@citeark/agent 0.3.20

package/src/cap/v2/pipeline-artifact.mjs

@@ -0,0 +1,922 @@
+import { measurementAssessmentRecords } from './measurement-assessment-records.mjs';
+import { researchObjectRecords } from './research-object-records.mjs';
+import { enrichExecutionGraph } from '../../graph/execution.mjs';
+import { lstat, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import {
+  executionContractMeasurements,
+  verificationPolicyCommitmentInput,
+} from "../../contracts/execution-contract.mjs";
+import { mediaTypeForPath } from "../../results/output-registry.mjs";
+import { metricMeasurements } from "../../records/views.mjs";
+import {
+  CiteArkError,
+  pathExists,
+  safeRelativePath,
+  sha256File,
+} from "../../util.mjs";
+import {
+  attachCapAttestation,
+  signCapArtifact,
+} from "./attestation.mjs";
+import {
+  CAP_PROFILE,
+  CAP_RECORD_TYPE,
+  assembleCapDirectory,
+} from "./core.mjs";
+import {
+  canonicalJsonBytes,
+  sha256Bytes,
+} from "./canonical-json.mjs";
+import { verifyCapDirectory } from "./verify.mjs";
+
+export const CAP_INLINE_BLOB_MAX_BYTES = 64 * 1024 * 1024;
+
+const SCHEMA = Object.freeze({
+  actor: "https://citeark.com/schemas/cap/v2/agent.schema.json",
+  sourceWork: "https://citeark.com/schemas/cap/v2/entity.schema.json",
+  claim: "https://citeark.com/schemas/cap/v2/assertion.schema.json",
+  experiment: "https://citeark.com/schemas/cap/v2/entity.schema.json",
+  execution: "https://citeark.com/schemas/cap/v2/activity.schema.json",
+  evidence: "https://citeark.com/schemas/cap/v2/entity.schema.json",
+  assessment: "https://citeark.com/schemas/cap/v2/assertion.schema.json",
+});
+
+export async function assemblePipelineCap({
+  directory,
+  deploymentHandoff,
+  sourceReproductionDigest,
+  research,
+  contract,
+  executionContract,
+  policy,
+  runDirectory,
+  run,
+  result,
+  metrics,
+  outputs,
+  integrity,
+  assessment,
+  diagnosis,
+  verifiedConclusion,
+  researchCard,
+  runnerAudit,
+  evidenceContext,
+  pipelineSummary,
+  signingKeyPath,
+  processingBinding,
+  researchArtifactDigest,
+  inlineBlobMaximumBytes = CAP_INLINE_BLOB_MAX_BYTES,
+}) {
+  const claim = research.claims.find((item) => item.versionId === contract.research.claimVersionId);
+  const experiment = research.experiments.find((item) => item.versionId === contract.research.experimentVersionId);
+  if (!claim || !experiment) throw new CiteArkError("CAP 2.0 组装找不到执行契约绑定的 Claim 或 Experiment");
+  if (contract.verificationPolicyCommitment !== policy.commitment?.digest) {
+    throw new CiteArkError("CAP 2.0 组装拒绝未绑定执行契约的验证策略承诺");
+  }
+  if (!validDigest(researchArtifactDigest)) {
+    throw new CiteArkError("复现 CAP 必须引用已验证的 Research Plan CAP 摘要");
+  }
+
+  const physicalRunId = run.sharedExecutionRunId ?? run.runId;
+  const actualContract = executionContract ?? contract;
+  const ids = {
+    assembler: recordId("actor", "citeark-artifact-assembler"),
+    executor: recordId("actor", `${physicalRunId}:${run.runtime ?? contract.agent?.runtime ?? "agent"}`),
+    assessor: recordId(
+      "actor",
+      `${assessment.assessor?.kind ?? "service"}:${assessment.assessor?.provider ?? "citeark"}:${assessment.assessor?.name ?? "citeark-verification-engine"}:${assessment.assessor?.rubricVersion ?? assessment.assessor?.version ?? "unknown"}`,
+    ),
+    work: recordId("work", research.work.id),
+    claim: recordId("claim", `${research.work.id}:${claim.id}`),
+    experiment: recordId("experiment", `${research.work.id}:${experiment.id}`),
+    execution: recordId("execution", physicalRunId),
+    assessment: recordId("assessment", `${run.runId}:${assessment.assessmentDigest}`),
+  };
+  const ref = (id) => ({ ref: id });
+  const outputDirectory = path.join(runDirectory, "output");
+  const blobByDigest = new Map();
+  const blobDigestBySourcePath = new Map();
+  const externalObjects = [];
+
+  const addBytesBlob = ({ id, roles, mediaType, bytes, rights = generatedRights() }) => {
+    const body = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+    return addBlob({
+      id,
+      roles,
+      mediaType,
+      availability: "embedded",
+      bytes: body,
+      digest: sha256Bytes(body),
+      size: body.byteLength,
+      rights,
+    });
+  };
+  const addFileBlob = async ({
+    sourcePath,
+    roles,
+    mediaType,
+    forceExternal = false,
+    withhold = false,
+  }) => {
+    if (!safeRelativePath(sourcePath)) throw new CiteArkError(`CAP Blob 源路径无效：${sourcePath}`);
+    const filename = path.resolve(outputDirectory, sourcePath);
+    if (!filename.startsWith(`${path.resolve(outputDirectory)}${path.sep}`)) {
+      throw new CiteArkError(`CAP Blob 源路径逃逸：${sourcePath}`);
+    }
