@crewhaus/tool-proof 0.0.0-stage → 0.8.0

package/dist/lib/context.js

@@ -0,0 +1,52 @@
+/** The session-id shape every session store and log enforces. */
+const SESSION_ID_REGEX = /^sess_[0-9a-f]{16}$/;
+/** provability's spec-name rule (`proofsRoot` refuses anything else). */
+const SPEC_NAME_REGEX = /^[a-zA-Z0-9_\-.]+$/;
+function bridgeOf(ctx) {
+    const bridge = ctx?.bridge;
+    return typeof bridge === "object" && bridge !== null ? bridge : undefined;
+}
+/** The run's context: `ctx.runContext` first, the bridge's otherwise. */
+export function runContextOf(ctx) {
+    return ctx?.runContext ?? bridgeOf(ctx)?.runContext;
+}
+/** The run's session id, when it has a well-formed one. */
+export function sessionIdOf(ctx) {
+    const id = runContextOf(ctx)?.sessionId;
+    return typeof id === "string" && SESSION_ID_REGEX.test(id) ? id : undefined;
+}
+/** The run's trace bus, or undefined off the loop (publishing is then a no-op). */
+export function eventBusOf(ctx) {
+    const bus = runContextOf(ctx)?.eventBus;
+    return bus !== undefined && typeof bus.publish === "function" ? bus : undefined;
+}
+/** The run's session event log, when the runtime handed one over. */
+export function eventLogOf(ctx) {
+    const log = bridgeOf(ctx)?.eventLog;
+    return log !== undefined && typeof log.append === "function" ? log : undefined;
+}
+/** Where the run's session logs live, when the runtime said. */
+export function sessionRootOf(ctx) {
+    const dir = bridgeOf(ctx)?.sessionRootDir;
+    return typeof dir === "string" && dir !== "" ? dir : undefined;
+}
+/** Whether the loop was told a sandbox backend is wired (`runChatLoop({ sandboxAvailable })`). */
+export function bridgeSandboxAvailable(ctx) {
+    return bridgeOf(ctx)?.sandboxAvailable === true;
+}
+/** The spec name the run carries, when it carries a valid one. */
+export function specNameOf(ctx) {
+    const name = runContextOf(ctx)?.specName;
+    return typeof name === "string" && SPEC_NAME_REGEX.test(name) && !/^\.+$/.test(name)
+        ? name
+        : undefined;
+}
+/** Log a warning on the run's logger; silent off the loop. Never throws. */
+export function warn(ctx, msg, fields) {
+    try {
+        runContextOf(ctx)?.logger?.warn(msg, fields);
+    }
+    catch {
+        // A logger that throws must not turn a finished check into a failure.
+    }
+}

package/dist/lib/evidence.d.ts

@@ -0,0 +1,57 @@
+import { type EvidenceIndex, type InputSchemaLookup } from "@crewhaus/provability";
+export type SessionEvidenceOptions = {
+    /** The run's session; absent ⇒ an empty index (nothing reachable was read). */
+    readonly sessionId?: string;
+    /** Where session `.jsonl` logs live (default `.crewhaus/sessions`, cwd-relative, as the runtime writes them). */
+    readonly rootDir?: string;
+    /** Workspace root for path-shaped inputs (default `process.cwd()`). */
+    readonly workspaceRoot?: string;
+    /**
+     * Where the runtime spilled results too long for the log (the tenant's
+     * `toolResultRoot` inside a tenant scope; default `.crewhaus/tool-results`
+     * under the workspace), so a spilled page is read whole.
+     */
+    readonly toolResultsRoot?: string;
+    /** `session` (every call the run made) or `turn` (the current turn's). */
+    readonly scope: "session" | "turn";
+    /** Told when a log could not be read to its end (records before it are kept). */
+    readonly onUnreadable?: (info: {
+        readonly sessionId: string;
+        readonly message: string;
+    }) => void;
+    /**
+     * The input schema each tool declared (provability's
+     * `EvidenceOptions.inputSchemaOf`), forwarded to every log read: an MCP
+     * call's origin is a field its schema declares. Absent ⇒ provability
+     * looks in `defaultCatalog`.
