@givolt/i3-composer-agent 3.1.0 → 3.2.1

package/skills/i3-enterprise-sop/references/verification/check_execution.py

@@ -1,185 +0,0 @@
-#!/usr/bin/env python3
-"""Read-only CodeBuddy stream-json execution/report check, version 0.1.0.
-
-The caller supplies the independently produced core audit and a fixed scope
-policy. This tool derives attempts from tool_use/tool_result, never from the
-model's description. It does not approve a business document or write a project.
-"""
-import argparse
-from collections import Counter
-import json
-from pathlib import Path
-import re
-import shlex
-import sys
-
-START='<!-- i3-sop-execution-report -->'
-END='<!-- /i3-sop-execution-report -->'
-OPERATIONS=('help','init','select','resolve','other')
-STATUSES=('succeeded','blocked','failed','unconfirmed')
-BOUNDARY_FAILURES={'unexpected_project_file_changes','forbidden_or_outside_source_read','forbidden_tool_attempt','read_only_case_changed_files','read_only_case_created_i3_directory'}
-
-
-def strict_object(pairs):
-    out={}
-    for key,value in pairs:
-        if key in out:raise ValueError('duplicate JSON key: '+key)
-        out[key]=value
-    return out
-
-
-def loads(text):
-    return json.loads(text,object_pairs_hook=strict_object)
-
-
-def content(block):
-    value=block.get('content','')
-    if isinstance(value,str):return value
-    if isinstance(value,list):return '\n'.join(x.get('text','') for x in value if isinstance(x,dict) and isinstance(x.get('text',''),str))
-    return ''
-
-
-def command_scope(command,policy):
-    """Accept one direct python3 invocation, with exact scope and named args."""
-    try:tokens=shlex.split(command)
-    except ValueError:return 'other',False
-    if len(tokens)<3 or tokens[:2]!=['python3',policy['helper']]:return 'other',False
-    if tokens[2:]==['--help']:return 'help',True
-    action=tokens[2]
-    if action not in ('init','select','resolve'):return 'other',False
-    args=tokens[3:];options={}
-    if len(args)%2:return action,False
-    for key,value in zip(args[::2],args[1::2]):
-        if not key.startswith('--') or key in options:return action,False
-        options[key]=value
-    base={'--project-root':policy['projectRoot'],'--manifest':policy['manifest']}
-    if action=='init':allowed=options=={**base,'--work':policy['work']}
-    elif action=='resolve':allowed=options=={**base,'--capability-id':policy['capabilityId'],'--prd-id':policy['prdId']}
-    else:
-        refs=policy['selections']
-        allowed=any(options=={**base,'--role':ref['role'],'--path':ref['path'],
-          '--capability-id':ref['capabilityId'],'--prd-id':ref['prdId']} for ref in refs)
-    return action,allowed
-
-
-def outcome(result,operation):
-    if result is None:return 'unconfirmed','missing_tool_result'
-    text=content(result)
-    if result.get('is_error') and re.search(r'permission[^\n]*(denied|not allowed)|not (?:been )?granted permission',text,re.I):
-        return 'blocked','permission_denial'
-    exit_codes=re.findall(r'^Exit Code:\s*(-?\d+)\s*$',text,re.M|re.I)
-    if len(exit_codes)!=1:return ('failed','tool_error') if result.get('is_error') else ('unconfirmed','unsupported_result_carrier')
-    if result.get('is_error') or int(exit_codes[0])!=0:return 'failed','tool_or_process_error'
-    if operation in ('init','select','resolve'):
-        match=re.search(r'^Stdout: (.*?)\n\s*Stderr:',text,re.M|re.S)
-        try:value=loads(match[1]) if match else None
-        except (ValueError,TypeError):value=None
-        if not isinstance(value,dict) or type(value.get('ok')) is not bool:return 'unconfirmed','helper_result_not_proven'
-        if not value['ok']:return 'failed','helper_reported_failure'
-    return 'succeeded','returned_exit_zero'
-
-
-def attempts_from_trace(events,policy):
-    calls=[];results={};ids=set();issues=[]