+    const stat = await lstat(filename);
+    if (!stat.isFile()) throw new CiteArkError(`CAP Blob 源不是普通文件：${sourcePath}`);
+    const digest = `sha256:${await sha256File(filename)}`;
+    withhold ||= (outputs?.outputs ?? []).some(output => output.digest === digest && output.storage === "withheld");
+    const availability = withhold
+      ? "withheld"
+      : forceExternal || stat.size > inlineBlobMaximumBytes ? "external" : "embedded";
+    const blob = addBlob({
+      id: recordId("blob", digest),
+      roles,
+      mediaType: mediaType ?? mediaTypeForPath(sourcePath),
+      availability,
+      ...(availability === "embedded" ? { bytes: await readFile(filename) } : {}),
+      digest,
+      size: stat.size,
+      rights: generatedRights(),
+      ...(availability !== "embedded"
+        ? {
+            accessPolicy: {
+              level: availability === "withheld"
+                ? "retention-excluded"
+                : "content-addressed-download",
+              integrityRequired: true,
+            },
+          }
+        : {}),
+    });
+    blobDigestBySourcePath.set(sourcePath, digest);
+    if (availability === "external" && !externalObjects.some((item) => item.digest === digest)) {
+      externalObjects.push({
+        sourcePath,
+        digest,
+        byteSize: stat.size,
+        mediaType: blob.mediaType,
+      });
+    }
+    return blob;
+  };
+  function addBlob(entry) {
+    const existing = blobByDigest.get(entry.digest);
+    if (existing) {
+      existing.roles = [...new Set([...existing.roles, ...entry.roles])].sort();
+      return existing;
+    }
+    blobByDigest.set(entry.digest, entry);
+    return entry;
+  }
+
+  const sharedContractBlob = executionContract?.campaign ? addBytesBlob({
+    id: recordId("blob", executionContract.contractDigest), roles: ["shared-execution-contract"],
+    mediaType: "application/json", bytes: JSON.stringify(executionContract),
+  }) : null;
+  if (deploymentHandoff) addBytesBlob({ id: recordId("blob", "deployment-handoff"),
+    roles: ["deployment-handoff"], mediaType: "application/json", bytes: JSON.stringify(deploymentHandoff) });
+  const rawEvidenceRecords = [];
+  const rawEvidenceIdBySourcePath = new Map();
+  for (const item of result.evidence ?? []) {
+    if (rawEvidenceIdBySourcePath.has(item.path)) continue;
+    const blob = await addFileBlob({
+      sourcePath: item.path,
+      roles: ["raw-evidence"],
+      mediaType: mediaTypeForPath(item.path),
+    });
+    const evidenceId = recordId("evidence", `${run.runId}:raw:${item.path}`);
+    rawEvidenceIdBySourcePath.set(item.path, evidenceId);
+    rawEvidenceRecords.push({
+      $schema: SCHEMA.evidence,
+      id: evidenceId,
+      type: CAP_RECORD_TYPE.entity, role: "observation",
+      kind: evidenceKindForPath(item.path),
+      basis: "observed",
+      generatedBy: ref(ids.execution),
+      blobs: [blob.digest],
+      limitations: [],
+      citeark: {
+        sourcePath: item.path,
+        summary: item.description ?? "Execution evidence",
+        role: "raw-evidence",
+      },
+    });
+  }
+
+  const measurementRecords = [];
+  const measurementEvidenceIdByMeasurement = new Map();
+  const contractMeasurements = executionContractMeasurements(contract);
+  for (const parsed of metricMeasurements(metrics)) {
+    const measurementId = parsed.measurementId ?? parsed.primary?.metric;
+    const declared = contractMeasurements.find((item) => item.measurementId === measurementId);
+    const sourcePath = declared?.parser?.evidencePath ?? parsed.sourceEvidence?.path;
+    let sourceBlob = sourcePath ? blobByDigest.get(blobDigestBySourcePath.get(sourcePath)) : null;
+    if (!sourceBlob && sourcePath && await pathExists(path.join(outputDirectory, sourcePath))) {
+      sourceBlob = await addFileBlob({
+        sourcePath,
+        roles: ["raw-evidence", "parser-input"],
+        mediaType: mediaTypeForPath(sourcePath),
+      });
+    } else if (sourceBlob) {
+      sourceBlob.roles = [...new Set([...sourceBlob.roles, "parser-input"])].sort();
+    }
+    const evidenceId = recordId("evidence", `${run.runId}:measurement:${measurementId}`);
+    measurementEvidenceIdByMeasurement.set(measurementId, evidenceId);
+    const observed = parsed.primary?.value;
+    measurementRecords.push({
+      $schema: SCHEMA.evidence,
+      id: evidenceId,
+      type: CAP_RECORD_TYPE.entity, role: "observation",
+      title: `${parsed.primary?.metric ?? measurementId}: ${typeof observed === 'number' ? `${observed} ${parsed.primary?.unit ?? ''}` : 'unavailable'}`,
+      kind: typeof observed === "number" && Number.isFinite(observed) ? "measurement" : "failure",
+      basis: "observed",
