@iowarp/clio-coder 0.3.6 → 0.3.8

package/dist/{chunk-OH3TOQTB.js → chunk-K4XHGFR5.js}

@@ -1,23 +1,25 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   ROUTE_POLICY_VERSION,
-  isExecutionRole,
   isRouteDecisionAgentSelection,
   isRoutingIntent
-} from "./chunk-22NAGB7X.js";
+} from "./chunk-P43ETTHK.js";
+import {
+  isExecutionRole
+} from "./chunk-H7IXIC72.js";
 import {
   assertSafeId
 } from "./chunk-R346GLFC.js";
+import {
+  readClioVersion,
+  resolvePackageRoot
+} from "./chunk-IWHMRKLL.js";
 import {
   require_dist
 } from "./chunk-APJ265NV.js";
 import {
   safeResourceWrite
 } from "./chunk-WEPFGWHJ.js";
-import {
-  readClioVersion,
-  resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
 import {
   __toESM,
   init_esm_shims
@@ -26,7 +28,7 @@ import {
 // src/domains/dispatch/receipt-integrity.ts
 init_esm_shims();
 import { createHash } from "node:crypto";
-var RUN_RECEIPT_INTEGRITY_VERSION = 15;
+var RUN_RECEIPT_INTEGRITY_VERSION = 20;
 var RUN_RECEIPT_INTEGRITY_ALGORITHM = "sha256";
 function sha256(input) {
   return createHash("sha256").update(input, "utf8").digest("hex");
@@ -79,6 +81,8 @@ var RECEIPT_INTEGRITY_FIELD_COVERAGE = {
   agentAudience: true,
   requestOrigin: true,
   task: true,
+  intent: true,
+  pathScope: true,
   // Historical receipts omit this field, so their receipt and ledger payloads remain unchanged.
   budget: true,
   targetId: true,
@@ -96,12 +100,13 @@ var RECEIPT_INTEGRITY_FIELD_COVERAGE = {
   reroutes: true,
   pipeline: true,
   gate: true,
+  council: true,
   plan: true,
+  fleetGate: true,
   personaOverride: true,
   projectContext: true,
   // Always set on receipts written after #104 landed; absent only on older
-  // receipts, which digest exactly as they did before these fields existed,
-  // so the integrity version stays where it is.
+  // receipts, which omit these fields from canonical serialization.
   rulesApplied: true,
   operatorProfileApplied: true,
   exitCode: true,
@@ -131,6 +136,8 @@ var RECEIPT_INTEGRITY_FIELD_COVERAGE = {
   toolStats: true,
   toolActivity: true,
   verification: true,
+  hostVerification: true,
+  worktree: true,
   routingIntent: true,
   quality: true,
   skillActivations: true,
@@ -146,7 +153,7 @@ var RECEIPT_INTEGRITY_FIELD_COVERAGE = {
   validationGrounding: true,
   capabilityMismatch: true,
   // Same reasoning: absent unless the run had an agent ledger, so a receipt
-  // without one digests byte-identically to one produced before it existed.
+  // without one omits the field from canonical serialization.
   ledgerContribution: true,
   sessionId: true,
   briefing: true,
@@ -863,6 +870,574 @@ function readArray2(record, source, field) {
   return value;
 }
 
+// src/domains/evidence/trust-status.ts
+init_esm_shims();
+var TRUST_STATUS_VERSION = 1;
+var TRUST_STATUS_MAX_ARTIFACT_REFERENCES = 16;
+var TRUST_STATUS_MAX_IDENTIFIER_LENGTH = 512;
+var TRUST_STATUS_AXES = [
+  "artifactIntegrity",
+  "validationGrounding",
+  "independentReview",
+  "contextProvenance",
+  "autonomyEnforcement",
+  "completionEvidence"
+];
+var TRUST_STATUS_STATES = {
+  artifactIntegrity: ["verified", "failed", "absent", "unknown", "not_applicable"],
+  validationGrounding: ["validated", "failed", "ungrounded", "absent", "unknown", "not_applicable"],
+  independentReview: ["passed", "failed", "inconclusive", "not_independent", "absent", "unknown", "not_applicable"],
+  contextProvenance: ["recorded", "invalid", "absent", "unknown", "not_applicable"],
+  autonomyEnforcement: ["enforced", "approximated", "bypassed", "absent", "unknown", "not_applicable"],
+  completionEvidence: ["evidenced", "incomplete", "limited", "absent", "unknown", "not_applicable"]
+};
+var SELF_REPORTED_ARTIFACT_KINDS = /* @__PURE__ */ new Set([
+  "finish_contract_evidence",
+  "run_receipt"
+]);
+var AXIS_STATES = {
+  artifactIntegrity: new Set(TRUST_STATUS_STATES.artifactIntegrity),
+  validationGrounding: new Set(TRUST_STATUS_STATES.validationGrounding),
+  independentReview: new Set(TRUST_STATUS_STATES.independentReview),
+  contextProvenance: new Set(TRUST_STATUS_STATES.contextProvenance),
+  autonomyEnforcement: new Set(TRUST_STATUS_STATES.autonomyEnforcement),
+  completionEvidence: new Set(TRUST_STATUS_STATES.completionEvidence)
+};
+var AXIS_SOURCES = {
+  artifactIntegrity: /* @__PURE__ */ new Set(["receipt_integrity_verification", "compatibility"]),
+  validationGrounding: /* @__PURE__ */ new Set(["run_receipt", "evidence_bundle", "compatibility"]),
+  independentReview: /* @__PURE__ */ new Set(["gate_decision", "compatibility"]),
+  contextProvenance: /* @__PURE__ */ new Set(["run_receipt", "evidence_bundle", "compatibility"]),