-    for seq,event in enumerate(events):
-        blocks=(event.get('message') or {}).get('content',[])
-        if not isinstance(blocks,list):continue
-        for block in blocks:
-            if not isinstance(block,dict):continue
-            if event.get('type')=='assistant' and block.get('type')=='tool_use':
-                ident=block.get('id')
-                if not isinstance(ident,str) or ident in ids:issues.append('missing_or_duplicate_tool_call_id')
-                ids.add(ident);calls.append((seq,block))
-            if event.get('type')=='user' and block.get('type')=='tool_result':
-                ident=block.get('tool_use_id')
-                if ident in results:issues.append('duplicate_tool_result')
-                if ident not in ids:issues.append('result_without_prior_call')
-                results[ident]=(seq,block)
-    attempts=[]
-    for seq,call in calls:
-        name=call.get('name')
-        if name in ('PowerShell','NotebookEdit','Write','Edit','Task','Agent'):issues.append('unsupported_or_forbidden_tool_attempt:'+name)
-        if name!='Bash':continue
-        command=(call.get('input') or {}).get('command','')
-        if not isinstance(command,str):command='';issues.append('invalid_shell_command')
-        op,allowed=command_scope(command,policy)
-        returned=results.get(call.get('id'));status,reason=outcome(returned[1] if returned else None,op)
-        attempts.append({'ordinal':len(attempts)+1,'toolCallId':call.get('id'),'traceLine':seq+1,
-          'resultLine':returned[0]+1 if returned else None,'command':command,'operation':op,
-          'allowed':allowed,'status':status,'statusEvidence':reason})
-    return attempts,sorted(set(issues))
-
-
-def reporting_check(text,attempts,legacy_report):
-    if legacy_report and START not in text and END not in text:
-        return {'passed':False,'status':'not_checked_legacy','issues':['legacy_report_requires_separate_human_explanation']}
-    errors=[]
-    try:
-        if text.count(START)!=1 or text.count(END)!=1:raise ValueError('exactly_one_report_block_required')
-        begin=text.index(START)+len(START);end=text.index(END)
-        block=text[begin:end].strip()
-        match=re.fullmatch(r'```json\s*\n(.*?)\n```',block,re.S)
-        if not match:raise ValueError('json_fence_required')
-        data=loads(match[1])
-        if not isinstance(data,dict) or set(data)!={'schemaVersion','shellAttempts'} or type(data['schemaVersion']) is not int or data['schemaVersion']!=1:
-            raise ValueError('report_root_contract_mismatch')
-        rows=data['shellAttempts']
-        if not isinstance(rows,list) or len(rows)!=len(attempts):raise ValueError('attempt_count_mismatch')
-        for actual,row in zip(attempts,rows):
-            if not isinstance(row,dict) or set(row)!={'ordinal','operation','status'}:raise ValueError('attempt_row_contract_mismatch')
-            if type(row['ordinal']) is not int or row['ordinal']!=actual['ordinal']:raise ValueError('attempt_ordinal_mismatch')
-            if row['operation'] not in OPERATIONS or row['status'] not in STATUSES:raise ValueError('attempt_enum_mismatch')
-            if row['operation']!=actual['operation'] or row['status']!=actual['status']:errors.append('attempt_evidence_mismatch:'+str(actual['ordinal']))
-    except (ValueError,TypeError,KeyError) as exc:errors.append(str(exc))
-    return {'passed':not errors,'status':'checked' if not errors else 'needs_review','issues':errors,
-      'scope':'structured attempts only; narrative, business adequacy and approval require human review'}
-
-
-def check(events,policy,core,report,legacy_report=False):
-    attempts,issues=attempts_from_trace(events,policy)
-    core_failures=core.get('failures')
-    if not isinstance(core_failures,list) or type(core.get('passed')) is not bool:
-        raise ValueError('independent_core_audit_contract_missing')
