@evomap/evolver-core 2.0.0-beta.19 → 2.0.0-beta.22

package/dist/algo/solidify.js

@@ -1,17 +1,45 @@
 import { ulid as makeUlid } from 'ulid';
 import { computeAssetId, SCHEMA_VERSION } from '../wire/index.js';
-/** ProofOfWork 是否表明有实际产出(解锁非 coding agent, 批注#17/#19). */
+import { gitDiffOf, artifactHashOf, externalReceiptOf, toolCallTraceOf, proofOfWorkForWrite } from '../schema/proofOfWork.js';
+/** ProofOfWork 是否表明有实际产出(解锁非 coding agent, 批注#17/#19). #961: 兼容读 helper(snake_case 优先, 回退旧 camelCase 存量). */
 export function proofIndicatesOutput(p) {
     if (!p)
         return false;
     switch (p.kind) {
-        case 'git_diff': return (p.gitDiff?.files ?? 0) > 0 || (p.gitDiff?.lines ?? 0) > 0;
-        case 'artifact_hash': return Boolean(p.artifactHash?.sha256);
-        case 'external_receipt': return Boolean(p.externalReceipt?.receiptId);
-        case 'tool_call_trace': return (p.toolCallTrace?.calls ?? 0) > 0;
+        case 'git_diff': return (gitDiffOf(p)?.files ?? 0) > 0 || (gitDiffOf(p)?.lines ?? 0) > 0;
+        case 'artifact_hash': return Boolean(artifactHashOf(p)?.sha256);
+        case 'external_receipt': {
+            const r = externalReceiptOf(p);
+            return Boolean(r?.receipt_id ?? r?.receiptId);
+        }
+        case 'tool_call_trace': return (toolCallTraceOf(p)?.calls ?? 0) > 0;
         default: return false;
     }
 }
+function nonEmpty(s) {
+    return typeof s === 'string' && s.trim().length > 0 ? s.trim() : undefined;
+}
+function failureIdentityTrace(input) {
+    if (input.outcome.status !== 'failed' || !input.failureIdentity)
+        return undefined;
+    const trace = { stage: 'validate' };
+    const root = nonEmpty(input.failureIdentity.rootAttemptId);
+    const execution = nonEmpty(input.failureIdentity.executionId);
+    const failure = nonEmpty(input.failureIdentity.failureId);
+    const verifier = nonEmpty(input.failureIdentity.verifierDigest);
+    const artifact = nonEmpty(input.failureIdentity.artifactDigest);
+    if (root)
+        trace['root_attempt_id'] = root;
+    if (execution)
+        trace['execution_id'] = execution;
+    if (failure)
+        trace['failure_id'] = failure;
+    if (verifier)
+        trace['verifier_digest'] = verifier;
+    if (artifact)
+        trace['artifact_digest'] = artifact;
+    return Object.keys(trace).length > 1 ? [trace] : undefined;
+}
 /**
  * 两级 resolution(M4A-8) + ProofOfWork 判价值(M4A-5):
  * - 失败: 分 < 阈 → regressed, 否则 inconclusive.
@@ -44,7 +72,8 @@ export function solidify(input) {
     // (artifact_hash/external_receipt/tool_call_trace) gd is undefined and blast falls back to {0,0} — which here
     // means "blast unknown", NOT "no change". Consumers that read blast=0 as a no-op signal (e.g. cycleFailure's
     // local_gene_no_blast bucket) MUST first confirm the proof kind is git_diff; the cycleEngine guard does this.
-    const gd = input.proofOfWork?.kind === 'git_diff' ? input.proofOfWork.gitDiff : undefined;
+    const gd = input.proofOfWork?.kind === 'git_diff' ? gitDiffOf(input.proofOfWork) : undefined;
+    const identityTrace = failureIdentityTrace(input);
     const base = {
         type: 'Capsule',
         schema_version: SCHEMA_VERSION,
@@ -56,7 +85,8 @@ export function solidify(input) {
         blast_radius: { files: gd?.files ?? 0, lines: gd?.lines ?? 0 },
         outcome: input.outcome,
         resolution_status: status,
-        ...(input.proofOfWork ? { proof_of_work: input.proofOfWork } : {}),
+        ...(input.proofOfWork ? { proof_of_work: proofOfWorkForWrite(input.proofOfWork) } : {}),
+        ...(identityTrace ? { execution_trace: identityTrace } : {}),
     };
     const asset_id = computeAssetId(base);
     return { capsule: { ...base, asset_id }, resolutionStatus: status, producedValue, reasons };

