@hecer/yoke 1.20.0 → 1.22.0

package/dist/agents/pi-telemetry.js

@@ -39,10 +39,11 @@ export function createPiTelemetry() {
             if (complete) {
                 // Optional totals must also cover every turn; omitted is not measured zero.
                 const measured = Object.fromEntries(Object.entries(totals).filter(([key]) => counts[key] === turns));
+                const partial = Object.fromEntries(Object.entries(totals).filter(([key]) => counts[key] !== turns));
                 return { usageAvailable: true, tokens: {
                         ...measured, inputTokens: totals.inputTokens, outputTokens: totals.outputTokens,
                         ...(reportedModels.length === 1 ? { model: reportedModels[0] } : {}),
-                    }, ...(reportedModels.length > 1 ? { reportedModels } : {}) };
+                    }, ...(Object.keys(partial).length ? { partialUsage: partial } : {}), ...(reportedModels.length > 1 ? { reportedModels } : {}) };
             }
             return { usageAvailable: false,
                 ...(Object.keys(totals).length ? { partialUsage: { ...totals } } : {}),

package/dist/agents/process-streams.js

@@ -1,4 +1,4 @@
-import { parseProviderTelemetry } from './telemetry.js';
+import { createStepTelemetry, parseProviderTelemetry } from './telemetry.js';
 import { createPiTelemetry } from './pi-telemetry.js';
 export function createBoundedOutput(limitBytes) {
     let text = '';
@@ -22,11 +22,17 @@ export function createTelemetryAccumulator(agent) {
     let trailing = '';
     let telemetry = { usageAvailable: false };
     let reportedModels = [];
-    const stepTotals = agent === 'opencode' || agent === 'kilo'
-        ? { input: 0, output: 0, cached: 0, cacheWrite: 0, reasoning: 0, cost: 0, hasInput: false, hasOutput: false, hasCached: false, hasCacheWrite: false, hasReasoning: false, hasCost: false }
-        : undefined;
+    const steps = agent === 'opencode' || agent === 'kilo' ? createStepTelemetry() : undefined;
     const update = (lines) => {
         for (const line of lines) {
+            if (steps) {
+                try {
+                    const event = JSON.parse(line);
+                    if (event && typeof event === 'object' && !Array.isArray(event))
+                        steps.consume(event);
+                }
+                catch { /* non-JSON diagnostics carry no usage */ }
+            }
             if (pi) {
                 try {
                     const event = JSON.parse(line);
@@ -45,35 +51,6 @@ export function createTelemetryAccumulator(agent) {
             // never add it to earlier results or to assistant-message snapshots.
             if (next.tokens || next.partialUsage)
                 telemetry = next;
-            if (stepTotals && isStepFinish(line)) {
-                const usage = next.tokens ?? next.partialUsage;
-                if (usage) {
-                    if (usage.inputTokens !== undefined) {
-                        stepTotals.input += usage.inputTokens;
-                        stepTotals.hasInput = true;
-                    }
-                    if (usage.outputTokens !== undefined) {
-                        stepTotals.output += usage.outputTokens;
-                        stepTotals.hasOutput = true;
-                    }
-                    if (usage.cachedInputTokens !== undefined) {
-                        stepTotals.cached += usage.cachedInputTokens;
-                        stepTotals.hasCached = true;
-                    }
-                    if (usage.cacheWriteInputTokens !== undefined) {
-                        stepTotals.cacheWrite += usage.cacheWriteInputTokens;
-                        stepTotals.hasCacheWrite = true;
-                    }
-                    if (usage.reasoningOutputTokens !== undefined) {
-                        stepTotals.reasoning += usage.reasoningOutputTokens;
-                        stepTotals.hasReasoning = true;
-                    }
-                    if (usage.totalCostUsd !== undefined) {
-                        stepTotals.cost += usage.totalCostUsd;
-                        stepTotals.hasCost = true;
-                    }
-                }
-            }
         }
     };
     return {
@@ -88,42 +65,13 @@ export function createTelemetryAccumulator(agent) {
             trailing = '';
             if (pi)
                 return pi.finish();
-            if (stepTotals && (stepTotals.hasInput || stepTotals.hasOutput)) {
-                const latest = telemetry.tokens;
