@ixo/openhands-sdk 0.3.0 → 0.4.1

package/dist/esm/geo/provenance.js

@@ -0,0 +1,129 @@
+/**
+ * What a picture says about where it came from (an AI label: IPTC DigitalSourceType in its XMP; C2PA content
+ * credentials), and whether it is a photo the reviewer can read at all (JPEG or PNG, within its pixel cap).
+ *
+ * The answer page used to shrink a photograph by redrawing it on a canvas, and a generator's PNG, labelled
+ * `trainedAlgorithmicMedia` in its XMP and signed in a C2PA manifest, lost both: the reviewer's not-generated
+ * screen then passed it (Red Harbor demo, 2026-10-16). Evidence photos are now sent as they are (camera.ts). This
+ * reads what the original declares, for the page's early warning on a photo marked AI-generated (`markedAi`) and
+ * the provenance the evidence records. The oracle still decides.
+ *
+ * Pure byte reading, no decoder. PNG (iTXt XMP, caBX), JPEG (APP1 XMP, APP11 JUMBF) and WebP (`XMP `, `C2PA`).
+ * shortcut: a compressed PNG iTXt XMP is not inflated (generators write it plain); upgrade with DecompressionStream if one turns up.
+ */
+/** The IPTC digital source types that say a model made or composited the picture. */
+const AI_SOURCE = /\b(trainedAlgorithmicMedia|compositeWithTrainedAlgorithmicMedia|compositeSynthetic|algorithmicMedia)\b/;
+/** The ones the answer page refuses on sight (owner, 2026-10-16). */
+const MARKED_AI = /\b(trainedAlgorithmicMedia|compositeSynthetic|algorithmicMedia)\b/;
+const XMP_JPEG_HEADER = "http://ns.adobe.com/xap/1.0/\0";
+const XMP_PNG_KEYWORD = "XML:com.adobe.xmp";
+const latin1 = (bytes) => {
+    let out = "";
+    for (let at = 0; at < bytes.length; at += 8192)
+        out += String.fromCharCode(...bytes.subarray(at, at + 8192));
+    return out;
+};
+const startsWith = (bytes, at, text) => {
+    if (at + text.length > bytes.length)
+        return false;
+    for (let index = 0; index < text.length; index += 1)
+        if (bytes[at + index] !== text.charCodeAt(index))
+            return false;
+    return true;
+};
+const u32 = (bytes, at) => ((bytes[at] << 24) >>> 0) + (bytes[at + 1] << 16) + (bytes[at + 2] << 8) + bytes[at + 3];
+const u32le = (bytes, at) => (bytes[at] | (bytes[at + 1] << 8) | (bytes[at + 2] << 16)) + bytes[at + 3] * 0x1000000;
+const isPng = (bytes) => bytes.length > 8 && bytes[0] === 0x89 && startsWith(bytes, 1, "PNG");
+const isJpeg = (bytes) => bytes.length > 4 && bytes[0] === 0xff && bytes[1] === 0xd8;
+/** The oracle's limits on an evidence photo (S3, 2026-10-16): its AI judge skips anything over 10 MB, and it reads at most 40 MP of a PNG. */
+export const EVIDENCE_MAX_BYTES = 10_000_000;
+export const PNG_MAX_PIXELS = 40_000_000;
+/**
+ * Why the reviewer could not read this photo, in plain words, or null. By its bytes, never its name: JPEG or PNG
+ * only, at most `maxBytes` (never above EVIDENCE_MAX_BYTES), and a PNG at most 40 MP (read from its IHDR).
