@haposoft/cafekit 0.16.0-rc.4 → 0.16.0-rc.5

package/bin/__tests__/codex-hooks.test.js

@@ -128,7 +128,7 @@ function inHookFixture(run, options = {}) {
   }
 }
 
-test('Codex privacy approval is exact, session-bound, and one-time', () => {
+test('Codex privacy approval is exact, session-bound, and reusable within its window', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
     fs.mkdirSync(nested, { recursive: true });
@@ -173,31 +173,36 @@ test('Codex privacy approval is exact, session-bound, and one-time', () => {
     });
     assert.match(wrongSession.stdout, /rejected/);
 
+    // A pasted prompt carries the terminal's surrounding whitespace. The
+    // exactness that matters is the request id, not the padding.
     const padded = runHook(approve, nested, {
       cwd: nested,
       session_id: 'session-a',
       hook_event_name: 'UserPromptSubmit',
       prompt: ` ${prompt}\n`
     });
-    assert.equal(padded.stdout, '', 'whitespace-padded prompt must not issue a token');
-
-    const approved = runHook(approve, nested, {
-      cwd: nested,
-      session_id: 'session-a',
-      hook_event_name: 'UserPromptSubmit',
-      prompt
-    });
-    assert.match(approved.stdout, /approved one retry/);
+    assert.match(padded.stdout, /User approved/, 'whitespace padding must not void the approval');
 
+    // The grant now covers repeated access to the same paths, and is not bound
+    // to the tool that first tripped the gate.
     const allowedOnce = runHook(block, nested, request);
     assert.equal(allowedOnce.stdout, '');
 
-    const deniedAgain = runHook(block, nested, request);
-    assert.equal(JSON.parse(deniedAgain.stdout).hookSpecificOutput.permissionDecision, 'deny');
+    const allowedAgain = runHook(block, nested, request);
+    assert.equal(allowedAgain.stdout, '', 'one approval covers a re-read');
 
+    const allowedOtherTool = runHook(block, nested, {
+      ...request,
+      tool_name: 'exec_command'
+    });
+    assert.equal(allowedOtherTool.stdout, '', 'grant is not bound to a tool name');
+
+    // A fresh session, so the single-path grant above cannot mask the exact-set
+    // matching under test.
     fs.writeFileSync(path.join(nested, 'credentials.json'), '{"token":"test"}\n');
     const multiRequest = {
       ...request,
+      session_id: 'session-c',
       tool_input: { command: 'cat .env credentials.json' }
     };
     const multiDenied = runHook(block, nested, multiRequest);
@@ -210,31 +215,65 @@ test('Codex privacy approval is exact, session-bound, and one-time', () => {
 
     const multiApproved = runHook(approve, nested, {
       cwd: nested,
-      session_id: 'session-a',
+      session_id: 'session-c',
       hook_event_name: 'UserPromptSubmit',
       prompt: multiPrompt
     });
-    assert.match(multiApproved.stdout, /approved one retry/);
+    assert.match(multiApproved.stdout, /User approved/);
 