package/dist/algo/ucb1.d.ts

@@ -0,0 +1,53 @@
+import type { RootEvent } from '../events/eventSchema.js';
+export declare const SELECTION_POLICIES: readonly ["engine-health", "ucb1-shadow", "ucb1"];
+export type SelectionPolicy = (typeof SELECTION_POLICIES)[number];
+export declare const UCB1_SELECTION_POLICY_VERSION = "ucb1-v1";
+export declare const UCB1_REWARD_POLICY_VERSION = "productive-binary-v1";
+export interface Ucb1ArmStats {
+    armId: string;
+    pulls: number;
+    completedPulls: number;
+    rewardSum: number;
+    meanReward: number;
+}
+export interface Ucb1History {
+    arms: ReadonlyMap<string, Ucb1ArmStats>;
+    /** Every non-ad-hoc decision counts immediately, including decisions whose terminal event is still pending. */
+    totalPulls: number;
+}
+export interface Ucb1Arm {
+    armId: string;
+    baseScore: number;
+    explorationEligible: boolean;
+    stats: Ucb1ArmStats;
+}
+export interface Ucb1Choice {
+    armId: string;
+    pulls: number;
+    completedPulls: number;
+    totalPulls: number;
+    meanReward: number;
+    /** Null represents the canonical +Infinity cold-start index without putting Infinity on the event wire. */
+    bonus: number | null;
+    /** Null represents the canonical +Infinity cold-start index without putting Infinity on the event wire. */
+    index: number | null;
+    coldStart: boolean;
+}
+export type Ucb1FallbackReason = 'empty_pool' | 'ineligible_arm' | 'missing_history';
+export interface Ucb1Decision {
+    choice: Ucb1Choice | null;
+    fallbackReason?: Ucb1FallbackReason;
+}
+/**
+ * Rebuild UCB1 state from the append-only root event log. Decisions are pulls immediately, so later readers no
+ * longer treat an in-flight arm as cold. The read-select-append sequence is not an atomic reservation across
+ * workers. A terminal event adds reward exactly once per cycle; duplicate rows collapse to their latest projection.
+ */
+export declare function deriveUcb1History(events: readonly RootEvent[]): Ucb1History;
+/** Combine current asset identity with legacy gene-only history when that bridge is unambiguous. */
+export declare function ucb1StatsForCandidate(history: Ucb1History, geneId: string, assetId?: string, includeLegacyGeneHistory?: boolean): Ucb1ArmStats;
+/**
+ * Canonical UCB1: mean reward + sqrt(2 ln(total pulls) / arm pulls). Cold arms have +Infinity and are ordered
+ * deterministically by base score then arm identity. The caller supplies only the already-gated exploration window.
+ */
+export declare function chooseUcb1Arm(arms: readonly Ucb1Arm[], historyTotalPulls: number): Ucb1Decision;

