@iowarp/clio-coder 0.3.7 → 0.3.9

package/src/domains/evidence/build.ts

@@ -24,13 +24,14 @@ import {
 	type SessionEntry,
 } from "../session/index.js";
 import { attributeEvidenceFailure } from "./failure-attribution.js";
+import { renderEvidenceFindingsMarkdown } from "./findings-markdown.js";
 import { compareCodepoints as compareStrings } from "./ordering.js";
 import { extractRunProvenance, provenanceTranscriptLines } from "./provenance.js";
 import { createRedactionTally, redactSecretsDeep, redactSecretsText } from "./redact.js";
 import { buildEvidenceTrustStatusFile } from "./run-trust.js";
 import { EVIDENCE_FILES, evidenceDirectory, findingsFile } from "./store.js";
-import type { TrustArtifactReference } from "./trust-status.js";
-import { inspectRunReceiptTrustStatus } from "./trust-status.js";
+import type { CanonicalTrustStatus, TrustArtifactReference } from "./trust-status.js";
+import { inspectRunReceiptTrustStatus, retiredIntegrityVersionOf } from "./trust-status.js";
 import {
 	EVIDENCE_VERSION,
 	type EvidenceAuditLinkedRow,
@@ -45,6 +46,7 @@ import {
 	type EvidenceReceiptFile,
 	type EvidenceRunLink,
 	type EvidenceRunSource,
+	type EvidenceSeverity,
 	type EvidenceTag,
 	type EvidenceToolEvent,
 	type EvidenceTrustStatusFile,
@@ -158,7 +160,6 @@ export async function buildEvidence(options: BuildEvidenceOptions): Promise<Evid
 		evidenceId,
 		runSources,
 		gateDecisions: gateDecisions.decisions,
-		auditRows: auditLinks.rows,
 		validationEvidence,
 	});
 	const findings = buildFindings(runSources, trustStatusRaw, sessionLinks, auditLinks, protectedArtifactsRaw);
@@ -195,7 +196,10 @@ export async function buildEvidence(options: BuildEvidenceOptions): Promise<Evid
 		redactedToolEvents,
 		protectedArtifacts,
 	);
-	const transcript = redactSecretsText(renderTranscript(overview, redactedRunSources, sessionLinks), tally);
+	const transcript = redactSecretsText(
+		renderTranscript(overview, redactedRunSources, sessionLinks, trustStatusRaw),
+		tally,
+	);
 	const finalOverview: EvidenceOverview = { ...overview, redactionCount: tally.count };
 	await writeEvidenceFiles(
 		directory,
@@ -285,8 +289,14 @@ function buildFindings(
 		const status = trustByRun.get(source.envelope.id);
 		if (status === undefined) throw new Error(`canonical trust status missing for run ${source.envelope.id}`);
 		if (source.receiptError !== null) {
-			const tag = source.receiptIntegrityFailed ? "receipt-integrity" : "unknown";
-			findings.push(finding(findings.length, "warn", tag, source.envelope.id, source.receiptError));
+			// The canonical axis, not the raw reason string, says whether the seal
+			// was retired: `receipt-retired` is the expected state of every run
+			// that predates an integrity bump and is an info row, while
+			// `receipt-integrity` stays the warning for a seal that was checked
+			// and rejected.
+			const retired = retiredIntegrityVersionOf(status.artifactIntegrity) !== null;
+			const tag = retired ? "receipt-retired" : source.receiptIntegrityFailed ? "receipt-integrity" : "unknown";
+			findings.push(finding(findings.length, retired ? "info" : "warn", tag, source.envelope.id, source.receiptError));
 		}
 		if (
 			isSuccessfulRun(source) &&
@@ -359,6 +369,13 @@ function buildFindings(
 				),
 			);
 		}
+		// The remaining axes were never read here, so a run could finish with
+		// no independent review, a contradictory context record, or a mutation
+		// nobody validated, and findings.md said nothing. Each finding is
+		// selected from the canonical state the way the validation and
+		// autonomy findings above are, with the detailed record left in
+		// trust-status.json.
+		findings.push(...axisFindings(findings.length, source, status));
 		if (source.envelope.status === "stale" || source.envelope.status === "dead") {
 			findings.push(
 				finding(findings.length, "warn", "timeout", source.envelope.id, `run status ${source.envelope.status}`),
@@ -601,7 +618,7 @@ async function writeEvidenceFiles(
 	await writeJson(join(directory, "overview.json"), overview);
 	await writeFile(
 		join(directory, "transcript.md"),
-		transcript ?? renderTranscript(overview, runSources, sessionLinks),
+		transcript ?? renderTranscript(overview, runSources, sessionLinks, trustStatus),
 		"utf8",
 	);
 	await writeJsonl(join(directory, "trace.raw.jsonl"), rawTraceRows(runSources));
@@ -613,7 +630,7 @@ async function writeEvidenceFiles(
 	await writeJson(join(directory, "trust-status.json"), trustStatus);
 	await writeJson(join(directory, "protected-artifacts.json"), protectedArtifacts);
 	await writeJson(join(directory, "findings.json"), findingsFile(overview.evidenceId, [...findings]));
-	await writeFile(join(directory, "findings.md"), renderFindings(findings), "utf8");
+	await writeFile(join(directory, "findings.md"), renderEvidenceFindingsMarkdown(findings, trustStatus), "utf8");
 }
 