+     */
+    readonly inputSchemaOf?: InputSchemaLookup;
+};
+/** The index, plus what a reader of the preflight should know about how it was built. */
+export type SessionEvidence = {
+    readonly index: EvidenceIndex;
+    readonly notes: ReadonlyArray<string>;
+};
+/**
+ * Is a logged `user_message` payload the user's own message — the start of a
+ * turn? Runtime-injected messages carry `synthetic: true`, and the runtime
+ * logs each batch of tool results as a user message whose content is only
+ * `tool_result` blocks; neither starts a turn.
+ */
+export declare function startsTurn(payload: unknown): boolean;
+/**
+ * The current turn of a session log: the ids of the calls made after the
+ * last real user message, and the sub-agent sessions started after it.
+ * Reading never creates the log directory; a missing log is an empty turn.
+ * A log that cannot be read to its end keeps what was read before it.
+ */
+export declare function currentTurn(opts: {
+    readonly sessionId: string;
+    readonly rootDir: string;
+    readonly onUnreadable?: SessionEvidenceOptions["onUnreadable"];
+}): Promise<{
+    readonly toolUseIds: ReadonlySet<string>;
+    readonly children: readonly string[];
+}>;
+/** The evidence index over a session's log, scoped as the config says. */
+export declare function sessionEvidence(opts: SessionEvidenceOptions): Promise<SessionEvidence>;

package/dist/lib/evidence.js

@@ -0,0 +1,173 @@
+/**
+ * The evidence index the proof tools read when nobody injects one: the
+ * run's own session event log (design §5.2).
+ *
+ * The log is the gate's source too — it records every `tool_use` (full
+ * input) and `tool_result` (full output) verbatim, children included, and
+ * compaction cannot evict from it. A preflight runs mid-turn, after the
+ * turn's earlier calls were logged (runtime-core appends `tool_use` before a
+ * call runs and `tool_result` when it returns), so the draft is checked
+ * against everything the run has read so far. The composition root injects
+ * its own builder (the log merged with the in-memory transcript), which is
+ * what makes the gate and the tools agree exactly; this default is for the
+ * builtin instances.
+ *
+ * `scope: turn` (design §3) keeps only the current turn's calls. The log
+ * records no turn number on a call, so the turn is read the way the gate
+ * reads it from the transcript: everything after the last REAL user message
+ * — not a runtime-injected one (`synthetic: true`: a retry nudge, a
+ * recovery note) and not the tool-result carrier the runtime logs as a user
+ * message. Sub-agents started in the turn count whole: their calls ran for
+ * it.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { DEFAULT_ROOT_DIR, openEventLog } from "@crewhaus/event-log";
+import { buildEvidenceIndex, evidenceFromSessionLog, } from "@crewhaus/provability";
+import { clip } from "./check";
+const SESSION_ID_REGEX = /^sess_[0-9a-f]{16}$/;
+/** How many unreadable logs the note names; it counts the rest. */
+const UNREADABLE_NAMED = 3;
+/** How much of the first unreadable log's error the note quotes. */
+const UNREADABLE_MESSAGE_CHARS = 200;
+/** One less than the walk's own bound: a child started in the turn is already one level down. */
+const CHILD_MAX_DEPTH = 7;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * Is a logged `user_message` payload the user's own message — the start of a
+ * turn? Runtime-injected messages carry `synthetic: true`, and the runtime
+ * logs each batch of tool results as a user message whose content is only
+ * `tool_result` blocks; neither starts a turn.
+ */
+export function startsTurn(payload) {
+    if (!isRecord(payload) || payload["synthetic"] === true)
+        return false;
+    const content = payload["content"];
+    if (!Array.isArray(content))
+        return true;
+    if (content.length === 0)
+        return true;
+    return !content.every((block) => isRecord(block) && block["type"] === "tool_result");
+}
+/**
+ * The current turn of a session log: the ids of the calls made after the
+ * last real user message, and the sub-agent sessions started after it.
