@etiquekit/etq 1.0.12 → 1.0.13

package/packages/control/src/authority/rig-conductor.ts

@@ -0,0 +1,632 @@
+type JsonRecord = Record<string, unknown>;
+
+export const RIG_CONDUCTOR_SCHEMA = 'rig_conductor.v0';
+export const RIG_CONDUCTOR_VALIDATION_SCHEMA = 'rig-conductor-validation.v0';
+
+const EXECUTION_STRATEGIES = ['solo', 'tango', 'rig', 'shadow'] as const;
+const RIG_EVENT_TYPES = ['rig_opened', 'child_spawned', 'child_returned', 'rig_closed'] as const;
+const STRUCTURED_CHECK_STATUSES = ['pass', 'fail', 'not_run', 'not_applicable'] as const;
+const RESERVED_STRATEGIES = ['shadow'] as const;
+const CANONICAL_WRITE_PREFIXES = [
+  '.etiquette/events',
+  '.etiquette/notify',
+  'docs/work/ledger',
+  'docs/work/packets',
+  'docs/work/lanes',
+  'artifacts/',
+] as const;
+const CANONICAL_TOOLS = [
+  'bus_write',
+  'ledger_write',
+  'merge',
+  'push',
+  'protected_branch_push',
+  'close_lane',
+  'grant',
+  'sign',
+  'rotate_secret',
+  'mutate_authority',
+] as const;
+
+export type RigExecutionStrategy = (typeof EXECUTION_STRATEGIES)[number];
+export type RigLifecycleEventType = (typeof RIG_EVENT_TYPES)[number];
+export type RigConductorStructuredCheckStatus = (typeof STRUCTURED_CHECK_STATUSES)[number];
+
+export interface RigConductorAuthorityBoundary {
+  topology_grants_authority: false;
+  parenthood_grants_authority: false;
+  child_mints_authority: false;
+  child_can_write_parent_ledger: false;
+  station_role_grants_authority: false;
+  validation_is_authorization: false;
+}
+
+export interface RigConductorStations {
+  orchestration_lead: string;
+  rig_lead: string;
+  synthesis_owner: string;
+  reviewer: string;
+}
+
+export interface RigConductorStationEdge {
+  from: keyof RigConductorStations;
+  to: keyof RigConductorStations;
+}
+
+export interface RigConductorReturnContract {
+  return_to: string;
+  required_refs: string[];
+  disposal_confirmed_required: true;
+}
+
+export interface RigConductorTaskSpec {
+  task_id: string;
+  lane: string;
+  assigned_to: string;
+  allowed_writes: string[];
+  validation: string[];
+  return_contract: RigConductorReturnContract;
+}
+
+export interface RigConductorChildNode {
+  node_id: string;
+  parent_node: string;
+  return_to: string;
+  lane: string;
+  assigned_to: string;
+  scratch_ref?: string;
+  allowed_writes: string[];
+  allowed_tools: string[];
+  forbidden_actions: string[];
+  child_spawn_budget: number;
+  task_spec: RigConductorTaskSpec;
+}
+
+export interface RigConductorStructuredCheck {
+  name: string;
+  compile_status?: RigConductorStructuredCheckStatus;
+  gate_status?: RigConductorStructuredCheckStatus;
+  tests_failed?: number;
+  blocking: boolean;
+}
+
+export interface RigConductorLifecycleEvent {
+  type: RigLifecycleEventType;
+  node_id?: string;
+  ref?: string;
+  disposal_confirmed?: boolean;
+  checks?: RigConductorStructuredCheck[];
+}
+
+export interface RigConductorSynthesis {
+  owner: string;
+  return_to: string;
+  child_return_refs: string[];
+  disposal_confirmed: boolean;
+}
+
+export interface RigConductorEnvelope {
+  schema: typeof RIG_CONDUCTOR_SCHEMA;
+  rig_id: string;
+  workflow_id: string;
+  lane: string;
+  execution_strategy: RigExecutionStrategy;
+  parent_node: string;
+  return_to: string;
+  synthesis_owner: string;
+  allowed_writes: string[];
+  allowed_tools: string[];
+  forbidden_actions: string[];
+  child_spawn_budget: number;
+  max_depth: number;
+  total_descendant_budget: number;
+  ephemeral_children: true;
+  stations: RigConductorStations;
+  station_edges: RigConductorStationEdge[];
+  child_nodes: RigConductorChildNode[];
+  lifecycle_events: RigConductorLifecycleEvent[];
+  synthesis?: RigConductorSynthesis;
+  authority_boundary: RigConductorAuthorityBoundary;
+}
+
+export interface RigConductorValidation {
+  schema: typeof RIG_CONDUCTOR_VALIDATION_SCHEMA;
