@dzhechkov/harness-core 0.5.1 → 0.5.2

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6aa58226ed2a38314929b9c93f1251932e9713c276bedb1006885757a0b0d59c"
+          "content": "1790811c8031105b1f281ecaff8a2e5b66a33ac9a323cbe63fb0caae67835b0d"
         }
       ]
     },
@@ -1525,7 +1525,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b5cc2034f02ea6c33a4e5a3c7009c5ba8357a3db35e6ee8e626ad5043b456d44"
+          "content": "837b65bceef392d58a8b85257443e796c8da7219e2c7d5749df952ff4ba9a7d9"
         }
       ]
     },
@@ -1535,7 +1535,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4ab8fac26790b7cfc5b87ce715cb9ded2cce5fe16e1791ad255c421adb67dba7"
+          "content": "2c88a22a96119c8ed14d67c1830bd85857e0c43f8a730951c1279ec9442decd6"
         }
       ]
     },
@@ -1545,7 +1545,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b67b9d7ea154657908e3f6c3a42c7156c34c769f0ba67dc462e8833cd1cd0f2c"
+          "content": "5c208320312a34f0e4d09b2cea3d50a057253771a67b60a0ee0d0907a382546c"
         }
       ]
     },
@@ -1555,7 +1555,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "55ef43a95452bd6e288f41a856283fc296c27a5ac489aa81832ff62605d25730"
+          "content": "262dd0fca9a734cc81ba33c215adb9ef88b343ee56091c017abda45c68bc2508"
         }
       ]
     },
@@ -1625,7 +1625,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "64c2189b94ec500649defd76ced51742807ebf7dba6ec3f4d68cc0ada6f86c6b"
+          "content": "115740b3c04b6e906e135eb9d1e462ae4197cdba558d4eb620e29e541b4de288"
         }
       ]
     },
@@ -1635,7 +1635,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8fe4553cb49e6440c3c2453e9e5a0aa0827829e250670afa33ba1cd9e7ccf0e0"
+          "content": "2cbadd2514704ccf6cfbf7e44fc50cad3d3701bc91b98651015896ebe209449a"
         }
       ]
     },
@@ -1785,7 +1785,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7fe2978192efae0c77f1b5da355fef75d035a2dd847b0111ae8f4e11c57af082"
+          "content": "49b8fc106dee22095dc02c43e224de52b9026dbf77d2f2e2654219a776017a09"
         }
       ]
     },
@@ -1795,7 +1795,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "79b8f649aab8bb4b7614cd35b24d4c102ca566ea1b7eb3b06fa35e4079b0becc"
+          "content": "170a7cdafb569ce8d9d1bd7c63ab83d4689cd3b1ed8a1f02536f5affd9dd6d5f"
         }
       ]
     },
@@ -1845,7 +1845,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b9eaa43bfc3cd4c80274c27410abd307d85c57d1952ca4563b93bbf87fa81de7"
+          "content": "bd228e00e217a99ee7f192c9e87d4e1c794c8ffb52323b77b87ee93f601f013a"
         }
       ]
     },
@@ -1855,7 +1855,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "df095cb1ae2aa32df0286c29da55aae3fa5bd277f8242a2b3fb14d3e3069585a"
+          "content": "4c37b21c750133def0498c6d1b0fddfb2525500ced4dc58634ae1234425337d3"
         }
       ]
     },
@@ -1865,7 +1865,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "96345388c0efa6f05388fed69ceb54e17e9edac9124cf06745e8a5cd3bc486e4"
+          "content": "83f2afea542e80bf09f9ccf9a56a9d352111a8a3cd7744bf8f2ccad84d796c6a"
         }
       ]
     },
@@ -1875,7 +1875,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6ce9f923b87ee9ae53c3a9a758609bde70decf039440e863ced8b407fc574366"
+          "content": "93a3007d6a7a906344f8f85272aef1928811997d331202171558763ab917b9d6"
         }
       ]
     },
@@ -3599,6 +3599,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/trace-corroborate.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "ebc36a47e4f8359eb7359a1e1697e9a135b2a281ecb1f795e99da7f9476f7f4c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/trace-corroborate.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "7a2f343525b6585d0cd54644282bc49b741baffd066ebff0f023c036b622e6f8"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/trace-corroborate.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "1b78df722776f6e253e3d0babb90c8557b5d733528125c793b7519ec724db96b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/trace-corroborate.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "7c95e98228f86fda4f4503b04efaf149466f9bd78fbb549a8aad49c8a4f3b7ab"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/upgrade.d.ts",
@@ -3765,7 +3805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9ab363920599845c6d7b895d7c79217c8eb547752f5a440c14841cec41d8d03a"
+          "content": "94d154db3feb9676e515fc04129ac299f967ff46b8a7daedc51ec201f7eb5259"
         }
       ]
     },
@@ -3775,7 +3815,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "998e470015beb24d24b0510e435d327786295c8c735bc145f9b7ec068f243e63"
+          "content": "0bda62d918a427203c946a0d6ec9fdb67a2223573939bc358fa9d48545e34361"