+  autonomyEnforcement: /* @__PURE__ */ new Set(["run_receipt", "compatibility"]),
+  completionEvidence: /* @__PURE__ */ new Set(["finish_contract", "compatibility"])
+};
+var SOURCE_AUTHORITIES = {
+  receipt_integrity_verification: /* @__PURE__ */ new Set(["clio"]),
+  run_receipt: /* @__PURE__ */ new Set(["clio", "validator", "runtime", "external_system", "unknown"]),
+  gate_decision: /* @__PURE__ */ new Set(["clio", "reviewer", "operator", "unknown"]),
+  evidence_bundle: /* @__PURE__ */ new Set(["clio"]),
+  finish_contract: /* @__PURE__ */ new Set(["clio"]),
+  compatibility: /* @__PURE__ */ new Set(["clio", "unknown"])
+};
+var ABSENCE_REASONS = /* @__PURE__ */ new Set([
+  "not_recorded",
+  "not_observed",
+  "artifact_missing",
+  "historical_format"
+]);
+var SOURCE_KINDS = /* @__PURE__ */ new Set([
+  "receipt_integrity_verification",
+  "run_receipt",
+  "gate_decision",
+  "evidence_bundle",
+  "finish_contract",
+  "compatibility"
+]);
+var AUTHORITY_KINDS = /* @__PURE__ */ new Set([
+  "clio",
+  "validator",
+  "reviewer",
+  "operator",
+  "runtime",
+  "external_system",
+  "unknown"
+]);
+var ARTIFACT_KINDS = /* @__PURE__ */ new Set([
+  "run_receipt",
+  "validation_result",
+  "gate_decision",
+  "briefing",
+  "project_context",
+  "autonomy_policy",
+  "finish_contract_evidence",
+  "evidence_bundle",
+  "session_entry"
+]);
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const expected = new Set(keys);
+  return Object.keys(value).length === expected.size && Object.keys(value).every((key) => expected.has(key));
+}
+function isTrustStatusIdentifier(value) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.length > TRUST_STATUS_MAX_IDENTIFIER_LENGTH) {
+    return false;
+  }
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint !== void 0 && (codePoint < 32 || codePoint === 127)) return false;
+  }
+  return true;
+}
+function compareArtifactReferences(left, right) {
+  const leftKey = `${left.kind}\0${left.id}\0${left.digest?.value ?? ""}`;
+  const rightKey = `${right.kind}\0${right.id}\0${right.digest?.value ?? ""}`;
+  return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+}
+function normalizeArtifactReference(value, path) {
+  if (!isRecord3(value)) throw new Error(`${path} must be an object`);
+  if (!hasExactKeys(value, value.digest === void 0 ? ["kind", "id"] : ["kind", "id", "digest"])) {
+    throw new Error(`${path} has unknown or missing fields`);
+  }
+  if (typeof value.kind !== "string" || !ARTIFACT_KINDS.has(value.kind)) {
+    throw new Error(`${path}.kind is invalid`);
+  }
+  if (!isTrustStatusIdentifier(value.id)) throw new Error(`${path}.id is invalid`);
+  const reference = { kind: value.kind, id: value.id };
+  if (value.digest !== void 0) {
+    if (!isRecord3(value.digest) || !hasExactKeys(value.digest, ["algorithm", "value"]) || value.digest.algorithm !== "sha256" || typeof value.digest.value !== "string" || !/^[a-f0-9]{64}$/u.test(value.digest.value)) {
+      throw new Error(`${path}.digest is invalid`);
+    }
+    reference.digest = { algorithm: "sha256", value: value.digest.value };
+  }
+  return reference;
+}
+function normalizeAttributedStatus(axis, value) {
+  if (!hasExactKeys(value, ["state", "source", "authority", "artifacts"])) {
+    throw new Error(`${axis} has unknown or missing fields`);
+  }
+  if (!isRecord3(value.source) || !hasExactKeys(value.source, ["kind", "id"])) {
+    throw new Error(`${axis}.source is invalid`);
+  }
+  if (typeof value.source.kind !== "string" || !SOURCE_KINDS.has(value.source.kind) || !AXIS_SOURCES[axis].has(value.source.kind) || !isTrustStatusIdentifier(value.source.id)) {
+    throw new Error(`${axis}.source is invalid`);
+  }
+  if (!isRecord3(value.authority) || !hasExactKeys(value.authority, ["kind", "id"])) {
+    throw new Error(`${axis}.authority is invalid`);
+  }
+  if (typeof value.authority.kind !== "string" || !AUTHORITY_KINDS.has(value.authority.kind) || !SOURCE_AUTHORITIES[value.source.kind].has(
+    value.authority.kind
+  ) || !isTrustStatusIdentifier(value.authority.id)) {
+    throw new Error(`${axis}.authority is invalid`);
+  }
+  if (value.source.kind === "compatibility" && value.state !== "unknown" && value.state !== "not_applicable") {
+    throw new Error(`${axis} compatibility source cannot establish ${value.state}`);
+  }
+  if (!Array.isArray(value.artifacts) || value.artifacts.length > TRUST_STATUS_MAX_ARTIFACT_REFERENCES) {
+    throw new Error(`${axis}.artifacts exceeds the bounded reference list`);
+  }
+  const artifacts = value.artifacts.map(
+    (entry, index) => normalizeArtifactReference(entry, `${axis}.artifacts[${index}]`)
