@gate-forge/core 0.1.0

package/dist/schemas/execution-result.js

@@ -0,0 +1,240 @@
+/**
+ * Execution-result record (plan 2026-09-13 §5.1 row "Execution result",
+ * Phase 4 work item 3, ADR 0005 D2): the trusted supervisor's OWN account
+ * of a run — planned versus executed instances, per-instance outcomes and
+ * attempts, runner exit, fixture/teardown outcome, shard completeness,
+ * selection + catalog digests, trusted policy digest, engine versions,
+ * and environment identity.
+ *
+ * Trust boundary (ADR 0005 D2): the suite reporter is INPUT, never
+ * signature authority. This record is written by trusted supervision
+ * under the excluded run-state directory; its digest (see
+ * {@link executionResultDigestOf}) is what the gate receipt binds —
+ * never a reporter aggregate. `outcomes` rows are supervision-normalized
+ * data, not the reporter's own summary.
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+import { sha256Canonical } from '../canonical-json.js';
+/** Domain tag separating execution-result digests from every other hash. */
+export const EXECUTION_RESULT_DOMAIN = 'gateforge.execution-result.v1';
+/** Domain tag separating selection digests from every other hash. */
+export const SELECTION_DOMAIN = 'gateforge.selection.v1';
+/** Hex pattern shared by every 64-char lowercase digest field. */
+const HEX64 = /^[0-9a-f]{64}$/;
+/** One planned instance (fixed BEFORE the run; ADR 0005 D2). */
+export const PlannedInstanceSchema = z
+    .object({
+    /** Stable logical key (§5.2). */
+    logicalKey: z.string().min(1),
+    /** Runner project, or null when no enumeration bound one. */
+    project: z.string().min(1).nullable(),
+    /** Repo-relative posix file. */
+    file: z.string().min(1),
+    /** Full title path (describe stack, then the test title). */
+    titlePath: z.array(z.string().min(1)).min(1),
+    /** The framework's own instance id, or null when unbound. */
+    frameworkId: z.string().nullable(),
+})
+    .strict();
+/** Per-instance execution status the supervisor accepts from the runner. */
+export const InstanceStatusSchema = z.enum(['passed', 'failed', 'skipped', 'fixme', 'not-run']);
+/** One executed instance outcome (supervision-normalized; input only). */
+export const ExecutedOutcomeSchema = z
+    .object({
+    /** Stable logical key the executed instance resolved to. */
+    logicalKey: z.string().min(1),
+    /** Runner project, or null when the runner did not report one. */
+    project: z.string().nullable(),
+    /** Repo-relative posix file (the instance identity join key). */
+    file: z.string().min(1),
+    /** Full title path (the instance identity join key). */
+    titlePath: z.array(z.string().min(1)),
+    /** Observed outcome on this attempt. */
+    status: InstanceStatusSchema,
+    /** Attempt number (1 = first attempt; required retries stay zero). */
+    attempt: z.number().int().min(1),
+    /** True when the instance was an expected failure (never proves behavior). */
+    expectedFailure: z.boolean(),
+})
+    .strict();
+/** One typed supervision finding (plan §5.4 run rows). */
+export const SupervisionFindingSchema = z
+    .object({
+    /** Stable cause code (TEST_NOT_EXECUTED / TEST_FAILED / RUN_INCOMPLETE). */
+    cause: z.enum(['TEST_NOT_EXECUTED', 'TEST_FAILED', 'RUN_INCOMPLETE']),
+    /** Single-cause human explanation (instance-scoped when known). */
+    detail: z.string().min(1),
+    /** The logical key the finding is scoped to, or null for run-scoped. */
+    logicalKey: z.string().nullable(),
+})
+    .strict();
+/** One witness-recorded session of an expected test (execution authority). */
+export const TracedSessionSchema = z
+    .object({
+    /** Witness-issued session id (UUID). */
+    sessionId: z.string().min(1),
+    /** Witness-monotonic tick at open. */
+    openedTick: z.number().int().min(0),
+    /** Witness-monotonic tick at seal (null = never sealed — blocking). */
+    sealedTick: z.number().int().min(0).nullable(),
+    /** The outcome the supervisor observed at close (null = unknown). */
+    outcome: z.string().nullable(),
+    /**
+     * Witness-side activity bound to the session (review recheck fix
+     * 2026-09-14): records issued under the session + recorded intervals
+     * + engine-observed exchanges. A sealed-passed session with zero
+     * activity blocks supervision (fabricated-lifecycle signature).