+      generatedBy: ref(ids.execution),
+      ...(sourcePath && rawEvidenceIdBySourcePath.has(sourcePath)
+        ? { derivedFrom: [ref(rawEvidenceIdBySourcePath.get(sourcePath))] }
+        : {}),
+      ...(typeof observed === "number" && Number.isFinite(observed)
+        ? {
+            measurement: {
+              measurementId,
+              metric: parsed.primary.metric,
+              value: { decimal: decimal(observed) },
+              unit: parsed.primary.unit,
+              ...(parsed.primary.scope ? { scope: parsed.primary.scope } : {}),
+            },
+          }
+        : {}),
+      ...(parsed.parser
+        ? {
+            parser: {
+              id: parsed.parser.id,
+              version: parsed.parser.version,
+              ...(validDigest(parsed.parser.implementationDigest)
+                ? { implementationDigest: parsed.parser.implementationDigest }
+                : {}),
+              inputs: sourceBlob ? [sourceBlob.digest] : [],
+              config: declared?.parser?.config ?? {},
+            },
+          }
+        : {}),
+      ...(sourceBlob ? { blobs: [sourceBlob.digest] } : {}),
+      limitations: parsed.availability?.status === "unavailable"
+        ? [parsed.availability.reason ?? "No trustworthy observation was available"]
+        : [],
+      citeark: {
+        sourcePath: sourcePath ?? null,
+        checks: parsed.checks ?? [],
+        observations: parsed.observations ?? [],
+        availability: parsed.availability ?? null,
+      },
+    });
+  }
+
+  const outputRecords = [];
+  const scientificOutputRecords = [];
+  const outputBindings = [];
+  const outputEvidenceIdByOutput = new Map();
+  for (const output of outputs?.outputs ?? []) {
+    const blob = await addFileBlob({
+      sourcePath: output.sourcePath,
+      roles: ["scientific-output", output.role, output.kind],
+      mediaType: output.mediaType,
+      forceExternal: output.storage === "external",
+      withhold: output.storage === "withheld",
+    });
+    const evidenceId = recordId("evidence", `${run.runId}:output:${output.id}`);
+    outputEvidenceIdByOutput.set(output.id, evidenceId);
+    if (['model', 'checkpoint', 'dataset'].includes(output.kind)) {
+      const materialId = recordId('scientific-output', `${physicalRunId}:${output.id}`);
+      scientificOutputRecords.push({ $schema: SCHEMA.evidence, id: materialId,
+        type: CAP_RECORD_TYPE.entity, role: output.kind, title: output.description ?? output.id,
+        basis: 'observed', prospective: false, generatedBy: ref(ids.execution), blobs: [blob.digest],
+        identity: { digest: blob.digest, byteSize: blob.size, mediaType: blob.mediaType },
+        availability: blob.availability, citeark: { outputId: output.id, sourcePath: output.sourcePath } });
+      if (output.scientificObjectId) outputBindings.push({ scientificObjectId: output.scientificObjectId, materialId, kind: output.kind });
+    }
+    outputRecords.push({
+      $schema: SCHEMA.evidence,
+      id: evidenceId,
+      type: CAP_RECORD_TYPE.entity, role: "observation",
+      kind: capEvidenceKind(output.kind),
+      basis: "observed",
+      generatedBy: ref(ids.execution),
+      blobs: [blob.digest],
+      limitations: [],
+      citeark: {
+        outputId: output.id,
+        sourcePath: output.sourcePath,
+        description: output.description,
+        role: output.role,
+        storage: output.storage,
+        relatedEvidencePaths: output.relatedEvidencePaths ?? [],
+      },
+    });
+  }
+
+  const traceBytes = Buffer.from(buildTrace({
+    run,
+    metrics,
+    integrity,
+    assessment,
+    runnerAudit,
+    actorId: ids.executor,
+    executionId: ids.execution,
+    evidenceIds: [...measurementRecords, ...outputRecords].map((item) => item.id),
+  }), "utf8");
+  const traceBlob = addBytesBlob({
+    id: recordId("blob", `${run.runId}:trace`),
+    roles: ["execution-trace"],
+    mediaType: "application/x-ndjson",
+    bytes: traceBytes,
+  });
+  const commandRecordsBlob = runnerAudit?.audit ? addBytesBlob({
+    id: recordId("blob", `${run.runId}:runner-command-records`),
+    roles: ["runner-command-records"],
+    mediaType: "application/x-ndjson",
+    bytes: Buffer.from((runnerAudit.commandRecords ?? []).map((record) => JSON.stringify(record)).join("\n") + "\n", "utf8"),
+  }) : null;
+  const evidenceContextBlob = evidenceContext ? addBytesBlob({
+    id: recordId("blob", `${run.runId}:assessment-evidence-context`),
+    roles: ["assessment-evidence-context"], mediaType: "application/json",
+    bytes: canonicalJsonBytes(evidenceContext),
+    rights: { statement: "Source excerpts and implementation retain their original rights; inclusion for evidence review grants no additional redistribution permission." },