+  );
+  artifacts.sort(compareArtifactReferences);
+  for (let index = 1; index < artifacts.length; index += 1) {
+    if (compareArtifactReferences(
+      artifacts[index - 1],
+      artifacts[index]
+    ) === 0) {
+      throw new Error(`${axis}.artifacts contains a duplicate reference`);
+    }
+  }
+  return {
+    state: value.state,
+    source: { kind: value.source.kind, id: value.source.id },
+    authority: { kind: value.authority.kind, id: value.authority.id },
+    artifacts
+  };
+}
+function normalizeAxis(axis, value) {
+  if (!isRecord3(value) || typeof value.state !== "string" || !AXIS_STATES[axis].has(value.state)) {
+    throw new Error(`${axis}.state is invalid`);
+  }
+  if (value.state === "absent") {
+    if (!hasExactKeys(value, ["state", "reason"]) || typeof value.reason !== "string" || !ABSENCE_REASONS.has(value.reason)) {
+      throw new Error(`${axis} absent state is invalid`);
+    }
+    return { state: "absent", reason: value.reason };
+  }
+  return normalizeAttributedStatus(axis, value);
+}
+function normalizeTrustStatus(value) {
+  if (!isRecord3(value) || !hasExactKeys(value, ["version", ...TRUST_STATUS_AXES])) {
+    throw new Error("trust status has unknown or missing fields");
+  }
+  if (value.version !== TRUST_STATUS_VERSION) throw new Error("trust status version is invalid");
+  return {
+    version: TRUST_STATUS_VERSION,
+    artifactIntegrity: normalizeAxis("artifactIntegrity", value.artifactIntegrity),
+    validationGrounding: normalizeAxis("validationGrounding", value.validationGrounding),
+    independentReview: normalizeAxis("independentReview", value.independentReview),
+    contextProvenance: normalizeAxis("contextProvenance", value.contextProvenance),
+    autonomyEnforcement: normalizeAxis("autonomyEnforcement", value.autonomyEnforcement),
+    completionEvidence: normalizeAxis("completionEvidence", value.completionEvidence)
+  };
+}
+function absentTrustStatus(reason) {
+  return { state: "absent", reason };
+}
+function composeTrustStatus(...projections) {
+  const axes = {
+    artifactIntegrity: absentTrustStatus("not_recorded"),
+    validationGrounding: absentTrustStatus("not_recorded"),
+    independentReview: absentTrustStatus("not_recorded"),
+    contextProvenance: absentTrustStatus("not_recorded"),
+    autonomyEnforcement: absentTrustStatus("not_recorded"),
+    completionEvidence: absentTrustStatus("not_recorded")
+  };
+  for (const projection of projections) {
+    if (projection.artifactIntegrity !== void 0) axes.artifactIntegrity = projection.artifactIntegrity;
+    if (projection.validationGrounding !== void 0) axes.validationGrounding = projection.validationGrounding;
+    if (projection.independentReview !== void 0) axes.independentReview = projection.independentReview;
+    if (projection.contextProvenance !== void 0) axes.contextProvenance = projection.contextProvenance;
+    if (projection.autonomyEnforcement !== void 0) axes.autonomyEnforcement = projection.autonomyEnforcement;
+    if (projection.completionEvidence !== void 0) axes.completionEvidence = projection.completionEvidence;
+  }
+  return normalizeTrustStatus({ version: TRUST_STATUS_VERSION, ...axes });
+}
+function sha256Reference(kind, id, digest) {
+  const reference = { kind, id };
+  if (digest !== void 0 && /^[a-f0-9]{64}$/u.test(digest)) {
+    reference.digest = { algorithm: "sha256", value: digest };
+  }
+  return reference;
+}
+function receiptReference(receipt) {
+  return sha256Reference("run_receipt", receipt.runId, receipt.integrity?.digest);
+}
+function attributed(state, source, authority, artifacts) {
+  return { state, source, authority, artifacts: [...artifacts].sort(compareArtifactReferences) };
+}
+function receiptSource(receipt) {
+  return { kind: "run_receipt", id: receipt.runId };
+}
+function compatibilitySource(receipt, field) {
+  return { kind: "compatibility", id: `run_receipt:${receipt.runId}:${field}` };
+}
+var DISPATCH_AUTHORITY = { kind: "clio", id: "dispatch" };
+var COMPATIBILITY_AUTHORITY = { kind: "unknown", id: "historical-persisted-format" };
+function retiredReceiptIntegrity(integrity) {
+  if (!isRecord3(integrity)) return null;
+  const version = integrity.version;
+  if (typeof version !== "number" || !Number.isInteger(version) || version < 1) return null;
+  if (version >= RUN_RECEIPT_INTEGRITY_VERSION) return null;
+  return { receiptVersion: version, supportedVersion: RUN_RECEIPT_INTEGRITY_VERSION };
+}
+function retiredReceiptIntegrityReason(retired) {
+  return `receipt integrity v${retired.receiptVersion} is retired; this build verifies v${retired.supportedVersion}; the receipt is not read as evidence`;
