@counterfact-labs/cli 0.2.3 → 0.2.5

package/dist/contract/engine.js

@@ -0,0 +1,44 @@
+import { z } from "zod";
+import { ANALYSIS_PROTOCOL, analysisCapabilities } from "../analysis-core/contracts/relay-analysis.js";
+import { stableStringify } from "../analysis-core/llm/stable-json.js";
+import { workloadHardware } from "../gatekeeper/trust/schema.js";
+import { kmsKeyName } from "../transport/kms.js";
+export const ENGINE_ABI = 1;
+export const ENGINE_SPAWNER_CONTRACT = 1;
+const hash = z.string().regex(/^[0-9a-f]{64}$/);
+const version = z.string().min(1).max(128).regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/);
+export const engineIdentity = z.strictObject({
+    abi: z.literal(ENGINE_ABI), protocol: z.literal(ANALYSIS_PROTOCOL), spawnerContract: z.literal(ENGINE_SPAWNER_CONTRACT),
+    engineVersion: version, coreVersion: version, logicCommit: z.string().regex(/^[0-9a-f]{40}$/),
+    programSha256: hash, closureSha256: hash,
+});
+export const engineKeyPolicy = z.strictObject({
+    wrappingKey: z.string().refine(value => { try {
+        kmsKeyName(value);
+        return true;
+    }
+    catch {
+        return false;
+    } }),
+    workloadPolicySha256: hash, hardware: workloadHardware,
+});
+export const enginePin = engineIdentity.extend({ artifactSha256: hash, keyPolicy: engineKeyPolicy }).strict();
+export const analysisRelease = z.strictObject({ engine: enginePin, wire: analysisCapabilities }).refine(value => value.wire.protocol === value.engine.protocol && value.wire.engineVersion === value.engine.engineVersion);
+export function matchEngineKeyPolicy(keyPolicy, release) {
+    const policy = engineKeyPolicy.parse(keyPolicy);
+    if (release.bundleKey !== undefined && policy.wrappingKey !== kmsKeyName(release.bundleKey) ||
+        release.workloadPolicySha256 !== undefined && policy.workloadPolicySha256 !== release.workloadPolicySha256 ||
+        release.workloadPolicy !== undefined && !release.workloadPolicy.hardwareModels.includes(policy.hardware))
+        throw new Error("Invalid engine key policy");
+}
+export function samePin(left, right) {
+    if (!left || !right)
+        return left === right;
+    return stableStringify(enginePin.parse(left)) === stableStringify(enginePin.parse(right));
+}
+/** Historical releases carry no engine. New analysis evidence must be complete and agree at every boundary. */
+export function matchAnalysisRelease(value, pin, bundleVersion) {
+    const parsed = analysisRelease.parse(value);
+    if (!samePin(parsed.engine, pin) || parsed.wire.bundleVersion !== bundleVersion)
+        throw new Error("Analysis release differs");
+}

package/dist/contract/findings.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export const findingSequenceSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+export const canonicalUuidSchema = z.uuid().transform(value => value.toLowerCase());
+export const numberedFindingSchema = z.strictObject({
+    id: canonicalUuidSchema, seq: findingSequenceSchema,
+});
+export const numberedFindingsSchema = z.array(numberedFindingSchema).max(20_000)
+    .refine(values => new Set(values.map(value => value.id)).size === values.length
+    && new Set(values.map(value => value.seq)).size === values.length);
+/** Both intake and recovery status must refer only to their committed finding ids. */
+export function matchingFindingNumbers(value) {
+    if (value.findings === undefined)
+        return true;
+    const ids = new Set(value.findingIds);
+    return value.findings.every(finding => ids.has(finding.id));
+}
+/**
+ * Console route to implement: GET /api/cli/projects/{projectId}/findings/{seq}.
+ * Requires the signed-in bearer token and project access; no body and no charge.
+ * Params: { projectId: UUID, seq: positive decimal integer }. 200: { id: UUID, seq: number }.
+ * 404 means that finding does not exist in this project. The caller then loads
+ * the explanation from the existing GET /api/cli/findings/{id} route, whose
+ * response may add seq: number. Numbers are never resolved across projects.
+ */
+export const findingNumberParamsSchema = z.strictObject({
+    projectId: canonicalUuidSchema, seq: z.string().regex(/^[1-9][0-9]*$/).transform(Number).pipe(findingSequenceSchema),
+});
+export const findingNumberResponseSchema = numberedFindingSchema;