+     */
+    activity: z.number().int().min(0),
+})
+    .strict();
+/** The witness-side session trace for ONE expected test. */
+export const TracedTestSchema = z
+    .object({
+    /** The runner-assigned id the session was opened under (diagnostic). */
+    testId: z.string().min(1).nullable(),
+    /** Registered runner project (the expected-set identity join key). */
+    project: z.string().min(1).nullable(),
+    /** Registered repo-relative posix file (the identity join key). */
+    file: z.string().min(1),
+    /** Registered full title path (the identity join key). */
+    titlePath: z.array(z.string().min(1)).min(1),
+    /** Every session the witness recorded for this expected test. */
+    sessions: z.array(TracedSessionSchema),
+})
+    .strict();
+/**
+ * The sealed execution result. Strict: unknown keys are rejected so a
+ * hostile run-state edit cannot smuggle extra authority in.
+ */
+export const ExecutionResultSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Run manifest identity the execution belongs to. */
+    runId: z.string().uuid(),
+    /** Fresh trusted invocation identity of the supervising run. */
+    invocationId: z.string().uuid(),
+    /** 64-hex digest of the canonical input snapshot this run tested. */
+    inputDigest: z.string().regex(HEX64, 'inputDigest must be 64-char lowercase hex'),
+    /** 64-hex trusted policy/config revision digest (ADR 0005 D6). */
+    trustedPolicyDigest: z.string().regex(HEX64, 'trustedPolicyDigest must be 64-char lowercase hex'),
+    /** The selection the supervisor fixed BEFORE the run. */
+    selection: z
+        .object({
+        /** Runner the selection executes under. */
+        runner: z.string().min(1),
+        /** Selection mode; `full-relevant-suite` until narrower selection is proven safe. */
+        mode: z.enum(['full-relevant-suite', 'mapped-selection']),
+        /** Exact logical keys the run was expected to cover (sorted). */
+        logicalKeys: z.array(z.string().min(1)),
+    })
+        .strict(),
+    /** 64-hex digest binding the selection (domain-separated). */
+    selectionDigest: z.string().regex(HEX64, 'selectionDigest must be 64-char lowercase hex'),
+    /** 64-hex digest of the catalog the selection was planned from. */
+    catalogDigest: z.string().regex(HEX64, 'catalogDigest must be 64-char lowercase hex'),
+    /** The planned instances (the expected test set, fixed pre-run). */
+    planned: z.array(PlannedInstanceSchema),
+    /** The executed instance outcomes (reporter data = input only). */
+    outcomes: z.array(ExecutedOutcomeSchema),
+    /**
+     * 64-hex digest over the expected set the witness registered BEFORE
+     * the run (enforcement-review fix 2d; additive). Present only when
+     * the supervisor registered an expected set with the witness.
+     */
+    enumerationDigest: z.string().regex(HEX64).optional(),
+    /**
+     * The witness-side per-test session trace (enforcement-review fix 2d;
+     * additive): sessionIds + outcomes per expected test, so receipts
+     * bind the CORROBORATED execution trace — not just the runner's own
+     * account. Present only when the supervisor fetched it.
