@entrorove/skill 0.1.37 → 0.1.38

package/runtime/validator-runtime-v7.0.44.mjs

@@ -0,0 +1,1362 @@
+// Generated by scripts/build-validator-domain.mjs from the pinned Validator base and first-party logic.
+// Generated by scripts/build-validator-runtime.mjs from first-party Validator source modules.
+const PUBLIC_BIND_ADDRESSES = new Set(['0.0.0.0', '::', '[::]', '0:0:0:0:0:0:0:0'])
+const BIND_OPTION = /^(?:host|hostname|bind|bindhost|bindaddress|listenhost|listenaddress)$/i
+const BIND_METHODS = new Set(['listen', 'bind'])
+const SCRIPT_EXTENSION = /\.(?:[cm]?[jt]sx?)$/i
+
+function decodeHostLiteral(value) {
+  return value.replace(/\\(?:u\{([0-9a-f]+)\}|u([0-9a-f]{4})|x([0-9a-f]{2})|(.))/gi,
+    (match, point, unicode, byte, character) => {
+      const digits = point ?? unicode ?? byte
+      if (digits === undefined) return character
+      const code = parseInt(digits, 16)
+      return code <= 0x10ffff ? String.fromCodePoint(code) : match
+    })
+}
+
+function quotedToken(source, start) {
+  const quote = source[start]
+  let end = start + 1
+  while (end < source.length) {
+    if (source[end] === '\\') { end += 2; continue }
+    if (source[end] === quote) {
+      return { kind: 'literal', value: decodeHostLiteral(source.slice(start + 1, end)), start, end: end + 1 }
+    }
+    end += 1
+  }
+  return { kind: 'invalid', value: source.slice(start), start, end: source.length }
+}
+
+function templateTokens(source, start) {
+  const tokens = []
+  let index = start + 1
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue }
+    if (source[index] === '`') {
+      if (tokens.length === 0) tokens.push(quotedToken(source, start))
+      return { tokens, end: index + 1 }
+    }
+    if (source[index] === '$' && source[index + 1] === '{') {
+      const expression = codeTokens(source, index + 2, true)
+      tokens.push(...expression.tokens)
+      index = expression.end
+      continue
+    }
+    index += 1
+  }
+  return { tokens, end: source.length }
+}
+
+function codeTokens(source, start = 0, templateExpression = false) {
+  const tokens = []
+  let depth = 0
+  for (let index = start; index < source.length;) {
+    const tail = source.slice(index)
+    const ignored = tail.match(/^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$))/)
+    if (ignored) { index += ignored[0].length; continue }
+    if (source[index] === '`') {
+      const template = templateTokens(source, index)
+      tokens.push(...template.tokens)
+      index = template.end
+      continue
+    }
+    if (['"', "'"].includes(source[index])) {
+      const token = quotedToken(source, index)
+      tokens.push(token)
+      index = token.end
+      continue
+    }
+    if (source[index] === '}' && templateExpression && depth === 0) return { tokens, end: index + 1 }
+    if (source[index] === '{') depth += 1
+    if (source[index] === '}') depth -= 1
+    const word = tail.match(/^[A-Za-z_$][\w$]*/)
+    const value = word === null ? source[index] : word[0]
+    tokens.push({ kind: word === null ? 'symbol' : 'word', value, start: index, end: index + value.length })
+    index += value.length
+  }
+  return { tokens, end: source.length }
+}
+
+function bindHost(token, aliases) {
+  if (token === undefined) return false
+  return token.kind === 'literal' ? PUBLIC_BIND_ADDRESSES.has(token.value)
+    : token.kind === 'word' && aliases.has(token.value)
+}
+
+function publicAliases(tokens) {
+  const aliases = new Set()
+  let changed = true
+  while (changed) {
+    changed = false
+    for (let index = 0; index < tokens.length - 2; index += 1) {
+      const token = tokens[index]
+      if (token.kind === 'word' && tokens[index + 1].value === '='
+        && bindHost(tokens[index + 2], aliases) && !aliases.has(token.value)) {
+        aliases.add(token.value)
+        changed = true
+      }
+    }
+  }
+  return aliases
+}
+
+function callArguments(tokens, opening) {
+  const args = [[]]
+  let depth = 0
+  for (let index = opening + 1; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token.value === ')' && depth === 0) return args
+    if (token.value === ',' && depth === 0) { args.push([]); continue }
+    args[args.length - 1].push(token)
+    if (['(', '[', '{'].includes(token.value)) depth += 1
+    if ([')', ']', '}'].includes(token.value)) depth -= 1
+  }
+  return []
+}
+
+function scriptBindSites(source) {
+  const { tokens } = codeTokens(source)
+  const aliases = publicAliases(tokens)
+  const sites = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    const normalized = token.value.replaceAll('_', '').replaceAll('-', '')
+    if (BIND_OPTION.test(normalized) && [':', '='].includes(tokens[index + 1]?.value)
+      && bindHost(tokens[index + 2], aliases)) {
+      sites.push({ offset: token.start, context: 'bind-option', address: tokens[index + 2].value })
+    }
+    if (!BIND_METHODS.has(token.value)) continue
+    let opening = index + 1
+    if (tokens[index - 1]?.value === '[' && tokens[opening]?.value === ']') opening += 1
+    if (tokens[opening]?.value === '?' && tokens[opening + 1]?.value === '.') opening += 2
+    if (tokens[opening]?.value !== '(') continue
+    const args = callArguments(tokens, opening)
+    const hosts = token.value === 'bind' ? args.slice(0, 2).flat() : args[1]
+    if (hosts === undefined) continue
+    const publicHost = hosts.find((candidate) => bindHost(candidate, aliases))
+    if (publicHost) sites.push({ offset: token.start, context: `${token.value}-argument`, address: publicHost.value })
+  }
+  return sites
+}
+
+function configurationBindSites(source) {
+  const sites = []
+  const pattern = /(?:\b(?:host|hostname|bind(?:[_-]?(?:host|address))?|listen(?:[_-]?(?:host|address))?)\b["']?\s*(?:[:=]\s*|\s+)|--(?:host|bind|listen)(?:=|\s+))["']?(0\.0\.0\.0|\[::\]|::)(?=["'\s:;,]|$)/gi
+  for (const match of source.matchAll(pattern)) {
+    const lineStart = source.lastIndexOf('\n', match.index) + 1
+    if (/^\s*(?:#|\/\/)/.test(source.slice(lineStart, match.index))) continue
+    sites.push({ offset: match.index, context: 'bind-configuration', address: match[1] })
+  }
+  return sites
+}
+
+/** Inspect bind sinks and host configuration; address lists and outbound targets are not listeners. */
+function publicBindSites(path, source) {
+  const sites = SCRIPT_EXTENSION.test(path) ? scriptBindSites(source) : configurationBindSites(source)
+  return sites.map((site) => ({
+    ...site, line: source.slice(0, site.offset).split('\n').length,
+  }))
+}
+
+const { brainRunnerContractSchema, validateBridgeContracts } = (() => {
+const SHA_PATTERN = '^[0-9a-f]{64}$'
+const UUID_PATTERN = '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+const SHA = new RegExp(SHA_PATTERN)
+const UUID = new RegExp(UUID_PATTERN)
+const FIELDS = ['schemaVersion', 'planId', 'planSha256', 'reportId', 'reportSha256',
+  'checksSha256', 'scopeContractSha256', 'snapshotSha256', 'adapterSha256']
+
+const brainRunnerContractSchema = {
+  type: 'object', additionalProperties: false, required: FIELDS,
+  properties: {
+    schemaVersion: { const: 'brain.frozen-runner/1.0' },
+    planId: { type: 'string', pattern: UUID_PATTERN }, reportId: { type: 'string', pattern: UUID_PATTERN },
+    ...Object.fromEntries(FIELDS.filter((field) => field.endsWith('Sha256'))
+      .map((field) => [field, { type: 'string', pattern: SHA_PATTERN }])),
+  },
+}
+
+function validBrainRunnerContract(value, subject) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('|') !== [...FIELDS].sort().join('|')
+    || value.schemaVersion !== 'brain.frozen-runner/1.0'
+    || !UUID.test(value.planId) || !UUID.test(value.reportId)
+    || value.planId !== subject.planId || subject.chainId !== 'chn-' + value.reportId
+    || subject.validationRunId !== 'brain-' + value.reportId) return false
+  return FIELDS.filter((field) => field.endsWith('Sha256')).every((field) => typeof value[field] === 'string' && SHA.test(value[field]))
+}
+
+function validateBridgeContracts(value, entityRef, hardened, utilities) {
+  const { isObj, text, idRegex, shaRegex, finding } = utilities
+  const findings = []
+  if (hardened && (!isObj(value.contracts) || (!isObj(value.contracts.aimlock)
+    && !validBrainRunnerContract(value.contracts.brain, value)))) findings.push(finding("P0", "VALIDATION-SUBJECT-SNAPSHOT", `${entityRef}.contracts`, "Hardened validation requires an Aimlock snapshot or server frozen Brain contract binding"));
+  if (value.contracts?.brain !== undefined && !validBrainRunnerContract(value.contracts.brain, value)) findings.push(finding("P0", "VALIDATION-SUBJECT-BRAIN", `${entityRef}.contracts.brain`, "Brain runner contract is invalid or bound to another execution"));
+  if (value.contracts !== undefined && (!isObj(value.contracts)
+    || (value.contracts.aimlock !== undefined && (!isObj(value.contracts.aimlock)
+      || !idRegex.test(text(value.contracts.aimlock.goalId))
+      || !shaRegex.test(text(value.contracts.aimlock.scopeContractSha256))
+      || !shaRegex.test(text(value.contracts.aimlock.snapshotSha256))))
+    || (value.contracts.blueprint !== undefined && (!isObj(value.contracts.blueprint)
+      || !idRegex.test(text(value.contracts.blueprint.blueprintId))
+      || !shaRegex.test(text(value.contracts.blueprint.acceptanceReportSha256))))
+    || (value.contracts.archguard !== undefined && (!isObj(value.contracts.archguard)
+      || !shaRegex.test(text(value.contracts.archguard.contractSha256))
+      || !shaRegex.test(text(value.contracts.archguard.ledgerSha256))
+      || !["green", "yellow", "red"].includes(value.contracts.archguard.driftStatus))))) findings.push(finding("P0", "VALIDATION-SUBJECT-CONTRACTS", `${entityRef}.contracts`, "Aimlock, Blueprint, and ArchGuard bridge contracts require stable ids, SHA-256 digests, and a valid drift status"));
+  return findings
+}
+
+return { brainRunnerContractSchema, validateBridgeContracts }; })();
+
+
+import { createHash, createPublicKey, verify as verifySignature } from "node:crypto";
+
+const REQ = "validator.skill.request/1.0";
+const RES = "validator.skill.response/1.0";
+const ERR = "validator.skill.error/1.0";
+const NAME = "validator";
+const COMPILER_VERSION = "v7.0.43";
+const CATALOG_SCHEMA = "entrorove.skill-catalog/1.0";
+const RECEIPT_SCHEMA = "validator.execution-receipt/1.0";
+const VALIDATION_SUBJECT_SCHEMA = "validator.validation-subject/1.0";
+const GOLDEN_BASELINE_SCHEMA = "validator.golden-baseline/1.0";
+const TEST_EVIDENCE_SCHEMA = "entrorove.test-evidence/2.0";
+const RECEIPT_PUBLIC_KEY_ENV = "ENTROROVE_VALIDATOR_RECEIPT_PUBLIC_KEY";
+const MAX_RECEIPT_LIFETIME_MS = 10 * 60 * 1000;
+const ID_PATTERN = "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$";
+const MEMBER_PATTERN = "^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$";
+const CHAIN_PATTERN = "^chn-[0-9a-f-]{36}$";
+const SHA_PATTERN = "^[0-9a-f]{64}$";
+const idRegex = new RegExp(ID_PATTERN);
+const memberRegex = new RegExp(MEMBER_PATTERN);
+const chainRegex = new RegExp(CHAIN_PATTERN);
+const shaRegex = new RegExp(SHA_PATTERN);
+
+const OPS = ["capabilities","help","intake","plan","validate-structure","security-scan","compliance-audit","functional-verify","sandbox-run","fuzz-input","perf-benchmark","intrusive-test","verdict"];
+const PURE = new Set(["capabilities","help","intake","plan","validate-structure","security-scan","compliance-audit","functional-verify","verdict"]);
+const LOCAL_ONLY = new Set(["sandbox-run","fuzz-input","perf-benchmark","intrusive-test"]);
+const CATALOG = OPS.map((operation) => ({ operation, summary: operation }));
+
+const stringSchema = (extra = {}) => ({ type: "string", ...extra });
+const arraySchema = (items, extra = {}) => ({ type: "array", items, ...extra });
+const objectSchema = (properties, required = [], extra = {}) => ({
+  type: "object", properties, required, additionalProperties: false, ...extra,
+});
+const anyObjectSchema = { type: "object" };
+const findingSchema = objectSchema({
+  severity: { enum: ["P0", "P1", "P2"] }, ruleId: stringSchema({ minLength: 1 }),
+  entityRef: stringSchema({ minLength: 1 }), message: stringSchema({ minLength: 1 }),
+  evidence: anyObjectSchema,
+}, ["severity", "ruleId", "entityRef", "message", "evidence"]);
+const receiptSchema = objectSchema({
+  schemaVersion: { const: RECEIPT_SCHEMA }, keyId: stringSchema({ pattern: SHA_PATTERN }),
+  nonce: stringSchema({ pattern: ID_PATTERN, minLength: 16, maxLength: 128 }), subjectDigest: stringSchema({ pattern: SHA_PATTERN }),
+  issuedAt: stringSchema({ format: "date-time" }), expiresAt: stringSchema({ format: "date-time" }),