+}
+function verifyReceiptIntegrityOutcome(receipt, envelope) {
+  const retired = retiredReceiptIntegrity(receipt.integrity);
+  if (retired !== null) return { ok: false, reason: retiredReceiptIntegrityReason(retired), retired };
+  return verifyReceiptIntegrity(receipt, envelope);
+}
+var RETIRED_INTEGRITY_SOURCE = /:integrity-v(\d+)-retired$/u;
+function retiredIntegritySourceId(runId, receiptVersion) {
+  return `run_receipt:${runId}:integrity-v${receiptVersion}-retired`;
+}
+function retiredIntegrityVersionOf(status) {
+  if (status.state !== "unknown" || status.source.kind !== "compatibility") return null;
+  const match = RETIRED_INTEGRITY_SOURCE.exec(status.source.id);
+  return match === null ? null : Number(match[1]);
+}
+function adaptReceiptIntegrityStatus(receipt, verification) {
+  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
+  const artifacts = [receiptReference(receipt)];
+  if (verification !== void 0 && !verification.ok && verification.retired !== void 0) {
+    return attributed(
+      "unknown",
+      { kind: "compatibility", id: retiredIntegritySourceId(receipt.runId, verification.retired.receiptVersion) },
+      COMPATIBILITY_AUTHORITY,
+      artifacts
+    );
+  }
+  if (verification === void 0 || verification.ok && receipt.integrity === void 0) {
+    return attributed(
+      "unknown",
+      {
+        kind: "compatibility",
+        id: `run_receipt:${receipt.runId}:${receipt.integrity === void 0 ? "integrity-missing" : "integrity-unchecked"}`
+      },
+      COMPATIBILITY_AUTHORITY,
+      artifacts
+    );
+  }
+  return attributed(
+    verification.ok ? "verified" : "failed",
+    { kind: "receipt_integrity_verification", id: receipt.runId },
+    { kind: "clio", id: "receipt-integrity" },
+    artifacts
+  );
+}
+function validationArtifacts(receipt) {
+  const artifacts = [receiptReference(receipt)];
+  for (const fact of receipt.quality?.typedValidations ?? []) {
+    artifacts.push(sha256Reference("validation_result", fact.sourceId, fact.validatorDigest));
+  }
+  const resultContract = receipt.quality?.resultContract;
+  if (resultContract !== null && resultContract !== void 0) {
+    artifacts.push(sha256Reference("validation_result", resultContract.sourceId, resultContract.validatorDigest));
+  }
+  return uniqueBoundedReferences(artifacts);
+}
+function qualityHasFailure(quality) {
+  if (quality === void 0) return false;
+  if (quality.typedValidations.some((fact) => !fact.passed)) return true;
+  return quality.resultContract?.conformance === "fail" || quality.resultContract?.quality === "fail";
+}
+function qualityHasValidation(quality) {
+  if (quality === void 0) return false;
+  if (quality.typedValidations.some((fact) => fact.passed)) return true;
+  return quality.resultContract?.quality === "pass";
+}
+function verificationStatus(verification, receipt, artifacts) {
+  if (verification.state === "verified") {
+    return attributed("validated", receiptSource(receipt), { kind: "validator", id: verification.basis }, artifacts);
+  }
+  if (verification.state === "unverified") return absentTrustStatus("not_observed");
+  if (verification.state === "not_applicable") {
+    return attributed("not_applicable", receiptSource(receipt), DISPATCH_AUTHORITY, artifacts);
+  }
+  return attributed(
+    "unknown",
+    receiptSource(receipt),
+    verification.basis === "acp-external-unobserved" ? { kind: "external_system", id: "acp-delegation" } : COMPATIBILITY_AUTHORITY,
+    artifacts
+  );
+}
+function adaptRunReceiptValidationStatus(receipt) {
+  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
+  const artifacts = validationArtifacts(receipt);
+  if (receipt.hostVerification?.status === "rejected") {
+    return attributed("failed", receiptSource(receipt), { kind: "validator", id: "host-verification" }, artifacts);
+  }
+  if (receipt.hostVerification?.status === "verified") {
+    return attributed("validated", receiptSource(receipt), { kind: "validator", id: "host-verification" }, artifacts);
+  }
+  if (qualityHasFailure(receipt.quality)) {
+    return attributed("failed", receiptSource(receipt), { kind: "validator", id: "receipt-quality" }, artifacts);
+  }
+  if ((receipt.validationGrounding?.ungrounded.length ?? 0) > 0 || receipt.validationGrounding !== void 0 && receipt.validationGrounding.claimed > receipt.validationGrounding.grounded) {
+    return attributed("ungrounded", receiptSource(receipt), { kind: "validator", id: "command-grounding" }, artifacts);
+  }
+  if (qualityHasValidation(receipt.quality)) {
+    return attributed("validated", receiptSource(receipt), { kind: "validator", id: "receipt-quality" }, artifacts);
