@coderifts/agent-guard 9.3.0 → 9.5.0

package/dist/esm/adapters/langgraph.js

@@ -13,10 +13,18 @@
  * owns the framework import and wires descriptors into tool() / ToolNode /
  * bind_tools / StateGraph themselves.
  *
- * Descriptor shape (dependency-free plain object):
- *   { name, description?, schema, func, invoke }
+ * Descriptor shape (dependency-free, StructuredTool-compatible for createReactAgent):
+ *   { name, description, schema, func, invoke, lc_runnable: true }
+ *   Measured against @langchain/langgraph createReactAgent tools:
+ *     ToolNode | (StructuredToolInterface | DynamicTool | RunnableToolLike)[]
+ *     (@langchain/langgraph@0.2.74 d.ts; current npm 1.4.12). Runtime isRunnable
+ *     requires lc_runnable === true; ToolNode drops non-matching tools and the
+ *     model sees "Tool not found" — NEVER return that silent shape.
  *   - schema  = JSON Schema from ProtectedTool.inputSchema (or empty object schema)
  *   - func / invoke = the GUARDED execute (same function reference) — never the raw tool
+ *   - description always set (fallback to name) — StructuredToolInterface requires it
+ * NO hard @langchain/* dependency: duck-type the measured surface. If a tool would
+ * still fail that check, throw LangGraphToolsNotStructuredError (named, with the fix).
  *
  * Honesty (do not "upgrade" assurance):
  *   - composition_assurance is passed through EXACTLY as the core reported it
@@ -34,6 +42,36 @@
  */
 import { withCodeRifts } from '../with-coderifts.js';
 import { attachProofToAgentResponse } from '../final-answer-proof.js';
+import { formatGateRefusalBody, formatGuardError, verdictKind, } from '../gate-refusal.js';
+/**
+ * Named error — thrown instead of returning tools createReactAgent would silently drop.
+ * Never a model-visible "Tool not found".
+ */
+export class LangGraphToolsNotStructuredError extends Error {
+    constructor(message) {
+        super(message
+            ?? 'withCodeRiftsLangGraph() tools are not StructuredTool-compatible for createReactAgent. '
+                + 'createReactAgent (@langchain/langgraph) requires StructuredToolInterface | DynamicTool | '
+                + 'RunnableToolLike (name, description, schema, invoke, lc_runnable). '
+                + 'Fix: wrap with tool() from @langchain/core/tools — see README (LangChain / LangGraph).');
+        this.name = 'LangGraphToolsNotStructuredError';
+    }
+}
+/**
+ * True iff `t` matches the measured createReactAgent tool surface
+ * (StructuredToolInterface | DynamicTool | RunnableToolLike).
+ */
+export function isLangGraphReactAgentTool(t) {
+    if (!t || typeof t !== 'object')
+        return false;
+    const o = t;
+    return typeof o.name === 'string' && o.name.length > 0
+        && typeof o.description === 'string'
+        && o.schema != null && typeof o.schema === 'object' && !Array.isArray(o.schema)
+        && typeof o.invoke === 'function'
+        && typeof o.func === 'function'
+        && o.lc_runnable === true;
+}
 /** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
 const EMPTY_SCHEMA = Object.freeze({
     type: 'object',
@@ -51,15 +89,21 @@ export function protectedToolToLangGraph(tool) {
         ? tool.inputSchema
         : { ...EMPTY_SCHEMA };
     // Guarded execute only — never a raw unwrapped executor.
-    const guarded = (args) => Promise.resolve(tool.execute(args));
+    const guarded = (args, _config) => Promise.resolve().then(() => tool.execute(args));
+    const description = tool.description != null && tool.description !== ''
+        ? tool.description
+        : tool.name;
     const out = {
         name: tool.name,
+        description,
         schema,
         func: guarded,
         invoke: guarded,
+        lc_runnable: true,
     };
-    if (tool.description != null && tool.description !== '') {
-        out.description = tool.description;
+    if (!isLangGraphReactAgentTool(out)) {
+        throw new LangGraphToolsNotStructuredError(`protectedToolToLangGraph(${JSON.stringify(tool.name)}): tool is not createReactAgent-consumable. `
+            + 'Fix: wrap with tool() from @langchain/core/tools — see README (LangChain / LangGraph).');
     }
     return out;
 }
@@ -68,13 +112,29 @@ export function protectedToolToLangGraph(tool) {
  * Does NOT call the guard — pure map over an already-protected list.
  */
 export function toLangGraphTools(protectedTools) {
-    return protectedTools.map(protectedToolToLangGraph);
+    return bindLangGraphTools(protectedTools.map(protectedToolToLangGraph));
+}
+/**
+ * Assert (and return) tools that createReactAgent can consume.
+ * Throws LangGraphToolsNotStructuredError — never a silent "Tool not found".
+ */
+export function bindLangGraphTools(tools) {
+    const out = [];
+    for (const t of tools) {
+        if (!isLangGraphReactAgentTool(t)) {
+            const n = t && typeof t === 'object' && 'name' in t ? String(t.name) : '?';
+            throw new LangGraphToolsNotStructuredError(`bindLangGraphTools: ${JSON.stringify(n)} is not StructuredTool-compatible for createReactAgent. `
+                + 'Fix: wrap with tool() from @langchain/core/tools — see README (LangChain / LangGraph).');
+        }
+        out.push(t);
+    }
+    return out;
 }
 /**
  * Build LangGraph/LangChain-ready guarded tool descriptors from raw tools + client + operation.
  *
  * Calls withCodeRifts internally (guard logic stays in the core). Returns:
- *   - `tools` — plain descriptors { name, description?, schema, func, invoke }
+ *   - `tools` — StructuredTool-compatible descriptors { name, description, schema, func, invoke, lc_runnable }
  *   - `protected_tools` — same guarded tools
  *   - assurance objects from the core, passed through untouched
  *
@@ -99,6 +159,7 @@ export function langGraphToolAdapter(result) {
         registry_report: result.registry_report,
         composition_assurance: result.composition_assurance,
         receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed,
     };
     if (result.repository !== undefined) {
         out.repository = result.repository;
@@ -134,10 +195,7 @@ export function bindLangGraphGuardOutcome(outcome, args) {
         body = serialize(outcome.result);
     }
     else if (outcome.executionAttempted === false) {
-        const kind = verdictKind(outcome);
-        body =
-            `CodeRifts gate did not permit execution (verdict: ${kind}). `
-                + 'No tool result was produced.';
+        body = formatGateRefusalBody(outcome);
     }
     else {
         const err = 'error' in outcome ? outcome.error : undefined;
@@ -157,21 +215,4 @@ export function bindLangGraphGuardOutcome(outcome, args) {
     }
     return msg;
 }
-function verdictKind(outcome) {
-    return outcome.verdict && typeof outcome.verdict === 'object' && 'kind' in outcome.verdict
-        ? String(outcome.verdict.kind)
-        : 'UNKNOWN';
-}
-function formatGuardError(err) {
-    if (err instanceof Error)
-        return err.message || err.name || 'Error';
-    if (typeof err === 'string')
-        return err;
-    try {
-        return JSON.stringify(err);
-    }
-    catch {
-        return String(err);
-    }
-}
 //# sourceMappingURL=langgraph.js.map