+ * Reading never creates the log directory; a missing log is an empty turn.
+ * A log that cannot be read to its end keeps what was read before it.
+ */
+export async function currentTurn(opts) {
+    const toolUseIds = new Set();
+    let children = [];
+    if (!existsSync(join(opts.rootDir, `${opts.sessionId}.jsonl`))) {
+        return { toolUseIds, children };
+    }
+    const log = await openEventLog(opts.sessionId, { rootDir: opts.rootDir });
+    try {
+        for await (const event of log.read()) {
+            const p = event.payload;
+            if (event.kind === "user_message") {
+                if (startsTurn(p)) {
+                    toolUseIds.clear();
+                    children = [];
+                }
+            }
+            else if (event.kind === "tool_use" && isRecord(p) && typeof p["id"] === "string") {
+                toolUseIds.add(p["id"]);
+            }
+            else if (event.kind === "sub_agent_start" && isRecord(p)) {
+                const child = p["childSessionId"];
+                if (typeof child === "string" &&
+                    SESSION_ID_REGEX.test(child) &&
+                    !children.includes(child)) {
+                    children.push(child);
+                }
+            }
+        }
+    }
+    catch (err) {
+        opts.onUnreadable?.({
+            sessionId: opts.sessionId,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    finally {
+        await log.close();
+    }
+    return { toolUseIds, children };
+}
+/**
+ * One note for every log that could not be read to its end, however many
+ * there were: a run whose sub-agents crashed mid-append can leave dozens of
+ * torn logs, and a note per log would crowd the preflight's instructions out
+ * of the report. Each log is still reported to `onUnreadable` on its own.
+ */
+function unreadableNote(unreadable) {
+    const ids = [...unreadable.keys()];
+    const [first] = ids;
+    if (first === undefined)
+        return [];
+    const why = clip(unreadable.get(first) ?? "", UNREADABLE_MESSAGE_CHARS);
+    if (ids.length === 1) {
+        return [
+            `the session log ${first} could not be read to its end (${why}); only the calls before that point count`,
+        ];
+    }
+    const named = ids.slice(0, UNREADABLE_NAMED);
+    const rest = ids.length - named.length;
+    return [
+        `${ids.length} session logs could not be read to their end (${named.join(", ")}${rest > 0 ? `, and ${rest} more` : ""}; the first: ${why}); in each, only the calls before that point count`,
+    ];
+}
+/** The evidence index over a session's log, scoped as the config says. */
+export async function sessionEvidence(opts) {
+    if (opts.sessionId === undefined || !SESSION_ID_REGEX.test(opts.sessionId)) {
+        return {
+            index: buildEvidenceIndex([]),
+            notes: [
+                "no session log is reachable from this call (it carries no run context), so no source counts as fetched and no tool result as run",
+            ],
+        };
+    }
+    const rootDir = opts.rootDir ?? DEFAULT_ROOT_DIR;
+    // Each unreadable log once, with its first error: the parent log is read
+    // twice under `scope: turn` (the turn, then its records).
+    const unreadable = new Map();
+    const onUnreadable = (info) => {
+        if (!unreadable.has(info.sessionId))
+            unreadable.set(info.sessionId, info.message);
+        opts.onUnreadable?.(info);
+    };
+    const common = {
+        rootDir,
+        onUnreadable,
+        ...(opts.workspaceRoot !== undefined ? { workspaceRoot: opts.workspaceRoot } : {}),
+        ...(opts.toolResultsRoot !== undefined ? { toolResultsRoot: opts.toolResultsRoot } : {}),
+        ...(opts.inputSchemaOf !== undefined ? { inputSchemaOf: opts.inputSchemaOf } : {}),
+    };
+    if (opts.scope === "session") {
+        const records = await evidenceFromSessionLog({ sessionId: opts.sessionId, ...common });
+        return {
+            index: buildEvidenceIndex(records, { sessionId: opts.sessionId }),
+            notes: unreadableNote(unreadable),
+        };
+    }
+    const turn = await currentTurn({ sessionId: opts.sessionId, rootDir, onUnreadable });
+    const own = await evidenceFromSessionLog({
+        sessionId: opts.sessionId,
+        includeChildren: false,
+        ...common,
+    });
+    const records = own.filter((r) => turn.toolUseIds.has(r.toolUseId));
+    for (const child of turn.children) {
+        records.push(...(await evidenceFromSessionLog({
+            sessionId: child,
+            maxDepth: CHILD_MAX_DEPTH,
+            ...common,
+        })));
+    }
+    // The parent named, so a child's call never answers the parent's id.