+ */
+export function photoRefusal(bytes, maxBytes = EVIDENCE_MAX_BYTES) {
+    if (!isJpeg(bytes) && !isPng(bytes))
+        return "Please send a JPEG or PNG photo.";
+    const limit = Math.min(maxBytes, EVIDENCE_MAX_BYTES);
+    const mb = (count) => (count / 1_000_000).toFixed(1).replace(/\.0$/, "");
+    if (bytes.length > limit)
+        return `This photo is too big to send (${mb(bytes.length)} MB; the limit is ${mb(limit)} MB). Take it again at a lower resolution, or pick a smaller photo.`;
+    if (isPng(bytes) && startsWith(bytes, 12, "IHDR")) {
+        const pixels = u32(bytes, 16) * u32(bytes, 20);
+        if (pixels > PNG_MAX_PIXELS)
+            return `This photo has too many pixels to send (${Math.round(pixels / 1_000_000)} megapixels; the limit is 40). Take it again at a lower resolution, or pick a smaller photo.`;
+    }
+    return null;
+}
+/** What a picture's own bytes say about its source. Never throws: a file it cannot read says nothing. */
+export function scanProvenance(bytes) {
+    let xmp = null;
+    const c2pa = [];
+    try {
+        if (isPng(bytes)) {
+            for (let at = 8; at + 12 <= bytes.length;) {
+                const length = u32(bytes, at);
+                const data = bytes.subarray(at + 8, at + 8 + length);
+                if (startsWith(bytes, at + 4, "iTXt") && startsWith(data, 0, `${XMP_PNG_KEYWORD}\0`)) {
+                    let cursor = XMP_PNG_KEYWORD.length + 1;
+                    const compressed = data[cursor] === 1;
+                    cursor += 2;
+                    /* The language tag, then the translated keyword: both NUL-terminated. */
+                    for (let nul = 0; nul < 2; nul += 1)
+                        cursor = data.indexOf(0, cursor) + 1;
+                    if (!compressed && cursor > 0)
+                        xmp = data.subarray(cursor);
+                }
+                else if (startsWith(bytes, at + 4, "caBX"))
+                    c2pa.push(data);
+                else if (startsWith(bytes, at + 4, "IEND"))
+                    break;
+                at += 12 + length;
+            }
+        }
+        else if (isJpeg(bytes)) {
+            for (let at = 2; at + 4 <= bytes.length && bytes[at] === 0xff;) {
+                const marker = bytes[at + 1];
+                /* Start of scan: the pixels begin and the metadata is behind us. */
+                if (marker === 0xda)
+                    break;
+                const length = (bytes[at + 2] << 8) | bytes[at + 3];
+                if (length < 2)
+                    break;
+                if (marker === 0xe1 && startsWith(bytes, at + 4, XMP_JPEG_HEADER))
+                    xmp = bytes.subarray(at + 4 + XMP_JPEG_HEADER.length, at + 2 + length);
+                /* APP11, JPEG XT "JP": a JUMBF box, which C2PA uses. */
+                if (marker === 0xeb && startsWith(bytes, at + 4, "JP"))
+                    c2pa.push(bytes.subarray(at, at + 2 + length));
+                at += 2 + length;
+            }
+        }
+        else if (startsWith(bytes, 0, "RIFF") && startsWith(bytes, 8, "WEBP")) {
+            for (let at = 12; at + 8 <= bytes.length;) {
+                const size = u32le(bytes, at + 4);
+                const data = bytes.subarray(at + 8, at + 8 + size);
+                if (startsWith(bytes, at, "XMP "))
+                    xmp = data;
+                if (startsWith(bytes, at, "C2PA"))
+                    c2pa.push(data);
+                at += 8 + size + (size % 2);
+            }
+        }
+    }
+    catch {
+        /* A truncated or odd file: whatever was read so far stands. */
+    }
+    const xmpText = xmp ? latin1(xmp) : "";
+    const labelledXmp = /DigitalSourceType/.test(xmpText);
+    const credentials = c2pa.map(latin1).filter((text) => text.includes("c2pa"));
+    const labelled = labelledXmp ? AI_SOURCE.exec(xmpText) : null;
+    const signed = credentials.map((text) => AI_SOURCE.exec(text)).find(Boolean) ?? null;
+    const sources = [...(labelledXmp ? ["xmp"] : []), ...(credentials.length ? ["c2pa"] : [])];
+    const type = (labelled ?? signed)?.[1];
+    return {
+        provenance: sources.length ? { aiLabel: Boolean(labelled || signed), sources, ...(type ? { digitalSourceType: type } : {}) } : null,
+        markedAi: (labelledXmp && MARKED_AI.test(xmpText)) || credentials.some((text) => MARKED_AI.test(text))