+  }) : null;
+
+  const sourceWork = {
+    $schema: SCHEMA.sourceWork,
+    id: ids.work,
+    type: CAP_RECORD_TYPE.entity, role: "source-work",
+    title: research.work.title,
+    abstract: research.work.abstract,
+    sources: research.sources.map((source) => sourceDescriptor({
+      source,
+      research,
+      processingBinding,
+    })),
+    citeark: {
+      workId: research.work.id,
+      ...(research.reproductionScope ? { reproductionScope: research.reproductionScope } : {}),
+      ...(research.work.significance ? { significance: research.work.significance } : {}),
+      authorNames: research.work.authors ?? [],
+      subjects: research.work.subjects ?? [],
+      license: research.license ?? {},
+      provenance: research.provenance ?? {},
+    },
+  };
+  const claimRecord = {
+    $schema: SCHEMA.claim,
+    id: ids.claim,
+    type: CAP_RECORD_TYPE.assertion, role: "claim",
+    statement: { value: claim.statement, language: "en" },
+    kind: claimKind(claim.type),
+    scope: {
+      reportedMeasurements: (claim.reportedMeasurements ?? []).map((item) => ({
+        id: item.id,
+        metric: item.metric,
+        value: decimal(item.value),
+        unit: item.unit,
+      })),
+      reproduction: claim.reproduction ?? {},
+    },
+    source: {
+      work: ref(ids.work),
+      selector: {
+        type: "TextQuoteSelector",
+        exact: claim.statement,
+        label: `${claim.sourceLocator.sourceId}:${claim.sourceLocator.locator}`,
+      },
+      selectedTextDigest: sha256Bytes(Buffer.from(claim.statement, "utf8")),
+    },
+    origin: {
+      basis: "inferred",
+      actor: ref(ids.assembler),
+      ...(research.provenance?.reviewStatus === "human-reviewed" ? { confidence: 1 } : {}),
+    },
+    citeark: {
+      localId: claim.id,
+      versionId: claim.versionId,
+      type: claim.type,
+      sourceLocator: claim.sourceLocator,
+      reportedMeasurements: claim.reportedMeasurements ?? [],
+      reproduction: claim.reproduction ?? {},
+    },
+  };
+  const experimentRecord = {
+    $schema: SCHEMA.experiment,
+    id: ids.experiment,
+    type: CAP_RECORD_TYPE.entity, role: "procedure",
+    tests: [ref(ids.claim)],
+    publicContract: {
+      implementation: {
+        repository: contract.repository.url,
+        revision: contract.repository.commit,
+        ...(contract.protocol.executionMode ? { executionMode: contract.protocol.executionMode } : {}),
+        ...(contract.protocol.objective ? { objective: contract.protocol.objective } : {}),
+        entrypoint: contract.protocol.entrypoint,
+        requiredCommandFragments: contract.protocol.requiredCommandFragments ?? [],
+      },
+      parameters: contract.protocol.parameters ?? [],
+      measurements: contractMeasurements.map((measurement) => ({
+        id: measurement.measurementId,
+        metric: measurement.metric,
+        unit: measurement.unit,
+        evidenceParser: {
+          id: measurement.parser.id,
+          version: measurement.parser.version,
+          ...(validDigest(measurement.parser.implementationDigest)
+            ? { implementationDigest: measurement.parser.implementationDigest }
+            : {}),
+        },
+      })),
+      resources: {
+        computeRequirement: contract.computeRequirement ?? {},
+        environment: contract.environment ?? {},
+      },
+      ...(contract.protocol.preflight ? { preflight: contract.protocol.preflight } : {}),
+      verificationPolicyCommitment: contract.verificationPolicyCommitment,
+    },
+    evaluationPlan: {
+      title: experiment.title,
+      reproductionLevel: contract.reproductionLevel,
+      ...(contract.reproductionScope ? { reproductionScope: contract.reproductionScope, requiredReproductionScope: contract.requiredReproductionScope } : {}),
+      reconstructionFidelity: contract.reconstructionFidelity,
+      instructions: contract.protocol.instructions ?? null,
+    },
+    citeark: {
+      localId: experiment.id,
+      versionId: experiment.versionId,
+      title: experiment.title,
+      claimIds: experiment.claimIds,
+      reproductionLevel: experiment.reproductionLevel,
+      ...(experiment.reproductionScope ? { reproductionScope: experiment.reproductionScope, requiredReproductionScope: experiment.requiredReproductionScope } : {}),
+      implementationOrigin: experiment.implementationOrigin ?? experiment.repository?.implementationOrigin ?? "official",
+      reconstructionFidelity: experiment.reconstructionFidelity ?? contract.reconstructionFidelity,
+      repository: experiment.repository,
+      protocol: experiment.protocol,