+  }
+  if (receipt.verification !== void 0) {
+    return verificationStatus(receipt.verification, receipt, artifacts);
+  }
+  return attributed("unknown", compatibilitySource(receipt, "verification"), COMPATIBILITY_AUTHORITY, artifacts);
+}
+function validBriefing(briefing) {
+  return Number.isSafeInteger(briefing.bytes) && briefing.bytes >= 0 && /^[a-f0-9]{64}$/u.test(briefing.contentHash);
+}
+function validBoundedProjectContext(context) {
+  return context.tier === "bounded" && Number.isSafeInteger(context.chars) && (context.chars ?? -1) >= 0 && typeof context.contentHash === "string" && /^[a-f0-9]{64}$/u.test(context.contentHash);
+}
+var NONE_TIER_SECTIONS = ["workspace-root"];
+function validNoneTierProjectContext(context) {
+  return context.tier === "none" && context.sections !== void 0 && context.sections.length === NONE_TIER_SECTIONS.length && context.sections.every((section) => NONE_TIER_SECTIONS.includes(section)) && Number.isSafeInteger(context.chars) && (context.chars ?? -1) >= 0 && typeof context.contentHash === "string" && /^[a-f0-9]{64}$/u.test(context.contentHash);
+}
+function recordedProjectContextHash(context) {
+  if (context === void 0) return void 0;
+  if (context.tier === "bounded") return validBoundedProjectContext(context) ? context.contentHash : void 0;
+  return validNoneTierProjectContext(context) ? context.contentHash : void 0;
+}
+function contextArtifacts(receipt) {
+  const artifacts = [receiptReference(receipt)];
+  if (receipt.briefing !== void 0 && validBriefing(receipt.briefing)) {
+    artifacts.push(sha256Reference("briefing", `${receipt.runId}:briefing`, receipt.briefing.contentHash));
+  }
+  const recordedHash = recordedProjectContextHash(receipt.projectContext);
+  if (recordedHash !== void 0) {
+    artifacts.push(sha256Reference("project_context", `${receipt.runId}:project-context`, recordedHash));
+  }
+  return uniqueBoundedReferences(artifacts);
+}
+function adaptRunReceiptContextStatus(receipt) {
+  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
+  const artifacts = contextArtifacts(receipt);
+  const source = receiptSource(receipt);
+  const briefingInvalid = receipt.briefing !== void 0 && !validBriefing(receipt.briefing);
+  if (briefingInvalid) return attributed("invalid", source, DISPATCH_AUTHORITY, artifacts);
+  const context = receipt.projectContext;
+  if (context === void 0) {
+    if (receipt.briefing !== void 0) return attributed("recorded", source, DISPATCH_AUTHORITY, artifacts);
+    return attributed("unknown", compatibilitySource(receipt, "projectContext"), COMPATIBILITY_AUTHORITY, artifacts);
+  }
+  if (context.tier === "none") {
+    const bare = context.chars === void 0 && context.contentHash === void 0 && context.sections === void 0;
+    if (bare) {
+      return receipt.briefing === void 0 ? attributed("not_applicable", source, DISPATCH_AUTHORITY, artifacts) : attributed("recorded", source, DISPATCH_AUTHORITY, artifacts);
+    }
+    return attributed(
+      validNoneTierProjectContext(context) ? "recorded" : "invalid",
+      source,
+      DISPATCH_AUTHORITY,
+      artifacts
+    );
+  }
+  return attributed(validBoundedProjectContext(context) ? "recorded" : "invalid", source, DISPATCH_AUTHORITY, artifacts);
+}
+function adaptRunReceiptAutonomyStatus(receipt) {
+  if (receipt === null || receipt === void 0) return absentTrustStatus("artifact_missing");
+  const enforcement = receipt.autonomyEnforcement;
+  const artifacts = [receiptReference(receipt)];
+  if (enforcement === void 0) {
+    return attributed("unknown", compatibilitySource(receipt, "autonomyEnforcement"), COMPATIBILITY_AUTHORITY, artifacts);
+  }
+  artifacts.push({ kind: "autonomy_policy", id: `${receipt.runId}:${enforcement.autonomy}` });
+  const authority = enforcement.grade === "mediated" ? { kind: "clio", id: "safety-autonomy" } : { kind: "runtime", id: enforcement.externalMode ?? "external-runtime" };
+  const state = enforcement.dangerousBypass === true || enforcement.grade === "bypassed" ? "bypassed" : enforcement.grade === "approximated" ? "approximated" : "enforced";
+  return attributed(state, receiptSource(receipt), authority, artifacts);
+}
+function receiptClaimsAreAuthenticated(receipt, integrity) {
+  return receipt?.integrity !== void 0 && integrity?.ok === true;
+}
+function unauthenticatedReceiptProjection(receipt, integrity) {
+  if (receipt === null || receipt === void 0) {
+    return {
+      validationGrounding: absentTrustStatus("artifact_missing"),
+      contextProvenance: absentTrustStatus("artifact_missing"),
+      autonomyEnforcement: absentTrustStatus("artifact_missing")