package/dist/algo/ucb1.js

@@ -0,0 +1,156 @@
+export const SELECTION_POLICIES = ['engine-health', 'ucb1-shadow', 'ucb1'];
+export const UCB1_SELECTION_POLICY_VERSION = 'ucb1-v1';
+export const UCB1_REWARD_POLICY_VERSION = 'productive-binary-v1';
+function nonEmptyString(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.trim();
+    return normalized.length > 0 ? normalized : undefined;
+}
+function decisionProjection(event) {
+    if (event.type !== 'decision.gene_selected')
+        return undefined;
+    const payload = event.payload;
+    const cycleId = nonEmptyString(payload['cycleId']);
+    const geneId = nonEmptyString(payload['selectedGeneId']);
+    if (!cycleId)
+        return undefined;
+    if (!geneId || geneId === 'ad-hoc')
+        return { cycleId, decision: null };
+    return {
+        cycleId,
+        decision: { armId: nonEmptyString(payload['selectedAssetId']) ?? geneId },
+    };
+}
+function terminalReward(event) {
+    if (event.type !== 'cycle.failed' && event.type !== 'cycle.solidified')
+        return null;
+    const payload = event.payload;
+    const cycleId = nonEmptyString(payload['cycleId']);
+    if (!cycleId)
+        return null;
+    if (event.type === 'cycle.failed' || payload['producedValue'] === false)
+        return { cycleId, reward: 0 };
+    // Legacy solidified events predate producedValue. Preserve the existing confidence replay compatibility policy.
+    return { cycleId, reward: 1 };
+}
+/**
+ * Rebuild UCB1 state from the append-only root event log. Decisions are pulls immediately, so later readers no
+ * longer treat an in-flight arm as cold. The read-select-append sequence is not an atomic reservation across
+ * workers. A terminal event adds reward exactly once per cycle; duplicate rows collapse to their latest projection.
+ */
+export function deriveUcb1History(events) {
+    const cycles = new Map();
+    for (const event of events) {
+        const decision = decisionProjection(event);
+        // A restarted/re-emitted decision for the same cycleId begins a new pending lifecycle. Never let a terminal
+        // from the earlier lifecycle leak reward into this newer arm.
+        if (decision) {
+            if (decision.decision)
+                cycles.set(decision.cycleId, { decision: decision.decision });
+            else
+                cycles.delete(decision.cycleId);
+        }
+        const terminal = terminalReward(event);
+        if (terminal) {
+            const cycle = cycles.get(terminal.cycleId);
+            if (cycle)
+                cycle.reward = terminal.reward;
+        }
+    }
+    const mutable = new Map();
+    for (const cycle of cycles.values()) {
+        const current = mutable.get(cycle.decision.armId) ?? { pulls: 0, completedPulls: 0, rewardSum: 0 };
+        current.pulls += 1;
+        if (cycle.reward !== undefined) {
+            current.completedPulls += 1;
+            current.rewardSum += cycle.reward;
+        }
+        mutable.set(cycle.decision.armId, current);
+    }
+    const arms = new Map();
+    for (const [armId, stats] of mutable) {
+        arms.set(armId, {
+            armId,
+            ...stats,
+            meanReward: stats.completedPulls > 0 ? stats.rewardSum / stats.completedPulls : 0,
+        });
+    }
+    return { arms, totalPulls: cycles.size };
+}
+function emptyStats(armId) {
+    return { armId, pulls: 0, completedPulls: 0, rewardSum: 0, meanReward: 0 };
+}
+/** Combine current asset identity with legacy gene-only history when that bridge is unambiguous. */
+export function ucb1StatsForCandidate(history, geneId, assetId, includeLegacyGeneHistory = true) {
+    const armId = assetId ?? geneId;
+    const identities = assetId === undefined
+        ? [geneId]
+        : [...new Set([assetId, ...(includeLegacyGeneHistory ? [geneId] : [])])];
+    const matches = identities.map((identity) => history.arms.get(identity)).filter((stats) => stats !== undefined);
+    if (matches.length === 0)
+        return emptyStats(armId);
+    const pulls = matches.reduce((sum, stats) => sum + stats.pulls, 0);
+    const completedPulls = matches.reduce((sum, stats) => sum + stats.completedPulls, 0);
+    const rewardSum = matches.reduce((sum, stats) => sum + stats.rewardSum, 0);
+    return {
+        armId,
+        pulls,
+        completedPulls,
+        rewardSum,
+        meanReward: completedPulls > 0 ? rewardSum / completedPulls : 0,
+    };
+}
+function finiteBaseScore(value) {
+    return Number.isFinite(value) ? value : Number.NEGATIVE_INFINITY;
+}
+function finiteCount(value) {
+    return Number.isFinite(value) ? Math.min(Number.MAX_SAFE_INTEGER, Math.floor(Math.max(0, value))) : 0;
+}
+function finiteMeanReward(value) {
+    return Number.isFinite(value) ? Math.max(0, Math.min(1, value)) : 0;
+}
+function saturatingCountSum(total, value) {
+    const count = finiteCount(value);
+    return total >= Number.MAX_SAFE_INTEGER - count ? Number.MAX_SAFE_INTEGER : total + count;
+}
+/**
+ * Canonical UCB1: mean reward + sqrt(2 ln(total pulls) / arm pulls). Cold arms have +Infinity and are ordered
+ * deterministically by base score then arm identity. The caller supplies only the already-gated exploration window.
+ */
+export function chooseUcb1Arm(arms, historyTotalPulls) {
+    if (arms.length === 0)
+        return { choice: null, fallbackReason: 'empty_pool' };
+    if (arms.some((arm) => !arm.explorationEligible))
+        return { choice: null, fallbackReason: 'ineligible_arm' };
+    const totalPulls = Math.max(1, finiteCount(historyTotalPulls), arms.reduce((sum, arm) => saturatingCountSum(sum, arm.stats.pulls), 0));
+    const ranked = arms.map((arm) => {
+        const pulls = finiteCount(arm.stats.pulls);
+        const meanReward = finiteMeanReward(arm.stats.meanReward);
+        const coldStart = pulls === 0;
+        const bonus = coldStart ? null : Math.sqrt((2 * Math.log(totalPulls)) / pulls);
+        const index = coldStart ? null : meanReward + bonus;
+        return { arm, pulls, meanReward, coldStart, bonus, index };
+    }).sort((left, right) => {
+        if (left.coldStart !== right.coldStart)
+            return left.coldStart ? -1 : 1;
+        if (left.index !== null && right.index !== null && left.index !== right.index)
+            return right.index - left.index;
+        const leftScore = finiteBaseScore(left.arm.baseScore);
+        const rightScore = finiteBaseScore(right.arm.baseScore);
+        return rightScore !== leftScore ? rightScore - leftScore : left.arm.armId.localeCompare(right.arm.armId);
+    });
+    const winner = ranked[0];
+    return {
+        choice: {
+            armId: winner.arm.armId,
+            pulls: winner.pulls,
+            completedPulls: finiteCount(winner.arm.stats.completedPulls),
+            totalPulls,
+            meanReward: winner.meanReward,
+            bonus: winner.bonus,
+            index: winner.index,
+            coldStart: winner.coldStart,
+        },
+    };
+}