+     */
+    sessionTrace: z.array(TracedTestSchema).optional(),
+    /** Framework process exit code (supplementary, never decisive). */
+    runnerExit: z.number().int().nullable(),
+    /** Supervision verdict: true only when the complete expected set passed. */
+    complete: z.boolean(),
+    /** Typed findings (empty only when complete). */
+    causes: z.array(SupervisionFindingSchema),
+    /** Setup/teardown/runner-body outcome the supervisor observed. */
+    fixtureOutcome: z.enum(['passed', 'failed', 'unknown']),
+    /** Shard completeness the supervisor verified. */
+    shardCompleteness: z
+        .object({
+        /** True only when every expected shard ran. */
+        complete: z.boolean(),
+        /** Single-cause detail when incomplete. */
+        detail: z.string(),
+    })
+        .strict(),
+    /** Highest attempt number observed (must be 1 — required retries are zero). */
+    maxAttemptObserved: z.number().int().min(1),
+    /** Engine/runtime versions the supervisor captured (honest subset). */
+    engines: z.record(z.string().min(1), z.string()),
+    /** Browser versions when the runner reports them (may be empty). */
+    browsers: z.record(z.string().min(1), z.string()),
+    /** 64-hex domain-separated environment identity (node/platform/arch/engines). */
+    environmentIdentity: z.string().regex(HEX64, 'environmentIdentity must be 64-char lowercase hex'),
+    /** Run start instant (ISO-8601). */
+    startedAt: z.string().datetime(),
+    /** Run end instant (ISO-8601). */
+    finishedAt: z.string().datetime(),
+})
+    .strict()
+    .superRefine((result, ctx) => {
+    // A complete run with findings is a contradiction — fail closed on
+    // the inconsistent document instead of trusting either field.
+    if (result.complete && result.causes.length > 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['complete'],
+            message: 'a complete execution result cannot carry supervision causes',
+        });
+    }
+    if (!result.complete && result.causes.length === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['causes'],
+            message: 'an incomplete execution result requires at least one typed cause',
+        });
+    }
+});
+/**
+ * Computes the domain-separated digest of an execution result (plan §5.1:
+ * the receipt binds THIS digest, never a reporter aggregate). The digest
+ * covers every field except the `causes`-vs-`complete` consistency check
+ * (which is structural, not content).
+ *
+ * Args:
+ *   result: a validated execution result.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex digest.
+ *
+ * Throws:
+ *   TypeError: when the result contains non-JSON-representable values.
+ */
+export function executionResultDigestOf(result) {
+    return sha256Canonical({ domain: EXECUTION_RESULT_DOMAIN, result });
+}
+/**
+ * Computes the domain-separated selection digest (plan Phase 4 item 3:
+ * the expected test set is hashed BEFORE the run so a receipt binds the
+ * exact selection, and any selection change forces a fresh run).
+ *
+ * Args:
+ *   selection: the runner, mode, and logical keys selected.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex digest.
+ */
+export function selectionDigestOf(selection) {
+    return sha256Canonical({
+        domain: SELECTION_DOMAIN,
+        runner: selection.runner,
+        mode: selection.mode,
+        logicalKeys: [...new Set(selection.logicalKeys)].sort(),
+    });
+}
+//# sourceMappingURL=execution-result.js.map

package/dist/schemas/execution-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-result.js","sourceRoot":"","sources":["../../src/schemas/execution-result.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEvE,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD,kEAAkE;AAClE,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,iCAAiC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,gCAAgC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,6DAA6D;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAKhG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,kEAAkE;IAClE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,iEAAiE;IACjE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,8EAA8E;IAC9E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrE,mEAAmE;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wEAAwE;IACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,mEAAmE;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,0DAA0D;IAC1D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,iEAAiE;IACjE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,qEAAqE;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,2CAA2C,CAAC;IACjF,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,mDAAmD,CAAC;IACjG,yDAAyD;IACzD,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,2CAA2C;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,qFAAqF;QACrF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;QACzD,iEAAiE;QACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KACxC,CAAC;SACD,MAAM,EAAE;IACX,8DAA8D;IAC9D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,+CAA+C,CAAC;IACzF,mEAAmE;IACnE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,6CAA6C,CAAC;IACrF,oEAAoE;IACpE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACvC,mEAAmE;IACnE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,mEAAmE;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,4EAA4E;IAC5E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACzC,kEAAkE;IAClE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,kDAAkD;IAClD,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,+CAA+C;QAC/C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,2CAA2C;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;SACD,MAAM,EAAE;IACX,+EAA+E;IAC/E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAChD,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACjD,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,mDAAmD,CAAC;IACjG,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kCAAkC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,mEAAmE;IACnE,8DAA8D;IAC9D,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,kEAAkE;SAC5E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAIjC;IACC,OAAO,eAAe,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/schemas/gate-receipt.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Gate receipt schema (plan 2026-09-13 §5.1 row "Gate receipt", ADR 0005
+ * D3): a NEW versioned, domain-separated envelope issued by trusted
+ * supervision only after complete run success and evidence grading.