package/dist/contract/fix-requests.js

@@ -0,0 +1,30 @@
+import { z } from "zod";
+import { canonicalUuidSchema, findingSequenceSchema } from "./findings.js";
+/**
+ * Console routes to implement; both require the signed-in CLI bearer token.
+ * GET /api/cli/fix-requests has no body and returns 200 with a JSON array:
+ * [{ findingId: UUID, seq: positive integer, title: string, projectId: UUID,
+ *    requestedAt: ISO-8601 UTC timestamp, repoKey?: string }]. Empty is [].
+ * repoKey is the finding's console repository key, including its scoped folder
+ * when present (for example fictional/support/agents/fern or local:fern).
+ * Older consoles may omit it. Only this user's
+ * unclaimed requests for accessible findings are returned. No charge or writes.
+ *
+ * POST /api/cli/fix-requests/{id}/claim takes JSON {} and returns 200 with
+ * { findingId: UUID, claimed: true }. The path id is the findingId from the list;
+ * there is one waiting request per user and finding, so no separate request id.
+ * Claiming is idempotent for that user, removes it from their waiting list and
+ * never starts analysis, applies edits or charges. Re-requesting a finding makes
+ * it waiting again. A missing or inaccessible request returns 404; unauthenticated
+ * requests return 401. The console owns authorization and atomic claiming.
+ */
+export const waitingFixSchema = z.object({
+    findingId: canonicalUuidSchema, seq: findingSequenceSchema, title: z.string().min(1).max(4096),
+    projectId: canonicalUuidSchema, requestedAt: z.iso.datetime(),
+    repoKey: z.string().min(1).max(4096).refine(value => value.trim().length > 0 && !/[\r\n\u2028\u2029]/.test(value)).optional(),
+});
+export const waitingFixesResponseSchema = z.array(waitingFixSchema).max(20_000)
+    .refine(values => new Set(values.map(value => value.findingId)).size === values.length);
+export const claimFixRequestParamsSchema = z.strictObject({ id: canonicalUuidSchema });
+export const claimFixRequestBodySchema = z.strictObject({});
+export const claimFixRequestResponseSchema = z.strictObject({ findingId: canonicalUuidSchema, claimed: z.literal(true) });