+  rig_ref: string;
+  verdict: 'legitimate' | 'blocked';
+  reasons: string[];
+  checks: {
+    strategy_supported: boolean;
+    station_graph_acyclic: boolean;
+    reviewer_not_implementer: boolean;
+    child_envelopes_subset_parent: boolean;
+    child_task_specs_subset_envelopes: boolean;
+    child_scratch_isolated: boolean;
+    children_not_canonical_writers: boolean;
+    child_budget_within_parent: boolean;
+    depth_within_max: boolean;
+    synthesis_has_child_refs: boolean;
+    child_return_checks_present: boolean;
+    child_return_checks_nonblocking: boolean;
+    disposal_confirmed: boolean;
+    lifecycle_events_valid: boolean;
+    authority_boundary_false: boolean;
+  };
+  derived: {
+    max_observed_depth: number;
+    child_count: number;
+    descendant_budget_requested: number;
+  };
+  authority_boundary: RigConductorAuthorityBoundary & {
+    validation_grants_authority: false;
+    topology_is_routing_only: true;
+  };
+}
+
+function isRecord(value: unknown): value is JsonRecord {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function asRecord(value: unknown, field: string): JsonRecord {
+  if (!isRecord(value)) throw new Error(`${field} must be an object`);
+  return value;
+}
+
+function asString(record: JsonRecord, field: string): string {
+  const value = record[field];
+  if (typeof value !== 'string' || value.trim().length === 0) throw new Error(`${field} must be a non-empty string`);
+  return value.trim();
+}
+
+function optionalString(record: JsonRecord, field: string): string | undefined {
+  const value = record[field];
+  if (value === undefined) return undefined;
+  if (typeof value !== 'string' || value.trim().length === 0) throw new Error(`${field} must be a non-empty string when present`);
+  return value.trim();
+}
+
+function asStringArray(record: JsonRecord, field: string): string[] {
+  const value = record[field];
+  if (!Array.isArray(value)) throw new Error(`${field} must be a string array`);
+  return value.map((item) => {
+    if (typeof item !== 'string' || item.trim().length === 0) throw new Error(`${field} must contain only non-empty strings`);
+    return item.trim();
+  });
+}
+
+function asNonNegativeInteger(record: JsonRecord, field: string): number {
+  const value = record[field];
+  if (!Number.isInteger(value) || Number(value) < 0) throw new Error(`${field} must be a non-negative integer`);
+  return Number(value);
+}
+
+function optionalNonNegativeInteger(record: JsonRecord, field: string): number | undefined {
+  if (record[field] === undefined) return undefined;
+  return asNonNegativeInteger(record, field);
+}
+
+function asBoolean(record: JsonRecord, field: string): boolean {
+  const value = record[field];
+  if (typeof value !== 'boolean') throw new Error(`${field} must be a boolean`);
+  return value;
+}
+
+function asTrue(record: JsonRecord, field: string): true {
+  const value = record[field];
+  if (value === undefined) return true;
+  if (value !== true) throw new Error(`${field} must be true`);
+  return true;
+}
+
+function asFalse(record: JsonRecord, field: keyof RigConductorAuthorityBoundary): false {
+  if (record[field] !== false) throw new Error(`authority_boundary.${field} must be false`);
+  return false;
+}
+
+function asEnum<T extends readonly string[]>(values: T, value: unknown, field: string): T[number] {
+  if (typeof value !== 'string' || !values.includes(value)) throw new Error(`${field} must be one of: ${values.join(', ')}`);
+  return value as T[number];
+}
+
+function assertPortableRef(value: string, field: string): void {
+  if (value.startsWith('/') || value.startsWith('\\') || /^[A-Za-z]:[\\/]/.test(value)) {
+    throw new Error(`${field} must be an opaque or repo-relative ref, not a local absolute path`);
+  }