+    };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/esm/geo/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../src/geo/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAqBH,qFAAqF;AACrF,MAAM,SAAS,GAAG,wGAAwG,CAAC;AAC3H,qEAAqE;AACrE,MAAM,SAAS,GAAG,mEAAmE,CAAC;AACtF,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7G,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AACF,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,EAAU,EAAE,IAAY,EAAW,EAAE;IAC1E,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACpH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,KAAiB,EAAE,EAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC;AACpJ,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAE,EAAU,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,GAAG,SAAS,CAAC;AACpJ,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACnH,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAE1G,8IAA8I;AAC9I,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,WAAmB,kBAAkB;IACnF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,kCAAkC,CAAC;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,OAAO,kCAAkC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,qEAAqE,CAAC;IACvL,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,cAAc;YAAE,OAAO,2CAA2C,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,8FAA8F,CAAC;IAC9M,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,IAAI,GAAG,GAAsB,IAAI,CAAC;IAClC,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAI,CAAC;gBAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;gBACrD,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,eAAe,IAAI,CAAC,EAAE,CAAC;oBACrF,IAAI,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;oBACxC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACtC,MAAM,IAAI,CAAC,CAAC;oBACZ,yEAAyE;oBACzE,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;wBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1E,IAAI,CAAC,UAAU,IAAI,MAAM,GAAG,CAAC;wBAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBACzD,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;oBAAE,MAAM;gBAClD,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,GAAI,CAAC;gBAChE,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC;gBAC9B,oEAAoE;gBACpE,IAAI,MAAM,KAAK,IAAI;oBAAE,MAAM;gBAC3B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC;gBACtD,IAAI,MAAM,GAAG,CAAC;oBAAE,MAAM;gBACtB,IAAI,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,eAAe,CAAC;oBAAE,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;gBAC1I,wDAAwD;gBACxD,IAAI,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACvG,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YACxE,KAAK,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAI,CAAC;gBAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACnD,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;oBAAE,GAAG,GAAG,IAAI,CAAC;gBAC9C,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IACrF,MAAM,OAAO,GAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QACnI,QAAQ,EAAE,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACvG,CAAC;AACJ,CAAC"}

package/dist/esm/rubric/bridge.d.ts

@@ -53,6 +53,23 @@ export interface BridgeOptions {
         meters: number;
         days: number;
     } | null;
+    /**
+     * W7a: a CAMPAIGN rubric — one document for every ask in a campaign, so it
+     * carries no per-ask literal. The `within-radius` gate is emitted as the
+     * `withinAskRadius` source with only the claim's fields; the oracle resolves
+     * the pin itself from the claim's collection → its deed → `#done`. The judge
+     * is shown `task` below (the campaign's wording) instead of the ask's.
+     */
+    pinFromAsk?: boolean;
+    /** The task the judges are shown, in place of the ask's own; the campaign's wording under `pinFromAsk`. */
+    task?: string;
+    /**
+     * A person stands behind the ask's reviews (an organisation's ask, its reviewers in the Console): then a photo
+     * with no camera data and no live capture is held for that person (the `cameraPhoto`/`liveCapture` gate) rather
+     * than ruled on by the screens alone. Never on a campaign rubric or an ask from a key with nobody behind it: a
+     * `review` there is held for ever (`ON_ERROR`).
+     */
+    personReviews?: boolean;
 }
 /**
  * What every source and AI check says when it could not answer at all.