+      ...(contract.executionPlan ? { executionPlan: contract.executionPlan } : {}),
+      measurements: experiment.measurements,
+      compute: experiment.compute ?? null,
+      environment: experiment.environment ?? null,
+    },
+  };
+
+  const allEvidenceRecords = [...rawEvidenceRecords, ...measurementRecords, ...outputRecords];
+  const lastAttempt = run.attempts?.at(-1) ?? {};
+  const endedAt = isoDate(run.finishedAt ?? run.startedAt ?? run.createdAt);
+  const startedAt = isoDate(run.startedAt ?? run.attempts?.[0]?.startedAt ?? endedAt);
+  const executionRecord = {
+    $schema: SCHEMA.execution,
+    id: ids.execution,
+    type: CAP_RECORD_TYPE.activity, role: "execution",
+    status: executionStatus(result.execution?.status, run.status),
+    startedAt,
+    endedAt,
+    actors: [
+      { actor: ref(ids.executor), role: "executor" },
+      { actor: ref(ids.assembler), role: "orchestrator" },
+    ],
+    environment: {
+      image: run.image ?? actualContract.environment?.image ?? null,
+      sandbox: run.sandbox ?? null,
+      computeDecision: run.computeDecision ?? null,
+      imageIdentity: run.sandboxImageIdentity ?? null,
+      cloudExecution: run.cloudExecution ?? null,
+    },
+    codeState: {
+      repository: actualContract.repository.url,
+      revision: actualContract.repository.commit,
+      observedRevision: run.repository?.commit ?? null,
+    },
+    inputs: [
+      { role: "public-contract", digest: actualContract.contractDigest },
+      ...(sharedContractBlob ? [{ role: "shared-execution-contract", digest: sharedContractBlob.digest }] : []),
+
+      ...(processingBinding?.sourceDigest
+        ? [{ role: "source-work", digest: processingBinding.sourceDigest }]
+        : []),
+    ],
+    trace: { blobDigest: traceBlob.digest },
+    exit: {
+      code: Number.isInteger(lastAttempt.exitCode) ? lastAttempt.exitCode : null,
+      signal: typeof lastAttempt.signal === "string" ? lastAttempt.signal : null,
+    },
+    ...(result.execution?.failure ? { failure: result.execution.failure } : {}),
+    citeark: {
+      runId: physicalRunId,
+      runtime: run.runtime ?? contract.agent?.runtime ?? null,
+      agent: run.agent ?? { runtime: run.runtime ?? null },
+      usage: run.usage ?? null,
+      attempts: run.attempts ?? [],
+      outcome: result.execution ?? {},
+
+
+
+      commands: (runnerAudit?.commandRecords ?? [])
+        .map((record) => record?.command?.text)
+        .filter((command) => typeof command === "string" && command),
+      audit: runnerAudit?.audit ?? null,
+      ...(commandRecordsBlob ? { commandRecordsBlobDigest: commandRecordsBlob.digest } : {}),
+      capture: { granularity: 'runner-process', unknownPhases: true },
+    },
+  };
+
+  const assessmentRecord = {
+    $schema: SCHEMA.assessment,
+    id: ids.assessment,
+    type: CAP_RECORD_TYPE.assertion, role: "assessment",
+    claim: ref(ids.claim),
+    experiment: ref(ids.experiment),
+    execution: ref(ids.execution),
+    evidence: allEvidenceRecords.map((item) => ref(item.id)),
+    method: {
+      type: assessment.assessor?.kind === "model" ? "QualitativeReview" : "MetricComparison",
+      policyCommitment: contract.verificationPolicyCommitment,
+      policyReveal: {
+        algorithm: "citeark-policy-commitment-v1",
+        nonce: policy.commitment.nonce,
+        policy: verificationPolicyCommitmentInput(policy),
+      },
+      comparisons: (assessment.measurementAssessments ?? []).map((item) => ({
+        measurementId: item.measurementId,
+        verdict: item.verdict,
+        verificationStatus: item.verificationStatus,
+        reason: item.reason,
+        ...(item.comparison ? { comparison: decimalComparison(item.comparison) } : {}),
+      })),
+    },
+    conclusion: assessmentConclusion(assessment.verdict),
+    scope: assessmentScope(contract),
+    limitations: [...new Set([
+      ...(result.limitations ?? []),
+      ...(assessment.limitations ?? []),
+      ...(contract.research?.claimCoverage === "partial"
+        ? [`This execution covers only part of the compound claim; unassessed measurements: ${(contract.research.uncoveredMeasurementIds ?? []).join(", ")}.`]
+        : []),
+      ...(assessment.verificationStatus === "inconclusive" ? [assessment.reason] : []),
+    ].filter(Boolean))],
+    performedBy: ref(ids.assessor),
+    createdAt: isoDate(assessment.assessedAt ?? endedAt),
+    citeark: {
+      verificationStatus: assessment.verificationStatus,
+      integrityStatus: assessment.integrityStatus,
+      reason: assessment.reason,
+      confidence: assessment.confidence ?? null,
+      protocolComparability: assessment.protocolComparability ?? "unknown",