+    };
+  }
+  if (receipt.integrity === void 0) {
+    const artifacts = [receiptReference(receipt)];
+    return {
+      validationGrounding: attributed(
+        "unknown",
+        compatibilitySource(receipt, "canonical-projection"),
+        COMPATIBILITY_AUTHORITY,
+        artifacts
+      ),
+      contextProvenance: attributed(
+        "unknown",
+        compatibilitySource(receipt, "canonical-projection"),
+        COMPATIBILITY_AUTHORITY,
+        artifacts
+      ),
+      autonomyEnforcement: attributed(
+        "unknown",
+        compatibilitySource(receipt, "canonical-projection"),
+        COMPATIBILITY_AUTHORITY,
+        artifacts
+      )
+    };
+  }
+  if (integrity !== void 0 && !integrity.ok && integrity.retired !== void 0) {
+    return {
+      validationGrounding: absentTrustStatus("historical_format"),
+      contextProvenance: absentTrustStatus("historical_format"),
+      autonomyEnforcement: absentTrustStatus("historical_format")
+    };
+  }
+  return {
+    validationGrounding: absentTrustStatus("not_observed"),
+    contextProvenance: absentTrustStatus("not_observed"),
+    autonomyEnforcement: absentTrustStatus("not_observed")
+  };
+}
+function adaptRunReceiptTrustStatus(receipt, options = {}) {
+  const authenticated = receiptClaimsAreAuthenticated(receipt, options.integrity);
+  const receiptProjection = authenticated ? {
+    validationGrounding: adaptRunReceiptValidationStatus(receipt),
+    contextProvenance: adaptRunReceiptContextStatus(receipt),
+    autonomyEnforcement: adaptRunReceiptAutonomyStatus(receipt)
+  } : unauthenticatedReceiptProjection(receipt, options.integrity);
+  return composeTrustStatus({
+    artifactIntegrity: adaptReceiptIntegrityStatus(receipt, options.integrity),
+    ...receiptProjection,
+    independentReview: absentTrustStatus(receipt === null || receipt === void 0 ? "artifact_missing" : "not_recorded"),
+    completionEvidence: absentTrustStatus(
+      receipt === null || receipt === void 0 ? "artifact_missing" : "not_recorded"
+    )
+  });
+}
+function inspectRunReceiptTrustStatus(receipt, envelope) {
+  let integrity;
+  if (receipt === null || receipt === void 0) {
+    integrity = { ok: false, reason: "receipt unavailable" };
+  } else if (envelope === null || envelope === void 0) {
+    integrity = { ok: false, reason: "run ledger envelope unavailable" };
+  } else {
+    try {
+      integrity = verifyReceiptIntegrityOutcome(receipt, envelope);
+    } catch (error) {
+      integrity = {
+        ok: false,
+        reason: `receipt invalid: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  }
+  return {
+    integrity,
+    status: adaptRunReceiptTrustStatus(receipt, { integrity })
+  };
+}
+function gateReference(artifact) {
+  return sha256Reference("gate_decision", artifact.id, artifact.integrity.digest);
+}
+function gateAuthority(artifact) {
+  if (artifact.outcome === "operator-confirmed") return { kind: "operator", id: "gate-confirmation" };
+  if (artifact.outcome === "full-auto-applied") return { kind: "clio", id: "full-auto-gate-policy" };
+  return { kind: "reviewer", id: artifact.decider?.runId ?? "unavailable-decider" };
+}
+function adaptGateDecisionReviewStatus(artifact, subjectRunId, verification) {
+  if (artifact === null || artifact === void 0) return absentTrustStatus("artifact_missing");
+  const source = { kind: "gate_decision", id: artifact.id };
+  const artifacts = [gateReference(artifact)];
+  const authority = gateAuthority(artifact);
+  if (!artifact.subjects.some((subject) => subject.runId === subjectRunId)) return absentTrustStatus("not_recorded");
+  if (verification === void 0 || !verification.ok) {
+    return attributed(
+      "unknown",
+      source,
+      verification === void 0 ? COMPATIBILITY_AUTHORITY : { kind: "unknown", id: "unauthenticated-gate-artifact" },
+      artifacts
+    );
+  }
+  if (artifact.decider === void 0 || artifact.correlation === void 0) {
+    if (artifact.outcome === "operator-confirmed" || artifact.outcome === "full-auto-applied") {
+      return attributed("not_applicable", source, authority, artifacts);
+    }
+    return attributed("inconclusive", source, authority, artifacts);
+  }
+  if (!artifact.correlation.independent) return attributed("not_independent", source, authority, artifacts);
+  if (artifact.outcome === "pass") return attributed("passed", source, authority, artifacts);
+  if (artifact.outcome === "fail") return attributed("failed", source, authority, artifacts);
+  if (artifact.outcome === "winner") {
+    return attributed(
+      artifact.winner?.subject.runId === subjectRunId ? "passed" : "failed",