-                const inputTokens = stepTotals.hasInput ? stepTotals.input : latest?.inputTokens;
-                const outputTokens = stepTotals.hasOutput ? stepTotals.output : latest?.outputTokens;
-                const partialUsage = {
-                    ...(inputTokens !== undefined ? { inputTokens } : {}),
-                    ...(outputTokens !== undefined ? { outputTokens } : {}),
-                    ...(stepTotals.hasCached ? { cachedInputTokens: stepTotals.cached } : latest?.cachedInputTokens !== undefined ? { cachedInputTokens: latest.cachedInputTokens } : {}),
-                    ...(stepTotals.hasCacheWrite ? { cacheWriteInputTokens: stepTotals.cacheWrite } : latest?.cacheWriteInputTokens !== undefined ? { cacheWriteInputTokens: latest.cacheWriteInputTokens } : {}),
-                    ...(stepTotals.hasReasoning ? { reasoningOutputTokens: stepTotals.reasoning } : latest?.reasoningOutputTokens !== undefined ? { reasoningOutputTokens: latest.reasoningOutputTokens } : {}),
-                    ...(stepTotals.hasCost ? { totalCostUsd: stepTotals.cost } : latest?.totalCostUsd !== undefined ? { totalCostUsd: latest.totalCostUsd } : {}),
-                    ...(latest?.model ? { model: latest.model } : {}),
-                };
-                if (inputTokens !== undefined && outputTokens !== undefined) {
-                    telemetry = { usageAvailable: true, tokens: { ...partialUsage, inputTokens, outputTokens } };
-                }
-                else {
-                    telemetry = { usageAvailable: false, partialUsage };
-                }
-            }
+            telemetry = steps?.finish() ?? telemetry;
             if (telemetry.tokens) {
                 const { model: _model, ...tokens } = telemetry.tokens;
-                return { usageAvailable: telemetry.usageAvailable, tokens: { ...tokens, ...(reportedModels.length === 1 ? { model: reportedModels[0] } : {}) },
+                return { ...telemetry, tokens: { ...tokens, ...(reportedModels.length === 1 ? { model: reportedModels[0] } : {}) },
                     ...(reportedModels.length > 1 ? { reportedModels } : {}) };
             }
             return { ...telemetry, ...(reportedModels.length ? { reportedModels } : {}) };
         },
     };
 }
-function isStepFinish(line) {
-    try {
-        const value = JSON.parse(line);
-        const part = value.part && typeof value.part === 'object' ? value.part : undefined;
-        return value.type === 'step_finish' || part?.type === 'step-finish';
-    }
-    catch {
-        return false;
-    }
-}

package/dist/agents/provider-selection.js

@@ -0,0 +1,12 @@
+/** Runner defaults belong to the runner that selected them. Undefined overrides
+ * are absent; explicit false values (for example bare: false) still override. */
+export function resolveProviderSelection(agent, defaults, overrides = {}) {
+    const inherited = defaults && (defaults.agent ?? 'codex') === agent ? defaults : {};
+    const result = {};
+    for (const key of ['provider', 'model', 'reasoningEffort', 'variant', 'bare', 'nativeMultiAgent']) {
+        const value = overrides[key] ?? inherited[key];
+        if (value !== undefined)
+            Object.assign(result, { [key]: value });
+    }
+    return result;
+}

package/dist/agents/telemetry.js

@@ -13,6 +13,50 @@ function parseJson(value) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/** OpenCode-family usage belongs to individual completed steps. Each field needs
+ * coverage of every step before it can be called a total. Shared by batch and
+ * streaming readers so an omitted measurement cannot turn into a measured zero. */
+export function createStepTelemetry() {
+    let steps = 0;
+    const totals = {};
+    const counts = {};
+    return {
+        consume(event) {
+            const part = isRecord(event.part) ? event.part : undefined;
+            if (event.type !== 'step_finish' && part?.type !== 'step-finish')
+                return;
+            steps++;
+            const tokens = isRecord(part?.tokens) ? part.tokens : {};
+            const cache = isRecord(tokens.cache) ? tokens.cache : undefined;
+            const fields = {
+                inputTokens: tokens.input,
+                outputTokens: tokens.output,
+                cachedInputTokens: tokens.cached ?? tokens.cacheRead ?? cache?.read,
+                cacheWriteInputTokens: tokens.cacheWrite ?? cache?.write,
+                reasoningOutputTokens: tokens.reasoning,
+                totalCostUsd: part?.cost ?? event.cost,