         }
       ]
     },
@@ -3785,7 +3825,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7877d5dcda3394aae5349a8b935d6cae67b0ba822e9a155d69f3476bca129ab4"
+          "content": "c5d24bc9e5a8731ecd9e83e0fc3c3bac02421b76028906b20d2a113f04efbe59"
         }
       ]
     },
@@ -3795,7 +3835,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5832275f40d831d58f18f0dd99434157ccb98f56ad689b4d10a373cbbd4f177d"
+          "content": "f9a9a320dde4bae0d6f6b0b2e7c03c08127e452f7fa7e00d78ea9f9b816bc6e7"
         }
       ]
     },
@@ -3845,7 +3885,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "317e79f0d14348171eee5ca0d0666ecfb98a4ad05bd438f6c9478686fcadad96"
+          "content": "f44d3dd18b5332681d861707c5644b1cbb027b217b9fda07a0b8510b6346d1a8"
         }
       ]
     },
@@ -4225,7 +4265,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6e6ebced34cfe7be2d69ccd257ca4382d312910c75164a6eb2248f6ced652a7a"
+          "content": "b741c4477d04f5fdb88f88601b8528f56e9b1fdc6a849dece4af157a81c0fe57"
         }
       ]
     },
@@ -4245,7 +4285,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "21ca2d73e0833cf70120a06d970b68e7c7e9ba39698b93c390d89b7d5655852c"
+          "content": "929be36a3c9fd2cf3ba6e6b7328dd8d7928d9c031c38bb62880ba234c9553334"
         }
       ]
     },
@@ -4285,7 +4325,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f6cd7fbc071b59804cd0a7f2ea37e2ebd80fe347806b338f618e11508bcf8301"
+          "content": "69d0daac70fda89235352be2cc2e40bcfe62651aedab8056c1919ed062d4a75b"
         }
       ]
     },
@@ -4305,7 +4345,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "26b22b86c80307158d78e587d27b9a09cd597f5a491c8046c3aebb8dabd6c654"
+          "content": "ea7d5b64c7805fd4622e7a892e0e3f1f03e4fdbb883f5fe377fcd64330775330"
         }
       ]
     },
@@ -4729,6 +4769,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/trace-corroborate.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "28a872378dce68940237a99e8ffe57d3da049cccb0ffc315fbddf8ba65e80ee8"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/upgrade.ts",
@@ -4775,7 +4825,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "36a7e633dbd7bde8a15f8e0a426bda7c308d67194a21094621654a7022b99c87"
+          "content": "f1aaf39fcb5088afe3c63185c05a0d22f0507d29c342e3024836f46e3996d430"
         }
       ]
     },
@@ -5339,6 +5389,26 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/feature-adr-workflow-write-discipline.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f491c12d9bb0a361095e9ec7cab216b60ea51f1c839256b8b4476bf0f8d5f4ca"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/feature-adr-write-discipline.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "e44795d46da74d4f21bf6817d3884f1428f8adfd814c5174490c9c372299932e"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/files-whitelist-guard.test.ts",
@@ -5435,7 +5505,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0a8d4ea5c160aa4e08e39a439907948dfeb92b622e42bf4bdd578c9a05848c45"
+          "content": "f20a7850a3313d5bb2431d81e8717694f2edf4cda5c67133c0b80d7549e2cbab"
         }
       ]
     },
@@ -5445,7 +5515,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "842d2425c72b12356512ebcfe66fe7f878f58daee947bbdd8ef1f2c908c748a7"
+          "content": "2bc8d4bd9c2bf15a3522d00b01a18611ef973f4b9e71ef5c1894ea72628294a8"
         }
       ]
     },
@@ -5655,7 +5725,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f4b88439e1319490d6bcff87f507d8f01a8ab11469057a7060693df70dbe8802"
+          "content": "95d04dbdb46e7f1fac3f6cfd5ec7705579a436ea7118823e11cb752da7f9adea"
         }
       ]
     },
@@ -5855,7 +5925,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a0f9cf5a77de387993d9c1860458469ab3015c26e6f7242aa170802ae0a85fc4"
+          "content": "e9ccae5e13df6370a8564326e5766aa1e03973c595bfdf73765d54191acf98c4"
         }
       ]
     },
@@ -6209,6 +6279,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/trace-attestation.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f4888117c97180797e6437abc1ef0c6aa1f1e48ee7c2df33d60a65e8bf11b35c"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/trace-bundle.test.ts",
@@ -6219,6 +6299,26 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/trace-corroborate.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "9e845bb448c1300966e76a030b2b0d88c3aa3cf666d85b58ddd981e15d4dcd85"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/trace-qe-round1.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "7790c41628d7223a45aa61977511d1ddd6cd2cd8dc2dfdcdd248bb25c2effeca"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/trusttier-schema.test.ts",