-    // A token for two paths cannot authorize a subset, and the failed subset
-    // attempt must not consume the exact-set token.
-    const subsetDenied = runHook(block, nested, request);
+    // A grant for two paths authorizes exactly that set: neither a subset nor a
+    // superset, in either order.
+    const subsetDenied = runHook(block, nested, { ...request, session_id: 'session-c' });
     assert.equal(JSON.parse(subsetDenied.stdout).hookSpecificOutput.permissionDecision, 'deny');
     fs.writeFileSync(path.join(nested, 'tokens.json'), '{"token":"test"}\n');
     const supersetDenied = runHook(block, nested, {
       ...request,
+      session_id: 'session-c',
       tool_input: { command: 'cat .env credentials.json tokens.json' }
     });
     assert.equal(JSON.parse(supersetDenied.stdout).hookSpecificOutput.permissionDecision, 'deny');
     const reordered = {
       ...request,
+      session_id: 'session-c',
       tool_input: { command: 'cat credentials.json .env' }
     };
     assert.equal(runHook(block, nested, reordered).stdout, '');
-    assert.equal(
-      JSON.parse(runHook(block, nested, multiRequest).stdout).hookSpecificOutput.permissionDecision,
-      'deny'
-    );
+    assert.equal(runHook(block, nested, multiRequest).stdout, '', 'the set stays granted');
+
+    // Session binding survives the change: another session sees no grant.
+    const otherSession = runHook(block, nested, { ...request, session_id: 'session-d' });
+    assert.equal(JSON.parse(otherSession.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});
+
+test('Codex privacy grant window is one hour and restarts at approval', () => {
+  inHookFixture((root, hooks) => {
+    const state = require(path.join(hooks, 'lib', 'privacy-state.cjs'));
+    const HOUR = 60 * 60 * 1000;
+    assert.equal(state.TTL_MS, HOUR, 'a five-minute window expired mid-conversation');
+
+    fs.writeFileSync(path.join(root, '.env'), 'SECRET=1\n');
+    const pending = state.createPending({
+      projectRoot: root,
+      sessionCwd: root,
+      sessionId: 'session-ttl',
+      filePaths: ['.env'],
+    });
+    assert.ok(pending.expiresAt - Date.now() > HOUR - 5000, 'pending must live an hour');
+
+    const approved = state.approvePending({
+      projectRoot: root,
+      sessionId: 'session-ttl',
+      requestId: pending.requestId,
+    });
+    assert.equal(approved.ok, true);
+
+    const stateDir = path.join(root, '.codex', 'hooks', '.privacy');
+    const tokenFile = fs.readdirSync(stateDir).find((name) => name.startsWith('token-'));
+    assert.ok(tokenFile, 'approval must write a grant');
+    const grant = JSON.parse(fs.readFileSync(path.join(stateDir, tokenFile), 'utf8'));
+    assert.ok(grant.expiresAt - Date.now() > HOUR - 5000, 'the grant window starts at approval');
+    assert.equal(grant.toolName, undefined, 'a grant is not bound to a tool name');
   });
 });
 
@@ -909,14 +948,14 @@ test('Codex adapter enforces declared task artifact SHA-256 with missing, invali
   }
 });
 
-test('Codex privacy denies obfuscated and session paths, allows benign', () => {
+test('Codex privacy denies obfuscated secret reads, allows benign and runtime state', () => {
   inHookFixture((root, hooks) => {
     const block = path.join(hooks, 'privacy-block.cjs');
     const denied = [
       { command: "cat .e''nv", tool: 'exec_command' },
-      { command: "cat .codex/sessions/test.json", tool: 'exec_command' },
-      { command: "cat $HOME/.cafekit/completion-authority/hmac.key", tool: 'exec_command' },
-      { command: "cat .codex/sessions/abc.json", tool: 'Bash' },
+      { command: 'cat ~/.cafekit/completion-authority/hmac.key', tool: 'exec_command' },
+      { command: 'cat ~/.ssh/id_rsa', tool: 'Bash' },
+      { command: 'docker compose --env-file .env up', tool: 'exec_command' },
       { command: "python3 -c \"open('.env').read()\"", tool: 'exec_command' },
       { command: "node -e \"fs.readFileSync('.env')\"", tool: 'Bash' },
       { command: "bash -c 'cat .e''nv'", tool: 'exec_command' },
@@ -926,10 +965,18 @@ test('Codex privacy denies obfuscated and session paths, allows benign', () => {
       const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
       assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', command);
     }
+    // Runtime state and transcripts are CafeKit's own bookkeeping, not secrets.
+    // Guarding them by substring also matched every source file and doc that
+    // merely spelled `sessions` or `session-state`, so the gate fired on the
+    // repo it was installed in. The one real secret there, hmac.key, is still
+    // covered above by the `.key` rule.
     const allowed = [
       { command: "echo hello", tool: 'exec_command' },
       { command: "cat README.md", tool: 'exec_command' },
       { command: "cat src/app.js", tool: 'Bash' },
+      { command: 'cat .codex/sessions/test.json', tool: 'exec_command' },
+      { command: 'cat .codex/session-state/latest.md', tool: 'Bash' },
+      { command: 'cat docs/sessions-guide.md', tool: 'exec_command' },
     ];
     for (const { command, tool } of allowed) {
       const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
@@ -938,45 +985,27 @@ test('Codex privacy denies obfuscated and session paths, allows benign', () => {
   });
 });
 