+            };
+            for (const [field, raw] of Object.entries(fields)) {
+                const value = finite(raw);
+                if (value === undefined)
+                    continue;
+                totals[field] = (totals[field] ?? 0) + value;
+                counts[field] = (counts[field] ?? 0) + 1;
+            }
+        },
+        finish() {
+            if (!steps)
+                return undefined;
+            const complete = counts.inputTokens === steps && counts.outputTokens === steps;
+            if (!complete)
+                return { usageAvailable: false, ...(Object.keys(totals).length ? { partialUsage: { ...totals } } : {}) };
+            const measured = Object.fromEntries(Object.entries(totals).filter(([field]) => counts[field] === steps));
+            const partialUsage = Object.fromEntries(Object.entries(totals).filter(([field]) => counts[field] !== steps));
+            return { usageAvailable: true, tokens: { ...measured, inputTokens: totals.inputTokens, outputTokens: totals.outputTokens },
+                ...(Object.keys(partialUsage).length ? { partialUsage } : {}) };
+        },
+    };
+}
 function textContent(value) {
     if (typeof value === 'string')
         return value;
@@ -154,9 +198,7 @@ export function parseProviderTelemetry(agent, lines) {
     let totalCostUsd;
     let model;
     let reportedModels = [];
-    const harnessTotals = agent === 'opencode' || agent === 'kilo'
-        ? { input: 0, output: 0, cached: 0, cacheWrite: 0, reasoning: 0, cost: 0, hasInput: false, hasOutput: false, hasCached: false, hasCacheWrite: false, hasReasoning: false, hasCost: false }
-        : undefined;
+    const steps = agent === 'opencode' || agent === 'kilo' ? createStepTelemetry() : undefined;
     for (const line of lines) {
         let parsed;
         try {
@@ -168,45 +210,11 @@ export function parseProviderTelemetry(agent, lines) {
         if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
             continue;
         const event = parsed;
+        steps?.consume(event);
         if ((agent === 'qwen' || agent === 'claude') && event.parent_tool_use_id != null)
             continue;
         const message = event.message && typeof event.message === 'object' ? event.message : undefined;
         const stats = event.stats && typeof event.stats === 'object' ? event.stats : undefined;
-        const part = event.part && typeof event.part === 'object' ? event.part : undefined;
-        const partTokens = part?.tokens && typeof part.tokens === 'object' ? part.tokens : undefined;
-        if (harnessTotals && (event.type === 'step_finish' || part?.type === 'step-finish') && partTokens) {
-            const cache = partTokens.cache && typeof partTokens.cache === 'object' ? partTokens.cache : undefined;
-            const stepInput = finite(partTokens.input);
-            const stepOutput = finite(partTokens.output);
-            const stepCached = finite(partTokens.cached ?? partTokens.cacheRead ?? cache?.read);
-            const stepCacheWrite = finite(partTokens.cacheWrite ?? cache?.write);
-            const stepReasoning = finite(partTokens.reasoning);
-            const stepCost = finite(part?.cost ?? event.cost);
-            if (stepInput !== undefined) {
-                harnessTotals.input += stepInput;
-                harnessTotals.hasInput = true;
-            }
-            if (stepOutput !== undefined) {
-                harnessTotals.output += stepOutput;
-                harnessTotals.hasOutput = true;
-            }
-            if (stepCached !== undefined) {
-                harnessTotals.cached += stepCached;
-                harnessTotals.hasCached = true;
-            }
-            if (stepCacheWrite !== undefined) {
-                harnessTotals.cacheWrite += stepCacheWrite;
-                harnessTotals.hasCacheWrite = true;
-            }
-            if (stepReasoning !== undefined) {
-                harnessTotals.reasoning += stepReasoning;
-                harnessTotals.hasReasoning = true;
-            }
-            if (stepCost !== undefined) {
-                harnessTotals.cost += stepCost;
-                harnessTotals.hasCost = true;
-            }
-        }
         const usage = (event.usage && typeof event.usage === 'object'
             ? event.usage
             : message?.usage && typeof message.usage === 'object'
@@ -277,20 +285,12 @@ export function parseProviderTelemetry(agent, lines) {
