@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.138

package/dist/services/code-checks.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { readRunnerEvidence, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations } from "./check-runner-evidence.js";
+import { candidateFailureFiles, checkRepairDisposition, readRunnerEvidence, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations } from "./check-runner-evidence.js";
 export { assertSourceRepairEligible, checkRepairDisposition } from "./check-runner-evidence.js";
 import { isGitlessWorkspace, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
 import { spawn, spawnSync } from "node:child_process";
@@ -15,6 +15,7 @@ import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDela
 import { confirmManagedProcess, finishManagedProcess, renewManagedProcess, managedProcessStatus, managedProcessRuntimeHome, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
 import { admitRuntimeCheck, runtimeBudgetForRun } from "./runtime-budget.js";
 import { getResourceDatabase } from "../storage/database.js";
+import { readBoundedReleaseFile } from "./release-source.js";
 const profileRelativePath = path.join(".memory-bank", "spec", "engineering", "code-check-profile.json");
 // Receipt reservation precedes child spawn so an interrupted CLI leaves an
 // auditable attempt. A second caller must not mistake that small handoff window
@@ -59,7 +60,11 @@ export function terminalCheckSettled(context, record) {
         resource.close?.();
     }
 }
-export function codeExecutionEnvironment(workspaceRoot) {
+export function codeExecutionEnvironment(workspaceRoot, checkEnvironment) {
+    if (checkEnvironment !== undefined && (!checkEnvironment || typeof checkEnvironment !== "object" || Array.isArray(checkEnvironment)
+        || Object.keys(checkEnvironment).length !== 1 || typeof checkEnvironment.CODEX_HOME !== "string"
+        || checkEnvironment.CODEX_HOME.length > 4096 || checkEnvironment.CODEX_HOME.includes("\0") || !path.isAbsolute(checkEnvironment.CODEX_HOME)))
+        throw new AppError("invalid_check_environment", "Owned check environment must name one absolute Codex home", 2, { effect: "no_effect" });
     const suffix = crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex").slice(0, 12);
     // The managed CLI's Node must win over a provider app's PATH: a Rosetta
     // provider can otherwise run x64 checks against arm64-installed modules.
@@ -67,6 +72,8 @@ export function codeExecutionEnvironment(workspaceRoot) {
     delete environment.NODE_PATH;
     for (const key of ["DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH", "DD_FLOW_CHECK_RUNNER_PROGRESS_PATH", "DD_FLOW_CHECK_INVOCATION_ID", "DD_FLOW_CHECK_ID", "DD_FLOW_CHECK_INPUT_HASH", "DD_FLOW_CHECK_VERIFICATION_EPOCH", "DD_FLOW_CHECK_COMMAND"])
         delete environment[key];
+    if (checkEnvironment)
+        environment.CODEX_HOME = checkEnvironment.CODEX_HOME;
     return environment;
 }
 export function workspaceOperationId(workspaceRoot) { return `workspace:${crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex")}`; }
@@ -172,6 +179,10 @@ export function resolveCodeCheckCommands(workspaceRoot, runId, commands) {
 }
 export function projectPolicyCheckDeclarations(workspaceRoot, gate) {
     const { profile } = readCodeCheckProfile(workspaceRoot);
+    return projectPolicyCheckDeclarationsFromProfile(profile, gate);
+}
+/** The caller may already have independently admitted exact profile bytes. */
+export function projectPolicyCheckDeclarationsFromProfile(profile, gate) {
     return (profile?.mandatory_by_gate[gate] ?? []).map((alias) => { const ref = `POLICY/${gate}/${alias.slice(7).replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "").toLowerCase()}`; return { id: ref, canonical_ref: ref, source: "project_policy", command: alias, purpose: `Mandatory project ${gate} gate.`, run_at: gate, availability: "available", ...(profile?.ports_by_alias?.[alias] ? { ports: profile.ports_by_alias[alias] } : {}), ...(profile?.inputs_by_alias?.[alias] ? { inputs: profile.inputs_by_alias[alias] } : {}) }; });
 }
 export function effectiveCheckDeclarations(workspaceRoot, declared, gates) { return gates.flatMap((gate) => [...declared.filter((check) => check.run_at === gate), ...projectPolicyCheckDeclarations(workspaceRoot, gate)]); }
@@ -182,6 +193,8 @@ export function validateCheckPlacement(workspaceRoot, checks) { const { profile
     if (check.run_at === "work" && aggregateCommands.has(check.command))
         throw new AppError("aggregate_check_requires_code_gate", "A project aggregate check must run at CODE or readiness, not inside one scoped Work", 2, { check_id: check.id, command: check.command, run_at: check.run_at }); }
 export function validateCheckDeclaration(workspaceRoot, check) {
+    if ((check.required_artifacts ?? []).some(file => path.posix.normalize(file.replaceAll("\\", "/")).split("/")[0] === "engine-outcome.json"))
+        throw new AppError("invalid_code_check_profile", "engine-outcome.json is reserved for engine execution evidence, not a candidate artifact", 2, { check_id: check.id });
     if (!["work", "code", "readiness", "merge", "release"].includes(check.run_at))
         throw new AppError("unsupported_check_gate", "Check requires an autonomous executable gate; replan the incompatible declaration", 2, { check_id: check.id, run_at: check.run_at });
     if (check.runner_evidence !== undefined && !runnerContractsValid({ "@check/declaration": check.runner_evidence }))
@@ -256,7 +269,216 @@ function assertDirectCheckExecutable(workspaceRoot, command, checkId) {
     if (probe.status !== 0)
         throw new AppError("check_command_unavailable", "Available CODE check names an executable that is unavailable in this environment", 2, { check_id: checkId, command, executable: program });
 }
+// An owning handler supplies this identity; it is a reuse boundary, not an
+// authority proof. Omitting it preserves the historical SDLC input hash.
+function validateCheckEvidenceContext(value) {
+    if (value !== undefined && (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,255}$/.test(value)))
+        throw new AppError("check_evidence_context_invalid", "Check evidence context must be a bounded opaque identifier", 2, { effect: "no_effect" });
+}
+const evidenceDigest = (value) => crypto.createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** Prepares current physical evidence outside a writer and retains an exact
+ * SQL-only fence. Declarations must come from the owning handler/policy, never
+ * from the result whose acceptance is being decided. This does not supply
+ * semantic acceptance or choose a memory verification policy.