+  result: objectSchema({ runner: { const: "trusted-runner" }, passed: { type: "boolean" },
+    exitCode: { type: "integer" }, durationMs: { type: "number", minimum: 0 },
+    summary: stringSchema({ minLength: 1 }) }, ["runner", "passed", "exitCode", "durationMs", "summary"]),
+  signature: stringSchema({ minLength: 1 }),
+}, ["schemaVersion", "keyId", "nonce", "subjectDigest", "issuedAt", "expiresAt", "result", "signature"]);
+const baselineSchema = objectSchema({
+  schemaVersion: { const: GOLDEN_BASELINE_SCHEMA }, baselineId: stringSchema({ pattern: ID_PATTERN }),
+  source: objectSchema({ kind: { enum: ["repository-commit", "artifact", "approved-record"] },
+    locator: stringSchema({ minLength: 1 }), digestSha256: stringSchema({ pattern: SHA_PATTERN }) },
+  ["kind", "locator", "digestSha256"]),
+  version: stringSchema({ pattern: ID_PATTERN }), frozen: { const: true },
+  frozenAt: stringSchema({ format: "date-time" }), frozenBy: stringSchema({ pattern: ID_PATTERN }),
+  testsSha256: stringSchema({ pattern: SHA_PATTERN }),
+}, ["schemaVersion", "baselineId", "source", "version", "frozen", "frozenAt", "frozenBy", "testsSha256"]);
+const contractsSchema = objectSchema({
+  brain: brainRunnerContractSchema,
+  aimlock: objectSchema({ goalId: stringSchema({ pattern: ID_PATTERN }),
+    scopeContractSha256: stringSchema({ pattern: SHA_PATTERN }), snapshotSha256: stringSchema({ pattern: SHA_PATTERN }) },
+  ["goalId", "scopeContractSha256", "snapshotSha256"]),
+  blueprint: objectSchema({ blueprintId: stringSchema({ pattern: ID_PATTERN }),
+    acceptanceReportSha256: stringSchema({ pattern: SHA_PATTERN }) }, ["blueprintId", "acceptanceReportSha256"]),
+  archguard: objectSchema({ contractSha256: stringSchema({ pattern: SHA_PATTERN }),
+    ledgerSha256: stringSchema({ pattern: SHA_PATTERN }),
+    driftStatus: { enum: ["green", "yellow", "red"] } },
+  ["contractSha256", "ledgerSha256", "driftStatus"]),
+});
+const validationFileSchema = objectSchema({
+  path: stringSchema({ minLength: 1, maxLength: 500 }),
+  sha256: stringSchema({ pattern: SHA_PATTERN }),
+}, ["path", "sha256"]);
+const subjectSchema = objectSchema({
+  schemaVersion: { const: VALIDATION_SUBJECT_SCHEMA }, artifactSha256: stringSchema({ pattern: SHA_PATTERN }),
+  memberId: stringSchema({ pattern: MEMBER_PATTERN }), chainId: stringSchema({ pattern: CHAIN_PATTERN }),
+  executedAt: stringSchema({ format: "date-time" }), files: arraySchema(validationFileSchema, { minItems: 1 }),
+  validationRunId: stringSchema({ pattern: ID_PATTERN }), planId: stringSchema({ pattern: ID_PATTERN }),
+  tests: arraySchema(anyObjectSchema, { minItems: 1 }), policy: anyObjectSchema,
+  goldenBaseline: baselineSchema, contracts: contractsSchema,
+}, ["schemaVersion", "artifactSha256", "validationRunId", "planId", "tests", "policy", "goldenBaseline"]);
+const testEvidenceProperties = {
+  schemaVersion: { const: TEST_EVIDENCE_SCHEMA }, evidenceId: stringSchema({ pattern: ID_PATTERN }),
+  kind: { enum: ["test", "build", "lint", "security", "benchmark"] }, command: stringSchema({ minLength: 1 }),
+  exitCode: { type: "integer" }, durationMs: { type: "number", minimum: 0 },
+  summary: stringSchema({ minLength: 1 }), artifactSha256: stringSchema({ pattern: SHA_PATTERN }),
+  subject: subjectSchema, subjectDigest: stringSchema({ pattern: SHA_PATTERN }), receipt: receiptSchema,
+};
+const testEvidenceRequired = ["schemaVersion", "evidenceId", "kind", "runner", "command", "exitCode", "durationMs", "summary"];
+const testEvidenceSchema = {
+  oneOf: [
+    objectSchema({ ...testEvidenceProperties, runner: { const: "local" } }, testEvidenceRequired),
+    objectSchema({ ...testEvidenceProperties, runner: { const: "trusted-runner" } },
+      [...testEvidenceRequired, "artifactSha256", "subject", "subjectDigest", "receipt"]),
+  ],
+};
+const riskEntrySchema = objectSchema({
+  riskId: stringSchema({ pattern: ID_PATTERN }), findingRuleId: stringSchema({ minLength: 1 }),
+  findingEntityRef: stringSchema({ minLength: 1 }), owner: stringSchema({ pattern: ID_PATTERN }),
+  mitigation: stringSchema({ minLength: 1 }), acceptedBy: stringSchema({ pattern: ID_PATTERN }),
+  acceptedAt: stringSchema({ format: "date-time" }),
+}, ["riskId", "findingRuleId", "findingEntityRef", "owner", "mitigation", "acceptedBy", "acceptedAt"]);
+const repairCategorySchema = {
+  enum: ["structure-schema", "formula-calculation", "scope-drift", "execution-dispatch", "validator-self"],
+};
+const fileSchema = objectSchema({ path: stringSchema({ minLength: 1 }), content: stringSchema(), schema: anyObjectSchema }, ["path", "content"]);
+const nextSchema = objectSchema({ operation: { type: ["string", "null"] }, instruction: stringSchema() }, ["operation", "instruction"]);
+const responseSchema = (properties, required) => objectSchema({
+  schemaVersion: { const: RES }, requestId: stringSchema({ minLength: 1 }), status: { enum: ["succeeded", "blocked", "failed"] }, ...properties,
+}, ["schemaVersion", "requestId", "status", ...required]);
+const operationSchema = (input, inputRequired, output, outputRequired) => ({
+  input: objectSchema(input, inputRequired), output: responseSchema(output, outputRequired),
+});
+const LEGACY_VALIDATOR_SCHEMAS = Object.freeze({
+  capabilities: operationSchema({}, [], { capabilities: anyObjectSchema, skill: anyObjectSchema, operationSchemas: anyObjectSchema, nextStep: nextSchema }, ["capabilities", "skill", "operationSchemas", "nextStep"]),
+  help: operationSchema({}, [], { help: anyObjectSchema, operationSchemas: anyObjectSchema, nextStep: nextSchema }, ["help", "operationSchemas", "nextStep"]),
+  intake: operationSchema({ goal: stringSchema({ minLength: 1 }), riskLevel: { enum: ["low", "medium", "high"] }, complianceReqs: arraySchema(stringSchema()), targetFiles: arraySchema(stringSchema()) }, ["goal", "riskLevel"], { intake: anyObjectSchema, nextStep: nextSchema }, ["intake", "nextStep"]),
+  plan: operationSchema({ findings: arraySchema(findingSchema), findingCategories: arraySchema(repairCategorySchema), intakeResult: anyObjectSchema, availableSkills: arraySchema(stringSchema()) }, ["intakeResult"], { plan: anyObjectSchema, nextStep: nextSchema }, ["plan", "nextStep"]),
+  "validate-structure": operationSchema({ files: arraySchema(fileSchema, { minItems: 1 }), rules: arraySchema(anyObjectSchema) }, ["files"], { findings: arraySchema(findingSchema), summary: anyObjectSchema, nextStep: nextSchema }, ["findings", "summary", "nextStep"]),
+  "security-scan": operationSchema({ files: arraySchema(fileSchema, { minItems: 1 }), rules: arraySchema(anyObjectSchema) }, ["files"], { findings: arraySchema(findingSchema), summary: anyObjectSchema, nextStep: nextSchema }, ["findings", "summary", "nextStep"]),
+  "compliance-audit": operationSchema({ files: arraySchema(fileSchema, { minItems: 1 }), template: stringSchema({ minLength: 1 }), requirements: arraySchema(stringSchema()) }, ["files", "template"], { findings: arraySchema(findingSchema), template: stringSchema(), nextStep: nextSchema }, ["findings", "template", "nextStep"]),
+  "functional-verify": operationSchema({ validationContext: subjectSchema, receipts: arraySchema(receiptSchema, { minItems: 1 }) }, ["validationContext", "receipts"], { subject: subjectSchema, subjectDigest: stringSchema({ pattern: SHA_PATTERN }), results: arraySchema(anyObjectSchema), summary: anyObjectSchema, findings: arraySchema(findingSchema), evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["subject", "subjectDigest", "results", "summary", "findings", "evidence", "nextStep"]),
+  "sandbox-run": operationSchema({ command: stringSchema({ minLength: 1 }), files: arraySchema(fileSchema), timeout: { type: "number", minimum: 0 }, networkPolicy: { enum: ["block", "allow"] } }, ["command", "networkPolicy"], { sandbox: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["sandbox", "runner", "evidence", "nextStep"]),
+  "fuzz-input": operationSchema({ targetFile: stringSchema({ minLength: 1 }), cases: arraySchema(anyObjectSchema), maxCases: { type: "integer", minimum: 1 } }, ["targetFile", "maxCases"], { fuzz: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["fuzz", "runner", "evidence", "nextStep"]),
+  "perf-benchmark": operationSchema({ command: stringSchema({ minLength: 1 }), baseline: baselineSchema, threshold: { type: "number", minimum: 0 } }, ["command", "baseline", "threshold"], { benchmark: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["benchmark", "runner", "evidence", "nextStep"]),
+  "intrusive-test": operationSchema({ authorization: { type: "boolean" }, tests: arraySchema(anyObjectSchema, { minItems: 1 }), sandbox: { const: true } }, ["authorization", "tests", "sandbox"], { intrusive: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["intrusive", "runner", "evidence", "nextStep"]),
+  verdict: operationSchema({ expectedSubject: subjectSchema, validationContext: subjectSchema, findings: arraySchema(findingSchema), evidence: arraySchema(testEvidenceSchema), riskLedger: arraySchema(riskEntrySchema) }, [], { report: anyObjectSchema, findings: arraySchema(findingSchema), evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["report", "findings", "evidence", "nextStep"]),
+});
+
+function text(value) { return String(value ?? ""); }
+function isObj(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
+function finding(severity, ruleId, entityRef, message, evidence) {
+  return { severity, ruleId, entityRef, message, evidence: evidence === undefined ? {} : { example: evidence } };
+}
+function ok(requestId, payload) { return { schemaVersion: RES, requestId, status: "succeeded", ...payload }; }
+function blocked(requestId, findings) { return { schemaVersion: RES, requestId, status: "blocked", validation: { valid: false, guarantee: "blocked", findings } }; }
+function failed(requestId, code, message) { return { schemaVersion: RES, requestId, status: "failed", errorSchema: ERR, error: { code, message } }; }
+function requiredText(input, key) {
+  const value = text(input[key]).trim();
+  return value ? { value } : { error: finding("P0", "REQUIRED", `input.${key}`, `${key} is required`) };
+}
+function requiredArray(input, key, minimum = 0) {
+  if (!Array.isArray(input[key]) || input[key].length < minimum) return { error: finding("P0", "REQUIRED", `input.${key}`, `${key} must contain at least ${minimum} item(s)`) };
+  return { value: input[key] };
+}
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("Evidence must contain finite numbers");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (!isObj(value)) throw new TypeError("Evidence must be JSON serializable");
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+export function validatorReceiptSubject(value) { return createHash("sha256").update(canonicalJson(value)).digest("hex"); }
+export function validatorArtifactSubject(files) {
+  const manifest = files.map((file) => `${file.path}\0${file.sha256}`).join("\n");
+  return createHash("sha256").update(`validator.file-manifest/1.0\n${manifest}`).digest("hex");
+}
+export function validatorReceiptPayload(receipt) {
+  if (!isObj(receipt)) throw new TypeError("Execution receipt must be an object");
+  const { signature: _signature, ...payload } = receipt;
+  return canonicalJson(payload);
+}
+
+function validateGoldenBaseline(value, entityRef, tests) {
+  const findings = [];
+  if (!isObj(value)) return [finding("P0", "GOLDEN-BASELINE-REQUIRED", entityRef, "A frozen golden baseline is required")];
+  if (value.schemaVersion !== GOLDEN_BASELINE_SCHEMA) findings.push(finding("P0", "GOLDEN-BASELINE-SCHEMA", `${entityRef}.schemaVersion`, `Expected ${GOLDEN_BASELINE_SCHEMA}`));
+  if (!idRegex.test(text(value.baselineId)) || !idRegex.test(text(value.version)) || !idRegex.test(text(value.frozenBy))) findings.push(finding("P0", "GOLDEN-BASELINE-ID", entityRef, "baselineId, version, and frozenBy must be stable identifiers"));
+  if (value.frozen !== true || !Number.isFinite(Date.parse(text(value.frozenAt)))) findings.push(finding("P0", "GOLDEN-BASELINE-FROZEN", entityRef, "Baseline must be frozen with a valid timestamp"));
+  if (!isObj(value.source) || !["repository-commit", "artifact", "approved-record"].includes(value.source.kind)
+    || !text(value.source.locator).trim() || !shaRegex.test(text(value.source.digestSha256))) findings.push(finding("P0", "GOLDEN-BASELINE-SOURCE", `${entityRef}.source`, "Baseline requires traceable source, locator, and SHA-256"));
