@cleocode/contracts 2026.4.70 → 2026.4.73

package/src/evidence-record-schema.ts

@@ -0,0 +1,158 @@
+/**
+ * Zod validation schemas for {@link EvidenceRecord} and its variants.
+ *
+ * Kept in a separate file from the plain TypeScript types so that consumers
+ * that do not need runtime validation (e.g. type-only imports) pay zero cost.
+ *
+ * All schemas are named `*RecordSchema` and derive their inferred types from
+ * the canonical TypeScript interfaces in `./evidence-record.ts`.
+ *
+ * The top-level {@link evidenceRecordSchema} is a `z.discriminatedUnion` on
+ * `"kind"` so Zod can route to the correct variant in O(1).
+ *
+ * @epic T810
+ * @task T816
+ */
+
+import { z } from 'zod';
+
+// ─── Shared base fields ───────────────────────────────────────────────────────
+
+/**
+ * Zod schema for the provenance fields shared by every EvidenceRecord variant.
+ *
+ * Not exported as a standalone validator; always composed into a full record
+ * schema via `.extend()`.
+ */
+const evidenceBaseSchema = z.object({
+  /** Identity string of the agent that produced this record. */
+  agentIdentity: z.string().min(1),
+  /** SHA-256 hex digest (64 chars) of the attached artifact. */
+  attachmentSha256: z.string().length(64),
+  /** ISO 8601 timestamp at which the action ran. */
+  ranAt: z.string().datetime(),
+  /** Wall-clock duration of the action in milliseconds. */
+  durationMs: z.number().nonnegative(),
+});
+
+// ─── Individual variant schemas ───────────────────────────────────────────────
+
+/**
+ * Zod schema for {@link ImplDiffRecord}.
+ *
+ * Validates that `filesChanged` is a non-empty array and that `linesAdded` /
+ * `linesRemoved` are non-negative integers.
+ */
+export const implDiffRecordSchema = evidenceBaseSchema.extend({
+  kind: z.literal('impl-diff'),
+  phase: z.literal('implement'),
+  filesChanged: z.array(z.string().min(1)).min(1),
+  linesAdded: z.number().int().nonnegative(),
+  linesRemoved: z.number().int().nonnegative(),
+});
+
+/** Inferred TypeScript type from {@link implDiffRecordSchema}. */
+export type ImplDiffRecordInput = z.input<typeof implDiffRecordSchema>;
+
+/**
+ * Zod schema for {@link ValidateSpecCheckRecord}.
+ *
+ * Validates that `reqIdsChecked` is non-empty and `details` is non-blank.
+ */
+export const validateSpecCheckRecordSchema = evidenceBaseSchema.extend({
+  kind: z.literal('validate-spec-check'),
+  phase: z.literal('validate'),
+  reqIdsChecked: z.array(z.string().min(1)).min(1),
+  passed: z.boolean(),
+  details: z.string().min(1),
+});
+
+/** Inferred TypeScript type from {@link validateSpecCheckRecordSchema}. */
+export type ValidateSpecCheckRecordInput = z.input<typeof validateSpecCheckRecordSchema>;
+
+/**
+ * Zod schema for {@link TestOutputRecord}.
+ *
+ * Validates that `command` is non-blank and test counts are non-negative.
+ */
+export const testOutputRecordSchema = evidenceBaseSchema.extend({
+  kind: z.literal('test-output'),
+  phase: z.literal('test'),
+  command: z.string().min(1),
+  exitCode: z.number().int(),
+  testsPassed: z.number().int().nonnegative(),
+  testsFailed: z.number().int().nonnegative(),
+});
+
+/** Inferred TypeScript type from {@link testOutputRecordSchema}. */
+export type TestOutputRecordInput = z.input<typeof testOutputRecordSchema>;
+
+/**
+ * Zod schema for {@link LintReportRecord}.
+ *
+ * `phase` is restricted to `'implement' | 'test'`.
+ * `warnings` and `errors` are non-negative integers.
+ */
+export const lintReportRecordSchema = evidenceBaseSchema.extend({
+  kind: z.literal('lint-report'),
+  phase: z.enum(['implement', 'test']),
+  tool: z.string().min(1),
+  passed: z.boolean(),
+  warnings: z.number().int().nonnegative(),
+  errors: z.number().int().nonnegative(),
+});
+
+/** Inferred TypeScript type from {@link lintReportRecordSchema}. */
+export type LintReportRecordInput = z.input<typeof lintReportRecordSchema>;
+
+/**
+ * Zod schema for {@link CommandOutputRecord}.