+ */
+export class PreparedCheckEvidence {
+    #input;
+    #snapshot;
+    #generation;
+    #references;
+    #artifacts;
+    #completions = [];
+    #passed;
+    constructor(input, snapshot, generation, references, artifacts, passed) {
+        this.#input = structuredClone({ projectId: input.projectId, runId: input.runId, runHome: input.runHome, workspaceRoot: input.workspaceRoot, scope: input.scope, checks: input.checks,
+            ...(input.mode === undefined ? {} : { mode: input.mode }), ...(input.workId === undefined ? {} : { workId: input.workId }), ...(input.expectedProfileHash === undefined ? {} : { expectedProfileHash: input.expectedProfileHash }), ...(input.evidenceContext === undefined ? {} : { evidenceContext: input.evidenceContext }), ...(input.checkEnvironment === undefined ? {} : { checkEnvironment: input.checkEnvironment }) });
+        this.#snapshot = snapshot;
+        this.#generation = generation;
+        this.#references = references;
+        this.#artifacts = artifacts;
+        this.#passed = passed;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        validateCheckEvidenceContext(input.evidenceContext);
+        const fail = () => { throw new AppError("check_evidence_stale", "Current declared checks lack owned passed evidence", 2, { effect: "no_effect" }); };
+        if (!input.checks.length || (input.scope === "work") !== Boolean(input.workId) || input.mode !== undefined && input.mode !== "diagnostic")
+            fail();
+        const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
+        const snapshot = checkEvidenceSqlSnapshot(context, input);
+        const selected = JSON.parse(snapshot);
+        if (!selected.run || fs.realpathSync.native(selected.run.workspace_root) !== fs.realpathSync.native(input.workspaceRoot)
+            || fs.realpathSync.native(selected.run.run_root ?? selected.run.run_dir) !== fs.realpathSync.native(input.runHome))
+            fail();
+        const rows = selected.receipts;
+        const root = fs.realpathSync.native(input.runHome);
+        for (const row of rows) {
+            const relative = path.relative(path.resolve(input.runHome), row.receipt_path);
+            if (!path.isAbsolute(row.receipt_path) || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative))
+                fail();
+            if (fs.existsSync(row.receipt_path)) {
+                const physical = path.relative(root, fs.realpathSync.native(row.receipt_path));
+                if (physical.startsWith(`..${path.sep}`) || physical === ".." || path.isAbsolute(physical))
+                    fail();
+            }
+        }
+        for (const check of input.checks)
+            validateCheckDeclaration(input.workspaceRoot, check);
+        const { profile } = readCodeCheckProfile(input.workspaceRoot), profileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
+        if (input.expectedProfileHash !== undefined && profileHash !== input.expectedProfileHash)
+            fail();
+        const checks = input.checks.map(check => {
+            const runner = profile?.runner_evidence_by_alias?.[check.command] ?? check.runner_evidence;
+            return { ...check, ports: check.ports ?? profile?.ports_by_alias?.[check.command] ?? [], inputs: check.inputs ?? profile?.inputs_by_alias?.[check.command] ?? [],
+                ...(runner ? { runner_evidence: runner, required_artifacts: [...new Set([...(check.required_artifacts ?? []), runner.path])] } : {}) };
+        });
+        const commands = resolveCodeCheckCommands(input.workspaceRoot, input.runId, checks.map(check => check.command));
+        assertConsistentDeclarations(checks, commands);
+        const state = workspaceState(input.workspaceRoot, [input.runHome]);
+        const receipts = rows.map(projectCheckReceiptRow);
+        const artifacts = [], completions = [];
+        let passed = true;
+        const references = deduplicate(checks, commands).map(group => {
+            const inputHash = checkInputHash(input.workspaceRoot, group, profileHash, workspaceInputFingerprint(input.workspaceRoot, state.files, group.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment);
+            const receipt = receipts.filter(item => item.input_hash === inputHash && item.profile_hash === profileHash && item.scope === input.scope && item.work_id === (input.workId ?? null)).at(-1);
+            if (!receipt || !checkReceiptEvidenceValidForMode(bindReceipt(receipt, group), input.mode))
+                fail();
+            passed = passed && receipt.status === "passed";
+            for (const artifact of receipt.artifacts)
+                artifacts.push({ root: "run", path: path.relative(input.runHome, path.join(path.dirname(receipt.receipt_path), "artifacts", artifact.path)).split(path.sep).join("/"), sha256: artifact.sha256 });
+            const bytes = fs.readFileSync(receipt.receipt_path);
+            completions.push({ root: "run", path: path.relative(input.runHome, receipt.completion_path).split(path.sep).join("/"), sha256: crypto.createHash("sha256").update(fs.readFileSync(receipt.completion_path)).digest("hex") });
+            return { id: receipt.id, path: receipt.receipt_path, sha256: crypto.createHash("sha256").update(bytes).digest("hex") };
+        });
+        const prepared = new PreparedCheckEvidence(input, snapshot, generation, references, artifacts, passed);
+        prepared.#completions = completions;
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    references() { return structuredClone(this.#references); }
+    artifactReferences() { return structuredClone(this.#artifacts); }
+    sourceReferences() { return [...this.artifactReferences(), ...structuredClone(this.#completions), ...this.resultReferences().map(reference => ({ root: "run", ...reference }))]; }
+    qualityPassed() { return this.#passed; }
+    resultReferences() {
+        return this.#references.map(reference => ({ path: path.relative(this.#input.runHome, reference.path).split(path.sep).join("/"), sha256: reference.sha256 }));
+    }
+    /** For an owning acceptance writer to retain independently of agent bytes.
+     * The row digest pins historical execution, not later workspace policy.
+     */
+    retainedReferences(context) {
+        return context.db.readSnapshot(() => {
+            this.assertCustody(context);
+            return this.#references.map(reference => ({ id: reference.id, path: path.relative(this.#input.runHome, reference.path).split(path.sep).join("/"), sha256: reference.sha256,
+                sql_sha256: evidenceDigest(context.db.get("SELECT * FROM check_receipts WHERE project_id=? AND run_id=? AND id=?", [this.#input.projectId, this.#input.runId, reference.id])) }));
+        });
+    }
+    assertOwner(scope) {
+        if (scope.projectId !== this.#input.projectId || scope.runId !== this.#input.runId || scope.scope !== undefined && scope.scope !== this.#input.scope)
+            throw new AppError("check_receipt_changed", "Prepared checks belong to another RUN or scope", 2, { effect: "no_effect" });
+    }
+    assertCustody(context) {
+        assertRunMutationAllowed(context, this.#input.projectId, this.#input.runId, this.#generation);
+        if (checkEvidenceSqlSnapshot(context, this.#input) !== this.#snapshot)
+            throw new AppError("check_receipt_changed", "Prepared check SQL custody changed", 2, { effect: "no_effect" });
+    }
+    revalidate(context) {
+        const current = PreparedCheckEvidence.prepare(context, this.#input);
+        if (!isDeepStrictEqual(current.sourceReferences(), this.sourceReferences()) || !isDeepStrictEqual(current.#references, this.#references) || current.#snapshot !== this.#snapshot)
+            throw new AppError("check_evidence_stale", "Prepared check evidence changed", 2, { effect: "no_effect" });
+        this.assertCustody(context);
+    }
+}
+/** Historical aggregate execution proof. Selectors must come from an owning
+ * committed acceptance receipt, not a proposed result. This reader does not
+ * select current declarations, inspect the current workspace or execute checks.