+  if (!shaRegex.test(text(value.testsSha256)) || value.testsSha256 !== validatorReceiptSubject(tests)) findings.push(finding("P0", "GOLDEN-BASELINE-TESTS", `${entityRef}.testsSha256`, "Frozen tests digest does not match subject tests"));
+  return findings;
+}
+function legacyValidatorreadValidationSubject(value, entityRef) {
+  if (!isObj(value)) return { findings: [finding("P0", "VALIDATION-SUBJECT-REQUIRED", entityRef, "A validation subject is required")] };
+  const findings = [];
+  const allowed = new Set(["schemaVersion", "memberId", "chainId", "executedAt", "files", "artifactSha256", "validationRunId", "planId", "tests", "policy", "goldenBaseline", "contracts"]);
+  const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+  if (unknown.length) findings.push(finding("P0", "VALIDATION-SUBJECT-FIELDS", entityRef, `Unknown fields: ${unknown.join(", ")}`));
+  if (value.schemaVersion !== VALIDATION_SUBJECT_SCHEMA) findings.push(finding("P0", "VALIDATION-SUBJECT-SCHEMA", `${entityRef}.schemaVersion`, `Expected ${VALIDATION_SUBJECT_SCHEMA}`));
+  if (!shaRegex.test(text(value.artifactSha256))) findings.push(finding("P0", "VALIDATION-SUBJECT-ARTIFACT", `${entityRef}.artifactSha256`, "artifactSha256 must be lowercase SHA-256"));
+  for (const key of ["validationRunId", "planId"]) if (!idRegex.test(text(value[key]))) findings.push(finding("P0", "VALIDATION-SUBJECT-ID", `${entityRef}.${key}`, `${key} must be stable`));
+  if (!Array.isArray(value.tests) || value.tests.length === 0) findings.push(finding("P0", "VALIDATION-SUBJECT-TESTS", `${entityRef}.tests`, "tests must be non-empty"));
+  if (!isObj(value.policy) || !text(value.policy.command).trim() || !Number.isInteger(value.policy.requiredExitCode)) findings.push(finding("P0", "VALIDATION-SUBJECT-POLICY", `${entityRef}.policy`, "policy requires command and requiredExitCode"));
+  const hardenedFields = ["memberId", "chainId", "executedAt", "files"];
+  const hardened = hardenedFields.some((key) => value[key] !== undefined);
+  if (hardened) {
+    if (!memberRegex.test(text(value.memberId))) findings.push(finding("P0", "VALIDATION-SUBJECT-MEMBER", `${entityRef}.memberId`, "memberId must be a stable member identifier"));
+    if (!chainRegex.test(text(value.chainId))) findings.push(finding("P0", "VALIDATION-SUBJECT-CHAIN", `${entityRef}.chainId`, "chainId must be a valid member chain identifier"));
+    if (!Number.isFinite(Date.parse(text(value.executedAt)))) findings.push(finding("P0", "VALIDATION-SUBJECT-EXECUTED-AT", `${entityRef}.executedAt`, "executedAt must be a valid timestamp"));
+    if (!Array.isArray(value.files) || value.files.length === 0) findings.push(finding("P0", "VALIDATION-SUBJECT-FILES", `${entityRef}.files`, "files must be a non-empty normalized manifest"));
+    else {
+      for (const [index, file] of value.files.entries()) {
+        const path = text(file?.path);
+        const normalized = path === path.normalize("NFC") && !/[\u0000-\u001f\u007f]/.test(path)
+          && !path.startsWith("/") && !path.includes("\\")
+          && path.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+        if (!isObj(file) || !normalized || !shaRegex.test(text(file.sha256))) findings.push(finding("P0", "VALIDATION-SUBJECT-FILE", `${entityRef}.files[${index}]`, "Each file needs a normalized relative path and SHA-256"));
+        if (index > 0 && text(value.files[index - 1]?.path) >= path) findings.push(finding("P0", "VALIDATION-SUBJECT-FILE-ORDER", `${entityRef}.files[${index}].path`, "File paths must be unique and sorted"));
+      }
+      if (!findings.some((item) => item.ruleId.startsWith("VALIDATION-SUBJECT-FILE"))
+        && value.artifactSha256 !== validatorArtifactSubject(value.files)) findings.push(finding("P0", "VALIDATION-SUBJECT-ARTIFACT-MANIFEST", `${entityRef}.artifactSha256`, "Artifact digest does not match the file manifest"));
+    }
+  }
+  findings.push(...validateBridgeContracts(value, entityRef, hardened, { isObj, text, idRegex, shaRegex, finding }));
+  if (Array.isArray(value.tests)) findings.push(...validateGoldenBaseline(value.goldenBaseline, `${entityRef}.goldenBaseline`, value.tests));
+  try { canonicalJson(value); } catch (error) { findings.push(finding("P0", "VALIDATION-SUBJECT-JSON", entityRef, error instanceof Error ? error.message : "Invalid JSON")); }
+  return findings.length ? { findings } : { value };
+}
+function expectedValidationSubject(input) {
+  if (input.expectedSubject === undefined && input.validationContext === undefined) return readValidationSubject(undefined, "input.expectedSubject");
+  const expected = input.expectedSubject === undefined ? null : readValidationSubject(input.expectedSubject, "input.expectedSubject");
+  const context = input.validationContext === undefined ? null : readValidationSubject(input.validationContext, "input.validationContext");
+  const findings = [...(expected?.findings ?? []), ...(context?.findings ?? [])];
+  if (findings.length) return { findings };
+  const value = expected?.value ?? context.value;
+  const digest = validatorReceiptSubject(value);
+  if (expected?.value && context?.value && digest !== validatorReceiptSubject(context.value)) return { findings: [finding("P0", "VALIDATION-SUBJECT-CONFLICT", "input.validationContext", "Targets differ")] };
+  return { value, digest };
+}
+
+function configuredReceiptKey(input = {}) {
+  const encoded = text(input.receiptPublicKey).trim() || text(process.env[RECEIPT_PUBLIC_KEY_ENV]).trim();
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) return null;
+  try {
+    const der = Buffer.from(encoded, "base64");
+    const key = createPublicKey({ key: der, format: "der", type: "spki" });
+    return key.asymmetricKeyType === "ed25519" ? { key, keyId: createHash("sha256").update(der).digest("hex") } : null;
+  } catch { return null; }
+}
+function verifiedReceipt(receipt, subjectDigest, subject, input = {}) {
+  const configured = configuredReceiptKey(input);
+  if (!configured || !isObj(receipt) || receipt.schemaVersion !== RECEIPT_SCHEMA) return null;
+  const result = receipt.result;
+  const issuedAt = Date.parse(text(receipt.issuedAt));
+  const expiresAt = Date.parse(text(receipt.expiresAt));
+  const executedAt = subject.executedAt === undefined ? null : Date.parse(text(subject.executedAt));
+  const now = Date.now();
+  if (receipt.keyId !== configured.keyId || receipt.subjectDigest !== subjectDigest || !idRegex.test(text(receipt.nonce))
+    || !Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || issuedAt > now + 60_000 || expiresAt <= now
+    || (executedAt !== null && (!Number.isFinite(executedAt) || executedAt > issuedAt
+      || issuedAt - executedAt > MAX_RECEIPT_LIFETIME_MS))
+    || expiresAt <= issuedAt || expiresAt - issuedAt > MAX_RECEIPT_LIFETIME_MS || !isObj(result)
+    || result.runner !== "trusted-runner" || typeof result.passed !== "boolean" || !Number.isInteger(result.exitCode)
+    || typeof result.durationMs !== "number" || result.durationMs < 0 || !text(result.summary).trim()) return null;
+  try {
+    const signature = Buffer.from(text(receipt.signature), "base64url");
+    return verifySignature(null, Buffer.from(validatorReceiptPayload(receipt)), configured.key, signature) ? receipt : null;
+  } catch { return null; }
+}
+function createTestEvidence(receipt, subject, subjectDigest, index) {
+  return { schemaVersion: TEST_EVIDENCE_SCHEMA, evidenceId: `${subject.validationRunId}:${index}`, kind: "test",
+    runner: "trusted-runner", command: subject.policy.command, exitCode: receipt.result.exitCode,
+    durationMs: receipt.result.durationMs, summary: receipt.result.summary, artifactSha256: subject.artifactSha256,
+    subject, subjectDigest, receipt };
+}
+function legacyValidatorevidenceState(evidence, subject, subjectDigest, input = {}) {
+  if (!isObj(evidence) || evidence.schemaVersion !== TEST_EVIDENCE_SCHEMA || evidence.runner === "local") return "unverifiable";
+  let evidenceDigest;
+  try { evidenceDigest = validatorReceiptSubject(evidence.subject); } catch { return "unverifiable"; }
+  if (!idRegex.test(text(evidence.evidenceId)) || !["test", "build", "lint", "security", "benchmark"].includes(evidence.kind)
+    || evidence.runner !== "trusted-runner" || evidence.command !== subject.policy.command
+    || evidence.artifactSha256 !== subject.artifactSha256 || evidence.subjectDigest !== subjectDigest
+    || !isObj(evidence.subject) || evidenceDigest !== subjectDigest) return "unverifiable";
+  const receipt = verifiedReceipt(evidence.receipt, subjectDigest, subject, input);
+  if (!receipt || evidence.exitCode !== receipt.result.exitCode || evidence.durationMs !== receipt.result.durationMs
+    || evidence.summary !== receipt.result.summary) return "unverifiable";
+  return receipt.result.passed && receipt.result.exitCode === subject.policy.requiredExitCode ? "valid" : "failed";
+}
+
+const DEFAULT_SECURITY_RULES = [
+  { id: "SEC-EVAL", pattern: /\beval\s*\(|new\s+Function\b|\bFunction\s*\(/g, severity: "P0", fix: "Use controlled AST evaluation", executableOnly: true },
+  { id: "SEC-SECRETS", pattern: /(?:api[_-]?key|token|password|secret)\s*[:=]\s*['"][A-Za-z0-9_\-]{8,}/gi, severity: "P0", fix: "Remove hardcoded credentials" },
+  { id: "SEC-SQLI", pattern: /(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\+\s*(?:req\.|input\.|params\.)/gi, severity: "P0", fix: "Use parameterized queries" },
+  { id: "SEC-XSS", pattern: /innerHTML\s*=\s*(?!\s*['"`]\s*['"`])/g, severity: "P1", fix: "Use sanitized output" },
+];
+const DEFAULT_STRUCTURE_RULES = ["references-closed", "required-fields", "type-correct", "no-cycle"];
+function executableJavaScript(path) { return /\.(?:[cm]?[jt]sx?)$/i.test(path); }
+function stripJavaScriptInertText(source) {
+  let output = "";
+  let state = "code";
+  let quote = "";
+  for (let index = 0; index < source.length; index += 1) {
+    const character = source[index];
+    const next = source[index + 1];
+    if (state === "line") {
+      if (character === "\n") { state = "code"; output += "\n"; }
+      continue;
+    }
+    if (state === "block") {
+      if (character === "*" && next === "/") { state = "code"; index += 1; }
+      else if (character === "\n") output += "\n";
+      continue;
+    }
+    if (state === "string") {
+      if (character === "\\") { index += 1; continue; }
+      if (character === quote) { state = "code"; quote = ""; }
+      else if (character === "\n") output += "\n";
+      continue;
+    }
+    if (character === "/" && next === "/") { state = "line"; index += 1; continue; }
+    if (character === "/" && next === "*") { state = "block"; index += 1; continue; }
+    if (["'", '"', "`"].includes(character)) { state = "string"; quote = character; continue; }
+    output += character;
+  }
+  return output;
+}
+function runSecurityScan(files, rules = DEFAULT_SECURITY_RULES) {
+  const findings = [];
+  for (const file of files) for (const rule of rules) {
+    const path = text(file.path);
+    const content = rule.executableOnly
+      ? executableJavaScript(path) ? stripJavaScriptInertText(text(file.content)) : ""
+      : text(file.content);
+    const matches = content.match(rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, "g"));
+    if (matches) findings.push(finding(rule.severity, rule.id, text(file.path), `${matches.length} match(es): ${rule.fix}`, { sample: matches[0] }));
+  }
+  return findings;
+}
+function runStructureValidation(files) {
+  const findings = [];
+  for (const file of files) {
+    const path = text(file.path);
+    if (path.endsWith(".json")) try { JSON.parse(text(file.content)); } catch (error) { findings.push(finding("P0", "STR-JSON", path, error.message)); }
+    if (file.schema && path.endsWith(".json")) try {
+      const data = JSON.parse(text(file.content));
+      for (const field of file.schema.required ?? []) if (data[field] === undefined) findings.push(finding("P0", "STR-REQ", `${path}.${field}`, "Required field is missing"));
+    } catch { /* invalid JSON is reported above */ }
+  }
+  return findings;
+}
+function validateReq(request) {
+  const findings = [];
+  if (!isObj(request)) return [finding("P0", "REQ_OBJECT", "request", "request must be an object")];
+  if (request.schemaVersion !== REQ) findings.push(finding("P0", "REQ_SCHEMA", "request.schemaVersion", `Expected ${REQ}`));
+  if (!text(request.requestId).trim()) findings.push(finding("P0", "REQ_FIELD", "request.requestId", "requestId is required"));
+  if (!OPS.includes(request.operation)) findings.push(finding("P0", "REQ_OPERATION", "request.operation", "operation is unsupported"));