+ *
+ * `phase` can be `'implement'`, `'validate'`, or `'test'`.
+ * `cmd` must be non-blank.
+ */
+export const commandOutputRecordSchema = evidenceBaseSchema.extend({
+  kind: z.literal('command-output'),
+  phase: z.enum(['implement', 'validate', 'test']),
+  cmd: z.string().min(1),
+  exitCode: z.number().int(),
+});
+
+/** Inferred TypeScript type from {@link commandOutputRecordSchema}. */
+export type CommandOutputRecordInput = z.input<typeof commandOutputRecordSchema>;
+
+// ─── Discriminated union ──────────────────────────────────────────────────────
+
+/**
+ * Zod discriminated-union schema for {@link EvidenceRecord}.
+ *
+ * Uses `z.discriminatedUnion('kind', [...])` for O(1) variant lookup.
+ * Parse with `evidenceRecordSchema.parse(input)` or
+ * `evidenceRecordSchema.safeParse(input)`.
+ *
+ * @example
+ * ```ts
+ * const rec = evidenceRecordSchema.parse({
+ *   kind: 'test-output',
+ *   phase: 'test',
+ *   agentIdentity: 'T816-worker',
+ *   attachmentSha256: 'a'.repeat(64),
+ *   command: 'pnpm test',
+ *   exitCode: 0,
+ *   testsPassed: 10,
+ *   testsFailed: 0,
+ *   ranAt: '2026-04-16T00:00:00.000Z',
+ *   durationMs: 1234,
+ * });
+ * ```
+ */
+export const evidenceRecordSchema = z.discriminatedUnion('kind', [
+  implDiffRecordSchema,
+  validateSpecCheckRecordSchema,
+  testOutputRecordSchema,
+  lintReportRecordSchema,
+  commandOutputRecordSchema,
+]);
+
+/** Inferred TypeScript type from {@link evidenceRecordSchema}. */
+export type EvidenceRecordInput = z.input<typeof evidenceRecordSchema>;

package/src/evidence-record.ts

@@ -0,0 +1,182 @@
+/**
+ * EvidenceRecord discriminated union — typed proof artifacts produced by IVTR agents.
+ *
+ * Each variant represents a specific kind of evidence that an IVTR-phase agent
+ * (implement, validate, test) can emit. All variants share a common set of
+ * provenance fields (`agentIdentity`, `attachmentSha256`, `ranAt`, `durationMs`)
+ * so that evidence rows can be queried, correlated, and archived uniformly.
+ *
+ * Five kinds are defined:
+ * - `impl-diff`         — a code change produced by an implement-phase agent
+ * - `validate-spec-check` — a spec-requirements check by a validate-phase agent
+ * - `test-output`       — the output of a test command run by a test-phase agent
+ * - `lint-report`       — a static-analysis run (biome, tsc, etc.)
+ * - `command-output`    — a generic CLI command invocation with exit code
+ *
+ * @epic T810
+ * @task T816
+ * @see {@link EvidenceRecordKind} for all discriminant values
+ */
+
+// ─── Variants ────────────────────────────────────────────────────────────────
+
+/**
+ * Evidence that an implement-phase agent produced a code diff.
+ *
+ * `filesChanged` lists the relative paths of every modified file.
+ * `attachmentSha256` is the SHA-256 hex digest of the serialised diff attachment.
+ */
+export interface ImplDiffRecord {
+  kind: 'impl-diff';
+  /** RCASD lifecycle phase that produced this record. */
+  phase: 'implement';
+  /** Identity string of the agent that ran this action (e.g. `"T816-worker"`). */
+  agentIdentity: string;
+  /** SHA-256 hex digest (64 chars) of the attached diff blob. */
+  attachmentSha256: string;
+  /** Relative paths of every file the diff touches. */
+  filesChanged: string[];
+  /** Net lines added across all changed files. */
+  linesAdded: number;
+  /** Net lines removed across all changed files. */
+  linesRemoved: number;
+  /** ISO 8601 timestamp at which the diff was captured. */
+  ranAt: string;
+  /** Wall-clock duration of the implement action in milliseconds. */
+  durationMs: number;
+}
+
+/**
+ * Evidence that a validate-phase agent checked one or more REQ-IDs against
+ * the implementation and recorded a pass/fail verdict.