package/dist/esm/adapters/langgraph.js.map

@@ -1 +1 @@
-{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AASrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAuDtE,+EAA+E;AAC/E,MAAM,YAAY,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GACV,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;IAE1B,yDAAyD;IACzD,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,MAAM,GAAG,GAA4B;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAwC;IACvE,OAAO,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,GAAG,GAAiC;QACxC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiCD,MAAM,UAAU,mCAAmC,CAAI,MAAS;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAwB,EACxB,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAExE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,qDAAqD,IAAI,KAAK;kBAC5D,8BAA8B,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,uDAAuD,IAAI,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAC9D,MAAM,GAAG,GAAyB;QAChC,OAAO;QACP,YAAY;KACb,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,GAAqC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAA8B;IACjD,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,OAAO;QACxF,CAAC,CAAC,MAAM,CAAE,OAAO,CAAC,OAA4B,CAAC,IAAI,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAUrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAkC5B;;;GAGG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD,YAAY,OAAgB;QAC1B,KAAK,CACH,OAAO;eACJ,yFAAyF;kBACxF,2FAA2F;kBAC3F,qEAAqE;kBACrE,wFAAwF,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;WACjD,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACjC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;WAC5E,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU;WAC9B,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU;WAC5B,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC;AAC9B,CAAC;AA+BD,+EAA+E;AAC/E,MAAM,YAAY,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GACV,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;IAE1B,yDAAyD;IACzD,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,OAAiB,EAAE,EAAE,CACnD,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE;QACrE,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAEd,MAAM,GAAG,GAA4B;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW;QACX,MAAM;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAgC,CACxC,4BAA4B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C;cACjG,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAwC;IACvE,OAAO,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAE,CAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACnG,MAAM,IAAI,gCAAgC,CACxC,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0DAA0D;kBAChG,wFAAwF,CAC3F,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,GAAG,GAAiC;QACxC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiCD,MAAM,UAAU,mCAAmC,CAAI,MAAS;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAwB,EACxB,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAExE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,uDAAuD,IAAI,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAC9D,MAAM,GAAG,GAAyB;QAChC,OAAO;QACP,YAAY;KACb,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,GAAqC,CAAC;AAC/C,CAAC"}