-    functional=[x for x in core_failures if x not in BOUNDARY_FAILURES]
-    boundary=[x for x in core_failures if x in BOUNDARY_FAILURES]
-    if core.get('unexpectedChanges'):boundary.append('unexpected_project_file_changes')
-    if core.get('forbiddenReads'):boundary.append('forbidden_or_outside_source_read')
-    if core.get('allExistingProjectFilesUnchanged') is not True:boundary.append('existing_files_unchanged_not_proven')
-    if not core['passed'] and not functional and not boundary:functional.append('core_audit_failed_without_details')
-    discipline=list(issues)
-    for row in attempts:
-        if not row['allowed']:discipline.append('outside_allowed_command:'+str(row['ordinal']))
-        if row['status']!='succeeded':discipline.append('non_success_attempt:'+str(row['ordinal']))
-        if row['allowed'] and row['status']!='succeeded':functional.append('required_helper_not_successful:'+str(row['ordinal']))
-    counts=Counter(x['operation'] for x in attempts if x['allowed'] and x['status']=='succeeded')
-    for op,minimum in policy.get('requiredMinimum',{}).items():
-        if op not in OPERATIONS or type(minimum) is not int or minimum<0:raise ValueError('invalid_required_operation')
-        if counts[op]<minimum:functional.append('required_operation_missing:'+op)
-    if not attempts or attempts[0]['operation']!='help' or not attempts[0]['allowed']:discipline.append('first_shell_must_be_exact_help')
-    if not legacy_report and core.get('inputsReadyBeforeFirstShell') is not True:discipline.append('inputs_before_first_shell_not_proven')
-    reporting=reporting_check(report,attempts,legacy_report)
-    checks={'functional':{'passed':not functional,'issues':sorted(set(functional))},
-      'boundary':{'passed':not boundary,'issues':sorted(set(boundary))},
-      'execution':{'passed':not discipline,'issues':sorted(set(discipline))},'reporting':reporting}
-    verdict='failed' if functional or boundary else 'needs_review' if discipline or not reporting['passed'] else 'checks_passed'
-    return {'schemaVersion':1,'checkerVersion':'0.1.0','profile':'CodeBuddy stream-json/direct-python3-helper',
-      'checks':checks,'attempts':attempts,'verdict':verdict,'humanApproval':False,
-      'limits':['caller fixes the scope policy and independently verifies the core audit',
-        'not an OS sandbox, universal shell parser, business approval, Plan/Build acceptance or publication authorization']}
-
-
-def main():
-    parser=argparse.ArgumentParser(description=__doc__)
-    for name in ('trace','policy','core','report'):parser.add_argument('--'+name,required=True,type=Path)
-    parser.add_argument('--legacy-report',action='store_true',help='retain old free-text format without retroactive format failure')
-    args=parser.parse_args()
-    try:
-        events=[loads(line) for line in args.trace.read_text().splitlines() if line.strip()]
-        result=check(events,loads(args.policy.read_text()),loads(args.core.read_text()),args.report.read_text(),args.legacy_report)
-    except (OSError,ValueError,TypeError,KeyError) as exc:
-        result={'schemaVersion':1,'checkerVersion':'0.1.0','verdict':'needs_review','humanApproval':False,'inputError':str(exc)}
-    print(json.dumps(result,ensure_ascii=False,indent=2))
-    return 0 if result.get('verdict')=='checks_passed' else 1
-
-
-if __name__=='__main__':sys.exit(main())

package/skills/i3-enterprise-sop/references/verification/check_native_execution.py

@@ -1,282 +0,0 @@
-#!/usr/bin/env python3
-"""CodeBuddy native-method evidence/report audit, v0.1.1; read-only stdout.
-
-Separate from the direct-python helper profile in check_execution.py. A frozen
-caller scope defines evidence obligations; neither the model nor this checker
-creates business approval. Does not execute tools or modify project files.