package/dist/contract/messages.js

@@ -1,13 +1,14 @@
 import { z } from "zod";
+import { analysisRelease } from "./engine.js";
 import { executionRequest } from "../analysis-core/contracts/requests.js";
-import { checkRuntimeEnvironment } from "./runtime-environment.js";
+import { compactJwtPattern, hexChallenge } from "./attestation.js";
+export { PRODUCTION_EVIDENCE_VERSION, RELAY_CHANNEL_AUDIENCE, RELAY_PORT, RELAY_URL, RELAY_HEALTH_PATH, RELAY_HEALTH_URL, GOOGLE_ATTESTATION_ISSUER, MAX_ATTESTATION_BYTES, attestationChallenge, productionEvidence, evidenceBinding, googleAttestationClaims, observedAttestationClaims, probeAttestationClaims, attestationClaims } from "./attestation.js";
 /**
  * The messages that cross between the customer's machine and the sealed relay. This module is the only owner of
- * their shape: the relay, the gatekeeper and the bundle tooling all import these schemas and never redefine them.
+ * their analysis shape: the relay, the gatekeeper and the bundle tooling import these schemas and never redefine them.
+ * Public identity schemas are owned by attestation.ts and re-exported here for existing consumers.
  * Design: docs/design/sealed-model-relay.md and docs/design/relay-contract.md.
  */
-const compactJwtPattern = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
-const hexChallenge = z.string().length(64).regex(/^[0-9a-f]+$/);
 /** The wire adds routing identity to the core's data-only execution envelope. */
 export const relayRequest = executionRequest.extend({
     bundleVersion: z.string().min(1).max(128),
@@ -125,102 +126,13 @@ export const relayHealthResponse = z.discriminatedUnion("ok", [
         code: z.enum(["bad_request", "unavailable"]),
     }).strict(),
 ]);
-export const PRODUCTION_EVIDENCE_VERSION = 1;
-export const RELAY_CHANNEL_AUDIENCE = "https://relay.counterfactlabs.com";
-// Passthrough forwarding keeps the non-root workload's listener port unchanged.
-export const RELAY_PORT = 8443;
-export const RELAY_URL = `${RELAY_CHANNEL_AUDIENCE}:${RELAY_PORT}`;
-export const RELAY_HEALTH_PATH = "/health";
-export const RELAY_HEALTH_URL = `${RELAY_URL}${RELAY_HEALTH_PATH}`;
-export const GOOGLE_ATTESTATION_ISSUER = "https://confidentialcomputing.googleapis.com";
-export const MAX_ATTESTATION_BYTES = 32 * 1024;
-export const attestationChallenge = z.object({
-    version: z.literal(PRODUCTION_EVIDENCE_VERSION),
-    challenge: hexChallenge,
-}).strict();
-export const productionEvidence = z.object({
-    version: z.literal(PRODUCTION_EVIDENCE_VERSION),
-    token: z.string().max(MAX_ATTESTATION_BYTES).regex(compactJwtPattern),
-}).strict();
-/** Google's launcher accepts up to six caller nonces, each at most 74 characters. */
-export const evidenceBinding = z.object({
-    audience: z.string().min(1).max(256).regex(/^[A-Za-z0-9:/._-]+$/),
-    nonces: z.array(z.string().min(1).max(74).regex(/^[A-Za-z0-9_:-]+$/)).min(1).max(6),
-}).strict();
-/** Native claims are interpreted only after the PKI chain and token signature are authenticated. */
-export const googleAttestationClaims = z.object({
-    iss: z.literal(GOOGLE_ATTESTATION_ISSUER),
-    aud: z.string(),
-    sub: z.string(),
-    iat: z.number().int(),
-    nbf: z.number().int(),
-    exp: z.number().int(),
-    eat_nonce: z.union([z.string(), z.array(z.string()).min(1).max(6)]),
-    secboot: z.literal(true),
-    dbgstat: z.literal("disabled-since-boot"),
-    oemid: z.literal(11129),
-    hwmodel: z.string(),
-    swname: z.literal("CONFIDENTIAL_SPACE"),
-    swversion: z.array(z.string()).length(1),
-    google_service_accounts: z.array(z.string()).min(1),
-    development: z.never().optional(),
-    identity: z.never().optional(),
-    submods: z.object({
-        confidential_space: z.object({
-            support_attributes: z.array(z.string()),
-            monitoring_enabled: z.object({ memory: z.literal(false) }).passthrough(),
-        }).passthrough(),
-        container: z.object({
-            image_digest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
-            image_signatures: z.array(z.object({
-                key_id: z.string(), signature: z.string().min(1),
-                signature_algorithm: z.literal("RSASSA_PSS_SHA256"),
-            }).passthrough()).min(1),
-            // Google omits both override claims when nothing was overridden; when present they must still be empty.
-            cmd_override: z.array(z.unknown()).length(0).optional(),
-            env_override: z.object({}).strict().optional(),
-            // Real tokens list the container's own environment; the relay's start-up rule decides which settings are allowed.
-            env: z.record(z.string(), z.string()).refine(env => {
-                try {
-                    checkRuntimeEnvironment(env);
-                    return true;
-                }
-                catch {
-                    return false;
-                }
-            }),
-        }).passthrough(),
-    }).passthrough(),
-}).passthrough();
-/** Authenticated observations describe a refused workload without granting it an admitted identity. */
-export const observedAttestationClaims = googleAttestationClaims.extend({
-    dbgstat: z.string(),
-    submods: googleAttestationClaims.shape.submods.extend({
-        container: googleAttestationClaims.shape.submods.shape.container.extend({
-            image_signatures: z.array(googleAttestationClaims.shape.submods.shape.container.shape.image_signatures.element),
-            cmd_override: z.array(z.unknown()).optional(),
-            env_override: z.record(z.string(), z.unknown()).optional(),
-        }),
-    }),
-});
-/**
- * Local development claims. These cannot establish production identity; production uses native Google claims.
- */
-export const attestationClaims = z.object({
-    iss: z.string().url(),
-    /** The relay image's digest. Must be one we published. */
-    imageDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
-    /** Hash of the relay's channel public key, so the token is bound to this connection. */
-    channelKeyHash: z.string().regex(/^[0-9a-f]{64}$/),
-    exp: z.number().int(),
-    iat: z.number().int(),
-}).passthrough();
 const assetMetadata = z.object({
     /** HMAC-SHA256 keyed by a secret stored only in the encrypted payload. */
     fingerprint: z.string().regex(/^[0-9a-f]{64}$/),
     size: z.number().int().nonnegative(),
 }).strict();
 export const bundleMetadata = z.object({
+    analysis: analysisRelease.optional(),
     templates: z.record(z.string().min(1), assetMetadata.extend({
         role: z.enum(["required", "optional"]),
         answerFormats: z.array(z.string().min(1)).min(1),

package/dist/contract/public-report.js

@@ -0,0 +1 @@
+export { projectPublicFinding, projectPublicReport, unredactedAnswer, publicReportSchema } from "../analysis-core/contracts/relay-analysis.js";

