@finchip.ai/foga 0.0.0-stage → 0.6.0-alpha.4

package/dist/genesis/t5.js

@@ -0,0 +1,168 @@
+import { join } from "node:path";
+import { getAddress, parseEther } from "ethers";
+import { TenderAdapterRef } from "../core/acdf.js";
+import { dataUri, keccakJcs, sha256Hex } from "../core/canonical.js";
+import { DecisionPoint, SwarmAccountRef, SwarmDecisionAdapterRef, SwarmTenderAdapterRef, packHashes } from "../core/swarm.js";
+import { nativeTerms } from "../core/tenders.js";
+import { runExtractIsolated } from "./skill-runner.js";
+/**
+ * T5 — governance: collective acceptance, collective labour, collective decisions.
+ *  (1) the swarm account submits the finch-extract-verify report to the judged tender of T4;
+ *  (2) anyone opens the council's case; two judges approve; the round settles, the appeal window passes, the
+ *      decision is Final; the adapter enacts acceptFulfillment and the swarm account is paid;
+ *  (3) the workers amend the charter through the decision adapter (2 of 2);
+ *  (4) a second judged tender ends without a decision: the adapter enacts nothing and the tender's own default
+ *      path (claimUnjudged) pays the fulfiller after the judgment window;
+ *  (5) the swarm tender adapter concludes the swarm ACHIEVED.
+ */
+export async function t5(g) {
+    const k = g.kernel;
+    const W = "W";
+    const A = g.cell("A");
+    const B = g.cell("B");
+    const C = g.cell("C");
+    const chainId = g.chainId;
+    const timing = g.timing;
+    const tokenId = BigInt(k.requireFact("T4.tokenId"));
+    const swarmId = k.requireFact("T4.swarmId");
+    const extractSkill = k.requireFact("T2.skill.finch-extract-verify");
+    const judges = ["J1", "J2", "J3"].map((j) => k.address(j));
+    const adapter = new TenderAdapterRef(g.world, k.requireFact("T0.acdf.tenderAdapter"));
+    const account = new SwarmAccountRef(g.world, k.requireFact("T4.swarmAccount"));
+    const decision = new SwarmDecisionAdapterRef(g.world, k.requireFact("T4.decisionAdapter"));
+    const swarmTender = new SwarmTenderAdapterRef(g.world, g.world.address("8447/SwarmTenderAdapter"));
+    const effects = await adapter.effects();
+    // the judges are nobody's party: not the demander, not a member, not the swarm account, not an operator
+    const parties = new Set([k.address(W), A.address, B.address, C.address, account.address, A.operatorAddress, B.operatorAddress, C.operatorAddress].map((a) => a.toLowerCase()));
+    g.check("T5", "judges.independent", judges.every((j) => !parties.has(j.toLowerCase())), `J1-J3 are not the demander, a member, the swarm account or an operator`);
+    // --- (1) the deliverable: the deterministic finch-extract-verify report over the pinned filing
+    const run = await runExtractIsolated({ documentPath: join(g.cfg.fixturesDir, "sample-filing.txt"), fieldsPath: join(g.cfg.skillsDir, "finch-extract-verify", "fields.json"), packageHash: extractSkill.packageHash, inputDir: g.cfg.fixturesDir, skillsDir: g.cfg.skillsDir });
+    const resultHash = run.resultHash;
+    k.setFact("T5.report", { resultHash, documentDigest: run.report.documentDigest, rules: run.report.rules });
+    const submitCall = account.encodeExecute(k.tenders.address, 0n, k.tenders.encodeSubmit(tokenId, resultHash, dataUri(run.report)));
+    const submit = await B.execute("T5.swarm.submit", account.address, submitCall);
+    const submissionId = k.tenders.submissionIdFromReceipt(submit.receipt);
+    k.setFact("T5.submissionId", submissionId.toString());
+    const sub = await k.tenders.submissionOf(tokenId, submissionId);
+    g.check("T5", "submission.bySwarmAccount", getAddress(sub.fulfiller) === getAddress(account.address) && sub.machineSettled === false, `submission ${submissionId}: fulfiller ${sub.fulfiller} (the swarm account, not a member), judged path`);
+    const workerCannot = await g.wouldRevert(A, account.address, submitCall);
+    g.check("T5", "represent.enforced", workerCannot !== null, `a worker driving the swarm account reverts: ${workerCannot}`);
+    // --- (2) the council: open, two approvals, settle, appeal window, finalize, enact
+    const open = await k.call("T5.open", W, adapter.address, adapter.iface, "open", [tokenId, submissionId]);
+    const issueId = adapter.issueIdFromReceipt(open.receipt);
+    k.setFact("T5.issueId", issueId);
+    const round = await k.acdf.roundOf(issueId);
+    const wrongRound = await g.wouldRevertCall(judges[2], k.acdf.registryAddress, k.acdf.encodeCastBallot(issueId, round + 1, 0, true));
+    g.check("T5", "ballot.wrongRound.refused", wrongRound !== null, `a ballot for round ${round + 1} reverts: ${wrongRound}`);
+    const nonJudge = await g.wouldRevertCall(k.address("E"), k.acdf.registryAddress, k.acdf.encodeCastBallot(issueId, round, 0, true));
+    g.check("T5", "ballot.nonJudge.refused", nonJudge !== null, `a ballot by a non-judge reverts: ${nonJudge}`);
+    const early = await g.wouldRevertCall(k.address(W), adapter.address, adapter.encodeExecute(issueId));
+    g.check("T5", "execute.beforeFinal.refused", early !== null, `adapter.execute before Final reverts: ${early}`);
+    await k.call("T5.J1.ballot", "J1", k.acdf.registryAddress, k.acdf.registry().interface, "castBallot", [issueId, round, 0, true]);
+    await k.call("T5.J2.ballot", "J2", k.acdf.registryAddress, k.acdf.registry().interface, "castBallot", [issueId, round, 0, true]);
+    await k.call("T5.settleRound", W, k.acdf.registryAddress, k.acdf.registry().interface, "settleRound", [issueId]);
+    let result = await k.acdf.getResult(issueId);
+    const settledState = result.stateName;
+    if (result.stateName === "Provisional") {
+        const r = await k.acdf.roundState(issueId, round);
+        const now = await k.blockTimestamp();
+        const wait = Number(r.appealOpenUntil) - now + 1;
+        if (wait > 0)
+            await k.advanceTime(wait, "appeal window of the council's decision");
+        await k.call("T5.finalize", W, k.acdf.registryAddress, k.acdf.registry().interface, "finalize", [issueId]);
+        result = await k.acdf.getResult(issueId);
+    }
+    g.check("T5", "council.final.yes", result.stateName === "Final" && result.outcomeName === "Decided" && result.outcomeYes && result.sourceRound === round, `settleRound -> ${settledState}; after the appeal window: ${result.stateName} ${result.outcomeName} yes=${result.outcomeYes} (round ${result.roundCount}, source ${result.sourceRound})`);
+    const balanceBefore = await k.balance(account.address);
+    await k.call("T5.execute", W, adapter.address, adapter.iface, "execute", [issueId]);
+    const accepted = await k.tenders.submissionOf(tokenId, submissionId);
+    const enacted = await k.acdf.enactment(issueId, adapter.address, effects.accept);
+    const paid = (await k.balance(account.address)) - balanceBefore;
+    const alreadySettled = k.store.get("T5.execute")?.status === "confirmed" && paid === 0n;
+    g.check("T5", "fulfilment.accepted", accepted.status === 1 && enacted.statusName === "Enacted", `submission ${submissionId} status ${accepted.status} (1 = Accepted); enactment ${enacted.statusName} by ${enacted.reporter}`);