+      source,
+      authority,
+      artifacts
+    );
+  }
+  return attributed("inconclusive", source, authority, artifacts);
+}
+function adaptGroundedEvidenceValidationStatus(input) {
+  const observed = (input.artifacts ?? []).filter((artifact) => !SELF_REPORTED_ARTIFACT_KINDS.has(artifact.kind));
+  if (observed.length === 0) return absentTrustStatus("not_observed");
+  return attributed(
+    "validated",
+    { kind: "evidence_bundle", id: `${input.evidenceId}:${input.runId}` },
+    { kind: "clio", id: "evidence-grounding" },
+    uniqueBoundedReferences([{ kind: "evidence_bundle", id: input.evidenceId }, ...observed])
+  );
+}
+function adaptFinishContractCompletionStatus(assessment, options = {}) {
+  const artifacts = uniqueBoundedReferences(
+    options.artifacts ?? assessment.evidence.map((evidence, index) => ({
+      kind: evidence.turnId === void 0 ? "finish_contract_evidence" : "session_entry",
+      id: evidence.turnId ?? `${evidence.kind}:${index + 1}`
+    }))
+  );
+  const source = { kind: "finish_contract", id: options.sourceId ?? assessment.reason };
+  const authority = { kind: "clio", id: "finish-contract" };
+  if (assessment.reason === "no_mutation") return attributed("not_applicable", source, authority, artifacts);
+  if (assessment.reason === "validation_evidence") return attributed("evidenced", source, authority, artifacts);
+  if (assessment.reason === "explicit_limitation") return attributed("limited", source, authority, artifacts);
+  return attributed("incomplete", source, authority, artifacts);
+}
+function uniqueBoundedReferences(references) {
+  const sorted = [...references].sort(compareArtifactReferences);
+  const unique = sorted.filter(
+    (reference, index) => index === 0 || compareArtifactReferences(sorted[index - 1], reference) !== 0
+  );
+  return unique.slice(0, TRUST_STATUS_MAX_ARTIFACT_REFERENCES);
+}
+
 // src/domains/eval/provenance.ts
 init_esm_shims();
 import { spawnSync } from "node:child_process";
@@ -933,7 +1508,7 @@ function parseEvalTaskFileYaml(raw) {
 }
 function validateEvalTaskFile(value) {
   const issues = [];
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return { valid: false, issues: [{ path: "$", message: "expected object" }] };
   }
   if (value.version !== EVAL_TASK_FILE_VERSION) {
@@ -969,7 +1544,7 @@ var EvalTaskFileError = class extends Error {
   }
 };
 function parseTask(value, path, issues) {
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     issues.push({ path, message: "expected object" });
     return null;
   }
@@ -1043,13 +1618,158 @@ function readPositiveInteger(record, path, field, issues) {
   }
   return value;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256Hex(content) {
   return createHash3("sha256").update(content, "utf8").digest("hex");
 }
 
+// src/domains/evidence/trust-projection.ts
+init_esm_shims();
+var TRUST_SUMMARY_VERSION = 1;
+var TRUST_SUMMARY_MAX_REFS = 8;
+var TRUST_STATE_WORDS = {
+  artifactIntegrity: {
+    verified: "sealed",
+    failed: "seal broken",
+    absent: "no receipt",
+    unknown: "seal unchecked",
+    not_applicable: "seal not applicable"
+  },
+  validationGrounding: {
+    validated: "grounded",
+    failed: "validation failed",
+    ungrounded: "inferred: validation claimed, none observed",
+    absent: "no validation observed",
+    unknown: "validation unknown",
+    not_applicable: "validation not applicable"
+  },
+  independentReview: {
+    passed: "independently reviewed: pass",
+    failed: "independently reviewed: fail",
+    inconclusive: "independent review inconclusive",
+    not_independent: "review not independent",
+    absent: "not independently reviewed",
+    unknown: "independent review unknown",
+    not_applicable: "independent review not applicable"
+  },
+  contextProvenance: {
+    recorded: "context recorded",
+    invalid: "context record invalid",
+    absent: "context not recorded",
+    unknown: "context unknown",
+    not_applicable: "context not applicable"
+  },
+  autonomyEnforcement: {
+    enforced: "mediated",
+    approximated: "approximated",
+    bypassed: "bypassed",
+    absent: "autonomy not recorded",
+    unknown: "autonomy unknown",
+    not_applicable: "autonomy not applicable"
+  },
+  completionEvidence: {
+    evidenced: "completion evidenced",
+    incomplete: "completion unevidenced",
+    limited: "completion limited",
+    absent: "completion not recorded",
+    unknown: "completion unknown",
+    not_applicable: "completion not applicable"
+  }
+};
+function trustStateWord(axis, state) {
+  const words = TRUST_STATE_WORDS[axis];