 function rawTraceRows(runSources: ReadonlyArray<EvidenceRunSource>): EvidenceRawTraceRow[] {
@@ -636,9 +653,11 @@ function cleanedTraceRows(
 	const rows: EvidenceCleanTraceRow[] = [];
 	for (const source of runSources) {
 		const envelope = source.envelope;
-		// Clean trace rows project only provenance carried by the sealed receipt.
+		// Clean trace rows project only provenance carried by an authenticated
+		// receipt: a rejected or retired seal contributes none of its fields.
 		// Runs without receipt provenance keep the standard row shape.
-		const provenance = source.receipt === null ? {} : extractRunProvenance(source.receipt);
+		const receipt = authenticatedReceipt(source);
+		const provenance = receipt === null ? {} : extractRunProvenance(receipt);
 		rows.push({
 			kind: "run",
 			runId: envelope.id,
@@ -1258,7 +1277,9 @@ function renderTranscript(
 	overview: EvidenceOverview,
 	runSources: ReadonlyArray<EvidenceRunSource>,
 	sessionLinks: SessionLinkResult,
+	trustStatus: EvidenceTrustStatusFile,
 ): string {
+	const trustByRun = new Map(trustStatus.runs.map((entry) => [entry.runId, entry.status]));
 	const lines = [
 		`# Evidence ${overview.evidenceId}`,
 		"",
@@ -1274,10 +1295,11 @@ function renderTranscript(
 			`- ${envelope.id} status=${envelope.status} exit=${exitCode ?? "?"} agent=${envelope.agentId} target=${envelope.targetId}`,
 		);
 		lines.push(`  task: ${truncateText(envelope.task, MAX_TASK_CHARS)}`);
-		// Run section rendering reads provenance from the sealed receipt and adds
-		// sentences only for fields that are present.
+		// Run section rendering adds a sentence per provenance field the
+		// canonical projection admits; a rejected or retired seal adds none.
 		if (source.receipt !== null) {
-			for (const line of provenanceTranscriptLines(extractRunProvenance(source.receipt))) {
+			const status = trustByRun.get(envelope.id);
+			for (const line of provenanceTranscriptLines(extractRunProvenance(source.receipt), status)) {
 				lines.push(`  ${line}`);
 			}
 		}
@@ -1438,15 +1460,37 @@ function renderSessionTranscriptEntry(linked: LinkedSessionEntry): string[] {
 	return [`${prefix} ${String(_exhaustive)}`];
 }
 