+  if (!isObj(request.input)) findings.push(finding("P0", "REQ_INPUT", "request.input", "input must be an object"));
+  return findings;
+}
+function severitySummary(findings) {
+  return { total: findings.length, p0: findings.filter((item) => item.severity === "P0").length,
+    p1: findings.filter((item) => item.severity === "P1").length,
+    p2: findings.filter((item) => item.severity === "P2").length };
+}
+const REPAIR_ROUTES = Object.freeze([
+  { category: "structure-schema", skill: "blueprint", action: "recompile-contract", trigger: "structure or schema mismatch", requiresHumanConfirmation: false },
+  { category: "formula-calculation", skill: "calctool", action: "repair-formula-engine", trigger: "formula or calculation mismatch", requiresHumanConfirmation: false },
+  { category: "scope-drift", skill: "aimlock", action: "relock-scope", trigger: "scope contract violation", requiresHumanConfirmation: false },
+  { category: "execution-dispatch", skill: "swarm", action: "repair-dispatch", trigger: "execution or dispatch failure", requiresHumanConfirmation: false },
+  { category: "validator-self", skill: "validator", action: "propose-validator-patch", trigger: "Validator rule or engine defect", requiresHumanConfirmation: true },
+]);
+
+function runMeta(requestId, operation) {
+  const operationStatus = { implementedPure: [...PURE], localRunnerRequired: [...LOCAL_ONLY], planned: ["mutation-testing"] };
+  const goldenPathExample = { operation: "functional-verify", input: { validationContext: "frozen ValidationSubject", receipts: "signed trusted-runner receipt[]" }, next: "verdict with entrorove.test-evidence/2.0" };
+  if (operation === "capabilities") return ok(requestId, { capabilities: { pure: false, stateless: true, operationStatus,
+    verdictLevels: ["pass", "pass-with-risk", "blocked", "incomplete"], testEvidenceSchema: TEST_EVIDENCE_SCHEMA,
+    goldenBaselineSchema: GOLDEN_BASELINE_SCHEMA, catalogSchema: CATALOG_SCHEMA }, operationSchemas: SCHEMAS,
+    goldenPathExample, skill: { name: NAME, version: COMPILER_VERSION }, nextStep: { operation: "intake", instruction: "Collect validation requirements." } });
+  return ok(requestId, { help: { name: NAME, version: COMPILER_VERSION, operations: CATALOG, operationStatus, goldenPathExample },
+    operationSchemas: SCHEMAS, nextStep: { operation: "intake", instruction: "Collect validation requirements." } });
+}
+function runLegacyValidatorPlanning(requestId, operation, input) {
+  if (operation === "intake") {
+    const goal = requiredText(input, "goal");
+    const risk = requiredText(input, "riskLevel");
+    if (goal.error || risk.error) return blocked(requestId, [goal.error, risk.error].filter(Boolean));
+    if (!["low", "medium", "high"].includes(risk.value)) return blocked(requestId, [finding("P0", "RISK-LEVEL", "input.riskLevel", "riskLevel must be low, medium, or high")]);
+    return ok(requestId, { intake: { goal: goal.value, riskLevel: risk.value, complianceReqs: input.complianceReqs, targetFiles: input.targetFiles }, nextStep: { operation: "plan", instruction: "Generate validation plan." } });
+  }
+  const risk = text(input.intakeResult?.riskLevel);
+  if (!["low", "medium", "high"].includes(risk)) return blocked(requestId, [finding("P0", "INTAKE-RESULT", "input.intakeResult", "A valid intakeResult is required")]);
+  const modules = ["validate-structure", "security-scan", "functional-verify"];
+  if (risk === "high") modules.push("compliance-audit", "sandbox-run", "intrusive-test");
+  else modules.push("fuzz-input");
+  modules.push("perf-benchmark", "verdict");
+  const available = Array.isArray(input.availableSkills) ? input.availableSkills : [];
+  const requestedCategories = Array.isArray(input.findingCategories) ? input.findingCategories : [];
+  const invalidCategory = requestedCategories.find((category) => !REPAIR_ROUTES.some((route) => route.category === category));
+  if (invalidCategory) return blocked(requestId, [finding("P0", "REPAIR-CATEGORY", "input.findingCategories", `Unsupported repair category: ${invalidCategory}`)]);
+  const selectedRoutes = requestedCategories.length
+    ? REPAIR_ROUTES.filter((route) => requestedCategories.includes(route.category)) : REPAIR_ROUTES;
+  const routing = selectedRoutes.map((route) => ({
+    ...route,
+    available: route.skill === "validator" || available.includes(route.skill),
+    invoke: route.skill !== "validator" && available.includes(route.skill),
+  }));
+  return ok(requestId, { plan: { modules, routing, routingPolicy: "deterministic-category-map",
+    riskLevel: risk, totalSteps: modules.length }, nextStep: { operation: modules[0], instruction: `Execute ${modules[0]}.` } });
+}
+function runStatic(requestId, operation, input) {
+  const files = requiredArray(input, "files", 1);
+  if (files.error) return blocked(requestId, [files.error]);
+  if (operation === "validate-structure") {
+    const findings = runStructureValidation(files.value);
+    return ok(requestId, { findings, summary: severitySummary(findings), line: "static", nextStep: { operation: "security-scan", instruction: "Run security scan." } });
+  }
+  if (operation === "security-scan") {
+    const findings = runSecurityScan(files.value, input.rules);
+    return ok(requestId, { findings, summary: severitySummary(findings), line: "static", nextStep: { operation: "functional-verify", instruction: "Run frozen golden baseline." } });
+  }
+  const template = requiredText(input, "template");
+  if (template.error) return blocked(requestId, [template.error]);
+  const findings = files.value.flatMap((file) => publicBindSites(text(file.path), text(file.content)).map((site) => finding("P1", "COMP-PORT", text(file.path), "Public bind requires review", site)));
+  return ok(requestId, { findings, template: template.value, nextStep: { operation: "functional-verify", instruction: "Run frozen golden baseline." } });
+}
+function runLegacyValidatorFunctional(requestId, input) {
+  const subject = readValidationSubject(input.validationContext, "input.validationContext");
+  if (subject.findings) return blocked(requestId, subject.findings);
+  const receipts = requiredArray(input, "receipts", 1);
+  if (receipts.error) return blocked(requestId, [finding("P0", "TRUSTED-RECEIPT-REQUIRED", "input.receipts", "Signed trusted-runner receipts are required")]);
+  const subjectDigest = validatorReceiptSubject(subject.value);
+  const verified = receipts.value.map((receipt) => verifiedReceipt(receipt, subjectDigest, subject.value, input));
+  if (verified.some((receipt) => receipt === null)) return blocked(requestId, [finding("P0", "INVALID-EXECUTION-RECEIPT", "input.receipts", "Receipt signature, lifetime, result, or subject is invalid")]);
+  const results = verified.map((receipt) => receipt.result);
+  const findings = results.flatMap((result, index) => result.passed && result.exitCode === subject.value.policy.requiredExitCode ? [] : [finding("P1", "GOLDEN-FAIL", `receipt:${index}`, "Frozen golden baseline failed", result)]);
+  const evidence = verified.map((receipt, index) => createTestEvidence(receipt, subject.value, subjectDigest, index));
+  return ok(requestId, { subject: subject.value, subjectDigest, results,
+    summary: { total: results.length, passed: results.length - findings.length, failed: findings.length },
+    runner: "trusted-runner", findings, evidence, nextStep: { operation: "verdict", instruction: "Render verdict from TestEvidence." } });
+}
+
+function runLegacyValidatorLocalProtocol(requestId, operation, input) {
+  if (operation === "intrusive-test" && input.authorization !== true) return blocked(requestId, [finding("P0", "INTRUSIVE-NO-AUTH", "input.authorization", "Explicit authorization is required")]);
+  const descriptor = operation === "fuzz-input" ? requiredText(input, "targetFile") : requiredText(input, "command");
+  if (descriptor.error && operation !== "intrusive-test") return blocked(requestId, [descriptor.error]);
+  const pending = { operation, status: "pending-execution", requestedTarget: descriptor.value };
+  const key = operation === "sandbox-run" ? "sandbox" : operation === "fuzz-input" ? "fuzz"
+    : operation === "perf-benchmark" ? "benchmark" : "intrusive";
+  return ok(requestId, { [key]: pending, runner: "local-only", evidence: [],
+    pendingEvidenceRequirements: { schemaVersion: TEST_EVIDENCE_SCHEMA, trustedReceiptRequiredForFinalPass: true },
+    nextStep: { operation: "verdict", instruction: "Local runner must return signed TestEvidence; pending is incomplete." } });
+}
+function validRiskLedger(findings, ledger) {
+  if (!Array.isArray(ledger)) return false;
+  return findings.filter((item) => item.severity === "P1").every((item) => ledger.some((entry) => isObj(entry)
+    && idRegex.test(text(entry.riskId)) && entry.findingRuleId === item.ruleId
+    && entry.findingEntityRef === item.entityRef
+    && idRegex.test(text(entry.owner)) && text(entry.mitigation).trim()
+    && idRegex.test(text(entry.acceptedBy)) && Number.isFinite(Date.parse(text(entry.acceptedAt)))));
+}
+function runLegacyValidatorVerdict(requestId, input) {
+  const expected = expectedValidationSubject(input);
+  if (expected.findings) return blocked(requestId, expected.findings);
+  const findings = Array.isArray(input.findings) ? input.findings : [];
+  const evidence = Array.isArray(input.evidence) ? input.evidence : [];
+  const states = evidence.map((item) => evidenceState(item, expected.value, expected.digest, input));
+  const failedCount = states.filter((state) => state === "failed").length;
+  const p0 = findings.filter((item) => item.severity === "P0").length;
+  const p1 = findings.filter((item) => item.severity === "P1").length;
+  const allValid = states.length > 0 && states.every((state) => state === "valid");
+  const riskLedgerValid = p1 === 0 || validRiskLedger(findings, input.riskLedger);
+  const level = p0 > 0 || failedCount > 0 ? "blocked"
+    : !allValid || !riskLedgerValid ? "incomplete" : p1 > 0 ? "pass-with-risk" : "pass";
+  const report = { verdict: level, subjectDigest: expected.digest, findings: severitySummary(findings),
+    evidenceCount: evidence.length, evidenceValid: allValid,
+    evidenceSummary: { valid: states.filter((state) => state === "valid").length, failed: failedCount,
+      pending: 0, unverifiable: states.filter((state) => state === "unverifiable").length },
+    riskLedgerValid, riskLedger: input.riskLedger };
+  return ok(requestId, { report, findings, evidence,
+    nextStep: level === "blocked" ? { operation: "plan", instruction: "Repair blocking failures." }
+      : level === "incomplete" ? { operation: "verdict", instruction: "Provide trusted evidence and complete P1 risk ledger." }
+        : { operation: null, instruction: `Verdict: ${level}.` } });
+}
+
+export async function run(request) {
+  const validationFindings = validateReq(request);
+  if (validationFindings.length) return { ...blocked(request?.requestId ?? "unknown", validationFindings), errorSchema: ERR };
+  const { requestId, operation, input } = request;
+  if (operation === "capabilities" || operation === "help") return runMeta(requestId, operation);
+  if (operation === "intake" || operation === "plan") return runPlanning(requestId, operation, input);
+  if (["validate-structure", "security-scan", "compliance-audit"].includes(operation)) return runStatic(requestId, operation, input);
+  if (operation === "functional-verify") return runFunctional(requestId, input);
+  if (LOCAL_ONLY.has(operation)) return runLocalProtocol(requestId, operation, input);
+  if (operation === "verdict") return runVerdict(requestId, input);
+  return failed(requestId, "UNSUPPORTED_OPERATION", `Unsupported operation: ${operation}`);
+}
+
+export { COMPILER_VERSION, NAME, OPS, PURE, CATALOG, SCHEMAS, GOLDEN_BASELINE_SCHEMA,
+  TEST_EVIDENCE_SCHEMA, DEFAULT_SECURITY_RULES, DEFAULT_STRUCTURE_RULES,
+  runSecurityScan, runStructureValidation };
+
+// First-party Validator logic: value.mjs
+import { createHash as validatorHash } from 'node:crypto';
+
+const VALIDATOR_SHA = /^[0-9a-f]{64}$/;
+const VALIDATOR_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const VALIDATOR_KINDS = ['test', 'build', 'lint', 'security', 'benchmark'];
+const VALIDATOR_RUNNERS = ['local', 'trusted-runner', 'sandbox'];
+const validatorObject = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+  && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+const validatorText = value => typeof value === 'string' && value.trim().length > 0;
+function validatorDate(value) {