+  if (/[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+    throw new Error(`${field} must be an opaque or repo-relative ref, not a URL`);
+  }
+}
+
+function parseAuthorityBoundary(value: unknown): RigConductorAuthorityBoundary {
+  const record = asRecord(value, 'authority_boundary');
+  return {
+    topology_grants_authority: asFalse(record, 'topology_grants_authority'),
+    parenthood_grants_authority: asFalse(record, 'parenthood_grants_authority'),
+    child_mints_authority: asFalse(record, 'child_mints_authority'),
+    child_can_write_parent_ledger: asFalse(record, 'child_can_write_parent_ledger'),
+    station_role_grants_authority: asFalse(record, 'station_role_grants_authority'),
+    validation_is_authorization: asFalse(record, 'validation_is_authorization'),
+  };
+}
+
+function parseStations(value: unknown): RigConductorStations {
+  const record = asRecord(value, 'stations');
+  return {
+    orchestration_lead: asString(record, 'orchestration_lead'),
+    rig_lead: asString(record, 'rig_lead'),
+    synthesis_owner: asString(record, 'synthesis_owner'),
+    reviewer: asString(record, 'reviewer'),
+  };
+}
+
+function parseStationEdge(value: unknown): RigConductorStationEdge {
+  const record = asRecord(value, 'station edge');
+  return {
+    from: asEnum(['orchestration_lead', 'rig_lead', 'synthesis_owner', 'reviewer'] as const, record.from, 'station_edges.from'),
+    to: asEnum(['orchestration_lead', 'rig_lead', 'synthesis_owner', 'reviewer'] as const, record.to, 'station_edges.to'),
+  };
+}
+
+function parseReturnContract(value: unknown): RigConductorReturnContract {
+  const record = asRecord(value, 'return_contract');
+  return {
+    return_to: asString(record, 'return_to'),
+    required_refs: asStringArray(record, 'required_refs'),
+    disposal_confirmed_required: asTrue(record, 'disposal_confirmed_required'),
+  };
+}
+
+function parseTaskSpec(value: unknown): RigConductorTaskSpec {
+  const record = asRecord(value, 'task_spec');
+  const taskId = asString(record, 'task_id');
+  const lane = asString(record, 'lane');
+  assertPortableRef(taskId, 'task_spec.task_id');
+  assertPortableRef(lane, 'task_spec.lane');
+  const allowedWrites = asStringArray(record, 'allowed_writes');
+  for (const ref of allowedWrites) assertPortableRef(ref, 'task_spec.allowed_writes');
+  return {
+    task_id: taskId,
+    lane,
+    assigned_to: asString(record, 'assigned_to'),
+    allowed_writes: allowedWrites,
+    validation: asStringArray(record, 'validation'),
+    return_contract: parseReturnContract(record.return_contract),
+  };
+}
+
+function parseStructuredCheck(value: unknown): RigConductorStructuredCheck {
+  const record = asRecord(value, 'structured check');
+  return {
+    name: asString(record, 'name'),
+    compile_status: record.compile_status === undefined
+      ? undefined
+      : asEnum(STRUCTURED_CHECK_STATUSES, record.compile_status, 'checks.compile_status'),
+    gate_status: record.gate_status === undefined
+      ? undefined
+      : asEnum(STRUCTURED_CHECK_STATUSES, record.gate_status, 'checks.gate_status'),
+    tests_failed: optionalNonNegativeInteger(record, 'tests_failed'),
+    blocking: asBoolean(record, 'blocking'),
+  };
+}
+
+function parseChildNode(value: unknown): RigConductorChildNode {
+  const record = asRecord(value, 'child node');
+  const nodeId = asString(record, 'node_id');
+  const lane = asString(record, 'lane');
+  assertPortableRef(nodeId, 'child_nodes.node_id');
+  assertPortableRef(lane, 'child_nodes.lane');
+  if ('depth' in record) throw new Error('child_nodes.depth is derived from parent_node chain and must not be declared');
+  const scratchRef = optionalString(record, 'scratch_ref');
+  if (scratchRef !== undefined) assertPortableRef(scratchRef, 'child_nodes.scratch_ref');
+  const allowedWrites = asStringArray(record, 'allowed_writes');
+  for (const ref of allowedWrites) assertPortableRef(ref, 'child_nodes.allowed_writes');