package/dist/contract/runtime-environment.js

@@ -1,12 +1,23 @@
 // The pinned distroless base image sets SSL_CERT_FILE to its bundled certificates. The relay accepts exactly that
 // value, so the image works while no operator setting can point the relay at a different trust store.
 export const BASE_CERTIFICATE_FILE = "/etc/ssl/certs/ca-certificates.crt";
+export const runtimeIdentities = Object.freeze({ loader: 65532, engine: 65533 });
 const fixedValues = Object.freeze({ SSL_CERT_FILE: BASE_CERTIFICATE_FILE });
+export const relayRawClockSetting = Object.freeze({ name: "COUNTERFACT_RELAY_RAW_CLOCK", value: "1" });
+export const allowedRuntimeOverrides = Object.freeze({
+    [relayRawClockSetting.name]: relayRawClockSetting.value,
+});
+/** Only the clock rollback setting may differ from the signed image's environment. */
+export function allowsRuntimeOverrides(overrides) {
+    return Object.entries(overrides).every(([name, value]) => Object.hasOwn(allowedRuntimeOverrides, name) && allowedRuntimeOverrides[name] === value);
+}
 // Native startup consumes these data, so loader checks have the same owner as runtime checks.
 export const runtimeEnvironmentPolicy = Object.freeze({
     fixedValues,
+    forwardedValues: Object.entries(allowedRuntimeOverrides).map(([name, value]) => `${name}=${value}`),
     forbiddenPrefixes: ["CF_RELAY_", "ANTHROPIC_", "GOOGLE_AUTH_", "LD_"],
-    forbiddenNames: ["GOOGLE_APPLICATION_CREDENTIALS", "NODE_OPTIONS", "NODE_USE_ENV_PROXY", "NODE_EXTRA_CA_CERTS",
+    forbiddenNames: ["GOOGLE_APPLICATION_CREDENTIALS", "NODE_OPTIONS", "NODE_V8_COVERAGE", "NODE_COMPILE_CACHE", "NODE_REDIRECT_WARNINGS", "NODE_DEBUG", "NODE_DEBUG_NATIVE",
+        "NODE_USE_ENV_PROXY", "NODE_EXTRA_CA_CERTS",
         "NODE_TLS_REJECT_UNAUTHORIZED", "SSL_CERT_DIR", "GLIBC_TUNABLES", "GCONV_PATH"],
     forbiddenNamesIgnoringCase: ["http_proxy", "https_proxy", "all_proxy"],
 });

package/dist/core/analysis/run-to-end.js

@@ -1,55 +1,10 @@
-import { JobError } from "../../analysis-core/errors.js";
-import { readAnalysisFlags } from "../../analysis-core/analysis/analysis-flags.js";
-import { mapStage, inspectStage, sourceNotesStage, headlinesStage, applyAnalysisDelta, buildAnalysisResult } from "../../analysis-core/index.js";
-import { readFindingQualityConfig } from "./finding-quality/config.js";
-import { buildLocalReport } from "../../adapters/report.js";
-import { runStructures } from "./structural-run.js";
+import { NO_PROGRESS } from "../../analysis-core/stages/execution-ports.js";
+import { runEngineAnalysis } from "../../analysis-core/stages/engine-entry.js";
 import { analysisExecution } from "../../adapters/models.js";
-/** Keep the hosted stage order while holding source files and results only in memory. */
+/** Product startup selects ports; the shared runner owns the stage order. */
 export async function runAnalysisToEnd(input, model, settings = {}, options = {}) {
-    const execution = await analysisExecution(model, options, settings);
-    const { model: llm, requestTools: tools } = execution;
-    const flags = readAnalysisFlags(settings);
-    const qualityConfig = readFindingQualityConfig(settings, tools);
-    if (!Object.keys(input.files).length)
-        throw new JobError("empty_folder", "No admitted source files were found.");
-    let prepared = { repos: [{ key: input.repoKey, kind: "fs", files: input.files, ...(input.root !== undefined ? { root: input.root } : {}) }],
-        warnings: input.warnings ?? [], ...(input.fragment ? { mapped: [input.fragment] } : {}) };
-    const ports = { readers: [], model: llm, instructions: execution.instructions, requestTools: async () => tools, context: {},
-        progress: { checkpoint: async () => { }, assertHeld: () => { }, elapsedMs: () => 0, log: () => { } } };
-    for (;;) {
-        const delta = await mapStage({ phase: "mapping", state: prepared, settings, execution: { scopeConcurrency: 4, forLocal: true,
-                preparation: { capUsd: 20, confirmPrice: false, qualityConfig } } }, ports);
-        prepared = applyAnalysisDelta(prepared, delta);
-        if (delta.next !== "mapping")
-            break;
-    }
-    prepared = { ...prepared, analysisFlags: { ...flags, sourceNotes: !options.findingsOnly && flags.sourceNotes },
-        findingQuality: { config: qualityConfig }, warnings: [...(prepared.warnings ?? []), ...qualityConfig.diagnostics] };
-    let phase = "inspecting";
-    ports.progress.checkpoint = async (fields, part) => {
-        prepared = { ...prepared, ...fields, ...(part ? { passResults: { ...prepared.passResults, [part.index]: part.result } } : {}) };
-    };
-    while (phase !== "structuring") {
-        const step = phase === "inspecting" ? inspectStage : sourceNotesStage;
-        const delta = await step({ phase, state: prepared, settings, execution: { scopeConcurrency: 4, passConcurrency: 4, forLocal: true } }, ports);
-        prepared = applyAnalysisDelta(prepared, delta);
-        phase = delta.next;
-    }
-    const output = () => buildAnalysisResult({ phase: "persisting", state: prepared, settings, execution: { scopeConcurrency: 4 } });
-    // Structural child references index the local display order, including optional ranking.
-    const report = buildLocalReport(input.repoKey, output(), prepared);
-    if (!options.findingsOnly) {
-        const findingsRaw = prepared.findingsRaw;
-        const structural = await runStructures(settings, llm, { repos: prepared.repos,
-            fragments: [{ repoKey: input.repoKey, fragment: prepared.mapped[0] }],
-            graph: report.graph, findings: report.findings, state: prepared }, { execution });
-        // Structural child references keep display order; wording uses the original cleaned order.
-        prepared = { ...structural.state, findingsRaw };
-    }
-    prepared = applyAnalysisDelta(prepared, await headlinesStage({ phase: "persisting", state: prepared, settings,
-        execution: { scopeConcurrency: 4, forLocal: true } }, ports));
-    const result = output();
-    await options.resultSink?.(result);
-    return buildLocalReport(input.repoKey, result, prepared);
+    const execution = await analysisExecution(model, options);
+    return runEngineAnalysis({ ...input, settings }, { ...execution,
+        progress: NO_PROGRESS,
+    }, options);
 }

