@evomap/evolver-core 2.0.0-beta.19 → 2.0.0-beta.22

package/dist/verify/validation.js

@@ -1,6 +1,70 @@
 // With shell:false these are passed literally (harmless), but their presence means an injection attempt
 // or a command that wrongly assumes a shell (e.g. `a && b`) — reject loudly so it is split, not silently mis-run.
 export const SHELL_METACHARS = /[;&|`$<>\n\r]/;
+/**
+ * Parse one validation command without invoking a shell. Quotes group whitespace and backslash only escapes
+ * whitespace, quotes, or another backslash; no variable expansion or command substitution is performed.
+ * A null result means the command has an unterminated quote and must be rejected.
+ */
+export function tokenizeValidationCommand(command) {
+    const value = String(command ?? '');
+    const tokens = [];
+    let current = '';
+    let tokenStarted = false;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const ch = value[index];
+        if (escaped) {
+            current += ch;
+            tokenStarted = true;
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\' && quote !== "'") {
+            const next = value[index + 1];
+            if (next !== undefined && (/\s/.test(next) || next === '"' || next === "'" || next === '\\')) {
+                escaped = true;
+                tokenStarted = true;
+                continue;
+            }
+        }
+        if (quote !== null) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            tokenStarted = true;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            tokenStarted = true;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (tokenStarted) {
+                tokens.push(current);
+                current = '';
+                tokenStarted = false;
+            }
+            continue;
+        }
+        current += ch;
+        tokenStarted = true;
+    }
+    if (quote !== null)
+        return null;
+    if (escaped) {
+        current += '\\';
+        tokenStarted = true;
+    }
+    if (tokenStarted)
+        tokens.push(current);
+    return tokens;
+}
 // Node flags that turn `node` into an arbitrary-code evaluator or preload hook. A legit validation command is
 // `node <script> [args]`; these flags must be denied by the sandbox and must never be hidden by missing-script skip.
 export const BLOCKED_NODE_FLAGS = new Set([
@@ -12,6 +76,10 @@ export const BLOCKED_NODE_FLAGS = new Set([
     '--inspect', '--inspect-brk', '--inspect-port', '--inspect-publish-uid',
     // Watch: keeps the process alive past its work → hangs validation until the sandbox SIGKILLs it (DoS).
     '--watch', '--watch-path', '--watch-preserve-output',
+    // Package/test runners execute code selected from package metadata or the checkout, not one declared script.
+    '--run', '--test',
+    // Input-type changes stdin into an evaluator; validation must always name a script explicitly.
+    '--input-type', '-',
     // Module-resolution override: can redirect imports/requires to attacker-chosen code paths.
     '--conditions', '-C',
 ]);
@@ -28,32 +96,72 @@ export function nodeFlagViolation(executable, args) {
     if (!isNodeExecutable(executable))
         return null;
     for (const a of args) {
+        // Node stops interpreting its own flags at the first script (or `--` delimiter). Anything after that is
+        // an argv value owned by the script, even when it happens to match a blocked Node option name.
+        if (a === '--' || !a.startsWith('-'))
+            return null;
         const flag = a.split('=')[0] ?? a;
         if (BLOCKED_NODE_FLAGS.has(flag))
             return flag;
     }
     return null;
 }
+const SAFE_NODE_SCRIPT_FLAGS = new Set(['-c', '--check']);
+const SAFE_NODE_NO_SCRIPT_FLAGS = new Set(['-v', '--version', '-h', '--help']);
+/**
+ * 将 Node 命令限制为明确的脚本位置，防止带参数的选项吞掉下一个 token 后绕过脚本路径检查。
+ * 验证只需要普通脚本、语法检查，以及兼容旧 Gene 的 version/help 身份检查；其他前置选项默认拒绝。
+ */
+export function classifyNodeValidationInvocation(executable, args) {
+    if (!isNodeExecutable(executable))
+        return { kind: 'invalid' };
+    const blocked = nodeFlagViolation(executable, args);
+    if (blocked)
+        return { kind: 'invalid', option: blocked };
+    if (args.length === 1 && SAFE_NODE_NO_SCRIPT_FLAGS.has(args[0])) {
+        return { kind: 'safe_no_script' };
+    }
+    let index = 0;
+    let afterEndOfOptions = false;
+    while (index < args.length) {
+        const token = args[index];
+        if (token === '--') {
+            afterEndOfOptions = true;
+            index += 1;
+            break;
+        }
+        if (SAFE_NODE_SCRIPT_FLAGS.has(token)) {