+  return {
+    node_id: nodeId,
+    parent_node: asString(record, 'parent_node'),
+    return_to: asString(record, 'return_to'),
+    lane,
+    assigned_to: asString(record, 'assigned_to'),
+    scratch_ref: scratchRef,
+    allowed_writes: allowedWrites,
+    allowed_tools: asStringArray(record, 'allowed_tools'),
+    forbidden_actions: asStringArray(record, 'forbidden_actions'),
+    child_spawn_budget: asNonNegativeInteger(record, 'child_spawn_budget'),
+    task_spec: parseTaskSpec(record.task_spec),
+  };
+}
+
+function parseLifecycleEvent(value: unknown): RigConductorLifecycleEvent {
+  const record = asRecord(value, 'lifecycle event');
+  const checks = record.checks === undefined ? undefined : record.checks;
+  if (checks !== undefined && !Array.isArray(checks)) throw new Error('lifecycle_events.checks must be an array when present');
+  return {
+    type: asEnum(RIG_EVENT_TYPES, record.type, 'lifecycle_events.type') as RigLifecycleEventType,
+    node_id: optionalString(record, 'node_id'),
+    ref: optionalString(record, 'ref'),
+    disposal_confirmed: typeof record.disposal_confirmed === 'boolean' ? record.disposal_confirmed : undefined,
+    checks: Array.isArray(checks) ? checks.map(parseStructuredCheck) : undefined,
+  };
+}
+
+function parseSynthesis(value: unknown): RigConductorSynthesis | undefined {
+  if (value === undefined) return undefined;
+  const record = asRecord(value, 'synthesis');
+  return {
+    owner: asString(record, 'owner'),
+    return_to: asString(record, 'return_to'),
+    child_return_refs: asStringArray(record, 'child_return_refs'),
+    disposal_confirmed: record.disposal_confirmed === true,
+  };
+}
+
+export function parseRigConductorEnvelope(value: unknown): RigConductorEnvelope {
+  const record = asRecord(value, 'rig conductor envelope');
+  if (record.schema !== RIG_CONDUCTOR_SCHEMA) throw new Error(`schema must be ${RIG_CONDUCTOR_SCHEMA}`);
+  const rigId = asString(record, 'rig_id');
+  const lane = asString(record, 'lane');
+  assertPortableRef(rigId, 'rig_id');
+  assertPortableRef(lane, 'lane');
+  const allowedWrites = asStringArray(record, 'allowed_writes');
+  for (const ref of allowedWrites) assertPortableRef(ref, 'allowed_writes');
+  const childNodes = (record.child_nodes ?? []) as unknown;
+  if (!Array.isArray(childNodes)) throw new Error('child_nodes must be an array');
+  const lifecycleEvents = (record.lifecycle_events ?? []) as unknown;
+  if (!Array.isArray(lifecycleEvents)) throw new Error('lifecycle_events must be an array');
+  const stationEdges = (record.station_edges ?? []) as unknown;
+  if (!Array.isArray(stationEdges)) throw new Error('station_edges must be an array');
+  return {
+    schema: RIG_CONDUCTOR_SCHEMA,
+    rig_id: rigId,
+    workflow_id: asString(record, 'workflow_id'),
+    lane,
+    execution_strategy: asEnum(EXECUTION_STRATEGIES, record.execution_strategy, 'execution_strategy') as RigExecutionStrategy,
+    parent_node: asString(record, 'parent_node'),
+    return_to: asString(record, 'return_to'),
+    synthesis_owner: asString(record, 'synthesis_owner'),
+    allowed_writes: allowedWrites,
+    allowed_tools: asStringArray(record, 'allowed_tools'),
+    forbidden_actions: asStringArray(record, 'forbidden_actions'),
+    child_spawn_budget: asNonNegativeInteger(record, 'child_spawn_budget'),
+    max_depth: asNonNegativeInteger(record, 'max_depth'),
+    total_descendant_budget: asNonNegativeInteger(record, 'total_descendant_budget'),
+    ephemeral_children: asTrue(record, 'ephemeral_children'),
+    stations: parseStations(record.stations),
+    station_edges: stationEdges.map(parseStationEdge),
+    child_nodes: childNodes.map(parseChildNode),
+    lifecycle_events: lifecycleEvents.map(parseLifecycleEvent),
+    synthesis: parseSynthesis(record.synthesis),