@@ -177,8 +194,31 @@ export interface EngineRubric {
         aiChecks?: EngineAiCheck[];
         unique?: EngineUnique;
         gates: EngineGate[];
+        review?: EngineReview;
     };
 }
+/** A person's look, for a gate that fails to `review`: without a claim-level task the engine turns review into reject (S3). */
+export interface EngineReview {
+    "@type": "HumanReview";
+    assignTo: {
+        role: "reviewer";
+    };
+    slaHours: number;
+    onTimeout: "reject";
+    tasks: {
+        "@type": "ReviewTask";
+        id: string;
+        prompt: string;
+        show: string[];
+        answer: {
+            type: "boolean";
+        };
+        map: {
+            true: "approve";
+            false: "reject";
+        };
+    }[];
+}
 /**
  * The names the oracle answers to, per gate. Exact: the oracle registers a
  * handler per name (and per suffix, 2..5, for a rule that repeats within one
@@ -198,6 +238,8 @@ export declare const SOURCE_NAMES: {
 };
 /** The cool-off source, emitted from the options rather than from a gate. */
 export declare const COOLDOWN_SOURCE = "cooldown";
+/** The pin-free radius source of a campaign rubric (W7a): the oracle reads the ask's point and radius from its deed's `#done`. */
+export declare const WITHIN_ASK_RADIUS_SOURCE = "withinAskRadius";
 /** The marker source on a site ask, so the claim's `kind` is frozen on the receipt for the oracle's act policy. */
 export declare const SITE_SOURCE = "openhandsSite";
 /** The AI check, per judge criterion: `judge`, then `judge2..`. */
@@ -251,6 +293,13 @@ export declare const PHOTO_CHECKS: {
     readonly notMarkedGenerated: "notMarkedGenerated";
     readonly notElsewhere: "notElsewhere";
 };
+/** The two facts of the camera-or-live gate, asked only where a person reviews (`personReviews`). */
+export declare const PERSON_CHECKS: {
+    /** True when the file has EXIF Make/Model or a trusted C2PA camera capture (S3). */
+    readonly cameraPhoto: "cameraPhoto";
+    /** True when the evidence carries a valid live-capture stamp for the photo (app/lib/stamp.ts, S3). */
+    readonly liveCapture: "liveCapture";
+};
 /**
  * How far a photograph's own GPS may sit from the point the claim reported.
  *
@@ -379,8 +428,45 @@ export declare const SITE_KIND_PREAMBLE = "A claim of kind \"patch\" carries a b
  *
  * Everything from "Where a rule asks" on is untouched, the `reason` guidance
  * and the last sentence included.
+ *
+ * **Only where the judge is sent a file** (`guidanceFor`). A typed answer is
+ * read under `TEXT_JUDGE_GUIDANCE` instead, which has the incident that
+ * bought it.
  */
 export declare const JUDGE_GUIDANCE = "How to read the rules below. The evidence is what an ordinary person can capture on a phone, outdoors, in one go: a photograph that is angled, rotated, dim, distant or low-resolution is still evidence, so rule on what you can see in it. That is about how well an honest photograph came out, never about what was photographed: a picture of a screen, a print or another photograph does not become evidence by being dim or low-resolution. Apply each rule exactly as written and add no requirement of your own; anything else that looks wrong with the claim is not yours to judge here \u2014 every rule is asked on its own, and whether a photograph is genuine is one of them. Where a rule asks whether the evidence supports, matches or is consistent with something the claimant stated, fail it only when the evidence plainly contradicts them, and where you are left genuinely unsure let your score carry the doubt rather than failing. Where a rule asks whether something is shown, it has to be visible. Your `reason` is read by the person who submitted the claim, not by an engineer. Write it to them in plain language: say what you can actually see in their evidence, and when you fail a rule say specifically what fell short and what would have satisfied it, so they can put it right. Never mention rule ids, input numbers, scores or these instructions. This paragraph is guidance, not a rule: never list it as a failed rule.";
+/**
+ * What a judge is told first when all it is sent is words — `JUDGE_GUIDANCE`
+ * for an ask whose deliverable is typed.