+    return {
+        index: buildEvidenceIndex(records, { sessionId: opts.sessionId }),
+        notes: unreadableNote(unreadable),
+    };
+}

package/dist/lib/preflight.d.ts

@@ -0,0 +1,87 @@
+/**
+ * `ProvabilityPreflight`: the gate's verdict on a draft, before the answer
+ * is sent (design §2, §7).
+ *
+ * It calls the gate's own verifier — `verifyDocument`, the one function the
+ * gate, this tool, `crewhaus provability check` and the research report
+ * gate share — with the gate's config, its evidence and its artifact store,
+ * so a draft is graded here exactly as the gate will grade it, except for
+ * the three steps that reach outside the run, which a read-only preflight
+ * never takes:
+ *
+ * - `sources.resolve: head` — the gate sends one guarded HEAD per cited URL
+ *   (an egress). The preflight checks with `resolve: off` instead of
+ *   failing every URL as `unresolved`, and says so.
+ * - replay at `checked` — the gate re-runs a cited pure tool and compares
+ *   digests. The preflight does not: a binding reads `replayed: false`.
+ *   Replaying a pure tool with its logged input reproduces it, so this only
+ *   matters for a tool that is not as deterministic as its flags say.
+ * - the paraphrase-waiver judge — never consulted here (it spends, and a
+ *   preflight must not). A paraphrase the gate's judge might accept shows
+ *   as `not_found_in_source`: the preflight is the stricter of the two.
+ *
+ * Nothing is gated, persisted or published: the draft is not an answer.
+ */
+import { type EvidenceIndex, type ProofArtifactStore, type ProofBundle, type ProvabilityConfig, type VerifyOptions } from "@crewhaus/provability";
+/** The longest draft a preflight reads (a long research report fits). */
+export declare const DRAFT_CHARS = 200000;
+/**
+ * The most claims the table lists; the counts above it always cover all of
+ * them. The report's byte budget ({@link REPORT_BYTES}) usually stops the
+ * table sooner.
+ */
+export declare const TABLE_ROWS = 100;
+/** The most bindings one row lists; `moreEvidence` counts the rest. */
+export declare const ROW_BINDINGS = 6;
+/**
+ * The notes' share. The preflight writes at most three or four short ones
+ * (where it differs from the gate, how the evidence was read), but they sit
+ * ahead of the nudge, so they are budgeted like it: a note list that grew
+ * with the run (one per unreadable log, say) would otherwise push the nudge
+ * out of the head the runtime shows.
+ */
+export declare const NOTES_BYTES = 1600;
+/** The config the preflight verifies with, and what it left out of the gate's. */
+export declare function preflightConfig(config: ProvabilityConfig): {
+    readonly config: ProvabilityConfig;
+    readonly notes: ReadonlyArray<string>;
+};
+/** Run the gate's verifier over `draft` with the preflight's config (see the module doc). */
+export declare function preflightBundle(draft: string, opts: {
+    readonly config: ProvabilityConfig;
+    readonly evidence: EvidenceIndex;
+    readonly artifacts: ProofArtifactStore;
+    readonly workspaceRoot: string;
+    /**
+     * `scope: turn` as the gate applies it to a session-wide index
+     * (`VerifyOptions.turnNumbers`). Absent: `evidence` is used as given,
+     * so it must already be scoped.
