-            | getattr(os, "O_CLOEXEC", 0)
-            | os.O_NONBLOCK,
-        )
-    except (OSError, UnicodeError, ValueError) as exc:
-        fail(f"{label} is unreadable: {exc}")
-    try:
-        try:
-            info = os.fstat(fd)
-        except OSError as exc:
-            fail(f"cannot inspect {label}: {exc}")
-        if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:
-            fail(f"{label} must be a singly linked regular file")
-        if info.st_size > maximum:
-            fail(f"{label} exceeds {maximum} bytes")
-        chunks: list[bytes] = []
-        remaining = maximum + 1
-        while remaining:
-            try:
-                chunk = os.read(fd, remaining)
-            except OSError as exc:
-                fail(f"cannot read {label}: {exc}")
-            if not chunk:
-                break
-            chunks.append(chunk)
-            remaining -= len(chunk)
-        raw = b"".join(chunks)
-    finally:
-        try:
-            os.close(fd)
-        except OSError:
-            pass
-    if len(raw) > maximum:
-        fail(f"{label} exceeds {maximum} bytes")
-    return raw
-
-
-def decode_json(raw: bytes, *, label: str) -> dict[str, Any]:
-    def unique_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
-        value: dict[str, Any] = {}
-        for key, item in pairs:
-            if key in value:
-                fail(f"{label} contains duplicate object key: {key}")
-            value[key] = item
-        return value
-
-    def reject_constant(constant: str) -> NoReturn:
-        fail(f"{label} contains a non-standard JSON constant: {constant}")
-
-    try:
-        value = json.loads(
-            raw.decode("utf-8"),
-            object_pairs_hook=unique_object,
-            parse_constant=reject_constant,
-        )
-    except StateError:
-        raise
-    except (UnicodeError, json.JSONDecodeError) as exc:
-        fail(f"{label} must be UTF-8 JSON: {exc}")
-    if not isinstance(value, dict):
-        fail(f"{label} must be a JSON object")
-    return value
-
-
-def sibling_name(value: object, field: str) -> str:
-    name = bounded_text(value, field, 255)
-    if Path(name).is_absolute() or Path(name).name != name or "/" in name or "\\" in name:
-        fail(f"{field} must name a file in the ledger directory")
-    return name
-
-
-def load_sibling(
-    ledger_dir: Path,
-    *,
-    file_value: object,
-    digest_value: object,
-    label: str,
-    maximum: int,
-) -> bytes:
-    name = sibling_name(file_value, f"{label}.file")
-    expected = sha256(digest_value, f"{label}.sha256")
-    raw = read_regular(ledger_dir / name, label=label, maximum=maximum)
-    actual = hashlib.sha256(raw).hexdigest()
-    if actual != expected:
-        fail(f"{label} digest does not match {name}")
-    return raw
-
-
-def canonical_hash(value: object, label: str) -> str:
-    try:
-        encoded = json.dumps(
-            value,
-            ensure_ascii=False,
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode()
-    except (TypeError, ValueError, UnicodeError) as exc:
-        fail(f"{label} is not canonical JSON: {exc}")
-    return hashlib.sha256(encoded).hexdigest()
-
-
-def parse_rfc3339(value: object, field: str) -> datetime:
-    text = bounded_text(value, field, 100)
-    if RFC3339_RE.fullmatch(text) is None:
-        fail(f"{field} must be a strict RFC3339 timestamp")
-    try:
-        parsed = datetime.fromisoformat(text[:-1] + "+00:00" if text.endswith("Z") else text)
-    except ValueError as exc:
-        fail(f"{field} must be a valid RFC3339 timestamp: {exc}")
-    if parsed.utcoffset() is None:
-        fail(f"{field} must include an RFC3339 UTC offset")
-    return parsed
-
-
-def load(path: Path) -> tuple[dict[str, Any], Path]:
-    raw = read_regular(path, label="ledger", maximum=MAX_LEDGER_BYTES)
-    value = decode_json(raw, label="ledger")
-    payload = exact_object(
-        value,
-        {
-            "schema_version",
-            "candidate_sha256",
-            "controller_receipts",
-            "completion_receipt",
-            "base_attestations",
-            "autonomous_round",
-            "controller_review_state",
-            "finding_classes",
-            "unreviewed_delta",
-            "closeout_state",
-        } | ({"finding_dispositions"} if "finding_dispositions" in value else set()),
-        "ledger",
-    )
-    return payload, path.absolute().parent
-
-
-def validate_scope(receipt: dict[str, Any], label: str) -> str:
-    scope = exact_object(
-        receipt.get("review_scope"),
-        {
-            "schema_version",
-            "intent_sha256",
-            "acceptance_sha256",
-            "stage",
-            "review_depth",
-            "risk_tags",
-            "challenge_budget",
-            "wording_only_proof_sha256",
-            "wording_only_scope_sha256",
-        },
-        f"{label}.review_scope",
-    )
-    if scope["schema_version"] != 3 or type(scope["schema_version"]) is not int:
-        fail(f"{label}.review_scope.schema_version must be 3")