-function renderFindings(findings: ReadonlyArray<EvidenceFinding>): string {
-	if (findings.length === 0) return "# Findings\n\nNo findings.\n";
-	const lines = ["# Findings", ""];
-	for (const item of findings) {
-		const run = item.runId === null ? "" : ` run=${item.runId}`;
-		lines.push(`- ${item.id} [${item.severity}] ${item.tag}${run}: ${item.message}`);
+/** Independent review, context provenance, and completion evidence, read off the canonical axes. */
+function axisFindings(offset: number, source: EvidenceRunSource, status: CanonicalTrustStatus): EvidenceFinding[] {
+	const out: EvidenceFinding[] = [];
+	const runId = source.envelope.id;
+	const next = (severity: EvidenceSeverity, tag: EvidenceTag, message: string): void => {
+		out.push(finding(offset + out.length, severity, tag, runId, message));
+	};
+	const review = status.independentReview.state;
+	if (review === "failed") {
+		next("warn", "independent-review", "independent review failed for this run");
+	} else if (review === "not_independent") {
+		next("warn", "independent-review", "review was not independent of the run it judged");
+	} else if (review === "inconclusive") {
+		next("info", "independent-review", "independent review was inconclusive");
+	} else if (isSuccessfulRun(source) && (review === "absent" || review === "unknown")) {
+		next("info", "independent-review", "run was not independently reviewed; its result rests on its own receipt");
 	}
-	lines.push("");
-	return `${lines.join("\n")}\n`;
+	if (status.contextProvenance.state === "invalid") {
+		next("warn", "context-provenance", "context provenance record is contradictory; see trust-status.json");
+	}
+	const completion = status.completionEvidence.state;
+	if (completion === "incomplete") {
+		next(
+			"warn",
+			"completion-evidence",
+			"run mutated the workspace and finished without validation evidence at the completion boundary",
+		);
+	} else if (completion === "limited") {
+		next("info", "completion-evidence", "run finished with an explicit limitation instead of validation evidence");
+	}
+	return out;
 }
 
 async function readRunLedger(stateDir: string): Promise<RunLedgerRows> {
@@ -1507,6 +1551,9 @@ async function readReceipt(
 	}
 	const integrity = inspectRunReceiptTrustStatus(receipt, envelope).integrity;
 	if (!integrity.ok) {
+		// A retired seal is set aside unread, the way a missing receipt is; it
+		// is not a failed one, and its reason already names both versions.
+		if (integrity.retired !== undefined) return { receipt, error: integrity.reason, integrityFailed: false };
 		return { receipt, error: `receipt integrity: ${integrity.reason}`, integrityFailed: true };
 	}
 	return { receipt, error: null, integrityFailed: false };

package/src/domains/evidence/eval.ts

@@ -5,6 +5,7 @@ import { readGateDecisionArtifactsForRunIds } from "../dispatch/index.js";
 import { redactArtifactForStorage } from "../eval/artifacts/redact.js";
 import type { EvalCommandResult, EvalRunArtifact, EvalRunRecord } from "../eval/index.js";
 import { loadEvalArtifact } from "../eval/index.js";
+import { renderEvidenceFindingsMarkdown } from "./findings-markdown.js";
 import { compareCodepoints as compareStrings } from "./ordering.js";
 import { buildEvidenceTrustStatusFile } from "./run-trust.js";
 import { evidenceDirectory, findingsFile } from "./store.js";
@@ -95,7 +96,6 @@ export async function buildEvalEvidence(options: BuildEvalEvidenceOptions): Prom
 		evidenceId,
 		runSources: linkedRuns.runSources,
 		gateDecisions: gateDecisions.decisions,
-		auditRows: linkedRuns.auditRows,
 	});
 	await writeEvalEvidenceFiles(
 		directory,
@@ -258,7 +258,7 @@ async function writeEvalEvidenceFiles(
 	await writeJson(join(directory, "protected-artifacts.json"), emptyProtected);
 	await writeJson(join(directory, "eval-result.json"), redactedArtifact);
 	await writeJson(join(directory, "findings.json"), findingsFile(overview.evidenceId, [...findings]));
-	await writeFile(join(directory, "findings.md"), renderFindings(findings), "utf8");
+	await writeFile(join(directory, "findings.md"), renderEvidenceFindingsMarkdown(findings, trustStatus), "utf8");
 }
 