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('-')) {
+            return { kind: 'invalid', option: token.split('=')[0] ?? token };
+        }
+        break;
+    }
+    const script = args[index];
+    if (!script || (!afterEndOfOptions && script.startsWith('-')))
+        return { kind: 'invalid' };
+    return { kind: 'script', script };
+}
 /** 命令首 token(可执行名)是否在项目声明的 allowlist 内. */
 export function isAllowed(cmd, allowlist) {
-    const head = cmd.trim().split(/\s+/)[0] ?? '';
+    const tokens = tokenizeValidationCommand(cmd);
+    const head = tokens?.[0] ?? '';
     return allowlist.includes(head);
 }
-/** Extract the local script targeted by `node <script> ...`, or null for non-script node commands. */
+/** Extract the unambiguous script targeted by `node <script> ...`, or null for non-script/unsupported commands. */
 export function validationScriptPath(cmd) {
-    const tokens = String(cmd ?? '').trim().split(/\s+/);
+    const tokens = tokenizeValidationCommand(cmd);
+    if (!tokens || tokens.length < 2)
+        return null;
     const executable = tokens[0] ?? '';
-    if (tokens.length < 2 || !isNodeExecutable(executable))
+    if (!isNodeExecutable(executable))
         return null;
-    if (SHELL_METACHARS.test(cmd) || nodeFlagViolation(executable, tokens.slice(1)))
+    if (SHELL_METACHARS.test(cmd))
         return null;
-    for (let i = 1; i < tokens.length; i += 1) {
-        const token = tokens[i];
-        if (token.startsWith('-'))
-            continue;
-        return /\.(?:c|m)?js$/.test(token) ? token : null;
-    }
-    return null;
+    const invocation = classifyNodeValidationInvocation(executable, tokens.slice(1));
+    return invocation.kind === 'script' ? invocation.script : null;
 }
 /** stdout 摘要 = 首行 + 末行(去 canary.js 隐形约定: 不找魔法字符串, 只留可读摘要). */
 export function summarizeStdout(stdout) {
@@ -68,20 +176,30 @@ export function summarizeStdout(stdout) {
  * 跑校验(M4A-4). 判价值 = **exit code + stdout 摘要**, 不依赖 canary.js 魔法字符串(批注#22).
  * 不在 allowlist 的命令 auto-deny(不执行, allowed=false), 守无人值守安全.
  */
-export async function runValidation(plan, run) {
+export async function runValidation(plan, run, signal) {
     const results = [];
+    let cancelled = signal?.aborted === true;
     for (const c of plan.commands) {
+        if (signal?.aborted) {
+            cancelled = true;
+            break;
+        }
         const label = c.label ?? c.cmd;
         if (!isAllowed(c.cmd, plan.allowlist)) {
             results.push({ label, cmd: c.cmd, allowed: false, exitCode: null, stdoutSummary: '', passed: false });
             continue;
         }
-        const out = await run(c.cmd);
+        const out = await run(c.cmd, signal);
         results.push({ label, cmd: c.cmd, allowed: true, exitCode: out.exitCode, stdoutSummary: summarizeStdout(out.stdout), passed: out.exitCode === 0 });
+        // runner 可能在返回结果后才观察到取消；此时不能让完整的 exit-0 列表伪装成通过。
+        if (signal?.aborted) {
+            cancelled = true;
+            break;
+        }
     }
     // 全部 allowed 的命令都 exit 0 才算通过; 有命令被 deny 视为未通过(校验不完整)
-    const passed = results.length > 0 && results.every((r) => r.allowed && r.passed);
-    return { results, passed };
+    const passed = !cancelled && results.length > 0 && results.every((r) => r.allowed && r.passed);
+    return { results, passed, cancelled };
 }
 /**
  * 检查验证命令是否安全可作为 Gene.validation 条目使用（忠实移植 v1 policyCheck.isValidationCommandAllowed）。
@@ -96,9 +214,6 @@ export function isValidationCommandAllowed(cmd) {
     const c = String(cmd || '').trim();
     if (!c)
         return false;
-    // 只允许 node 命令作为验证命令
-    if (!c.startsWith('node '))
-        return false;
     // 不允许命令替换
     if (/`|\$\(/.test(c))
         return false;
@@ -106,11 +221,13 @@ export function isValidationCommandAllowed(cmd) {
     const stripped = c.replace(/"[^"]*"/g, '').replace(/'[^']*'/g, '');
     if (SHELL_METACHARS.test(stripped))
         return false;
-    // 检查被阻止的 node 标志
-    const tokens = c.split(/\s+/);
+    // 检查被阻止或会让脚本位置产生歧义的 node 标志
+    const tokens = tokenizeValidationCommand(c);
+    if (!tokens)
+        return false;
     const executable = tokens[0] ?? '';
-    const args = tokens.slice(1);
-    if (nodeFlagViolation(executable, args))
+    if (executable !== 'node')
         return false;
-    return true;
+    const args = tokens.slice(1);
+    return classifyNodeValidationInvocation(executable, args).kind !== 'invalid';
 }

package/dist/wire/geneHints.d.ts

@@ -3,15 +3,14 @@
  * router (routing_hint) or restrict tools (tool_policy). Ported from v1 src/gep/schemas/gene.js (PR #93,
  * "wire routing_hint and tool_policy into Gene schema").