-    sha256(scope["intent_sha256"], f"{label}.review_scope.intent_sha256")
-    sha256(scope["acceptance_sha256"], f"{label}.review_scope.acceptance_sha256")
-    stage = bounded_text(scope["stage"], f"{label}.review_scope.stage", 80)
-    depth = bounded_text(scope["review_depth"], f"{label}.review_scope.review_depth", 80)
-    risks = scope["risk_tags"]
-    if not isinstance(risks, list):
-        fail(f"{label}.review_scope.risk_tags must be an array")
-    normalized_risks = [
-        bounded_text(item, f"{label}.review_scope.risk_tags", 100) for item in risks
-    ]
-    if len(normalized_risks) != len(set(normalized_risks)):
-        fail(f"{label}.review_scope.risk_tags contains duplicates")
-    if scope["challenge_budget"] != WRAPPER_CHALLENGE_BUDGET or type(scope["challenge_budget"]) is not int:
-        fail(f"{label}.review_scope.challenge_budget must be {WRAPPER_CHALLENGE_BUDGET}")
-    if (
-        scope["wording_only_proof_sha256"] is not None
-        or scope["wording_only_scope_sha256"] is not None
-        or "wording_only_proof_sha256" not in receipt
-        or receipt["wording_only_proof_sha256"] is not None
-        or "wording_only_scope" not in receipt
-        or receipt["wording_only_scope"] is not None
-    ):
-        fail(f"{label} must bind the non-wording extraction scope")
-    recorded = sha256(receipt.get("review_scope_sha256"), f"{label}.review_scope_sha256")
-    if canonical_hash(scope, f"{label}.review_scope") != recorded:
-        fail(f"{label}.review_scope_sha256 does not reproduce review_scope")
-    if (
-        receipt.get("stage") != stage
-        or receipt.get("review_depth") != depth
-        or receipt.get("risk_tags") != normalized_risks
-    ):
-        fail(f"{label} top-level scope fields contradict review_scope")
-    return recorded
-
-
-def validate_controller_receipts(
-    payload: dict[str, Any], ledger_dir: Path
-) -> tuple[list[dict[str, Any]], list[str], dict[str, list[str]], str, str]:
-    refs = payload["controller_receipts"]
-    if not isinstance(refs, list) or not 1 <= len(refs) <= LANE_MAX_ROUNDS:
-        fail(
-            f"controller_receipts must contain one to {LANE_MAX_ROUNDS} ordered Agent rounds"
-        )
-    if payload["autonomous_round"] != len(refs) or type(payload["autonomous_round"]) is not int:
-        fail("autonomous_round must equal the ordered controller receipt count")
-
-    receipts: list[dict[str, Any]] = []
-    receipt_hashes: list[str] = []
-    finding_hashes: dict[str, list[str]] = {}
-    chain_id: str | None = None
-    final_chain_id: str | None = None
-    scope_hash: str | None = None
-    candidates: list[str] = []
-    succession_index: int | None = None
-    ledger_candidate = sha256(
-        payload["candidate_sha256"], "ledger.candidate_sha256"
-    )
-    for expected_index, value in enumerate(refs, start=1):
-        # A caller supplying more receipts than the lane can mint would
-        # otherwise claim a negative remaining count and reach completion
-        # validation as a ready-state budget bypass. The wrapper bound still
-        # governs each chain; the lane bound governs their sum.
-        if expected_index > LANE_MAX_ROUNDS:
-            fail("controller chain exceeds the lane budget")
-        ref = exact_object(
-            value, {"sequence", "file", "sha256"}, f"controller_receipts[{expected_index - 1}]"
-        )
-        if ref["sequence"] != expected_index or type(ref["sequence"]) is not int:
-            fail("controller receipt sequence must be contiguous from 1")
-        receipt_hash = sha256(ref["sha256"], f"controller_receipts[{expected_index - 1}].sha256")
-        raw = load_sibling(
-            ledger_dir,
-            file_value=ref["file"],
-            digest_value=receipt_hash,
-            label=f"controller receipt {expected_index}",
-            maximum=MAX_RESULT_BYTES,
-        )
-        receipt = decode_json(raw, label=f"controller receipt {expected_index}")
-        if receipt.get("schema_version") != 3 or type(receipt.get("schema_version")) is not int:
-            fail(f"controller receipt {expected_index} schema_version must be 3")
-        # A succession round opens a second chain, so its own chain arithmetic
-        # restarts at one while its lane position keeps counting. Classify first;
-        # every expectation below reads the chain position, not the lane index.
-        predecessor_chain = receipt.get("predecessor_chain_id")
-        is_succession = predecessor_chain is not None
-        if is_succession:
-            if expected_index != len(refs):
-                fail("a succession round must be the lane's final round")
-            if expected_index != WRAPPER_AUTONOMOUS_ROUNDS + 1:
-                fail("a succession round may only follow a spent wrapper chain")
-            succession_index = expected_index
-            chain_position = 1
-        else:
-            # Only a succession round may sit past the wrapper chain. Without this
-            # the caller claims a negative remaining count and reaches completion
-            # validation as a ready-state budget bypass.