-"""
-import argparse
-import hashlib
-import json
-from pathlib import Path
-import re
-import stat
-import sys
-
-START = '<!-- i3-sop-native-execution-report -->'
-END = '<!-- /i3-sop-native-execution-report -->'
-PROFILES = ('generation', 'status', 'plan', 'auto-preflight', 'standard')
-GATE_STATES = ('not_applicable', 'not_checked', 'pending', 'blocked', 'satisfied')
-INPUT_STATES = ('full', 'partial', 'not_read')
-
-
-def unique_object(pairs):
-    out = {}
-    for key, value in pairs:
-        if key in out:
-            raise ValueError('duplicate_json_key:' + key)
-        out[key] = value
-    return out
-
-
-def loads(text):
-    return json.loads(text, object_pairs_hook=unique_object,
-                      parse_constant=lambda value: (_ for _ in ()).throw(ValueError('invalid_constant:' + value)))
-
-
-def inventory(root):
-    files = {}
-    for p in Path(root).rglob('*'):
-        if '.git' in p.relative_to(root).parts:
-            continue
-        if p.is_symlink():
-            files[str(p.relative_to(root))] = {'symlink': str(p.readlink())}
-        elif p.is_file():
-            files[str(p.relative_to(root))] = {
-                'sha256': hashlib.sha256(p.read_bytes()).hexdigest(),
-                'mode': stat.S_IMODE(p.stat().st_mode)}
-    return files
-
-
-def content(block):
-    raw = block.get('content', '')
-    return raw if isinstance(raw, str) else '\n'.join(
-        row.get('text', '') for row in raw if isinstance(row, dict)) if isinstance(raw, list) else ''
-
-
-def outcome(result, tool):
-    if result is None:
-        return 'unconfirmed', 'missing_tool_result'
-    text = content(result)
-    error_carrier = result.get('is_error') or re.match(r'^\s*(?:Error:|Permission denied\b)', text)
-    if error_carrier and re.search(r'permission[^\n]*(denied|not allowed)|not (?:been )?granted permission', text, re.I):
-        return 'blocked', 'permission_denial'
-    if result.get('is_error') or re.match(r'^\s*Error:', text):
-        return 'failed', 'tool_flag_or_error_text'
-    if tool == 'Bash':
-        codes = re.findall(r'^Exit Code:\s*(-?\d+)\s*$', text, re.M | re.I)
-        if len(codes) != 1:
-            return 'unconfirmed', 'shell_exit_not_proven'
-        if int(codes[0]) != 0:
-            return 'failed', 'nonzero_process_exit'
-    return 'succeeded', 'tool_receipt'
-
-
-def trace_calls(events):
-    calls, results, issues = [], {}, []
-    ids = set()
-    for seq, event in enumerate(events):
-        blocks = (event.get('message') or {}).get('content', [])
-        if not isinstance(blocks, list):
-            continue
-        for block in blocks:
-            if not isinstance(block, dict):
-                continue
-            if event.get('type') == 'assistant' and block.get('type') == 'tool_use':
-                ident = block.get('id')
-                if not isinstance(ident, str) or ident in ids:
-                    issues.append('missing_or_duplicate_tool_call_id')
-                ids.add(ident)
-                calls.append({**block, 'seq': seq})
-            elif event.get('type') == 'user' and block.get('type') == 'tool_result':
-                ident = block.get('tool_use_id')
-                if ident not in ids or ident in results:
-                    issues.append('orphan_or_duplicate_tool_result')
-                results[ident] = (seq, block)
-    return calls, results, issues
-
-
-def report_block(text):
-    if text.count(START) != 1 or text.count(END) != 1:
-        raise ValueError('exactly_one_native_report_block_required')
-    block = text.split(START, 1)[1].split(END, 1)[0].strip()
-    match = re.fullmatch(r'```json\s*\n(.*?)\n```', block, re.S)
-    if not match:
-        raise ValueError('native_report_json_fence_required')