  *
- * v2-delta (feature-gate): these fields are NOT yet in @evomap/gep-sdk's gene.schema.json
- * (additionalProperties:false), so a Gene carrying them is not a schema-valid gep-sdk asset until a
- * gep-sdk gene-schema bump — exactly how Capsule's proof_of_work / resolution_status were v2-delta before
- * the 1.11.0 bump made them first-class. That invalidity is surfaced ONLY by the advisory validateWire
- * (wire/schemaGate) — at intake on the hint-stripped core, and via the evolver_gep_build pre-publish
- * preview — plus the hub's own schema check on receipt; there is NO enforced local egress gate (the
- * publish/egress path is sanitize-only and does not call validateWire). Until a bump the hints ride along
- * LOCALLY (intake pool + v1→v2 import fidelity); nothing in this repo wires them to a runtime consumer yet
- * (the proxy model router's `gene_hint` seam is the eventual tier consumer — see
+ * routing_hint / tool_policy and the K_auto coordinates are first-class in @evomap/gep-sdk 1.13.0, so they
+ * are normalized here rather than stripped. generation_meta and model_name remain local-only annotations for
+ * now. The advisory validateWire still surfaces any malformed shape — at intake on the local-only slice, and
+ * via the evolver_gep_build pre-publish preview — plus the hub's own schema check on receipt; there is NO
+ * enforced local egress gate (the publish/egress path is sanitize-only and does not call validateWire).
+ *
+ * Until a future schema bump, nothing in this repo wires these annotations to a runtime consumer yet (the
+ * proxy model router's `gene_hint` seam is the eventual tier consumer — see
  * packages/evolver-proxy/src/router/modelRouter.ts).
  *
  * Enum strings are matched case-sensitively by the consuming router / tool-gate — keep them EXACT. The
@@ -55,7 +54,7 @@ export interface GeneGenerationHeuristics {
     has_corrective_insight?: boolean;
 }
 /**
- * The full provenance + quality metadata block (V1 `gene._source`). Lives on Gene as the v2-delta field
+ * The full provenance + quality metadata block (V1 `gene._source`). Lives on Gene as the local-only field
  * `generation_meta`. `source` is the only required key; the rest is descriptive for reviewers / future
  * governance. `quality_score` is a coarse [0,1] tier-anchored score (evolved 0.7 / distilled 0.4 / manual 0.3
  * baseline + bonuses); `overcame_errors` is the mutation_log copy that the trajectory overcame.
@@ -67,12 +66,56 @@ export interface GenerationMeta {
     overcame_errors?: string[];
 }
 /**
- * The v2-delta hint field names, in one place — the intake gate strips these before the gep-sdk schema check.
- * IMPORTANT: when a gep-sdk gene-schema bump makes one of these first-class, REMOVE it from this list in the
- * same change. Otherwise intakeGene keeps stripping a now-validated field before validateWire (fail-open — the
- * field's new schema constraints go unchecked at intake) while asset_id still commits it.
+ * K_auto projection-key coordinates a Gene MAY carry so its record is machine-decidable in the strict
+ * automatic-governance subdomain (paper §K_auto; validator: algo/kautoValidator.ts). These four fields are the
+ * DEDICATED, structured form of the coordinates that production previously expressed only through proxy fields
+ * (category≈claim, signals_match≈scope, model_name≈runtime, validation≈verifier). The strict measurement
+ * (bench/thesis/result-kauto-strict.json) found the dedicated fields populated at 0% and three coordinates
+ * (version/claim/scope) undecidable for 100% of 5,665 real rows — the writer side simply never emitted them.