         if (typeof eventModel === 'string' && eventModel && reportedModels.length <= 1)
             model = eventModel;
     }
-    if (harnessTotals) {
-        if (harnessTotals.hasInput)
-            inputTokens = harnessTotals.input;
-        if (harnessTotals.hasOutput)
-            outputTokens = harnessTotals.output;
-        if (harnessTotals.hasCached)
-            cachedInputTokens = harnessTotals.cached;
-        if (harnessTotals.hasCacheWrite)
-            cacheWriteInputTokens = harnessTotals.cacheWrite;
-        if (harnessTotals.hasReasoning)
-            reasoningOutputTokens = harnessTotals.reasoning;
-        if (harnessTotals.hasCost)
-            totalCostUsd = harnessTotals.cost;
-    }
+    const stepUsage = steps?.finish();
+    if (stepUsage)
+        return { ...stepUsage,
+            ...(stepUsage.tokens && model ? { tokens: { ...stepUsage.tokens, model } } : {}),
+            ...(!stepUsage.tokens && model ? { reportedModels: [model] } : {}),
+        };
     if (inputTokens === undefined || outputTokens === undefined) {
         const partialUsage = {
             ...(inputTokens !== undefined ? { inputTokens } : {}),

package/dist/change/inbox.js

@@ -9,8 +9,9 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, w
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { z } from 'zod';
 import { criterionCommandProblem, isAcceptanceCriterion, loadPrd, parsePrd, savePrd, validateDependencies } from '../loop/prd.js';
-import { agentInvocation, buildWatchdogInvocation, isAgentAvailable, runAgent, } from '../loop/runner.js';
+import { agentInvocation, buildWatchdogInvocation, isAgentAvailable, runCapturedAgent, } from '../loop/runner.js';
 import { commitPaths } from '../loop/git.js';
+import { measureInvocation } from '../observability/invocation.js';
 const ChangeRequestSchema = z.object({
     version: z.literal(1),
     id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/),
@@ -184,7 +185,9 @@ export function runChangeApply(targetDir, opts) {
     rmSync(proposal, { force: true });
     const base = agentInvocation(opts.runner, buildChangePrompt(request, proposal, existing, brief), plannerDir, opts.permissions ?? 'safe', opts.selection);
     const invocation = buildWatchdogInvocation(base, opts.timeoutMs ?? 0);
-    const result = (opts.run ?? runAgent)(invocation);
+    const result = measureInvocation({ root: targetDir, agent: opts.runner, role: 'change-planner', storyId: request.id, runId: `change:${request.id}`, selection: opts.selection, invocation,
+        execute: opts.run ?? (item => runCapturedAgent(opts.runner, item)),
+    });
     if (!result.success)
         return { ok: false, added: 0, summary: `planner failed: ${result.summary}`, changeId: request.id };
     if (readFileSync(prdPath, 'utf8') !== existingText || (readPlanningFile(targetDir, '.yoke/plan.md', 80_000) ?? '') !== brief) {
@@ -246,7 +249,9 @@ export function runChangeApply(targetDir, opts) {
     rmSync(reviewPath, { force: true });
     const reviewBase = agentInvocation(reviewer, buildChangeReviewPrompt(request, reviewPath, appended), plannerDir, opts.permissions ?? 'safe', reviewer === opts.runner ? opts.selection : undefined);
     const reviewInvocation = buildWatchdogInvocation(reviewBase, opts.timeoutMs ?? 0);
-    const reviewResult = (opts.review ?? runAgent)(reviewInvocation);
+    const reviewResult = measureInvocation({ root: targetDir, agent: reviewer, role: 'coverage-review', storyId: request.id, runId: `change:${request.id}`, selection: reviewer === opts.runner ? opts.selection : undefined, invocation: reviewInvocation,
+        execute: opts.review ?? (item => runCapturedAgent(reviewer, item)),
+    });
     if (!reviewResult.success) {
         return { ok: false, added: 0, summary: `coverage review failed: ${reviewResult.summary}`, changeId: request.id };
     }

package/dist/check/command.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, realpathSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { parse } from 'yaml';
@@ -15,10 +15,17 @@ import { writeOutputArtifact } from '../output/artifact.js';
 import { DEFAULT_OUTPUT_POLICY } from '../output/types.js';
 import { createProviderProcessRecord, filesystemProviderProcessRecordAdapter } from '../agents/process-record.js';
 import { trackProcessRecordIdentity } from '../agents/process-record-identity.js';
+import { DeliverySchema, startDelivery, finishDelivery } from './delivery.js';
 const Criterion = z.object({ id: z.string().min(1).max(120), text: z.string().min(1).max(8000), commands: z.array(z.string().min(1).max(8000)).max(30) }).strict();