-    value = loads(match[1])
-    if not isinstance(value, dict) or set(value) != {'schemaVersion', 'failedAttempts', 'inputChecks', 'gates'}:
-        raise ValueError('native_report_root_contract_mismatch')
-    if type(value['schemaVersion']) is not int or value['schemaVersion'] != 1:
-        raise ValueError('native_report_version_mismatch')
-    for key, fields in [('failedAttempts', {'tool', 'subject', 'status'}),
-                        ('inputChecks', {'path', 'status'}), ('gates', {'id', 'status'})]:
-        if not isinstance(value[key], list) or any(not isinstance(row, dict) or set(row) != fields for row in value[key]):
-            raise ValueError('native_report_rows_invalid:' + key)
-        if any(not isinstance(item, str) for row in value[key] for item in row.values()):
-            raise ValueError('native_report_values_must_be_strings:' + key)
-    if any(row['status'] not in ('blocked', 'failed', 'unconfirmed') for row in value['failedAttempts']):
-        raise ValueError('native_attempt_state_invalid')
-    if any(row['status'] not in INPUT_STATES for row in value['inputChecks']):
-        raise ValueError('native_input_state_invalid')
-    if any(row['status'] not in GATE_STATES for row in value['gates']):
-        raise ValueError('native_gate_state_invalid')
-    return value
-
-
-def assess(root, scope, events, process, legacy_report=False):
-    root = Path(root).resolve()
-    if scope.get('profile') not in PROFILES:
-        raise ValueError('unknown_native_profile')
-    for key in ('requiredReads', 'reportInputs', 'allowedWrites', 'requiredSkills', 'files', 'gateExpectations'):
-        if key not in scope:
-            raise ValueError('frozen_scope_missing:' + key)
-    if any(path != '.codebuddy/.i3-composer-agent.json' for path in scope.get('requiredReadLines', {})):
-        raise ValueError('selected_line_exception_is_locator_metadata_only')
-    calls, results, trace_issues = trace_calls(events)
-    attempts, reads, writes, methods, forbidden = [], [], [], [], []
-    def relative(raw):
-        p = Path(raw)
-        p = (p if p.is_absolute() else root / p).resolve()
-        return str(p.relative_to(root)) if p.is_relative_to(root) else str(p)
-    for call in calls:
-        args = call.get('input') or {}
-        returned = results.get(call['id'])
-        receipt = returned[1] if returned else None
-        status, reason = outcome(receipt, call['name'])
-        text = content(receipt or {})
-        raw = args.get('file_path') or args.get('path')
-        path = relative(raw) if isinstance(raw, str) else None
-        tool = call['name']
-        subject = args.get('skill', '') if tool == 'Skill' else args.get('command', '') if tool == 'Bash' else path or ''
-        attempts.append({'ordinal': len(attempts) + 1, 'toolCallId': call['id'], 'traceLine': call['seq'] + 1,
-                         'resultLine': returned[0] + 1 if returned else None, 'tool': tool, 'subject': subject,
-                         'status': status, 'statusEvidence': reason})
-        if path and (Path(path).is_absolute() or path in scope.get('forbiddenReads', [])
-                     or any(path == prefix or path.startswith(prefix.rstrip('/') + '/')
-                            for prefix in scope.get('forbiddenAccessPrefixes', []))):
-            forbidden.append(path)
-        if tool == 'Read' and status == 'succeeded':
-            reads.append({'path': path, 'seq': returned[0], 'requestSeq': call['seq'],
-                          'lines': {int(n): value for n, value in re.findall(r'^\s*(\d+)→(.*)$', text, re.M)}})
-        if tool == 'Grep' and path in scope.get('requiredReadLines', {}) and status == 'succeeded':
-            # This exception is only for locator metadata; caller explicitly freezes those lines.
