@dzhechkov/harness-core 0.5.1 → 0.5.3

package/src/loop-trace.ts

@@ -60,6 +60,15 @@ export interface TraceSettleEvent {
   wallTime?: string | null;
 }
 
+/**
+ * WHICH CODE PATH was meant to write this file. A HINT, never a trust statement — the rendered
+ * script's flush is performed BY AN AGENT, which therefore controls these bytes before the file
+ * exists and could write any value here. It is deliberately NOT called `attestedBy`, so nothing in
+ * the codebase can read it as provenance (ADR-001 round 1 made exactly that mistake). The trust
+ * question is answered by `deriveAttestation`, from an artifact the sandboxed script cannot write.
+ */
+export type TraceEmitterPath = 'dz-process' | 'rendered-script';
+
 export interface TraceRunOpened {
   v: 1;
   runId: string;
@@ -67,6 +76,9 @@ export interface TraceRunOpened {
   event: 'run.opened';
   planDigest: string;
   execFp: string;
+  /** Optional ON THE WIRE (NFR-1): an older reader ignores it, a newer reader over an older trace
+   *  gets `unknown` — which is never `instrument`. */
+  emitterPath?: TraceEmitterPath;
 }
 
 export interface TraceRunClosed {
@@ -122,6 +134,10 @@ export function traceValidateEvent(e: unknown): string | null {
   }
   if (kind === 'run.opened') {
     if (typeof ev['planDigest'] !== 'string' || typeof ev['execFp'] !== 'string') return 'run.opened needs planDigest + execFp';
+    const ep = ev['emitterPath'];
+    // Absent is legal (NFR-1). Present-but-outside-the-union is a REFUSAL, not a downgrade: a value
+    // like 'trusted' is someone trying to say something the vocabulary does not permit.
+    if (ep !== undefined && ep !== 'dz-process' && ep !== 'rendered-script') return 'emitterPath must be dz-process|rendered-script';
     return null;
   }
   if (kind === 'run.closed') {
@@ -132,11 +148,17 @@ export function traceValidateEvent(e: unknown): string | null {
   return 'unknown event kind';
 }
 
-/** Open a trace state and buffer the run.opened frame. Throws on an invalid runId (fail-closed). */
-export function traceInit(runId: string, planDigest: string, execFp: string): TraceState {
+/**
+ * Open a trace state and buffer the run.opened frame. Throws on an invalid runId (fail-closed).
+ *
+ * `emitterPath` is REQUIRED and has NO DEFAULT, on purpose: a default would be chosen once, by
+ * whoever added the parameter, and every future caller that forgot it would silently inherit that
+ * choice. A missing argument must be a compile error instead.
+ */
+export function traceInit(runId: string, planDigest: string, execFp: string, emitterPath: TraceEmitterPath): TraceState {
   if (!TRACE_RUNID_RE.test(runId)) throw new Error('loop-trace: runId fails ' + String(TRACE_RUNID_RE));
   const state: TraceState = { runId, seq: 0, dispatched: 0, settled: 0, buffer: [] };
-  const opened: TraceRunOpened = { v: 1, runId, seq: ++state.seq, event: 'run.opened', planDigest, execFp };
+  const opened: TraceRunOpened = { v: 1, runId, seq: ++state.seq, event: 'run.opened', planDigest, execFp, emitterPath };
   traceBuffer(state, opened);
   return state;
 }
@@ -314,6 +336,11 @@ export interface TraceRun {
   /** No run.closed frame ⇒ the tail may be lost; truncated-window invariants report inconclusive. */
   incomplete: boolean;
   parseErrors: string[];
+  /** The self-declared HINT (see TraceEmitterPath) — null when absent. NEVER read as provenance. */
+  emitterPath: TraceEmitterPath | null;
+  /** Two `run.opened` frames that DISAGREE. The scan used to keep the last one silently, which
+   *  would let a spliced frame overwrite the genuine one; a conflict now forbids `instrument`. */
+  openConflict: boolean;
 }
 