-const Acceptance = z.object({ version: z.literal(1), criteria: z.array(Criterion).max(200), protected: z.array(z.string().min(1)).max(500).default([]) }).strict().superRefine((value, ctx) => {
+const Acceptance = z.object({ version: z.literal(1), criteria: z.array(Criterion).max(200), protected: z.array(z.string().min(1)).max(500).default([]), delivery: DeliverySchema.optional() }).strict().superRefine((value, ctx) => {
     if (new Set(value.criteria.map(c => c.id)).size !== value.criteria.length)
         ctx.addIssue({ code: 'custom', message: 'Duplicate acceptance criterion id' });
+    const ids = new Set(value.criteria.map(criterion => criterion.id));
+    for (const item of [...(value.delivery?.artifacts ?? []), ...(value.delivery?.journeys ?? [])]) {
+        for (const id of item.criteria)
+            if (!ids.has(id))
+                ctx.addIssue({ code: 'custom', path: ['delivery'], message: `Delivery references unknown criterion: ${id}` });
+    }
 });
 export async function checkProjectAsync(directory, options = {}) {
     const controller = new AbortController();
@@ -162,8 +169,36 @@ function verifyCommandAsync(command, root, signal) {
     });
 }
 export function loadAcceptance(root) {
+    return loadAcceptanceSnapshot(root).manifest;
+}
+/** Hash the exact bounded bytes that were parsed; never reread an untrusted path for the digest. */
+function loadAcceptanceSnapshot(root) {
     const file = statePath(root, 'acceptance.yaml');
-    return existsSync(file) ? Acceptance.parse(parse(readFileSync(file, 'utf8'))) : null;
+    if (!existsSync(file))
+        return { manifest: null, digest: null };
+    const fd = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    try {
+        const before = fstatSync(fd);
+        if (!before.isFile() || before.size > 64 * 1024 * 1024)
+            throw Error('Acceptance must be a regular file of at most 64 MiB');
+        const bytes = Buffer.alloc(before.size + 1);
+        let length = 0;
+        while (length < bytes.length) {
+            const count = readSync(fd, bytes, length, bytes.length - length, null);
+            if (!count)
+                break;
+            length += count;
+        }
+        const after = fstatSync(fd), named = lstatSync(statePath(root, 'acceptance.yaml'));
+        if (length !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs ||
+            named.ino !== before.ino || named.dev !== before.dev || named.size !== before.size || named.mtimeMs !== before.mtimeMs || named.ctimeMs !== before.ctimeMs)
+            throw Error('Acceptance changed while loading');
+        const content = bytes.subarray(0, length);
+        return { manifest: Acceptance.parse(parse(content.toString('utf8'))), digest: createHash('sha256').update(content).digest('hex') };
+    }
+    finally {
+        closeSync(fd);
+    }
 }
 function protectedPath(root, path) {
     if (isAbsolute(path))
@@ -209,17 +244,41 @@ export function acceptanceProtectionProblem(root, baselineRoot = root) {
         return `Protected acceptance cannot be verified: ${error.message}`;
     }
 }
+function finalizeDelivery(root, manifest, start, fingerprint, criteria, options = {}) {
+    let changed = false;
+    const delivery = finishDelivery(root, manifest, start, fingerprint, criteria, { ...options, checkIntegrity: () => {
+            let problem = null;
+            try {
+                changed = workspaceFingerprint(root) !== fingerprint;
+            }
+            catch (error) {
+                changed = true;
+                problem = `Checked source cannot be verified: ${error.message}`;
+            }
+            problem = problem ?? acceptanceProtectionProblem(root) ?? (changed ? 'Source changed during verification; run check again on a stable tree' : null);
+            if (problem)
+                criteria.push({ id: 'source-integrity', text: 'Checked source remained stable', commands: [], status: 'failed', summary: problem });
+            if (options.signal?.aborted || (options.deadline !== undefined && Date.now() >= options.deadline)) {
+                const cancelled = 'Verification cancelled or deadline reached';
+                criteria.push({ id: 'verification-cancelled', text: 'Verification completed within its allowed run', commands: [], status: 'failed', summary: cancelled });
+                problem = problem ?? cancelled;
+            }
+            return problem;
+        } });