+ *
+ * Shapes mirror gep-sdk 1.13.0 gene.schema.json (PR: add Gene K_auto coordinates), the schema-authoritative
+ * definition, EXACTLY so a gene minted here validates once the SDK bump lands:
+ *   claims:           {predicate:string, kind?:'behavioral'|'structural'|'performance'|'safety'}[]
+ *   scope:            {signals:string[], predicate?:string}
+ *   runtime_profile:  {runtime:string, env_class?:'ci'|'local'|'prod'|'sandbox'}
+ *   verifier_profile: {verifier:string, decision?:'pass'|'fail'|'inconclusive'}
+ *
+ * Since gep-sdk 1.13.0, these four coordinates are first-class Gene fields: the intake schema gate validates
+ * their dedicated structure instead of stripping them as local-only hints. They still ride along in asset_id
+ * (canonicalize hashes every own key), so a silent strip on the hub side would change the hashed bytes and fail
+ * gene_asset_id_verification_failed; the hub allowlist admits them for exactly this reason.
+ */
+export declare const CLAIM_KINDS: readonly ["behavioral", "structural", "performance", "safety"];
+export type ClaimKind = (typeof CLAIM_KINDS)[number];
+export interface GeneClaim {
+    predicate: string;
+    kind?: ClaimKind;
+}
+export declare const ENV_CLASSES: readonly ["ci", "local", "prod", "sandbox"];
+export type EnvClass = (typeof ENV_CLASSES)[number];
+export interface GeneRuntimeProfile {
+    runtime: string;
+    env_class?: EnvClass;
+}
+export declare const VERIFIER_DECISIONS: readonly ["pass", "fail", "inconclusive"];
+export type VerifierDecision = (typeof VERIFIER_DECISIONS)[number];
+export interface GeneVerifierProfile {
+    verifier: string;
+    decision?: VerifierDecision;
+}
+export interface GeneScope {
+    signals: string[];
+    predicate?: string;
+}
+/**
+ * The still-local-only Gene field names, in one place — the intake gate strips these before the gep-sdk schema
+ * check. IMPORTANT: when a gep-sdk gene-schema bump makes one of these first-class, REMOVE it from this list in
+ * the same change. Otherwise intakeGene keeps stripping a now-validated field before validateWire (fail-open —
+ * the field's new schema constraints go unchecked at intake) while asset_id still commits it.
+ *
+ * Only generation_meta and model_name remain local-only annotations for now, so the strip list is just those two.
  */
-export declare const GENE_HINT_FIELDS: readonly ["routing_hint", "tool_policy", "generation_meta"];
+export declare const GENE_HINT_FIELDS: readonly ["generation_meta", "model_name"];
 /**
  * Normalize an arbitrary routing_hint fragment to a strict { tier?, reasoning_level? } object, or null.
  * Unknown enum values are dropped (a stray tier would fail the consumer's exhaustive match and route as if
@@ -101,5 +144,34 @@ export declare function normalizeToolPolicy(raw: unknown): GeneToolPolicy | null
  * alone is a meaningful provenance tag); only a missing/unknown source yields null.
  */
 export declare function normalizeGenerationMeta(raw: unknown): GenerationMeta | null;
-/** Strip the v2-delta hint fields from a gene-shaped object (used to validate the gep-sdk-known core). */
+/**
+ * Normalize an arbitrary claims fragment to a strict GeneClaim[] or null. A claim survives only with a
+ * non-empty string `predicate`; `kind` is kept only if it is one of the closed enum members (a stray kind is
+ * dropped, mirroring the enum typeguards for tier/severity). Predicates are trimmed and length-bounded so a
+ * runaway string cannot bloat the hashed bytes. An empty result → null ("no explicit claim"), which keeps the
+ * gene OUT of strict K_auto rather than fabricating a coordinate.
+ */
+export declare function normalizeClaims(raw: unknown): GeneClaim[] | null;
+/**
+ * Normalize an arbitrary scope fragment to a strict { signals, predicate? } object or null. `signals` keeps only
+ * non-empty trimmed strings; the block collapses to null when none survive (an empty signal list is not a scope).
+ * `predicate` is kept only as a non-empty trimmed string. Deliberately lossy like the hint normalizers.