 /**
@@ -339,7 +366,7 @@ export interface TraceRun {
  * the only ordering the file can still testify to. INV-14 fails such a trace on uniqueness anyway.
  */
 export function parseTrace(text: string): TraceRun {
-  const run: TraceRun = { runId: null, planDigest: null, execFp: null, events: [], incomplete: true, parseErrors: [] };
+  const run: TraceRun = { runId: null, planDigest: null, execFp: null, events: [], incomplete: true, parseErrors: [], emitterPath: null, openConflict: false };
   const scanned: TraceEvent[] = [];
   for (const line of String(text ?? '').split('\n')) {
     const t = line.trim();
@@ -364,9 +391,22 @@ export function parseTrace(text: string): TraceRun {
   const dispatchSeen = new Set<string>();
   for (const ev of scanned) {
     if (ev.event === 'run.opened') {
+      const prior = run.events.some((p) => p.event === 'run.opened');
+      if (prior) {
+        const disagrees =
+          run.runId !== ev.runId ||
+          run.planDigest !== ev.planDigest ||
+          run.execFp !== ev.execFp ||
+          run.emitterPath !== (ev.emitterPath ?? null);
+        if (disagrees) {
+          run.openConflict = true;
+          run.parseErrors.push('conflicting run.opened frames — refusing to prefer either (ADR-001)');
+        }
+      }
       run.runId = ev.runId;
       run.planDigest = ev.planDigest;
       run.execFp = ev.execFp;
+      run.emitterPath = ev.emitterPath ?? null;
     }
     if (ev.event === 'run.closed') run.incomplete = false;
     if (ev.event === 'dispatched') {
@@ -386,12 +426,84 @@ export function parseTrace(text: string): TraceRun {
   return run;
 }
 
+/**
+ * ATTESTATION — the trust question, answered by the READER, never by the file.
+ *
+ * `instrument` means, EXACTLY (ADR-001 round 3, wording taken from the cross-family reviewer):
+ * *the bytes read match the identifiers, the hash and the line count asserted by the co-located
+ * `run-state.json`.* It does NOT mean `dz` historically wrote those bytes, nor that this is the
+ * directory it wrote them in. A byte-identical replay passes. Copying the matched trace+run-state
+ * pair elsewhere passes. Both are accepted and tested, not patched.
+ *
+ * What it DOES buy: `run-state.json` is written by the dz process, and the rendered script runs in a
+ * sandbox with no filesystem — so an agent that mis-writes, truncates, reorders or invents its
+ * flush cannot reach `instrument`. What it cannot buy: a defence against an actor with write access
+ * to the run directory. On this machine the agent IS such an actor and the signing key is readable
+ * by the same account, so no local artifact — signature included — closes that. Named, not hidden.
+ *
+ * `unknown` is kept DISTINCT from `agent` (a legacy instrument run, a stripped field and explicit
+ * agent testimony are different facts) while sharing its conservative tier for every decision.
+ */
+export type TraceAttestation = 'instrument' | 'agent' | 'unknown';
+
+/** The subset of `run-state.json` the attestation reads. Unknown-shaped input is not an error — it
+ *  simply fails to bind, which yields `unknown`. */
+export interface TraceRunStateBinding {
+  runId?: unknown;
+  planDigest?: unknown;
+  execFp?: unknown;
+  traceSha256?: unknown;
+  traceLines?: unknown;
+}
+
+/** What the CALLER measured about the trace text it actually read. Passed in rather than computed
+ *  here so this module keeps its zero dependencies (no node:crypto) and stays trivially testable. */
+export interface TraceObserved {
+  sha256: string;
+  lines: number;
+}
+
+export function deriveAttestation(run: TraceRun, state: TraceRunStateBinding | null | undefined, observed: TraceObserved): TraceAttestation {
+  // A conflict between two run.opened frames forbids the favourable reading outright: preferring
+  // either one is exactly the silent choice this feature exists to remove.
+  if (run.openConflict) return 'unknown';
+  // QE round 1 / H1: EVERY bound value must be non-empty. Equality alone let a trace whose
+  // planDigest and execFp are both '' bind against a state carrying the same two empty strings —
+  // an "identity" that identifies nothing. A binding over absent values is not a binding.
+  const nonEmpty = (a: unknown, b: unknown): boolean => typeof a === 'string' && a !== '' && a === b;
+  const bound =
+    state != null &&
+    nonEmpty(state.runId, run.runId) &&
+    nonEmpty(state.planDigest, run.planDigest) &&
+    nonEmpty(state.execFp, run.execFp) &&
+    // CONTENT binding, not just identifiers: a legacy run-state with no traceSha256 can never mint
+    // `instrument` (that was the reviewer's stale-directory counterexample).
+    nonEmpty(state.traceSha256, observed.sha256) &&
+    typeof state.traceLines === 'number' && state.traceLines === observed.lines;
+  if (bound) return 'instrument';
+  if (run.emitterPath === 'rendered-script') return 'agent';
+  return 'unknown';
+}
+
 export type InvariantStatus = 'pass' | 'fail' | 'inconclusive';
 