+    return { delivery, changed };
+}
 export function checkProject(directory, options = {}) {
     const root = realpathSync(directory);
     const started = Date.now();
     const before = workspaceFingerprint(root);
     const problem = acceptanceProtectionProblem(root);
+    const { manifest, digest } = problem ? { manifest: null, digest: null } : loadAcceptanceSnapshot(root);
+    const deliveryStart = startDelivery(root, manifest, digest);
     const criteria = [];
     const execute = options.execute ?? ((command, cwd) => commandVerifier(command, { phase: 'verify' })(cwd));
     if (problem)
         criteria.push({ id: 'protected-acceptance', text: 'Acceptance infrastructure unchanged', commands: [], status: 'failed', summary: problem });
     else {
-        const manifest = loadAcceptance(root);
         for (const criterion of manifest?.criteria ?? []) {
             const results = criterion.commands.map(command => {
                 try {
@@ -247,14 +306,11 @@ export function checkProject(directory, options = {}) {
         if (criteria.length === 0)
             criteria.push({ id: 'acceptance', text: 'Project acceptance', commands: [], status: 'unverified', summary: 'No acceptance manifest or project verification command found' });
     }
-    const changed = workspaceFingerprint(root) !== before;
-    const afterProblem = acceptanceProtectionProblem(root);
-    if (changed || afterProblem)
-        criteria.push({ id: 'source-integrity', text: 'Checked source remained stable', commands: [], status: 'failed', summary: afterProblem ?? 'Source changed during verification; run check again on a stable tree' });
+    const { changed, delivery } = finalizeDelivery(root, manifest, deliveryStart, before, criteria);
     const status = criteria.some(c => c.status === 'failed') ? 'failed' : criteria.some(c => c.status === 'unverified') ? 'unverified' : 'passed';
     const id = randomUUID();
     const evidencePath = statePath(root, 'checks', `${id}.json`);
-    const report = { version: 1, id, generatedAt: new Date().toISOString(), fingerprint: before, status, summary: changed ? 'Source changed during verification' : `${criteria.filter(c => c.status === 'passed').length}/${criteria.length} checks passed; ${status}`, criteria, durationMs: Date.now() - started, evidencePath };
+    const report = { version: 1, id, generatedAt: new Date().toISOString(), fingerprint: before, status, summary: changed ? 'Source changed during verification' : `${criteria.filter(c => c.status === 'passed').length}/${criteria.length} checks passed; ${status}`, criteria, delivery, durationMs: Date.now() - started, evidencePath };
     mkdirSync(dirname(evidencePath), { recursive: true });
     writeFileSync(evidencePath, JSON.stringify(report, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
     return report;
@@ -265,6 +321,8 @@ async function checkProjectAsyncAdmitted(directory, options) {
     const started = Date.now();
     const before = workspaceFingerprint(root);
     const problem = acceptanceProtectionProblem(root);
+    const { manifest, digest } = problem ? { manifest: null, digest: null } : loadAcceptanceSnapshot(root);
+    const deliveryStart = startDelivery(root, manifest, digest, options);
     const criteria = [];
     let cleanupUnconfirmed = false;
     const rawExecute = options.execute ?? ((command, cwd) => verifyCommandAsync(command, cwd, options.signal));
@@ -281,7 +339,6 @@ async function checkProjectAsyncAdmitted(directory, options) {
     if (problem)
         criteria.push({ id: 'protected-acceptance', text: 'Acceptance infrastructure unchanged', commands: [], status: 'failed', summary: problem });
     else {
-        const manifest = loadAcceptance(root);
         for (const criterion of manifest?.criteria ?? []) {
             const results = [];
             for (const command of criterion.commands) {
@@ -316,16 +373,11 @@ async function checkProjectAsyncAdmitted(directory, options) {
         if (criteria.length === 0)
             criteria.push({ id: 'acceptance', text: 'Project acceptance', commands: [], status: 'unverified', summary: 'No acceptance manifest or project verification command found' });
     }
-    const changed = workspaceFingerprint(root) !== before;
-    const afterProblem = acceptanceProtectionProblem(root);
-    if (changed || afterProblem)
-        criteria.push({ id: 'source-integrity', text: 'Checked source remained stable', commands: [], status: 'failed', summary: afterProblem ?? 'Source changed during verification; run check again on a stable tree' });