+ * Relocation of SQL path fields still requires explicit receipt projection.
+ */
+export class PreparedRetainedCheckEvidence {
+    #input;
+    #snapshot;
+    #generation;
+    constructor(input, snapshot, generation) {
+        this.#input = structuredClone(input);
+        this.#snapshot = snapshot;
+        this.#generation = generation;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        const fail = () => { throw new AppError("retained_check_evidence_invalid", "Accepted checks lack exact historical execution proof", 2, { effect: "no_effect" }); };
+        if (!Array.isArray(input.references) || !input.references.length || input.references.length > 4096
+            || new Set(input.references.map(reference => reference?.id)).size !== input.references.length
+            || input.references.some(reference => !reference || typeof reference.id !== "string" || !reference.id
+                || typeof reference.path !== "string" || !/^[a-f0-9]{64}$/.test(reference.sha256) || !/^[a-f0-9]{64}$/.test(reference.sql_sha256)))
+            fail();
+        const generation = assertRunMutationAllowed(context, input.projectId, input.runId), snapshot = retainedCheckSqlSnapshot(context, input);
+        const selected = JSON.parse(snapshot);
+        if (!selected.run || selected.receipts.some(row => !row))
+            fail();
+        const runRoot = selected.run.run_root ?? selected.run.run_dir;
+        if (!path.isAbsolute(runRoot) || fs.realpathSync.native(runRoot) !== path.resolve(runRoot))
+            fail();
+        for (let index = 0; index < input.references.length; index++) {
+            const reference = input.references[index], row = selected.receipts[index];
+            if (row.scope !== "aggregate" || row.work_id !== null || evidenceDigest(row) !== reference.sql_sha256
+                || row.receipt_path !== path.join(runRoot, reference.path))
+                fail();
+            // Admit contained regular receipt/completion files before any helper
+            // reads them; escaping paths and symlink parents are rejected.
+            const bytes = readRetainedCheckFile(runRoot, reference.path);
+            readRetainedCheckFile(runRoot, path.posix.join(path.posix.dirname(reference.path), "completion.json"));
+            if (crypto.createHash("sha256").update(bytes).digest("hex") !== reference.sha256 || !checkReceiptEvidenceValidForMode(projectCheckReceiptRow(row), input.mode))
+                fail();
+        }
+        const prepared = new PreparedRetainedCheckEvidence(input, snapshot, generation);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    assertCustody(context) {
+        assertRunMutationAllowed(context, this.#input.projectId, this.#input.runId, this.#generation);
+        if (retainedCheckSqlSnapshot(context, this.#input) !== this.#snapshot)
+            throw new AppError("retained_check_evidence_invalid", "Accepted check SQL custody changed", 2, { effect: "no_effect" });
+    }
+    revalidate(context) {
+        const current = PreparedRetainedCheckEvidence.prepare(context, this.#input);
+        if (current.#snapshot !== this.#snapshot)
+            throw new AppError("retained_check_evidence_invalid", "Accepted check proof changed", 2, { effect: "no_effect" });
+        this.assertCustody(context);
+    }
+}
+function readRetainedCheckFile(root, relative) {
+    const fail = () => { throw new AppError("retained_check_evidence_invalid", "Accepted check file is not a contained regular file", 2, { effect: "no_effect" }); };
+    if (!relative || path.posix.isAbsolute(relative) || path.win32.isAbsolute(relative) || relative.includes("\\") || relative.includes("\0")
+        || relative.split("/").some(segment => !segment || segment === "." || segment === ".."))
+        fail();
+    try {
+        let parent = root;
+        if (!fs.lstatSync(parent).isDirectory())
+            fail();
+        for (const segment of relative.split("/").slice(0, -1)) {
+            parent = path.join(parent, segment);
+            if (!fs.lstatSync(parent).isDirectory())
+                fail();
+        }
+        return readBoundedReleaseFile(path.join(root, relative), 16 * 1024 * 1024);
+    }
+    catch {
+        return fail();
+    }
+}
+function retainedCheckSqlSnapshot(context, input) {
+    return context.db.readSnapshot(() => JSON.stringify({
+        run: context.db.get("SELECT project_id,id,workspace_root,run_root,run_dir FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]) ?? null,
+        receipts: input.references.map(reference => context.db.get("SELECT * FROM check_receipts WHERE project_id=? AND run_id=? AND id=?", [input.projectId, input.runId, reference.id]) ?? null)
+    }));
+}
+function checkEvidenceSqlSnapshot(context, input) {
+    return context.db.readSnapshot(() => JSON.stringify({
+        run: context.db.get("SELECT project_id,id,workspace_root,run_root,run_dir FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]),
+        receipts: context.db.all("SELECT * FROM check_receipts WHERE project_id=? AND run_id=? ORDER BY reservation_sequence,rowid", [input.projectId, input.runId])
+    }));
+}
 export async function runCodeChecks(context, input) {
+    validateCheckEvidenceContext(input.evidenceContext);
     const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
     let gate;
     for (;;) {
@@ -305,7 +527,8 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
         const predecessor = validateFailedCheckRetry(context, { projectId: input.projectId, runId: input.runId, receiptId, declarations: checks, reason: input.retryReason });
         const snapshot = workspaceState(input.workspaceRoot, [input.runHome]);
         const group = groups.find(candidate => candidate.declarations.some(check => check.run_at === predecessor.gate)
-            && checkInputHash(input.workspaceRoot, { ...candidate, gate: predecessor.gate }, profileHash, workspaceInputFingerprint(input.workspaceRoot, snapshot.files, candidate.inputs, [input.runHome])) === predecessor.input_hash);
+            && (checkInputHash(input.workspaceRoot, { ...candidate, gate: predecessor.gate }, profileHash, workspaceInputFingerprint(input.workspaceRoot, snapshot.files, candidate.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment) === predecessor.input_hash
+                || sourceRepairContractMatches(predecessor, candidate, profileHash)));
         if (!group || retries.has(group))
             throw new AppError("retry_check_invalid", "Retry must match exactly one current execution contract", 2, { check_receipt_id: receiptId });
         // Preserve the identity of a pre-deduplication failed execution when an
@@ -318,7 +541,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
         const before = workspaceState(input.workspaceRoot, [input.runHome]);
         const startedAt = context.now();
         const inputFingerprint = workspaceInputFingerprint(input.workspaceRoot, before.files, group.inputs, [input.runHome]);
-        const inputHash = checkInputHash(input.workspaceRoot, group, profileHash, inputFingerprint);
+        const inputHash = checkInputHash(input.workspaceRoot, group, profileHash, inputFingerprint, input.evidenceContext, input.checkEnvironment);
         const epoch = crypto.createHash("sha256").update(`${group.gate}\0${before.fingerprint}`).digest("hex");
         const reservationInput = { ...input, retryReceiptIds: retries.has(group) ? [retries.get(group)] : [], generation, group, before, profileHash, inputHash, epoch, startedAt };
         delete reservationInput.retryReceiptId;
@@ -363,7 +586,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