 function rawEvalTraceRows(artifact: EvalRunArtifact): EvidenceEvalRawTraceRow[] {
@@ -360,16 +360,6 @@ function renderEvalTranscript(artifact: EvalRunArtifact, overview: EvidenceOverv
 	return `${lines.join("\n")}\n`;
 }
 
-function renderFindings(findings: ReadonlyArray<EvidenceFinding>): string {
-	if (findings.length === 0) return "No findings.\n";
-	const lines = ["# Findings", ""];
-	for (const finding of findings) {
-		lines.push(`- ${finding.id} [${finding.severity}] ${finding.tag}: ${finding.message}`);
-	}
-	lines.push("");
-	return `${lines.join("\n")}\n`;
-}
-
 async function writeJson(path: string, value: unknown): Promise<void> {
 	await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
 }

package/src/domains/evidence/findings-markdown.ts

@@ -0,0 +1,33 @@
+import { formatTrustAxes, formatTrustSummary, trustVerdict } from "./trust-projection.js";
+import type { EvidenceFinding, EvidenceTrustStatusFile } from "./types.js";
+
+/** Render the canonical verdict before the diagnostic records in every evidence bundle. */
+export function renderEvidenceFindingsMarkdown(
+	findings: ReadonlyArray<EvidenceFinding>,
+	trustStatus: EvidenceTrustStatusFile,
+): string {
+	const lines = ["# Findings", "", "## Canonical trust", ""];
+	if (trustStatus.runs.length === 0) {
+		lines.push("No linked run trust status.");
+	} else {
+		for (const run of trustStatus.runs) {
+			lines.push(
+				`- run=${run.runId}`,
+				`  tier: ${trustVerdict(run.status)}`,
+				`  summary: ${formatTrustSummary(run.status)}`,
+				`  axes: ${formatTrustAxes(run.status)}`,
+			);
+		}
+	}
+	lines.push("", "## Finding records", "");
+	if (findings.length === 0) {
+		lines.push("No findings.");
+	} else {
+		for (const item of findings) {
+			const run = item.runId === null ? "" : ` run=${item.runId}`;
+			lines.push(`- ${item.id} [${item.severity}] ${item.tag}${run}: ${item.message}`);
+		}
+	}
+	lines.push("");
+	return `${lines.join("\n")}\n`;
+}

package/src/domains/evidence/index.ts

@@ -5,6 +5,7 @@ export { buildEvalEvidence, evalEvidenceId } from "./eval.js";
 export { FINISH_CONTRACT_EVIDENCE_TAGS, finishContractEvidenceTags } from "./finish-contract-map.js";
 export type { RunEscalationCounts, RunProvenanceView } from "./provenance.js";
 export {
+	admitRunProvenance,
 	extractRunProvenance,
 	hasRunProvenance,
 	PERSONA_HASH_PREFIX_CHARS,
@@ -22,6 +23,20 @@ export {
 	loadEvidenceRunProvenance,
 	loadEvidenceTrustStatus,
 } from "./store.js";
+export type { TrustSummaryProjection, TrustVerdict } from "./trust-projection.js";
+export {
+	formatTrustAxes,
+	formatTrustSummary,
+	formatTrustSummaryLine,
+	summarizeTrustStatus,
+	TRUST_STATE_WORDS,
+	TRUST_SUMMARY_MAX_REFS,
+	TRUST_SUMMARY_VERSION,
+	TRUST_VERDICTS,
+	trustStateWord,
+	trustSummaryReferences,
+	trustVerdict,
+} from "./trust-projection.js";
 export type {
 	AbsentTrustStatus,
 	AdaptFinishContractTrustOptions,
@@ -35,6 +50,8 @@ export type {
 	GroundedEvidenceValidationInput,
 	IndependentReviewStatus,
 	PersistedRunReceiptTrustFacts,
+	ReceiptIntegrityOutcome,
+	RetiredReceiptIntegrity,
 	RunReceiptTrustInspection,
 	TrustAbsenceReason,
 	TrustArtifactKind,
@@ -63,12 +80,16 @@ export {
 	inspectRunReceiptTrustStatus,
 	normalizeTrustStatus,
 	projectTrustStatus,
+	retiredIntegrityVersionOf,
+	retiredReceiptIntegrity,
+	retiredReceiptIntegrityReason,
 	TRUST_STATUS_AXES,
 	TRUST_STATUS_MAX_ARTIFACT_REFERENCES,
 	TRUST_STATUS_MAX_IDENTIFIER_LENGTH,
 	TRUST_STATUS_STATES,
 	TRUST_STATUS_VERSION,
 	validateTrustStatus,
+	verifyReceiptIntegrityOutcome,
 } from "./trust-status.js";
 export type {
 	EvidenceAuditLinkedRow,