+    authority_boundary: parseAuthorityBoundary(record.authority_boundary),
+  };
+}
+
+function isSubset(child: string[], parent: string[]): boolean {
+  return child.every((item) => parent.includes(item));
+}
+
+function hasCycle(edges: RigConductorStationEdge[]): boolean {
+  const graph = new Map<keyof RigConductorStations, Array<keyof RigConductorStations>>();
+  for (const edge of edges) {
+    graph.set(edge.from, [...(graph.get(edge.from) ?? []), edge.to]);
+  }
+  const visiting = new Set<keyof RigConductorStations>();
+  const visited = new Set<keyof RigConductorStations>();
+  const visit = (node: keyof RigConductorStations): boolean => {
+    if (visiting.has(node)) return true;
+    if (visited.has(node)) return false;
+    visiting.add(node);
+    for (const next of graph.get(node) ?? []) {
+      if (visit(next)) return true;
+    }
+    visiting.delete(node);
+    visited.add(node);
+    return false;
+  };
+  return (['orchestration_lead', 'rig_lead', 'synthesis_owner', 'reviewer'] as Array<keyof RigConductorStations>).some(visit);
+}
+
+function childWritesCanonicalSurface(child: RigConductorChildNode): boolean {
+  return child.allowed_writes.some((ref) => CANONICAL_WRITE_PREFIXES.some((prefix) => ref === prefix || ref.startsWith(`${prefix}/`)))
+    || child.allowed_tools.some((tool) => (CANONICAL_TOOLS as readonly string[]).includes(tool));
+}
+
+function childScratchIsolated(envelope: RigConductorEnvelope): boolean {
+  const seen = new Set<string>();
+  for (const child of envelope.child_nodes) {
+    if (child.allowed_writes.length === 0) continue;
+    if (child.scratch_ref === undefined) return false;
+    if (seen.has(child.scratch_ref)) return false;
+    seen.add(child.scratch_ref);
+  }
+  return true;
+}
+
+function containsAuthorityWriteClaim(value: unknown): boolean {
+  if (!isRecord(value)) return false;
+  for (const [key, child] of Object.entries(value)) {
+    const normalized = key.toLowerCase();
+    const isProhibition = normalized.includes('cannot')
+      || normalized.includes('requires')
+      || normalized.includes('read_only')
+      || normalized.includes('false');
+    if (!isProhibition && /(authority|authorize|grant|merge|close|promote|push|sign|mint)/i.test(key) && child === true) {
+      return true;
+    }
+    if (containsAuthorityWriteClaim(child)) return true;
+  }
+  return false;
+}
+
+function computeDepths(envelope: RigConductorEnvelope): Map<string, number> {
+  const childrenByParent = new Map<string, RigConductorChildNode[]>();
+  for (const child of envelope.child_nodes) {
+    childrenByParent.set(child.parent_node, [...(childrenByParent.get(child.parent_node) ?? []), child]);
+  }
+  const depths = new Map<string, number>();
+  const visit = (parent: string, depth: number, path: Set<string>): void => {
+    for (const child of childrenByParent.get(parent) ?? []) {
+      if (path.has(child.node_id)) {
+        depths.set(child.node_id, Number.POSITIVE_INFINITY);
+        continue;
+      }
+      depths.set(child.node_id, depth);
+      visit(child.node_id, depth + 1, new Set([...path, child.node_id]));
+    }
+  };
+  visit(envelope.parent_node, 1, new Set([envelope.parent_node]));
+  return depths;
+}
+
+function lifecycleEventsValid(envelope: RigConductorEnvelope): boolean {
+  const childIds = new Set(envelope.child_nodes.map((child) => child.node_id));
+  return envelope.lifecycle_events.every((event) => {
+    if (event.type === 'rig_opened' || event.type === 'rig_closed') return event.node_id === undefined || event.node_id === envelope.rig_id;
+    return typeof event.node_id === 'string' && childIds.has(event.node_id);
+  });
+}
+
+function closedRig(envelope: RigConductorEnvelope): boolean {
+  return envelope.lifecycle_events.some((event) => event.type === 'rig_closed');
+}
+
+function returnEventsByChild(envelope: RigConductorEnvelope): Map<string, RigConductorLifecycleEvent[]> {