-            if expected_index > WRAPPER_AUTONOMOUS_ROUNDS:
-                fail("controller chain exceeds the wrapper budget")
-            chain_position = expected_index
-        expected_mode = (
-            "challenge" if is_succession else "review" if expected_index == 1 else "challenge"
-        )
-        if receipt.get("mode") != expected_mode:
-            fail(f"controller receipt {expected_index} must have mode {expected_mode}")
-        if receipt.get("status") not in {"passed", "findings"}:
-            fail(f"controller receipt {expected_index} must have status passed or findings")
-        if receipt.get("review_chain_tracked") is not True:
-            fail(f"controller receipt {expected_index} must belong to a tracked chain")
-        current_chain = bounded_text(
-            receipt.get("review_chain_id"), f"controller receipt {expected_index}.review_chain_id", 120
-        )
-        if is_succession:
-            if current_chain == chain_id:
-                fail(
-                    f"controller receipt {expected_index} succeeds its own chain"
-                )
-            final_chain_id = current_chain
-        elif chain_id is None:
-            chain_id = current_chain
-            final_chain_id = current_chain
-        elif current_chain != chain_id:
-            fail(f"controller receipt {expected_index} review_chain_id changed")
-        if receipt.get("autonomous_review_index") != chain_position or type(
-            receipt.get("autonomous_review_index")
-        ) is not int:
-            fail(f"controller receipt {expected_index} autonomous_review_index is not contiguous")
-        expected_challenge_index = (
-            1 if is_succession else 0 if expected_index == 1 else expected_index - 1
-        )
-        if receipt.get("challenge_index") != expected_challenge_index or type(
-            receipt.get("challenge_index")
-        ) is not int:
-            fail(f"controller receipt {expected_index} challenge_index is invalid")
-        if receipt.get("challenge_budget") != WRAPPER_CHALLENGE_BUDGET or type(receipt.get("challenge_budget")) is not int:
-            fail(f"controller receipt {expected_index} challenge_budget must be {WRAPPER_CHALLENGE_BUDGET}")
-        if receipt.get("autonomous_review_budget") != WRAPPER_AUTONOMOUS_ROUNDS or type(
-            receipt.get("autonomous_review_budget")
-        ) is not int:
-            fail(f"controller receipt {expected_index} autonomous_review_budget must be {WRAPPER_AUTONOMOUS_ROUNDS}")
-        expected_remaining = WRAPPER_AUTONOMOUS_ROUNDS - chain_position
-        if receipt.get("autonomous_reviews_remaining") != expected_remaining or type(
-            receipt.get("autonomous_reviews_remaining")
-        ) is not int:
-            fail(f"controller receipt {expected_index} autonomous_reviews_remaining is invalid")
-        if receipt.get("autonomous_review_allowed") is not (expected_remaining > 0):
-            fail(f"controller receipt {expected_index} autonomous_review_allowed is invalid")
-        prior = receipt.get("prior_review_result_sha256")
-        expected_prior = [] if is_succession else receipt_hashes
-        if prior != expected_prior:
-            fail(f"controller receipt {expected_index} prior_review_result_sha256 is not the complete ordered prefix")
-        candidate = sha256(
-            receipt.get("candidate_sha256"), f"controller receipt {expected_index}.candidate_sha256"
-        )
-        packet = sha256(
-            receipt.get("packet_sha256"), f"controller receipt {expected_index}.packet_sha256"
-        )
-        if packet != candidate:
-            fail(f"controller receipt {expected_index} packet_sha256 must equal candidate_sha256")
-        # Which candidate a round must bind depends on its phase, and the phase
-        # split is only known once every round is loaded, so this is settled
-        # after the loop rather than here.
-        candidates.append(candidate)
-        current_scope_hash = validate_scope(receipt, f"controller receipt {expected_index}")
-        if scope_hash is None:
-            scope_hash = current_scope_hash
-        elif current_scope_hash != scope_hash:
-            fail(f"controller receipt {expected_index} review scope changed")
-
-        findings = receipt.get("findings")
-        if not isinstance(findings, list):
-            fail(f"controller receipt {expected_index}.findings must be an array")
-        current_findings: list[str] = []
-        current_finding_set: set[str] = set()
-        for finding_index, finding in enumerate(findings):
-            if not isinstance(finding, dict):
-                fail(f"controller receipt {expected_index}.findings[{finding_index}] must be an object")
-            finding_hash = canonical_hash(
-                finding, f"controller receipt {expected_index}.findings[{finding_index}]"
-            )
-            if finding_hash in current_finding_set:
-                # Raw receipts stay intact; repeated canonical payloads share
-                # this receipt's existing finding identity and first-seen order.
-                continue
-            current_finding_set.add(finding_hash)
-            current_findings.append(finding_hash)
-        if receipt["status"] == "passed" and findings:
-            fail(f"controller receipt {expected_index} passed status cannot carry findings")
-        if receipt["status"] == "findings" and not findings:
-            fail(f"controller receipt {expected_index} findings status requires findings")
-        state = bounded_text(
-            receipt.get("review_state"), f"controller receipt {expected_index}.review_state", 80
-        )
-        if state not in EXTERNAL_REVIEW_STATES:
-            fail(f"controller receipt {expected_index} has unknown controller review_state {state}")
-        expected_state = (
-            "post_review_budget"
-            if receipt["status"] == "findings" and chain_position == WRAPPER_AUTONOMOUS_ROUNDS
-            else "findings_pending"
-            if receipt["status"] == "findings"
-            else "reviewed"
-        )
-        if state != expected_state:
-            fail(f"controller receipt {expected_index} review_state contradicts status and round")
-        if receipt.get("human_decision_required") is not (state == "post_review_budget"):
-            fail(f"controller receipt {expected_index} human_decision_required contradicts review_state")
-
-        receipts.append(receipt)
-        receipt_hashes.append(receipt_hash)
-        finding_hashes[receipt_hash] = current_findings
-
-    if chain_id is None or scope_hash is None or final_chain_id is None:
-        fail("controller receipt chain is empty")
-
-    # Phase binding. Without a succession every counted round must have inspected
-    # the exact final candidate. With one, the wrapper chain reviewed the candidate
-    # the fix batch then moved, and the succession round is the only round that can
-    # bind what actually lands — which is the whole point of running it.