                 const runnerEnvironment = group.runnerEvidence ? { DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH: path.join(evidenceDir, group.runnerEvidence.path), DD_FLOW_CHECK_RUNNER_PROGRESS_PATH: path.join(evidenceDir, "runner-progress.jsonl"), DD_FLOW_CHECK_INVOCATION_ID: id, DD_FLOW_CHECK_ID: id, DD_FLOW_CHECK_INPUT_HASH: inputHash, DD_FLOW_CHECK_VERIFICATION_EPOCH: epoch } : {};
                 if (group.runnerEvidence)
                     fs.mkdirSync(path.dirname(path.join(evidenceDir, group.runnerEvidence.path)), { recursive: true });
-                result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...runnerEnvironment, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => {
+                result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot, input.checkEnvironment), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...runnerEnvironment, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => {
                     confirmedExpiry = confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }).lease_expires_at;
                     assertRunMutationAllowed(context, input.projectId, input.runId, generation);
                     if (budget)
@@ -388,7 +611,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
         }
         const after = workspaceState(input.workspaceRoot, [input.runHome]);
         const mutationPaths = changedPaths(before.files, after.files);
-        const artifacts = collectCheckArtifacts(evidenceDir, group.requiredArtifacts);
+        let artifacts = collectCheckArtifacts(evidenceDir, group.requiredArtifacts);
         if (fs.existsSync(stderrPath)) {
             if (!artifacts.complete)
                 fs.appendFileSync(stderrPath, `\nmissing required evidence artifacts: ${artifacts.missing.join(", ")}\n`);
@@ -398,14 +621,26 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
                 fs.appendFileSync(stderrPath, `\ncheck mutated project workspace: ${mutationPaths.join(", ")}\n`);
         }
         const runnerEvidence = group.runnerEvidence ? readRunnerEvidence(evidenceDir, group.runnerEvidence, { invocation_id: id, check_id: id, command: group.command, input_hash: inputHash, verification_epoch: epoch }) : undefined;
+        const physicalFailures = executionFailures({ exitCode: result.exitCode, launcherError: result.error ?? undefined, cleanupUnconfirmed: result.cleanupUnconfirmed, missing: artifacts.missing, mutations: mutationPaths, invalidRunner: Boolean(group.runnerEvidence && !runnerEvidence) });
+        const candidateFiles = candidateFailureFiles(runnerEvidence, input.workspaceRoot);
+        if (group.runnerEvidence)
+            retainExecutionOutcome(evidenceDir, { id, command: group.command, input_hash: inputHash, verification_epoch: epoch }, input.workspaceRoot, physicalFailures, candidateFiles);
+        const requiredArtifacts = [...new Set([...group.requiredArtifacts, ...(group.runnerEvidence ? ["engine-outcome.json"] : [])])];
+        artifacts = collectCheckArtifacts(evidenceDir, requiredArtifacts);
         const status = result.aborted ? "aborted" : result.exitCode === 0 && !result.error && artifacts.complete && mutationPaths.length === 0 && (!group.runnerEvidence || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         const receipt = receiptFor({ ...reserved, resources, result, status, after, mutationPaths, artifacts: artifacts.items });
+        receipt.required_artifacts = requiredArtifacts;
+        receipt.candidate_root = input.workspaceRoot;
+        receipt.candidate_files = candidateFiles;
+        receipt.execution_failures = physicalFailures;
         if (group.runnerEvidence) {
             receipt.runner_evidence_required = group.runnerEvidence;
             receipt.runner_evidence = runnerEvidence ?? null;
         }
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [receipt.status, receipt.exit_code, receipt.after_fingerprint, JSON.stringify(receipt.mutation_paths), JSON.stringify(receipt.artifacts), receipt.finished_at, id, input.projectId]);
         writeReceipt(receiptPath, receipt);
+        if (status === "failed")
+            receipt.diagnostic_evidence_valid = checkReceiptEvidenceValidForMode(receipt, "diagnostic");
         receipts.push(receipt);
         input.progress?.(`check ${index + 1}/${groups.length} ${status}: ${group.command}`);
     }
@@ -413,7 +648,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
         const current = workspaceState(input.workspaceRoot, [input.runHome]), currentProfileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
         for (const receipt of receipts) {
             const group = groups.find(candidate => candidate.declarations.some(check => receipt.check_refs.includes(checkRef(check))));
-            const currentHash = group ? checkInputHash(input.workspaceRoot, group, currentProfileHash, workspaceInputFingerprint(input.workspaceRoot, current.files, group.inputs, [input.runHome])) : null;
+            const currentHash = group ? checkInputHash(input.workspaceRoot, group, currentProfileHash, workspaceInputFingerprint(input.workspaceRoot, current.files, group.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment) : null;
             if (!group || !checkReceiptEvidenceValid(receipt) || receipt.input_hash !== currentHash)
                 throw new AppError("check_evidence_stale", "Check evidence changed before the gate could be accepted", 1, { check_receipt_id: receipt.id });
         }
@@ -456,18 +691,44 @@ export function reconcileUnfinishedChecks(context, input) {
             throw new AppError("check_in_progress", "A previous check invocation is still initializing", 1, { check_receipt_id: pendingReceipt.id, initializing: true });
         }
         const after = workspaceState(input.workspaceRoot, input.runHome ? [input.runHome] : []);
-        const artifacts = receipt ? collectCheckArtifacts(path.join(path.dirname(receipt.completion_path || pendingReceipt.receipt_path), "artifacts"), receipt.required_artifacts ?? []) : { complete: false, missing: [], items: [] };
+        let artifacts = receipt ? collectCheckArtifacts(path.join(path.dirname(receipt.completion_path || pendingReceipt.receipt_path), "artifacts"), receipt.required_artifacts ?? []) : { complete: false, missing: [], items: [] };
         const workspaceUnchanged = receipt?.before_fingerprint === after.fingerprint;
         const runnerEvidence = receipt?.runner_evidence_required ? readRunnerEvidence(path.join(path.dirname(pendingReceipt.receipt_path), "artifacts"), receipt.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch }) : undefined;
-        const status = completion === null ? "aborted" : completion.exit_code === 0 && workspaceUnchanged && artifacts.complete && (!receipt?.runner_evidence_required || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         const exitCode = completion?.exit_code ?? null;
         const finishedAt = completion?.finished_at ?? context.now();
+        const physicalFailures = executionFailures({ exitCode, missing: artifacts.missing.filter(file => file !== "engine-outcome.json"), mutations: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], invalidRunner: Boolean(receipt?.runner_evidence_required && !runnerEvidence) });
+        let candidateFiles = candidateFailureFiles(runnerEvidence, input.workspaceRoot);
+        if (receipt?.runner_evidence_required) {
+            const evidenceDir = path.join(path.dirname(pendingReceipt.receipt_path), "artifacts");
+            if (fs.existsSync(path.join(evidenceDir, "engine-outcome.json"))) {
+                // A completed live writer's bound proof is already authoritative. Never erase its blockers during reconciliation.