package/dist/esm/adapters/openai.d.ts

@@ -22,6 +22,7 @@
  * LangGraph / Anthropic adapters follow the same thin-converter pattern later.
  */
 import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
+import type { CoverageObservedHandle } from '../coverage-observed.js';
 import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
 import type { GuardOutcome } from '../types.js';
 /**
@@ -61,6 +62,8 @@ export type WithCodeRiftsOpenAIResult = {
     composition_assurance: CompositionAssurance;
     /** Per-composition receipt cursor — NOT product-truth chain evidence. */
     receipt_thread: ReceiptThreadHandle;
+    /** Observed coverage for this withCodeRifts run. Half A always; Half B via reportToolDispatch. */
+    coverage_observed: CoverageObservedHandle;
     repository?: string;
 };
 /**

package/dist/esm/adapters/openai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,2EAA2E;QAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,CAAC;CACH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAgB7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAE5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAcxF;AAID;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,OAAO,CAAC,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAC;AAC/C,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,GAAG;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,iBAAiB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAgBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAClC,2BAA2B,CAuC7B"}
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,2EAA2E;QAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,CAAC;CACH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,kGAAkG;IAClG,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAgB7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAE5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAexF;AAID;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,OAAO,CAAC,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAC;AAC/C,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,GAAG;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,iBAAiB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAgBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAClC,2BAA2B,CAgC7B"}

package/dist/esm/adapters/openai.js

@@ -23,6 +23,7 @@
  */
 import { withCodeRifts } from '../with-coderifts.js';
 import { attachProofToAgentResponse } from '../final-answer-proof.js';
+import { formatGateRefusalBody, formatGuardError, verdictKind, } from '../gate-refusal.js';
 /** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
 const EMPTY_PARAMETERS = Object.freeze({
     type: 'object',
@@ -83,6 +84,7 @@ export function openAIToolAdapter(result) {
         registry_report: result.registry_report,
         composition_assurance: result.composition_assurance,
         receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed,
     };
     if (result.repository !== undefined) {
         out.repository = result.repository;
@@ -133,20 +135,13 @@ export function bindOpenAIGuardOutcome(outcome, args) {
     }
     else if (outcome.executionAttempted === false) {
         // Blocked before factory — no result; never fabricate one.
-        const kind = outcome.verdict && typeof outcome.verdict === 'object' && 'kind' in outcome.verdict
-            ? String(outcome.verdict.kind)
-            : 'UNKNOWN';
-        body =
-            `CodeRifts gate did not permit execution (verdict: ${kind}). `
-                + 'No tool result was produced.';
+        body = formatGateRefusalBody(outcome);
     }
     else {
         // executionAttempted && !executed → factory threw; error is present.
         const err = 'error' in outcome ? outcome.error : undefined;
         const errText = formatGuardError(err);
-        const kind = outcome.verdict && typeof outcome.verdict === 'object' && 'kind' in outcome.verdict
-            ? String(outcome.verdict.kind)
-            : 'UNKNOWN';
+        const kind = verdictKind(outcome);
         body =
             `Tool execution failed after gate decision (verdict: ${kind}): ${errText}`;
     }
@@ -162,16 +157,4 @@ export function bindOpenAIGuardOutcome(outcome, args) {
     };
     return msg;
 }
-function formatGuardError(err) {
-    if (err instanceof Error)
-        return err.message || err.name || 'Error';
-    if (typeof err === 'string')
-        return err;
-    try {
-        return JSON.stringify(err);
-    }
-    catch {
-        return String(err);
-    }
-}
 //# sourceMappingURL=openai.js.map