+    if (!alreadySettled)
+        g.check("T5", "swarmAccount.paid", paid === parseEther("0.002"), `the swarm account received ${paid} wei (reward 0.002 ETH); members received nothing directly`);
+    else
+        g.skipped("T5", "swarmAccount.paid", "replayed run: the payout was already made");
+    const twice = await g.wouldRevertCall(k.address(W), adapter.address, adapter.encodeExecute(issueId));
+    g.check("T5", "execute.twice.refused", twice !== null, `adapter.execute again reverts: ${twice}`);
+    // --- (3) governance: the workers amend the charter through the decision adapter (2 of 2)
+    const pack = k.requireFact("T4.pack.document");
+    const pack2 = { ...pack, version: 2, charter: { path: "charter.md", digest: `sha256:${sha256Hex("FOGA genesis swarm charter v2: the coordinator publishes the report package digest before submitting.").slice(2)}` }, prev: `sha256:${(k.requireFact("T4.pack").charterHash).slice(2)}` };
+    const h2 = packHashes(pack2);
+    const amendCall = k.swarms.encodeAmend(swarmId, h2.charterHash, h2.charterURI);
+    const roster = [A.address, C.address];
+    const openGov = await B.execute("T5.gov.open", decision.address, decision.encodeOpen(swarmId, DecisionPoint.AMEND, amendCall, roster));
+    const govIssue = decision.issueIdFromReceipt(openGov.receipt);
+    k.setFact("T5.gov.issueId", govIssue);
+    const govRound = await k.acdf.roundOf(govIssue);
+    const outsider = await g.wouldRevert(B, k.acdf.registryAddress, k.acdf.encodeCastBallot(govIssue, govRound, 0, true));
+    g.check("T5", "gov.coordinator.cannotVote", outsider !== null, `B (coordinator) voting on the workers' decision reverts: ${outsider}`);
+    await A.execute("T5.gov.A.ballot", k.acdf.registryAddress, k.acdf.encodeCastBallot(govIssue, govRound, 0, true));
+    await C.execute("T5.gov.C.ballot", k.acdf.registryAddress, k.acdf.encodeCastBallot(govIssue, govRound, 0, true));
+    await k.call("T5.gov.settle", W, k.acdf.registryAddress, k.acdf.registry().interface, "settleRound", [govIssue]);
+    const govResult = await k.acdf.getResult(govIssue);
+    await k.call("T5.gov.execute", W, decision.address, decision.iface, "execute", [govIssue]);
+    const amended = await k.swarms.getSwarm(swarmId);
+    g.check("T5", "gov.amended", govResult.stateName === "Final" && govResult.outcomeYes && amended.charterHash === h2.charterHash && amended.charterVersion === 2 && amended.commitmentVersion === 1, `decision ${govResult.stateName} yes=${govResult.outcomeYes}; charterHash ${amended.charterHash.slice(0, 10)}… version ${amended.charterVersion} (commitment version ${amended.commitmentVersion}: not material)`);
+    const proposal = await decision.proposal(govIssue);
+    g.check("T5", "gov.enacted", proposal.enacted === true, `proposal ${govIssue.slice(0, 10)}… enacted through the registry as the AMEND authority`);
+    // --- (4) no decision: one approval only, the window passes, the kernel's own default path pays
+    const ndReward = parseEther("0.001");
+    const ndTask = { schema: "foga.task/1", skill: "finch-extract-verify", packageHash: extractSkill.packageHash, input: { document: "scenarios/fixtures/sample-filing.txt", fields: "fields.json" }, acceptance: { mode: "judge", policy: "FOGA-Council", authority: adapter.address, judgmentWindow: timing.noDecisionJudgmentWindow }, note: "second judged tender: the council stays silent" };
+    const ndMint = await k.call("T5.nd.mint", W, k.tenders.address, k.tenders.contract().interface, "mintTask", [k.address(W), k.address(W), adapter.address, keccakJcs({ td: "foga.task/1", skill: "finch-extract-verify", variant: "no-decision" }), sha256Hex(JSON.stringify(ndTask)), dataUri(ndTask), nativeTerms(ndReward, { judgmentWindow: BigInt(timing.noDecisionJudgmentWindow) })]);
+    const ndToken = k.tenders.tokenIdFromReceipt(ndMint.receipt);
+    k.setFact("T5.nd.tokenId", ndToken.toString());
+    await k.call("T5.nd.fund", W, k.tenders.address, k.tenders.contract().interface, "fundTask", [ndToken, ndReward], ndReward);
+    const ndSubmit = await B.execute("T5.nd.submit", account.address, account.encodeExecute(k.tenders.address, 0n, k.tenders.encodeSubmit(ndToken, resultHash, dataUri(run.report))));
+    const ndSubmission = k.tenders.submissionIdFromReceipt(ndSubmit.receipt);
+    k.setFact("T5.nd.submissionId", ndSubmission.toString());
+    const ndOpen = await k.call("T5.nd.open", W, adapter.address, adapter.iface, "open", [ndToken, ndSubmission]);
+    const ndIssue = adapter.issueIdFromReceipt(ndOpen.receipt);
+    k.setFact("T5.nd.issueId", ndIssue);
+    const ndRound = await k.acdf.roundOf(ndIssue);
+    await k.call("T5.nd.J1.ballot", "J1", k.acdf.registryAddress, k.acdf.registry().interface, "castBallot", [ndIssue, ndRound, 0, true]);
+    const ndState = await k.acdf.roundState(ndIssue, ndRound);
+    const nowNd = await k.blockTimestamp();
+    if (Number(ndState.deadline) >= nowNd)
+        await k.advanceTime(Number(ndState.deadline) - nowNd + 1, "the council's window on the second tender passes with one approval");
+    await k.call("T5.nd.settleRound", W, k.acdf.registryAddress, k.acdf.registry().interface, "settleRound", [ndIssue]);
+    const ndResult = await k.acdf.getResult(ndIssue);
+    g.check("T5", "nd.noDecision", ndResult.stateName === "Final" && ndResult.outcomeName === "NoDecision" && ndResult.reasonName === "QUORUM_NOT_MET", `one approval of three, window over: ${ndResult.stateName} ${ndResult.outcomeName} (${ndResult.reasonName})`);
+    const ndExecute = await g.wouldRevertCall(k.address(W), adapter.address, adapter.encodeExecute(ndIssue));
+    g.check("T5", "nd.adapter.inert", ndExecute !== null, `adapter.execute on a NoDecision reverts: ${ndExecute}`);
+    const ndSub = await k.tenders.submissionOf(ndToken, ndSubmission);
+    const claimAt = Number(ndSub.submittedAt) + timing.noDecisionJudgmentWindow;
+    const nowClaim = await k.blockTimestamp();
+    if (claimAt >= nowClaim)
+        await k.advanceTime(claimAt - nowClaim + 1, "the tender's judgment window passes with no ruling");
+    const ndBalanceBefore = await k.balance(account.address);
+    await k.call("T5.nd.claimUnjudged", W, k.tenders.address, k.tenders.contract().interface, "claimUnjudged", [ndToken, ndSubmission]);
+    const ndPaid = (await k.balance(account.address)) - ndBalanceBefore;
+    const ndAfter = await k.tenders.submissionOf(ndToken, ndSubmission);
+    const ndAlready = k.store.get("T5.nd.claimUnjudged")?.status === "confirmed" && ndPaid === 0n;
+    g.check("T5", "nd.claimUnjudged", ndAfter.status === 1, `claimUnjudged after the judgment window: submission status ${ndAfter.status} (1 = Accepted) - silence pays the fulfiller`);
+    if (!ndAlready)
+        g.check("T5", "nd.paid", ndPaid === ndReward, `the swarm account received ${ndPaid} wei from the second tender`);
+    else
+        g.skipped("T5", "nd.paid", "replayed run: the payout was already made");