package/src/domains/evidence/provenance.ts

@@ -4,6 +4,7 @@ import type {
 	RunReceipt,
 	RunReceiptAutonomyEnforcement,
 } from "../dispatch/types.js";
+import type { CanonicalTrustStatus } from "./trust-status.js";
 
 /**
  * Worker permission-escalation counters projected from sealed receipt
@@ -50,6 +51,33 @@ export function extractRunProvenance(receipt: ProvenanceReceipt): RunProvenanceV
 	return view;
 }
 
+/**
+ * The slice of a provenance view the canonical projection admits. The
+ * projection is the only thing that decides whether an axis is reported, so
+ * the autonomy detail (`autonomy=`, `mode=`, `dangerousBypass=`) is kept only
+ * when the projection reports the autonomy axis in a recorded state, and the
+ * non-axis provenance (pipeline, persona override, escalations) only when the
+ * seal that carries it verified. With no projection at hand no axis detail is
+ * admitted at all, whatever the receipt says; the non-axis provenance passes
+ * through for a caller that prints it beside its own integrity banner.
+ */
+export function admitRunProvenance(view: RunProvenanceView, status?: CanonicalTrustStatus): RunProvenanceView {
+	const admitted: RunProvenanceView = {};
+	if (status === undefined || status.artifactIntegrity.state === "verified") {
+		if (view.pipeline !== undefined) admitted.pipeline = view.pipeline;
+		if (view.personaOverride !== undefined) admitted.personaOverride = view.personaOverride;
+		if (view.escalation !== undefined) admitted.escalation = view.escalation;
+	}
+	const autonomy = status?.autonomyEnforcement.state;
+	if (
+		view.autonomyEnforcement !== undefined &&
+		(autonomy === "enforced" || autonomy === "approximated" || autonomy === "bypassed")
+	) {
+		admitted.autonomyEnforcement = view.autonomyEnforcement;
+	}
+	return admitted;
+}
+
 /** True when at least one provenance field set is present. */
 export function hasRunProvenance(view: RunProvenanceView): boolean {
 	return (
@@ -144,10 +172,15 @@ function formatPersonaHashPrefix(promptHash: string): string {
 }
 