package/dist/gatekeeper/attestation.js

@@ -1,6 +1,6 @@
 import { createHash, verify } from "node:crypto";
 import { z } from "zod";
-import { MAX_ATTESTATION_BYTES, attestationClaims } from "../contract/messages.js";
+import { MAX_ATTESTATION_BYTES, attestationClaims } from "../contract/attestation.js";
 import { decodeBase64url } from "../transport/base64url.js";
 export function attestationPolicy(settings, trust) {
     return { ...trust, allowDevelopment: settings.CF_RELAY_DEV === "1" };

package/dist/gatekeeper/channel-binding.js

@@ -0,0 +1,15 @@
+import { PRODUCTION_EVIDENCE_VERSION, RELAY_CHANNEL_AUDIENCE, attestationChallenge } from "../contract/attestation.js";
+import { AttestationError } from "./attestation.js";
+/** Both peers supply bytes from their actual TLS socket; the transport owns freshness and socket reuse. */
+export function channelEvidenceBinding(binding) {
+    try {
+        attestationChallenge.parse({ version: PRODUCTION_EVIDENCE_VERSION, challenge: binding.challenge });
+        if (!(binding.exportedKeyMaterial instanceof Uint8Array) || binding.exportedKeyMaterial.byteLength !== 32)
+            throw new Error();
+        return { audience: RELAY_CHANNEL_AUDIENCE,
+            nonces: [Buffer.from(binding.exportedKeyMaterial).toString("base64url"), binding.challenge] };
+    }
+    catch {
+        throw new AttestationError("Invalid production attestation channel binding");
+    }
+}

package/dist/gatekeeper/cli-api.js

@@ -4,6 +4,8 @@ import { consoleSchemeAllowed } from "../contract/console-url.js";
 import { cliApiMessages } from "../contract/cli-api-messages.js";
 import { emailSignInMessages } from "../contract/email-sign-in-messages.js";
 import { CLI_BODY_LIMIT } from "../cli/api-types.js";
+import { findingNumberParamsSchema } from "../contract/findings.js";
+import { claimFixRequestBodySchema, claimFixRequestParamsSchema } from "../contract/fix-requests.js";
 export { DEFAULT_CONSOLE_URL as DEFAULT_URL } from "../setup-pings/client.js";
 export class ApiError extends Error {
     status;
@@ -36,6 +38,14 @@ function retryAfterMs(value, rejectNegativeSeconds = false) {
     return Number.isFinite(date) ? Math.max(0, date - Date.now()) : undefined;
 }
 function requestBody(path, body, emailRoute) {
+    if (path === "fix-requests" && body === undefined)
+        return undefined;
+    const lookup = /^projects\/([^/]+)\/findings\/([^/]+)$/.exec(path);
+    if (lookup && body === undefined && findingNumberParamsSchema.safeParse({ projectId: lookup[1], seq: lookup[2] }).success)
+        return undefined;
+    const claim = /^fix-requests\/([^/]+)\/claim$/.exec(path);
+    if (claim && claimFixRequestParamsSchema.safeParse({ id: claim[1] }).success && claimFixRequestBodySchema.safeParse(body).success)
+        return {};
     if ((path === "balance" || path === "checks/mode" || /^findings\/[a-zA-Z0-9_-]+$/.test(path)) && body === undefined)
         return undefined;
     if (body && typeof body === "object" && !Array.isArray(body)) {
@@ -95,7 +105,7 @@ export class ApiClient {
             throw new Error("COUNTERFACT_URL must be an HTTP or HTTPS address without credentials or query fields.");
         this.baseUrl = url.href.replace(/\/+$/, "");
     }
-    async request(path, body, authenticated = true) {
+    async request(path, body, authenticated = true, options = {}) {
         const emailRoute = Object.hasOwn(emailRoutes, path) ? emailRoutes[path] : undefined;
         const throwIfAborted = () => {
             if (emailRoute && this.signal?.aborted)
@@ -119,7 +129,7 @@ export class ApiClient {
         }
         const controller = new AbortController();
         const cancel = () => controller.abort(this.signal?.reason);
-        const timeout = setTimeout(() => controller.abort(), 120_000);
+        const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 120_000);
         timeout.unref();
         this.signal?.addEventListener("abort", cancel, { once: true });
         try {