-    if (options.signal?.aborted)
-        criteria.push({ id: 'verification-cancelled', text: 'Verification completed within its allowed run', commands: [], status: 'failed', summary: 'Verification cancelled or deadline reached' });
+    const { changed, delivery } = finalizeDelivery(root, manifest, deliveryStart, before, criteria, options);
     const status = criteria.some(c => c.status === 'failed') ? 'failed' : criteria.some(c => c.status === 'unverified') ? 'unverified' : 'passed';
     const id = randomUUID();
     const evidencePath = statePath(root, 'checks', `${id}.json`);
-    const report = { ...(cleanupUnconfirmed ? { cleanupUnconfirmed: true } : {}), version: 1, id, generatedAt: new Date().toISOString(), fingerprint: before, status, summary: changed ? 'Source changed during verification' : `${criteria.filter(c => c.status === 'passed').length}/${criteria.length} checks passed; ${status}`, criteria, durationMs: Date.now() - started, evidencePath };
+    const report = { ...(cleanupUnconfirmed ? { cleanupUnconfirmed: true } : {}), version: 1, id, generatedAt: new Date().toISOString(), fingerprint: before, status, summary: changed ? 'Source changed during verification' : `${criteria.filter(c => c.status === 'passed').length}/${criteria.length} checks passed; ${status}`, criteria, delivery, durationMs: Date.now() - started, evidencePath };
     mkdirSync(dirname(evidencePath), { recursive: true });
     writeFileSync(evidencePath, JSON.stringify(report, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
     return report;

package/dist/check/delivery.js

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { z } from 'zod';
+const References = z.array(z.string().min(1).max(120)).min(1).max(200);
+export const DeliverySchema = z.object({
+    version: z.literal(1),
+    artifacts: z.array(z.object({ path: z.string().min(1).max(1000), criteria: References }).strict()).max(32).default([]),
+    journeys: z.array(z.object({ id: z.string().min(1).max(120), text: z.string().min(1).max(8000), criteria: References }).strict()).max(100).default([]),
+    environment: z.object({ name: z.string().min(1).max(200), url: z.string().url().max(2000).optional() }).strict().optional(),
+}).strict().superRefine((value, context) => {
+    if (new Set(value.artifacts.map(item => item.path)).size !== value.artifacts.length)
+        context.addIssue({ code: 'custom', message: 'Duplicate delivery artifact path' });
+    if (new Set(value.journeys.map(item => item.id)).size !== value.journeys.length)
+        context.addIssue({ code: 'custom', message: 'Duplicate delivery journey id' });
+});
+export const DELIVERY_HASH_LIMITS = Object.freeze({ fileBytes: 512 * 1024 * 1024, totalBytes: 1024 * 1024 * 1024, timeoutMs: 10_000 });
+function snapshotBudget(options) {
+    return { signal: options.signal, remaining: DELIVERY_HASH_LIMITS.totalBytes, deadline: Math.min(options.deadline ?? Infinity, Date.now() + DELIVERY_HASH_LIMITS.timeoutMs) };
+}
+function checkBudget(budget) {
+    if (budget.signal?.aborted || Date.now() >= budget.deadline)
+        throw Error('Artifact hashing cancelled or deadline reached');
+}
+function artifactPath(root, path) {
+    if (isAbsolute(path))
+        throw Error('Artifact path must be relative');
+    const full = resolve(root, path), rel = relative(root, full);
+    if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        throw Error('Artifact path escapes project');
+    let current = root;
+    for (const component of rel.split(sep)) {
+        current = join(current, component);
+        if (lstatSync(current).isSymbolicLink())
+            throw Error('Artifact paths must not contain symbolic links');
+    }
+    if (realpathSync(full) !== full)
+        throw Error('Artifact path is not canonical');
+    return full;
+}
+/** Bounded bytes and constant memory; the deadline is checked between synchronous reads. */
+function snapshotArtifact(root, path, budget) {
+    let fd;
+    try {
+        checkBudget(budget);
+        const full = artifactPath(root, path);
+        const named = lstatSync(full);
+        if (!named.isFile())
+            throw Error('Artifact must be a regular file');
+        if (named.size > DELIVERY_HASH_LIMITS.fileBytes)
+            throw Error(`Artifact exceeds the ${DELIVERY_HASH_LIMITS.fileBytes} byte file limit`);
+        if (named.size > budget.remaining)
+            throw Error(`Artifact exceeds the remaining aggregate hash budget (${budget.remaining} bytes)`);