+      ...(assessment.executionEvidence ? { executionEvidence: assessment.executionEvidence } : {}),
+      assessor: assessment.assessor ?? null,
+      ...(evidenceContextBlob ? { evidenceContextBlobDigest: evidenceContextBlob.digest } : {}),
+      evidenceReads: assessment.evidenceReads ?? [],
+      assessorFailure: assessment.assessorFailure ?? null,
+      assessmentUsage: assessment.usage ?? null,
+      measurementAssessments: assessment.measurementAssessments ?? [],
+      outputAssessments: assessment.outputAssessments ?? [],
+      claimCoverage: contract.research?.claimCoverage ?? "complete",
+      uncoveredMeasurementIds: contract.research?.uncoveredMeasurementIds ?? [],
+      diagnosis: diagnosis ?? null,
+    },
+  };
+
+  const objectGraph = researchObjectRecords({ research: { ...research, claims: [claim] }, sourceWorkId: ids.work, actorId: ids.assembler });
+  claimRecord.objects = (claim.objectIds ?? []).map(id => ref(objectGraph.objectIds.get(id)));
+  for (const observation of measurementRecords) {
+    const measurement = claim.reportedMeasurements.find(item => item.id === observation.measurement?.measurementId);
+    observation.contextObjects = (measurement?.objectIds ?? claim.objectIds ?? []).map(id => ref(objectGraph.objectIds.get(id)));
+    observation.contextBasis = 'declared';
+  }
+  experimentRecord.inputs = (objectGraph.inputIdsByExperiment.get(experiment.id) ?? []).map(id => ({ record: ref(id), role: 'scientific-input', basis: 'declared' }));
+  experimentRecord.steps = (objectGraph.stepIdsByExperiment.get(experiment.id) ?? []).map(ref);
+  // Per-measurement judgments retain their own evidence and scope. The compound claim's
+  // original assessment remains authoritative and may still be inconclusive.
+  const componentAssessments = measurementAssessmentRecords({ assessment, parent: assessmentRecord,
+    identity: `${run.runId}:${assessment.assessmentDigest}`, evidenceByMeasurement: measurementEvidenceIdByMeasurement });
+  assessmentRecord.componentAssessments = componentAssessments.map(item => ref(item.id));
+  const records = [
+    actorRecord(ids.assembler, "CiteArk Artifact Assembler", "runner", "2.0.0-alpha.2"),
+    actorRecord(ids.executor, `${run.runtime ?? contract.agent?.runtime ?? "Research"} execution Agent`, "agent", run.agent?.model),
+    actorRecord(
+      ids.assessor,
+      assessment.assessor?.name ?? "CiteArk Verification Engine",
+      assessment.assessor?.kind === "model" ? "model" : "runner",
+      assessment.assessor?.model ?? assessment.assessor?.version,
+    ),
+    sourceWork,
+    claimRecord,
+    experimentRecord,
+    executionRecord,
+    ...allEvidenceRecords,
+    ...scientificOutputRecords,
+    ...objectGraph.records,
+    ...componentAssessments,
+    assessmentRecord,
+  ];
+  records.push(...await enrichExecutionGraph({ runDirectory, physicalRunId, ids, actualContract,
+    executionRecord, experimentRecord, assessmentRecord, runnerAudit, evidenceContext,
+    rawEvidenceRecords, blobByDigest, addBytesBlob, objectGraph }));
+  for (const binding of outputBindings) {
+    const expectedId = objectGraph.objectIds.get(binding.scientificObjectId);
+    const specification = research.researchObjects?.find(object => object.id === binding.scientificObjectId);
+    if (!expectedId || specification?.prospective !== true) throw new CiteArkError(`Output must bind a prospective research object: ${binding.scientificObjectId}`);
+    records.push({ $schema: "https://citeark.com/schemas/cap/v2/relation.schema.json",
+      id: recordId("relation", `${physicalRunId}:${binding.scientificObjectId}:${binding.materialId}`),
+      type: CAP_RECORD_TYPE.relation, role: "provenance", predicate: "describes",
+      subject: ref(expectedId), object: ref(binding.materialId), basis: "declared",
+      attributedTo: ref(ids.executor), sources: [ref(expectedId)], qualifiers: { binding: "declared-output-identity" } });
+  }
+  const profiles = [
+    CAP_PROFILE.computationalRun,
+    CAP_PROFILE.reproduction,
+    CAP_PROFILE.agentTrace,
+    CAP_PROFILE.publicBundle,
+    ...([...blobByDigest.values()].some((blob) => blob.availability !== "embedded")
+      ? [CAP_PROFILE.restrictedEvidence]
+      : []),
+  ];
+  const built = await assembleCapDirectory({
+    directory,
+    artifact: {
+      id: recordId("artifact", run.runId),
+      createdAt: isoDate(assessment.assessedAt ?? endedAt),
+      createdBy: ids.assembler,
+    },
+    profiles,
+    roots: [
+      { role: "primaryClaim", ref: ids.claim },
+      { role: "primaryExecution", ref: ids.execution },
+      { role: "primaryAssessment", ref: ids.assessment },
+    ],
+    records,
+    blobs: [...blobByDigest.values()],