package/dist/gatekeeper/connection-exchange.js

@@ -1,8 +1,21 @@
 import { RELAY_MAX_FRAME_BYTES, deliveryReceipt, relayAnswer, relayAnswerFrame, relayRequest } from "../contract/messages.js";
+import { unredactedAnswer } from "../contract/public-report.js";
 export class RelayConnectionError extends Error {
     name = "RelayConnectionError";
     constructor() { super("Relay connection failed"); }
 }
+/** Both carriers retry the same confirmation, never another paid request. */
+export async function acknowledgeDelivery(options, confirmation) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        options.valid();
+        const receipt = await options.exchange("/delivery", confirmation, 1024);
+        if (receipt.status === 200) {
+            deliveryReceipt.parse(receipt.body);
+            return;
+        }
+    }
+    throw new RelayConnectionError();
+}
 /** Calls and delivery retries share the authenticated transport and run in input order. */
 export function createRelayExchange(options) {
     let queue = Promise.resolve();
@@ -14,26 +27,18 @@ export function createRelayExchange(options) {
                 throw new Error();
             // Provider work can exceed a network-body timeout; evidence expiry still closes this exact socket.
             const response = await options.exchange("/relay", request, RELAY_MAX_FRAME_BYTES, options.remainingEvidenceMs());
-            const frame = options.development ? { answer: relayAnswer.parse(response.body), delivery: undefined } : relayAnswerFrame.parse(response.body);
+            const legacy = options.development ? relayAnswer.safeParse(response.body) : undefined;
+            const frame = legacy?.success ? { answer: legacy.data, delivery: undefined } : relayAnswerFrame.parse(response.body);
             if (frame.answer.nonce !== request.nonce)
                 throw new Error();
+            if (frame.answer.ok)
+                unredactedAnswer(frame.answer);
             if (frame.delivery) {
                 const { confirmation } = frame.delivery;
                 if (confirmation.callId !== request.callId)
                     throw new Error();
                 // The relay enforces its deadline on its own clock; local clock drift must not discard a paid answer.
-                let acknowledged = false;
-                for (let attempt = 0; attempt < 2; attempt++) {
-                    options.valid();
-                    const receipt = await options.exchange("/delivery", confirmation, 1024);
-                    if (receipt.status === 200) {
-                        deliveryReceipt.parse(receipt.body);
-                        acknowledged = true;
-                        break;
-                    }
-                }
-                if (!acknowledged)
-                    throw new Error();
+                await acknowledgeDelivery(options, confirmation);
             }
             return frame.answer;
         }