 export interface InvariantVerdict {
   id: string;
   status: InvariantStatus;
   message: string;
+  /**
+   * FR-3 — the qualifier travels IN the verdict, never beside it. A caller that stores a verdict
+   * and reads it back later must not be able to end up holding a bare `pass` whose attestation was
+   * dropped in transit. Optional only so a caller that has not derived one is a compile-time
+   * possibility; `stampAttestation` is how the reader attaches it.
+   */
+  attestation?: TraceAttestation;
+}
+
+/** Attach one attestation to every verdict in a batch. Kept as a named function rather than a spread
+ *  at each call site so a NEW verdict producer cannot silently ship unstamped verdicts. */
+export function stampAttestation(verdicts: InvariantVerdict[], attestation: TraceAttestation): InvariantVerdict[] {
+  return verdicts.map((v) => ({ ...v, attestation }));
 }
 
 interface Invocation {
@@ -697,7 +809,12 @@ export interface Timeline {
 /**
  * Merge one timeline: trace.jsonl is the AUTHORITATIVE order (rows sorted by seq); checkpoints,
  * cost-ledger lines and usageEvents are appended as unordered context rows (seq 0); journal.jsonl
- * contributes DIAGNOSTIC agentId correlation only, never ordering (the ACL of 04 §8).
+ * contributes a DIAGNOSTIC LINE COUNT only, never ordering (the ACL of 04 §8).
+ *
+ * Honesty fix (2026-08-20): this note used to promise "agentId correlation", which the code never
+ * did — it counts lines. A comment claiming an analysis that does not exist is the same defect class
+ * this feature was built to remove, one layer up. The real correlation now lives in
+ * `trace-corroborate.ts`, behind `dz workflow-trace --corroborate`, where it is scoped and tested.
  */
 export function assembleTimeline(input: {
   trace: string;
@@ -749,7 +866,7 @@ export function assembleTimeline(input: {
     sources.push('journal (diagnostic only — never ordering)');
     let n = 0;
     for (const line of input.journal.split('\n')) if (line.trim() !== '') n++;
-    rows.push({ seq: 0, kind: 'journal', label: 'journal', detail: `${n} host-journal line(s) — agentId correlation only; the host journal carries no seq/ts and NEVER orders this timeline`, wallTime: null });
+    rows.push({ seq: 0, kind: 'journal', label: 'journal', detail: n + ' host-journal line(s) — COUNT only; the host journal carries no seq/ts and NEVER orders this timeline. For an actual comparison run: dz workflow-trace --corroborate <hostRunDir>', wallTime: null });
   }
   return { runId: run.runId, incomplete: run.incomplete, rows, sources };
 }