+    relations: [{
+      relationship: "reproduces",
+      artifactDigest: researchArtifactDigest,
+      summary: "Reproduces the immutable Research Plan CAP snapshot.",
+    }, ...(sourceReproductionDigest ? [{ relationship: "derivedFrom", artifactDigest: sourceReproductionDigest, summary: "Continues the completed execution handoff with fresh local observations." }] : [])],
+  });
+
+  await writeBundleAttachments({
+    directory,
+    built,
+    sourceWork,
+    claimRecord,
+    experimentRecord,
+    executionRecord,
+    assessmentRecord,
+    metrics,
+    integrity,
+    researchCard,
+    verifiedConclusion,
+    pipelineSummary,
+    diagnosis,
+  });
+  const attestation = await signCapArtifact({
+    artifactDigest: built.artifactDigest,
+    actor: ref(ids.assembler),
+    role: "artifactAssembler",
+    createdAt: isoDate(assessment.assessedAt ?? endedAt),
+    signingKeyPath,
+    processingBinding,
+  });
+  const attachedAttestation = await attachCapAttestation({ directory, attestation });
+  const verification = await verifyCapDirectory(directory);
+  if (!verification.valid) {
+    throw new CiteArkError(`流水线生成的 CAP 2.0 未通过自校验：\n- ${verification.issues.join("\n- ")}`);
+  }
+  return {
+    ...built,
+    verification,
+    attestation: attachedAttestation,
+    recordIds: ids,
+    externalObjects,
+  };
+}
+
+async function writeBundleAttachments({
+  directory,
+  built,
+  sourceWork,
+  claimRecord,
+  experimentRecord,
+  executionRecord,
+  assessmentRecord,
+  metrics,
+  integrity,
+  researchCard,
+  verifiedConclusion,
+  pipelineSummary,
+  diagnosis,
+}) {
+  await Promise.all([
+    mkdir(path.join(directory, "preview"), { recursive: true }),
+    mkdir(path.join(directory, "projections", "citeark"), { recursive: true }),
+  ]);
+  const crate = {
+    "@context": "https://w3id.org/ro/crate/1.3/context",
+    "@graph": [
+      { "@id": "ro-crate-metadata.json", "@type": "CreativeWork", about: { "@id": "./" } },
+      {
+        "@id": "./",
+        "@type": "Dataset",
+        name: sourceWork.title,
+        identifier: built.artifactDigest,
+        hasPart: built.manifest.records.map((record) => ({ "@id": record.path })),
+      },
+      ...built.manifest.records.map((record) => ({
+        "@id": record.path,
+        "@type": "CreativeWork",
+        identifier: record.digest,
+        encodingFormat: record.mediaType,
+      })),
+    ],
+  };
+  await Promise.all([
+    writeFile(path.join(directory, "ro-crate-metadata.json"), `${JSON.stringify(crate, null, 2)}\n`),
+    writeFile(
+      path.join(directory, "preview", "README.md"),
+      researchCard?.markdown ?? `# ${sourceWork.title}\n\nCAP Artifact: \`${built.artifactDigest}\`\n`,
+    ),
+    writeProjection(directory, "claim.json", claimRecord),
+    writeProjection(directory, "experiment.json", experimentRecord),
+    writeProjection(directory, "execution.json", executionRecord),
+    writeProjection(directory, "assessment.json", assessmentRecord),
+    writeProjection(directory, "metrics.json", metrics),
+    writeProjection(directory, "integrity.json", integrity),
+    ...(researchCard ? [writeProjection(directory, "research-card.json", researchCard.card)] : []),
+    ...(verifiedConclusion ? [writeProjection(directory, "verified-conclusion.json", verifiedConclusion)] : []),
+    ...(pipelineSummary ? [writeProjection(directory, "pipeline-summary.json", pipelineSummary)] : []),
+    ...(diagnosis?.markdown
+      ? [writeFile(path.join(directory, "preview", "diagnosis.md"), diagnosis.markdown)]
+      : []),
+  ]);
+}
+
+function writeProjection(directory, filename, value) {
+  return writeFile(path.join(directory, "projections", "citeark", filename), canonicalJsonBytes(value));
+}
+
+function actorRecord(id, name, kind, version) {
+  return {
+    $schema: SCHEMA.actor,
+    id,
+    type: CAP_RECORD_TYPE.agent, role: "agent",
+    kind,
+    name,
+    ...(version ? { version: String(version) } : {}),
+  };
+}
+
+function sourceDescriptor({ source, research, processingBinding }) {
+  const paperDigest = source.kind === "paper" && validDigest(processingBinding?.sourceDigest)
+    ? processingBinding.sourceDigest
+    : validDigest(source.digest) ? source.digest : null;
+  return {
+    kind: sourceKind(source.kind),
+    uri: source.uri,
+    ...(source.version ? { version: String(source.version) } : {}),
+    integrity: paperDigest ? "verified" : "unverified",
+    ...(paperDigest ? { digest: paperDigest } : {}),
+    rights: sourceRights(source.kind, research.license),
+  };
+}
+
+function sourceRights(kind, license = {}) {
+  const key = kind === "repository" ? "code" : kind === "paper" ? "paper" : kind === "dataset" ? "dataset" : kind === "checkpoint" ? "checkpoint" : null;