+  if (typeof value !== 'string') return NaN;
+  const match = value.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|([+-])(\d{2}):(\d{2}))$/);
+  if (!match) return NaN;
+  const [, year, month, day, hour, minute, second, , offsetHour = '0', offsetMinute = '0'] = match;
+  const days = new Date(Date.UTC(Number(year), Number(month), 0)).getUTCDate();
+  if (Number(month) < 1 || Number(month) > 12 || Number(day) < 1 || Number(day) > days
+    || Number(hour) > 23 || Number(minute) > 59 || Number(second) > 59 || Number(offsetHour) > 23 || Number(offsetMinute) > 59) return NaN;
+  const instant = Date.parse(value);
+  return Number.isFinite(instant) && instant >= 0 ? instant : NaN;
+}
+
+function validatorCanonical(value) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return JSON.stringify(value);
+  if (typeof value === 'number' && Number.isFinite(value)) return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(validatorCanonical).join(',')}]`;
+  if (!validatorObject(value)) throw new Error('Validator data must contain finite JSON values');
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${validatorCanonical(value[key])}`).join(',')}}`;
+}
+const validatorDigest = value => validatorHash('sha256').update(validatorCanonical(value)).digest('hex');
+const validatorHashBytes = value => validatorHash('sha256').update(value).digest('hex');
+const validatorDiagnostic = (ruleId, entityRef, message, severity = 'P0') =>
+  ({ severity, ruleId, entityRef, message, evidence: {} });
+
+
+// First-party Validator logic: subject.mjs
+
+function validatorBaselineFindings(baseline, tests, now) {
+  if (!validatorObject(baseline)) return [validatorDiagnostic('GOLDEN-BASELINE-REQUIRED', 'subject.goldenBaseline', 'Frozen baseline is missing', 'P2')];
+  const findings = [];
+  if (Object.keys(baseline).some(key => !['schemaVersion', 'baselineId', 'source', 'version', 'frozen', 'frozenAt', 'frozenBy', 'testsSha256'].includes(key))) {
+    findings.push(validatorDiagnostic('GOLDEN-BASELINE-FROZEN', 'subject.goldenBaseline', 'Frozen baseline has unknown fields'));
+  }
+  if (baseline.schemaVersion !== 'validator.golden-baseline/1.0' || baseline.frozen !== true
+    || !['baselineId', 'version', 'frozenBy'].every(key => VALIDATOR_ID.test(baseline[key] ?? ''))) {
+    findings.push(validatorDiagnostic('GOLDEN-BASELINE-FROZEN', 'subject.goldenBaseline', 'Frozen baseline identity is invalid'));
+  }
+  const frozenAt = validatorDate(baseline.frozenAt);
+  if (!Number.isFinite(frozenAt) || frozenAt > now) findings.push(validatorDiagnostic('GOLDEN-BASELINE-TIME', 'subject.goldenBaseline.frozenAt', 'Baseline must already be frozen'));
+  if (!validatorObject(baseline.source) || !['repository-commit', 'artifact', 'approved-record'].includes(baseline.source.kind)
+    || Object.keys(baseline.source).some(key => !['kind', 'locator', 'digestSha256'].includes(key))
+    || !validatorText(baseline.source.locator) || baseline.source.locator.length > 2000 || !VALIDATOR_SHA.test(baseline.source.digestSha256 ?? '')) {
+    findings.push(validatorDiagnostic('GOLDEN-BASELINE-SOURCE', 'subject.goldenBaseline.source', 'Frozen baseline source is invalid'));
+  }
+  let testsDigest;
+  try { testsDigest = validatorDigest(tests); } catch { testsDigest = null; }
+  if (baseline.testsSha256 !== testsDigest) findings.push(validatorDiagnostic('GOLDEN-BASELINE-TESTS', 'subject.goldenBaseline.testsSha256', 'Frozen tests changed or are not finite JSON'));
+  return findings;
+}
+
+function validatorManifestFindings(subject) {
+  const findings = [];
+  if (!Array.isArray(subject.files) || subject.files.length === 0) {
+    return [validatorDiagnostic('VALIDATION-MANIFEST-MISSING', 'subject.files', 'Independent evidence requires an actual file manifest', 'P2')];
+  }
+  if (subject.files.length > 10_000) return [validatorDiagnostic('VALIDATION-SUBJECT-FILE', 'subject.files', 'Manifest exceeds its bounded file count')];
+  for (const [index, file] of subject.files.entries()) {
+    const name = file?.path;
+    if (!validatorObject(file) || typeof name !== 'string' || name !== name.normalize('NFC') || name !== name.trim()
+      || /[\u0000-\u001f\u007f\\:]/.test(name) || /^[~\/]/.test(name)
+      || name.split('/').some(part => !part || part === '.' || part === '..')
+      || Object.keys(file).sort().join('|') !== 'path|sha256'
+      || !VALIDATOR_SHA.test(file.sha256 ?? '') || (index > 0 && String(subject.files[index - 1]?.path ?? '') >= name)) {
+      findings.push(validatorDiagnostic('VALIDATION-SUBJECT-FILE', `subject.files.${index}`, 'Manifest paths and hashes must be normalized, sorted and unique'));
+    }
+  }
+  if (!findings.length) {
+    const manifest = subject.files.map(file => `${file.path}\0${file.sha256}`).join('\n');
+    const artifact = validatorHashBytes(Buffer.from(`validator.file-manifest/1.0\n${manifest}`));
+    if (subject.artifactSha256 !== artifact) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-ARTIFACT-MANIFEST', 'subject.artifactSha256', 'Frozen artifact manifest changed'));
+  }
+  return findings;
+}
+
+function validatorContractFindings(subject) {
+  const contracts = subject.contracts;
+  if (!validatorObject(contracts) || (!validatorObject(contracts.aimlock) && !validatorObject(contracts.brain))) {
+    return [validatorDiagnostic('VALIDATION-SUBJECT-SNAPSHOT', 'subject.contracts', 'A frozen scope or Brain binding is required')];
+  }
+  const findings = [];
+  const specs = { aimlock: ['scopeContractSha256', 'snapshotSha256'], blueprint: ['acceptanceReportSha256'], archguard: ['contractSha256', 'ledgerSha256'] };
+  for (const [name, fields] of Object.entries(specs)) if (contracts[name] !== undefined) {
+    if (!validatorObject(contracts[name]) || !fields.every(key => VALIDATOR_SHA.test(contracts[name][key] ?? ''))) {
+      findings.push(validatorDiagnostic('VALIDATION-SUBJECT-CONTRACTS', `subject.contracts.${name}`, 'Frozen contract digests are invalid'));
+    }
+  }
+  if (contracts.aimlock && !VALIDATOR_ID.test(contracts.aimlock.goalId ?? '')) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-CONTRACTS', 'subject.contracts.aimlock', 'Scope goal is invalid'));
+  if (contracts.blueprint && !VALIDATOR_ID.test(contracts.blueprint.blueprintId ?? '')) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-CONTRACTS', 'subject.contracts.blueprint', 'Blueprint identity is invalid'));
+  if (contracts.archguard && !['green', 'yellow', 'red'].includes(contracts.archguard.driftStatus)) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-CONTRACTS', 'subject.contracts.archguard', 'Architecture drift status is invalid'));
+  if (contracts.archguard?.driftStatus === 'red') findings.push(validatorDiagnostic('SCOPE-DRIFT', 'subject.contracts.archguard', 'Frozen architecture reports red drift'));
+  if (contracts.brain) {
+    const brain = contracts.brain;
+    const fields = ['planSha256', 'reportSha256', 'checksSha256', 'scopeContractSha256', 'snapshotSha256', 'adapterSha256'];
+    if (brain.schemaVersion !== 'brain.frozen-runner/1.0' || brain.planId !== subject.planId
+      || subject.chainId !== `chn-${brain.reportId}` || subject.validationRunId !== `brain-${brain.reportId}`
+      || !fields.every(key => VALIDATOR_SHA.test(brain[key] ?? ''))) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-BRAIN', 'subject.contracts.brain', 'Frozen Brain binding changed'));
+  }
+  return findings;
+}
+
+function validateValidatorSubject(subject, { now = Date.now() } = {}) {
+  if (!validatorObject(subject)) return { subject: null, digest: null, findings: [validatorDiagnostic('VALIDATION-SUBJECT-MISSING', 'subject', 'No validation subject is available', 'P2')], valid: false };
+  const findings = [];
+  const allowed = ['schemaVersion', 'memberId', 'chainId', 'executedAt', 'files', 'artifactSha256', 'validationRunId', 'planId', 'tests', 'policy', 'goldenBaseline', 'contracts', 'execution', 'equivalence', 'disciplineComparison'];
+  if (Object.keys(subject).some(key => !allowed.includes(key)) || subject.schemaVersion !== 'validator.validation-subject/1.0') findings.push(validatorDiagnostic('VALIDATION-SUBJECT-SCHEMA', 'subject', 'Validation subject schema is invalid'));
+  if (!['planId', 'validationRunId'].every(key => VALIDATOR_ID.test(subject[key] ?? ''))) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-ID', 'subject', 'Frozen execution identity is invalid'));
+  if (!validatorObject(subject.policy) || !validatorText(subject.policy.command) || subject.policy.requiredExitCode !== 0) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-POLICY', 'subject.policy', 'Frozen policy requires a command and zero success exit code'));
+  if (!Array.isArray(subject.tests) || subject.tests.length === 0) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-TESTS', 'subject.tests', 'Frozen tests must be nonempty'));
+  else findings.push(...validatorBaselineFindings(subject.goldenBaseline, subject.tests, now));
+  findings.push(...validatorManifestFindings(subject));
+  findings.push(...validatorEquivalenceFindings(subject), ...validatorDisciplineFindings(subject));
+  if (Array.isArray(subject.files) && subject.files.length > 0) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/.test(subject.memberId ?? '') || !/^chn-[0-9a-f-]{36}$/.test(subject.chainId ?? '')) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-SCOPE', 'subject', 'Frozen member or chain binding is invalid'));
+    if (!Number.isFinite(validatorDate(subject.executedAt)) || validatorDate(subject.executedAt) > now + 60_000) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-EXECUTED-AT', 'subject.executedAt', 'Execution timestamp is invalid'));
+    findings.push(...validatorContractFindings(subject));
+    if (Array.isArray(subject.tests) && subject.tests.some(test => !validatorObject(test)
+      || !VALIDATOR_ID.test(test.testId ?? '') || !subject.files.some(file => file?.path === test.path))) {
+      findings.push(validatorDiagnostic('GOLDEN-BASELINE-TESTS', 'subject.tests', 'Frozen tests must bind actual manifest files'));
+    }
+    const source = subject.goldenBaseline?.source;
+    if (subject.goldenBaseline && Date.parse(subject.goldenBaseline.frozenAt) > Date.parse(subject.executedAt)) {
+      findings.push(validatorDiagnostic('GOLDEN-BASELINE-TIME', 'subject.goldenBaseline.frozenAt', 'Baseline must be frozen before execution'));
+    }
+    if (source?.kind === 'artifact' && subject.files.some(file => file?.path === source.locator && file?.sha256 !== source.digestSha256)) {
+      findings.push(validatorDiagnostic('GOLDEN-BASELINE-SOURCE', 'subject.goldenBaseline.source', 'Frozen baseline source differs from manifest'));
+    }
+  }
+  if (subject.execution !== undefined && (!validatorObject(subject.execution)
+    || Object.keys(subject.execution).some(key => !['exitCode', 'signal', 'timedOut', 'outputLimitExceeded'].includes(key))
+    || (subject.execution.exitCode !== null && !Number.isInteger(subject.execution.exitCode))
+    || (subject.execution.signal !== null && !validatorText(subject.execution.signal))
+    || typeof subject.execution.timedOut !== 'boolean' || typeof subject.execution.outputLimitExceeded !== 'boolean')) {
+    findings.push(validatorDiagnostic('VALIDATION-SUBJECT-EXECUTION', 'subject.execution', 'Signed execution result is invalid'));
+  }
+  try { return { subject, digest: validatorDigest(subject), findings, valid: findings.length === 0 }; }
+  catch { return { subject, digest: null, findings: [...findings, validatorDiagnostic('VALIDATION-SUBJECT-JSON', 'subject', 'Subject must contain finite JSON values')], valid: false }; }
+}
+
+// First-party Validator logic: equivalence.mjs
+
+const equivalenceText = { type: 'string', minLength: 1 };
+const VALIDATOR_PARALLEL_PATHS_SCHEMA = { type: 'array', minItems: 1, items: { type: 'object', additionalProperties: false,
+  properties: { comparisonId: { type: 'string', pattern: VALIDATOR_ID.source }, originalPath: equivalenceText,
+    candidatePath: equivalenceText, baselinePath: equivalenceText, baselineSha256: { type: 'string', pattern: VALIDATOR_SHA.source } },
+  required: ['comparisonId', 'originalPath', 'candidatePath', 'baselinePath', 'baselineSha256'] } };
+function validatorParallelDeclarationsValid(pairs) {
+  return Array.isArray(pairs) && pairs.length > 0 && pairs.every(declarationValid)
+    && new Set(pairs.map(pair => pair.comparisonId)).size === pairs.length;
+}
+
+// The declaration is frozen with the original execution policy; the results
+// belong to the existing independently signed test subject.