package/src/trace-corroborate.ts

@@ -0,0 +1,205 @@
+/**
+ * `trace-corroborate` — the Claude host's OWN records, for the half of a trace they can witness.
+ *
+ * ADR-002. Pure over already-read strings: no `fs`, so it is testable with fixtures alone.
+ *
+ * The design is shaped by one MEASURED fact and one refuted design. The fact: the trace and the
+ * host's `journal.jsonl` share NO identifier — trace dispatch events carry `invocationId` /
+ * `stepId`, the journal carries `agentId` and a `v2:<sha>` key. There is no run nonce to bind them
+ * with, and we do not control the host's format, so DIRECTORY CONTAINMENT is the only binding
+ * available and every result says so. The refuted design: a bare `agrees` over "agent set +
+ * wall-clock order", which a cross-family reviewer defeated with a trace that matched on agents
+ * while inventing a join, a gate redo, a typed pause and a file deliverable — every consequential
+ * claim fabricated, the verdict green. Hence `agreesWithinScope`, and hence `notWitnessed` being
+ * non-empty BY TYPE rather than by discipline.
+ */
+
+/** Non-empty by construction: a tuple type, so no edit can empty it and silently unscope a result. */
+export type NotWitnessed = readonly ['join', 'gate-redo', 'typed-pause', 'file-deliverable'];
+export const NOT_WITNESSED: NotWitnessed = ['join', 'gate-redo', 'typed-pause', 'file-deliverable'] as const;
+
+export type WitnessedClaim = 'agent-multiset' | 'agent-count' | 'wall-clock-order';
+export const WITNESSED: readonly WitnessedClaim[] = ['agent-multiset', 'agent-count', 'wall-clock-order'] as const;
+
+/** Deliberately NOT `agrees`. The scope lives in the word, so a stored verdict carries it too. */
+export type CorroborationVerdict = 'agreesWithinScope' | 'disagrees' | 'inconclusive';
+
+export interface CorroborationResult {
+  verdict: CorroborationVerdict;
+  /** The ONLY binding available — see the module note. Never omitted. */
+  binding: 'by-directory';
+  hostDir: string;
+  witnessed: readonly WitnessedClaim[];
+  notWitnessed: NotWitnessed;
+  /** Why, in words, for the human-readable report. */
+  detail: string;
+  /** Counts, so a caller can render the disagreement rather than re-deriving it. */
+  traceAgentCount: number;
+  hostAgentCount: number;
+}
+
+/** One host record set, already read from disk by the caller. */
+export interface HostRecords {
+  /** Raw `journal.jsonl` text, or null when the file is absent/unreadable. */
+  journal: string | null;
+  /** Raw `agent-<id>.jsonl` texts, keyed by agent id. Empty when none were found. */
+  agentTranscripts: Record<string, string>;
+}
+
+/** The trace side, projected by the caller: the agent ids the trace claims took part, in order. */
+export interface TraceAgentProjection {
+  agentIds: string[];
+}
+
+/**
+ * Read the agent ids the host journal STARTED, or null when the journal cannot be trusted to be
+ * complete. QE round 1 closed three ways this used to lie:
+ *   H4 — a `started` row whose `agentId` is not a string was silently DROPPED, so a malformed row
+ *        that may well represent a real extra agent made the sets look equal.
+ *   M2 — a non-empty journal with zero usable start rows returned `[]`, and an empty trace then
+ *        "agreed" with it. A journal that records no starts is not evidence that none happened.
+ *   M3 — `JSON.parse('null')` is valid JSON, and indexing the result threw.
+ */
+function journalAgentIds(journal: string): string[] | null {
+  const ids: string[] = [];
+  let sawAny = false;
+  for (const line of journal.split('\n')) {
+    const t = line.trim();
+    if (t === '') continue;
+    sawAny = true;
+    let o: unknown;
+    try {
+      o = JSON.parse(t);
+    } catch {
+      // A malformed journal is INCONCLUSIVE, not "the agents we could still parse". A partially
+      // readable independent record is not an independent record.
+      return null;
+    }
+    // M3: `null`, a number and a string are all valid JSON and none of them are records.
+    if (typeof o !== 'object' || o === null || Array.isArray(o)) return null;
+    const rec = o as Record<string, unknown>;
+    if (rec['type'] !== 'started') continue;
+    // H4: a start row we cannot read is a start row we cannot account for.
+    if (typeof rec['agentId'] !== 'string' || rec['agentId'] === '') return null;
+    ids.push(rec['agentId']);
+  }
+  // M2: a non-empty journal that yielded no starts tells us nothing about how many agents ran.
+  if (!sawAny || ids.length === 0) return null;
+  return ids;
+}
+
+/**
+ * The FIRST readable timestamp in a transcript, or null when the answer cannot be trusted.
+ *
+ * QE round 1 / M1: this used to skip unparseable lines and keep scanning. But an unparseable line
+ * EARLIER in the file may carry an earlier timestamp — so a corrupt prefix does not just cost us a
+ * line, it invalidates the whole "first" claim. Returning the next readable stamp presents a