+    // --- (5) the objective: the swarm tender adapter concludes ACHIEVED from the tender's own record
+    await k.call("T5.swarmTender.settle", W, swarmTender.address, swarmTender.contract().interface, "settle", [swarmId, submissionId]);
+    const concluded = await k.swarms.getSwarm(swarmId);
+    g.check("T5", "swarm.achieved", concluded.stateName === "CONCLUDING" && concluded.outcomeName === "ACHIEVED" && concluded.resultHash === resultHash, `swarm ${concluded.stateName}, outcome ${concluded.outcomeName}, resultHash = the report's hash`);
+    const members = await Promise.all(["A", "B", "C"].map((X) => k.swarms.memberStatus(swarmId, g.cell(X).address)));
+    const balances = await Promise.all(["A", "B", "C"].map((X) => k.balance(g.cell(X).address)));
+    k.evidence("T5", "governance", {
+        tenderId: tokenId.toString(),
+        submissionId: submissionId.toString(),
+        resultHash,
+        issueId,
+        result: { state: result.stateName, outcome: result.outcomeName, yes: result.outcomeYes, roundCount: result.roundCount, sourceRound: result.sourceRound },
+        enactment: enacted,
+        swarmAccountPaid: paid.toString(),
+        governance: { issueId: govIssue, roster, charterHashV2: h2.charterHash, charterVersion: amended.charterVersion, enacted: proposal.enacted },
+        noDecision: { tenderId: ndToken.toString(), submissionId: ndSubmission.toString(), issueId: ndIssue, result: { state: ndResult.stateName, outcome: ndResult.outcomeName, reason: ndResult.reasonName }, claimedUnjudged: ndAfter.status === 1, paid: ndPaid.toString() },
+        swarm: { state: concluded.stateName, outcome: concluded.outcomeName, members: members.map((m) => m.statusName), memberBalances: balances.map(String) },
+        txs: { submit: submit.txHash, open: open.txHash, execute: k.store.get("T5.execute")?.txHash, govOpen: openGov.txHash, govExecute: k.store.get("T5.gov.execute")?.txHash, ndMint: ndMint.txHash, claimUnjudged: k.store.get("T5.nd.claimUnjudged")?.txHash, settle: k.store.get("T5.swarmTender.settle")?.txHash },
+    });
+}

package/dist/genesis/t6.js

@@ -0,0 +1,222 @@
+import { join } from "node:path";
+import { getAddress, parseEther } from "ethers";
+import { EFFECT_REFUND, Value, claims, declaredVersionInputs, declaredVersionProposition, addressParam } from "../core/adrf.js";
+import { accountRef, keccakJcs } from "../core/canonical.js";
+import { buildSkillPackage, readSkillDir } from "../core/pack/skillpack.js";
+/**
+ * T6 — dispute: a service call between cells, settled through the world's ADRFServiceEscrow (bound in T0 to
+ * FOGA-Service-v1), ends in a ruling the escrow enacts within its own authority.
+ *  (1) C deposits and opens a call against A for one run of finch-extract-verify, the terms committing A to the
+ *      package version C evaluated (v1); A publishes v2 of the skill, delivers declaring v2 and charges the call;
+ *      the charge is held for the dispute period.
+ *  (2) C files: the decisive question "the version actually used matches the committed version" is JUDGED by
+ *      FOGA-Council through the bridge; the informative FORMAL question "the declared version differs" is
+ *      answered by the upstream verifier over the escrow's own records. Two judges find the proposition FALSE;
+ *      the round settles, the appeal window passes, the bridge imports the Final result with its provenance;
+ *      the registry decides Sustained, the review window passes, the ruling is Final and allows the refund.
+ *  (3) The escrow enacts the refund once (the held charge goes back to C) and reports it; a second enactment is
+ *      refused; nothing is ever released to A for that call.
+ *  (4) The control case: a second call committed to v2, delivered as v2; the verifier finds no departure; after
+ *      the dispute period the charge is released to A, which withdraws it to its account.
+ * Negative cases: a third party has no standing to file; the respondent cannot file against itself; the same
+ * contested point cannot be filed twice; the refund cannot be enacted twice.
+ */
+export async function t6(g) {
+    const k = g.kernel;
+    const W = "W";
+    const A = g.cell("A");
+    const B = g.cell("B");
+    const C = g.cell("C");
+    const chainId = g.chainId;
+    const timing = g.timing.service;
+    const adrf = k.requireFact("T0.adrf");
+    const council = k.requireFact("T0.acdf.policy");
+    const skill = k.requireFact("T2.skill.finch-extract-verify");
+    const tokenId = BigInt(skill.tokenId);
+    const escrow = k.adrf.escrowAddress;
+    const price = parseEther("0.0005");
+    const deposit = parseEther("0.002");
+    // the judges are nobody's party here either
+    const judges = ["J1", "J2", "J3"].map((j) => k.address(j));
+    const parties = new Set([k.address(W), A.address, B.address, C.address, A.operatorAddress, C.operatorAddress].map((a) => a.toLowerCase()));
+    g.check("T6", "judges.independent", judges.every((j) => !parties.has(j.toLowerCase())), `J1-J3 are neither client, provider, operator nor world operator of the call`);
+    // --- (1) the call, committed to v1; then v2 is published and delivered
+    const terms = { kind: "service-terms", service: "finch-extract-verify", provider: accountRef(chainId, A.address), client: accountRef(chainId, C.address), price: `${price} wei per call`, committedVersion: skill.packageHash, deliverable: "a finch.extract-verify/1 report over the client's pinned document", clause: "the service runs the committed skill version", disputePeriod: timing.disputePeriod };
+    const termsHash = keccakJcs(terms);
+    k.setFact("T6.terms", { termsHash, terms });
+    const depositDone = k.store.get("T6.C.escrow.deposit")?.status === "confirmed";
+    const cBalanceBefore = await k.adrf.escrowBalanceOf(C.address);
+    await C.execute("T6.C.escrow.deposit", escrow, k.adrf.encodeDeposit(), { value: deposit });
+    if (!depositDone) {
+        const after = await k.adrf.escrowBalanceOf(C.address);
+        g.check("T6", "C.deposited", after - cBalanceBefore === deposit, `C's escrow balance rose by ${after - cBalanceBefore} wei`);
+    }
+    else
+        g.skipped("T6", "C.deposited", "replayed run: the deposit was already made");
+    const open1 = await C.execute("T6.C.call1.open", escrow, k.adrf.encodeOpenCall(A.address, price, termsHash, skill.packageHash, timing.disputePeriod));
+    const call1 = k.adrf.callIdFromReceipt(open1.receipt);
+    k.setFact("T6.call1.id", call1.toString());
+    // A publishes v2 of the skill: the same package with a new manifest version and a changelog note
+    const v2 = await k.memo("T6.skill.v2", async () => {
+        const files = { ...readSkillDir(join(g.cfg.skillsDir, "finch-extract-verify")) };
+        const manifest = JSON.parse(Buffer.from(files["manifest.json"]).toString("utf8"));
+        manifest.skillVersion = "1.1.0";
+        files["manifest.json"] = new Uint8Array(Buffer.from(JSON.stringify(manifest, null, 2) + "\n"));