package/src/index.ts

@@ -65,6 +65,7 @@ export {
   type LintOptions,
 } from './loop-lint.js';
 export * from './loop-trace.js';
+export * from './trace-corroborate.js';
 export * from './trace-bundle.js';
 export { BLOBS as LOOP_BLOBS, LOOP_BLOB_NAMES, BLOB_COVERAGE_MANIFEST } from './loop-blobs.generated.js';
 export type { LoopBlob } from './loop-blobs.generated.js';

package/src/loop-blobs.generated.ts

@@ -97,11 +97,11 @@ export const BLOBS: Record<string, LoopBlob> = {
   "trace": {
     name: "trace",
     version: "1.1.0",
-    contentHash: "fc59098bb0deb747c4c1c9a6ba843df70edfe0dc5ef8370c0f7192afc7657890",
+    contentHash: "1270f9aac5fbe5693af8bcc26af55e81aeb41ef4b911dbda72c23ea248072344",
     sourcePath: "packages/@dzhechkov/harness-core/src/loop-trace.ts",
     requires: [],
     exports: ["LOOP_TRACE_SCHEMA_VERSION","TRACE_RUNID_RE","TRACE_KEY_RE","traceShellQuote","traceValidateEvent","traceInit","traceOnDispatch","traceOnSettle","traceClose","traceFlushCmd","traceFaRecordCmd","traceLedgerLine","traceLedgerAppendCmd"],
-    code: "const LOOP_TRACE_SCHEMA_VERSION = 1;\nconst TRACE_RUNID_RE = /^[a-z0-9-]{1,40}$/;\nconst TRACE_KEY_RE = /^[a-z0-9_.:-]{1,64}$/i;\nfunction traceShellQuote(s) {\n    return \"'\" + String(s).replace(/'/g, \"'\\\\''\") + \"'\";\n}\nfunction traceValidateEvent(e) {\n    if (typeof e !== 'object' || e === null || Array.isArray(e))\n        return 'event must be an object';\n    const ev = e;\n    if (ev['v'] !== 1)\n        return 'v must be 1';\n    if (typeof ev['runId'] !== 'string' || !TRACE_RUNID_RE.test(ev['runId']))\n        return 'runId fails its VO regex';\n    if (typeof ev['seq'] !== 'number' || !Number.isInteger(ev['seq']) || ev['seq'] < 1)\n        return 'seq must be a positive integer';\n    const kind = ev['event'];\n    if (kind === 'dispatched') {\n        if (typeof ev['invocationId'] !== 'string' || ev['invocationId'] === '')\n            return 'invocationId required';\n        if (typeof ev['stepId'] !== 'string' || !TRACE_KEY_RE.test(ev['stepId']))\n            return 'stepId fails its VO regex';\n        if (ev['itemKey'] !== null && (typeof ev['itemKey'] !== 'string' || !TRACE_KEY_RE.test(ev['itemKey'])))\n            return 'itemKey fails its VO regex';\n        if (typeof ev['attempt'] !== 'number' || ev['attempt'] < 1)\n            return 'attempt must be >= 1';\n        if (typeof ev['phase'] !== 'string' || ev['phase'] === '')\n            return 'phase required';\n        if (!Array.isArray(ev['causedBy']) || ev['causedBy'].some((n) => typeof n !== 'number'))\n            return 'causedBy must be a number array';\n        return null;\n    }\n    if (kind === 'settled') {\n        if (typeof ev['invocationId'] !== 'string' || ev['invocationId'] === '')\n            return 'invocationId required';\n        if (ev['outcome'] !== 'ok' && ev['outcome'] !== 'null' && ev['outcome'] !== 'error')\n            return 'outcome must be ok|null|error';\n        return null;\n    }\n    if (kind === 'run.opened') {\n        if (typeof ev['planDigest'] !== 'string' || typeof ev['execFp'] !== 'string')\n            return 'run.opened needs planDigest + execFp';\n        return null;\n    }\n    if (kind === 'run.closed') {\n        const c = ev['counts'];\n        if (typeof c !== 'object' || c === null)\n            return 'run.closed needs counts';\n        return null;\n    }\n    return 'unknown event kind';\n}\nfunction traceInit(runId, planDigest, execFp) {\n    if (!TRACE_RUNID_RE.test(runId))\n        throw new Error('loop-trace: runId fails ' + String(TRACE_RUNID_RE));\n    const state = { runId, seq: 0, dispatched: 0, settled: 0, buffer: [] };\n    const opened = { v: 1, runId, seq: ++state.seq, event: 'run.opened', planDigest, execFp };\n    traceBuffer(state, opened);\n    return state;\n}\nfunction traceBuffer(state, e) {\n    const err = traceValidateEvent(e);\n    if (err !== null)\n        throw new Error('loop-trace: refusing non-conforming event (' + err + ') — the authoritative ordering source is never repaired later');\n    state.buffer.push(JSON.stringify(e));\n}\nfunction traceOnDispatch(state, e) {\n    const seq = ++state.seq;\n    state.dispatched++;\n    traceBuffer(state, {\n        v: 1,\n        runId: state.runId,\n        seq,\n        event: 'dispatched',\n        invocationId: e.invocationId,\n        stepId: e.stepId,\n        itemKey: e.itemKey,\n        attempt: e.attempt,\n        phase: e.phase,\n        model: e.model,\n        causedBy: e.causedBy,\n    });\n    return seq;\n}\nfunction traceOnSettle(state, e) {\n    const seq = ++state.seq;\n    state.settled++;\n    traceBuffer(state, { v: 1, runId: state.runId, seq, event: 'settled', invocationId: e.invocationId, outcome: e.outcome });\n    return seq;\n}\nfunction traceClose(state) {\n    const closed = {\n        v: 1,\n        runId: state.runId,\n        seq: ++state.seq,\n        event: 'run.closed',\n        counts: { dispatched: state.dispatched, settled: state.settled },\n    };\n    traceBuffer(state, closed);\n}\nfunction traceFlushCmd(state, traceFileAbs) {\n    if (state.buffer.length === 0)\n        return null;\n    const lines = state.buffer.splice(0, state.buffer.length);\n    const file = traceShellQuote(traceFileAbs);\n    const dir = traceShellQuote(traceFileAbs.replace(/\\/[^/]*$/, ''));\n    const printfs = lines\n        .map((l) => \"printf '%s\\\\n' \" + traceShellQuote(l) + ' | sed \"s/}$/,\\\\\"wallTime\\\\\":\\\\\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\\\\"}/\" >> ' + file)\n        .join(' && ');\n    return 'mkdir -p ' + dir + ' && ' + printfs;\n}\nfunction traceFaRecordCmd(dzBin, slug, stepLabel, projectAbs) {\n    if (typeof slug !