package/dist/assetrepair/hubRejection.d.ts

@@ -0,0 +1,12 @@
+import type { RepairIssue } from './repair.js';
+/** Field-level issues reported by the Hub, keyed to the asset index they belong to (`-1` = bundle-level). */
+export interface HubRejectionReport {
+    issues: RepairIssue[];
+    /** Issues for one asset of the published bundle, by its position in `payload.assets`. */
+    byAssetIndex: Map<number, RepairIssue[]>;
+}
+export interface HubRejectionOptions {
+    /** The bundle's asset types in `payload.assets` order, so a `<type>_*` rule reason routes to its own asset. */
+    assetTypes?: readonly (string | undefined)[];
+}
+export declare function hubRejectionIssues(body: unknown, options?: HubRejectionOptions): HubRejectionReport;

package/dist/assetrepair/hubRejection.js

@@ -0,0 +1,109 @@
+const MAX_ISSUES = 50;
+const MAX_MESSAGE_CHARS = 300;
+const REASON_TOKEN = /^[a-z][a-z0-9_]*$/;
+const REASON_PREFIXES = [
+    { prefix: 'gene', assetType: 'Gene' },
+    { prefix: 'capsule', assetType: 'Capsule' },
+    { prefix: 'event', assetType: 'EvolutionEvent' },
+    { prefix: 'bundle' },
+];
+const REPAIRABLE_REASON_PATHS = new Map([
+    ['asset_id_verification_failed', 'asset_id'],
+    ['missing_asset_id', 'asset_id'],
+]);
+export function hubRejectionIssues(body, options = {}) {
+    const fieldReport = fieldLevelIssues(body);
+    if (fieldReport.issues.length > 0)
+        return fieldReport;
+    return ruleReasonIssues(body, options.assetTypes ?? []);
+}
+function fieldLevelIssues(body) {
+    const report = { issues: [], byAssetIndex: new Map() };
+    for (const raw of detailRows(body).slice(0, MAX_ISSUES)) {
+        const detail = asRecord(raw);
+        if (!detail)
+            continue;
+        const path = pathSegments(detail['path']);
+        const message = text(detail['message']) ?? text(detail['code']);
+        if (!message)
+            continue;
+        const issue = {
+            path: assetRelativePath(path),
+            keyword: text(detail['code']) ?? 'invalid',
+            message: message.slice(0, MAX_MESSAGE_CHARS),
+            source: 'hub',
+        };
+        report.issues.push(issue);
+        const index = assetIndex(path);
+        const bucket = report.byAssetIndex.get(index);
+        if (bucket)
+            bucket.push(issue);
+        else
+            report.byAssetIndex.set(index, [issue]);
+    }
+    return report;
+}
+function ruleReasonIssues(body, assetTypes) {
+    const report = { issues: [], byAssetIndex: new Map() };
+    const reason = ruleReason(body);
+    if (!reason)
+        return report;
+    const prefix = REASON_PREFIXES.find((entry) => reason.token.startsWith(`${entry.prefix}_`));
+    if (!prefix)
+        return report;
+    const issue = {
+        path: REPAIRABLE_REASON_PATHS.get(reason.token.slice(prefix.prefix.length + 1)) ?? '',
+        keyword: reason.token,
+        message: reason.message.slice(0, MAX_MESSAGE_CHARS),
+        source: 'hub',
+    };
+    const index = prefix.assetType === undefined ? -1 : assetTypes.indexOf(prefix.assetType);
+    report.issues.push(issue);
+    report.byAssetIndex.set(index, [issue]);
+    return report;
+}
+function ruleReason(body) {
+    const root = asRecord(body);
+    if (!root)
+        return undefined;
+    const payload = asRecord(root['payload']);
+    const raw = [root['error'], root['reason'], payload?.['error'], payload?.['reason']]
+        .map((candidate) => text(candidate))
+        .find((candidate) => candidate !== undefined);
+    if (!raw)
+        return undefined;
+    const token = raw.split(":", 1)[0]?.trim() ?? '';
+    return REASON_TOKEN.test(token) ? { token, message: raw } : undefined;
+}
+function detailRows(body) {
+    const root = asRecord(body);
+    if (!root)
+        return [];
+    const payload = asRecord(root['payload']);
+    for (const candidate of [root['details'], root['errors'], payload?.['details'], payload?.['errors']]) {
+        if (Array.isArray(candidate))
+            return candidate;
+    }
+    return [];
+}
+function pathSegments(value) {
+    if (!Array.isArray(value))
+        return typeof value === 'string' ? value.split('.') : [];
+    return value.filter((segment) => typeof segment === 'string' || typeof segment === 'number');
+}
+/** `['payload','assets',0,'constraints','forbidden_paths']` → `constraints.forbidden_paths`. */
+function assetRelativePath(path) {
+    const at = path.findIndex((segment) => typeof segment === 'number');
+    const tail = at >= 0 ? path.slice(at + 1) : path.filter((segment) => segment !== 'payload');
+    return tail.join('.');
+}
+function assetIndex(path) {
+    const found = path.find((segment) => typeof segment === 'number');
+    return typeof found === 'number' ? found : -1;
+}
+function text(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}