+        files["SKILL.md"] = new Uint8Array(Buffer.concat([Buffer.from(files["SKILL.md"]), Buffer.from("\n## Changes in 1.1.0\n\nEvidence spans now carry the line number of the quote in addition to the page.\n")]));
+        const pkg = buildSkillPackage(files, { version: 2, previousPackageHash: skill.packageHash });
+        return { mdHash: pkg.mdHash, packageHash: pkg.packageHash, rootCid: pkg.rootCid, version: pkg.version };
+    });
+    const v2Pkg = { mdHash: v2.mdHash, packageHash: v2.packageHash };
+    await A.execute("T6.A.skill.v2.update", k.skills.address, k.skills.encodeUpdate(tokenId, v2Pkg));
+    const onchain = await k.skills.skillOf(tokenId);
+    g.check("T6", "skill.v2", onchain.packageHash === v2.packageHash && onchain.version === 2n, `skillOf(${tokenId}) = {packageHash ${v2.packageHash.slice(0, 10)}…, v${onchain.version}}; the call was committed to v1 ${skill.packageHash.slice(0, 10)}…`);
+    const deliver1 = await A.execute("T6.A.call1.deliver", escrow, k.adrf.encodeDeliver(call1, v2.packageHash));
+    const settle1Done = k.store.get("T6.A.call1.settle")?.status === "confirmed";
+    await A.execute("T6.A.call1.settle", escrow, k.adrf.encodeSettle(call1));
+    const call1State = await k.adrf.call(call1);
+    const held1 = await k.adrf.heldOf(call1);
+    g.check("T6", "call1.held", call1State.committedVersion === skill.packageHash && call1State.declaredVersion === v2.packageHash && held1 === price, `call ${call1}: committed v1, declared v2, ${held1} wei held for ${timing.disputePeriod} s`, "T6.C.call1.enact");
+    if (!settle1Done)
+        g.check("T6", "call1.charged", (await k.adrf.escrowBalanceOf(C.address)) === deposit - price, `C's escrow balance is ${deposit - price} wei after the charge`, "T6.C.call1.enact");
+    else
+        g.skipped("T6", "call1.charged", "replayed run: the charge was already made");
+    // --- (2) the case
+    const object = await k.adrf.objectOf(call1);
+    const caseDocument = {
+        kind: "adrf-case",
+        object: { ref: { chainId: object.chainId.toString(), target: object.target.toLowerCase(), id: object.id.toString(), versionHash: object.versionHash }, description: `service call ${call1} of the escrow, terms committing finch-extract-verify v1` },
+        event: { eventRef: "delivery", description: `the delivery of call ${call1}` },
+        claim: { statement: "The service did not run the committed version of finch-extract-verify.", decisive: 1, supportsWhen: "FALSE" },
+        rules: { normRef: termsHash, clause: "the service runs the committed skill version", obligationKind: "result", policy: "FOGA-Service-v1" },
+        aiRelation: "which version of an agent skill produced the deliverable of a service call",
+        subjects: { claimant: accountRef(chainId, C.address), respondent: accountRef(chainId, A.address), roles: [{ account: accountRef(chainId, C.address), role: "client" }, { account: accountRef(chainId, A.address), role: "provider (obligor of the version commitment)" }] },
+        authorization: { effectClass: "Binding", acceptanceMode: "PRE_COMMIT", acceptedBy: "the escrow, for all its calls, at binding time (T0)" },
+        evidence: { scope: "the run receipt of the delivery and the skill token's commitments at delivery time", provision: "on chain (ERC-8338 skillOf, the escrow's declared version) and the provider's run receipt", verifiers: "FOGA-Council" },
+        context: { committed: ["finch-extract-verify v1 (terms)"], declared: ["finch-extract-verify v2 (provider declaration at delivery)"], toEstablish: ["the version actually used for the call"] },
+        effects: { requested: ["adrf:effect/refund"], onSustained: "adrf:effect/refund", onNotSustained: null, fallbackRef: "adrf:disposition/status-quo", atMost: `${price} wei` },
+        subQuestions: [
+            { index: 0, statement: "The version the provider declared at delivery differs from the committed version.", qType: "FORMAL", method: "DeclaredVersionVerifier over the escrow" },
+            { index: 1, statement: "The version actually used for the call matches the committed version.", qType: "JUDGED", method: "FOGA-Council through the ADRF/ACDF bridge" },
+        ],
+    };
+    const evidenceScopeHash = keccakJcs({ scope: caseDocument.evidence });
+    const claim = claims.versionCommitment({ object, escrow, callId: call1, termsHash, provider: A.address, documentHash: keccakJcs(caseDocument), evidenceScopeHash });
+    k.setFact("T6.caseDocument", caseDocument);
+    // negatives at the door: a third party has no standing; the respondent cannot file against itself
+    const stranger = await g.wouldRevert(B, k.adrf.registryAddress, k.adrf.encodeFile(adrf.bindingId, claim));
+    g.check("T6", "file.stranger.refused", stranger !== null, `B (no party to the call) filing reverts: ${stranger}`);
+    const selfClaim = await g.wouldRevert(A, k.adrf.registryAddress, k.adrf.encodeFile(adrf.bindingId, claim));
+    g.check("T6", "file.respondent.refused", selfClaim !== null, `A filing against itself reverts: ${selfClaim}`);
+    const filed = await C.execute("T6.C.call1.file", k.adrf.registryAddress, k.adrf.encodeFile(adrf.bindingId, claim));
+    const caseId = k.adrf.caseIdFromReceipt(filed.receipt);
+    k.setFact("T6.caseId", caseId);
+    const header = await k.adrf.getCase(caseId);
+    const clock = await k.adrf.getClock(caseId);
+    g.check("T6", "case.admitted", header.stateName === "Admitted" && header.effectClass === 1 && getAddress(header.source) === getAddress(escrow) && header.bindingId === adrf.bindingId && getAddress(header.claimant) === getAddress(C.address) && getAddress(header.respondent) === getAddress(A.address), `case ${caseId.slice(0, 10)}…: ${header.stateName}, Binding, source = the escrow, claimant C, respondent A; decision by ${clock.decisionDeadline}, hard deadline ${clock.hardDeadline}`, "T6.call1.decide");
+    const duplicate = await g.wouldRevert(C, k.adrf.registryAddress, k.adrf.encodeFile(adrf.bindingId, claim));
+    g.check("T6", "file.duplicate.refused", duplicate !== null, `the same contested point filed again reverts: ${duplicate}`);
+    // the formal question: anyone runs the verifier over the pinned inputs
+    await k.call("T6.call1.resolveFormal", W, k.adrf.registryAddress, k.adrf.registry().interface, "resolveFormal", [caseId, 0, declaredVersionInputs(call1)]);
+    const formal = await k.adrf.getFinding(caseId, 0);
+    g.check("T6", "finding.declared", formal.resolved && formal.valueName === "TRUE" && formal.supportKinds === 2 && getAddress(formal.acceptedBy) === getAddress(k.adrf.versionVerifierAddress), `sub-question 0 (declared version differs) = ${formal.valueName}, COMPUTED by the DeclaredVersionVerifier`);
+    // the judged question: the bridge files the council's issue; two judges find the proposition FALSE
+    await k.call("T6.call1.openJudgment", W, k.adrf.registryAddress, k.adrf.registry().interface, "openJudgment", [caseId, 1]);
+    const issueId = await k.adrf.issueOf(caseId, 1);
+    k.setFact("T6.issueId", issueId);
+    const issue = await k.acdf.registry().getIssue(issueId);