+ */
+export interface ValidateSpecCheckRecord {
+  kind: 'validate-spec-check';
+  /** RCASD lifecycle phase that produced this record. */
+  phase: 'validate';
+  /** Identity string of the agent that ran this action. */
+  agentIdentity: string;
+  /** SHA-256 hex digest (64 chars) of the spec-check report attachment. */
+  attachmentSha256: string;
+  /** REQ-IDs checked in this run (e.g. `["IVTR-01", "IVTR-02"]`). */
+  reqIdsChecked: string[];
+  /** `true` when all checked REQ-IDs passed; `false` if any failed. */
+  passed: boolean;
+  /** Human-readable summary of results per REQ-ID. */
+  details: string;
+  /** ISO 8601 timestamp at which the check ran. */
+  ranAt: string;
+  /** Wall-clock duration of the validation check in milliseconds. */
+  durationMs: number;
+}
+
+/**
+ * Evidence that a test-phase agent ran a test command and recorded counts.
+ */
+export interface TestOutputRecord {
+  kind: 'test-output';
+  /** RCASD lifecycle phase that produced this record. */
+  phase: 'test';
+  /** Identity string of the agent that ran this action. */
+  agentIdentity: string;
+  /** SHA-256 hex digest (64 chars) of the test-output attachment. */
+  attachmentSha256: string;
+  /** The full test command that was executed (e.g. `"pnpm --filter @cleocode/contracts run test"`). */
+  command: string;
+  /** Exit code returned by the test command. */
+  exitCode: number;
+  /** Number of individual test cases that passed. */
+  testsPassed: number;
+  /** Number of individual test cases that failed. */
+  testsFailed: number;
+  /** ISO 8601 timestamp at which the test command started. */
+  ranAt: string;
+  /** Wall-clock duration of the full test run in milliseconds. */
+  durationMs: number;
+}
+
+/**
+ * Evidence that a lint / static-analysis tool was run.
+ *
+ * The `phase` field is `'implement' | 'test'` because lint is commonly run
+ * after a code change (implement) or as part of a test suite (test).
+ */
+export interface LintReportRecord {
+  kind: 'lint-report';
+  /** RCASD lifecycle phase that produced this record. */
+  phase: 'implement' | 'test';
+  /** Identity string of the agent that ran this action. */
+  agentIdentity: string;
+  /** SHA-256 hex digest (64 chars) of the lint-output attachment. */
+  attachmentSha256: string;
+  /** Name of the lint tool that was invoked (e.g. `"biome"`, `"tsc"`). */
+  tool: string;
+  /** `true` when the lint run produced zero errors. */
+  passed: boolean;
+  /** Number of warnings emitted (may be > 0 even when `passed` is `true`). */
+  warnings: number;
+  /** Number of errors emitted. Non-zero means `passed` is `false`. */
+  errors: number;
+  /** ISO 8601 timestamp at which the lint tool was invoked. */
+  ranAt: string;
+  /** Wall-clock duration of the lint run in milliseconds. */
+  durationMs: number;
+}
+
+/**
+ * Evidence that an agent ran an arbitrary CLI command and recorded its exit code.
+ *
+ * Use this as the catch-all when none of the other variants fit.
+ */
+export interface CommandOutputRecord {
+  kind: 'command-output';
+  /** RCASD lifecycle phase that produced this record. */
+  phase: 'implement' | 'validate' | 'test';
+  /** Identity string of the agent that ran this action. */
+  agentIdentity: string;
+  /** SHA-256 hex digest (64 chars) of the command-output attachment. */
+  attachmentSha256: string;
+  /** The CLI command that was executed. */
+  cmd: string;
+  /** Exit code returned by the command. */
+  exitCode: number;
+  /** ISO 8601 timestamp at which the command was invoked. */
+  ranAt: string;
+  /** Wall-clock duration of the command in milliseconds. */
+  durationMs: number;
+}
+
+// ─── Discriminated union ──────────────────────────────────────────────────────
+
+/**
+ * A typed evidence record produced by an IVTR-phase agent.
+ *
+ * The `kind` discriminant selects the variant. All variants carry
+ * `agentIdentity`, `attachmentSha256`, `ranAt`, and `durationMs` for
+ * uniform provenance tracking.