-    if succession_index is None:
-        for position, value in enumerate(candidates, start=1):
-            if value != ledger_candidate:
-                fail(f"controller receipt {position} does not bind the ledger candidate")
-    else:
-        succession = receipts[-1]
-        succeeded_candidate = sha256(
-            succession.get("predecessor_candidate_sha256"),
-            "succession receipt.predecessor_candidate_sha256",
-        )
-        if candidates[-1] != ledger_candidate:
-            fail("the succession round does not bind the ledger candidate")
-        if succeeded_candidate == ledger_candidate:
-            fail("a succession round must bind a candidate the wrapper chain never saw")
-        for position, value in enumerate(candidates[:-1], start=1):
-            if value != succeeded_candidate:
-                fail(f"controller receipt {position} does not bind the succeeded candidate")
-        if succession.get("predecessor_chain_id") != chain_id:
-            fail("the succession round does not name the chain it succeeds")
-        if sha256(
-            succession.get("predecessor_result_sha256"),
-            "succession receipt.predecessor_result_sha256",
-        ) != receipt_hashes[-2]:
-            fail("the succession round does not bind the succeeded chain's terminal receipt")
-    return receipts, receipt_hashes, finding_hashes, final_chain_id, scope_hash
-
-
-def validate_completion_receipt(
-    value: object,
-    ledger_dir: Path,
-    receipts: list[dict[str, Any]],
-    receipt_hashes: list[str],
-    chain_id: str,
-    scope_hash: str,
-) -> dict[str, Any] | None:
-    if value is None:
-        return None
-    ref = exact_object(value, {"file", "sha256"}, "completion_receipt")
-    raw = load_sibling(
-        ledger_dir,
-        file_value=ref["file"],
-        digest_value=ref["sha256"],
-        label="completion receipt",
-        maximum=MAX_RESULT_BYTES,
-    )
-    receipt = decode_json(raw, label="completion receipt")
-    final = receipts[-1]
-    if (
-        receipt.get("schema_version") != 3
-        or type(receipt.get("schema_version")) is not int
-        or receipt.get("mode") != "complete"
-        or receipt.get("status") != "passed"
-        or receipt.get("review_state") != "self_reviewed"
-        or receipt.get("completion_gated") is not False
-        or receipt.get("next_action") != "complete"
-        or receipt.get("findings") != []
-    ):
-        fail("completion receipt must be a passed self_reviewed complete result")
-    basis = receipt.get("completion_basis", "external_pass")
-    if basis == "external_pass":
-        if final.get("status") != "passed" or final.get("findings") != []:
-            fail("completion receipt cannot close a final external receipt with findings")
-        if receipt.get("finding_dispositions_sha256") is not None or receipt.get(
-            "resolved_finding_occurrences", []
-        ) != []:
-            fail("external_pass completion cannot carry finding dispositions")
-    elif basis == "source_refuted_findings":
-        if (
-            len(receipts) < 2
-            or receipts[0].get("mode") != "review"
-            or final.get("mode") != "challenge"
-            or final.get("status") not in {"passed", "findings"}
-            or any(item.get("predecessor_chain_id") is not None for item in receipts)
-            or any(item.get("candidate_sha256") != final.get("candidate_sha256") for item in receipts)
-        ):
-            fail("source_refuted completion requires a same-candidate review and challenge without succession")
-    else:
-        fail("completion receipt has an unknown completion_basis")
-    if receipt.get("review_chain_tracked") is not True or receipt.get("review_chain_id") != chain_id:
-        fail("completion receipt review_chain_id does not match the controller chain")
-    if receipt.get("challenge_budget") != WRAPPER_CHALLENGE_BUDGET or type(receipt.get("challenge_budget")) is not int:
-        fail(f"completion receipt challenge_budget must be {WRAPPER_CHALLENGE_BUDGET}")
-    if receipt.get("autonomous_review_budget") != WRAPPER_AUTONOMOUS_ROUNDS or type(
-        receipt.get("autonomous_review_budget")
-    ) is not int:
-        fail(f"completion receipt autonomous_review_budget must be {WRAPPER_AUTONOMOUS_ROUNDS}")
-    # The completion checkpoint binds the final external round, so its chain
-    # arithmetic is that round's — which is the succeeding chain's when a fix
-    # batch ended the wrapper chain, not the lane's round count.
-    final_index = final.get("autonomous_review_index")
-    if receipt.get("autonomous_review_index") != final_index or type(
-        receipt.get("autonomous_review_index")
-    ) is not int:
-        fail("completion receipt autonomous_review_index does not match the final round")
-    expected_remaining = WRAPPER_AUTONOMOUS_ROUNDS - final_index
-    if receipt.get("autonomous_reviews_remaining") != expected_remaining or type(
-        receipt.get("autonomous_reviews_remaining")
-    ) is not int:
-        fail("completion receipt autonomous_reviews_remaining does not match the final round")
-    if receipt.get("autonomous_review_allowed") is not False:
-        fail("completion receipt must disable further autonomous review")
-    if receipt.get("prior_review_result_sha256") != final.get(
-        "prior_review_result_sha256"
-    ):
-        fail("completion receipt prior_review_result_sha256 does not match the final external receipt")
-    if receipt.get("completion_review_result_sha256") != receipt_hashes[-1]:
-        fail("completion receipt completion_review_result_sha256 does not identify the final external receipt")
-    candidate = sha256(receipt.get("candidate_sha256"), "completion receipt.candidate_sha256")
-    packet = sha256(receipt.get("packet_sha256"), "completion receipt.packet_sha256")
-    if packet != candidate or candidate != final.get("candidate_sha256"):
-        fail("completion receipt does not bind the exact final candidate")
-    if validate_scope(receipt, "completion receipt") != scope_hash:
-        fail("completion receipt review scope changed")
-    return receipt
-
-
-def validate_completion_dispositions(
-    payload: dict[str, Any],
-    ledger_dir: Path,
-    completion: dict[str, Any] | None,
-    receipt_hashes: list[str],
-    receipt_findings: dict[str, list[str]],
-    candidate: str,
-) -> None:
-    if completion is None or completion.get("completion_basis") != "source_refuted_findings":
-        if "finding_dispositions" in payload:
-            fail("finding_dispositions requires a source_refuted_findings completion")
-        return
-    ref = exact_object(payload.get("finding_dispositions"), {"file", "sha256"}, "finding_dispositions")
-    raw = load_sibling(
-        ledger_dir,
-        file_value=ref["file"],
-        digest_value=ref["sha256"],
-        label="finding dispositions",
-        maximum=MAX_EVIDENCE_BYTES,
-    )
-    if completion.get("finding_dispositions_sha256") != ref["sha256"]:
-        fail("completion disposition digest does not match the bound finding_dispositions file")
-    document = exact_object(
-        decode_json(raw, label="finding dispositions"),
-        {"schema_version", "candidate_sha256", "review_result_sha256", "dispositions"},
-        "finding dispositions",
-    )
-    if type(document["schema_version"]) is not int or document["schema_version"] != 1:
-        fail("finding dispositions schema_version must be 1")
-    if sha256(document["candidate_sha256"], "finding dispositions.candidate_sha256") != candidate:
-        fail("finding dispositions are stale for the current candidate")
-    if document["review_result_sha256"] != receipt_hashes:
-        fail("finding dispositions must bind the full ordered controller receipts")
-    expected = [
-        {"receipt_sha256": receipt_hash, "finding_sha256": finding_hash}
-        for receipt_hash in receipt_hashes
-        for finding_hash in receipt_findings[receipt_hash]
-    ]
-    if not expected:
-        fail("source_refuted completion requires at least one controller finding")
-    if completion.get("resolved_finding_occurrences") != expected:
-        fail("completion resolved_finding_occurrences must match the ordered controller findings")
-    dispositions = document["dispositions"]
-    if not isinstance(dispositions, list) or len(dispositions) != len(expected):
-        fail("finding dispositions must cover the full ordered controller findings")
-    class_occurrences = {
-        (item["receipt_sha256"], item["finding_sha256"]): item
-        for row in payload["finding_classes"]
-        for item in row["occurrences"]
-    }
-    for index, (value, expected_pair) in enumerate(zip(dispositions, expected)):
-        label = f"finding dispositions.dispositions[{index}]"
-        row = exact_object(value, {"receipt_sha256", "finding_sha256", "disposition", "evidence"}, label)
-        if any(row[key] != value for key, value in expected_pair.items()):
-            fail("finding dispositions must cover the full ordered controller findings")
-        occurrence = class_occurrences[(row["receipt_sha256"], row["finding_sha256"])]
-        if row["disposition"] != "source_refuted" or occurrence["disposition"] != "source_refuted":
-            fail("adjudicated completion permits only source_refuted finding occurrences")
-        evidence = row["evidence"]
-        if not isinstance(evidence, list) or not evidence:
-            fail(f"{label} requires a non-empty evidence array")
-        for evidence_index, item in enumerate(evidence):
-            bounded_text(item, f"{label}.evidence[{evidence_index}]", 1000)
-        if len(evidence) != len(set(evidence)):
-            fail(f"{label}.evidence contains duplicates")
-        # Class validation already binds this witness to the candidate, raw
-        # finding, and disposition. Require the complete checkpoint to use the
-        # same evidence; neither record authenticates its semantic truth.
-        witness = decode_json(load_sibling(
-            ledger_dir,
-            file_value=occurrence["disposition_evidence_file"],
-            digest_value=occurrence["disposition_evidence_sha256"],
-            label=f"{label} class disposition evidence",
-            maximum=MAX_EVIDENCE_BYTES,
-        ), label=f"{label} class disposition evidence")
-        if evidence != witness["evidence"]:
-            fail(f"{label} does not match its class disposition evidence")
-
-
-def validate_base_attestations(
-    payload: dict[str, Any],
-    ledger_dir: Path,
-    receipt_hashes: list[str],
-    closeout: str,
-) -> int:
-    attestations = payload["base_attestations"]
-    if not isinstance(attestations, list) or not attestations:
-        fail("base_attestations must be a non-empty array")
-    base_shas: list[str] = []
-    mapped_receipts: list[str] = []
-    mapped_receipt_bases: list[str] = []
-    expected_remote: str | None = None
-    expected_ref: str | None = None
-    previous_time: datetime | None = None
-    base_changes = 0
-    second_drift_sequence: int | None = None
-    for index, item in enumerate(attestations, start=1):
-        row = exact_object(
-            item,
-            {
-                "sequence",
-                "remote",
-                "ref",
-                "sha",
-                "confirmed_at",
-                "controller_receipt_sha256",
-                "evidence_file",
-                "evidence_sha256",
-            },
-            f"base_attestations[{index - 1}]",
-        )
-        if row["sequence"] != index or type(row["sequence"]) is not int:
-            fail("base attestation sequence must be contiguous from 1")
-        remote = bounded_text(row["remote"], f"base_attestations[{index - 1}].remote", 200)
-        ref = bounded_text(row["ref"], f"base_attestations[{index - 1}].ref", 300)
-        if expected_remote is None:
-            expected_remote, expected_ref = remote, ref
-        elif remote != expected_remote or ref != expected_ref:
-            fail("base attestations must use the same remote and ref")
-        base_sha = object_id(row["sha"], f"base_attestations[{index - 1}].sha")
-        if base_shas and base_sha != base_shas[-1]:
-            base_changes += 1
-            if base_changes == 2:
-                second_drift_sequence = index
-        confirmed = parse_rfc3339(
-            row["confirmed_at"], f"base_attestations[{index - 1}].confirmed_at"
-        )
-        if previous_time is not None and confirmed <= previous_time:
-            fail("base attestation confirmed_at values must strictly increase")
-        previous_time = confirmed
-        raw = load_sibling(
-            ledger_dir,
-            file_value=row["evidence_file"],
-            digest_value=row["evidence_sha256"],
-            label=f"base attestation {index} evidence",
-            maximum=MAX_EVIDENCE_BYTES,
-        )
-        expected_raw = f"{base_sha}\t{ref}\n".encode()
-        if raw != expected_raw:
-            fail(f"base attestation {index} evidence does not contain canonical ls-remote output")
-        receipt_hash_value = row["controller_receipt_sha256"]