+    g.check("T6", "judgment.opened", issue.policyId === council.policyId && getAddress(issue.consumer) === getAddress(k.adrf.bridgeAddress) && Number(issue.consumerDeadline) === clock.decisionDeadline, `issue ${issueId.slice(0, 10)}… under FOGA-Council, consumer = the bridge, consumer deadline = the case's decision deadline`);
+    const round = await k.acdf.roundOf(issueId);
+    await k.call("T6.call1.J1.ballot", "J1", k.acdf.registryAddress, k.acdf.registry().interface, "castBallot", [issueId, round, 0, false]);
+    await k.call("T6.call1.J2.ballot", "J2", k.acdf.registryAddress, k.acdf.registry().interface, "castBallot", [issueId, round, 0, false]);
+    await k.call("T6.call1.acdf.settleRound", W, k.acdf.registryAddress, k.acdf.registry().interface, "settleRound", [issueId]);
+    const roundState = await k.acdf.roundState(issueId, round);
+    const provisional = await k.acdf.getResult(issueId);
+    if (provisional.stateName === "Provisional") {
+        const now = await k.blockTimestamp();
+        const wait = Number(roundState.appealOpenUntil) - now + 1;
+        if (wait > 0)
+            await k.advanceTime(wait, "appeal window of the council's finding on the delivered version");
+        await k.call("T6.call1.acdf.finalize", W, k.acdf.registryAddress, k.acdf.registry().interface, "finalize", [issueId]);
+    }
+    const result = await k.acdf.getResult(issueId);
+    g.check("T6", "council.final", result.stateName === "Final" && result.outcomeName === "Decided" && result.outcomeYes === false, `FOGA-Council: ${result.stateName} ${result.outcomeName}, proposition "actual version matches" held ${result.outcomeYes} (2 of 3 against)`);
+    const importDone = k.store.get("T6.call1.import")?.status === "confirmed";
+    if (!importDone) {
+        const early = await g.wouldRevertCall(k.address(W), k.adrf.registryAddress, k.adrf.registry().interface.encodeFunctionData("decide", [caseId]));
+        g.check("T6", "decide.early.refused", early !== null, `deciding before the judged finding exists reverts: ${early}`);
+    }
+    else
+        g.skipped("T6", "decide.early.refused", "replayed run: the judged finding was already imported");
+    await k.call("T6.call1.import", W, k.adrf.bridgeAddress, k.adrf.bridge().interface, "importResult", [caseId, 1]);
+    const judged = await k.adrf.getFinding(caseId, 1);
+    g.check("T6", "finding.judged", judged.resolved && judged.valueName === "FALSE" && judged.supportKinds === 8 && getAddress(judged.acceptedBy) === getAddress(k.adrf.bridgeAddress) && judged.issueId === issueId, `sub-question 1 (actual version matches) = ${judged.valueName}, JUDGED, provenance issue ${judged.issueId.slice(0, 10)}…`);
+    await k.call("T6.call1.decide", W, k.adrf.registryAddress, k.adrf.registry().interface, "decide", [caseId]);
+    const afterDecide = await k.adrf.getCase(caseId);
+    if (afterDecide.stateName === "Provisional") {
+        const c = await k.adrf.getClock(caseId);
+        const now = await k.blockTimestamp();
+        const early = await g.wouldRevertCall(k.address(W), k.adrf.registryAddress, k.adrf.registry().interface.encodeFunctionData("finalize", [caseId]));
+        g.check("T6", "finalize.early.refused", early !== null, `finalizing inside the review window reverts: ${early}`);
+        if (c.reviewOpenUntil >= now)
+            await k.advanceTime(c.reviewOpenUntil - now + 1, "review window of the dispute's round decision");
+        await k.call("T6.call1.finalize", W, k.adrf.registryAddress, k.adrf.registry().interface, "finalize", [caseId]);
+    }
+    else
+        g.skipped("T6", "finalize.early.refused", "replayed run: the case was already finalized");
+    const ruling = await k.adrf.getRuling(caseId);
+    g.check("T6", "ruling.sustained", ruling.stateName === "Final" && ruling.resultName === "Sustained" && ruling.allowedEffect === EFFECT_REFUND && ruling.closureName === "REVIEW_LAPSED" && ruling.judgmentIssueId === issueId, `ruling: ${ruling.stateName} ${ruling.resultName}, allowed effect = refund, closure ${ruling.closureName}, judgment provenance = the council's issue`);
+    // --- (3) enactment by the escrow, within its own authority, once
+    const enactDone = k.store.get("T6.C.call1.enact")?.status === "confirmed";
+    const cBefore = await k.adrf.escrowBalanceOf(C.address);
+    await C.execute("T6.C.call1.enact", escrow, k.adrf.encodeEnact(caseId, EFFECT_REFUND));
+    const cAfter = await k.adrf.escrowBalanceOf(C.address);
+    if (!enactDone)
+        g.check("T6", "refund.enacted", cAfter - cBefore === price, `C's escrow balance rose by ${cAfter - cBefore} wei: the held charge went back`);
+    else
+        g.skipped("T6", "refund.enacted", "replayed run: the refund was already enacted");
+    const s1 = await k.adrf.settlementOf(call1, 1);
+    const enactment = await k.adrf.getEnactment(caseId, EFFECT_REFUND);
+    g.check("T6", "refund.reported", s1.stateName === "Refunded" && enactment.statusName === "Enacted" && getAddress(enactment.reporter) === getAddress(escrow) && (await k.adrf.heldOf(call1)) === 0n, `settlement 1 of call ${call1} is ${s1.stateName}; the registry records ${enactment.statusName} by the escrow; nothing held`);
+    const again = await g.wouldRevert(C, escrow, k.adrf.encodeEnact(caseId, EFFECT_REFUND));
+    g.check("T6", "refund.twice.refused", again !== null, `a second enactment reverts: ${again}`);
+    const aEscrow = await k.adrf.escrowBalanceOf(A.address);
+    g.check("T6", "provider.unpaid", aEscrow === 0n, `A's escrow balance is ${aEscrow} wei: the disputed charge was never released`);
+    // --- (4) the control case: a call committed to v2, delivered as v2, released after the dispute period
+    const open2 = await C.execute("T6.C.call2.open", escrow, k.adrf.encodeOpenCall(A.address, price, termsHash, v2.packageHash, timing.disputePeriod));
+    const call2 = k.adrf.callIdFromReceipt(open2.receipt);
+    k.setFact("T6.call2.id", call2.toString());
+    await A.execute("T6.A.call2.deliver", escrow, k.adrf.encodeDeliver(call2, v2.packageHash));
+    await A.execute("T6.A.call2.settle", escrow, k.adrf.encodeSettle(call2));
+    const verdict = await g.world.contract("8471/DeclaredVersionVerifier").verify(declaredVersionProposition(escrow, call2), addressParam(escrow), declaredVersionInputs(call2));
+    g.check("T6", "call2.conforms", Number(verdict.value) === Value.FALSE, `DeclaredVersionVerifier on call ${call2}: "declared differs" = ${["UNDETERMINED", "TRUE", "FALSE"][Number(verdict.value)]} (declared v2 = committed v2)`);
+    const s2 = await k.adrf.settlementOf(call2, 1);
+    const releaseAt = s2.at + timing.disputePeriod;
+    const now2 = await k.blockTimestamp();
+    if (s2.stateName === "Held" && releaseAt >= now2)
+        await k.advanceTime(releaseAt - now2 + 1, "the dispute period of the undisputed call");
+    await k.call("T6.call2.release", W, escrow, k.adrf.escrow().interface, "release", [call2]);
+    const s2After = await k.adrf.settlementOf(call2, 1);
+    const aEscrowAfter = await k.adrf.escrowBalanceOf(A.address);