+ *
+ * A receipt NEVER reuses or repurposes the v2 witness attestation
+ * (`gateforge.ledger.v2`): old evidence stays valid only for its original
+ * weaker contract. The receipt binds — in one authenticated object — the
+ * tested input digest, base/parent Git identity, the trusted policy
+ * revision digest (ADR 0005 D6), the invocation, the selection/catalog
+ * digests, the supervision execution-result digest, the evidence
+ * attestation digest, and the final verdict summary. The MAC is computed
+ * with the SAME authority as witness records (the witness verifier key,
+ * HMAC-SHA256 over GF-canonical JSON) — see `src/receipt/index.ts`.
+ *
+ * Scope extension (opt-in scoped supervised runs): a receipt also names
+ * its evaluation scope (`scope`, absent = `full` for pre-extension
+ * receipts) and, for `changed`-scope receipts, the pin-#2 fingerprints of
+ * the obligations the sealed slice covers. Both fields sit inside the
+ * signed body (the MAC covers every field but `mac` by construction), so
+ * a covered set cannot be widened or trimmed without breaking the
+ * signature.
+ */
+import { z } from 'zod';
+/**
+ * The evaluation scope a receipt seals (opt-in scoped supervised runs):
+ * - `full` — the whole relevant suite ran and the whole-repo gate was
+ *   green (the historical, default shape);
+ * - `changed` — only the SLICE of tests claiming obligations affected by
+ *   the changed files ran, and only those obligations were graded.
+ * OPTIONAL/additive like `approvedPolicyDigest`: receipts sealed before
+ * scoped runs existed omit it and are read as `full` (that is exactly
+ * what the old seal process certified).
+ */
+export declare const ReceiptScopeSchema: z.ZodEnum<{
+    changed: "changed";
+    full: "full";
+}>;
+/** Inferred receipt-scope shape. */
+export type ReceiptScope = z.infer<typeof ReceiptScopeSchema>;
+/** The final verdict summary the receipt seals. */
+export declare const ReceiptVerdictSummarySchema: z.ZodObject<{
+    total: z.ZodNumber;
+    satisfied: z.ZodNumber;
+    waived: z.ZodNumber;
+    blocking: z.ZodNumber;
+}, z.core.$strict>;
+/** Inferred receipt verdict-summary shape. */
+export type ReceiptVerdictSummary = z.infer<typeof ReceiptVerdictSummarySchema>;
+/**
+ * The gate receipt. Unsigned fields first, `mac` last; the signed body is
+ * exactly `{domain, receiptVersion, ...everything except mac}`.