+ *
+ * @example
+ * ```ts
+ * const rec: EvidenceRecord = {
+ *   kind: 'test-output',
+ *   phase: 'test',
+ *   agentIdentity: 'T816-worker',
+ *   attachmentSha256: 'a'.repeat(64),
+ *   command: 'pnpm --filter @cleocode/contracts run test',
+ *   exitCode: 0,
+ *   testsPassed: 10,
+ *   testsFailed: 0,
+ *   ranAt: '2026-04-16T00:00:00.000Z',
+ *   durationMs: 1234,
+ * };
+ * ```
+ */
+export type EvidenceRecord =
+  | ImplDiffRecord
+  | ValidateSpecCheckRecord
+  | TestOutputRecord
+  | LintReportRecord
+  | CommandOutputRecord;
+
+/** All valid `kind` discriminants for {@link EvidenceRecord}. */
+export type EvidenceRecordKind = EvidenceRecord['kind'];

package/src/index.ts

@@ -15,6 +15,7 @@ export type {
   FileAssertion,
   FileGate,
   GateBase,
+  GateResultDetails,
   HttpGate,
   LintGate,
   ManualGate,
@@ -26,6 +27,7 @@ export type {
   AcceptanceGateSchemaInput,
   AcceptanceItemInput,
   FileAssertionInput,
+  GateResultDetailsInput,
 } from './acceptance-gate-schema.js';
 // === Acceptance Gate Zod Schemas (runtime validation) ===
 export {
@@ -37,6 +39,7 @@ export {
   fileAssertionSchema,
   fileGateSchema,
   gateBaseSchema,
+  gateResultDetailsSchema,
   httpGateSchema,
   lintGateSchema,
   manualGateSchema,
@@ -82,6 +85,22 @@ export type {
   LocalFileAttachment,
   UrlAttachment,
 } from './attachment.js';
+// === Attachment Zod Schemas (runtime validation) ===
+export type {
+  AttachmentMetadataSchemaInput,
+  AttachmentRefSchemaInput,
+  AttachmentSchemaInput,
+} from './attachment-schema.js';
+export {
+  attachmentMetadataSchema,
+  attachmentRefSchema,
+  attachmentSchema,
+  blobAttachmentSchema,
+  llmsTxtAttachmentSchema,
+  llmtxtDocAttachmentSchema,
+  localFileAttachmentSchema,
+  urlAttachmentSchema,
+} from './attachment-schema.js';
 // === Backup Manifest Types ===
 export type {
   BackupDatabaseEntry,
@@ -182,6 +201,33 @@ export {
   isErrorType,
   normalizeError,
 } from './errors.js';
+// === Evidence Record Types (IVTR typed proof artifacts) ===
+export type {
+  CommandOutputRecord,
+  EvidenceRecord,
+  EvidenceRecordKind,
+  ImplDiffRecord,
+  LintReportRecord,
+  TestOutputRecord,
+  ValidateSpecCheckRecord,
+} from './evidence-record.js';
+export type {
+  CommandOutputRecordInput,
+  EvidenceRecordInput,
+  ImplDiffRecordInput,
+  LintReportRecordInput,
+  TestOutputRecordInput,
+  ValidateSpecCheckRecordInput,
+} from './evidence-record-schema.js';
+// === Evidence Record Zod Schemas (runtime validation) ===
+export {
+  commandOutputRecordSchema,
+  evidenceRecordSchema,
+  implDiffRecordSchema,
+  lintReportRecordSchema,
+  testOutputRecordSchema,
+  validateSpecCheckRecordSchema,
+} from './evidence-record-schema.js';
 // === Exit Codes ===
 export {
   ExitCode,
@@ -397,6 +443,25 @@ export type {
   VerificationFailure,
   VerificationGate,
 } from './task.js';
+// === Task Evidence Types (T801) ===
+export type {
+  CommandOutputEvidence,
+  FileEvidence,
+  LogEvidence,
+  ScreenshotEvidence,
+  TaskEvidence,
+  TaskEvidenceInput,
+  TaskEvidenceKind,
+  TestOutputEvidence,
+} from './task-evidence.js';
+export {
+  commandOutputEvidenceSchema,
+  fileEvidenceSchema,
+  logEvidenceSchema,
+  screenshotEvidenceSchema,
+  taskEvidenceSchema,
+  testOutputEvidenceSchema,
+} from './task-evidence.js';
 // === TaskRecord Types (string-widened for dispatch/LAFS) ===
 export type {
   MinimalTaskRecord,
@@ -445,5 +510,4 @@ export type {
   WarpLink,
   WarpStage,
 } from './warp-chain.js';
-
 // === WASM SDK (Rust crate bindings) ===

package/src/task-evidence.ts

@@ -0,0 +1,239 @@
+/**
+ * TaskEvidence discriminated union — typed evidence references for verification records.