+function validatorFieldDifferences(original, candidate, prefix = '$') {
+  if (validatorDigest(original) === validatorDigest(candidate)) return [];
+  if (Array.isArray(original) && Array.isArray(candidate)) {
+    const paths = [];
+    for (let index = 0; index < Math.max(original.length, candidate.length); index++) {
+      const path = `${prefix}[${index}]`;
+      if (index >= original.length || index >= candidate.length) paths.push(path);
+      else paths.push(...validatorFieldDifferences(original[index], candidate[index], path));
+    }
+    return paths;
+  }
+  if (validatorObject(original) && validatorObject(candidate)) {
+    const paths = [];
+    for (const key of [...new Set([...Object.keys(original), ...Object.keys(candidate)])].sort()) {
+      const path = `${prefix}[${JSON.stringify(key)}]`;
+      if (!Object.hasOwn(original, key) || !Object.hasOwn(candidate, key)) paths.push(path);
+      else paths.push(...validatorFieldDifferences(original[key], candidate[key], path));
+    }
+    return paths;
+  }
+  return [prefix];
+}
+
+function exact(value, names) {
+  return validatorObject(value) && Object.keys(value).sort().join('|') === [...names].sort().join('|');
+}
+function path(value) {
+  return typeof value === 'string' && value === value.normalize('NFC') && value === value.trim()
+    && value.length > 0 && !/^[~\/]|[\\:\u0000-\u001f\u007f]/.test(value)
+    && value.split('/').every(part => part && part !== '.' && part !== '..');
+}
+function declarationValid(pair) {
+  return exact(pair, ['comparisonId', 'originalPath', 'candidatePath', 'baselinePath', 'baselineSha256'])
+    && VALIDATOR_ID.test(pair.comparisonId ?? '')
+    && ['originalPath', 'candidatePath', 'baselinePath'].every(key => path(pair[key]))
+    && pair.originalPath !== pair.candidatePath && VALIDATOR_SHA.test(pair.baselineSha256 ?? '');
+}
+function validatorReadEquivalenceBaseline(bytes, pair) {
+  if (!declarationValid(pair) || !Buffer.isBuffer(bytes) || bytes.length > 1_048_576
+    || validatorHashBytes(bytes) !== pair.baselineSha256) throw new Error('Original baseline bytes changed');
+  const baseline = JSON.parse(bytes.toString('utf8'));
+  if (!exact(baseline, ['schemaVersion', 'source', 'cases'])
+    || baseline.schemaVersion !== 'validator.equivalence-baseline/1.0'
+    || !exact(baseline.source, ['path', 'sha256']) || baseline.source.path !== pair.originalPath
+    || !VALIDATOR_SHA.test(baseline.source.sha256 ?? '')
+    || !Array.isArray(baseline.cases) || baseline.cases.length === 0
+    || !baseline.cases.every(item => exact(item, ['caseId', 'input', 'output']) && VALIDATOR_ID.test(item.caseId ?? ''))
+    || new Set(baseline.cases.map(item => item.caseId)).size !== baseline.cases.length) {
+    throw new Error('Original baseline schema is invalid');
+  }
+  validatorDigest(baseline);
+  return baseline;
+}
+function validatorBindEquivalenceResult(pair, baselineBytes, candidates, frozenAt) {
+  const baseline = validatorReadEquivalenceBaseline(baselineBytes, pair);
+  if (!Number.isFinite(validatorDate(frozenAt)) || !Array.isArray(candidates)
+    || candidates.length !== baseline.cases.length
+    || !candidates.every(item => exact(item, ['caseId', 'input', 'output']) && VALIDATOR_ID.test(item.caseId ?? ''))
+    || new Set(candidates.map(item => item.caseId)).size !== candidates.length) {
+    throw new Error('Candidate comparison cases must match the fixed baseline');
+  }
+  const cases = baseline.cases.map(original => {
+    const candidate = candidates.find(item => item.caseId === original.caseId);
+    if (!candidate) throw new Error('Candidate omitted a fixed baseline case');
+    return { caseId: original.caseId, originalInput: original.input, candidateInput: candidate.input,
+      originalOutput: original.output, candidateOutput: candidate.output };
+  });
+  const result = { comparisonId: pair.comparisonId, baselineSha256: pair.baselineSha256,
+    baselineContentBase64: baselineBytes.toString('base64'), frozenAt, cases };
+  return { ...result, comparisonArtifactDigest: validatorDigest(result) };
+}
+function resultValid(result) {
+  return exact(result, ['comparisonId', 'baselineSha256', 'baselineContentBase64', 'frozenAt', 'cases', 'comparisonArtifactDigest'])
+    && VALIDATOR_ID.test(result.comparisonId ?? '') && VALIDATOR_SHA.test(result.baselineSha256 ?? '')
+    && VALIDATOR_SHA.test(result.comparisonArtifactDigest ?? '')
+    && typeof result.baselineContentBase64 === 'string' && result.baselineContentBase64.length <= 1_398_104
+    && Array.isArray(result.cases) && result.cases.length > 0
+    && result.cases.every(item => exact(item, ['caseId', 'originalInput', 'candidateInput', 'originalOutput', 'candidateOutput'])
+      && VALIDATOR_ID.test(item.caseId ?? ''))
+    && new Set(result.cases.map(item => item.caseId)).size === result.cases.length;
+}
+function manifestBound(subject, pair) {
+  const files = subject.files ?? [];
+  return files.some(file => file.path === pair.baselinePath && file.sha256 === pair.baselineSha256)
+    && [pair.originalPath, pair.candidatePath].every(name => files.some(file => file.path === name))
+    && subject.goldenBaseline?.source?.kind === 'artifact'
+    && subject.goldenBaseline.source.locator === pair.baselinePath
+    && subject.goldenBaseline.source.digestSha256 === pair.baselineSha256;
+}
+function comparisonFindings(subject, pair, result) {
+  const at = `equivalence:${pair.comparisonId}`;
+  if (!result) return [validatorDiagnostic('EQUIVALENCE-REQUIRED', at,
+    'Parallel paths require independently signed same-input field comparisons', 'P2')];
+  if (!resultValid(result)) return [validatorDiagnostic('EQUIVALENCE-INVALID', at, 'Comparison result schema is invalid')];
+  const { comparisonArtifactDigest, ...payload } = result;
+  if (validatorDigest(payload) !== comparisonArtifactDigest || result.baselineSha256 !== pair.baselineSha256
+    || result.frozenAt !== subject.goldenBaseline.frozenAt || !Number.isFinite(validatorDate(result.frozenAt))
+    || validatorDate(result.frozenAt) > validatorDate(subject.executedAt)) {
+    return [validatorDiagnostic('EQUIVALENCE-BASELINE', at, 'Comparison changed its original frozen baseline')];
+  }
+  const baselineBytes = Buffer.from(result.baselineContentBase64, 'base64');
+  const baseline = validatorReadEquivalenceBaseline(baselineBytes, pair);
+  if (baselineBytes.toString('base64') !== result.baselineContentBase64
+    || baseline.source.sha256 !== subject.files.find(file => file.path === pair.originalPath)?.sha256
+    || result.cases.length !== baseline.cases.length || baseline.cases.some(original => {
+      const reported = result.cases.find(item => item.caseId === original.caseId);
+      return !reported || validatorDigest(reported.originalInput) !== validatorDigest(original.input)
+        || validatorDigest(reported.originalOutput) !== validatorDigest(original.output);
+    })) return [validatorDiagnostic('EQUIVALENCE-BASELINE', at, 'Original outputs must come from the actual frozen baseline bytes')];
+  const findings = [];
+  for (const item of result.cases) {
+    if (validatorDigest(item.originalInput) !== validatorDigest(item.candidateInput)) {
+      findings.push(validatorDiagnostic('EQUIVALENCE-INPUT', `${at}:${item.caseId}`, 'Original and candidate inputs differ'));
+      continue;
+    }
+    for (const field of validatorFieldDifferences(item.originalOutput, item.candidateOutput)) {
+      findings.push(validatorDiagnostic('EQUIVALENCE-FIELD', `${at}:${item.caseId}:${field}`, `Field differs: ${field}`));
+    }
+  }
+  return findings;
+}
+function validatorEquivalenceFindings(subject) {
+  const declared = subject?.policy?.parallelPaths;
+  const results = subject?.equivalence;
+  if (declared === undefined && results === undefined) return [];
+  if (!validatorParallelDeclarationsValid(declared)) {
+    return [validatorDiagnostic('EQUIVALENCE-DECLARATION', 'subject.policy.parallelPaths', 'Parallel paths need a frozen declaration')];
+  }
+  if (declared.some(pair => !manifestBound(subject, pair))) {
+    return [validatorDiagnostic('EQUIVALENCE-MANIFEST', 'subject.policy.parallelPaths', 'Prior baseline and both paths must bind actual frozen files')];
+  }
+  if (results === undefined) return declared.flatMap(pair => comparisonFindings(subject, pair, null));
+  if (!Array.isArray(results) || results.some(result => !resultValid(result))
+    || new Set(results.map(result => result.comparisonId)).size !== results.length
+    || results.some(result => !declared.some(pair => pair.comparisonId === result.comparisonId))) {
+    return [validatorDiagnostic('EQUIVALENCE-INVALID', 'subject.equivalence', 'Comparison results contain undeclared or duplicate identities')];
+  }
+  try { return declared.flatMap(pair => comparisonFindings(subject, pair, results.find(result => result.comparisonId === pair.comparisonId))); }
+  catch { return [validatorDiagnostic('EQUIVALENCE-INVALID', 'subject.equivalence', 'Comparison must contain finite JSON values')]; }
+}
+
+// First-party Validator logic: discipline.mjs
+
+function validatorDisciplineFindings(subject) {
+  if (subject?.policy?.disciplineReviewRequired !== true) return [];
+  const report = subject.disciplineComparison;
+  if (!validatorObject(report)) return [validatorDiagnostic('DISCIPLINE-DIFF-MISSING', 'subject.disciplineComparison', 'Actual whole-repository comparison evidence is required', 'P2')];
+  const { reportDigest, ...core } = report;
+  if (report.schemaVersion !== 'entrorove.discipline-runner-diff/1.0' || report.planId !== subject.planId
+    || report.comparisonScope !== 'whole-repository-including-ignored-files' || !VALIDATOR_SHA.test(report.originalManifestDigest ?? '')
+    || !VALIDATOR_SHA.test(report.actualManifestDigest ?? '') || reportDigest !== validatorDigest(core)
+    || !Number.isSafeInteger(report.changedCount) || report.changedCount < 0 || !Array.isArray(report.changedPaths)
+    || report.changedPaths.length !== Math.min(report.changedCount, 256) || !validatorObject(report.gates)
+    || report.gates.repositoryUnchanged !== (report.changedCount === 0)) {
+    return [validatorDiagnostic('DISCIPLINE-DIFF-BINDING', 'subject.disciplineComparison', 'Original deterministic comparison binding is invalid')];
+  }
+  if (report.changedCount || report.originalManifestDigest !== report.actualManifestDigest) return [validatorDiagnostic('DISCIPLINE-REPOSITORY-DRIFT', 'subject.disciplineComparison', 'Execution changed files outside its guarded write history', 'P0', { changedPaths: report.changedPaths, changedCount: report.changedCount })];
+  return [];
+}
+
+// First-party Validator logic: evidence.mjs
+import { createPublicKey as validatorPublicKey, verify as validatorVerify } from 'node:crypto';
+
+function validatorReceiptState(receipt, subjectState, { receiptPublicKey, now = Date.now() } = {}) {
+  const reject = reason => ({ state: 'unverifiable', reason });
+  if (!subjectState.valid) return reject('Frozen subject is incomplete or invalid');
+  if (!validatorEvidenceDeclaration(subjectState.subject).valid) return reject('Signed policy declarations are invalid');
+  if (!validatorText(receiptPublicKey)) return reject('Independent receipt key is not configured');
+  let key; let keyId;
+  try {
+    const der = Buffer.from(receiptPublicKey, 'base64');
+    if (der.toString('base64') !== receiptPublicKey) return reject('Independent key encoding is not canonical');
+    key = validatorPublicKey({ key: der, format: 'der', type: 'spki' });
+    if (key.asymmetricKeyType !== 'ed25519' || !key.export({ format: 'der', type: 'spki' }).equals(der)) return reject('Independent key must be canonical Ed25519');
+    keyId = validatorHashBytes(der);
+  } catch { return reject('Independent key is invalid'); }
+  if (!validatorObject(receipt) || receipt.schemaVersion !== 'validator.execution-receipt/1.0'
+    || receipt.keyId !== keyId || receipt.subjectDigest !== subjectState.digest
+    || !VALIDATOR_ID.test(receipt.nonce ?? '') || receipt.nonce.length < 16) return reject('Receipt identity or frozen subject binding is invalid');