+ */
+export declare const GateReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    receiptVersion: z.ZodLiteral<1>;
+    receiptId: z.ZodString;
+    runId: z.ZodString;
+    invocationId: z.ZodString;
+    inputDigest: z.ZodString;
+    gitSha: z.ZodNullable<z.ZodString>;
+    parentSha: z.ZodNullable<z.ZodString>;
+    trustedPolicyDigest: z.ZodString;
+    approvedPolicyDigest: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        changed: "changed";
+        full: "full";
+    }>>;
+    coveredObligationFingerprints: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    invocation: z.ZodString;
+    selectionDigest: z.ZodString;
+    catalogDigest: z.ZodString;
+    executionResultDigest: z.ZodString;
+    evidenceAttestationDigest: z.ZodNullable<z.ZodString>;
+    verdictSummary: z.ZodObject<{
+        total: z.ZodNumber;
+        satisfied: z.ZodNumber;
+        waived: z.ZodNumber;
+        blocking: z.ZodNumber;
+    }, z.core.$strict>;
+    issuedAt: z.ZodString;
+    mac: z.ZodString;
+}, z.core.$strict>;
+/** Inferred gate-receipt shape. */
+export type GateReceipt = z.infer<typeof GateReceiptSchema>;
+//# sourceMappingURL=gate-receipt.d.ts.map

package/dist/schemas/gate-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-receipt.d.ts","sourceRoot":"","sources":["../../src/schemas/gate-receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;EAA8B,CAAC;AAE9D,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B;;;;;kBAmBpC,CAAC;AAEL,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgI1B,CAAC;AAEL,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/schemas/gate-receipt.js

@@ -0,0 +1,193 @@
+/**
+ * Gate receipt schema (plan 2026-09-13 §5.1 row "Gate receipt", ADR 0005
+ * D3): a NEW versioned, domain-separated envelope issued by trusted
+ * supervision only after complete run success and evidence grading.
+ *
+ * A receipt NEVER reuses or repurposes the v2 witness attestation
+ * (`gateforge.ledger.v2`): old evidence stays valid only for its original
+ * weaker contract. The receipt binds — in one authenticated object — the
+ * tested input digest, base/parent Git identity, the trusted policy
+ * revision digest (ADR 0005 D6), the invocation, the selection/catalog
+ * digests, the supervision execution-result digest, the evidence
+ * attestation digest, and the final verdict summary. The MAC is computed
+ * with the SAME authority as witness records (the witness verifier key,
+ * HMAC-SHA256 over GF-canonical JSON) — see `src/receipt/index.ts`.
+ *
+ * Scope extension (opt-in scoped supervised runs): a receipt also names
+ * its evaluation scope (`scope`, absent = `full` for pre-extension
+ * receipts) and, for `changed`-scope receipts, the pin-#2 fingerprints of
+ * the obligations the sealed slice covers. Both fields sit inside the
+ * signed body (the MAC covers every field but `mac` by construction), so
+ * a covered set cannot be widened or trimmed without breaking the
+ * signature.
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+import { FingerprintHexSchema } from './baseline.js';
+/** Hex pattern shared by every digest field. */
+const HEX64 = /^[0-9a-f]{64}$/;
+/**
+ * The evaluation scope a receipt seals (opt-in scoped supervised runs):
+ * - `full` — the whole relevant suite ran and the whole-repo gate was
+ *   green (the historical, default shape);
+ * - `changed` — only the SLICE of tests claiming obligations affected by
+ *   the changed files ran, and only those obligations were graded.
+ * OPTIONAL/additive like `approvedPolicyDigest`: receipts sealed before
+ * scoped runs existed omit it and are read as `full` (that is exactly
+ * what the old seal process certified).