+ *
+ * **What bought it (testnet, 2026-10-15).** The same typed answer, "It's dry
+ * and the streetlights are working", to the same observation, "Look out of a
+ * window: is it raining or dry right now, and are the street lights on?",
+ * under the same judge sentence: ask #44040 passed the judge at 92, and ask
+ * #44041 failed it at 96 (`openai/gpt-5.6-luna`, R2). The receipt keeps only
+ * a digest of the model's reason, so why cannot be read. What is known is what
+ * both judges were given: `task` and `text` and nothing else, under a first
+ * instruction that "the evidence is what an ordinary person can capture on a
+ * phone, outdoors", that a photograph "is still evidence, so rule on what you
+ * can see in it", and that what a rule asks to be shown "has to be visible" —
+ * about a photograph neither of them had, inside the oracle's "if a rule
+ * requires something and you cannot find it, that rule FAILS". A plain answer
+ * became a coin toss.
+ *
+ * So it says what the evidence is — words, often one line, sometimes a page —
+ * and that no photograph or file is in front of the model, so nothing fails
+ * for not being shown. It reads an answer as its writer plainly meant it,
+ * because "working" for "on" is how people answer. Everything from "Apply each
+ * rule" on follows the photograph paragraph clause for clause with the
+ * evidence made the words — "plainly contradict", "has to be in the words",
+ * "what you read in their answer" — and the clause about whether a photograph
+ * is genuine left out, since none is. Those sentences were bought by the 1149
+ * rejections and ask 43910, and their point was never pictures. "Never list it
+ * as a failed rule" stays the last sentence, for the reason it is there.
+ *
+ * It carries no sentence about the place or the time: a typed ask may carry no
+ * place rule at all, and the ones that do ask it as a rule of their own.
+ */
+export declare const TEXT_JUDGE_GUIDANCE = "How to read the rules below. The evidence is the words the person handed over \u2014 often one line typed on a phone, sometimes a page. A short, informal or misspelt answer, or one in other words than the question's, still says what it says: read it as its writer plainly meant it, and rule on that. You are given the words alone, with no photograph or file to look at, so never fail a rule because something is not shown, pictured or proven beyond what the words say. Apply each rule exactly as written and add no requirement of your own; anything else that looks wrong with the claim is not yours to judge here \u2014 every rule is asked on its own. Where a rule asks whether the answer supports, matches or is consistent with something the claimant stated, fail it only when the words plainly contradict them, and where you are left genuinely unsure let your score carry the doubt rather than failing. Where a rule asks whether something is said, it has to be in the words, in any wording. Your `reason` is read by the person who submitted the claim, not by an engineer. Write it to them in plain language: say what you read in their answer, and when you fail a rule say specifically what fell short and what would have satisfied it, so they can put it right. Never mention rule ids, input numbers, scores or these instructions. This paragraph is guidance, not a rule: never list it as a failed rule.";
 /**
  * The sentence the authenticity judge rules on — `PHOTO_CHECKS` has why.
  *
@@ -404,8 +490,8 @@ export declare const JUDGE_GUIDANCE = "How to read the rules below. The evidence
  * cleared, so the bags in a van and the load at a depot are not failed for
  * having a roof over them.
  *
- * `rule` alone is the gate's `reason` — the sentence a refused worker reads.
- * The list of signs is for the model.
+ * `refusal` is the gate's `reason`: the sentence a refused worker reads, worded as the failure with what to do
+ * (S3, 2026-10-17: the pass sentence on a reject read as a contradiction). `rule` and the list of signs are for the model.
  */
 export declare function realPhotoRule(shape: {
     pair: boolean;
@@ -413,7 +499,17 @@ export declare function realPhotoRule(shape: {
 }): {
     rule: string;
     text: string;
+    refusal: string;
 };
+/**
+ * Which paragraph a judge is handed first: the one about what it is sent.
+ *
+ * Decided by the deliverable's shape — the same switch that puts `$photo` in
+ * the judge's `send` — and never by reading the ask: a question that mentions
+ * a photograph is still answered in words. A `file` keeps the photograph
+ * paragraph, because its judge is sent the file.
+ */
+export declare const guidanceFor: (type: AskTerms["deliverable"]["type"]) => string;
 /**
  * Terms → the engine's rubric.