+ */
+export declare function normalizeGeneScope(raw: unknown): GeneScope | null;
+/**
+ * Normalize an arbitrary runtime_profile fragment to { runtime, env_class? } or null. `runtime` must be a
+ * non-empty trimmed string (the coordinate is meaningless without it); `env_class` is kept only if it is a
+ * closed enum member. Note this is DISTINCT from the flat `model_name` field — model_name records WHICH LLM
+ * produced the gene (an authorship/tier signal); runtime_profile records the EXECUTION environment class the
+ * claims were established under. A producer may set either, both, or neither.
+ */
+export declare function normalizeRuntimeProfile(raw: unknown): GeneRuntimeProfile | null;
+/**
+ * Normalize an arbitrary verifier_profile fragment to { verifier, decision? } or null. `verifier` must be a
+ * non-empty trimmed string; `decision` is kept only if it is a closed enum member. This is the verifier IDENTITY
+ * axis (e.g. 'npm-test', 'gep-verify@1.4'); the substantive-command bar the strict validator applies is checked
+ * downstream in kautoValidator.decideVerifier, not here — this layer only shapes the field.
+ */
+export declare function normalizeVerifierProfile(raw: unknown): GeneVerifierProfile | null;
+/** Strip only local-only Gene annotations before validating against the gep-sdk schema. */
 export declare function stripGeneHints(gene: Record<string, unknown>): Record<string, unknown>;

package/dist/wire/geneHints.js

@@ -3,15 +3,14 @@
  * router (routing_hint) or restrict tools (tool_policy). Ported from v1 src/gep/schemas/gene.js (PR #93,
  * "wire routing_hint and tool_policy into Gene schema").
  *
- * v2-delta (feature-gate): these fields are NOT yet in @evomap/gep-sdk's gene.schema.json
- * (additionalProperties:false), so a Gene carrying them is not a schema-valid gep-sdk asset until a
- * gep-sdk gene-schema bump — exactly how Capsule's proof_of_work / resolution_status were v2-delta before
- * the 1.11.0 bump made them first-class. That invalidity is surfaced ONLY by the advisory validateWire
- * (wire/schemaGate) — at intake on the hint-stripped core, and via the evolver_gep_build pre-publish
- * preview — plus the hub's own schema check on receipt; there is NO enforced local egress gate (the
- * publish/egress path is sanitize-only and does not call validateWire). Until a bump the hints ride along
- * LOCALLY (intake pool + v1→v2 import fidelity); nothing in this repo wires them to a runtime consumer yet
- * (the proxy model router's `gene_hint` seam is the eventual tier consumer — see
+ * routing_hint / tool_policy and the K_auto coordinates are first-class in @evomap/gep-sdk 1.13.0, so they
+ * are normalized here rather than stripped. generation_meta and model_name remain local-only annotations for
+ * now. The advisory validateWire still surfaces any malformed shape — at intake on the local-only slice, and
+ * via the evolver_gep_build pre-publish preview — plus the hub's own schema check on receipt; there is NO
+ * enforced local egress gate (the publish/egress path is sanitize-only and does not call validateWire).
+ *
+ * Until a future schema bump, nothing in this repo wires these annotations to a runtime consumer yet (the
+ * proxy model router's `gene_hint` seam is the eventual tier consumer — see
  * packages/evolver-proxy/src/router/modelRouter.ts).
  *
  * Enum strings are matched case-sensitively by the consuming router / tool-gate — keep them EXACT. The
@@ -32,12 +31,37 @@ export const TOOL_POLICY_SEVERITIES = ['warn', 'block'];
  */
 export const GENERATION_SOURCES = ['evolved', 'distilled', 'manual'];
 /**
- * The v2-delta hint field names, in one place — the intake gate strips these before the gep-sdk schema check.
- * IMPORTANT: when a gep-sdk gene-schema bump makes one of these first-class, REMOVE it from this list in the
- * same change. Otherwise intakeGene keeps stripping a now-validated field before validateWire (fail-open — the
- * field's new schema constraints go unchecked at intake) while asset_id still commits it.