== 'string' || slug === ''\n        || typeof stepLabel !== 'string' || stepLabel === ''\n        || typeof projectAbs !== 'string' || projectAbs === '')\n        return null;\n    const bin = typeof dzBin === 'string' && dzBin !== '' ? dzBin : 'dz';\n    const cmd = traceShellQuote(bin) + ' statusline --fa-record --slug ' + traceShellQuote(slug)\n        + ' --step ' + traceShellQuote(stepLabel) + ' --kind loop --project ' + traceShellQuote(projectAbs);\n    return cmd + ' >/dev/null 2>&1';\n}\nfunction traceLedgerLine(opts) {\n    try {\n        if (typeof opts.slug !== 'string' || opts.slug === '')\n            return null;\n        const agents = typeof opts.agents === 'number'\n            && Number.isFinite(opts.agents)\n            && Number.isInteger(opts.agents)\n            && opts.agents >= 0\n            ? opts.agents\n            : 0;\n        const date = typeof opts.date === 'string' && /^\\d{4}-\\d{2}-\\d{2}$/.test(opts.date) ? opts.date : null;\n        const outcome = typeof opts.outcome === 'string' && opts.outcome !== '' ? opts.outcome : 'unknown';\n        const line = JSON.stringify({\n            slug: opts.slug,\n            stage: 'loop-run',\n            tier: null,\n            tokens: null,\n            minutes: null,\n            agents,\n            coder: null,\n            grade: null,\n            date,\n            auto: true,\n            outcome,\n            runId: typeof opts.runId === 'string' ? opts.runId : null,\n            planDigest: typeof opts.planDigest === 'string' ? opts.planDigest : null,\n        });\n        return line.length <= 4000 ? line : null;\n    }\n    catch {\n        return null;\n    }\n}\nfunction traceLedgerAppendCmd(repoAbs, line) {\n    if (typeof repoAbs !== 'string' || repoAbs === '' || typeof line !== 'string' || line === '')\n        return null;\n    const dir = traceShellQuote(repoAbs + '/.dz/feature-adr');\n    const file = traceShellQuote(repoAbs + '/.dz/feature-adr/run-cost-ledger.jsonl');\n    return 'mkdir -p ' + dir\n        + \" && printf '%s' \" + traceShellQuote(line)\n        + ' | sed \"s/\\\\\"date\\\\\":null/\\\\\"date\\\\\":\\\\\"$(date -u +%Y-%m-%d)\\\\\"/\" >> ' + file\n        + \" && printf '\\\\n' >> \" + file\n        + ' && echo LEDGER-OK';\n}\nfunction invocations(run) {\n    const out = new Map();\n    for (const e of run.events) {\n        if (e.event === 'dispatched') {\n            out.set(e.invocationId, {\n                invocationId: e.invocationId,\n                stepId: e.stepId,\n                itemKey: e.itemKey,\n                dispatchSeq: e.seq,\n                settleSeq: null,\n                causedBy: e.causedBy,\n            });\n        }\n        else if (e.event === 'settled') {\n            const inv = out.get(e.invocationId);\n            if (inv)\n                inv.settleSeq = e.seq;\n        }\n    }\n    return [...out.values()];\n}",
+    code: "const LOOP_TRACE_SCHEMA_VERSION = 1;\nconst TRACE_RUNID_RE = /^[a-z0-9-]{1,40}$/;\nconst TRACE_KEY_RE = /^[a-z0-9_.:-]{1,64}$/i;\nfunction traceShellQuote(s) {\n    return \"'\" + String(s).replace(/'/g, \"'\\\\''\") + \"'\";\n}\nfunction traceValidateEvent(e) {\n    if (typeof e !== 'object' || e === null || Array.isArray(e))\n        return 'event must be an object';\n    const ev = e;\n    if (ev['v'] !== 1)\n        return 'v must be 1';\n    if (typeof ev['runId'] !== 'string' || !TRACE_RUNID_RE.test(ev['runId']))\n        return 'runId fails its VO regex';\n    if (typeof ev['seq'] !== 'number' || !Number.isInteger(ev['seq']) || ev['seq'] < 1)\n        return 'seq must be a positive integer';\n    const kind = ev['event'];\n    if (kind === 'dispatched') {\n        if (typeof ev['invocationId'] !== 'string' || ev['invocationId'] === '')\n            return 'invocationId required';\n        if (typeof ev['stepId'] !== 'string' || !TRACE_KEY_RE.test(ev['stepId']))\n            return 'stepId fails its VO regex';\n        if (ev['itemKey'] !== null && (typeof ev['itemKey'] !== 'string' || !TRACE_KEY_RE.test(ev['itemKey'])))\n            return 'itemKey fails its VO regex';\n        if (typeof ev['attempt'] !== 'number' || ev['attempt'] < 1)\n            return 'attempt must be >= 1';\n        if (typeof ev['phase'] !== 'string' || ev['phase'] === '')\n            return 'phase required';\n        if (!Array.isArray(ev['causedBy']) || ev['causedBy'].some((n) => typeof n !== 'number'))\n            return 'causedBy must be a number array';\n        return null;\n    }\n    if (kind === 'settled') {\n        if (typeof ev['invocationId'] !== 'string' || ev['invocationId'] === '')\n            return 'invocationId required';\n        if (ev['outcome'] !== 'ok' && ev['outcome'] !== 'null' && ev['outcome'] !== 'error')\n            return 'outcome must be ok|null|error';\n        return null;\n    }\n    if (kind === 'run.opened') {\n        if (typeof ev['planDigest'] !== 'string' || typeof ev['execFp'] !== 'string')\n            return 'run.opened needs planDigest + execFp';\n        const ep = ev['emitterPath'];\n        if (ep !== undefined && ep !== 'dz-process' && ep !== 'rendered-script')\n            return 'emitterPath must be dz-process|rendered-script';\n        return null;\n    }\n    if (kind === 'run.closed') {\n        const c = ev['counts'];\n        if (typeof c !