+     */
+    readonly turnNumbers?: ReadonlySet<number>;
+    /** The gate's re-check of a stored proof (`recheckProof`), so the preflight reads proofs as it does. */
+    readonly recheckProof?: VerifyOptions["recheckProof"];
+    /** The directories the gate refuses path sources under (`VerifyOptions.stateRoots`, `runtimeStateRoots`). */
+    readonly stateRoots?: VerifyOptions["stateRoots"];
+    readonly now?: () => Date;
+}): Promise<{
+    readonly bundle: ProofBundle;
+    readonly notes: ReadonlyArray<string>;
+}>;
+/**
+ * The preflight's answer, in the order the model should read it: the
+ * verdict and counts, the footer the reader would see, what to do next,
+ * the notes on where the preflight differs from the gate, the gate's own
+ * retry nudge when the draft would not pass cleanly, and then a row per
+ * claim with each binding's verdict — the unmet claims first.
+ *
+ * The whole report fits in {@link REPORT_BYTES}: the runtime shows the model
+ * only the head of a larger result, so the instructions go first — the
+ * notes and the nudge each held to a byte share ({@link NOTES_BYTES},
+ * `NUDGE_BYTES`) — and the table takes the room that is left, row by row; `tableOmitted` counts the
+ * claims it had no room for (the counts above it cover every claim, and the
+ * nudge already names the unmet ones). Excerpts of fetched bodies are left
+ * out on purpose: the model already read those bodies, and the nudge's rule
+ * (no fetched content) is the right one for anything the gate machinery
+ * hands back to the model.
+ */
+export declare function preflightReport(bundle: ProofBundle, notes: ReadonlyArray<string>): Record<string, unknown>;

package/dist/lib/preflight.js

@@ -0,0 +1,196 @@
+/**
+ * `ProvabilityPreflight`: the gate's verdict on a draft, before the answer
+ * is sent (design §2, §7).
+ *
+ * It calls the gate's own verifier — `verifyDocument`, the one function the
+ * gate, this tool, `crewhaus provability check` and the research report
+ * gate share — with the gate's config, its evidence and its artifact store,
+ * so a draft is graded here exactly as the gate will grade it, except for
+ * the three steps that reach outside the run, which a read-only preflight
+ * never takes:
+ *
+ * - `sources.resolve: head` — the gate sends one guarded HEAD per cited URL
+ *   (an egress). The preflight checks with `resolve: off` instead of
+ *   failing every URL as `unresolved`, and says so.
+ * - replay at `checked` — the gate re-runs a cited pure tool and compares
+ *   digests. The preflight does not: a binding reads `replayed: false`.
+ *   Replaying a pure tool with its logged input reproduces it, so this only
+ *   matters for a tool that is not as deterministic as its flags say.
+ * - the paraphrase-waiver judge — never consulted here (it spends, and a
+ *   preflight must not). A paraphrase the gate's judge might accept shows
+ *   as `not_found_in_source`: the preflight is the stricter of the two.
+ *
+ * Nothing is gated, persisted or published: the draft is not an answer.
+ */
+import { renderFooter, renderNudge, verifyDocument, } from "@crewhaus/provability";
+import { REPORT_BYTES, clip, clipMiddle, fitText, jsonBytes, listed } from "./check";
+/** The longest draft a preflight reads (a long research report fits). */
+export const DRAFT_CHARS = 200_000;
+/**
+ * The most claims the table lists; the counts above it always cover all of
+ * them. The report's byte budget ({@link REPORT_BYTES}) usually stops the
+ * table sooner.
+ */
+export const TABLE_ROWS = 100;
+/** The most bindings one row lists; `moreEvidence` counts the rest. */
+export const ROW_BINDINGS = 6;
+/** The nudge's share of the report; cut in the middle, so its closing instructions stay. */
+const NUDGE_BYTES = 3_500;
+/**
+ * The notes' share. The preflight writes at most three or four short ones
+ * (where it differs from the gate, how the evidence was read), but they sit
+ * ahead of the nudge, so they are budgeted like it: a note list that grew
+ * with the run (one per unreadable log, say) would otherwise push the nudge
+ * out of the head the runtime shows.