+ * K_auto projection-key coordinates a Gene MAY carry so its record is machine-decidable in the strict
+ * automatic-governance subdomain (paper §K_auto; validator: algo/kautoValidator.ts). These four fields are the
+ * DEDICATED, structured form of the coordinates that production previously expressed only through proxy fields
+ * (category≈claim, signals_match≈scope, model_name≈runtime, validation≈verifier). The strict measurement
+ * (bench/thesis/result-kauto-strict.json) found the dedicated fields populated at 0% and three coordinates
+ * (version/claim/scope) undecidable for 100% of 5,665 real rows — the writer side simply never emitted them.
+ *
+ * Shapes mirror gep-sdk 1.13.0 gene.schema.json (PR: add Gene K_auto coordinates), the schema-authoritative
+ * definition, EXACTLY so a gene minted here validates once the SDK bump lands:
+ *   claims:           {predicate:string, kind?:'behavioral'|'structural'|'performance'|'safety'}[]
+ *   scope:            {signals:string[], predicate?:string}
+ *   runtime_profile:  {runtime:string, env_class?:'ci'|'local'|'prod'|'sandbox'}
+ *   verifier_profile: {verifier:string, decision?:'pass'|'fail'|'inconclusive'}
+ *
+ * Since gep-sdk 1.13.0, these four coordinates are first-class Gene fields: the intake schema gate validates
+ * their dedicated structure instead of stripping them as local-only hints. They still ride along in asset_id
+ * (canonicalize hashes every own key), so a silent strip on the hub side would change the hashed bytes and fail
+ * gene_asset_id_verification_failed; the hub allowlist admits them for exactly this reason.
  */
-export const GENE_HINT_FIELDS = ['routing_hint', 'tool_policy', 'generation_meta'];
+export const CLAIM_KINDS = ['behavioral', 'structural', 'performance', 'safety'];
+export const ENV_CLASSES = ['ci', 'local', 'prod', 'sandbox'];
+export const VERIFIER_DECISIONS = ['pass', 'fail', 'inconclusive'];
+/**
+ * The still-local-only Gene field names, in one place — the intake gate strips these before the gep-sdk schema
+ * check. IMPORTANT: when a gep-sdk gene-schema bump makes one of these first-class, REMOVE it from this list in
+ * the same change. Otherwise intakeGene keeps stripping a now-validated field before validateWire (fail-open —
+ * the field's new schema constraints go unchecked at intake) while asset_id still commits it.
+ *
+ * Only generation_meta and model_name remain local-only annotations for now, so the strip list is just those two.
+ */
+export const GENE_HINT_FIELDS = ['generation_meta', 'model_name'];
 function includesEnum(set, v) {
     return typeof v === 'string' && set.includes(v);
 }
@@ -140,7 +164,92 @@ export function normalizeGenerationMeta(raw) {
         out.overcame_errors = errs;
     return out;
 }
-/** Strip the v2-delta hint fields from a gene-shaped object (used to validate the gep-sdk-known core). */
+/**
+ * Normalize an arbitrary claims fragment to a strict GeneClaim[] or null. A claim survives only with a
+ * non-empty string `predicate`; `kind` is kept only if it is one of the closed enum members (a stray kind is
+ * dropped, mirroring the enum typeguards for tier/severity). Predicates are trimmed and length-bounded so a
+ * runaway string cannot bloat the hashed bytes. An empty result → null ("no explicit claim"), which keeps the
+ * gene OUT of strict K_auto rather than fabricating a coordinate.
+ */
+export function normalizeClaims(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    const out = [];
+    for (const item of raw) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const r = item;
+        const predicate = typeof r['predicate'] === 'string' ? r['predicate'].trim().slice(0, 500) : '';
+        if (!predicate)
+            continue;
+        const claim = { predicate };
+        if (includesEnum(CLAIM_KINDS, r['kind']))
+            claim.kind = r['kind'];
+        out.push(claim);
+    }
+    return out.length > 0 ? out : null;
+}
+/**
+ * Normalize an arbitrary scope fragment to a strict { signals, predicate? } object or null. `signals` keeps only
+ * non-empty trimmed strings; the block collapses to null when none survive (an empty signal list is not a scope).
+ * `predicate` is kept only as a non-empty trimmed string. Deliberately lossy like the hint normalizers.
+ */
+export function normalizeGeneScope(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const r = raw;
+    // Trim signals and drop whitespace-only ones (cleanToolList keeps by raw length, which would leak '  ' and an
+    // untrimmed ' x ' into the hashed bytes). A scope signal is an identity/constraint term, so its canonical form
+    // is the trimmed token — the strict validator reads it trimmed anyway (decideScope maps through str()).