+    g.check("T6", "call2.released", s2After.stateName === "Released" && aEscrowAfter === price, `settlement 1 of call ${call2} is ${s2After.stateName}; A's escrow balance ${aEscrowAfter} wei`, "T7.A.derisk.withdraw");
+    // A's earnings stay in the escrow for now: T7 brings them home under a suspension (a de-risk action)
+    const cRest = await k.adrf.escrowBalanceOf(C.address);
+    if (cRest > 0n)
+        await C.execute("T6.C.escrow.withdraw", escrow, k.adrf.encodeWithdrawBalance(cRest));
+    g.check("T6", "balances.settled", (await k.adrf.escrowBalanceOf(C.address)) === 0n && aEscrowAfter === price, `C withdrew its balance (paid for one conforming call, refunded the disputed one); A's ${price} wei stay in the escrow until T7`, "T7.A.derisk.withdraw");
+    k.evidence("T6", "dispute", {
+        escrow,
+        policyId: adrf.policyId,
+        bindingId: adrf.bindingId,
+        terms: { termsHash, committedVersion: skill.packageHash, declaredVersion: v2.packageHash, price: price.toString(), disputePeriod: timing.disputePeriod },
+        skillV2: v2,
+        call1: call1.toString(),
+        caseId,
+        caseDocumentHash: keccakJcs(caseDocument),
+        findings: { declaredVersionDiffers: formal.valueName, actualVersionMatches: judged.valueName },
+        council: { issueId, policyId: council.policyId, ballots: { J1: false, J2: false }, result: `${result.outcomeName} ${result.outcomeYes}` },
+        ruling: { state: ruling.stateName, result: ruling.resultName, allowedEffect: ruling.allowedEffect, closure: ruling.closureName },
+        enactment: { effect: "adrf:effect/refund", status: enactment.statusName, reporter: enactment.reporter, settlement: s1.stateName },
+        call2: { id: call2.toString(), committedVersion: v2.packageHash, settlement: s2After.stateName },
+        txs: { open1: open1.txHash, deliver1: deliver1.txHash, settle1: k.store.get("T6.A.call1.settle")?.txHash, file: filed.txHash, resolveFormal: k.store.get("T6.call1.resolveFormal")?.txHash, openJudgment: k.store.get("T6.call1.openJudgment")?.txHash, import: k.store.get("T6.call1.import")?.txHash, decide: k.store.get("T6.call1.decide")?.txHash, finalize: k.store.get("T6.call1.finalize")?.txHash, enact: k.store.get("T6.C.call1.enact")?.txHash, open2: open2.txHash, release2: k.store.get("T6.call2.release")?.txHash },
+    });
+}

package/dist/genesis/t7.js

@@ -0,0 +1,198 @@
+import { join } from "node:path";
+import { getAddress, parseEther } from "ethers";
+import { Restriction } from "../core/asf.js";
+import { accountRef, dataUri, keccakJcs, sha256Hex } from "../core/canonical.js";
+import { hashlock, nativeTerms } from "../core/tenders.js";
+import { runExtractIsolated } from "./skill-runner.js";
+import { LIVENESS_DEMO_WINDOW } from "./scenario.js";
+/**
+ * T7 — safety: the stop is enforced where the cell acts, not where it promises.
+ *  (0) B tenders two completions of the finch-extract-verify report (a pending opportunity for A).
+ *  (1) The guardian suspends A's binding (no new risk, de-risk only). The kernel reads `status()` and records its
+ *      decision: no new commitments, de-risk actions allowed.
+ *  (2) Bypass: the operator key sends a transaction straight to the account, around the kernel, for a
+ *      commitment-class call; the account's gate reverts it on chain. A de-risk call through the same gate
+ *      succeeds (A withdraws its escrow earnings from T6).
+ *  (3) Attribution: the operator key submits to the tender directly, not through the account; the chain accepts
+ *      it, but the fulfiller is the operator's own address, and the kernel marks the submission and its payout
+ *      as not the cell's.
+ *  (4) Escape attempts: the owner presents a fresh binding; the standing stop recorded by the intervener still
+ *      applies (StoppedByIntervener); the adopter cannot lift the intervener's suspension; a non-guardian cannot
+ *      suspend.
+ *  (5) The guardian resumes; A submits and is paid through its account.
+ *  (6) The anchor gate: A shortens its liveness window (an anchor's own parameter) and the window passes without a
+ *      heartbeat; A is STALE and a commitment-class call is refused by the gate's AID clause; after a heartbeat it
+ *      passes the gate again and A restores the registry's default window. B and C heartbeat too. The same path runs
+ *      on every chain: the clock is moved on anvil and waited for elsewhere.
+ */
+export async function t7(g) {
+    const k = g.kernel;
+    const W = "W";
+    const A = g.cell("A");
+    const B = g.cell("B");
+    const C = g.cell("C");
+    const chainId = g.chainId;
+    const G = k.address("G");
+    const bindingId = k.requireFact("T1.A.bindingId");
+    const extractSkill = k.requireFact("T2.skill.finch-extract-verify");
+    const spec = k.requireFact("T0.asf.spec");
+    const reward = parseEther("0.001");
+    const escrow = k.adrf.escrowAddress;
+    // the suspension was lifted in an earlier run: state checks of the suspended phase cannot be remade
+    const replayedStop = k.store.get("T7.G.resume")?.status === "confirmed";
+    const replayedStale = k.store.get("T7.A.aid.heartbeat")?.status === "confirmed";
+    // --- (0) the pending opportunity: a hashlock tender over the deterministic report, two completions
+    const run = await runExtractIsolated({ documentPath: join(g.cfg.fixturesDir, "sample-filing.txt"), fieldsPath: join(g.cfg.skillsDir, "finch-extract-verify", "fields.json"), packageHash: extractSkill.packageHash, inputDir: g.cfg.fixturesDir, skillsDir: g.cfg.skillsDir });
+    const answer = run.canonical;
+    const answerHash = hashlock.answerHash(answer);
+    const task = { schema: "foga.task/1", skill: "finch-extract-verify", packageHash: extractSkill.packageHash, input: { document: "scenarios/fixtures/sample-filing.txt", documentDigest: run.report.documentDigest }, acceptance: { mode: "verifier", profile: "x-hashlock-v1", verifier: k.tenders.hashlockAddress, answerHash }, deliverable: "the canonical finch.extract-verify/1 report; resultHash = sha256(report || fulfiller)", completions: 2 };
+    const taskURI = dataUri(task);
+    const taskHash = sha256Hex(JSON.stringify(task));
+    const settleBy = await k.memo("T7.settleBy", async () => (await k.blockTimestamp()) + 7 * 86400);
+    const terms = nativeTerms(reward, { maxCompletions: 2n, submitBy: BigInt(settleBy - 86400), settleBy: BigInt(settleBy) });
+    const mint = await B.execute("T7.B.mint", k.tenders.address, k.tenders.encodeMint({ to: B.address, updateAuthority: B.address, acceptanceAuthority: k.tenders.hashlockAddress, tdHash: keccakJcs({ td: "foga.task/1", skill: "finch-extract-verify" }), taskHash, taskURI, terms }));
+    const tokenId = k.tenders.tokenIdFromReceipt(mint.receipt);
+    k.setFact("T7.tokenId", tokenId.toString());
+    await B.execute("T7.B.fund", k.tenders.address, k.tenders.encodeFund(tokenId, reward * 2n), { value: reward * 2n });
+    await B.execute("T7.B.commit", k.tenders.hashlockAddress, k.tenders.encodeCommitAnswer(tokenId, answerHash));