 /**
- * Human transcript sentences for each present provenance field set.
- * An empty view adds no lines to the transcript run section.
+ * Human transcript sentences for each admitted provenance field set, gated
+ * through {@link admitRunProvenance}. The autonomy line carries only the
+ * detail the canonical projection does not: the policy name, the external
+ * mode, and the bypass flag. The axis itself (mediated, approximated,
+ * bypassed) is printed by the trust summary and nowhere else, so one
+ * autonomy fact never appears in two vocabularies on one screen.
  */
-export function provenanceTranscriptLines(view: RunProvenanceView): string[] {
+export function provenanceTranscriptLines(source: RunProvenanceView, status?: CanonicalTrustStatus): string[] {
+	const view = admitRunProvenance(source, status);
 	const lines: string[] = [];
 	if (view.pipeline !== undefined) {
 		const { fromRunId, position, inputBytes, inputTruncated } = view.pipeline;
@@ -163,20 +196,22 @@ export function provenanceTranscriptLines(view: RunProvenanceView): string[] {
 		lines.push(`escalations: ${requested} requested, ${approved} approved, ${denied} denied, ${timedOut} timed out`);
 	}
 	if (view.autonomyEnforcement !== undefined) {
-		const { grade, autonomy, externalMode, dangerousBypass } = view.autonomyEnforcement;
+		const { autonomy, externalMode, dangerousBypass } = view.autonomyEnforcement;
 		const mode = externalMode !== undefined ? ` mode=${externalMode}` : "";
 		const bypass = dangerousBypass === true ? " dangerousBypass=true" : "";
-		lines.push(`autonomy enforcement: ${grade} autonomy=${autonomy}${mode}${bypass}`);
+		lines.push(`autonomy: ${autonomy}${mode}${bypass}`);
 	}
 	return lines;
 }
 
 /**
- * Compact ` key=value` suffix for the dispatch tool's per-run and CLI lines.
- * The leading space lets callers append it directly. An empty provenance view
- * returns an empty string.
+ * Compact ` key=value` suffix for the dispatch tool's per-run and CLI lines,
+ * gated through {@link admitRunProvenance} on the same terms as the
+ * transcript lines. The leading space lets callers append it directly. An
+ * empty admitted view returns an empty string.
  */
-export function provenanceCompactSuffix(view: RunProvenanceView): string {
+export function provenanceCompactSuffix(source: RunProvenanceView, status?: CanonicalTrustStatus): string {
+	const view = admitRunProvenance(source, status);
 	const parts: string[] = [];
 	if (view.pipeline !== undefined) {
 		const { fromRunId, position, inputBytes, inputTruncated } = view.pipeline;
@@ -191,10 +226,10 @@ export function provenanceCompactSuffix(view: RunProvenanceView): string {
 		parts.push(`escalations=${requested}req/${approved}appr/${denied}deny/${timedOut}timeout`);
 	}
 	if (view.autonomyEnforcement !== undefined) {
-		const { grade, autonomy, externalMode, dangerousBypass } = view.autonomyEnforcement;
+		const { autonomy, externalMode, dangerousBypass } = view.autonomyEnforcement;
 		const mode = externalMode !== undefined ? `/${externalMode}` : "";
 		const bypass = dangerousBypass === true ? "/bypass" : "";
-		parts.push(`enforcement=${grade}:${autonomy}${mode}${bypass}`);
+		parts.push(`autonomy=${autonomy}${mode}${bypass}`);
 	}
 	return parts.length === 0 ? "" : ` ${parts.join(" ")}`;
 }

package/src/domains/evidence/run-trust.ts

@@ -1,9 +1,7 @@
 import { type GateDecisionArtifact, verifyGateDecisionArtifact } from "../dispatch/gate-decisions.js";
 import type { RunEnvelope, RunReceipt } from "../dispatch/types.js";
-import type { FinishContractAssessment, FinishContractEvidenceKind } from "../safety/finish-contract.js";
 import { compareCodepoints as compareStrings } from "./ordering.js";
 import {
-	adaptFinishContractCompletionStatus,
 	adaptGateDecisionReviewStatus,
 	adaptGroundedEvidenceValidationStatus,
 	type CanonicalTrustStatus,
@@ -12,7 +10,7 @@ import {
 	isTrustStatusIdentifier,
 	type TrustArtifactReference,
 } from "./trust-status.js";
-import { EVIDENCE_VERSION, type EvidenceAuditLinkedRow, type EvidenceTrustStatusFile } from "./types.js";
+import { EVIDENCE_VERSION, type EvidenceTrustStatusFile } from "./types.js";
 
 export interface EvidenceRunTrustSource {
 	envelope: RunEnvelope;
@@ -23,15 +21,15 @@ export interface BuildEvidenceTrustStatusInput {
 	evidenceId: string;
 	runSources: ReadonlyArray<EvidenceRunTrustSource>;
 	gateDecisions: ReadonlyArray<GateDecisionArtifact>;
-	auditRows: ReadonlyArray<EvidenceAuditLinkedRow>;
 	validationEvidence?: ReadonlyMap<string, ReadonlyArray<TrustArtifactReference>>;
 }
 