+    const signals = Array.isArray(r['signals'])
+        ? r['signals'].filter((x) => typeof x === 'string').map((s) => s.trim()).filter((s) => s.length > 0)
+        : [];
+    if (signals.length === 0)
+        return null;
+    const out = { signals };
+    const predicate = typeof r['predicate'] === 'string' ? r['predicate'].trim().slice(0, 500) : '';
+    if (predicate)
+        out.predicate = predicate;
+    return out;
+}
+/**
+ * Normalize an arbitrary runtime_profile fragment to { runtime, env_class? } or null. `runtime` must be a
+ * non-empty trimmed string (the coordinate is meaningless without it); `env_class` is kept only if it is a
+ * closed enum member. Note this is DISTINCT from the flat `model_name` field — model_name records WHICH LLM
+ * produced the gene (an authorship/tier signal); runtime_profile records the EXECUTION environment class the
+ * claims were established under. A producer may set either, both, or neither.
+ */
+export function normalizeRuntimeProfile(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const r = raw;
+    const runtime = typeof r['runtime'] === 'string' ? r['runtime'].trim().slice(0, 100) : '';
+    if (!runtime)
+        return null;
+    const out = { runtime };
+    if (includesEnum(ENV_CLASSES, r['env_class']))
+        out.env_class = r['env_class'];
+    return out;
+}
+/**
+ * Normalize an arbitrary verifier_profile fragment to { verifier, decision? } or null. `verifier` must be a
+ * non-empty trimmed string; `decision` is kept only if it is a closed enum member. This is the verifier IDENTITY
+ * axis (e.g. 'npm-test', 'gep-verify@1.4'); the substantive-command bar the strict validator applies is checked
+ * downstream in kautoValidator.decideVerifier, not here — this layer only shapes the field.
+ */
+export function normalizeVerifierProfile(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const r = raw;
+    const verifier = typeof r['verifier'] === 'string' ? r['verifier'].trim().slice(0, 100) : '';
+    if (!verifier)
+        return null;
+    const out = { verifier };
+    if (includesEnum(VERIFIER_DECISIONS, r['decision']))
+        out.decision = r['decision'];
+    return out;
+}
+/** Strip only local-only Gene annotations before validating against the gep-sdk schema. */
 export function stripGeneHints(gene) {
     const hidden = GENE_HINT_FIELDS;
     const out = {};

package/dist/wire/index.d.ts

@@ -2,7 +2,7 @@
  * 资产 wire 层. SSOT = @evomap/gep-sdk/schemas/*.schema.json (D19).
  * 字段一律 snake_case 锁定 (asset_id 跨实现契约); 本仓不发明 wire 字段, 只镜像 + 重导出工具.
  */
-import type { GeneRoutingHint, GeneToolPolicy, GenerationMeta } from './geneHints.js';
+import type { GeneRoutingHint, GeneToolPolicy, GenerationMeta, GeneClaim, GeneScope, GeneRuntimeProfile, GeneVerifierProfile } from './geneHints.js';
 export { SCHEMA_VERSION, canonicalize, computeAssetId, verifyAssetId } from '@evomap/gep-sdk';
 export type GepCategory = typeof import('@evomap/gep-sdk').GEP_GENE_CATEGORIES[number];
 export type OutcomeStatus = typeof import('@evomap/gep-sdk').GEP_OUTCOME_STATUSES[number];
@@ -35,6 +35,11 @@ export interface Gene {
     routing_hint?: GeneRoutingHint | null;
     tool_policy?: GeneToolPolicy | null;
     generation_meta?: GenerationMeta | null;
+    model_name?: string;
+    claims?: GeneClaim[] | null;
+    scope?: GeneScope | null;
+    runtime_profile?: GeneRuntimeProfile | null;
+    verifier_profile?: GeneVerifierProfile | null;
     asset_id: string;
 }
 /** Capsule = 表现型/纯进化产物 (capsule.schema.json). */
@@ -99,5 +104,5 @@ export interface Mutation {
     expected_effect: string;
     risk_level: RiskLevel;
 }
-export { validateWire, schemaProperties, type WireValidation } from './schemaGate.js';