+    const receipt = { schema: "foga.run-receipt/1", skill: "finch-extract-verify", packageHash: extractSkill.packageHash, tokenId: extractSkill.tokenId, input: task.input, answerHash, fulfiller: accountRef(chainId, A.address), worker: "deterministic extractor in the kernel process" };
+    const submitAsA = k.tenders.encodeSubmit(tokenId, hashlock.resultHash(answer, A.address), dataUri(receipt));
+    // --- (1) the guardian stops A: no new risk, de-risk only
+    const response = { kind: "response", restrictions: ["no-new-risk", "derisk-only"], allowed: ["withdrawals of earned credit", "refunds", "leaving a swarm", "withdrawing escrow balances"], text: "Stop taking on new work and new counterparties; bring exposures home; await the guardian's review." };
+    const reason = { kind: "reason", summary: "guardian review of the cell's conduct after the T6 dispute", step: "T7" };
+    const notGuardian = await g.wouldRevertCall(k.address(W), k.asf.bindingRegistryAddress, k.asf.encodeSuspend(bindingId, Restriction.noNewRisk | Restriction.deriskOnly, keccakJcs(response), keccakJcs(reason)));
+    g.check("T7", "suspend.stranger.refused", notGuardian !== null, `W (not the intervener) suspending A's binding reverts: ${notGuardian}`);
+    await k.call("T7.G.suspend", "G", k.asf.bindingRegistryAddress, k.asf.bindings().interface, "suspend", [bindingId, Restriction.noNewRisk | Restriction.deriskOnly, keccakJcs(response), keccakJcs(reason)]);
+    if (!replayedStop) {
+        const status = await A.status();
+        const decision = { cell: "A", verdict: status.verdictName, reasons: status.reasonNames, restrictions: status.restrictions, decision: "no new commitment-class calls; de-risk actions continue; wait for resume", recordedAt: await k.blockTimestamp() };
+        k.setFact("T7.kernel.decision", decision);
+        // Suspended through the presented binding, or StoppedByIntervener when a resumed run already presents the second one
+        g.check("T7", "status.suspended", status.verdictName === "NotSatisfied" && status.reasonNames.some((r) => r === "Suspended" || r === "StoppedByIntervener"), `status() = ${status.verdictName} [${status.reasonNames.join(",")}], restrictions ${status.restrictions.join(",")}; kernel decision recorded`);
+        // --- (2) bypass: the operator key goes around the kernel and straight to the account; the gate refuses
+        const bypass = await k.memo("T7.bypass", async () => {
+            const operator = k.signer(A.roles.operator);
+            const data = A.iface.encodeFunctionData("execute", [k.tenders.address, 0n, submitAsA]);
+            const reasonText = await g.wouldRevertCall(operator.address, A.address, data);
+            const tx = await operator.sendTransaction({ to: A.address, data, gasLimit: 400000n });
+            const r = await g.world.provider.waitForTransaction(tx.hash); // unlike tx.wait(), returns a status-0 receipt instead of throwing
+            return { txHash: tx.hash, status: r?.status ?? null, gasUsed: r?.gasUsed.toString() ?? null, reason: reasonText };
+        });
+        g.check("T7", "bypass.reverted", bypass.status === 0 && bypass.reason !== null, `operator.A's direct transaction ${bypass.txHash.slice(0, 10)}… to execute(submitFulfillment) failed on chain (status ${bypass.status}, ${bypass.gasUsed} gas): ${bypass.reason}`);
+        const deposit = await g.wouldRevert(A, escrow, k.adrf.encodeDeposit());
+        g.check("T7", "newrisk.refused", deposit !== null, `a call that is neither de-risk nor allow-listed (escrow deposit) reverts under the suspension: ${deposit}`);
+    }
+    else {
+        g.skipped("T7", "status.suspended", "replayed run: the suspension was already lifted");
+        g.skipped("T7", "bypass.reverted", "replayed run: the suspension was already lifted");
+        g.skipped("T7", "newrisk.refused", "replayed run: the suspension was already lifted");
+    }
+    // de-risk through the same gate: A brings its T6 earnings home from the escrow
+    const earned = await k.adrf.escrowBalanceOf(A.address);
+    const withdrawDone = k.store.get("T7.A.derisk.withdraw")?.status === "confirmed";
+    const before = await A.balance();
+    if (earned > 0n)
+        await A.execute("T7.A.derisk.withdraw", escrow, k.adrf.encodeWithdrawBalance(earned));
+    if (!withdrawDone)
+        g.check("T7", "derisk.allowed", (await A.balance()) - before === earned && earned > 0n, `withdrawBalance(${earned}) through the account succeeded under the suspension (de-risk allow-list); A's account rose by ${(await A.balance()) - before} wei`);
+    else
+        g.skipped("T7", "derisk.allowed", "replayed run: the withdrawal was already made");
+    // --- (3) attribution: the operator key acts on its own, not through the account
+    const operatorAddress = A.operatorAddress;
+    const rogue = await k.call("T7.operator.submit", A.roles.operator, k.tenders.address, k.tenders.contract().interface, "submitFulfillment", [tokenId, hashlock.resultHash(answer, operatorAddress), dataUri({ ...receipt, fulfiller: accountRef(chainId, operatorAddress), note: "submitted by the operator key directly" })]);
+    const rogueId = k.tenders.submissionIdFromReceipt(rogue.receipt);
+    k.setFact("T7.operator.submissionId", rogueId.toString());
+    const rogueSub = await k.tenders.submissionOf(tokenId, rogueId);
+    const attributable = getAddress(rogueSub.fulfiller) === getAddress(A.address);
+    g.check("T7", "attribution.operator", !attributable && getAddress(rogueSub.fulfiller) === getAddress(operatorAddress), `submission ${rogueId}: fulfiller ${rogueSub.fulfiller} is the operator key, not the cell; the kernel marks it "not attributable to A"`);
+    const opBefore = await k.balance(operatorAddress);
+    const settleDone = k.store.get("T7.operator.settle")?.status === "confirmed";
+    await k.call("T7.operator.settle", A.roles.operator, k.tenders.address, k.tenders.contract().interface, "settleFulfillment", [tokenId, rogueId, Buffer.from(answer, "utf8")]);
+    const rogueAfter = await k.tenders.submissionOf(tokenId, rogueId);
+    if (!settleDone)
+        g.check("T7", "attribution.payout", rogueAfter.status === 1 && (await k.balance(operatorAddress)) > opBefore - parseEther("0.0005"), `the operator settled its own submission and was paid ${reward} wei to its key: income outside the cell's boundary (T8 does not count it)`);
+    else
+        g.skipped("T7", "attribution.payout", "replayed run: the operator's settlement was already made");
+    k.setFact("T7.unattributed", { tokenId: tokenId.toString(), submissionId: rogueId.toString(), fulfiller: operatorAddress, reward: reward.toString(), reason: "fulfiller is the operator key, not the cell account" });
+    // --- (4) escape attempts
+    const input2 = k.asf.cellBindingInput({ chainId, cell: A.address, specId: spec.specId, version: spec.version, contentHash: spec.contentHash, guardian: G, params: { profile: "foga-cell/1", cell: "A", note: "second binding presented while the first is suspended" }, authority: { kind: "owner", owner: accountRef(chainId, A.ownerAddress), guardian: accountRef(chainId, G) }, salt: "0x" + "00".repeat(31) + "02" });