package/dist/assetrepair/index.d.ts

@@ -0,0 +1,2 @@
+export { repairAssetRecord, type RepairChange, type RepairIssue, type RepairOptions, type RepairReport, type RepairStatus, } from './repair.js';
+export { hubRejectionIssues, type HubRejectionReport } from './hubRejection.js';

package/dist/assetrepair/index.js

@@ -0,0 +1,2 @@
+export { repairAssetRecord, } from './repair.js';
+export { hubRejectionIssues } from './hubRejection.js';

package/dist/assetrepair/repair.d.ts

@@ -0,0 +1,33 @@
+import type { AssetRecord } from '../assetstore/index.js';
+export type RepairStatus = 'already_valid' | 'repaired' | 'unrepairable';
+export interface RepairIssue {
+    path: string;
+    keyword: string;
+    message: string;
+    /** `schema` = found by the local gep-sdk gate; `hub` = reported by the network in its rejection body. */
+    source: 'schema' | 'hub';
+}
+export interface RepairChange {
+    path: string;
+    action: 'added' | 'removed' | 'replaced';
+    note: string;
+}
+export interface RepairReport {
+    status: RepairStatus;
+    /** The accepted-by-schema record. Absent only when blockers remain (`status: 'unrepairable'`). */
+    asset?: AssetRecord;
+    changes: RepairChange[];
+    blockers: RepairIssue[];
+}
+export interface RepairOptions {
+    /** Field-level issues the network itself reported — see `hubRejectionIssues`. Stricter than the GEP schema
+     *  (the Hub adds envelope rules of its own), so they are folded in rather than re-derived locally. */
+    hubIssues?: readonly RepairIssue[];
+}
+type JsonRecord = Record<string, unknown>;
+/**
+ * Repair `input` into a record the GEP schema (and, when supplied, the Hub's own rules) accepts.
+ * Pure: `input` is never mutated, and nothing is written anywhere — the caller decides what to do with the result.
+ */
+export declare function repairAssetRecord(input: JsonRecord, options?: RepairOptions): RepairReport;
+export {};