+ *
+ * Replaces free-text evidence fields in verification records with structured,
+ * kind-specific evidence artifacts. Each variant carries a SHA-256 attachment
+ * reference, a timestamp, and optional description.
+ *
+ * Five evidence kinds are supported:
+ * - `file`           — a file artifact (source file, output artifact, config)
+ * - `log`            — a log stream captured from a process
+ * - `screenshot`     — a visual capture (PNG/JPEG/WEBP)
+ * - `test-output`    — structured test-runner output
+ * - `command-output` — raw stdout/stderr from a shell command
+ *
+ * @epic T760
+ * @task T801
+ * @see {@link AcceptanceGateResult} — `evidence` field
+ */
+
+import { z } from 'zod';
+
+// ─── Variant interfaces ───────────────────────────────────────────────────────
+
+/**
+ * Evidence for a file artifact produced or inspected during verification.
+ *
+ * The `sha256` is the content hash of the file at capture time, used to
+ * look up the blob in the attachment store.
+ */
+export interface FileEvidence {
+  kind: 'file';
+  /** SHA-256 hex digest of the file at capture time (attachment ref). */
+  sha256: string;
+  /** ISO 8601 timestamp when evidence was captured. */
+  timestamp: string;
+  /** Path to the file, relative to the project root. */
+  path: string;
+  /** IANA MIME type of the file (e.g. `"text/typescript"`, `"application/pdf"`). */
+  mime?: string;
+  /** Optional human-readable note about this evidence artifact. */
+  description?: string;
+}
+
+/**
+ * Evidence for a log stream captured from a running process.
+ *
+ * The `sha256` is the content hash of the captured log text.
+ */
+export interface LogEvidence {
+  kind: 'log';
+  /** SHA-256 hex digest of the captured log content. */
+  sha256: string;
+  /** ISO 8601 timestamp when evidence was captured. */
+  timestamp: string;
+  /**
+   * Source process name or description (e.g. `"pnpm test"`, `"node server.js"`).
+   */
+  source: string;
+  /** Optional human-readable note about this log artifact. */
+  description?: string;
+}
+
+/**
+ * Evidence for a screenshot or visual capture taken during verification.
+ *
+ * Used for manual gates and UI smoke tests. The `sha256` references the
+ * image blob in the attachment store.
+ */
+export interface ScreenshotEvidence {
+  kind: 'screenshot';
+  /** SHA-256 hex digest of the image file. */
+  sha256: string;
+  /** ISO 8601 timestamp when evidence was captured. */
+  timestamp: string;
+  /**
+   * MIME type of the image.
+   *
+   * @defaultValue "image/png"
+   */
+  mime?: 'image/png' | 'image/jpeg' | 'image/webp';
+  /** Optional human-readable note (e.g. `"dark mode toggle on macOS Chrome"`). */
+  description?: string;
+}
+
+/**
+ * Evidence for structured test-runner output.
+ *
+ * Carries the summary metrics from the test run alongside the SHA-256
+ * reference to the full output blob.
+ */
+export interface TestOutputEvidence {
+  kind: 'test-output';
+  /** SHA-256 hex digest of the full test-runner output. */
+  sha256: string;
+  /** ISO 8601 timestamp when evidence was captured. */
+  timestamp: string;
+  /** Number of tests that passed. */
+  passed: number;
+  /** Number of tests that failed. */
+  failed: number;
+  /** Number of tests skipped or pending. */
+  skipped: number;
+  /** Exit code of the test process. */
+  exitCode: number;
+  /** Optional human-readable note about the test run. */
+  description?: string;
+}
+
+/**
+ * Evidence for raw stdout/stderr output from a shell command.
+ *
+ * The `sha256` references the full output blob in the attachment store.