package/dist/gatekeeper/console.js

@@ -3,7 +3,7 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { CLI_VERSION } from "../contract/cli-version.js";
 import { cliRefusals, FINISH_FAILURE_MESSAGE, RESERVATION_EXPIRED_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, START_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
-import { cliRelayReservationRequestSchema, consoleCreatedSchema, consoleIntakeResultSchema, consoleReservationSchema, consoleStatusSchema, LOCAL_FINDINGS_BODY_LIMIT, localFindingsPayloadSchema, LOCAL_START_BODY_LIMIT, LOCAL_START_EXECUTION_HEADER, localStartRequestSchema, localStartResponseSchema } from "../contract/console.js";
+import { cliRelayReservationRequestSchema, consoleCreatedSchema, consoleIntakeResultSchema, consoleReservationSchema, consoleStatusSchema, LOCAL_FINDINGS_BODY_LIMIT, localFindingsPayloadSchema, LOCAL_START_BODY_LIMIT, LOCAL_START_EXECUTION_HEADER, localStartRequestSchema, localStartResponseSchema, serializeLocalStartMetadata } from "../contract/console.js";
 const RESPONSE_LIMIT = 64 * 1024;
 const RESERVATION_BODY_LIMIT = 64 * 1024;
 const messages = {
@@ -54,8 +54,15 @@ export class ConsoleClient {
             throw new ConsoleError("invalid_configuration");
         }
     }
-    start(input) {
-        return this.#send("/api/cli/checks", input, localStartRequestSchema, localStartResponseSchema, LOCAL_START_BODY_LIMIT, { statuses: [201], header: LOCAL_START_EXECUTION_HEADER, context: "start" });
+    async start(input, metadata) {
+        let headers;
+        try {
+            headers = metadata === undefined ? {} : serializeLocalStartMetadata(metadata);
+        }
+        catch {
+            throw new ConsoleError("invalid_request", "start");
+        }
+        return this.#send("/api/cli/checks", input, localStartRequestSchema, localStartResponseSchema, LOCAL_START_BODY_LIMIT, { statuses: [201], headers: { ...headers, [LOCAL_START_EXECUTION_HEADER.name]: LOCAL_START_EXECUTION_HEADER.value }, context: "start" });
     }
     create(input) {
         return this.#lifecycle({ ...input, action: "create" }, consoleCreatedSchema);
@@ -115,7 +122,7 @@ export class ConsoleClient {
                 method: "POST", agent: false, rejectUnauthorized: true, maxHeaderSize: 16 * 1024,
                 headers: { "x-counterfact-cli-version": CLI_VERSION, authorization: `Bearer ${this.#token}`, "content-type": "application/json", accept: "application/json",
                     "content-length": body.length, "accept-encoding": "identity",
-                    ...(options.header ? { [options.header.name]: options.header.value } : {}) },
+                    ...options.headers },
             }, response => {
                 const status = response.statusCode ?? 0;
                 const declared = response.headers["content-length"];

package/dist/gatekeeper/model.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
+import { unredactedAnswer } from "../contract/public-report.js";
 import { executionRequest } from "../analysis-core/contracts/requests.js";
 export class ModelConfigurationError extends Error {
     name = "ModelConfigurationError";
@@ -62,7 +63,7 @@ export function relayModel(options) {
                 catch {
                     // A failed counter must not discard an answer or expose the sink's error text.
                 }
-                return reply.answer;
+                return unredactedAnswer(reply);
             },
         };
     }

package/dist/gatekeeper/production-attestation.js

@@ -1,11 +1,13 @@
 import { constants, verify, X509Certificate } from "node:crypto";
 import { z } from "zod";
-import { GOOGLE_ATTESTATION_ISSUER, MAX_ATTESTATION_BYTES, PRODUCTION_EVIDENCE_VERSION, RELAY_CHANNEL_AUDIENCE, attestationChallenge, evidenceBinding, googleAttestationClaims, observedAttestationClaims, productionEvidence } from "../contract/messages.js";
+import { GOOGLE_ATTESTATION_ISSUER, MAX_ATTESTATION_BYTES, PRODUCTION_EVIDENCE_VERSION, evidenceBinding, googleAttestationClaims, observedAttestationClaims, probeAttestationClaims, productionEvidence } from "../contract/attestation.js";
 import { decodeBase64url } from "../transport/base64url.js";
 import { isApprovedHardware } from "./trust/hardware.js";
 import { AttestationError } from "./attestation.js";
 import { validateCertificatePath } from "./certificate-path.js";
 import { validateProductionTrust, validateWorkloadPolicy } from "./trust/policy.js";
+import { channelEvidenceBinding } from "./channel-binding.js";
+export { channelEvidenceBinding } from "./channel-binding.js";
 /** A published client needs every trust constraint configured before it can connect to production. */
 export function assertProductionTrustConfigured(value) {
     try {
@@ -20,19 +22,6 @@ const headerSchema = z.object({
     alg: z.literal("RS256"), typ: z.literal("JWT").optional(), kid: z.string().max(256).optional(),
     x5c: z.array(z.string().min(1).max(8192)).min(1).max(5),
 }).strict();
-/** Both peers supply bytes from their actual TLS socket; the transport owns freshness and socket reuse. */
-export function channelEvidenceBinding(binding) {
-    try {
-        attestationChallenge.parse({ version: PRODUCTION_EVIDENCE_VERSION, challenge: binding.challenge });
-        if (!(binding.exportedKeyMaterial instanceof Uint8Array) || binding.exportedKeyMaterial.byteLength !== 32)
-            throw new Error();
-        return { audience: RELAY_CHANNEL_AUDIENCE,
-            nonces: [Buffer.from(binding.exportedKeyMaterial).toString("base64url"), binding.challenge] };
-    }
-    catch {
-        throw new AttestationError("Invalid production attestation channel binding");
-    }
-}
 /** The caller's binding comes from the channel/health/action owner, never from the token being verified. */
 export async function verifyProductionEvidence(token, binding, trust, now = Math.floor(Date.now() / 1000)) {
     let validated;
@@ -57,6 +46,20 @@ export async function verifyWorkloadEvidence(token, binding, policy, now = Math.
     }
     return verifyEvidence(token, binding, validated, now);
 }
+/** Bootstrap may bound this candidate before verification; it is never an authenticated time sample. */
+export function unverifiedEvidenceIssueTime(token) {
+    try {
+        productionEvidence.parse({ version: PRODUCTION_EVIDENCE_VERSION, token });
+        const candidate = JSON.parse(decodeBase64url(token.split(".")[1]).toString("utf8"));
+        const iat = candidate?.iat;
+        if (typeof iat !== "number" || !Number.isSafeInteger(iat) || !Number.isSafeInteger(iat * 1000))
+            throw new Error();
+        return iat;
+    }
+    catch {
+        throw new AttestationError("Malformed production attestation evidence");
+    }
+}
 async function authenticate(token, binding, roots, now) {
     try {
         productionEvidence.parse({ version: PRODUCTION_EVIDENCE_VERSION, token });
@@ -99,14 +102,17 @@ function validateClaimsBinding(claims, binding, now) {
 }
 /**
  * Reviewed roots authenticate probe facts; this result cannot substitute for workload admission.
- * The default schema is the strict observed shape; a probe owner can supply its own shape for claims
- * that Google omits on non-compliant workloads, but authentication and binding are always enforced here.
+ * Only the contract owner's probe shape may relax missing signature/support arrays. Caller schemas
+ * can impose stricter validation, but freshness, binding, issuer and all other claim rules stay fixed.
  */
 export async function observeGoogleEvidence(token, binding, roots, now = Math.floor(Date.now() / 1000), claimsSchema = observedAttestationClaims) {
     const payload = await authenticate(token, binding, roots, now);
     try {
-        const claims = claimsSchema.parse(JSON.parse(payload.toString("utf8")));
+        const rawClaims = JSON.parse(payload.toString("utf8"));
+        const claims = probeAttestationClaims.parse(rawClaims);
         validateClaimsBinding(claims, binding, now);
+        // Isolate even passthrough fields from caller mutation and discard any rewritten parser output.
+        claimsSchema.parse(structuredClone(rawClaims));
         return { claims };
     }
     catch {