package/dist/assetrepair/repair.js

@@ -0,0 +1,155 @@
+// Asset repair — turn a GEP record the network refuses into one it accepts, WITHOUT inventing content.
+//
+// Two producers of refused records exist and both were wasting assets outright:
+//   * publish: the Hub rejects a bundle field-by-field (`details[]`), the operator gets a flat error, and the
+//     distilled asset is dropped on the floor.
+//   * reuse/fetch: the Hub delivers a lossy projection of a published record (dropped `schema_version`, dropped
+//     logical `id`, emptied `constraints.forbidden_paths`, extra non-schema keys such as `model_name`), which
+//     then fails the local wire gate and is discarded — reported to the operator as "not found".
+//
+// The line this module refuses to cross: a repair may only restore fields whose value is DERIVABLE (recomputed
+// `asset_id`), CONSTANT (`schema_version`), or a strictly-narrowing default (`constraints`). Anything carrying
+// an evidence or meaning claim — a Capsule's `outcome`/`confidence`/`blast_radius`, a Gene's `strategy`, a
+// human summary — is never fabricated: it is reported as a blocker so the operator (or a re-distill) supplies it.
+import { computeAssetId, wireSchemaIssues } from '../wire/index.js';
+import { SCHEMA_VERSION } from '@evomap/gep-sdk';
+const DEFAULT_MAX_FILES = 12;
+const DEFAULT_FORBIDDEN_PATHS = ['.git', 'node_modules'];
+const CONTENT_ASSET_ID = /^sha256:[0-9a-f]{64}$/;
+const SEMVER = /^\d+\.\d+\.\d+$/;
+/**
+ * Repair `input` into a record the GEP schema (and, when supplied, the Hub's own rules) accepts.
+ * Pure: `input` is never mutated, and nothing is written anywhere — the caller decides what to do with the result.
+ */
+export function repairAssetRecord(input, options = {}) {
+    const hubIssues = options.hubIssues ?? [];
+    const before = wireSchemaIssues(input);
+    if (before.length === 0 && hubIssues.length === 0 && assetIdIsCurrent(input)) {
+        return { status: 'already_valid', asset: input, changes: [], blockers: [] };
+    }
+    const changes = [];
+    const draft = { ...input };
+    restoreSchemaVersion(draft, changes);
+    dropUnknownProperties(draft, before, changes);
+    restoreGeneConstraints(draft, changes);
+    restoreLogicalId(draft, changes);
+    restoreAssetId(draft, changes);
+    const remaining = wireSchemaIssues(draft);
+    const blockers = [...remaining.map(schemaBlocker), ...unresolvedHubIssues(hubIssues, changes)];
+    if (blockers.length > 0)
+        return { status: 'unrepairable', changes, blockers };
+    return { status: 'repaired', asset: draft, changes, blockers: [] };
+}
+/**
+ * Hub rules the local schema cannot see (a minimum summary length, a bundle arity) stay blockers — but a hub
+ * complaint about a field this pass just mended is answered, and keeping it would report every repairable
+ * asset as unrepairable.
+ */
+function unresolvedHubIssues(issues, changes) {
+    return issues.filter((issue) => !changes.some((change) => pathsOverlap(change.path, issue.path)));
+}
+function pathsOverlap(repaired, reported) {
+    return repaired === reported
+        || reported.startsWith(`${repaired}.`)
+        || repaired.startsWith(`${reported}.`);
+}
+/** True when the record already declares the id its own content hashes to — the invariant `restoreAssetId` holds. */
+function assetIdIsCurrent(record) {
+    const declared = record['asset_id'];
+    return typeof declared === 'string' && declared === safeComputeAssetId(record);
+}
+function restoreSchemaVersion(draft, changes) {
+    const current = draft['schema_version'];
+    if (typeof current === 'string' && SEMVER.test(current))
+        return;
+    draft['schema_version'] = SCHEMA_VERSION;
+    changes.push({
+        path: 'schema_version',
+        action: current === undefined ? 'added' : 'replaced',
+        note: `set to the SDK schema version ${SCHEMA_VERSION}`,
+    });
+}
+// `additionalProperties: false` means an unknown key is fatal, so a delivery that adds `model_name` is
+// unusable as-is. Dropping is the only content-preserving move: the key is not part of the GEP contract, so