+  if (typeof receipt.signature !== 'string' || !/^[A-Za-z0-9_-]{86}$/.test(receipt.signature)) return reject('Ed25519 signature encoding is not canonical');
+  const signature = Buffer.from(receipt.signature, 'base64url');
+  if (signature.length !== 64 || signature.toString('base64url') !== receipt.signature) return reject('Ed25519 signature encoding is not canonical');
+  const { signature: _signature, ...payload } = receipt;
+  try { if (!validatorVerify(null, Buffer.from(validatorCanonical(payload)), key, signature)) return reject('Receipt signature is invalid'); }
+  catch { return reject('Receipt signature is invalid'); }
+  const issuedAt = validatorDate(receipt.issuedAt); const expiresAt = validatorDate(receipt.expiresAt);
+  const executedAt = validatorDate(subjectState.subject.executedAt);
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || issuedAt > now + 60_000 || expiresAt <= now
+    || expiresAt <= issuedAt || expiresAt - issuedAt > 600_000 || executedAt > issuedAt || issuedAt - executedAt > 600_000) return reject('Receipt lifetime or execution instant is invalid');
+  const result = receipt.result;
+  if (!validatorObject(result) || result.runner !== 'trusted-runner' || typeof result.passed !== 'boolean'
+    || !Number.isInteger(result.exitCode) || result.exitCode < -128 || result.exitCode > 255
+    || !Number.isFinite(result.durationMs) || result.durationMs < 0 || result.durationMs > 86_400_000
+    || !validatorText(result.summary) || result.summary.length > 4000) return reject('Signed result fields are invalid');
+  const execution = subjectState.subject.execution;
+  if (execution && ((execution.exitCode === null ? 1 : execution.exitCode) !== result.exitCode
+    || (result.passed && (execution.signal !== null || execution.timedOut || execution.outputLimitExceeded)))) return reject('Signed result contradicts its signed process outcome');
+  return { state: result.passed && result.exitCode === 0 ? 'valid' : 'failed', receipt };
+}
+
+function validatorEvidenceDeclaration(subject) {
+  const kind = subject?.policy?.evidenceKind ?? 'test';
+  const runner = subject?.policy?.evidenceRunner ?? 'trusted-runner';
+  const sandboxDeclared = runner !== 'sandbox' || (subject?.policy?.evidenceKind !== undefined && subject?.policy?.evidenceRunner === 'sandbox');
+  const binding = subject?.policy?.workflowBinding;
+  const bindingDeclared = !Object.hasOwn(subject?.policy ?? {}, 'workflowBinding') || (validatorObject(binding)
+    && ['flowId', 'stepId'].every(key => Object.hasOwn(binding, key) && VALIDATOR_ID.test(binding[key] ?? ''))
+    && (!Object.hasOwn(binding, 'ownerId') || VALIDATOR_ID.test(binding.ownerId ?? '')));
+  const local = subject?.policy?.localVerification;
+  const localDeclared = !Object.hasOwn(subject?.policy ?? {}, 'localVerification') || (validatorObject(local)
+    && Object.keys(local).sort().join('|') === 'operation|requestedTarget|requirementsSha256'
+    && ['sandbox-run', 'fuzz-input', 'perf-benchmark', 'intrusive-test'].includes(local.operation)
+    && validatorText(local.requestedTarget) && VALIDATOR_SHA.test(local.requirementsSha256 ?? ''));
+  return { kind, runner, valid: VALIDATOR_KINDS.includes(kind) && VALIDATOR_RUNNERS.includes(runner) && sandboxDeclared && bindingDeclared && localDeclared };
+}
+
+function classifyValidatorEvidence(evidence, subjectState, options = {}) {
+  const reject = reason => ({ state: 'unverifiable', reason });
+  if (!validatorObject(evidence) || evidence.schemaVersion !== 'entrorove.test-evidence/2.0') return reject('Evidence schema is invalid');
+  const fields = ['schemaVersion', 'evidenceId', 'kind', 'runner', 'command', 'exitCode', 'durationMs', 'summary',
+    'artifactSha256', 'subject', 'subjectDigest', 'receipt', 'flowId', 'stepId', 'status'];
+  if (Object.keys(evidence).some(key => !fields.includes(key))) return reject('Evidence has unknown fields');
+  if (evidence.runner === 'local') return reject('Local evidence cannot become independent evidence');
+  if (['pending', 'pending-execution'].includes(evidence.status)) return { state: 'pending', reason: 'Execution is still pending' };
+  const declaration = validatorEvidenceDeclaration(subjectState.subject);
+  if (!declaration.valid || evidence.kind !== declaration.kind || evidence.runner !== declaration.runner) return reject('Evidence kind or runner differs from its signed policy');
+  let evidenceDigest;
+  try { evidenceDigest = validatorDigest(evidence.subject); } catch { return reject('Evidence subject is invalid'); }
+  const declaredId = subjectState.subject?.policy?.evidenceId;
+  const runId = subjectState.subject?.validationRunId;
+  const idBound = declaredId !== undefined ? evidence.evidenceId === declaredId : evidence.evidenceId === `${runId}:process`
+    || (typeof evidence.evidenceId === 'string' && evidence.evidenceId.startsWith(`${runId}:`) && /^(?:0|[1-9][0-9]*)$/.test(evidence.evidenceId.slice(String(runId).length + 1)));
+  if (!validatorText(evidence.evidenceId) || evidence.evidenceId.length > 200 || !idBound
+    || !validatorText(evidence.command) || evidence.command.length > 2000
+    || evidenceDigest !== subjectState.digest
+    || evidence.subjectDigest !== subjectState.digest || evidence.artifactSha256 !== subjectState.subject?.artifactSha256
+    || evidence.command !== subjectState.subject?.policy?.command) return reject('Evidence does not bind the frozen subject, manifest and command');
+  const binding = subjectState.subject?.policy?.workflowBinding;
+  for (const name of ['flowId', 'stepId']) {
+    const signed = binding?.[name] ?? subjectState.subject?.[name === 'flowId' ? 'chainId' : 'validationRunId'];
+    const expected = options[name] ?? signed;
+    if ((evidence[name] !== undefined && evidence[name] !== expected) || (options[name] !== undefined && signed !== options[name])) return reject(`Evidence ${name} is not signed for its actual authority`);
+  }
+  const verified = validatorReceiptState(evidence.receipt, subjectState, options);
+  if (verified.state === 'unverifiable') return verified;
+  if (evidence.exitCode !== verified.receipt.result.exitCode || evidence.durationMs !== verified.receipt.result.durationMs
+    || evidence.summary !== verified.receipt.result.summary) return reject('Evidence fields differ from the signed result');
+  return verified;
+}
+
+function validatorEvidenceFromReceipt(receipt, subjectState, index) {
+  const declaration = validatorEvidenceDeclaration(subjectState.subject);
+  const binding = subjectState.subject.policy.workflowBinding;
+  return { schemaVersion: 'entrorove.test-evidence/2.0', evidenceId: subjectState.subject.policy.evidenceId ?? `${subjectState.subject.validationRunId}:${index}`,
+    kind: declaration.kind, runner: declaration.runner, command: subjectState.subject.policy.command,
+    exitCode: receipt.result.exitCode, durationMs: receipt.result.durationMs, summary: receipt.result.summary,
+    artifactSha256: subjectState.subject.artifactSha256, subject: subjectState.subject, subjectDigest: subjectState.digest, receipt,
+    ...(binding?.flowId === undefined ? {} : { flowId: binding.flowId }), ...(binding?.stepId === undefined ? {} : { stepId: binding.stepId }) };
+}
+
+// First-party Validator logic: rework.mjs
+
+const VALIDATOR_REWORK = Object.freeze([
+  { category: 'structure-schema', skill: 'blueprint', operation: 'validate', inputRequirements: ['flowId', 'expectedRevision', 'blueprint'] },
+  { category: 'formula-calculation', skill: 'calctool', operation: 'compile-inline', inputRequirements: ['requirements.goal', 'requirements.engineId', 'requirements.inputs', 'requirements.formulas'] },
+  { category: 'scope-drift', skill: 'aimlock', operation: 'scope-contract', inputRequirements: ['contract.allowedPaths', 'contract.maxChangedLines', 'contract.allowNewFiles', 'contract.allowDeleteFiles'] },
+  { category: 'execution-dispatch', skill: 'swarm', operation: 'dispatch', inputRequirements: ['tasks', 'taskId', 'workerId', 'actorRole', 'facts'],
+    preconditions: ['Original failed execution is recorded and reconciled by its owner', 'Current dispatcher authorization and dependency checks'] },
+  { category: 'validator-self', skill: 'validator', operation: null, inputRequirements: ['human reviewed Validator correction'] },
+]);
+
+function validatorFindingCategory(finding) {
+  const rule = String(finding?.ruleId ?? '').toUpperCase();
+  if (/^(STR[-_]|SCHEMA[-_]|STRUCTURE[-_]|REF[-_]|TYPE[-_]|CYCLE[-_])/.test(rule)) return 'structure-schema';
+  if (/^(FORMULA[-_]|CALC[-_]|ARITHMETIC[-_])/.test(rule)) return 'formula-calculation';
+  if (/^(SCOPE[-_]|AIMLOCK[-_]|ARCH[-_]|VALIDATION-SUBJECT-(SCOPE|SNAPSHOT|CONTRACTS|BRAIN|ARTIFACT-MANIFEST|POLICY))/.test(rule)) return 'scope-drift';
+  if (/^(GOLDEN-FAIL|EXECUTION[-_]|DISPATCH[-_]|SWARM[-_])/.test(rule)) return 'execution-dispatch';
+  return 'validator-self';
+}
+
+function validatorRepairRoutes(findings) {
+  const values = Array.isArray(findings) ? findings.filter(item => validatorObject(item) && validatorText(item.ruleId)) : [];
+  return VALIDATOR_REWORK.flatMap(route => {
+    const matching = values.filter(item => validatorFindingCategory(item) === route.category);
+    if (!matching.length) return [];
+    const triggers = [...new Set(matching.map(item => `${item.ruleId}:${item.entityRef}`))].sort();
+    return [{ ...route, triggers, requiresHumanConfirmation: route.category === 'validator-self',
+      invoke: false, authorityRequired: route.skill !== 'validator' }];
+  });
+}
+
+// First-party Validator logic: judgement.mjs
+
+function validatorRiskLedgerValid(findings, ledger, now = Date.now()) {
+  const risks = findings.filter(item => item.severity === 'P1');
+  if (!risks.length) return true;
+  if (!Array.isArray(ledger)) return false;
+  const entries = ledger.filter(entry => validatorObject(entry)
+    && ['riskId', 'owner', 'acceptedBy'].every(key => VALIDATOR_ID.test(entry[key] ?? ''))
+    && validatorText(entry.mitigation) && validatorText(entry.findingRuleId) && validatorText(entry.findingEntityRef)
+    && Number.isFinite(validatorDate(entry.acceptedAt)) && validatorDate(entry.acceptedAt) <= now);
+  if (new Set(entries.map(entry => entry.riskId)).size !== entries.length) return false;
+  const used = new Set();
+  return risks.every(finding => {
+    const index = entries.findIndex((entry, i) => !used.has(i) && entry.findingRuleId === finding.ruleId && entry.findingEntityRef === finding.entityRef);
+    if (index < 0) return false;
+    used.add(index); return true;
+  });
+}
+
+function validatorDuplicateNonces(evidence) {
+  const counts = new Map();
+  for (const value of evidence) if (validatorText(value?.receipt?.nonce)) counts.set(value.receipt.nonce, (counts.get(value.receipt.nonce) ?? 0) + 1);
+  return new Set([...counts].filter(([, count]) => count > 1).map(([nonce]) => nonce));
+}
+
+function validatorPendingState(pending, evidence, states) {
+  const required = { 'sandbox-run': 'test', 'fuzz-input': 'test', 'intrusive-test': 'security', 'perf-benchmark': 'benchmark' };
+  const used = new Set();
+  return pending.map(item => {
+    if (!validatorObject(item) || item.status !== 'pending-execution' || !required[item.operation]) return { descriptor: item, resolved: false };
+    const index = evidence.findIndex((value, i) => {
+      if (used.has(i) || states[i].state !== 'valid' || value.kind !== required[item.operation]) return false;
+      if (item.operation === 'sandbox-run' && value.runner !== 'sandbox') return false;
+      if (item.operation === 'intrusive-test' && value.runner !== 'sandbox') return false;
+      const target = item.requestedTarget;
+      const verification = value.subject?.policy?.localVerification;
+      if (!validatorText(target) || !VALIDATOR_SHA.test(item.requirementsSha256 ?? '') || !validatorObject(verification)
+        || Object.keys(verification).sort().join('|') !== 'operation|requestedTarget|requirementsSha256') return false;