-test('Codex privacy denies active read expansion, preserves literal dollars and safe controls', () => {
+test('Codex privacy denies sensitive names it can resolve, allows pure indirection', () => {
   inHookFixture((root, hooks) => {
     const block = path.join(hooks, 'privacy-block.cjs');
     const denied = [
-      { command: "cat $FILE", tool: 'Bash' },
-      { command: 'cat "$FILE"', tool: 'exec_command' },
-      { command: "cat ${FILE}", tool: 'Bash' },
-      { command: "cat $1", tool: 'exec_command' },
-      { command: "cat $(echo .env)", tool: 'Bash' },
-      { command: "cat `echo .env`", tool: 'Bash' },
-      { command: "head $SECRET", tool: 'exec_command' },
-      { command: "tail ${MY_FILE}", tool: 'Bash' },
-      { command: "cat README.md $EXTRA", tool: 'Bash' },
-      { command: "head README.md $UNRELATED", tool: 'exec_command' },
-      { command: "echo ok; cat README.md $FILE", tool: 'Bash' },
-      { command: "cat README.md | head $FILE", tool: 'exec_command' },
-      { command: "bash -c 'cat $FILE'", tool: 'Bash' },
-      { command: "echo $(cat $FILE)", tool: 'exec_command' },
-      { command: 'cat README.md "$(printf safe)"', tool: 'Bash' },
-      { command: 'cat README.md *', tool: 'Bash' },
-      { command: 'cat README.md ~/README.md', tool: 'exec_command' },
-      { command: 'cat README.md {README.md,LICENSE}', tool: 'Bash' },
       { command: 'cat .e\\\nnv', tool: 'Bash' },
       { command: "cat $'\\x2e\\x65\\x6e\\x76'", tool: 'exec_command' },
-      { command: 'env -u UNUSED cat "$FILE"', tool: 'Bash' },
-      { command: 'timeout 1 cat "$FILE"', tool: 'exec_command' },
-      { command: 'nice -n 10 cat "$FILE"', tool: 'Bash' },
-      { command: "eval 'cat \"$FILE\"'", tool: 'exec_command' },
-      { command: "find . -exec sh -c 'cat \"$FILE\"' \\;", tool: 'Bash' },
-      { command: 'source "$FILE"', tool: 'exec_command' },
-      { command: 'xargs -a "$LIST" cat', tool: 'Bash' },
-      { command: 'python3 -c \'open(os.environ["FILE"]).read()\'', tool: 'exec_command' },
-      { command: 'node -e \'fs.readFileSync(process.env.FILE)\'', tool: 'Bash' },
-      { command: 'cat < "$FILE"', tool: 'exec_command' },
+      { command: 'cat .env*', tool: 'Bash' },
+      { command: 'cat certs/*.pem', tool: 'exec_command' },
+      { command: 'cat ~/.aws/credentials', tool: 'Bash' },
+      { command: 'ssh -i ~/.ssh/id_ed25519 host', tool: 'exec_command' },
+      { command: 'curl --config ~/.netrc https://example.com', tool: 'Bash' },
+      { command: 'kubectl --kubeconfig ~/.kube/kubeconfig get pods', tool: 'exec_command' },
+      { command: 'openssl rsa -in server.key', tool: 'Bash' },
     ];
     for (const { command, tool } of denied) {
       const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
       assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', `should deny ${command}`);
     }
+    // Accepted gap: the target of `$FILE` is unknowable without running the
+    // shell, and every denial here costs a round trip through a one-shot
+    // approval prompt. `less "$HOME/.env"` is the edge of that decision.
     const allowed = [
       { command: "echo $VAR", tool: 'exec_command' },
       { command: 'echo "$HOME"', tool: 'Bash' },
@@ -995,11 +1024,37 @@ test('Codex privacy denies active read expansion, preserves literal dollars and
       { command: 'echo not.env', tool: 'Bash' },
       { command: 'echo .env', tool: 'exec_command' },
       { command: "printf '%s\\n' .env", tool: 'Bash' },
+      { command: 'git log -- .env', tool: 'Bash' },
       { command: 'git status sessions.md', tool: 'exec_command' },
       { command: 'python3 -c "print(os.environ[\'HOME\'])"', tool: 'Bash' },
       { command: 'head -n "$COUNT" README.md', tool: 'exec_command' },
       { command: 'grep .env README.md', tool: 'Bash' },
       { command: "sed -n '/.env/p' README.md", tool: 'exec_command' },
+      { command: 'cat $FILE', tool: 'Bash' },
+      { command: 'cat "$FILE"', tool: 'exec_command' },
+      { command: 'cat ${FILE}', tool: 'Bash' },
+      { command: 'cat $1', tool: 'exec_command' },
+      { command: 'cat $(echo .env)', tool: 'Bash' },
+      { command: 'cat `echo .env`', tool: 'Bash' },
+      { command: 'head $SECRET', tool: 'exec_command' },
+      { command: 'tail ${MY_FILE}', tool: 'Bash' },
+      { command: 'less "$HOME/.env"', tool: 'Bash' },
+      { command: 'cat README.md $EXTRA', tool: 'Bash' },
+      { command: 'echo ok; cat README.md $FILE', tool: 'Bash' },
+      { command: 'cat README.md | head $FILE', tool: 'exec_command' },
+      { command: "bash -c 'cat $FILE'", tool: 'Bash' },
+      { command: 'cat README.md *', tool: 'Bash' },
+      { command: 'cat ~/.zshrc', tool: 'exec_command' },
+      { command: 'du -sh */', tool: 'Bash' },
+      { command: 'env -u UNUSED cat "$FILE"', tool: 'Bash' },
+      { command: 'timeout 1 cat "$FILE"', tool: 'exec_command' },
+      { command: "eval 'cat \"$FILE\"'", tool: 'exec_command' },
+      { command: "find . -exec sh -c 'cat \"$FILE\"' \\;", tool: 'Bash' },
+      { command: 'source "$FILE"', tool: 'exec_command' },
+      { command: 'xargs -a "$LIST" cat', tool: 'Bash' },
+      { command: 'python3 -c \'open(os.environ["FILE"]).read()\'', tool: 'exec_command' },
+      { command: 'node -e \'fs.readFileSync(process.env.FILE)\'', tool: 'Bash' },
+      { command: 'cat < "$FILE"', tool: 'exec_command' },
     ];
     for (const { command, tool } of allowed) {
       const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
@@ -1007,11 +1062,24 @@ test('Codex privacy denies active read expansion, preserves literal dollars and
     }
     const assignmentOnly = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat README.md' } });
     assert.equal(assignmentOnly.stdout, '');
-    const assignmentRead = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat "$FILE"' } });
+    const assignmentRead = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat .env' } });
     assert.equal(JSON.parse(assignmentRead.stdout).hookSpecificOutput.permissionDecision, 'deny');
   });
 });
 