+  return words[state] ?? words.unknown ?? "unknown";
+}
+function authorityOf(status, axis) {
+  const entry = status[axis];
+  return entry.state === "absent" ? null : `${entry.authority.kind}:${entry.authority.id}`;
+}
+function integrityClause(status) {
+  const retired = retiredIntegrityVersionOf(status.artifactIntegrity);
+  if (retired !== null) return `seal v${retired} retired (this build verifies v${RUN_RECEIPT_INTEGRITY_VERSION})`;
+  return trustStateWord("artifactIntegrity", status.artifactIntegrity.state);
+}
+function validationClause(status) {
+  const entry = status.validationGrounding;
+  const word = trustStateWord("validationGrounding", entry.state);
+  if (entry.state === "absent") return word;
+  if (entry.state === "validated" || entry.state === "failed") return `${word} by ${entry.authority.id}`;
+  if (entry.state === "unknown" && entry.authority.kind !== "unknown") return `${word} (${entry.authority.id})`;
+  return word;
+}
+function autonomyClause(status) {
+  const entry = status.autonomyEnforcement;
+  const word = trustStateWord("autonomyEnforcement", entry.state);
+  if (entry.state !== "approximated" && entry.state !== "bypassed") return word;
+  return `${word} (${entry.authority.id})`;
+}
+function formatTrustSummary(status) {
+  return [
+    integrityClause(status),
+    validationClause(status),
+    trustStateWord("independentReview", status.independentReview.state),
+    autonomyClause(status),
+    trustStateWord("contextProvenance", status.contextProvenance.state),
+    trustStateWord("completionEvidence", status.completionEvidence.state)
+  ].join("; ");
+}
+function formatTrustSummaryLine(status) {
+  return `trust v${TRUST_SUMMARY_VERSION}: ${formatTrustSummary(status)}`;
+}
+function formatTrustAxes(status) {
+  return [`trust_status=v${status.version}`, ...TRUST_STATUS_AXES.map((axis) => `${axis}:${status[axis].state}`)].join(
+    " "
+  );
+}
+function isUnanswered(status, axis) {
+  const state = status[axis].state;
+  return state === "absent" || state === "unknown";
+}
+function trustVerdict(status) {
+  const integrity = status.artifactIntegrity.state;
+  const validation = status.validationGrounding.state;
+  const review = status.independentReview.state;
+  const autonomy = status.autonomyEnforcement.state;
+  if (integrity === "failed" || autonomy === "bypassed" || validation === "failed" || validation === "ungrounded" || review === "failed" || review === "not_independent" || status.contextProvenance.state === "invalid") {
+    return "compromised";
+  }
+  if (integrity !== "verified") return "unknown";
+  if (review === "passed") return "reviewed";
+  if (validation === "validated") return "grounded";
+  return "unverified";
+}
+function claimantOf(status) {
+  const state = status.validationGrounding.state;
+  if (state === "absent" || state === "ungrounded") return "worker";
+  return authorityOf(status, "validationGrounding") ?? "worker";
+}
+function referenceKey(reference) {
+  return `${reference.kind}:${reference.id}`;
+}
+function trustSummaryReferences(status) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const axis of TRUST_STATUS_AXES) {
+    const entry = status[axis];
+    if (entry.state === "absent") continue;
+    for (const reference of entry.artifacts) keys.add(referenceKey(reference));
+  }
+  return [...keys].sort().slice(0, TRUST_SUMMARY_MAX_REFS);
+}
+function summarizeTrustStatus(status) {
+  const axes = Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, status[axis].state]));
+  return {
+    version: TRUST_SUMMARY_VERSION,
+    verdict: trustVerdict(status),
+    text: formatTrustSummary(status),
+    axes,
+    claimant: claimantOf(status),
+    unknown: TRUST_STATUS_AXES.filter((axis) => isUnanswered(status, axis)),
+    refs: trustSummaryReferences(status)
+  };
+}
+
 export {
   RUN_RECEIPT_INTEGRITY_VERSION,
   RUN_RECEIPT_INTEGRITY_ALGORITHM,
@@ -1065,9 +1785,25 @@ export {
   writeEvalArtifactV4,
   loadEvalArtifactV4,
   parseEvalArtifactV4,
+  TRUST_STATUS_AXES,
+  isTrustStatusIdentifier,
+  normalizeTrustStatus,
+  composeTrustStatus,
+  retiredReceiptIntegrity,
+  retiredReceiptIntegrityReason,
+  retiredIntegrityVersionOf,
+  adaptRunReceiptTrustStatus,
+  inspectRunReceiptTrustStatus,
+  adaptGateDecisionReviewStatus,
+  adaptGroundedEvidenceValidationStatus,
+  adaptFinishContractCompletionStatus,
   evalClioProvenance,
   evalEnvironmentProvenance,
   loadEvalTaskFile,
-  EvalTaskFileError
+  EvalTaskFileError,
+  formatTrustSummary,
+  formatTrustSummaryLine,
+  formatTrustAxes,
+  summarizeTrustStatus
 };
-//# sourceMappingURL=chunk-OH3TOQTB.js.map
+//# sourceMappingURL=chunk-K4XHGFR5.js.map