+  const byChild = new Map<string, RigConductorLifecycleEvent[]>();
+  for (const event of envelope.lifecycle_events) {
+    if (event.type !== 'child_returned' || event.node_id === undefined) continue;
+    byChild.set(event.node_id, [...(byChild.get(event.node_id) ?? []), event]);
+  }
+  return byChild;
+}
+
+function childReturnChecksPresent(envelope: RigConductorEnvelope): boolean {
+  if (!closedRig(envelope)) return true;
+  const returnsByChild = returnEventsByChild(envelope);
+  return envelope.child_nodes.every((child) => (
+    (returnsByChild.get(child.node_id) ?? []).some((event) => (event.checks ?? []).length > 0)
+  ));
+}
+
+function childReturnChecksNonblocking(envelope: RigConductorEnvelope): boolean {
+  if (!closedRig(envelope)) return true;
+  const returnsByChild = returnEventsByChild(envelope);
+  return envelope.child_nodes.every((child) => {
+    const checks = (returnsByChild.get(child.node_id) ?? []).flatMap((event) => event.checks ?? []);
+    return checks.length > 0 && checks.every((check) => check.blocking === false);
+  });
+}
+
+function pushReason(reasons: string[], ok: boolean, reason: string): void {
+  if (!ok) reasons.push(reason);
+}
+
+export function evaluateRigConductorEnvelope(raw: unknown): RigConductorValidation {
+  const envelope = parseRigConductorEnvelope(raw);
+  const reasons: string[] = [];
+  const childReturnRefs = new Set(envelope.lifecycle_events
+    .filter((event) => event.type === 'child_returned' && typeof event.ref === 'string')
+    .map((event) => event.ref as string));
+  const childIds = new Set(envelope.child_nodes.map((child) => child.node_id));
+  const depths = computeDepths(envelope);
+  const observedDepths = [...depths.values()];
+  const maxObservedDepth = observedDepths.length === 0 ? 0 : Math.max(...observedDepths);
+  const descendantBudgetRequested = envelope.child_nodes.length
+    + envelope.child_nodes.reduce((sum, child) => sum + child.child_spawn_budget, 0);
+  const strategySupported = !(RESERVED_STRATEGIES as readonly string[]).includes(envelope.execution_strategy);
+  const stationGraphAcyclic = !hasCycle(envelope.station_edges);
+  const reviewerNotImplementer = envelope.child_nodes.every((child) => (
+    child.assigned_to !== envelope.stations.reviewer && child.node_id !== envelope.stations.reviewer
+  ));
+  const childEnvelopesSubsetParent = envelope.child_nodes.every((child) => (
+    child.lane === envelope.lane
+    && isSubset(child.allowed_writes, envelope.allowed_writes)
+    && isSubset(child.allowed_tools, envelope.allowed_tools)
+    && isSubset(envelope.forbidden_actions, child.forbidden_actions)
+  ));
+  const childTaskSpecsSubsetEnvelopes = envelope.child_nodes.every((child) => (
+    child.task_spec.lane === child.lane
+    && child.task_spec.assigned_to === child.assigned_to
+    && isSubset(child.task_spec.allowed_writes, child.allowed_writes)
+    && child.task_spec.return_contract.return_to === child.return_to
+    && child.task_spec.return_contract.disposal_confirmed_required === true
+    && child.task_spec.return_contract.required_refs.length > 0
+    && child.task_spec.validation.length > 0
+  ));
+  const scratchIsolated = childScratchIsolated(envelope);
+  const childrenNotCanonicalWriters = envelope.child_nodes.every((child) => !childWritesCanonicalSurface(child));
+  const childBudgetWithinParent = envelope.child_nodes.length <= envelope.child_spawn_budget
+    && descendantBudgetRequested <= envelope.total_descendant_budget
+    && envelope.child_nodes.every((child) => {
+      const parentBudget = child.parent_node === envelope.parent_node
+        ? envelope.child_spawn_budget
+        : envelope.child_nodes.find((candidate) => candidate.node_id === child.parent_node)?.child_spawn_budget ?? -1;
+      return parentBudget > 0 && child.child_spawn_budget < parentBudget;