+ */
+export const NOTES_BYTES = 1_600;
+/** One note as listed. */
+const NOTE_CHARS = 500;
+const moreNotes = (rest) => `… and ${rest} more ${rest === 1 ? "note" : "notes"} on how this preflight read the run`;
+/** The config the preflight verifies with, and what it left out of the gate's. */
+export function preflightConfig(config) {
+    const notes = [];
+    let checked = config;
+    if (config.sources.resolve === "head") {
+        checked = { ...config, sources: { ...config.sources, resolve: "off" } };
+        if (config.level === "cited" || config.level === "grounded") {
+            notes.push("provability.sources.resolve is head: the gate also sends one HEAD request per cited URL and fails an unreachable one (unresolved); this preflight sends none, so it does not check reachability");
+        }
+    }
+    if (config.judge !== undefined && config.level === "grounded") {
+        notes.push("the gate may ask its paraphrase judge to accept a claim this preflight reports as not_found_in_source; the judge is never consulted here, so fix those claims rather than count on it");
+    }
+    return { config: checked, notes };
+}
+/** Run the gate's verifier over `draft` with the preflight's config (see the module doc). */
+export async function preflightBundle(draft, opts) {
+    const { config, notes } = preflightConfig(opts.config);
+    const bundle = await verifyDocument(draft, {
+        config,
+        evidence: opts.evidence,
+        artifacts: opts.artifacts,
+        workspaceRoot: opts.workspaceRoot,
+        ...(opts.turnNumbers !== undefined ? { turnNumbers: opts.turnNumbers } : {}),
+        ...(opts.recheckProof !== undefined ? { recheckProof: opts.recheckProof } : {}),
+        ...(opts.stateRoots !== undefined ? { stateRoots: opts.stateRoots } : {}),
+        ...(opts.now !== undefined ? { now: opts.now } : {}),
+        // Deliberately absent: replay, isPureTool, resolveHead, judgeWaiver.
+    });
+    const replayed = config.level === "checked" &&
+        config.execution.replay &&
+        bundle.claims.some((c) => c.bindings.some((b) => b.kind === "execution" && b.ok));
+    return {
+        bundle,
+        notes: replayed
+            ? [
+                ...notes,
+                "the gate also re-runs each cited pure tool with its logged input and fails a claim whose output differs (replay_mismatch); this preflight does not re-run them",
+            ]
+            : notes,
+    };
+}
+function bindingRow(b) {
+    return {
+        ref: b.ref,
+        kind: b.kind,
+        rung: b.rung,
+        ok: b.ok,
+        ...(b.reason !== undefined ? { reason: b.reason } : {}),
+        // Detail says why a binding fell short; on a met binding it is noise.
+        ...(!b.ok && b.detail !== undefined ? { detail: clip(b.detail, 300) } : {}),
+        ...(b.origin !== undefined ? { origin: clip(b.origin, 200) } : {}),
+        ...(b.kind === "execution" && b.replayed !== undefined ? { replayed: b.replayed } : {}),
+        ...(b.checker !== undefined ? { checker: b.checker } : {}),
+    };
+}
+function claimRow(c) {
+    // A sentence can carry any number of markers; past a few the row says how
+    // many more rather than spending the report on them.