-        if receipt_hash_value is not None:
-            if second_drift_sequence is not None:
-                fail(
-                    "a controller receipt is mapped at or after the second base drift"
-                )
-            mapped_receipts.append(
-                sha256(
-                    receipt_hash_value,
-                    f"base_attestations[{index - 1}].controller_receipt_sha256",
-                )
-            )
-            mapped_receipt_bases.append(base_sha)
-        base_shas.append(base_sha)
-    if mapped_receipts != receipt_hashes:
-        fail("base attestations must map every controller receipt exactly once in order")
-    second_drift = base_changes >= 2
-    if second_drift != (closeout == "baseline_race"):
-        fail("the second base drift must terminate as baseline_race, and baseline_race requires two ordered base changes")
-    if (
-        closeout != "baseline_race"
-        and mapped_receipt_bases[-1] != base_shas[-1]
-    ):
-        fail(
-            "the final controller receipt does not consume the latest attested base"
-        )
-    return base_changes
-
-
-def validate_disposition_evidence(
-    ledger_dir: Path,
-    *,
-    file_value: object,
-    digest_value: object,
-    candidate: str,
-    receipt_hash: str,
-    finding_hash: str,
-    disposition: str,
-    class_key: str,
-    occurrence_index: int,
-    class_pairs: list[tuple[str, str]],
-    unresolved_pairs: set[tuple[str, str]],
-) -> list[tuple[str, str]]:
-    label = f"finding class {class_key} disposition evidence {occurrence_index + 1}"
-    raw = load_sibling(
-        ledger_dir,
-        file_value=file_value,
-        digest_value=digest_value,
-        label=label,
-        maximum=MAX_EVIDENCE_BYTES,
-    )
-    evidence = exact_object(
-        decode_json(raw, label=label),
-        {
-            "schema_version",
-            "candidate_sha256",
-            "receipt_sha256",
-            "finding_sha256",
-            "disposition",
-            "resolves_occurrences",
-            "evidence",
-        },
-        label,
-    )
-    if evidence["schema_version"] != 1 or type(evidence["schema_version"]) is not int:
-        fail(f"{label}.schema_version must be 1")
-    if sha256(evidence["candidate_sha256"], f"{label}.candidate_sha256") != candidate:
-        fail(f"{label} is stale for the current candidate")
-    if sha256(evidence["receipt_sha256"], f"{label}.receipt_sha256") != receipt_hash:
-        fail(f"{label} does not bind its controller receipt")
-    if sha256(evidence["finding_sha256"], f"{label}.finding_sha256") != finding_hash:
-        fail(f"{label} does not bind its controller finding")
-    if bounded_text(evidence["disposition"], f"{label}.disposition", 80) != disposition:
-        fail(f"{label} does not bind its disposition")
-
-    refs = evidence["resolves_occurrences"]
-    if not isinstance(refs, list) or not refs:
-        fail(f"{label}.resolves_occurrences must be a non-empty array")
-    resolved_pairs: list[tuple[str, str]] = []
-    seen_resolved: set[tuple[str, str]] = set()
-    for resolved_index, value in enumerate(refs):
-        resolved = exact_object(
-            value,
-            {"receipt_sha256", "finding_sha256"},
-            f"{label}.resolves_occurrences[{resolved_index}]",
-        )
-        pair = (
-            sha256(
-                resolved["receipt_sha256"],
-                f"{label}.resolves_occurrences[{resolved_index}].receipt_sha256",
-            ),
-            sha256(
-                resolved["finding_sha256"],
-                f"{label}.resolves_occurrences[{resolved_index}].finding_sha256",
-            ),
-        )
-        if pair in seen_resolved:
-            fail(f"{label} repeats a resolved occurrence")
-        if pair not in class_pairs:
-            fail(f"{label} resolves an occurrence outside the current class prefix")
-        if pair not in unresolved_pairs:
-            fail(f"{label} resolves an occurrence that is not currently unresolved")
-        seen_resolved.add(pair)
-        resolved_pairs.append(pair)
-    current_pair = (receipt_hash, finding_hash)
-    if current_pair not in seen_resolved:
-        fail(f"{label} must resolve its current occurrence")
-    expected_order = [pair for pair in class_pairs if pair in seen_resolved]
-    if resolved_pairs != expected_order:
-        fail(f"{label}.resolves_occurrences must follow finding class order")
-
-    evidence_items = evidence["evidence"]
-    if not isinstance(evidence_items, list) or not evidence_items:
-        fail(f"{label}.evidence must be a non-empty array")
-    normalized_evidence = [
-        bounded_text(value, f"{label}.evidence[{index}]", 1000)
-        for index, value in enumerate(evidence_items)
-    ]
-    if len(normalized_evidence) != len(set(normalized_evidence)):
-        fail(f"{label}.evidence contains duplicates")
-    return resolved_pairs
-
-
-def validate_finding_classes(
-    payload: dict[str, Any],
-    ledger_dir: Path,
-    receipt_findings: dict[str, list[str]],
-    candidate: str,
-    closeout: str,
-) -> bool:
-    classes = payload["finding_classes"]
-    if not isinstance(classes, list):
-        fail("finding_classes must be an array")
-    expected_pairs = {
-        (receipt_hash, finding_hash)
-        for receipt_hash, findings in receipt_findings.items()
-        for finding_hash in findings
-    }
-    seen_pairs: set[tuple[str, str]] = set()
-    seen_keys: set[str] = set()
-    seen_predicates: dict[str, str] = {}
-    any_unresolved = False
-    finding_order = {
-        (receipt_hash, finding_hash): (receipt_index, finding_index)
-        for receipt_index, (receipt_hash, findings) in enumerate(receipt_findings.items())
-        for finding_index, finding_hash in enumerate(findings)
-    }
-    for class_index, item in enumerate(classes):
-        row = exact_object(
-            item,
-            {"key", "root_cause_predicate", "affected_surface", "occurrences", "authoritative_sweep"},
-            f"finding_classes[{class_index}]",
-        )
-        key = bounded_text(row["key"], f"finding_classes[{class_index}].key", 120)
-        if key in seen_keys:
-            fail(f"duplicate finding class key: {key}")
-        seen_keys.add(key)
-        predicate = bounded_text(
-            row["root_cause_predicate"],
-            f"finding_classes[{class_index}].root_cause_predicate",
-            2000,
-        )
-        normalized_predicate = " ".join(predicate.casefold().split())
-        prior_key = seen_predicates.get(normalized_predicate)