+    });
+  const depthWithinMax = maxObservedDepth <= envelope.max_depth && observedDepths.every(Number.isFinite) && depths.size === childIds.size;
+  const closed = closedRig(envelope);
+  const synthesisHasChildRefs = !closed || (
+    envelope.synthesis !== undefined
+    && envelope.synthesis.owner === envelope.synthesis_owner
+    && envelope.synthesis.return_to === envelope.return_to
+    && envelope.child_nodes.every((child) => (
+      envelope.synthesis?.child_return_refs.includes(child.node_id)
+      || envelope.synthesis?.child_return_refs.some((ref) => childReturnRefs.has(ref) && child.task_spec.return_contract.required_refs.includes(ref))
+    ))
+  );
+  const disposalConfirmed = !closed || (
+    envelope.synthesis?.disposal_confirmed === true
+    && envelope.lifecycle_events
+      .filter((event) => event.type === 'child_returned')
+      .every((event) => event.disposal_confirmed === true)
+  );
+  const returnChecksPresent = childReturnChecksPresent(envelope);
+  const returnChecksNonblocking = childReturnChecksNonblocking(envelope);
+  const eventsValid = lifecycleEventsValid(envelope);
+  const authorityBoundaryFalse = !containsAuthorityWriteClaim(raw);
+  const checks = {
+    strategy_supported: strategySupported,
+    station_graph_acyclic: stationGraphAcyclic,
+    reviewer_not_implementer: reviewerNotImplementer,
+    child_envelopes_subset_parent: childEnvelopesSubsetParent,
+    child_task_specs_subset_envelopes: childTaskSpecsSubsetEnvelopes,
+    child_scratch_isolated: scratchIsolated,
+    children_not_canonical_writers: childrenNotCanonicalWriters,
+    child_budget_within_parent: childBudgetWithinParent,
+    depth_within_max: depthWithinMax,
+    synthesis_has_child_refs: synthesisHasChildRefs,
+    child_return_checks_present: returnChecksPresent,
+    child_return_checks_nonblocking: returnChecksNonblocking,
+    disposal_confirmed: disposalConfirmed,
+    lifecycle_events_valid: eventsValid,
+    authority_boundary_false: authorityBoundaryFalse,
+  };
+  pushReason(reasons, checks.strategy_supported, 'strategy_reserved');
+  pushReason(reasons, checks.station_graph_acyclic, 'station_cycle');
+  pushReason(reasons, checks.reviewer_not_implementer, 'reviewer_is_implementer');
+  pushReason(reasons, checks.child_envelopes_subset_parent, 'child_envelope_widens_parent');
+  pushReason(reasons, checks.child_task_specs_subset_envelopes, 'task_spec_not_subset_or_missing_return_contract');
+  pushReason(reasons, checks.child_scratch_isolated, 'child_scratch_not_isolated');
+  pushReason(reasons, checks.children_not_canonical_writers, 'child_canonical_write_surface');
+  pushReason(reasons, checks.child_budget_within_parent, 'child_budget_exhausted');
+  pushReason(reasons, checks.depth_within_max, 'depth_exceeds_max');
+  pushReason(reasons, checks.synthesis_has_child_refs, 'synthesis_missing_child_refs');
+  pushReason(reasons, checks.child_return_checks_present, 'child_return_checks_missing');
+  pushReason(reasons, checks.child_return_checks_nonblocking, 'child_return_blocking');
+  pushReason(reasons, checks.disposal_confirmed, 'disposal_unconfirmed');
+  pushReason(reasons, checks.lifecycle_events_valid, 'lifecycle_event_invalid');
+  pushReason(reasons, checks.authority_boundary_false, 'authority_field_write_attempt');
+  return {
+    schema: RIG_CONDUCTOR_VALIDATION_SCHEMA,
+    rig_ref: envelope.rig_id,
+    verdict: reasons.length === 0 ? 'legitimate' : 'blocked',
+    reasons,
+    checks,
+    derived: {
+      max_observed_depth: maxObservedDepth,
+      child_count: envelope.child_nodes.length,
+      descendant_budget_requested: descendantBudgetRequested,
+    },
+    authority_boundary: {
+      ...envelope.authority_boundary,
+      validation_grants_authority: false,
+      topology_is_routing_only: true,
+    },
+  };
+}