-export { ROUTING_TIERS, REASONING_LEVELS, TOOL_POLICY_SEVERITIES, GENERATION_SOURCES, GENE_HINT_FIELDS, normalizeRoutingHint, normalizeToolPolicy, normalizeGenerationMeta, stripGeneHints, type RoutingTier, type ReasoningLevel, type ToolPolicySeverity, type GenerationSource, type GeneRoutingHint, type GeneToolPolicy, type GeneGenerationHeuristics, type GenerationMeta, } from './geneHints.js';
+export { validateWire, validateWireDeep, wireSchemaIssues, schemaProperties, type WireValidation, type WireSchemaIssue, } from './schemaGate.js';
+export { ROUTING_TIERS, REASONING_LEVELS, TOOL_POLICY_SEVERITIES, GENERATION_SOURCES, CLAIM_KINDS, ENV_CLASSES, VERIFIER_DECISIONS, GENE_HINT_FIELDS, normalizeRoutingHint, normalizeToolPolicy, normalizeGenerationMeta, normalizeClaims, normalizeGeneScope, normalizeRuntimeProfile, normalizeVerifierProfile, stripGeneHints, type RoutingTier, type ReasoningLevel, type ToolPolicySeverity, type GenerationSource, type ClaimKind, type EnvClass, type VerifierDecision, type GeneRoutingHint, type GeneToolPolicy, type GeneGenerationHeuristics, type GenerationMeta, type GeneClaim, type GeneScope, type GeneRuntimeProfile, type GeneVerifierProfile, } from './geneHints.js';

package/dist/wire/index.js

@@ -1,3 +1,3 @@
 export { SCHEMA_VERSION, canonicalize, computeAssetId, verifyAssetId } from '@evomap/gep-sdk';
-export { validateWire, schemaProperties } from './schemaGate.js';
-export { ROUTING_TIERS, REASONING_LEVELS, TOOL_POLICY_SEVERITIES, GENERATION_SOURCES, GENE_HINT_FIELDS, normalizeRoutingHint, normalizeToolPolicy, normalizeGenerationMeta, stripGeneHints, } from './geneHints.js';
+export { validateWire, validateWireDeep, wireSchemaIssues, schemaProperties, } from './schemaGate.js';
+export { ROUTING_TIERS, REASONING_LEVELS, TOOL_POLICY_SEVERITIES, GENERATION_SOURCES, CLAIM_KINDS, ENV_CLASSES, VERIFIER_DECISIONS, GENE_HINT_FIELDS, normalizeRoutingHint, normalizeToolPolicy, normalizeGenerationMeta, normalizeClaims, normalizeGeneScope, normalizeRuntimeProfile, normalizeVerifierProfile, stripGeneHints, } from './geneHints.js';

package/dist/wire/schemaGate.d.ts

@@ -2,10 +2,31 @@ export interface WireValidation {
     ok: boolean;
     errors: string[];
 }
+/** One schema violation located at a concrete field, so a caller can decide what to do about THAT field.
+ *  `validateWireDeep`'s message strings are deliberately stable/opaque; repair needs the location instead. */
+export interface WireSchemaIssue {
+    /** Dotted path into the record (`constraints.forbidden_paths`); `''` for a record-level violation. */
+    path: string;
+    /** Ajv keyword that failed (`required`, `additionalProperties`, `minItems`, `pattern`, …). */
+    keyword: string;
+    /** Field named by a record-level violation: the missing required prop or the rejected extra prop. */
+    property?: string;
+    message: string;
+}
 /**
  * 结构校验(required 齐 + additionalProperties:false 不许多字段). 轻量, 不做深类型校验(那是发版 CI conformance 的活).
  * 用途: 发 hub 前确认资产能被 gep-sdk schema 接受; v2-delta(proof_of_work/resolution_status)在 bump 前会在此暴露.
  */
 export declare function validateWire(asset: Record<string, unknown>): WireValidation;
+/**
+ * Full Draft-07 runtime validation against the gep-sdk JSON Schema SSOT.
+ * Validation is observational: values are never coerced, defaulted, stripped, or otherwise mutated.
+ */
+export declare function validateWireDeep(asset: Record<string, unknown>): WireValidation;
+/**
+ * Every schema violation of `asset`, located by field. Same SSOT and same verdict as {@link validateWireDeep}
+ * (empty ⇔ ok) — this form exists for callers that must ACT on a specific field rather than only report.
+ */
+export declare function wireSchemaIssues(asset: Record<string, unknown>): WireSchemaIssue[];
 /** schema 已声明的字段白名单(给上层判断哪些 v2-delta 尚未进 SDK). */
 export declare function schemaProperties(type: string): string[];