+                const retained = context.db.get("SELECT artifacts_json FROM check_receipts WHERE id = ?", [pendingReceipt.id]);
+                const proven = resolvedReceiptArtifacts(pendingReceipt.receipt_path, retained ? JSON.parse(retained.artifacts_json) : [], receipt);
+                if (proven.candidate_root) {
+                    physicalFailures.push(...(proven.execution_failures ?? []));
+                    candidateFiles = proven.candidate_files ?? candidateFiles;
+                }
+                else {
+                    physicalFailures.push({ code: "engine_outcome_unbound", message: "Existing execution outcome is not bound to retained inventory; prior launcher/cleanup outcome is unknown" });
+                    fs.renameSync(path.join(evidenceDir, "engine-outcome.json"), path.join(evidenceDir, `engine-outcome-unconfirmed-${crypto.randomUUID()}.json`));
+                }
+            }
+            retainExecutionOutcome(evidenceDir, receipt, input.workspaceRoot, physicalFailures, candidateFiles);
+            receipt.required_artifacts = [...new Set([...(receipt.required_artifacts ?? []), "engine-outcome.json"])];
+            artifacts = collectCheckArtifacts(evidenceDir, receipt.required_artifacts);
+        }
+        const status = completion === null ? "aborted" : completion.exit_code === 0 && workspaceUnchanged && artifacts.complete && physicalFailures.length === 0 && (!receipt?.runner_evidence_required || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [status, exitCode, after.fingerprint, JSON.stringify(workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"]), JSON.stringify(artifacts.items), finishedAt, pendingReceipt.id, input.projectId]);
         if (process)
             finishManagedProcess(context, { id: process.id, leaseToken: process.lease_token, state: status === "passed" ? "stopped" : "failed", reason: status === "passed" ? "reconciled_completion" : completion === null ? "completion_marker_missing" : "reconciled_check_failed" });
         if (receipt) {
             const repaired = { ...receipt, ...(receipt.runner_evidence_required ? { runner_evidence: runnerEvidence ?? null } : {}), completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], ...(status === "aborted" ? { abort_reason: "completion_marker_missing" } : {}), status, exit_code: exitCode, after_fingerprint: after.fingerprint, mutation_paths: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], artifacts: artifacts.items, finished_at: finishedAt };
+            repaired.candidate_root = input.workspaceRoot;
+            repaired.candidate_files = candidateFiles;
+            repaired.execution_failures = physicalFailures;
             writeReceipt(pendingReceipt.receipt_path, repaired);
+            if (status === "failed")
+                repaired.diagnostic_evidence_valid = checkReceiptEvidenceValidForMode(repaired, "diagnostic");
             reconciled.push(repaired);
         }
     }
@@ -486,6 +747,9 @@ function reserveOrReuseReceipt(context, input) {
     const retryIds = new Set([...(input.retryReceiptId ? [input.retryReceiptId] : []), ...(input.retryReceiptIds ?? [])]);
     const successor = retryIds.size === 1 ? receipts.find((receipt) => receipt.retry_of_receipt_id === [...retryIds][0] && receipt.input_hash === input.inputHash && receipt.profile_hash === input.profileHash) : null;
     const reusableSuccessor = successor?.status === "passed" && checkReceiptEvidenceValid(successor);
+    const retryPredecessor = receipts.find(receipt => retryIds.has(receipt.id));
+    const sourceCorrection = Boolean(retryPredecessor && sourceRepairContractMatches(retryPredecessor, input.group, input.profileHash));
+    const latestContract = receipts.filter(receipt => receipt.command === input.group.command && receipt.profile_hash === input.profileHash && receipt.gate === input.group.gate && receipt.scope === input.scope && receipt.work_id === (input.workId ?? null)).at(-1);
     return context.db.writeTransaction(() => {
         assertRunMutationAllowed(context, input.projectId, input.runId, input.generation);
         if (JSON.stringify(context.db.all(snapshotSql, [input.projectId, input.runId])) !== snapshot)
@@ -499,9 +763,9 @@ function reserveOrReuseReceipt(context, input) {
             if (!input.retryReason?.trim())
                 throw new AppError("retry_check_invalid", "A check retry requires the restored-condition reason", 2, { check_receipt_id: retryId });
             const predecessor = receipts.find(receipt => receipt.id === retryId);
-            if (!predecessor || !["failed", "aborted"].includes(predecessor.status) || predecessor.input_hash !== input.inputHash || predecessor.profile_hash !== input.profileHash || predecessor.command !== input.group.command || predecessor.gate !== input.group.gate)
+            if (!predecessor || !["failed", "aborted"].includes(predecessor.status) || predecessor.input_hash !== input.inputHash && !sourceCorrection || predecessor.profile_hash !== input.profileHash || predecessor.command !== input.group.command || predecessor.gate !== input.group.gate)
                 throw new AppError("retry_check_invalid", "Retry predecessor does not match this exact check contract", 2, { check_receipt_id: retryId });
-            if (prior?.id !== (successor?.id ?? predecessor.id))
+            if ((sourceCorrection ? latestContract?.id : prior?.id) !== (successor?.id ?? predecessor.id))
                 throw new AppError("retry_check_invalid", "This retry was superseded by a newer check outcome; inspect the latest receipt", 2, { check_receipt_id: retryId, latest_check_receipt_id: prior?.id ?? null, latest_status: prior?.status ?? null });
             if (successor?.status === "running")
                 throw new AppError("check_in_progress", "The requested retry is already running", 1, { check_receipt_id: successor.id, retry_of_receipt_id: retryId });
@@ -530,6 +794,10 @@ function reserveOrReuseReceipt(context, input) {
         return { reserved };
     }, "checks.reserveOrReuseReceipt");
 }
+function sourceRepairContractMatches(receipt, group, profileHash) {
+    return checkRepairDisposition(receipt) === "source_repair" && group.command === receipt.command && profileHash === receipt.profile_hash && isDeepStrictEqual(group.inputs, receipt.inputs)