package/dist/gatekeeper/trust/policy.js

@@ -1,3 +1,4 @@
+import { enginePin } from "../../contract/engine.js";
 import { X509Certificate } from "node:crypto";
 import { z } from "zod";
 import { hardwareModels } from "./hardware.js";
@@ -30,7 +31,9 @@ export const workloadPolicy = z.object({
 }).strict();
 const productionTrust = workloadPolicy.extend({
     imageDigests: z.array(z.string().regex(/^sha256:[0-9a-f]{64}$/)).min(1),
-});
+    engineReleases: z.array(z.strictObject({ imageDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/), engine: enginePin })).min(1).optional(),
+}).refine(value => !value.engineReleases || value.engineReleases.every(release => value.imageDigests.includes(release.imageDigest)) &&
+    new Set(value.engineReleases.map(release => release.imageDigest)).size === value.engineReleases.length, "Engine release image differs");
 export function validateWorkloadPolicy(value) {
     return workloadPolicy.parse(value);
 }

package/dist/gatekeeper/trust/schema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+import { hardwareModels } from "./hardware.js";
+export const hash = z.string().regex(/^[0-9a-f]{64}$/);
+export const workloadHardware = z.enum(hardwareModels);

package/dist/transport/kms.js

@@ -0,0 +1,25 @@
+const maxBytes = 64 * 1024;
+export function kmsKeyName(value) {
+    if (!/^projects\/[a-z][a-z0-9-]{4,62}\/locations\/[a-z0-9-]+\/keyRings\/[A-Za-z0-9_-]+\/cryptoKeys\/[A-Za-z0-9_-]+$/.test(value)) {
+        throw new Error("Invalid KMS key configuration");
+    }
+    return value;
+}
+export function kmsKeyVersionName(value) {
+    kmsKeyForVersion(value);
+    return value;
+}
+export function kmsKeyForVersion(value) {
+    const match = /^(.*)\/cryptoKeyVersions\/[1-9][0-9]*$/.exec(value);
+    if (!match)
+        throw new Error("Invalid KMS key configuration");
+    return kmsKeyName(match[1]);
+}
+export function kmsBase64(value) {
+    if (typeof value !== "string" || value.length < 4 || value.length > maxBytes)
+        throw new Error();
+    const bytes = Buffer.from(value, "base64");
+    if (bytes.toString("base64") !== value)
+        throw new Error();
+    return bytes;
+}