+test('Codex privacy reads an inert heredoc body as prose, not shell', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const inert = "gh pr create --body \"$(cat <<'BODY'\nRun `cat .env` to inspect config\nBODY\n)\"";
+    const allowed = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: inert } });
+    assert.equal(allowed.stdout, '', 'quoted delimiter expands nothing');
+
+    const expanding = 'bash -c "cat <<BODY\n$(cat .env)\nBODY"';
+    const denied = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: expanding } });
+    assert.equal(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision, 'deny', 'unquoted delimiter expands');
+  });
+});
+
 test('Claude and Codex privacy lexers agree on literals, delimiters, and quote expansion', () => {
   inHookFixture((root, hooks) => {
     const claude = path.join(PACKAGE_ROOT, 'src/claude/hooks/privacy-block.cjs');
@@ -1019,8 +1087,8 @@ test('Claude and Codex privacy lexers agree on literals, delimiters, and quote e
     const vectors = [
       ["cat .e''nv", true],
       ["python3 -c \"open('.env').read()\"", true],
-      ['cat README.md $FILE', true],
-      ['echo ok; cat README.md $FILE', true],
+      ['cat README.md $FILE', false],
+      ['echo ok; cat README.md $FILE', false],
       ["cat '$FILE'", false],
       ["echo '$(cat $FILE)'", false],
       ["cat README.md '*'", false],
@@ -1030,13 +1098,17 @@ test('Claude and Codex privacy lexers agree on literals, delimiters, and quote e
       ['echo .envoy', false],
       ['cat .e\\\nnv', true],
       ["cat $'\\x2e\\x65\\x6e\\x76'", true],
-      ['env -u UNUSED cat "$FILE"', true],
-      ['timeout 1 cat "$FILE"', true],
-      ["eval 'cat \"$FILE\"'", true],
-      ["find . -exec sh -c 'cat \"$FILE\"' \\;", true],
-      ['source "$FILE"', true],
-      ['xargs -a "$LIST" cat', true],
-      ['python3 -c \'open(os.environ["FILE"]).read()\'', true],
+      ['env -u UNUSED cat "$FILE"', false],
+      ['timeout 1 cat "$FILE"', false],
+      ["eval 'cat \"$FILE\"'", false],
+      ["find . -exec sh -c 'cat \"$FILE\"' \\;", false],
+      ['source "$FILE"', false],
+      ['xargs -a "$LIST" cat', false],
+      ['python3 -c \'open(os.environ["FILE"]).read()\'', false],
+      ['cat ~/.ssh/id_rsa', true],
+      ['docker compose --env-file .env up', true],
+      ['cat ~/.zshrc', false],
+      ['git log -- .env', false],
       ['echo .env', false],
       ["printf '%s\\n' .env", false],
       ['git status sessions.md', false],