package/dist/esm/adapters/openai.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AASrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AA2CtE,+EAA+E;AAC/E,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,EAAE,GAAmC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,cAAwC;IACpE,OAAO,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmCD;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAI,MAAS;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,IAAmC;IAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gCAAgC,CAAC;IAErE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,sDAAsD;QACtD,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,2DAA2D;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,OAAO;YAC9F,CAAC,CAAC,MAAM,CAAE,OAAO,CAAC,OAA4B,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI;YACF,qDAAqD,IAAI,KAAK;kBAC5D,8BAA8B,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,OAAO;YAC9F,CAAC,CAAC,MAAM,CAAE,OAAO,CAAC,OAA4B,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI;YACF,uDAAuD,IAAI,MAAM,OAAO,EAAE,CAAC;IAC/E,CAAC;IAED,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAE9D,kGAAkG;IAClG,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,MAAM;QACZ,YAAY;QACZ,OAAO;KACR,CAAC;IACF,OAAO,GAAkC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAUrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AA6C5B,+EAA+E;AAC/E,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,EAAE,GAAmC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,cAAwC;IACpE,OAAO,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmCD;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAI,MAAS;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,IAAmC;IAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gCAAgC,CAAC;IAErE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,sDAAsD;QACtD,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,2DAA2D;QAC3D,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,uDAAuD,IAAI,MAAM,OAAO,EAAE,CAAC;IAC/E,CAAC;IAED,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAE9D,kGAAkG;IAClG,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,MAAM;QACZ,YAAY;QACZ,OAAO;KACR,CAAC;IACF,OAAO,GAAkC,CAAC;AAC5C,CAAC"}

package/dist/esm/cas-adapters/fs-default-wire.d.ts

@@ -0,0 +1,15 @@
+import type { ExecuteIfUnchangedOutcome } from '../conditional-write.js';
+/** Unambiguous fs target: a non-empty `path` string on tool arguments (Write convention). */
+export declare function inferFsPathFromArgs(args: unknown): string | null;
+/**
+ * Full-file body for a Write-style tool. `contents` wins; `content` only when this
+ * is not an Edit (no old_string/new_string). Fragments are not a whole-file CAS.
+ */
+export declare function inferFullFileWriteContent(args: unknown): string | null;
+/**
+ * Wire the FS adapter when path + full-file contents are both present.
+ * Otherwise run the host write unchanged. If the host already returned an
+ * ExecuteIfUnchangedOutcome, pass it through (do not wrap again).
+ */
+export declare function wrapWriteWithFsCas<T>(args: unknown, write: () => Promise<T> | T): Promise<T | ExecuteIfUnchangedOutcome<unknown>>;
+//# sourceMappingURL=fs-default-wire.d.ts.map

package/dist/esm/cas-adapters/fs-default-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-default-wire.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs-default-wire.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGzE,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC1B,OAAO,CAAC,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAmBjD"}