+ * possibly-late time as the earliest one, which is exactly how a wrong order reads as right.
+ */
+function firstTimestamp(text: string): number | null {
+  for (const line of text.split('\n')) {
+    const t = line.trim();
+    if (t === '') continue;
+    let o: unknown;
+    try {
+      o = JSON.parse(t);
+    } catch {
+      return null; // a corrupt line before any stamp ⇒ the earliest is unknowable
+    }
+    if (typeof o !== 'object' || o === null || Array.isArray(o)) return null;
+    const ts = (o as Record<string, unknown>)['timestamp'];
+    if (typeof ts === 'string') {
+      const ms = Date.parse(ts);
+      if (Number.isFinite(ms)) return ms;
+    }
+  }
+  return null;
+}
+
+function multisetEqual(a: string[], b: string[]): boolean {
+  if (a.length !== b.length) return false;
+  const count = new Map<string, number>();
+  for (const x of a) count.set(x, (count.get(x) ?? 0) + 1);
+  for (const x of b) {
+    const n = count.get(x);
+    if (n === undefined || n === 0) return false;
+    count.set(x, n - 1);
+  }
+  return true;
+}
+
+export function corroborate(trace: TraceAgentProjection, host: HostRecords, hostDir: string): CorroborationResult {
+  const base = {
+    binding: 'by-directory' as const,
+    hostDir,
+    witnessed: WITNESSED,
+    notWitnessed: NOT_WITNESSED,
+    traceAgentCount: trace.agentIds.length,
+  };
+
+  if (host.journal === null) {
+    return { ...base, verdict: 'inconclusive', hostAgentCount: 0, detail: 'no host journal at ' + hostDir + ' — absent evidence is never agreement' };
+  }
+  const hostIds = journalAgentIds(host.journal);
+  if (hostIds === null) {
+    return { ...base, verdict: 'inconclusive', hostAgentCount: 0, detail: 'the host journal is empty or malformed — a partially readable record is not an independent one' };
+  }
+
+  // COUNT and MULTISET before ordering: a mismatch here is a real disagreement, and comparing the
+  // order of two different sets would be meaningless anyway.
+  if (!multisetEqual(trace.agentIds, hostIds)) {
+    return {
+      ...base,
+      verdict: 'disagrees',
+      hostAgentCount: hostIds.length,
+      detail: `the trace claims ${trace.agentIds.length} agent run(s), the host journal records ${hostIds.length}` +
+        (trace.agentIds.length === hostIds.length ? ' — same count, different ids' : ''),
+    };
+  }
+
+  // Wall-clock order, from the per-agent transcripts (the journal carries no ts). An agent with no
+  // readable timestamp makes the ORDER unwitnessable — inconclusive, not a pass on the rest.
+  //
+  // QE round 1 / M4: `host.agentTranscripts[id]` walks the PROTOTYPE, so an agent literally named
+  // `__proto__` (or `constructor`, `toString`, …) read a function off Object.prototype and threw.
+  // An own-property check is the fix; the id is data from an outside file and must be treated as such.
+  const own = (o: Record<string, string>, k: string): string | undefined =>
+    Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined;
+
+  const stamps: Array<{ id: string; at: number }> = [];
+  for (const id of hostIds) {
+    const text = own(host.agentTranscripts, id);
+    const at = typeof text !== 'string' ? null : firstTimestamp(text);
+    if (at === null) {
+      return { ...base, verdict: 'inconclusive', hostAgentCount: hostIds.length, detail: `no readable timestamp for agent ${id} — the wall-clock order cannot be witnessed` };
+    }
+    stamps.push({ id, at });
+  }
+
+  // QE round 1 / H3: two agents sharing a timestamp make their relative order UNKNOWABLE. A stable
+  // sort preserved the journal's own order and reported agreement — the sort's tie-breaking rule
+  // was silently doing duty as evidence.
+  const sorted = [...stamps].sort((a, b) => a.at - b.at);
+  for (let i = 1; i < sorted.length; i++) {
+    if (sorted[i]!.at === sorted[i - 1]!.at) {
+      return { ...base, verdict: 'inconclusive', hostAgentCount: hostIds.length, detail: `agents ${sorted[i - 1]!.id} and ${sorted[i]!.id} share a timestamp — their relative order cannot be witnessed` };
+    }
+  }
+
+  // QE round 1 / H2: compare ELEMENT-WISE. `join('|')` collapsed ['x','x|x'] and ['x|x','x'] to the
+  // same string, so a reversed order read as agreement — a delimiter chosen for display doing duty
+  // as an equality operator.
+  const byClock = sorted.map((sv) => sv.id);
+  const orderMatches = byClock.length === trace.agentIds.length && byClock.every((id, i) => id === trace.agentIds[i]);
+  if (!orderMatches) {
+    return { ...base, verdict: 'disagrees', hostAgentCount: hostIds.length, detail: 'the host wall-clock order of the agents differs from the order the trace claims' };
+  }
+
+  return {
+    ...base,
+    verdict: 'agreesWithinScope',
+    hostAgentCount: hostIds.length,
+    detail: 'the host records agree on which agents ran and in what order. They CANNOT witness ' +
+      NOT_WITNESSED.join(', ') + ' — a fabricated one of those would still land here, which is why this is never a bare "agrees"',
+  };
+}