+        && isDeepStrictEqual([...group.requiredArtifacts].sort(), receipt.required_artifacts.filter(file => file !== "engine-outcome.json").sort()) && isDeepStrictEqual([...group.ports].sort(), Object.keys(receipt.resources.ports).sort());
+}
 function receiptFor(input) { return { id: input.id, local_id: input.localId, declaration_id: input.group.declarations[0].id, check_refs: input.group.declarations.map(checkRef), gate: input.group.gate, scope: input.scope, work_id: input.workId ?? null, command: input.group.command, input_hash: input.inputHash, verification_epoch: input.epoch, retry_of_receipt_id: input.retryOf ?? null, retry_reason: input.retryReason ?? null, status: input.status, ...(input.status === "aborted" ? { abort_reason: input.result.error } : {}), exit_code: input.status === "running" ? null : input.result.exitCode, stdout_path: input.stdoutPath, stderr_path: input.stderrPath, receipt_path: input.receiptPath, completion_path: input.completionPath, required_artifacts: input.group.requiredArtifacts, inputs: input.group.inputs, workspace_fingerprint: input.before.fingerprint, before_fingerprint: input.before.fingerprint, after_fingerprint: input.after.fingerprint, profile_hash: input.profileHash, mutation_paths: input.mutationPaths, artifacts: input.artifacts, resources: { ports: input.resources }, started_at: input.startedAt, finished_at: input.status === "running" ? input.startedAt : new Date().toISOString() }; }
 function writeReceipt(file, receipt) { const temporary = `${file}.tmp-${process.pid}-${crypto.randomUUID()}`; fs.writeFileSync(temporary, `${JSON.stringify(receipt, null, 2)}\n`); fs.renameSync(temporary, file); }
 function readReceipt(file) { try {
@@ -561,17 +829,25 @@ export function validateFailedCheckRetry(context, input) {
 export function checkReceipts(context, input) {
     const where = input.workId ? "project_id = ? AND run_id = ? AND work_id = ?" : "project_id = ? AND run_id = ?";
     const params = input.workId ? [input.projectId, input.runId, input.workId] : [input.projectId, input.runId];
-    return context.db.all(`SELECT id, declaration_id, check_refs_json, gate, scope, work_id, command, input_hash, verification_epoch, retry_of_receipt_id, retry_reason, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY reservation_sequence, rowid`, params).map((row) => ({ ...row, local_id: row.id.slice(row.id.lastIndexOf("/") + 1), check_refs: parseArray(row.check_refs_json, [row.declaration_id]), mutation_paths: parseArray(row.mutation_paths_json, []), resources: readReceiptResources(row.receipt_path), ...resolvedReceiptArtifacts(row.receipt_path, JSON.parse(row.artifacts_json), row) }));
+    return context.db.all(`SELECT id, declaration_id, check_refs_json, gate, scope, work_id, command, input_hash, verification_epoch, retry_of_receipt_id, retry_reason, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY reservation_sequence, rowid`, params).map(projectCheckReceiptRow);
+}
+function projectCheckReceiptRow(row) {
+    const receipt = { ...row, local_id: row.id.slice(row.id.lastIndexOf("/") + 1), check_refs: parseArray(row.check_refs_json, [row.declaration_id]), mutation_paths: parseArray(row.mutation_paths_json, []), resources: readReceiptResources(row.receipt_path), ...resolvedReceiptArtifacts(row.receipt_path, JSON.parse(row.artifacts_json), row) };
+    if (receipt.status === "failed")
+        receipt.diagnostic_evidence_valid = checkReceiptEvidenceValidForMode(receipt, "diagnostic");
+    return receipt;
 }
 /** File bytes remain immutable; only the reader projects their current location. */
 function resolvedReceiptArtifacts(receiptPath, artifacts, binding) {
     let original = {};
     try {
-        original = JSON.parse(fs.readFileSync(receiptPath, "utf8"));
+        const value = JSON.parse(fs.readFileSync(receiptPath, "utf8"));
+        if (value && typeof value === "object" && !Array.isArray(value))
+            original = value;
     }
     catch { /* Historical missing receipts remain visibly incomplete. */ }
     const currentRoot = path.dirname(receiptPath);
-    const oldRoot = original.receipt_path ? path.dirname(original.receipt_path) : currentRoot;
+    const oldRoot = typeof original.receipt_path === "string" ? path.dirname(original.receipt_path) : currentRoot;
     const relocate = (file) => {
         const relative = path.relative(oldRoot, file);
         return !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`) ? path.join(currentRoot, relative) : file;
@@ -580,10 +856,44 @@ function resolvedReceiptArtifacts(receiptPath, artifacts, binding) {
     if (original.runner_evidence_required && original.id && original.command && original.input_hash && original.verification_epoch) {
         const root = path.join(currentRoot, "artifacts");
         const retained = collectCheckArtifacts(root, [original.runner_evidence_required.path]);
-        if (retained.complete && JSON.stringify(retained.items) === JSON.stringify(artifacts))
+        if (retained.complete && retained.items.every(item => artifacts.some(artifact => relocate(artifact.path) === item.path && artifact.sha256 === item.sha256)))
             evidence = readRunnerEvidence(root, original.runner_evidence_required, { invocation_id: binding.id, check_id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch });
     }
-    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })), ...(original.runner_evidence_required ? { runner_evidence_required: original.runner_evidence_required, runner_evidence: evidence } : {}) };
+    let outcome = {};
+    const outcomePath = path.join(currentRoot, "artifacts", "engine-outcome.json");
+    const retainedOutcome = collectCheckArtifacts(path.join(currentRoot, "artifacts"), ["engine-outcome.json"]);
+    if (retainedOutcome.complete && retainedOutcome.items.every(item => artifacts.some(artifact => relocate(artifact.path) === item.path && artifact.sha256 === item.sha256))) {
+        try {
+            const value = JSON.parse(fs.readFileSync(outcomePath, "utf8"));
+            if (value.schema_id === "dd-flow/check-execution-outcome@1" && value.id === binding.id && value.command === binding.command && value.input_hash === binding.input_hash && value.verification_epoch === binding.verification_epoch && typeof value.candidate_root === "string" && path.isAbsolute(value.candidate_root) && (value.candidate_files === undefined || Array.isArray(value.candidate_files) && value.candidate_files.length <= 64 && value.candidate_files.every((file) => typeof file === "string" && path.isAbsolute(file) && Buffer.byteLength(file) <= 4096)) && Array.isArray(value.execution_failures) && value.execution_failures.every((failure) => failure && typeof failure === "object" && typeof failure.code === "string" && typeof failure.message === "string"))