 /**
  * Compose every evidence-linked trust axis at one pure boundary. Both the
  * run/session and eval builders call this function, so the same authenticated
- * receipt, gate decision, and exact finish-contract row cannot project
- * differently merely because it was bundled through a different entry point.
+ * receipt and gate decision cannot project differently merely because the
+ * receipt was bundled through a different entry point. Completion evidence
+ * stays receipt-derived so an audit row cannot change one surface alone.
  */
 export function buildEvidenceTrustStatusFile(input: BuildEvidenceTrustStatusInput): EvidenceTrustStatusFile {
 	return {
@@ -44,7 +42,6 @@ export function buildEvidenceTrustStatusFile(input: BuildEvidenceTrustStatusInpu
 				evidenceId: input.evidenceId,
 				source,
 				gateDecisions: input.gateDecisions,
-				auditRows: input.auditRows,
 				validationEvidence: input.validationEvidence?.get(source.envelope.id) ?? [],
 			}),
 		})),
@@ -55,22 +52,15 @@ interface ComposeEvidenceRunTrustInput {
 	evidenceId: string;
 	source: EvidenceRunTrustSource;
 	gateDecisions: ReadonlyArray<GateDecisionArtifact>;
-	auditRows: ReadonlyArray<EvidenceAuditLinkedRow>;
 	validationEvidence: ReadonlyArray<TrustArtifactReference>;
 }
 
 function composeEvidenceRunTrustStatus(input: ComposeEvidenceRunTrustInput): CanonicalTrustStatus {
 	const inspection = inspectRunReceiptTrustStatus(input.source.receipt, input.source.envelope);
-	// A receipt that was presented and rejected authenticates nothing about the
-	// run it names. Its integrity failure stays on `artifactIntegrity`; no other
-	// axis may reach a trust-granting state on the strength of that run's own
-	// self-reports. A missing or unchecked receipt is not a rejection.
-	const receiptRejected = inspection.status.artifactIntegrity.state === "failed";
 	let status = inspection.status;
-	// Only independently observed executions ground validation. The
-	// completion-contract audit row is the run's own self-report: it feeds
-	// `completionEvidence` below and nothing else. The cross-axis rules this
-	// enforces are listed under "composition rules" in docs/evidence-and-memory.md.
+	// Only independently observed executions ground validation. A completion
+	// contract audit row is the run's own self-report and cannot override the
+	// receipt-derived completion axis on this surface alone.
 	const grounded = input.validationEvidence.filter((artifact) => isTrustStatusIdentifier(artifact.id));
 	if (
 		grounded.length > 0 &&
@@ -106,25 +96,6 @@ function composeEvidenceRunTrustStatus(input: ComposeEvidenceRunTrustInput): Can
 			independentReview: adaptGateDecisionReviewStatus(gate, input.source.envelope.id, verification),
 		});
 	}
-
-	const finish = latestFinishContractForRun(input.auditRows, input.source.envelope.id);
-	if (finish !== null) {
-		const completion = adaptFinishContractCompletionStatus(finish.assessment, {
-			sourceId: finish.sourceId,
-			artifacts: finish.artifacts,
-		});
-		status = composeTrustStatus(status, {
-			completionEvidence:
-				receiptRejected && completion.state === "evidenced"
-					? {
-							state: "unknown",
-							source: { kind: "finish_contract", id: finish.sourceId },
-							authority: { kind: "clio", id: "finish-contract" },
-							artifacts: finish.artifacts,
-						}
-					: completion,
-		});
-	}
 	return status;
 }
 