+        fd = openSync(full, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+        const before = fstatSync(fd);
+        if (!before.isFile() || before.ino !== named.ino || before.dev !== named.dev || before.size !== named.size)
+            throw Error('Artifact changed before hashing');
+        const hash = createHash('sha256'), buffer = Buffer.alloc(256 * 1024);
+        let bytes = 0;
+        while (bytes < before.size) {
+            checkBudget(budget);
+            const count = readSync(fd, buffer, 0, Math.min(buffer.length, before.size - bytes), null);
+            if (!count)
+                break;
+            hash.update(buffer.subarray(0, count));
+            bytes += count;
+            budget.remaining -= count;
+        }
+        checkBudget(budget);
+        const after = fstatSync(fd);
+        const finalNamed = lstatSync(artifactPath(root, path));
+        if (bytes !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs ||
+            !finalNamed.isFile() || finalNamed.ino !== before.ino || finalNamed.dev !== before.dev || finalNamed.size !== before.size || finalNamed.mtimeMs !== before.mtimeMs || finalNamed.ctimeMs !== before.ctimeMs)
+            throw Error('Artifact changed while hashing');
+        return { sha256: hash.digest('hex'), bytes };
+    }
+    catch (error) {
+        return { problem: `Artifact cannot be bound: ${error.message}` };
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* Preserve the snapshot failure. */ }
+        }
+    }
+}
+export function startDelivery(root, manifest, acceptanceDigest, options = {}) {
+    const budget = snapshotBudget(options);
+    return { acceptanceDigest, artifacts: (manifest?.delivery?.artifacts ?? []).map(item => snapshotArtifact(root, item.path, budget)) };
+}
+export function finishDelivery(root, manifest, start, fingerprint, criteria, options = {}) {
+    const budget = snapshotBudget(options);
+    const snapshots = (manifest?.delivery?.artifacts ?? []).map((artifact, index) => {
+        const before = start.artifacts[index], after = snapshotArtifact(root, artifact.path, budget);
+        const stable = !!before?.sha256 && before.sha256 === after.sha256;
+        const problem = before?.problem ?? after.problem ?? (!stable ? 'Artifact changed during verification; rebuild and check the stable artifact again' : undefined);
+        if (problem)
+            criteria.push({ id: `delivery-artifact-${index + 1}`, text: `Artifact ${artifact.path} remained stable`, commands: [], status: 'failed', summary: problem });
+        return { artifact, before, after, stable, problem };
+    });
+    // Recheck source and cancellation after the final artifact I/O, before assigning proof status.
+    const bindingProblem = options.checkIntegrity?.() ?? snapshots.find(item => item.problem)?.problem;
+    const statusFor = (ids) => {
+        const statuses = ids.flatMap(id => { const matches = criteria.filter(criterion => criterion.id === id); return matches.length ? matches.map(item => item.status) : ['unverified']; });
+        return statuses.some(status => status === 'failed') ? 'failed' : !bindingProblem && statuses.every(status => status === 'passed') ? 'passed' : 'unverified';
+    };
+    const artifacts = snapshots.map(({ artifact, before, after, stable, problem }) => {
+        return { ...artifact, binding: 'declared-criteria', status: problem ? 'failed' : statusFor(artifact.criteria), stable, sha256: before?.sha256, bytes: before?.bytes, afterSha256: after.sha256, summary: problem ?? bindingProblem ?? 'Artifact hashes matched before and after checking its declared criteria; the project commands define how this artifact is exercised' };
+    });
+    const requirements = manifest?.criteria.map(item => item.id) ?? [];
+    return {
+        version: 1, sourceFingerprint: fingerprint, acceptanceDigest: start.acceptanceDigest, ...(bindingProblem ? { bindingProblem } : {}),
+        environment: { platform: process.platform, architecture: process.arch, nodeVersion: process.version, declared: manifest?.delivery?.environment },
+        artifacts, journeys: (manifest?.delivery?.journeys ?? []).map(journey => ({ ...journey, status: statusFor(journey.criteria) })),
+        passedRequirementIds: requirements.filter(id => statusFor([id]) === 'passed'),
+        failedRequirementIds: requirements.filter(id => statusFor([id]) === 'failed'),
+        unverifiedRequirementIds: requirements.filter(id => statusFor([id]) === 'unverified'),
+    };
+}