+  return {
+    statement: key && license?.[key]
+      ? String(license[key])
+      : "Source-specific rights; CAP records identity and provenance but grants no redistribution permission.",
+  };
+}
+
+function generatedRights() {
+  return { statement: "CiteArk-generated execution material; redistribution remains subject to referenced source rights." };
+}
+
+function buildTrace({ run, metrics, integrity, assessment, runnerAudit, actorId, executionId, evidenceIds }) {
+  const endedAt = isoDate(run.finishedAt ?? run.startedAt ?? run.createdAt);
+  const events = [];
+  const push = (eventType, occurredAt, attributes = {}, outputs = []) => {
+    events.push({
+      sequence: events.length + 1,
+      eventType,
+      occurredAt: isoDate(occurredAt ?? endedAt),
+      observedAt: isoDate(occurredAt ?? endedAt),
+      actor: actorId,
+      execution: executionId,
+      ...(outputs.length ? { outputs } : {}),
+      attributes,
+    });
+  };
+  for (const attempt of run.attempts ?? []) {
+    push("execution.attempt", attempt.finishedAt ?? attempt.startedAt, {
+      attempt: attempt.attempt,
+      exitCode: attempt.exitCode ?? null,
+      signal: attempt.signal ?? null,
+      timedOut: Boolean(attempt.timedOut),
+    });
+  }
+  for (const command of runnerAudit?.commandRecords ?? []) {
+    push("tool.command", command.finishedAt ?? command.startedAt, {
+      recordId: command.recordId,
+      command: command.command?.text ?? "",
+      exitCode: command.exitCode ?? null,
+      provenance: command.provenance ?? null,
+    });
+  }
+  push("execution.finished", endedAt, { status: run.status ?? 'unknown' });
+  return `${events.map((event) => JSON.stringify(event)).join("\n")}\n`;
+}
+
+function recordId(kind, value) {
+  return `urn:citeark:${kind}:${sha256Bytes(Buffer.from(String(value), "utf8")).slice(7)}`;
+}
+
+function claimKind(value) {
+  return ({
+    finding: "descriptive",
+    method: "methodological",
+    measurement: "descriptive",
+    limitation: "limitation",
+  })[value] ?? "descriptive";
+}
+
+function sourceKind(value) {
+  if (value === "checkpoint") return "model";
+  return new Set(["paper", "repository", "dataset", "model", "supplement", "other"]).has(value)
+    ? value
+    : "other";
+}
+
+function evidenceKindForPath(value) {
+  const mediaType = mediaTypeForPath(value);
+  if (mediaType.startsWith("image/")) return "figure";
+  if (mediaType.startsWith("text/")) return "text";
+  return "observation";
+}
+
+function capEvidenceKind(value) {
+  return new Set(["figure", "table", "dataset", "model", "checkpoint", "text"]).has(value)
+    ? value
+    : "other";
+}
+
+function executionStatus(resultStatus, runStatus) {
+  if (resultStatus === "succeeded") return "succeeded";
+  if (resultStatus === "partial") return "partial";
+  if (resultStatus === "cancelled") return "cancelled";
+  if (resultStatus === "timed_out" || runStatus === "timed_out") return "timedOut";
+  if (resultStatus === "failed" || runStatus === "failed" || runStatus === "invalid_result") return "failed";
+  return "unknown";
+}
+
+function assessmentConclusion(value) {
+  return new Set(["supports", "challenges", "contradicts", "inconclusive"]).has(value)
+    ? value
+    : "inconclusive";
+}
+
+function assessmentScope(contract) {
+  const origin = contract.repository?.implementationOrigin ?? "official";
+  const fidelity = contract.reconstructionFidelity ?? "faithful";
+  return {
+    operator: "independent",
+    implementation: origin === "citeark_reconstruction"
+      ? fidelity === "exact" || fidelity === "faithful" ? "independent" : "modified"
+      : "same",
+    environment: "reconstructed",
+    hardware: "independent",
+    data: origin === "citeark_reconstruction" && new Set(["approximate", "proxy"]).has(fidelity)
+      ? "modified"
+      : "same",
+  };
+}
+
+function decimalComparison(value) {
+  const output = {};
+  for (const [key, item] of Object.entries(value)) {
+    output[key] = typeof item === "number" && Number.isFinite(item)
+      ? { decimal: decimal(item) }
+      : item;
+  }
+  return output;
+}
+
+function decimal(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "string" && /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$/.test(value)) return value;
+  throw new CiteArkError(`CAP 科研数值无法表示为十进制字符串：${String(value)}`);
+}
+
+function validDigest(value) {
+  return typeof value === "string" && /^sha256:[0-9a-f]{64}$/.test(value);
+}
+
+function isoDate(value) {
+  const date = new Date(value ?? Date.now());
+  if (!Number.isFinite(date.getTime())) throw new CiteArkError(`CAP 时间无效：${String(value)}`);
+  return date.toISOString();
+}