== 'object' || c === null)\n            return 'run.closed needs counts';\n        return null;\n    }\n    return 'unknown event kind';\n}\nfunction traceInit(runId, planDigest, execFp, emitterPath) {\n    if (!TRACE_RUNID_RE.test(runId))\n        throw new Error('loop-trace: runId fails ' + String(TRACE_RUNID_RE));\n    const state = { runId, seq: 0, dispatched: 0, settled: 0, buffer: [] };\n    const opened = { v: 1, runId, seq: ++state.seq, event: 'run.opened', planDigest, execFp, emitterPath };\n    traceBuffer(state, opened);\n    return state;\n}\nfunction traceBuffer(state, e) {\n    const err = traceValidateEvent(e);\n    if (err !== null)\n        throw new Error('loop-trace: refusing non-conforming event (' + err + ') — the authoritative ordering source is never repaired later');\n    state.buffer.push(JSON.stringify(e));\n}\nfunction traceOnDispatch(state, e) {\n    const seq = ++state.seq;\n    state.dispatched++;\n    traceBuffer(state, {\n        v: 1,\n        runId: state.runId,\n        seq,\n        event: 'dispatched',\n        invocationId: e.invocationId,\n        stepId: e.stepId,\n        itemKey: e.itemKey,\n        attempt: e.attempt,\n        phase: e.phase,\n        model: e.model,\n        causedBy: e.causedBy,\n    });\n    return seq;\n}\nfunction traceOnSettle(state, e) {\n    const seq = ++state.seq;\n    state.settled++;\n    traceBuffer(state, { v: 1, runId: state.runId, seq, event: 'settled', invocationId: e.invocationId, outcome: e.outcome });\n    return seq;\n}\nfunction traceClose(state) {\n    const closed = {\n        v: 1,\n        runId: state.runId,\n        seq: ++state.seq,\n        event: 'run.closed',\n        counts: { dispatched: state.dispatched, settled: state.settled },\n    };\n    traceBuffer(state, closed);\n}\nfunction traceFlushCmd(state, traceFileAbs) {\n    if (state.buffer.length === 0)\n        return null;\n    const lines = state.buffer.splice(0, state.buffer.length);\n    const file = traceShellQuote(traceFileAbs);\n    const dir = traceShellQuote(traceFileAbs.replace(/\\/[^/]*$/, ''));\n    const printfs = lines\n        .map((l) => \"printf '%s\\\\n' \" + traceShellQuote(l) + ' | sed \"s/}$/,\\\\\"wallTime\\\\\":\\\\\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\\\\"}/\" >> ' + file)\n        .join(' && ');\n    return 'mkdir -p ' + dir + ' && ' + printfs;\n}\nfunction traceFaRecordCmd(dzBin, slug, stepLabel, projectAbs) {\n    if (typeof slug !== 'string' || slug === ''\n        || typeof stepLabel !== 'string' || stepLabel === ''\n        || typeof projectAbs !== 'string' || projectAbs === '')\n        return null;\n    const bin = typeof dzBin === 'string' && dzBin !== '' ? dzBin : 'dz';\n    const cmd = traceShellQuote(bin) + ' statusline --fa-record --slug ' + traceShellQuote(slug)\n        + ' --step ' + traceShellQuote(stepLabel) + ' --kind loop --project ' + traceShellQuote(projectAbs);\n    return cmd + ' >/dev/null 2>&1';\n}\nfunction traceLedgerLine(opts) {\n    try {\n        if (typeof opts.slug !== 'string' || opts.slug === '')\n            return null;\n        const agents = typeof opts.agents === 'number'\n            && Number.isFinite(opts.agents)\n            && Number.isInteger(opts.agents)\n            && opts.agents >= 0\n            ? opts.agents\n            : 0;\n        const date = typeof opts.date === 'string' && /^\\d{4}-\\d{2}-\\d{2}$/.test(opts.date) ? opts.date : null;\n        const outcome = typeof opts.outcome === 'string' && opts.outcome !== '' ? opts.outcome : 'unknown';\n        const line = JSON.stringify({\n            slug: opts.slug,\n            stage: 'loop-run',\n            tier: null,\n            tokens: null,\n            minutes: null,\n            agents,\n            coder: null,\n            grade: null,\n            date,\n            auto: true,\n            outcome,\n            runId: typeof opts.runId === 'string' ? opts.runId : null,\n            planDigest: typeof opts.planDigest === 'string' ? opts.planDigest : null,\n        });\n        return line.length <= 4000 ? line : null;\n    }\n    catch {\n        return null;\n    }\n}\nfunction traceLedgerAppendCmd(repoAbs, line) {\n    if (typeof repoAbs !== 'string' || repoAbs === '' || typeof line !== 'string' || line === '')\n        return null;\n    const dir = traceShellQuote(repoAbs + '/.dz/feature-adr');\n    const file = traceShellQuote(repoAbs + '/.dz/feature-adr/run-cost-ledger.jsonl');\n    return 'mkdir -p ' + dir\n        + \" && printf '%s' \" + traceShellQuote(line)\n        + ' | sed \"s/\\\\\"date\\\\\":null/\\\\\"date\\\\\":\\\\\"$(date -u +%Y-%m-%d)\\\\\"/\" >> ' + file\n        + \" && printf '\\\\n' >> \" + file\n        + ' && echo LEDGER-OK';\n}\nfunction invocations(run) {\n    const out = new Map();\n    for (const e of run.events) {\n        if (e.event === 'dispatched') {\n            out.set(e.invocationId, {\n                invocationId: e.invocationId,\n                stepId: e.stepId,\n                itemKey: e.itemKey,\n                dispatchSeq: e.seq,\n                settleSeq: null,\n                causedBy: e.causedBy,\n            });\n        }\n        else if (e.event === 'settled') {\n            const inv = out.get(e.invocationId);\n            if (inv)\n                inv.settleSeq = e.seq;\n        }\n    }\n    return [...out.values()];\n}",
   },
   "loop-semantics": {
     name: "loop-semantics",