+    const { bindingId: binding2 } = await A.adoptBinding("T7.A.adopt2", input2, 0);
+    k.setFact("T7.A.bindingId2", binding2);
+    if (!replayedStop) {
+        const status2 = await A.status();
+        g.check("T7", "escape.sibling.refused", status2.verdictName === "NotSatisfied" && status2.reasonNames.includes("StoppedByIntervener"), `with a fresh binding ${binding2.slice(0, 10)}… presented, status() = ${status2.verdictName} [${status2.reasonNames.join(",")}]: the intervener's standing stop follows the adopter and the subject`);
+        const stillBlocked = await g.wouldRevert(A, k.tenders.address, submitAsA);
+        g.check("T7", "escape.sibling.gate", stillBlocked !== null, `the commitment-class call through the fresh binding still reverts: ${stillBlocked}`);
+        const adopterLift = await g.wouldRevert(A, k.asf.bindingRegistryAddress, k.asf.encodeResume(bindingId, keccakJcs({ by: "adopter" })), "owner");
+        g.check("T7", "escape.adopter.refused", adopterLift !== null, `the adopter (owner through the account) resuming the intervener's suspension reverts: ${adopterLift}`);
+    }
+    else {
+        for (const n of ["escape.sibling.refused", "escape.sibling.gate", "escape.adopter.refused"])
+            g.skipped("T7", n, "replayed run: the suspension was already lifted");
+    }
+    // --- (5) resume, then A works through its account
+    await k.call("T7.G.resume", "G", k.asf.bindingRegistryAddress, k.asf.bindings().interface, "resume", [bindingId, keccakJcs({ kind: "reason", summary: "review complete; the cell may resume", step: "T7" })]);
+    const resumed = await A.status();
+    g.check("T7", "status.resumed", resumed.verdictName === "Satisfied", `status() = ${resumed.verdictName} after the guardian's resume (the standing stop is lifted with it)`);
+    const aBefore = await A.balance();
+    const submitDone = k.store.get("T7.A.settle")?.status === "confirmed";
+    const sub = await A.execute("T7.A.submit", k.tenders.address, submitAsA);
+    const subId = k.tenders.submissionIdFromReceipt(sub.receipt);
+    k.setFact("T7.A.submissionId", subId.toString());
+    await A.execute("T7.A.settle", k.tenders.address, k.tenders.encodeSettle(tokenId, subId, Buffer.from(answer, "utf8")));
+    const aSub = await k.tenders.submissionOf(tokenId, subId);
+    g.check("T7", "A.accepted", aSub.status === 1 && getAddress(aSub.fulfiller) === getAddress(A.address), `submission ${subId}: Accepted, fulfiller = the cell account`);
+    if (!submitDone)
+        g.check("T7", "A.paid", (await A.balance()) - aBefore === reward, `A's account rose by ${(await A.balance()) - aBefore} wei`);
+    else
+        g.skipped("T7", "A.paid", "replayed run: the settlement was already made");
+    // --- (6) the anchor gate: STALE once a liveness window passes without a heartbeat, back to ACTIVE after one
+    const defaultWindow = await k.aid.defaultLivenessWindow();
+    if (!replayedStale) {
+        // the anchor shortens its own window (setLivenessWindow is the anchor's call; it also counts as a heartbeat)
+        await A.execute("T7.A.aid.window", k.aid.address, k.aid.encodeSetLivenessWindow(LIVENESS_DEMO_WINDOW));
+        const window = await k.aid.livenessWindow(A.address);
+        const lastSeen = Number(await k.aid.lastSeen(A.address));
+        const now = await k.blockTimestamp();
+        const staleAt = (lastSeen || now) + window + 1;
+        if (staleAt > now)
+            await k.advanceTime(staleAt - now, `A's liveness window (${window} s) passes without a heartbeat`);
+        const stateA = await k.aid.stateName(A.address);
+        const staleGate = await g.wouldRevert(A, k.tenders.address, submitAsA);
+        g.check("T7", "anchor.stale.gate", window === LIVENESS_DEMO_WINDOW && stateA === "STALE" && staleGate !== null && /AnchorNotActive/.test(staleGate), `livenessWindow(A) = ${window} s (default ${defaultWindow} s); after it passes, state(A) = ${stateA} and a commitment-class call reverts at the gate: ${staleGate}`);
+    }
+    else {
+        g.skipped("T7", "anchor.stale.gate", "replayed run: the heartbeat was already sent");
+    }
+    for (const X of [A, B, C]) {
+        await X.execute(`T7.${X.name}.aid.heartbeat`, k.aid.address, k.aid.encodeHeartbeat());
+        if (k.aid.backing)
+            await X.execute(`T7.${X.name}.aid.backing.heartbeat`, k.aid.backing.address, k.aid.encodeHeartbeat());
+    }
+    const states = await Promise.all([A, B, C].map((X) => k.aid.stateName(X.address)));
+    const afterBeat = await g.wouldRevert(A, k.tenders.address, submitAsA);
+    // A's anchor state changes first at the identity transfer of T9 (STALE, then taken over), then at the retirement
+    const untilA = ["T9.A.8004.transfer", "T9.A.aid.retire"];
+    g.check("T7", "anchor.active.gate", states.every((s) => s === "ACTIVE") && afterBeat !== null && !/AnchorNotActive/.test(afterBeat), `states ${states.join("/")} after heartbeats; the same call now passes the gate and fails only inside the tender: ${afterBeat}`, untilA);
+    // the default window again: the demonstration leaves no short window behind
+    await A.execute("T7.A.aid.window.reset", k.aid.address, k.aid.encodeSetLivenessWindow(0));
+    const restored = await k.aid.livenessWindow(A.address);
+    g.check("T7", "anchor.window.restored", restored === defaultWindow, `livenessWindow(A) = ${restored} s after the reset (the registry's default)`, "T9.A.aid.retire");
+    if (k.aid.backing) {
+        const backingStates = await Promise.all([A, B, C].map((X) => k.aid.stateName(X.address, k.aid.backing.address)));
+        g.check("T7", "anchor.backing.active", backingStates.every((s) => s === "ACTIVE"), `states ${backingStates.join("/")} in the backing registry ${k.aid.backing.address} after heartbeats`, untilA);
+    }
+    k.evidence("T7", "safety", {
+        binding: bindingId,
+        binding2,
+        tender: { tokenId: tokenId.toString(), completions: 2, reward: reward.toString() },
+        suspension: { by: G, restrictions: Restriction.noNewRisk | Restriction.deriskOnly, response, reason },
+        kernelDecision: k.fact("T7.kernel.decision") ?? null,
+        bypass: k.fact("T7.bypass") ?? null,
+        derisk: { action: "ADRFServiceEscrow.withdrawBalance", amount: earned.toString() },
+        unattributed: k.fact("T7.unattributed"),
+        attributed: { submissionId: subId.toString(), fulfiller: A.address },
+        liveness: { demonstrationWindow: LIVENESS_DEMO_WINDOW, defaultWindow, backingRegistry: k.aid.backing?.address ?? null },
+        txs: { suspend: k.store.get("T7.G.suspend")?.txHash, resume: k.store.get("T7.G.resume")?.txHash, operatorSubmit: rogue.txHash, submit: sub.txHash, window: k.store.get("T7.A.aid.window")?.txHash, heartbeats: [A, B, C].map((X) => k.store.get(`T7.${X.name}.aid.heartbeat`)?.txHash), windowReset: k.store.get("T7.A.aid.window.reset")?.txHash },
+    });
+}