+                outcome = value;
+        }
+        catch { /* Missing physical proof cannot grant attribution. */ }
+    }
+    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })), ...(original.runner_evidence_required ? { runner_evidence_required: original.runner_evidence_required, runner_evidence: evidence } : {}), execution_failures: outcome.execution_failures ?? [], ...(outcome.candidate_root ? { candidate_root: outcome.candidate_root } : {}), ...(outcome.candidate_files ? { candidate_files: outcome.candidate_files } : {}) };
+}
+function executionFailures(input) {
+    const failures = [];
+    if (input.exitCode === null)
+        failures.push({ code: "completion_unknown", message: "Check completion is unknown" });
+    if (input.launcherError)
+        failures.push({ code: "launcher_error", message: input.launcherError });
+    if (input.cleanupUnconfirmed)
+        failures.push({ code: "cleanup_unconfirmed", message: "Check process cleanup is not confirmed" });
+    if (input.missing.length)
+        failures.push({ code: "missing_required_artifact", message: input.missing.join(", ") });
+    if (input.mutations.length)
+        failures.push({ code: "check_input_mutated", message: input.mutations.join(", ") });
+    if (input.invalidRunner)
+        failures.push({ code: "invalid_runner_evidence", message: "Required runner evidence is unavailable or invalid" });
+    return failures;
+}
+function retainExecutionOutcome(evidenceDir, binding, candidateRoot, failures, candidateFiles) {
+    const temporary = path.join(evidenceDir, `.engine-outcome-${crypto.randomUUID()}.tmp`);
+    if (!fs.lstatSync(evidenceDir).isDirectory() || fs.lstatSync(evidenceDir).isSymbolicLink())
+        throw new AppError("check_evidence_stale", "Check evidence directory was replaced", 1);
+    fs.writeFileSync(temporary, JSON.stringify({ schema_id: "dd-flow/check-execution-outcome@1", id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch, candidate_root: candidateRoot, candidate_files: candidateFiles, execution_failures: failures }), { flag: "wx", mode: 0o600 });
+    fs.renameSync(temporary, path.join(evidenceDir, "engine-outcome.json"));
 }
 export function workspaceFingerprint(root) { return workspaceState(root).fingerprint; }
 /** One NUL-aware source of truth for paths differing from HEAD. Rename/copy
@@ -650,12 +960,13 @@ function deduplicate(checks, commands) {
         const reusable = check.reuse === "deterministic";
         // Stage labels identify obligations, not different processes in this gate.
         // Cross-invocation reuse still requires the explicit deterministic contract.
-        const key = JSON.stringify([commands[index], artifacts, ports, inputs, reusable, check.runner_evidence ?? null]);
+        const environmentInputs = normalizedEnvironmentInputs(check.environment_inputs);
+        const key = JSON.stringify([commands[index], artifacts, ports, inputs, reusable, environmentInputs, check.runner_evidence ?? null]);
         const current = groups.get(key);
         if (current)
             current.declarations.push(check);
         else
-            groups.set(key, { gate: check.run_at, command: commands[index], declarations: [check], requiredArtifacts: artifacts, ports, inputs, reusable, ...(check.runner_evidence ? { runnerEvidence: check.runner_evidence } : {}) });
+            groups.set(key, { gate: check.run_at, command: commands[index], declarations: [check], requiredArtifacts: artifacts, ports, inputs, reusable, ...(environmentInputs === undefined ? {} : { environmentInputs }), ...(check.runner_evidence ? { runnerEvidence: check.runner_evidence } : {}) });
     });
     return [...groups.values()].map(group => ({ ...group, gate: [...group.declarations].map(check => check.run_at).sort()[0], declarations: [...group.declarations].sort((left, right) => checkRef(left).localeCompare(checkRef(right))) }));
 }
@@ -703,16 +1014,34 @@ function checkRef(check) { return check.canonical_ref ?? check.id; }
 function assertConsistentDeclarations(checks, commands) {
     const seen = new Map();
     for (const [index, check] of checks.entries()) {
-        const contract = JSON.stringify([check.run_at, commands[index], [...(check.required_artifacts ?? [])].sort(), [...(check.ports ?? [])].sort(), normalizedInputs(check.inputs ?? []), check.reuse ?? null, check.runner_evidence ?? null]);
+        const contract = JSON.stringify([check.run_at, commands[index], [...(check.required_artifacts ?? [])].sort(), [...(check.ports ?? [])].sort(), normalizedInputs(check.inputs ?? []), check.reuse ?? null, normalizedEnvironmentInputs(check.environment_inputs), check.runner_evidence ?? null]);
         const ref = checkRef(check), prior = seen.get(ref);
         if (prior && prior !== contract)
             throw new AppError("check_declaration_conflict", "The same check reference has conflicting execution definitions", 2, { check_ref: ref });
         seen.set(ref, contract);
     }
 }
-function environmentFingerprint(workspaceRoot) {
-    const environment = codeExecutionEnvironment(workspaceRoot);
-    return crypto.createHash("sha256").update(JSON.stringify(Object.entries(environment).filter(([, value]) => value !== undefined).sort(([left], [right]) => left.localeCompare(right)))).digest("hex");
+function normalizedEnvironmentInputs(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || !value.length || value.length > 64 || value.some(name => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*\*?$/.test(name)))
+        throw new AppError("invalid_check_environment_inputs", "Internal check environment inputs must be bounded names or prefixes", 2, { effect: "no_effect" });
+    return [...new Set(value)].sort();
+}
+function environmentFingerprint(workspaceRoot, inputs, checkEnvironment) {
+    const environment = codeExecutionEnvironment(workspaceRoot, checkEnvironment);
+    // Invocation authority is checked by its own owners, not an application check
+    // input. Preserve arbitrary application variables (including DD_FLOW_PORT_*)
+    // and tool selection; omit only known process/control bookkeeping.