package/dist/esm/cas-adapters/fs-default-wire.js

@@ -0,0 +1,72 @@
+/**
+ * Default-wire helper for the FS CAS adapter.
+ *
+ * Only when the target AND the full-file body are unambiguously inferable
+ * (`args.path` + `args.contents` / `args.content`, Write-style). Edit fragments
+ * (`old_string`/`new_string`) are NOT a full-file write — leave those opt-in.
+ * API / DB / registry adapters stay opt-in.
+ *
+ * This layer performs writeFileIfUnchanged (the FS adapter), not a token
+ * pre-check around an unconditional host write — that would be a silent
+ * `committed` claim.
+ */
+'use strict';
+import { isExecuteIfUnchangedOutcome } from '../cas-attestation.js';
+import { createFsVersionToken, writeFileIfUnchanged } from './fs.js';
+/** Unambiguous fs target: a non-empty `path` string on tool arguments (Write convention). */
+export function inferFsPathFromArgs(args) {
+    if (!args || typeof args !== 'object')
+        return null;
+    const path = args.path;
+    if (typeof path !== 'string')
+        return null;
+    const trimmed = path.trim();
+    if (!trimmed)
+        return null;
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed))
+        return null;
+    return trimmed;
+}
+/**
+ * Full-file body for a Write-style tool. `contents` wins; `content` only when this
+ * is not an Edit (no old_string/new_string). Fragments are not a whole-file CAS.
+ */
+export function inferFullFileWriteContent(args) {
+    if (!args || typeof args !== 'object')
+        return null;
+    const a = args;
+    if (typeof a.contents === 'string')
+        return a.contents;
+    if (typeof a.content === 'string' && a.old_string == null && a.new_string == null) {
+        return a.content;
+    }
+    return null;
+}
+/**
+ * Wire the FS adapter when path + full-file contents are both present.
+ * Otherwise run the host write unchanged. If the host already returned an
+ * ExecuteIfUnchangedOutcome, pass it through (do not wrap again).
+ */
+export async function wrapWriteWithFsCas(args, write) {
+    const filePath = inferFsPathFromArgs(args);
+    const content = inferFullFileWriteContent(args);
+    if (filePath && content != null) {
+        let expected;
+        try {
+            expected = await createFsVersionToken(filePath);
+        }
+        catch {
+            return write();
+        }
+        return writeFileIfUnchanged({
+            path: filePath,
+            expected_token: expected,
+            content,
+        });
+    }
+    const raw = await write();
+    if (isExecuteIfUnchangedOutcome(raw))
+        return raw;
+    return raw;
+}
+//# sourceMappingURL=fs-default-wire.js.map

package/dist/esm/cas-adapters/fs-default-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-default-wire.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs-default-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,YAAY,CAAC;AAEb,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAErE,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAClF,OAAO,CAAC,CAAC,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,KAA2B;IAE3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,oBAAoB,CAAC;YAC1B,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,QAAQ;YACxB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,IAAI,2BAA2B,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/esm/coverage-observed.d.ts

@@ -0,0 +1,45 @@
+export type CoverageObservedClass = 'UNKNOWN_OUTSIDE_SCOPE' | 'INCOMPLETE_OBSERVED' | 'COMPLETE_OBSERVED';
+export type CoverageDispatch = {
+    name: string;
+    /** Host timestamp if they have one. Accepted and discarded — the snapshot is counts, not a trail. */
+    at?: string;
+};
+type CoverageObservedBase = {
+    governed_calls: number;
+    tools: readonly string[];
+};
+export type CoverageObservedUnknown = CoverageObservedBase & {
+    class: 'UNKNOWN_OUTSIDE_SCOPE';
+};
+export type CoverageObservedIncomplete = CoverageObservedBase & {
+    class: 'INCOMPLETE_OBSERVED';
+    total_calls: number;
+    ungoverned_calls: number;
+    ungoverned_tools: readonly string[];
+};
+export type CoverageObservedComplete = CoverageObservedBase & {
+    class: 'COMPLETE_OBSERVED';
+    total_calls: number;
+    ungoverned_calls: number;
+    ungoverned_tools: readonly string[];
+};
+export type CoverageObserved = CoverageObservedUnknown | CoverageObservedIncomplete | CoverageObservedComplete;
+export type CoverageObservedHandle = {
+    snapshot: () => CoverageObserved;
+    reportToolDispatch: (ev: CoverageDispatch) => void;
+    reportToolDispatchBatch: (evs: readonly CoverageDispatch[]) => void;
+};
+export type CoverageObserver = {
+    setTableNames: (names: readonly string[]) => void;
+    recordGoverned: (name: string) => void;
+    snapshot: () => CoverageObserved;
+    handle: CoverageObservedHandle;
+};
+export declare function createCoverageObserver(): CoverageObserver;
+export declare function freezeCoverageObserved(obs: CoverageObserved): CoverageObserved;
+/**
+ * Proof / T3 human line. Half B absent vs named ungoverned vs complete host report.
+ */
+export declare function formatCoverageObservedLine(obs: CoverageObserved): string;
+export {};
+//# sourceMappingURL=coverage-observed.d.ts.map