+// nothing that reads the record by contract can miss it. Every dropped key is named in the report.
+function dropUnknownProperties(draft, issues, changes) {
+    for (const issue of issues) {
+        if (issue.keyword !== 'additionalProperties' || !issue.property)
+            continue;
+        if (!(issue.property in draft))
+            continue;
+        delete draft[issue.property];
+        changes.push({ path: issue.path, action: 'removed', note: 'not declared by the GEP schema' });
+    }
+}
+// A Gene's constraints are a CEILING on what an executing agent may touch. Restoring the default is therefore
+// safe in one direction only: the default must be at least as restrictive as a missing/empty value, which
+// (no ceiling at all) it always is.
+function restoreGeneConstraints(draft, changes) {
+    if (draft['type'] !== 'Gene')
+        return;
+    const current = asRecord(draft['constraints']);
+    if (!current) {
+        draft['constraints'] = { max_files: DEFAULT_MAX_FILES, forbidden_paths: [...DEFAULT_FORBIDDEN_PATHS] };
+        changes.push({ path: 'constraints', action: 'added', note: 'restored the default execution ceiling' });
+        return;
+    }
+    const repaired = { ...current };
+    const maxFiles = repaired['max_files'];
+    if (typeof maxFiles !== 'number' || !Number.isInteger(maxFiles) || maxFiles < 1) {
+        repaired['max_files'] = DEFAULT_MAX_FILES;
+        changes.push({ path: 'constraints.max_files', action: maxFiles === undefined ? 'added' : 'replaced', note: `restored the default ceiling ${DEFAULT_MAX_FILES}` });
+    }
+    const forbidden = repaired['forbidden_paths'];
+    const usable = Array.isArray(forbidden) && forbidden.length > 0 && forbidden.every((entry) => typeof entry === 'string');
+    if (!usable) {
+        repaired['forbidden_paths'] = [...DEFAULT_FORBIDDEN_PATHS];
+        changes.push({ path: 'constraints.forbidden_paths', action: forbidden === undefined ? 'added' : 'replaced', note: 'restored the default forbidden paths' });
+    }
+    draft['constraints'] = repaired;
+}
+// A logical id names the asset for humans and for Capsule→Gene binding; it carries no claim about the content.
+// A delivery that dropped it cannot be re-bound to its original name (that name is not recoverable from the
+// bytes), so the derived one is marked `repaired_` — visibly synthetic, and stable for the same content.
+function restoreLogicalId(draft, changes) {
+    const current = draft['id'];
+    if (typeof current === 'string' && current.length > 0)
+        return;
+    const type = typeof draft['type'] === 'string' ? draft['type'].toLowerCase() : 'asset';
+    const digest = safeComputeAssetId(draft)?.slice('sha256:'.length, 'sha256:'.length + 12);
+    if (!digest)
+        return;
+    draft['id'] = `${type}_repaired_${digest}`;
+    changes.push({ path: 'id', action: 'added', note: 'derived a stable placeholder id from the content digest' });
+}
+// Content-addressing means `asset_id` is a FUNCTION of the rest of the record, so it is the one field that must
+// be recomputed last — every repair above changes what the content hashes to.
+function restoreAssetId(draft, changes) {
+    const declared = draft['asset_id'];
+    const computed = safeComputeAssetId(draft);
+    if (!computed || !CONTENT_ASSET_ID.test(computed))
+        return;
+    if (declared === computed)
+        return;
+    draft['asset_id'] = computed;
+    changes.push({
+        path: 'asset_id',
+        action: typeof declared === 'string' ? 'replaced' : 'added',
+        note: 'recomputed the content id over the repaired record',
+    });
+}
+function safeComputeAssetId(record) {
+    try {
+        const id = computeAssetId(record);
+        return typeof id === 'string' && id.length > 0 ? id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function schemaBlocker(issue) {
+    return { path: issue.path, keyword: issue.keyword, message: issue.message, source: 'schema' };
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}