+ */
+export interface CommandOutputEvidence {
+  kind: 'command-output';
+  /** SHA-256 hex digest of the full command output. */
+  sha256: string;
+  /** ISO 8601 timestamp when evidence was captured. */
+  timestamp: string;
+  /** The command that was run (e.g. `"pnpm run build"`). */
+  cmd: string;
+  /** Exit code of the command process. */
+  exitCode: number;
+  /** Optional human-readable note about the command run. */
+  description?: string;
+}
+
+// ─── Discriminated union ──────────────────────────────────────────────────────
+
+/**
+ * A typed evidence artifact attached to a verification record.
+ *
+ * Replaces the bare `evidence?: string` field on {@link AcceptanceGateResult}
+ * with structured, kind-specific references backed by the attachment store.
+ *
+ * The `kind` field is the discriminant. All variants carry `sha256` (the
+ * attachment store ref), `timestamp`, and optional `description`.
+ *
+ * @example
+ * ```ts
+ * const ev: TaskEvidence = {
+ *   kind: 'test-output',
+ *   sha256: 'a1b2c3...ff',
+ *   timestamp: '2026-04-15T10:00:00.000Z',
+ *   passed: 42,
+ *   failed: 0,
+ *   skipped: 2,
+ *   exitCode: 0,
+ * };
+ * ```
+ */
+export type TaskEvidence =
+  | FileEvidence
+  | LogEvidence
+  | ScreenshotEvidence
+  | TestOutputEvidence
+  | CommandOutputEvidence;
+
+/** All valid `kind` discriminants for `TaskEvidence`. */
+export type TaskEvidenceKind = TaskEvidence['kind'];
+
+// ─── Zod schemas ─────────────────────────────────────────────────────────────
+
+/** Zod schema for {@link FileEvidence}. */
+export const fileEvidenceSchema = z.object({
+  kind: z.literal('file'),
+  sha256: z.string().length(64),
+  timestamp: z.string().datetime(),
+  path: z.string().min(1),
+  mime: z.string().optional(),
+  description: z.string().optional(),
+});
+
+/** Zod schema for {@link LogEvidence}. */
+export const logEvidenceSchema = z.object({
+  kind: z.literal('log'),
+  sha256: z.string().length(64),
+  timestamp: z.string().datetime(),
+  source: z.string().min(1),
+  description: z.string().optional(),
+});
+
+/** Zod schema for {@link ScreenshotEvidence}. */
+export const screenshotEvidenceSchema = z.object({
+  kind: z.literal('screenshot'),
+  sha256: z.string().length(64),
+  timestamp: z.string().datetime(),
+  mime: z.enum(['image/png', 'image/jpeg', 'image/webp']).optional(),
+  description: z.string().optional(),
+});
+
+/** Zod schema for {@link TestOutputEvidence}. */
+export const testOutputEvidenceSchema = z.object({
+  kind: z.literal('test-output'),
+  sha256: z.string().length(64),
+  timestamp: z.string().datetime(),
+  passed: z.number().int().nonnegative(),
+  failed: z.number().int().nonnegative(),
+  skipped: z.number().int().nonnegative(),
+  exitCode: z.number().int(),
+  description: z.string().optional(),
+});
+
+/** Zod schema for {@link CommandOutputEvidence}. */
+export const commandOutputEvidenceSchema = z.object({
+  kind: z.literal('command-output'),
+  sha256: z.string().length(64),
+  timestamp: z.string().datetime(),
+  cmd: z.string().min(1),
+  exitCode: z.number().int(),
+  description: z.string().optional(),
+});
+
+/**
+ * Zod discriminated-union schema for {@link TaskEvidence}.
+ *
+ * Uses `z.discriminatedUnion('kind', [...])` for O(1) variant lookup.
+ *
+ * @example
+ * ```ts
+ * const ev = taskEvidenceSchema.parse({
+ *   kind: 'command-output',
+ *   sha256: 'a'.repeat(64),
+ *   timestamp: '2026-04-15T10:00:00.000Z',
+ *   cmd: 'pnpm run build',
+ *   exitCode: 0,
+ * });
+ * ```
+ */
+export const taskEvidenceSchema = z.discriminatedUnion('kind', [
+  fileEvidenceSchema,
+  logEvidenceSchema,
+  screenshotEvidenceSchema,
+  testOutputEvidenceSchema,
+  commandOutputEvidenceSchema,
+]);
+
+/** Inferred TypeScript type from {@link taskEvidenceSchema}. */
+export type TaskEvidenceInput = z.input<typeof taskEvidenceSchema>;