package/dist/esm/coverage-observed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-observed.d.ts","sourceRoot":"","sources":["../../src/coverage-observed.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,qBAAqB,GACrB,mBAAmB,CAAC;AAExB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,GAAG;IAC3D,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,oBAAoB,GAAG;IAC9D,KAAK,EAAE,qBAAqB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,GAAG;IAC5D,KAAK,EAAE,mBAAmB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,0BAA0B,GAC1B,wBAAwB,CAAC;AAE7B,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,gBAAgB,CAAC;IACjC,kBAAkB,EAAE,CAAC,EAAE,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACnD,uBAAuB,EAAE,CAAC,GAAG,EAAE,SAAS,gBAAgB,EAAE,KAAK,IAAI,CAAC;CACrE,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;IAClD,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,QAAQ,EAAE,MAAM,gBAAgB,CAAC;IACjC,MAAM,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAaF,wBAAgB,sBAAsB,IAAI,gBAAgB,CAuEzD;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,GAAG,gBAAgB,CAiB9E;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAcxE"}

package/dist/esm/coverage-observed.js

@@ -0,0 +1,136 @@
+/**
+ * Coverage attestation — what the guard MEASURED about tool traffic, not what it
+ * assumed at registration time.
+ *
+ * Half A (always): counts execute() through the returned table (governed_calls / tools).
+ * Half B (optional host report): total_calls / ungoverned_* — OMITTED when the host
+ * never reported, never zero. Absence ≠ zero.
+ *
+ * Observation only. Not a verdict input. Not a preimage field.
+ *
+ * Run scope: one withCodeRifts instance (same lifetime as receipt_thread). There is
+ * no process-wide session; this is the smallest honest run.
+ */
+'use strict';
+function uniqueInOrder(names) {
+    const seen = new Set();
+    const out = [];
+    for (const n of names) {
+        if (seen.has(n))
+            continue;
+        seen.add(n);
+        out.push(n);
+    }
+    return out;
+}
+export function createCoverageObserver() {
+    const table = new Set();
+    const governed = [];
+    const host = [];
+    let hostReported = false;
+    function snapshot() {
+        const tools = uniqueInOrder(governed);
+        if (!hostReported) {
+            return freezeCoverageObserved({
+                class: 'UNKNOWN_OUTSIDE_SCOPE',
+                governed_calls: governed.length,
+                tools,
+            });
+        }
+        const ungovernedList = host.filter((n) => !table.has(n));
+        if (ungovernedList.length > 0) {
+            return freezeCoverageObserved({
+                class: 'INCOMPLETE_OBSERVED',
+                governed_calls: governed.length,
+                tools,
+                total_calls: host.length,
+                ungoverned_calls: ungovernedList.length,
+                ungoverned_tools: uniqueInOrder(ungovernedList),
+            });
+        }
+        return freezeCoverageObserved({
+            class: 'COMPLETE_OBSERVED',
+            governed_calls: governed.length,
+            tools,
+            total_calls: host.length,
+            ungoverned_calls: 0,
+            ungoverned_tools: [],
+        });
+    }
+    function reportOne(ev) {
+        if (!ev || typeof ev.name !== 'string')
+            return false;
+        const name = ev.name.trim();
+        if (!name)
+            return false;
+        host.push(name);
+        return true;
+    }
+    const handle = {
+        snapshot,
+        reportToolDispatch(ev) {
+            if (reportOne(ev))
+                hostReported = true;
+        },
+        reportToolDispatchBatch(evs) {
+            // An actual array (including []) is a supplied report. A non-array is not.
+            if (!Array.isArray(evs))
+                return;
+            hostReported = true;
+            for (const ev of evs)
+                reportOne(ev);
+        },
+    };
+    return {
+        setTableNames(names) {
+            table.clear();
+            if (!Array.isArray(names) && !names)
+                return;
+            for (const n of names) {
+                if (typeof n === 'string' && n)
+                    table.add(n);
+            }
+        },
+        recordGoverned(name) {
+            if (typeof name === 'string' && name)
+                governed.push(name);
+        },
+        snapshot,
+        handle,
+    };
+}
+export function freezeCoverageObserved(obs) {
+    const tools = Object.freeze(obs.tools.slice());
+    if (obs.class === 'UNKNOWN_OUTSIDE_SCOPE') {
+        return Object.freeze({
+            class: 'UNKNOWN_OUTSIDE_SCOPE',
+            governed_calls: obs.governed_calls,
+            tools,
+        });
+    }
+    return Object.freeze({
+        class: obs.class,
+        governed_calls: obs.governed_calls,
+        tools,
+        total_calls: obs.total_calls,
+        ungoverned_calls: obs.ungoverned_calls,
+        ungoverned_tools: Object.freeze((obs.ungoverned_tools || []).slice()),
+    });
+}
+/**
+ * Proof / T3 human line. Half B absent vs named ungoverned vs complete host report.
+ */
+export function formatCoverageObservedLine(obs) {
+    const n = obs.governed_calls;
+    const callWord = n === 1 ? 'call' : 'calls';
+    if (obs.class === 'UNKNOWN_OUTSIDE_SCOPE') {
+        return `governed ${n} ${callWord}; traffic outside the guarded table not observable from here`;
+    }
+    if (obs.class === 'INCOMPLETE_OBSERVED') {
+        const names = obs.ungoverned_tools.join(', ');
+        return (`governed ${n}/${obs.total_calls} dispatched calls; `
+            + `${obs.ungoverned_calls} outside the guarded table: ${names}`);
+    }
+    return `governed ${n}/${obs.total_calls} dispatched calls; 0 outside the guarded table`;
+}
+//# sourceMappingURL=coverage-observed.js.map