+ */
+export const ReceiptScopeSchema = z.enum(['full', 'changed']);
+/** The final verdict summary the receipt seals. */
+export const ReceiptVerdictSummarySchema = z
+    .object({
+    /** Number of obligations evaluated. */
+    total: z.number().int().min(0),
+    /** Obligations graded `satisfied`. */
+    satisfied: z.number().int().min(0),
+    /** Obligations graded `waived` (legacy/reporting; not strict proof). */
+    waived: z.number().int().min(0),
+    /** Blocking obligations + blocking entries (must be 0 for issuance). */
+    blocking: z.number().int().min(0),
+})
+    .strict()
+    .superRefine((summary, ctx) => {
+    if (summary.satisfied + summary.waived > summary.total) {
+        ctx.addIssue({
+            code: 'custom',
+            message: 'satisfied + waived cannot exceed total obligations',
+        });
+    }
+});
+/**
+ * The gate receipt. Unsigned fields first, `mac` last; the signed body is
+ * exactly `{domain, receiptVersion, ...everything except mac}`.
+ */
+export const GateReceiptSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Envelope version; only `1` is produced or honored. */
+    receiptVersion: z.literal(1),
+    /** Receipt identity (UUID) — the `reused receipt <id>` surface value. */
+    receiptId: z.string().uuid(),
+    /** Run manifest identity of the sealed run. */
+    runId: z.string().uuid(),
+    /** Fresh trusted invocation identity of the sealed run. */
+    invocationId: z.string().uuid(),
+    /** 64-hex digest of the canonical input snapshot the run tested. */
+    inputDigest: z.string().regex(HEX64, 'inputDigest must be 64-char lowercase hex'),
+    /** Candidate HEAD sha, or null when unavailable (base identity). */
+    gitSha: z
+        .string()
+        .regex(/^[0-9a-f]{40}$/, 'gitSha must be a 40-char lowercase sha1 hex')
+        .nullable(),
+    /** Parent commit sha, or null when unavailable (parent identity). */
+    parentSha: z
+        .string()
+        .regex(/^[0-9a-f]{40}$/, 'parentSha must be a 40-char lowercase sha1 hex')
+        .nullable(),
+    /** 64-hex trusted policy/config revision digest (ADR 0005 D6). */
+    trustedPolicyDigest: z.string().regex(HEX64, 'trustedPolicyDigest must be 64-char lowercase hex'),
+    /**
+     * ADDITIVE v1 field: 64-hex digest of the OWNER-APPROVED policy
+     * revision the sealing run was pinned to (from
+     * `GATEFORGE_APPROVED_POLICY_DIGEST` / `--approved-policy-digest` /
+     * a trusted config outside the candidate). OPTIONAL for backward
+     * compatibility: receipts sealed before a policy pin was provisioned
+     * omit it and remain verifiable without a pin; verification under a
+     * provisioned pin demands it and rejects a missing or different value
+     * as "policy revision changed after sealing" (fail closed).
+     */
+    approvedPolicyDigest: z
+        .string()
+        .regex(HEX64, 'approvedPolicyDigest must be 64-char lowercase hex')
+        .optional(),
+    /**
+     * ADDITIVE v1 field: the evaluation scope the receipt seals. OPTIONAL
+     * for backward compatibility — absent reads as `full`, which is what
+     * the historical seal process (whole relevant suite, whole-repo clean
+     * gate) certified. See {@link ReceiptScopeSchema}.
+     */
+    scope: ReceiptScopeSchema.optional(),
+    /**
+     * ADDITIVE v1 field, `scope: 'changed'` receipts ONLY: the pin-#2
+     * fingerprints of the obligations the sealed slice covers (sorted,
+     * duplicate-free). Fingerprints — not obligation ids — because they
+     * are the SAME identity the baseline/waiver layers hash
+     * (`obligationFingerprint`), so every consumer joins covered sets
+     * through one hash and a policy/lifecycle change (which moves the
+     * fingerprint) cannot let an old receipt claim a reshaped obligation.
+     * A `full` receipt must NOT carry the field (it covers everything by
+     * definition); a `changed` receipt must (an empty slice seals
+     * nothing and is refused at planning, never receipted).