package/dist/assetstore/assetSidecarRecords.js

@@ -118,7 +118,7 @@ export function parseAssetSyncRecord(value) {
         || !remoteAssetId) {
         return null;
     }
-    const logicalId = stringField(record, 'logicalId');
+    const logicalId = rawStringField(record, 'logicalId');
     const status = stringField(record, 'status');
     const runKey = optionalStrictString(record, 'runKey');
     const inventoryKey = optionalStrictString(record, 'inventoryKey');
@@ -359,6 +359,10 @@ function stringField(value, key) {
     const raw = value[key];
     return typeof raw === 'string' && raw.trim() ? raw.trim() : undefined;
 }
+function rawStringField(value, key) {
+    const raw = value[key];
+    return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
+}
 function optionalStrictString(value, key) {
     const raw = value[key];
     if (raw === undefined)

package/dist/assetstore/assetStoreHealth.d.ts

@@ -16,9 +16,8 @@ export interface AssetStoreFileHealth {
     corruptRows: number;
     hashMismatchRows: number;
     /**
-     * Rows that fail content-hash verification but are provenance-marked as an unverified hub reuse
-     * (evolver-v2#570). These are EXPECTED — the hub rewrote the delivered bytes and reuse froze them untrusted —
-     * so they are a benign category, counted separately and never degrading the store.
+     * Rows that fail content-hash verification but carry an active, content-bound unverified provenance waiver.
+     * They remain untrusted and are counted separately instead of being misclassified as store corruption.
      */
     unverifiedRows: number;
     schemaInvalidRows: number;