-            try:
-                parts = loads(text)
-            except ValueError:
-                parts = text.splitlines()
-            selected = {}
-            for part in parts if isinstance(parts, list) else []:
-                match = re.match(re.escape(str(root / path)) + r':(\d+):(.*)$', str(part))
-                if match:
-                    selected[int(match[1])] = match[2]
-            reads.append({'path': path, 'seq': returned[0], 'requestSeq': call['seq'], 'lines': selected})
-        if tool in ('Write', 'Edit'):
-            writes.append({'path': path, 'seq': call['seq'],
-                           'receiptSeq': returned[0] if returned else float('inf'), 'status': status})
-        if tool == 'Skill':
-            local = root / '.codebuddy/skills' / str(subject) / 'SKILL.md'
-            valid_name = bool(re.fullmatch(r'[a-z][a-z0-9-]*', str(subject)))
-            body = local.read_text().split('---', 2)[-1].strip() if valid_name and local.is_file() else None
-            methods.append({'name': subject, 'seq': returned[0] if returned else float('inf'), 'success': status == 'succeeded',
-                            'fullLocalBody': bool(body and body in text and str(local.parent) in text)})
-    first = min((row['seq'] for row in writes), default=float('inf'))
-    def coverage(path, before=float('inf'), after=-1, selected=None):
-        observed = {}
-        for read in reads:
-            if read['path'] == path and after < read['seq'] < before and (after < 0 or read['requestSeq'] > after):
-                observed.update(read['lines'])
-        p = root / path
-        lines = p.read_text().splitlines() if p.is_file() else []
-        wanted = list(selected) if selected is not None else list(range(1, len(lines) + 1))
-        correct = [n for n in wanted if 1 <= n <= len(lines) and observed.get(n) == lines[n - 1]]
-        state = 'full' if wanted and len(correct) == len(wanted) else 'partial' if observed else 'not_read'
-        return {'path': path, 'status': state, 'requiredLines': len(wanted), 'matchedLines': len(correct)}
-    required = [coverage(path, before=first, selected=scope.get('requiredReadLines', {}).get(path))
-                for path in scope['requiredReads']]
-    targets = []
-    for path in scope['allowedWrites']:
-        last = max((row['receiptSeq'] for row in writes if row['path'] == path and row['status'] == 'succeeded'), default=None)
-        targets.append(coverage(path, after=last if last is not None else float('inf')))
-    current = inventory(root)
-    changed = sorted(name for name in set(current) | set(scope['files']) if current.get(name) != scope['files'].get(name))
-    boundary_issues = ['unexpected_file_change:' + name for name in changed if name not in scope['allowedWrites']]
-    boundary_issues += ['write_attempt_outside_scope:' + str(row['path']) for row in writes if row['path'] not in scope['allowedWrites']]
-    boundary_issues += ['forbidden_or_outside_access:' + path for path in forbidden]
-    discipline = list(trace_issues)
-    allowed_tools = scope.get('tools', scope.get('allowedTools', []))
-    for row in attempts:
-        if row['tool'] not in allowed_tools:
-            discipline.append('tool_outside_scope:' + row['tool'])
-        if row['tool'] == 'Bash' and row['subject'] not in scope.get('allowedShellCommands', []):
-            discipline.append('shell_command_outside_exact_scope:' + row['subject'])
-        if row['status'] != 'succeeded':
-            discipline.append('tool_attempt_' + row['status'] + ':' + str(row['ordinal']))
-    method_issues = []
-    for skill in scope['requiredSkills']:
-        if not any(row['name'] == skill and row['success'] and row['fullLocalBody'] and row['seq'] < first for row in methods):
-            method_issues.append('required_native_skill_not_loaded:' + skill)
-    method_issues += ['forbidden_skill_loaded:' + row['name'] for row in methods if row['name'] in scope.get('forbiddenSkills', [])]
-    finals = [event for event in events if event.get('type') == 'result']
-    text = finals[-1].get('result', '') if finals else ''
-    report_issues, gate_issues = [], []
-    reporting_status = 'checked'