-        if prior_key is not None:
-            fail(
-                "duplicate normalized root_cause_predicate across finding classes: "
-                f"{prior_key}, {key}"
-            )
-        seen_predicates[normalized_predicate] = key
-        bounded_text(
-            row["affected_surface"], f"finding_classes[{class_index}].affected_surface", 500
-        )
-        occurrences = row["occurrences"]
-        if not isinstance(occurrences, list) or not occurrences:
-            fail(f"finding_classes[{class_index}].occurrences must be non-empty")
-        class_order: list[tuple[int, int]] = []
-        class_pairs: list[tuple[str, str]] = []
-        unresolved_pairs: set[tuple[str, str]] = set()
-        human_decision_pairs: set[tuple[str, str]] = set()
-        for occurrence_index, occurrence in enumerate(occurrences):
-            occurrence_label = (
-                f"finding_classes[{class_index}].occurrences[{occurrence_index}]"
-            )
-            if not isinstance(occurrence, dict):
-                fail(f"{occurrence_label} must be an object")
-            disposition = bounded_text(
-                occurrence.get("disposition"),
-                f"{occurrence_label}.disposition",
-                80,
-            )
-            if disposition not in DISPOSITIONS:
-                fail(f"finding class {key} has an unknown disposition")
-            occurrence_fields = {
-                "receipt_sha256",
-                "finding_sha256",
-                "disposition",
-            }
-            if disposition in RESOLVED_DISPOSITIONS:
-                occurrence_fields |= {
-                    "disposition_evidence_file",
-                    "disposition_evidence_sha256",
-                }
-            occurrence_row = exact_object(
-                occurrence,
-                occurrence_fields,
-                occurrence_label,
-            )
-            receipt_hash = sha256(
-                occurrence_row["receipt_sha256"],
-                f"finding_classes[{class_index}].occurrences[{occurrence_index}].receipt_sha256",
-            )
-            finding_hash = sha256(
-                occurrence_row["finding_sha256"],
-                f"finding_classes[{class_index}].occurrences[{occurrence_index}].finding_sha256",
-            )
-            pair = (receipt_hash, finding_hash)
-            if pair not in expected_pairs:
-                fail(f"finding class {key} occurrence does not identify a finding in its controller receipt")
-            if pair in seen_pairs:
-                fail(f"controller finding {finding_hash} is classified more than once")
-            seen_pairs.add(pair)
-            class_order.append(finding_order[pair])
-            class_pairs.append(pair)
-            unresolved_pairs.add(pair)
-            if disposition == "needs_human_decision":
-                human_decision_pairs.add(pair)
-            if disposition in RESOLVED_DISPOSITIONS:
-                resolved_pairs = validate_disposition_evidence(
-                    ledger_dir,
-                    file_value=occurrence_row["disposition_evidence_file"],
-                    digest_value=occurrence_row["disposition_evidence_sha256"],
-                    candidate=candidate,
-                    receipt_hash=receipt_hash,
-                    finding_hash=finding_hash,
-                    disposition=disposition,
-                    class_key=key,
-                    occurrence_index=occurrence_index,
-                    class_pairs=class_pairs,
-                    unresolved_pairs=unresolved_pairs,
-                )
-                if human_decision_pairs.intersection(resolved_pairs):
-                    fail(
-                        f"finding class {key} local evidence cannot resolve a "
-                        "needs_human_decision occurrence"
-                    )
-                unresolved_pairs.difference_update(resolved_pairs)
-        if class_order != sorted(class_order):
-            fail(f"finding class {key} occurrences are not in controller receipt order")
-        any_unresolved |= bool(unresolved_pairs)
-
-        sweep = row["authoritative_sweep"]
-        if len(occurrences) >= 3:
-            sweep_row = exact_object(
-                sweep,
-                {
-                    "candidate_sha256",
-                    "manifest_file",
-                    "manifest_sha256",
-                    "searched_set",
-                    "unmatched_instances",
-                },
-                f"finding_classes[{class_index}].authoritative_sweep",
-            )
-            if sha256(
-                sweep_row["candidate_sha256"],
-                f"finding_classes[{class_index}].authoritative_sweep.candidate_sha256",
-            ) != candidate:
-                fail(f"finding class {key} sweep is stale for the current candidate")
-            searched = sweep_row["searched_set"]
-            if not isinstance(searched, list) or not searched:
-                fail(f"finding class {key} third occurrence requires a non-empty searched_set")
-            normalized = [
-                bounded_text(value, f"finding class {key} searched_set", 500)
-                for value in searched
-            ]
-            if len(normalized) != len(set(normalized)):
-                fail(f"finding class {key} searched_set contains duplicates")
-            unmatched = sweep_row["unmatched_instances"]
-            if type(unmatched) is not int or unmatched < 0:
-                fail(f"finding class {key} unmatched_instances must be a non-negative integer")
-            manifest_raw = load_sibling(
-                ledger_dir,
-                file_value=sweep_row["manifest_file"],
-                digest_value=sweep_row["manifest_sha256"],
-                label=f"finding class {key} sweep manifest",
-                maximum=MAX_EVIDENCE_BYTES,
-            )
-            manifest = exact_object(
-                decode_json(manifest_raw, label=f"finding class {key} sweep manifest"),
-                {"schema_version", "candidate_sha256", "searched_set", "unmatched_instances"},
-                f"finding class {key} sweep manifest",
-            )
-            if manifest["schema_version"] != 1 or type(manifest["schema_version"]) is not int:
-                fail(f"finding class {key} sweep manifest schema_version must be 1")
-            if sha256(manifest["candidate_sha256"], f"finding class {key} sweep manifest candidate") != candidate:
-                fail(f"finding class {key} sweep manifest is stale")
-            if manifest["searched_set"] != normalized:
-                fail(f"finding class {key} searched_set does not match its sweep manifest")
-            unmatched_items = manifest["unmatched_instances"]
-            if not isinstance(unmatched_items, list):
-                fail(f"finding class {key} sweep manifest unmatched_instances must be an array")
-            normalized_unmatched = [
-                bounded_text(value, f"finding class {key} unmatched instance", 500)
-                for value in unmatched_items
-            ]
-            if len(normalized_unmatched) != len(set(normalized_unmatched)):
-                fail(f"finding class {key} sweep manifest repeats an unmatched instance")
-            if len(normalized_unmatched) != unmatched:
-                fail(f"finding class {key} unmatched_instances count does not match its sweep manifest")
-            if closeout == "ready_for_human_decision" and unmatched != 0:
-                fail(f"finding class {key} ready sweep must report zero unmatched instances")
-        elif sweep is not None:
-            fail(f"finding class {key} has a sweep before its third occurrence")
-    if seen_pairs != expected_pairs:
-        fail("finding_classes omits controller findings")
-    return any_unresolved
-
-
-def validate(payload: dict[str, Any], ledger_dir: Path) -> tuple[str, int, int]:
-    if payload["schema_version"] != 3 or type(payload["schema_version"]) is not int:
-        fail("schema_version must be 3")
-    candidate = sha256(payload["candidate_sha256"], "candidate_sha256")
-    closeout = bounded_text(payload["closeout_state"], "closeout_state", 80)
-    if closeout not in TERMINAL_STATES:
-        fail("closeout_state is not an extraction terminal state")
-
-    receipts, receipt_hashes, receipt_findings, chain_id, scope_hash = (
-        validate_controller_receipts(payload, ledger_dir)
-    )
-    if receipts[-1]["candidate_sha256"] != candidate:
-        fail("candidate_sha256 must equal the final controller receipt candidate")
-    completion = validate_completion_receipt(
-        payload["completion_receipt"],
-        ledger_dir,
-        receipts,
-        receipt_hashes,
-        chain_id,
-        scope_hash,
-    )
-    base_changes = validate_base_attestations(
-        payload, ledger_dir, receipt_hashes, closeout
-    )
-    any_unresolved = validate_finding_classes(
-        payload, ledger_dir, receipt_findings, candidate, closeout
-    )
-    validate_completion_dispositions(
-        payload, ledger_dir, completion, receipt_hashes, receipt_findings, candidate
-    )
-
-    delta = payload["unreviewed_delta"]
-    if not isinstance(delta, list):
-        fail("unreviewed_delta must be an array")
-    for index, value in enumerate(delta):
-        bounded_text(value, f"unreviewed_delta[{index}]", 500)
-
-    if closeout == "ready_for_human_decision" and completion is None:
-        fail("ready_for_human_decision requires a completion receipt")
-    if closeout == "continuation_authorization_required" and completion is not None:
-        fail("continuation_authorization_required cannot carry a completion receipt")
-    if closeout == "baseline_race" and completion is not None:
-        fail("baseline_race cannot carry a completion receipt")
-
-    controller_state = bounded_text(
-        payload["controller_review_state"], "controller_review_state", 80
-    )
-    if controller_state not in KNOWN_REVIEW_STATES:
-        fail(f"unknown controller review_state {controller_state}")
-    derived_state = completion["review_state"] if completion is not None else receipts[-1]["review_state"]
-    if controller_state != derived_state:
-        fail("controller_review_state does not match the referenced final receipt")
-
-    if closeout == "ready_for_human_decision":
-        if len(receipts) < 2:
-            fail("ready_for_human_decision ready requires at least one tracked challenge")
-        if completion is None:
-            fail("ready_for_human_decision requires a completion receipt")
-        if completion["candidate_sha256"] != candidate or receipts[-1]["candidate_sha256"] != candidate:
-            fail("ready_for_human_decision completion receipt must bind the exact final candidate")
-        if any_unresolved or delta:
-            fail("ready_for_human_decision requires no unresolved finding occurrence and no unreviewed delta")
-    elif closeout == "continuation_authorization_required":
-        final = receipts[-1]
-        # The lane is spent either at the wrapper chain's last round, or — when a
-        # fix batch moved the candidate — at the succession round that reviewed it.
-        # Only the closeout knows the lane is spent: the controller sizes
-        # human_decision_required from its own chain, where the succession round
-        # is round one of two.
-        succeeded = final.get("predecessor_chain_id") is not None
-        if succeeded:
-            spent = (
-                len(receipts) == LANE_MAX_ROUNDS and final.get("status") == "findings"
-            )
-        else:
-            spent = (
-                len(receipts) == WRAPPER_AUTONOMOUS_ROUNDS
-                and final.get("status") == "findings"
-                and final.get("review_state") == "post_review_budget"
-                and final.get("human_decision_required") is True
-            )
-        if not spent:
-            fail(
-                "continuation_authorization_required requires final-round "
-                f"(round {WRAPPER_AUTONOMOUS_ROUNDS}) findings in post_review_budget, "
-                f"or a succession round (round {LANE_MAX_ROUNDS}) carrying findings"
-            )
-    elif closeout == "baseline_race" and not delta:
-        fail("baseline_race requires a non-empty unreviewed_delta")
-
-    return closeout, len(payload["finding_classes"]), base_changes
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("state_file", type=Path)
-    args = parser.parse_args()
-    try:
-        payload, ledger_dir = load(args.state_file)
-        state, class_count, base_changes = validate(payload, ledger_dir)
-    except StateError as exc:
-        print(f"extraction_review_state_invalid: {exc}", file=sys.stderr)
-        return 1
-    except (OSError, UnicodeError, ValueError):
-        print(
-            "extraction_review_state_invalid: local evidence read or encoding failed",
-            file=sys.stderr,
-        )
-        return 1
-    print(
-        "extraction_review_state_ok: "
-        f"closeout_state={state} finding_classes={class_count} base_changes={base_changes}"
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())