+     */
+    coveredObligationFingerprints: z.array(FingerprintHexSchema).optional(),
+    /** Normalized invocation that produced the receipt (e.g. `test-gates --changed`). */
+    invocation: z.string().min(1),
+    /** 64-hex selection digest (the expected test set, fixed pre-run). */
+    selectionDigest: z.string().regex(HEX64, 'selectionDigest must be 64-char lowercase hex'),
+    /** 64-hex digest of the catalog the selection was planned from. */
+    catalogDigest: z.string().regex(HEX64, 'catalogDigest must be 64-char lowercase hex'),
+    /** 64-hex digest of the supervision execution result (ADR 0005 D2). */
+    executionResultDigest: z.string().regex(HEX64, 'executionResultDigest must be 64-char lowercase hex'),
+    /**
+     * 64-hex digest of the v2 evidence attestation envelope sealed into
+     * the receipt, or null when the run carried none (such a run can only
+     * be clean when no evidence was required).
+     */
+    evidenceAttestationDigest: z.string().regex(HEX64, 'evidenceAttestationDigest must be 64-char lowercase hex').nullable(),
+    /** Final verdict summary (blocking must have been 0 at issuance). */
+    verdictSummary: ReceiptVerdictSummarySchema,
+    /** Issuance instant (ISO-8601). */
+    issuedAt: z.string().datetime(),
+    /** HMAC-SHA256 over the receipt body, domain `gateforge.receipt.v1`. */
+    mac: z.string().regex(HEX64, 'mac must be a 64-char lowercase hex HMAC'),
+})
+    .strict()
+    .superRefine((receipt, ctx) => {
+    // Scope/coverage coherence (fail closed): the covered set exists only
+    // for changed-scope receipts, and a changed-scope receipt without one
+    // would claim authority over an unnamed slice. Ordering/duplication
+    // are enforced so the canonical signed bytes are deterministic.
+    if (receipt.scope === 'changed') {
+        const covered = receipt.coveredObligationFingerprints;
+        if (covered === undefined || covered.length === 0) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['coveredObligationFingerprints'],
+                message: "a 'changed'-scope receipt must carry its coveredObligationFingerprints",
+            });
+            return;
+        }
+        const sorted = [...covered].sort();
+        for (let index = 0; index < covered.length; index += 1) {
+            const current = covered[index];
+            const expected = sorted[index];
+            if (current !== expected) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['coveredObligationFingerprints', index],
+                    message: "coveredObligationFingerprints must be sorted; expected '" + expected +
+                        "' at index " + index + ", got '" + current + "'",
+                });
+                return;
+            }
+            if (index > 0 && current === covered[index - 1]) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['coveredObligationFingerprints', index],
+                    message: `duplicate covered fingerprint '${current}'`,
+                });
+                return;
+            }
+        }
+        return;
+    }
+    if (receipt.coveredObligationFingerprints !== undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['coveredObligationFingerprints'],
+            message: "only a 'changed'-scope receipt may carry coveredObligationFingerprints",
+        });
+    }
+});
+//# sourceMappingURL=gate-receipt.js.map

package/dist/schemas/gate-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-receipt.js","sourceRoot":"","sources":["../../src/schemas/gate-receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,gDAAgD;AAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAK9D,mDAAmD;AACnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,uCAAuC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAML;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,yDAAyD;IACzD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5B,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,+CAA+C;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,oEAAoE;IACpE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,2CAA2C,CAAC;IACjF,oEAAoE;IACpE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SACtE,QAAQ,EAAE;IACb,qEAAqE;IACrE,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,gDAAgD,CAAC;SACzE,QAAQ,EAAE;IACb,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,mDAAmD,CAAC;IACjG;;;;;;;;;OASG;IACH,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,KAAK,CAAC,KAAK,EAAE,oDAAoD,CAAC;SAClE,QAAQ,EAAE;IACb;;;;;OAKG;IACH,KAAK,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;OAWG;IACH,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IACvE,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,sEAAsE;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,+CAA+C,CAAC;IACzF,mEAAmE;IACnE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,6CAA6C,CAAC;IACrF,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,qDAAqD,CAAC;IACrG;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC,QAAQ,EAAE;IACxH,qEAAqE;IACrE,cAAc,EAAE,2BAA2B;IAC3C,mCAAmC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wEAAwE;IACxE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,0CAA0C,CAAC;CACzE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,gEAAgE;IAChE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,6BAA6B,CAAC;QACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,+BAA+B,CAAC;gBACvC,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,+BAA+B,EAAE,KAAK,CAAC;oBAC9C,OAAO,EACL,0DAA0D,GAAG,QAAQ;wBACrE,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,GAAG;iBACpD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,+BAA+B,EAAE,KAAK,CAAC;oBAC9C,OAAO,EAAE,kCAAkC,OAAO,GAAG;iBACtD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,6BAA6B,KAAK,SAAS,EAAE,CAAC;QACxD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,+BAA+B,CAAC;YACvC,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Barrel for all gateforge artifact schemas (zod) and their inferred
+ * types. This barrel plus `src/index.ts` form the frozen public surface.