+      const targetBound = value.command === target || value.subject?.tests?.some(test => test.path === target || test.testId === target);
+      return targetBound && verification.operation === item.operation && verification.requestedTarget === target
+        && verification.requirementsSha256 === item.requirementsSha256;
+    });
+    if (index >= 0) used.add(index);
+    return { descriptor: item, resolved: index >= 0 };
+  });
+}
+
+function evaluateValidatorVerdict(input = {}, options = {}) {
+  const now = options.now ?? Date.now();
+  const subjectState = validateValidatorSubject(input.expectedSubject ?? input.validationContext, { now });
+  const findings = [...(Array.isArray(input.findings) ? input.findings : []), ...subjectState.findings];
+  if (input.expectedSubject && input.validationContext) {
+    try { if (validatorDigest(input.expectedSubject) !== validatorDigest(input.validationContext)) findings.push(validatorDiagnostic('VALIDATION-SUBJECT-SCOPE', 'subject', 'Two frozen subject bindings disagree')); }
+    catch { findings.push(validatorDiagnostic('VALIDATION-SUBJECT-JSON', 'subject', 'Frozen subject is invalid')); }
+  }
+  const evidence = Array.isArray(input.evidence) ? input.evidence : [];
+  const duplicates = validatorDuplicateNonces(evidence);
+  const states = evidence.map(value => duplicates.has(value?.receipt?.nonce)
+    ? { state: 'unverifiable', reason: 'Duplicate receipt nonce is not independent evidence' }
+    : classifyValidatorEvidence(value, subjectState, { ...options, now }));
+  const pending = validatorPendingState(Array.isArray(input.pending) ? input.pending : [], evidence, states);
+  const summary = { valid: states.filter(value => value.state === 'valid').length, failed: states.filter(value => value.state === 'failed').length,
+    pending: states.filter(value => value.state === 'pending').length + pending.filter(value => !value.resolved).length,
+    unverifiable: states.filter(value => value.state === 'unverifiable').length };
+  const p0 = findings.filter(value => value.severity === 'P0').length; const p1 = findings.filter(value => value.severity === 'P1').length;
+  const allValid = subjectState.valid && summary.valid > 0 && summary.failed + summary.pending + summary.unverifiable === 0;
+  const riskLedgerValid = validatorRiskLedgerValid(findings, input.riskLedger, now);
+  const verdict = p0 > 0 || summary.failed > 0 ? 'blocked' : !allValid || !riskLedgerValid ? 'incomplete' : p1 > 0 ? 'pass-with-risk' : 'pass';
+  return { report: { verdict, subjectDigest: subjectState.digest, findings: { total: findings.length, p0, p1, p2: findings.filter(value => value.severity === 'P2').length },
+    evidenceCount: evidence.length, evidenceValid: allValid, evidenceSummary: summary, riskLedgerValid, riskLedger: input.riskLedger ?? [],
+    pending, evidenceDiagnostics: states.map((value, index) => ({ index, state: value.state, reason: value.reason ?? null })),
+    routing: validatorRepairRoutes(findings) }, findings, evidence };
+}
+
+function functionalVerifyValidator(input = {}, options = {}) {
+  const subjectState = validateValidatorSubject(input.validationContext, options);
+  const receipts = Array.isArray(input.receipts) ? input.receipts : [];
+  const duplicates = validatorDuplicateNonces(receipts.map(receipt => ({ receipt })));
+  const states = receipts.map(receipt => duplicates.has(receipt?.nonce) ? { state: 'unverifiable', reason: 'Duplicate receipt nonce' }
+    : validatorReceiptState(receipt, subjectState, options));
+  const declaration = validatorEvidenceDeclaration(subjectState.subject);
+  if (!declaration.valid || declaration.runner === 'local') states.fill({ state: 'unverifiable', reason: 'Signed policy does not declare independent evidence' });
+  states.forEach((value, index) => {
+    if (value.receipt) states[index] = classifyValidatorEvidence(validatorEvidenceFromReceipt(value.receipt, subjectState, index), subjectState, options);
+  });
+  const evidence = states.flatMap((value, index) => value.state === 'unverifiable' ? [] : [validatorEvidenceFromReceipt(value.receipt, subjectState, index)]);
+  const findings = [...subjectState.findings, ...states.flatMap((value, index) => value.state === 'failed'
+    ? [validatorDiagnostic('GOLDEN-FAIL', `receipt:${index}`, 'Authentic frozen golden baseline failed', 'P1')] : [])];
+  const failed = states.filter(value => value.state === 'failed').length;
+  const incomplete = !subjectState.valid || !receipts.length || states.some(value => value.state === 'unverifiable');
+  const status = findings.some(value => value.severity === 'P0') ? 'blocked' : incomplete ? 'incomplete' : 'succeeded';
+  return { status, subject: subjectState.subject, subjectDigest: subjectState.digest, evidence, findings,
+    results: states.flatMap(value => value.receipt ? [value.receipt.result] : []),
+    summary: { total: receipts.length, passed: states.filter(value => value.state === 'valid').length, failed,
+      pending: 0, unverifiable: states.filter(value => value.state === 'unverifiable').length },
+    receiptDiagnostics: states.map((value, index) => ({ index, state: value.state, reason: value.reason ?? null })) };
+}
+
+// First-party Validator logic: schema.mjs
+
+function augmentValidatorSchemas(original) {
+  const schemas = structuredClone(original);
+  const execution = { type: 'object', additionalProperties: false, properties: {
+    exitCode: { type: ['integer', 'null'] }, signal: { type: ['string', 'null'] },
+    timedOut: { type: 'boolean' }, outputLimitExceeded: { type: 'boolean' },
+  }, required: ['exitCode', 'signal', 'timedOut', 'outputLimitExceeded'] };
+  function visit(value) {
+    if (!value || typeof value !== 'object') return;
+    if (value.properties?.schemaVersion?.const === 'validator.validation-subject/1.0') {
+      value.properties.execution = execution;
+      value.properties.equivalence = { type: 'array', items: { type: 'object' } };
+      value.properties.disciplineComparison = { type: 'object' };
+      value.properties.policy.properties ??= {};
+      value.properties.policy.properties.parallelPaths = VALIDATOR_PARALLEL_PATHS_SCHEMA;
+      value.properties.policy.properties.disciplineReviewRequired = { type: 'boolean' };
+      const archguard = value.properties.contracts?.properties?.archguard;
+      if (archguard) archguard.properties.contractId = { type: 'string', minLength: 1 };
+    }
+    if (value.properties?.schemaVersion?.const === 'entrorove.test-evidence/2.0') {
+      value.properties.flowId = { type: 'string', minLength: 1 };
+      value.properties.stepId = { type: 'string', minLength: 1 };
+      value.properties.status = { enum: ['pending', 'pending-execution'] };
+      value.properties.evidenceId = { type: 'string', minLength: 1, maxLength: 200 };
+      value.properties.command.maxLength = 2000;
+      value.properties.summary.maxLength = 4000;
+      value.properties.durationMs.maximum = 86_400_000;
+      if (value.properties.runner?.const === 'trusted-runner') value.properties.runner = { enum: ['trusted-runner', 'sandbox'] };
+    }
+    if (value.properties?.schemaVersion?.const === 'validator.execution-receipt/1.0') {
+      value.properties.result.properties.summary.maxLength = 4000;
+      value.properties.result.properties.durationMs.maximum = 86_400_000;
+      value.properties.result.properties.exitCode.minimum = -128;
+      value.properties.result.properties.exitCode.maximum = 255;
+    }
+    for (const item of Object.values(value)) {
+      if (Array.isArray(item)) item.forEach(visit);
+      else if (item && typeof item === 'object') visit(item);
+    }
+  }
+  visit(schemas);
+  const pending = { type: 'object', additionalProperties: false, properties: {
+    operation: { enum: ['sandbox-run', 'fuzz-input', 'perf-benchmark', 'intrusive-test'] },
+    status: { const: 'pending-execution' }, requestedTarget: { type: 'string', minLength: 1 },
+    requirementsSha256: { type: 'string', pattern: '^[0-9a-f]{64}$' },
+  }, required: ['operation', 'status'] };
+  schemas.verdict.input.properties.pending = { type: 'array', items: pending };
+  for (const operation of ['sandbox-run', 'fuzz-input', 'perf-benchmark', 'intrusive-test']) {
+    schemas[operation].output.properties.pendingEvidenceRequirements = { type: 'object' };
+  }
+  for (const key of ['functional-verify', 'verdict']) schemas[key].output.properties.status.enum.push('incomplete');
+  schemas['functional-verify'].input.required = [];
+  schemas['functional-verify'].input.properties.receipts.minItems = 0;
+  schemas['functional-verify'].output.properties.subject.anyOf = [structuredClone(schemas['functional-verify'].output.properties.subject), { type: 'null' }];
+  delete schemas['functional-verify'].output.properties.subject.type;
+  schemas['functional-verify'].output.properties.subjectDigest = { type: ['string', 'null'] };
+  schemas['functional-verify'].output.properties.receiptDiagnostics = { type: 'array', items: { type: 'object' } };
+  return Object.freeze(schemas);
+}
+
+// First-party Validator logic: bridge.mjs
+
+function readValidationSubject(value, entityRef = 'subject') {
+  const state = validateValidatorSubject(value);
+  return state.valid ? { value: state.subject } : { findings: state.findings.map(finding => ({ ...finding, entityRef: finding.entityRef.replace(/^subject/, entityRef) })) };
+}
+
+function evidenceState(evidence, subject, subjectDigest, input = {}) {
+  const state = validateValidatorSubject(subject);
+  if (subjectDigest !== state.digest) return 'unverifiable';
+  return classifyValidatorEvidence(evidence, state, validatorRuntimeOptions(input)).state;
+}
+
+function validatorRuntimeOptions(input) {
+  return { receiptPublicKey: input.receiptPublicKey ?? process.env.ENTROROVE_VALIDATOR_RECEIPT_PUBLIC_KEY };
+}
+
+function runFunctional(requestId, input) {
+  const output = functionalVerifyValidator(input, validatorRuntimeOptions(input));
+  return { schemaVersion: RES, requestId, ...output,
+    nextStep: { operation: output.status === 'blocked' ? 'plan' : 'verdict',
+      instruction: output.status === 'incomplete' ? 'Provide independently verifiable evidence for the frozen subject.' : 'Render verdict from signed TestEvidence.' } };
+}
+
+function runVerdict(requestId, input) {
+  const output = evaluateValidatorVerdict(input, validatorRuntimeOptions(input));
+  const level = output.report.verdict;
+  return { schemaVersion: RES, requestId, status: level === 'blocked' || level === 'incomplete' ? level : 'succeeded', ...output,
+    nextStep: { operation: level === 'blocked' ? 'plan' : level === 'incomplete' ? 'verdict' : null,
+      instruction: level === 'blocked' ? 'Repair failures through the finding-derived routes.'
+        : level === 'incomplete' ? 'Provide independent evidence, resolve actual pending executions and complete the P1 risk ledger.' : `Verdict: ${level}.` } };
+}
+
+function runPlanning(requestId, operation, input) {
+  const result = runLegacyValidatorPlanning(requestId, operation, { ...input, findingCategories: [] });
+  if (operation !== 'plan' || result.status !== 'succeeded') return result;
+  const routing = validatorRepairRoutes(input.findings);
+  return { ...result, plan: { ...result.plan, routing, routingPolicy: 'deterministic-finding-map' } };
+}
+
+function runLocalProtocol(requestId, operation, input) {
+  const output = runLegacyValidatorLocalProtocol(requestId, operation, input);
+  if (output.status !== 'succeeded') return output;
+  const key = { 'sandbox-run': 'sandbox', 'fuzz-input': 'fuzz', 'perf-benchmark': 'benchmark', 'intrusive-test': 'intrusive' }[operation];
+  const { receiptPublicKey: _hostKey, ...originalInput } = input;
+  return { ...output, [key]: { ...output[key], requirementsSha256: validatorDigest(originalInput) } };
+}
+
+const SCHEMAS = augmentValidatorSchemas(LEGACY_VALIDATOR_SCHEMAS);
+export { readValidationSubject, evidenceState, validatorBindEquivalenceResult, validatorReadEquivalenceBaseline, validatorFieldDifferences, validatorEquivalenceFindings, validatorParallelDeclarationsValid, VALIDATOR_PARALLEL_PATHS_SCHEMA };