@@ -142,80 +113,3 @@ function latestGateDecisionForRun(
 			.at(-1) ?? null
 	);
 }
-
-interface EvidenceFinishContractProjection {
-	sourceId: string;
-	assessment: FinishContractAssessment;
-	artifacts: TrustArtifactReference[];
-}
-
-function latestFinishContractForRun(
-	rows: ReadonlyArray<EvidenceAuditLinkedRow>,
-	runId: string,
-): EvidenceFinishContractProjection | null {
-	const candidates = rows
-		.filter((row) => row.auditKind === "completion_contract" && row.runId === runId && row.confidence === "exact")
-		.flatMap((row) => {
-			const assessment = finishContractAssessmentFromAudit(row.row);
-			if (assessment === null) return [];
-			const correlationId = readOptionalString(row.row.correlationId) ?? `${runId}:completion-contract`;
-			// A malformed row is dropped from the trust projection rather than
-			// thrown out of the whole forensic build. `readAuditRows` already
-			// reports the malformed line, so the bundle stays honest about it.
-			if (!isTrustStatusIdentifier(correlationId)) return [];
-			const turnId = readOptionalString(row.row.turnId);
-			const artifacts: TrustArtifactReference[] = [
-				{ kind: "finish_contract_evidence", id: correlationId },
-				...(turnId === null || !isTrustStatusIdentifier(turnId) ? [] : [{ kind: "session_entry" as const, id: turnId }]),
-			];
-			return [{ sourceId: correlationId, assessment, artifacts, timestamp: row.ts ?? "" }];
-		})
-		.sort(
-			(left, right) => compareStrings(left.timestamp, right.timestamp) || compareStrings(left.sourceId, right.sourceId),
-		);
-	const latest = candidates.at(-1);
-	return latest === undefined
-		? null
-		: { sourceId: latest.sourceId, assessment: latest.assessment, artifacts: latest.artifacts };
-}
-
-function finishContractAssessmentFromAudit(row: Record<string, unknown>): FinishContractAssessment | null {
-	const reason = readOptionalString(row.reason);
-	const decision = readOptionalString(row.decision);
-	const mutatedPaths = Array.isArray(row.mutatedPaths)
-		? row.mutatedPaths.filter((entry): entry is string => typeof entry === "string")
-		: [];
-	const turnId = readOptionalString(row.turnId);
-	const evidenceKinds = Array.isArray(row.evidenceKinds) ? row.evidenceKinds.filter(isFinishContractEvidenceKind) : [];
-	const evidence = evidenceKinds.map((kind) => ({
-		kind,
-		summary: "recorded by the finish contract",
-		...(turnId === null ? {} : { turnId }),
-	}));
-	if (decision === "ok" && reason === "no_mutation") {
-		return { kind: "ok", reason, evidence: [], mutatedPaths };
-	}
-	if (decision === "ok" && reason === "validation_evidence") {
-		return { kind: "ok", reason, evidence, mutatedPaths };
-	}
-	if (decision === "ok" && reason === "explicit_limitation") {
-		return { kind: "ok", reason, evidence: [], mutatedPaths };
-	}
-	if (decision === "engage" && reason === "unvalidated_mutation") {
-		return { kind: "engage", reason, message: "finish contract engaged", evidence: [], mutatedPaths };
-	}
-	return null;
-}
-
-function isFinishContractEvidenceKind(value: unknown): value is FinishContractEvidenceKind {
-	return value === "validation_command" || value === "protected_artifact" || value === "dispatch_receipt";
-}
-
-/**
- * A blank or whitespace-only optional field is absent, not an identifier. The
- * `??` fallbacks below depend on it, and an empty string would otherwise reach
- * `normalizeArtifactReference` and abort the entire bundle.
- */
-function readOptionalString(value: unknown): string | null {
-	return typeof value === "string" && value.trim().length > 0 ? value : null;
-}