+ */
+export * from './common.js';
+export * from './resource.js';
+export * from './classification.js';
+export * from './policy.js';
+export * from './obligation.js';
+export * from './claim.js';
+export * from './evidence.js';
+export * from './waiver.js';
+export * from './baseline.js';
+export * from './run-manifest.js';
+export * from './verdict.js';
+export * from './coverage-policy.js';
+export * from './test-catalog.js';
+export * from './runner-adapter.js';
+export * from './plugin.js';
+export * from './execution-result.js';
+export * from './gate-receipt.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,22 @@
+/**
+ * Barrel for all gateforge artifact schemas (zod) and their inferred
+ * types. This barrel plus `src/index.ts` form the frozen public surface.
+ */
+export * from './common.js';
+export * from './resource.js';
+export * from './classification.js';
+export * from './policy.js';
+export * from './obligation.js';
+export * from './claim.js';
+export * from './evidence.js';
+export * from './waiver.js';
+export * from './baseline.js';
+export * from './run-manifest.js';
+export * from './verdict.js';
+export * from './coverage-policy.js';
+export * from './test-catalog.js';
+export * from './runner-adapter.js';
+export * from './plugin.js';
+export * from './execution-result.js';
+export * from './gate-receipt.js';
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}

package/dist/schemas/obligation.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Obligation schema (plan §4.5): a concrete test requirement generated
+ * from a resource and a policy. Obligation ids are
+ * `<resourceId>:<contract>` (e.g. `tenant.accounts:crud:update`) and the
+ * fingerprint over their identity is what baselines store (pin #2).
+ *
+ * Id grammar: the id splits at the FIRST colon — `resourceId` never
+ * contains a colon, `contract` may (e.g. `crud:update`).
+ */
+import { z } from 'zod';
+/**
+ * The obligation artifact. `lifecycle` carries the classification
+ * lifecycle attributes relevant to this obligation — it is part of the
+ * fingerprint identity (pin #2), so it must travel with the obligation.
+ */
+export declare const ObligationSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    id: z.ZodString;
+    resourceId: z.ZodString;
+    contract: z.ZodString;
+    policyId: z.ZodString;
+    lifecycle: z.ZodObject<{
+        create: z.ZodBoolean;
+        read: z.ZodBoolean;
+        update: z.ZodBoolean;
+        delete: z.ZodBoolean;
+        deleteSemantics: z.ZodOptional<z.ZodEnum<{
+            hard: "hard";
+            archive: "archive";
+        }>>;
+        archiveFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        updateableFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Inferred obligation shape. */
+export type Obligation = z.infer<typeof ObligationSchema>;
+//# sourceMappingURL=obligation.d.ts.map

package/dist/schemas/obligation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligation.d.ts","sourceRoot":"","sources":["../../src/schemas/obligation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;kBA2BzB,CAAC;AAEL,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}