package/src/loop-render.ts

@@ -653,7 +653,7 @@ function renderRuntime(plan: LoopPlan, planDig: string, execFp: string, blobs: L
   }
   if (traceOn) {
     lines.push(`// trace wiring (blob-provided emitter; hooks INSIDE runStep — ADR-003)`);
-    lines.push(`const __traceState = traceInit(RUN_ID, PLAN_DIGEST, EXEC_FP)`);
+    lines.push(`const __traceState = traceInit(RUN_ID, PLAN_DIGEST, EXEC_FP, 'rendered-script')`);
     lines.push(`__hooks.onDispatch = function (e) { return traceOnDispatch(__traceState, e) }`);
     lines.push(`__hooks.onSettle = function (e) { return traceOnSettle(__traceState, e) }`);
     lines.push(`async function __traceFlushNow(phaseName, stepLabel) {`);

package/src/loop-trace.ts

@@ -60,6 +60,15 @@ export interface TraceSettleEvent {
   wallTime?: string | null;
 }
 
+/**
+ * WHICH CODE PATH was meant to write this file. A HINT, never a trust statement — the rendered
+ * script's flush is performed BY AN AGENT, which therefore controls these bytes before the file
+ * exists and could write any value here. It is deliberately NOT called `attestedBy`, so nothing in
+ * the codebase can read it as provenance (ADR-001 round 1 made exactly that mistake). The trust
+ * question is answered by `deriveAttestation`, from an artifact the sandboxed script cannot write.
+ */
+export type TraceEmitterPath = 'dz-process' | 'rendered-script';
+
 export interface TraceRunOpened {
   v: 1;
   runId: string;
@@ -67,6 +76,9 @@ export interface TraceRunOpened {
   event: 'run.opened';
   planDigest: string;
   execFp: string;
+  /** Optional ON THE WIRE (NFR-1): an older reader ignores it, a newer reader over an older trace
+   *  gets `unknown` — which is never `instrument`. */
+  emitterPath?: TraceEmitterPath;
 }
 
 export interface TraceRunClosed {
@@ -122,6 +134,10 @@ export function traceValidateEvent(e: unknown): string | null {
   }
   if (kind === 'run.opened') {
     if (typeof ev['planDigest'] !== 'string' || typeof ev['execFp'] !== 'string') return 'run.opened needs planDigest + execFp';
+    const ep = ev['emitterPath'];
+    // Absent is legal (NFR-1). Present-but-outside-the-union is a REFUSAL, not a downgrade: a value
+    // like 'trusted' is someone trying to say something the vocabulary does not permit.
+    if (ep !== undefined && ep !== 'dz-process' && ep !== 'rendered-script') return 'emitterPath must be dz-process|rendered-script';
     return null;
   }
   if (kind === 'run.closed') {
@@ -132,11 +148,17 @@ export function traceValidateEvent(e: unknown): string | null {
   return 'unknown event kind';
 }
 