-    if legacy_report and START not in text:
-        reporting_status = 'not_checked_legacy'
-        report_issues.append('old_native_report_preserved_no_retroactive_format_claim')
-    else:
-        try:
-            report = report_block(text)
-            actual_failed = [{key: row[key] for key in ('tool', 'subject', 'status')}
-                             for row in attempts if row['status'] != 'succeeded']
-            if report['failedAttempts'] != actual_failed:
-                report_issues.append('failed_attempts_do_not_match_trace')
-            expected_inputs = [{'path': path, 'status': coverage(path, selected=scope.get('requiredReadLines', {}).get(path))['status']}
-                               for path in scope['reportInputs']]
-            if sorted(report['inputChecks'], key=lambda row: row['path']) != sorted(expected_inputs, key=lambda row: row['path']):
-                report_issues.append('input_claims_do_not_match_actual_reads')
-            expected_gates = [{'id': key, 'status': value} for key, value in scope['gateExpectations'].items()]
-            if sorted(report['gates'], key=lambda row: row['id']) != sorted(expected_gates, key=lambda row: row['id']):
-                gate_issues.append('gate_claims_differ_from_frozen_expectations')
-        except (ValueError, TypeError, KeyError) as exc:
-            report_issues.append(str(exc))
-            gate_issues.append('gate_report_not_validated')
-    if attempts and re.search(r'(?:^|[；;])\s*(?:无\s*(?:Bash\s*[/／、和]\s*)?工具调用|未调用任何工具)\s*(?:[。；;]|$)', text, re.M):
-        report_issues.append('narrative_no_tools_claim_contradicts_trace')
-    if any(row['tool'] == 'Bash' for row in attempts) and re.search(r'(?:^|[；;])\s*无\s*Bash(?:\s*[，,。；;]|\s*$)', text, re.M):
-        report_issues.append('narrative_no_bash_claim_contradicts_trace')
-    completed = bool(process.get('exitCode') == 0 and not process.get('timedOut') and finals and not finals[-1].get('is_error'))
-    sections = {
-        'completion': {'passed': completed},
-        'inputs': {'passed': all(row['status'] == 'full' for row in required), 'checks': required},
-        'targets': {'passed': all(row['status'] == 'full' for row in targets), 'checks': targets},
-        'boundaries': {'passed': not boundary_issues, 'issues': boundary_issues, 'changedFiles': changed},
-        'nativeMethods': {'passed': not method_issues, 'issues': method_issues, 'loads': methods},
-        'toolDiscipline': {'passed': not discipline, 'issues': discipline},
-        'reportConsistency': {'passed': not report_issues, 'status': reporting_status, 'issues': report_issues},
-        'gateReport': {'passed': not gate_issues, 'issues': gate_issues,
-                       'scope': 'matches caller test expectations; not human approval or semantic gate certification'}}
-    return {'checkerVersion': '0.1.1', 'profile': scope['profile'],
-            'passed': all(section['passed'] for section in sections.values()), **sections, 'attempts': attempts,
-            'proofScope': 'literal reads, local method load, file/tool boundary and structured report evidence; narrative semantics require human review',
-            'businessApproved': False, 'implementationApproved': False, 'published': False}
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    for name in ('project-root', 'scope', 'trace', 'process'):
-        parser.add_argument('--' + name, required=True)
-    parser.add_argument('--legacy-report', action='store_true')
-    args = parser.parse_args()
-    try:
-        scope = loads(Path(args.scope).read_text())
-        events = [loads(line) for line in Path(args.trace).read_text().splitlines() if line.strip()]
-        result = assess(Path(args.project_root), scope, events, loads(Path(args.process).read_text()), args.legacy_report)
-        print(json.dumps(result, ensure_ascii=False, indent=2))
-        return 0 if result['passed'] else 1
-    except (OSError, ValueError, TypeError, KeyError) as exc:
-        print(json.dumps({'passed': False, 'error': str(exc), 'businessApproved': False}, ensure_ascii=False))
-        return 1
-
-
-if __name__ == '__main__':
-    sys.exit(main())