+    const bookkeeping = new Set(["PWD", "OLDPWD", "SHLVL", "_", "DD_FLOW_DAEMON_ID",
+        "DD_FLOW_CURRENT_INVOCATION", "DD_FLOW_INVOCATION_READONLY", "DD_FLOW_INVOCATION_SCOPE", "DD_FLOW_CODEX_STATE_DIR",
+        "DD_FLOW_RUNTIME_OWNER", "DD_FLOW_CONTROLLER_TOKEN", "DD_FLOW_CONTROL_TOKEN", "DD_FLOW_SCOPE_CONTROL_TOKEN",
+        "DD_FLOW_BIN", "DD_FLOW_ENGINE_HOME", "DD_FLOW_RUNTIME_BUDGET", "DD_FLOW_WORK_ID", "DD_FLOW_SESSION_ID", "CODEX_THREAD_ID", "DD_EVAL_OPERATION_ID",
+        "CODEX_PERMISSION_PROFILE", "CODEX_SESSION_ID", "CODEX_VERSION"]);
+    return crypto.createHash("sha256").update(JSON.stringify(Object.entries(environment)
+        .filter(([name, value]) => value !== undefined && !bookkeeping.has(name)
+        && (inputs === undefined || inputs.some(input => input.endsWith("*") ? name.startsWith(input.slice(0, -1)) : name === input)))
+        .sort(([left], [right]) => left.localeCompare(right)))).digest("hex");
 }
 function acquireWorkspaceGate(context, input) {
     const operationId = workspaceOperationId(input.workspaceRoot);
@@ -806,19 +1135,43 @@ function explicitInputFiles(root, inputs, ignoredRoots) {
         visit(path.resolve(root, input), input, new Set());
     return [...result.entries()];
 }
-function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, ...(group.runnerEvidence ? { runner_evidence: group.runnerEvidence } : {}), profile_hash: profileHash, environment: environmentFingerprint(workspaceRoot), input_fingerprint: inputFingerprint })).digest("hex"); }
-function bindReceipt(receipt, group) { return { ...receipt, gate: group.gate, declaration_id: group.declarations[0].id, check_refs: group.declarations.map(checkRef), required_artifacts: group.requiredArtifacts, inputs: group.inputs }; }
-export function checkReceiptEvidenceValid(receipt) {
-    if (receipt.status !== "passed" || receipt.exit_code !== 0 || receipt.before_fingerprint !== receipt.after_fingerprint || !fs.existsSync(receipt.completion_path) || readCompletion(receipt.completion_path)?.exit_code !== 0)
-        return false;
-    const stored = readReceipt(receipt.receipt_path);
-    if (!stored || stored.status !== "passed" || stored.input_hash !== receipt.input_hash || stored.profile_hash !== receipt.profile_hash)
-        return false;
-    const root = path.join(path.dirname(receipt.receipt_path), "artifacts");
-    if (stored.runner_evidence_required && !runnerEvidencePass(readRunnerEvidence(root, stored.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch })))
+function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint, evidenceContext, checkEnvironment) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, ...(group.runnerEvidence ? { runner_evidence: group.runnerEvidence } : {}), profile_hash: profileHash, environment: environmentFingerprint(workspaceRoot, group.environmentInputs, checkEnvironment), input_fingerprint: inputFingerprint, ...(group.environmentInputs === undefined ? {} : { environment_inputs: group.environmentInputs }), ...(evidenceContext === undefined ? {} : { evidence_context: evidenceContext }) })).digest("hex"); }
+function bindReceipt(receipt, group) { return { ...receipt, gate: group.gate, declaration_id: group.declarations[0].id, check_refs: group.declarations.map(checkRef), required_artifacts: [...new Set([...group.requiredArtifacts, ...(receipt.required_artifacts.includes("engine-outcome.json") ? ["engine-outcome.json"] : [])])], inputs: group.inputs }; }
+export function checkReceiptEvidenceValid(receipt) { return checkReceiptEvidenceValidForMode(receipt); }
+function checkReceiptEvidenceValidForMode(receipt, mode) {
+    try {
+        if (!(receipt.status === "passed" && receipt.exit_code === 0 || mode === "diagnostic" && receipt.status === "failed" && typeof receipt.exit_code === "number" && receipt.exit_code !== 0) || receipt.before_fingerprint !== receipt.after_fingerprint
+            || receipt.mutation_paths.length !== 0 || receipt.completion_path !== path.join(path.dirname(receipt.receipt_path), "completion.json")
+            || readCompletion(receipt.completion_path)?.exit_code !== receipt.exit_code)
+            return false;
+        const stored = readReceipt(receipt.receipt_path);
+        if (!stored || typeof stored !== "object" || Array.isArray(stored)
+            || typeof stored.receipt_path !== "string" || !path.isAbsolute(stored.receipt_path)
+            || path.basename(stored.receipt_path) !== "receipt.json"
+            || stored.completion_path !== path.join(path.dirname(stored.receipt_path), "completion.json"))
+            return false;
+        // Gate/ref labels may be rebound for explicit deterministic reuse. Physical
+        // execution identity and settled SQL evidence must never be rebound from a
+        // mutable receipt file, including after recovery relocates the RUN home.
+        const fields = ["id", "scope", "work_id", "command", "input_hash", "verification_epoch", "status", "exit_code",
+            "workspace_fingerprint", "before_fingerprint", "after_fingerprint", "profile_hash", "started_at", "finished_at"];
+        if (fields.some(field => stored[field] !== receipt[field]) || !Array.isArray(stored.artifacts)
+            || !Array.isArray(stored.mutation_paths) || stored.mutation_paths.length !== 0
+            || JSON.stringify(stored.required_artifacts) !== JSON.stringify(receipt.required_artifacts)
+            || JSON.stringify(stored.inputs) !== JSON.stringify(receipt.inputs))
+            return false;
+        const retained = resolvedReceiptArtifacts(receipt.receipt_path, stored.artifacts, receipt).artifacts;
+        if (JSON.stringify(retained) !== JSON.stringify(receipt.artifacts))
+            return false;
+        const root = path.join(path.dirname(receipt.receipt_path), "artifacts");
+        if (stored.runner_evidence_required && mode !== "diagnostic" && !runnerEvidencePass(readRunnerEvidence(root, stored.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch })))
+            return false;
+        const artifacts = collectCheckArtifacts(root, receipt.required_artifacts);
+        return artifacts.complete && JSON.stringify(artifacts.items) === JSON.stringify(retained);
+    }
+    catch {
         return false;
-    const artifacts = collectCheckArtifacts(root, stored.required_artifacts ?? []);
-    return artifacts.complete && JSON.stringify(artifacts.items) === JSON.stringify(stored.artifacts ?? []);
+    }
 }
 function parseArray(value, fallback) { try {
     const parsed = JSON.parse(value);