+    const shown = c.bindings.slice(0, ROW_BINDINGS);
+    return {
+        index: c.index,
+        status: c.status,
+        best: c.best,
+        text: clip(c.text, 300),
+        ...(c.line !== undefined ? { line: c.line } : {}),
+        ...(c.definition !== undefined ? { definition: c.definition } : {}),
+        evidence: shown.map(bindingRow),
+        ...(c.bindings.length > shown.length ? { moreEvidence: c.bindings.length - shown.length } : {}),
+    };
+}
+/** Room kept for `"tableOmitted":<n>` after the rows. */
+const OMITTED_KEY_BYTES = 32;
+/**
+ * The preflight's answer, in the order the model should read it: the
+ * verdict and counts, the footer the reader would see, what to do next,
+ * the notes on where the preflight differs from the gate, the gate's own
+ * retry nudge when the draft would not pass cleanly, and then a row per
+ * claim with each binding's verdict — the unmet claims first.
+ *
+ * The whole report fits in {@link REPORT_BYTES}: the runtime shows the model
+ * only the head of a larger result, so the instructions go first — the
+ * notes and the nudge each held to a byte share ({@link NOTES_BYTES},
+ * `NUDGE_BYTES`) — and the table takes the room that is left, row by row; `tableOmitted` counts the
+ * claims it had no room for (the counts above it cover every claim, and the
+ * nudge already names the unmet ones). Excerpts of fetched bodies are left
+ * out on purpose: the model already read those bodies, and the nudge's rule
+ * (no fetched content) is the right one for anything the gate machinery
+ * hands back to the model.
+ */
+export function preflightReport(bundle, notes) {
+    const clean = bundle.verdict === "pass" && bundle.unmet === 0;
+    const head = {
+        verdict: bundle.verdict,
+        level: bundle.level,
+        score: bundle.score,
+        threshold: bundle.threshold,
+        achieved: bundle.achieved,
+        claims: bundle.claimCount,
+        met: bundle.met,
+        unmet: bundle.unmet,
+        assumptions: bundle.assumptions,
+        ...(bundle.assumptionsRefused !== undefined
+            ? { assumptionsRefused: bundle.assumptionsRefused }
+            : {}),
+        ...(bundle.hypotheses !== undefined ? { hypotheses: bundle.hypotheses } : {}),
+        sources: bundle.sources,
+        ...(bundle.vacuous !== undefined ? { vacuous: bundle.vacuous } : {}),
+        footer: renderFooter(bundle),
+        next: clean
+            ? "the gate would accept this draft as it stands; send it without changing the claims or their citations"
+            : bundle.verdict === "pass"
+                ? "the gate would accept this draft, but the claims marked unmet are not backed; fix or drop them if you can"
+                : "the gate would not accept this draft; fix every unmet claim, then run ProvabilityPreflight again before you answer",
+        ...(notes.length > 0 ? { notes: listed(notes, NOTES_BYTES, moreNotes, NOTE_CHARS) } : {}),
+        // The nudge is written for the gate's retry; here the draft is not yet an
+        // answer. Cut in the middle: its head names the verdict and the first
+        // unmet claims, its tail how to cite and to preflight again.
+        ...(clean
+            ? {}
+            : {
+                nudge: fitText(renderNudge(bundle).replace("your last answer", "this draft"), NUDGE_BYTES, clipMiddle),
+            }),
+    };
+    // Unmet claims first, each group in draft order: they are what to fix.
+    const ordered = [
+        ...bundle.claims.filter((c) => c.status === "unmet"),
+        ...bundle.claims.filter((c) => c.status !== "unmet"),
+    ];
+    const rows = [];
+    let used = jsonBytes({ ...head, table: [] }) + OMITTED_KEY_BYTES;
+    for (const claim of ordered.slice(0, TABLE_ROWS)) {
+        const row = claimRow(claim);
+        const cost = jsonBytes(row) + (rows.length > 0 ? 1 : 0);
+        if (used + cost > REPORT_BYTES)
+            break;
+        rows.push(row);
+        used += cost;
+    }
+    return {
+        ...head,
+        table: rows,
+        ...(bundle.claims.length > rows.length
+            ? { tableOmitted: bundle.claims.length - rows.length }
+            : {}),
+    };
+}

package/dist/lib/recheck.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The `proven` rung's re-check (design §6.4; `VerifyOptions.recheckProof`):
+ * the statement and proof a stored artifact holds, checked again by the
+ * builtin checker before the artifact backs a claim.