package/dist/esm/coverage-observed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-observed.js","sourceRoot":"","sources":["../../src/coverage-observed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,CAAC;AAsDb,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,SAAS,QAAQ;QACf,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,sBAAsB,CAAC;gBAC5B,KAAK,EAAE,uBAAuB;gBAC9B,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,sBAAsB,CAAC;gBAC5B,KAAK,EAAE,qBAAqB;gBAC5B,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,gBAAgB,EAAE,cAAc,CAAC,MAAM;gBACvC,gBAAgB,EAAE,aAAa,CAAC,cAAc,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,sBAAsB,CAAC;YAC5B,KAAK,EAAE,mBAAmB;YAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,gBAAgB,EAAE,CAAC;YACnB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,SAAS,CAAC,EAAuC;QACxD,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAA2B;QACrC,QAAQ;QACR,kBAAkB,CAAC,EAAE;YACnB,IAAI,SAAS,CAAC,EAAE,CAAC;gBAAE,YAAY,GAAG,IAAI,CAAC;QACzC,CAAC;QACD,uBAAuB,CAAC,GAAG;YACzB,2EAA2E;YAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,OAAO;YAChC,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;IAEF,OAAO;QACL,aAAa,CAAC,KAAK;YACjB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO;YAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,cAAc,CAAC,IAAI;YACjB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAqB;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,uBAAuB;YAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,KAAK;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAqB;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,IAAI,QAAQ,8DAA8D,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CACL,YAAY,CAAC,IAAI,GAAG,CAAC,WAAW,qBAAqB;cACnD,GAAG,GAAG,CAAC,gBAAgB,+BAA+B,KAAK,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,GAAG,CAAC,WAAW,gDAAgD,CAAC;AAC1F,CAAC"}

package/dist/esm/execution-proof.d.ts

@@ -145,6 +145,11 @@ export type GuardExecutionProof = {
         fingerprint: string | null;
         execution_action: string | null;
     }>;
+    /**
+     * Observed tool-traffic coverage (withCodeRifts run). Observation only; omitted
+     * when no observer is wired. Not a preimage field.
+     */
+    coverage_observed?: import('./coverage-observed.js').CoverageObserved;
 };
 export type ProofBuildInput = {
     preflighted: boolean;
@@ -179,6 +184,8 @@ export type ProofBuildInput = {
         fingerprint: string | null;
         execution_action: string | null;
     }>;
+    /** Coverage snapshot (observation). Omit when no observer. */
+    coverageObserved?: import('./coverage-observed.js').CoverageObserved;
 };
 /**
  * Runtime twin of the type-level enforced⟺receiptVerified invariant.