package/src/workflow-run.ts

@@ -112,6 +112,15 @@ export interface WfRunOwner {
 
 export interface WfRunState {
   schema: typeof WF_RUN_STATE_SCHEMA;
+  /**
+   * CONTENT binding for the attestation (feature honest-trace-provenance, ADR-001 round 3).
+   * Identifiers alone were not enough: a fabricated trace dropped beside a genuine run-state with
+   * matching ids satisfied the binding, which is exactly the counterexample that failed round 2.
+   * Optional because a state written before this feature has none — and a state with NO binding can
+   * never mint `instrument`, which is the fail-closed direction.
+   */
+  traceSha256?: string;
+  traceLines?: number;
   owner: WfRunOwner;
   status: 'running' | 'paused' | 'completed' | 'failed';
   runId: string;
@@ -895,6 +904,9 @@ export interface RunStore {
    * instead would make a diagnostic field load-bearing (the W10 mistake).
    */
   readTraceText(): string | null;
+  /** sha256 + non-empty line count of trace.jsonl AS IT NOW STANDS ON DISK, or null when absent.
+   *  Impure by nature (hashing a file), so it lives behind the store seam like every other fs read. */
+  measureTrace(): { sha256: string; lines: number } | null;
   readRunState(): WfRunState | null;
   /** Atomic in the fs impl (temp + rename): a half-written state is a foreign run forever. */
   writeRunState(s: WfRunState): void;
@@ -1279,6 +1291,7 @@ export async function runWorkflow(inputs: RunnerInputs, pre: PreflightOk, deps:
   ctx.state.status = 'completed';
   ctx.state.completedSteps = pre.projection.boundaries.map((b) => b.boundaryId);
   ctx.state.updatedAt = deps.now();
+  stampTraceBinding(ctx.state, store);
   deps.lock(() => store.writeRunState(ctx.state));
   appendLedger(ctx, 'completed');
   return {
@@ -1302,7 +1315,9 @@ export async function runWorkflow(inputs: RunnerInputs, pre: PreflightOk, deps:
  * run rather than its last leg.
  */
 function openTrace(inputs: RunnerInputs, pre: PreflightOk, store: RunStore, resuming: boolean): { trace: TraceState; settleSeq: Record<string, number> } {
-  const st = traceInit(inputs.runId, pre.planDigest, pre.execFp);
+  // 'dz-process': this runner IS the dz process, and it appends trace.jsonl itself. The value is a
+  // fact about which code path is running, not a claim about trustworthiness — see ADR-001.
+  const st = traceInit(inputs.runId, pre.planDigest, pre.execFp, 'dz-process');
   if (!resuming) return { trace: st, settleSeq: {} };
   const priorText = store.readTraceText();
   if (priorText === null || priorText.trim() === '') return { trace: st, settleSeq: {} };
@@ -1656,6 +1671,19 @@ function checkpoint(ctx: RunCtx, b: RunBoundary, value: unknown): void {
   if (line !== null) ctx.deps.store.appendCheckpointLine(line);
 }
 
+/**
+ * THE ONE PLACE the content binding is refreshed. A helper rather than three inline copies, because
+ * three call sites mean three chances to forget — and a forgotten one degrades silently to
+ * `unknown` (fail-closed, but a real dz run would then read as un-attested).
+ * Called AFTER the final trace flush, so it describes the bytes a reader will actually see.
+ */
+function stampTraceBinding(state: WfRunState, store: RunStore): void {
+  const m = store.measureTrace();
+  if (m === null) return; // no trace ⇒ no binding to make; the reader will say `unknown`
+  state.traceSha256 = m.sha256;
+  state.traceLines = m.lines;
+}
+
 function appendLedger(ctx: RunCtx, outcome: string): void {
   const line = traceLedgerLine({
     slug: ctx.deps.slug ?? ctx.inputs.runId,
@@ -1683,6 +1711,7 @@ function pauseOutcome(ctx: RunCtx, b: RunBoundary, pauseState: string, reason: W
     reservationNote: detail,
   };
   ctx.state.updatedAt = ctx.deps.now();
+  stampTraceBinding(ctx.state, ctx.deps.store);
   ctx.deps.lock(() => ctx.deps.store.writeRunState(ctx.state));
   appendLedger(ctx, 'paused');
   return {
@@ -1699,6 +1728,7 @@ function terminalOutcome(ctx: RunCtx, route: string, _startedAt: string): RunOut
   flush(ctx); // NO traceClose: parity with the render's terminal return skipping the epilogue
   ctx.state.status = 'completed';
   ctx.state.updatedAt = ctx.deps.now();
+  stampTraceBinding(ctx.state, ctx.deps.store);
   ctx.deps.lock(() => ctx.deps.store.writeRunState(ctx.state));
   appendLedger(ctx, route);
   return {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 dzhechko
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.