+ *
+ * An artifact is a file in the workspace. The verifier already requires the
+ * run's own `ProofCheck` call that wrote it, with the input it was given;
+ * this is the second, independent reading: the checker itself, run on what
+ * the file says now. Only the builtin is re-run — it is pure, needs no
+ * sandbox, runs on a worker thread and is bounded by `formal.timeoutMs`. The
+ * sandbox checkers start a container per check, so their artifacts rest on
+ * the logged call alone.
+ *
+ * A re-check that stops without a verdict (cancelled, out of time, the
+ * checker failing) is not a verdict: it returns `undefined`, and the
+ * verifier falls back to the logged call.
+ */
+import { type ProofChecker } from "@crewhaus/proof-checker";
+import type { ProofArtifact, RecheckedProof } from "@crewhaus/provability";
+export type RecheckProofOptions = {
+    /** The check's budget: the spec's `formal.timeoutMs`. */
+    readonly timeoutMs: number;
+    /** The turn's signal: an aborted turn re-checks nothing. */
+    readonly signal?: AbortSignal;
+    /** The builtin checker to run (tests). Default: one shared builtin. */
+    readonly checker?: ProofChecker;
+};
+/** Re-check `artifact` with the builtin checker (see the module doc). */
+export declare function recheckProof(artifact: ProofArtifact, opts: RecheckProofOptions): Promise<RecheckedProof | undefined>;
+/** A `VerifyOptions.recheckProof` over {@link recheckProof} with these options. */
+export declare function proofRecheck(opts: RecheckProofOptions): (artifact: ProofArtifact) => Promise<RecheckedProof | undefined>;

package/dist/lib/recheck.js

@@ -0,0 +1,47 @@
+/**
+ * The `proven` rung's re-check (design §6.4; `VerifyOptions.recheckProof`):
+ * the statement and proof a stored artifact holds, checked again by the
+ * builtin checker before the artifact backs a claim.
+ *
+ * An artifact is a file in the workspace. The verifier already requires the
+ * run's own `ProofCheck` call that wrote it, with the input it was given;
+ * this is the second, independent reading: the checker itself, run on what
+ * the file says now. Only the builtin is re-run — it is pure, needs no
+ * sandbox, runs on a worker thread and is bounded by `formal.timeoutMs`. The
+ * sandbox checkers start a container per check, so their artifacts rest on
+ * the logged call alone.
+ *
+ * A re-check that stops without a verdict (cancelled, out of time, the
+ * checker failing) is not a verdict: it returns `undefined`, and the
+ * verifier falls back to the logged call.
+ */
+import { BUILTIN_CHECKER_ID, createBuiltinChecker, stoppedWithoutVerdict, } from "@crewhaus/proof-checker";
+let shared;
+/** Re-check `artifact` with the builtin checker (see the module doc). */
+export async function recheckProof(artifact, opts) {
+    if (artifact.checker !== BUILTIN_CHECKER_ID)
+        return undefined;
+    // Read afresh each time: the turn may end while the check runs.
+    const aborted = () => opts.signal?.aborted === true;
+    if (aborted())
+        return undefined;
+    shared ??= createBuiltinChecker();
+    const checker = opts.checker ?? shared;
+    const result = await checker.check({
+        claim: artifact.claim,
+        statement: artifact.statement,
+        proof: artifact.proof,
+        timeoutMs: opts.timeoutMs,
+        ...(opts.signal !== undefined ? { signal: opts.signal } : {}),
+    });
+    if (result.ok) {
+        return { ok: true, assumptions: [...result.assumptions], axioms: [...result.axioms] };
+    }
+    if (aborted() || stoppedWithoutVerdict(result))
+        return undefined;
+    return { ok: false };
+}
+/** A `VerifyOptions.recheckProof` over {@link recheckProof} with these options. */
+export function proofRecheck(opts) {
+    return (artifact) => recheckProof(artifact, opts);
+}