package/bin/__tests__/develop-contract.test.js

@@ -17,6 +17,7 @@ const VALIDATOR = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/validate-s
 const GROUNDER = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-ground.cjs'));
 const SEMANTIC_AUTHORITY = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/semantic-review-authority.cjs'));
 const READINESS = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-readiness.cjs'));
+const AUTHORING_VALIDATOR = path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-authoring-validation.cjs');
 const { copyClaudeTestRuntime } = require('./test-runtime-dependency-closure.cjs');
 const DEVELOP = path.join(PACKAGE_ROOT, 'src/claude/skills/develop/SKILL.md');
 const SPECS = path.join(PACKAGE_ROOT, 'src/claude/skills/specs/SKILL.md');
@@ -183,23 +184,38 @@ The result contains the literal deleted state.
 ## Verification Definitions
 - **V1**: Criteria R1.1; Owner A-D-01; Decision refs D1, I1, C1; Method command \`node --test test/entry.test.js\`; Expected exit 0 and the service reports deleted state; Negative/failure a missing record returns not-found without deleted state; Reachability/grounding entrypoint \`src/entry.js\` via A-D-01.
 `);
-  const spec = JSON.parse(fs.readFileSync(specPath, 'utf8'));
-  spec.authoring.requirements = 'validated';
-  spec.authoring.design = 'validated';
-  fs.writeFileSync(specPath, `${JSON.stringify(spec, null, 2)}\n`);
+  const semantic = runNode(root, SCAFFOLD, ['ordinary', '--sync-semantic-model']);
+  assert.equal(semantic.status, 0, commandOutput(semantic));
+  const authoring = runNode(root, AUTHORING_VALIDATOR, [specDir]);
+  assert.equal(authoring.status, 0, commandOutput(authoring));
   initFixtureGit(root);
   return { root, specDir, specPath };
 }
 
 function ordinaryReview() {
-  return {
-    reviewed_criteria: ['R1.1'],
-    counterexamples: [{
+  return canonicalPassReview(['R1.1'], [{
       criterion: 'R1.1', case_kind: 'failure',
       scenario: 'Deletion targets a record that does not exist in the current store.',
       expected: 'The service returns not-found and never reports the record as deleted.',
       decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
-    }],
+    }]);
+}
+
+function canonicalPassReview(reviewedCriteria, counterexamples) {
+  return {
+    verdict: 'PASS',
+    findings: [],
+    unresolved_decisions: [],
+    graph_coverage: [
+      'criterion_local', 'cross_criterion', 'runtime_path',
+      'assumption_provenance', 'compatibility_migration',
+    ].map((surface) => ({
+      surface, covered: true,
+      notes: 'The review covers this semantic surface against the canonical model.',
+    })),
+    reviewed_criteria: reviewedCriteria,
+    counterexamples,
+    reviewer_evidence: null,
   };
 }
 