-/** Open a trace state and buffer the run.opened frame. Throws on an invalid runId (fail-closed). */
-export function traceInit(runId: string, planDigest: string, execFp: string): TraceState {
+/**
+ * Open a trace state and buffer the run.opened frame. Throws on an invalid runId (fail-closed).
+ *
+ * `emitterPath` is REQUIRED and has NO DEFAULT, on purpose: a default would be chosen once, by
+ * whoever added the parameter, and every future caller that forgot it would silently inherit that
+ * choice. A missing argument must be a compile error instead.
+ */
+export function traceInit(runId: string, planDigest: string, execFp: string, emitterPath: TraceEmitterPath): TraceState {
   if (!TRACE_RUNID_RE.test(runId)) throw new Error('loop-trace: runId fails ' + String(TRACE_RUNID_RE));
   const state: TraceState = { runId, seq: 0, dispatched: 0, settled: 0, buffer: [] };
-  const opened: TraceRunOpened = { v: 1, runId, seq: ++state.seq, event: 'run.opened', planDigest, execFp };
+  const opened: TraceRunOpened = { v: 1, runId, seq: ++state.seq, event: 'run.opened', planDigest, execFp, emitterPath };
   traceBuffer(state, opened);
   return state;
 }
@@ -314,6 +336,11 @@ export interface TraceRun {
   /** No run.closed frame ⇒ the tail may be lost; truncated-window invariants report inconclusive. */
   incomplete: boolean;
   parseErrors: string[];
+  /** The self-declared HINT (see TraceEmitterPath) — null when absent. NEVER read as provenance. */
+  emitterPath: TraceEmitterPath | null;
+  /** Two `run.opened` frames that DISAGREE. The scan used to keep the last one silently, which
+   *  would let a spliced frame overwrite the genuine one; a conflict now forbids `instrument`. */
+  openConflict: boolean;
 }
 
 /**
@@ -339,7 +366,7 @@ export interface TraceRun {
  * the only ordering the file can still testify to. INV-14 fails such a trace on uniqueness anyway.
  */
 export function parseTrace(text: string): TraceRun {
-  const run: TraceRun = { runId: null, planDigest: null, execFp: null, events: [], incomplete: true, parseErrors: [] };
+  const run: TraceRun = { runId: null, planDigest: null, execFp: null, events: [], incomplete: true, parseErrors: [], emitterPath: null, openConflict: false };
   const scanned: TraceEvent[] = [];
   for (const line of String(text ?? '').split('\n')) {
     const t = line.trim();
@@ -364,9 +391,22 @@ export function parseTrace(text: string): TraceRun {
   const dispatchSeen = new Set<string>();
   for (const ev of scanned) {
     if (ev.event === 'run.opened') {
+      const prior = run.events.some((p) => p.event === 'run.opened');
+      if (prior) {
+        const disagrees =
+          run.runId !== ev.runId ||
+          run.planDigest !== ev.planDigest ||
+          run.execFp !== ev.execFp ||
+          run.emitterPath !== (ev.emitterPath ?? null);
+        if (disagrees) {
+          run.openConflict = true;
+          run.parseErrors.push('conflicting run.opened frames — refusing to prefer either (ADR-001)');
+        }
+      }
       run.runId = ev.runId;
       run.planDigest = ev.planDigest;
       run.execFp = ev.execFp;
+      run.emitterPath = ev.emitterPath ?? null;
     }
     if (ev.event === 'run.closed') run.incomplete = false;
     if (ev.event === 'dispatched') {
@@ -386,12 +426,84 @@ export function parseTrace(text: string): TraceRun {
   return run;
 }
 