package/dist/esm/execution-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-proof.d.ts","sourceRoot":"","sources":["../../src/execution-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAG,0BAAmC,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EACF,cAAc,GACd,iBAAiB,GACjB,wBAAwB,GACxB,yBAAyB,CAAC;CAC/B,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,OAAO,oBAAoB,CAAC;IACxC,uGAAuG;IACvG,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE;QACP;;;WAGG;QACH,QAAQ,EAAE,OAAO,CAAC;QAClB;;;WAGG;QACH,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAClC,sEAAsE;QACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IACF;;;;OAIG;IACH,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,SAAS,EAAE;QACT,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C;;OAEG;IACH,MAAM,EAAE;QACN,0BAA0B,EAAE,IAAI,CAAC;QACjC,iCAAiC,EAAE,IAAI,CAAC;QACxC,yCAAyC,EAAE,IAAI,CAAC;QAChD,+CAA+C,EAAE,IAAI,CAAC;QACtD,oCAAoC,EAAE,IAAI,CAAC;QAC3C,iDAAiD,EAAE,IAAI,CAAC;QACxD;;;;;WAKG;QACH,mDAAmD,EAAE,IAAI,CAAC;QAC1D;;;;WAIG;QACH,+CAA+C,EAAE,IAAI,CAAC;KACvD,CAAC;IACF,yFAAyF;IACzF,kBAAkB,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC;;;OAGG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IAC1D,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACnD,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC,CAAC;CACJ,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;IACtB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QACtB,yBAAyB,EAAE,OAAO,CAAC;QACnC,WAAW,EAAE,OAAO,CAAC;QACrB,iBAAiB,EAAE,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;KAClD,CAAC;IACF,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IACzD,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,aAAa,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC,CAAC;CACJ,CAAC;AAaF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,wFAAwF;IACxF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;CAClD,GAAG,IAAI,CAeP;AA0BD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAuBxE;AAeD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,mBAAmB,CA6E/E"}
+{"version":3,"file":"execution-proof.d.ts","sourceRoot":"","sources":["../../src/execution-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAG,0BAAmC,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EACF,cAAc,GACd,iBAAiB,GACjB,wBAAwB,GACxB,yBAAyB,CAAC;CAC/B,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,OAAO,oBAAoB,CAAC;IACxC,uGAAuG;IACvG,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE;QACP;;;WAGG;QACH,QAAQ,EAAE,OAAO,CAAC;QAClB;;;WAGG;QACH,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAClC,sEAAsE;QACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IACF;;;;OAIG;IACH,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,SAAS,EAAE;QACT,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C;;OAEG;IACH,MAAM,EAAE;QACN,0BAA0B,EAAE,IAAI,CAAC;QACjC,iCAAiC,EAAE,IAAI,CAAC;QACxC,yCAAyC,EAAE,IAAI,CAAC;QAChD,+CAA+C,EAAE,IAAI,CAAC;QACtD,oCAAoC,EAAE,IAAI,CAAC;QAC3C,iDAAiD,EAAE,IAAI,CAAC;QACxD;;;;;WAKG;QACH,mDAAmD,EAAE,IAAI,CAAC;QAC1D;;;;WAIG;QACH,+CAA+C,EAAE,IAAI,CAAC;KACvD,CAAC;IACF,yFAAyF;IACzF,kBAAkB,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC;;;OAGG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IAC1D,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACnD,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC,CAAC;IACH;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;CACvE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;IACtB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QACtB,yBAAyB,EAAE,OAAO,CAAC;QACnC,WAAW,EAAE,OAAO,CAAC;QACrB,iBAAiB,EAAE,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;KAClD,CAAC;IACF,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IACzD,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,aAAa,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC,CAAC;IACH,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;CACtE,CAAC;AAaF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,wFAAwF;IACxF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;CAClD,GAAG,IAAI,CAeP;AA0BD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAuBxE;AAeD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,mBAAmB,CAgF/E"}

package/dist/esm/execution-proof.js

@@ -18,6 +18,7 @@
  * package, or that an absent field means compliance. Those limits are explicit on every block.
  */
 import { createHash } from 'node:crypto';
+import { freezeCoverageObserved } from './coverage-observed.js';
 /** Machine-readable schema id for this block. */
 export const EXECUTION_PROOF_SPEC = 'guard-execution-proof.v1';
 const LIMITS = Object.freeze({
@@ -175,6 +176,9 @@ export function buildExecutionProof(input) {
     if (Array.isArray(input.recheckTrail) && input.recheckTrail.length > 0) {
         proof.recheck_trail = Object.freeze(input.recheckTrail.map((e) => Object.freeze({ ...e })));
     }
+    if (input.coverageObserved && typeof input.coverageObserved === 'object') {
+        proof.coverage_observed = freezeCoverageObserved(input.coverageObserved);
+    }
     return freezeProof(proof);
 }
 function freezeMonitoringDelivery(d) {