@@ -209,16 +225,12 @@ function promoteCanonicalModel(fixture) {
 }
 
 function makeCanonicalReady(fixture) {
-  const spec = JSON.parse(fs.readFileSync(fixture.specPath, 'utf8'));
-  spec.authoring.requirements = 'validated';
-  spec.authoring.design = 'validated';
-  fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+  const authoring = runNode(fixture.root, AUTHORING_VALIDATOR, [fixture.specDir]);
+  assert.equal(authoring.status, 0, commandOutput(authoring));
   const result = READINESS.finalizeReadiness({
     specDir: fixture.specDir,
     projectRoot: fixture.root,
-    reviewResult: {
-    reviewed_criteria: ['R1.1', 'R1.2'],
-    counterexamples: [{
+    reviewResult: canonicalPassReview(['R1.1', 'R1.2'], [{
       criterion: 'R1.1', case_kind: 'failure',
       scenario: 'The service receives invalid input without its required discriminator.',
       expected: 'The service returns rejected state and never emits enabled true.',
@@ -228,8 +240,7 @@ function makeCanonicalReady(fixture) {
       scenario: 'The service reports enabled state without producing separate proof evidence.',
       expected: 'Verification fails because the independent proof artifact is absent.',
       decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
-    }],
-    },
+    }]),
   });
   return result.spec;
 }
@@ -875,6 +886,8 @@ test('auto authoring reaches readiness only after promotion, validation, groundi
     assert.ok(validation.errors.some((error) => error.includes('readiness requires validated')));
     assert.ok(validation.errors.some((error) => error.includes('requires completed semantic review')));
 
+    spec.ready_for_implementation = false;
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
     spec = makeCanonicalReady(fixture);
     validation = VALIDATOR.validateSpec(fixture.specDir);
     assert.deepEqual(validation.errors, [], validation.errors.join('\n'));
@@ -1025,6 +1038,31 @@ test('done is a final-state request bound to current semantic model and digest',
     assert.equal(current.ok, true, current.reason);
     assert.equal(current.semanticDigest, spec.validation.semantic_review.semantic_digest);
 
+    const failedReceipt = structuredClone(spec);
+    failedReceipt.validation.semantic_review.verdict = 'FAIL';
+    const receiptMutation = FINAL_STATE.validateCanonicalFinalState({
+      policy: POLICY,
+      projectRoot: fixture.root,
+      candidate: { ...candidate, spec: failedReceipt },
+      dependencies,
+    });
+    assert.equal(receiptMutation.ok, false);
+    assert.match(receiptMutation.reason, /PASS CONTINUE/);
+
+    const mismatchedHistory = structuredClone(spec);
+    const latest = mismatchedHistory.validation.semantic_review_history.entries[
+      mismatchedHistory.validation.semantic_review_history.entries.length - 1
+    ];
+    latest.review_receipt_digest = `sha256:${'0'.repeat(64)}`;
+    const digestMismatch = FINAL_STATE.validateCanonicalFinalState({
+      policy: POLICY,
+      projectRoot: fixture.root,
+      candidate: { ...candidate, spec: mismatchedHistory },
+      dependencies,
+    });
+    assert.equal(digestMismatch.ok, false);
+    assert.match(digestMismatch.reason, /review_receipt_digest|canonical receipt/);
+
     const requirementsPath = path.join(fixture.specDir, 'requirements.md');
     const requirements = fs.readFileSync(requirementsPath, 'utf8');
     fs.writeFileSync(requirementsPath, requirements.replace('invalid input shall return rejected state', 'invalid input shall return a deterministic rejected state'));