+/**
+ * ATTESTATION — the trust question, answered by the READER, never by the file.
+ *
+ * `instrument` means, EXACTLY (ADR-001 round 3, wording taken from the cross-family reviewer):
+ * *the bytes read match the identifiers, the hash and the line count asserted by the co-located
+ * `run-state.json`.* It does NOT mean `dz` historically wrote those bytes, nor that this is the
+ * directory it wrote them in. A byte-identical replay passes. Copying the matched trace+run-state
+ * pair elsewhere passes. Both are accepted and tested, not patched.
+ *
+ * What it DOES buy: `run-state.json` is written by the dz process, and the rendered script runs in a
+ * sandbox with no filesystem — so an agent that mis-writes, truncates, reorders or invents its
+ * flush cannot reach `instrument`. What it cannot buy: a defence against an actor with write access
+ * to the run directory. On this machine the agent IS such an actor and the signing key is readable
+ * by the same account, so no local artifact — signature included — closes that. Named, not hidden.
+ *
+ * `unknown` is kept DISTINCT from `agent` (a legacy instrument run, a stripped field and explicit
+ * agent testimony are different facts) while sharing its conservative tier for every decision.
+ */
+export type TraceAttestation = 'instrument' | 'agent' | 'unknown';
+
+/** The subset of `run-state.json` the attestation reads. Unknown-shaped input is not an error — it
+ *  simply fails to bind, which yields `unknown`. */
+export interface TraceRunStateBinding {
+  runId?: unknown;
+  planDigest?: unknown;
+  execFp?: unknown;
+  traceSha256?: unknown;
+  traceLines?: unknown;
+}
+
+/** What the CALLER measured about the trace text it actually read. Passed in rather than computed
+ *  here so this module keeps its zero dependencies (no node:crypto) and stays trivially testable. */
+export interface TraceObserved {
+  sha256: string;
+  lines: number;
+}
+
+export function deriveAttestation(run: TraceRun, state: TraceRunStateBinding | null | undefined, observed: TraceObserved): TraceAttestation {
+  // A conflict between two run.opened frames forbids the favourable reading outright: preferring
+  // either one is exactly the silent choice this feature exists to remove.
+  if (run.openConflict) return 'unknown';
+  // QE round 1 / H1: EVERY bound value must be non-empty. Equality alone let a trace whose
+  // planDigest and execFp are both '' bind against a state carrying the same two empty strings —
+  // an "identity" that identifies nothing. A binding over absent values is not a binding.
+  const nonEmpty = (a: unknown, b: unknown): boolean => typeof a === 'string' && a !== '' && a === b;
+  const bound =
+    state != null &&
+    nonEmpty(state.runId, run.runId) &&
+    nonEmpty(state.planDigest, run.planDigest) &&
+    nonEmpty(state.execFp, run.execFp) &&
+    // CONTENT binding, not just identifiers: a legacy run-state with no traceSha256 can never mint
+    // `instrument` (that was the reviewer's stale-directory counterexample).
+    nonEmpty(state.traceSha256, observed.sha256) &&
+    typeof state.traceLines === 'number' && state.traceLines === observed.lines;
+  if (bound) return 'instrument';
+  if (run.emitterPath === 'rendered-script') return 'agent';
+  return 'unknown';
+}
+
 export type InvariantStatus = 'pass' | 'fail' | 'inconclusive';
 
 export interface InvariantVerdict {
   id: string;
   status: InvariantStatus;
   message: string;
+  /**
+   * FR-3 — the qualifier travels IN the verdict, never beside it. A caller that stores a verdict
+   * and reads it back later must not be able to end up holding a bare `pass` whose attestation was
+   * dropped in transit. Optional only so a caller that has not derived one is a compile-time
+   * possibility; `stampAttestation` is how the reader attaches it.
+   */
+  attestation?: TraceAttestation;
+}
+
+/** Attach one attestation to every verdict in a batch. Kept as a named function rather than a spread
+ *  at each call site so a NEW verdict producer cannot silently ship unstamped verdicts. */
+export function stampAttestation(verdicts: InvariantVerdict[], attestation: TraceAttestation): InvariantVerdict[] {
+  return verdicts.map((v) => ({ ...v, attestation }));
 }
 
 interface Invocation {
@@ -697,7 +809,12 @@ export interface Timeline {
 /**
  * Merge one timeline: trace.jsonl is the AUTHORITATIVE order (rows sorted by seq); checkpoints,
  * cost-ledger lines and usageEvents are appended as unordered context rows (seq 0); journal.jsonl
- * contributes DIAGNOSTIC agentId correlation only, never ordering (the ACL of 04 §8).
+ * contributes a DIAGNOSTIC LINE COUNT only, never ordering (the ACL of 04 §8).
+ *
+ * Honesty fix (2026-08-20): this note used to promise "agentId correlation", which the code never
+ * did — it counts lines. A comment claiming an analysis that does not exist is the same defect class
+ * this feature was built to remove, one layer up. The real correlation now lives in
+ * `trace-corroborate.ts`, behind `dz workflow-trace --corroborate`, where it is scoped and tested.
  */
 export function assembleTimeline(input: {
   trace: string;
@@ -749,7 +866,7 @@ export function assembleTimeline(input: {
     sources.push('journal (diagnostic only — never ordering)');
     let n = 0;
     for (const line of input.journal.split('\n')) if (line.trim() !== '') n++;
-    rows.push({ seq: 0, kind: 'journal', label: 'journal', detail: `${n} host-journal line(s) — agentId correlation only; the host journal carries no seq/ts and NEVER orders this timeline`, wallTime: null });
+    rows.push({ seq: 0, kind: 'journal', label: 'journal', detail: n + ' host-journal line(s) — COUNT only; the host journal carries no seq/ts and NEVER orders this timeline. For an actual comparison run: dz workflow-trace --corroborate <hostRunDir>', wallTime: null });
   }
   return { runId: run.runId, incomplete: run.incomplete, rows, sources };
 }