  *

package/dist/esm/rubric/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/rubric/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,QAAQ,EAAkB,KAAK,SAAS,EAAa,MAAM,YAAY,CAAC;AAE3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,EAAG,QAAiB,CAAC;AAE1C,kGAAkG;AAClG,eAAO,MAAM,gBAAgB;;;CAAoC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,6BAA6B,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAM7J;AAED,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,EAAE,YAAY,CAAC;CACxB;AAMD,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzC;;;;GAIG;AACH,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,KAAK,EAAE,SAAS,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;CAChH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,QAAQ,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,UAAU,EAAE,CAAC,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAAE,CAAC;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzB,UAAU,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE;QAAE,GAAG,EAAE,mCAAmC,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,IAAI,CAAA;KAAE,CAAC;IAC5G,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE;QACN,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,EAAE;YAAE,OAAO,EAAE,oBAAoB,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAClG,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;QACzB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,YAAY,CAAC;QACtB,KAAK,EAAE,UAAU,EAAE,CAAC;KACrB,CAAC;CACH;AAID;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;CAUf,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,eAAe,aAAa,CAAC;AAC1C,mHAAmH;AACnH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,mEAAmE;AACnE,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,sDAAsD;AACtD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAevD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAM7D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,kOAC+L,CAAC;AAE/N;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,eAAO,MAAM,cAAc,m5CACk3C,CAAC;AAE94C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAczG;AAsUD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,aAAkB,GAAG,WAAW,CAqV1H"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/rubric/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,QAAQ,EAAkB,KAAK,SAAS,EAAa,MAAM,YAAY,CAAC;AAE3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2GAA2G;IAC3G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,EAAG,QAAiB,CAAC;AAE1C,kGAAkG;AAClG,eAAO,MAAM,gBAAgB;;;CAAoC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,6BAA6B,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAM7J;AAED,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,EAAE,YAAY,CAAC;CACxB;AAMD,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzC;;;;GAIG;AACH,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,KAAK,EAAE,SAAS,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;CAChH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,QAAQ,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,UAAU,EAAE,CAAC,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAAE,CAAC;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzB,UAAU,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE;QAAE,GAAG,EAAE,mCAAmC,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,IAAI,CAAA;KAAE,CAAC;IAC5G,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE;QACN,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,EAAE;YAAE,OAAO,EAAE,oBAAoB,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAClG,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;QACzB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,YAAY,CAAC;QACtB,KAAK,EAAE,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;CACH;AAED,+HAA+H;AAC/H,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,QAAQ,CAAC;IACpB,KAAK,EAAE;QAAE,OAAO,EAAE,YAAY,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,SAAS,CAAA;SAAE,CAAC;QAAC,GAAG,EAAE;YAAE,IAAI,EAAE,SAAS,CAAC;YAAC,KAAK,EAAE,QAAQ,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;CACxJ;AAID;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;CAUf,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,eAAe,aAAa,CAAC;AAC1C,kIAAkI;AAClI,eAAO,MAAM,wBAAwB,oBAAoB,CAAC;AAC1D,mHAAmH;AACnH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,mEAAmE;AACnE,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX,qGAAqG;AACrG,eAAO,MAAM,aAAa;IACxB,oFAAoF;;IAEpF,sGAAsG;;CAE9F,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,sDAAsD;AACtD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAkBvD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAM7D,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,kOAC+L,CAAC;AAE/N;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,eAAO,MAAM,cAAc,m5CACk3C,CAAC;AAE94C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,mBAAmB,g4CACq1C,CAAC;AAEt3C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAe1H;AA6CD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAG,MAAuE,CAAC;AA0S5I;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,aAAkB,GAAG,WAAW,CAoY1H"}

package/dist/esm/rubric/bridge.js

@@ -63,6 +63,8 @@ export const SOURCE_NAMES = {
 };
 /** The cool-off source, emitted from the options rather than from a gate. */
 export const COOLDOWN_SOURCE = "cooldown";
+/** The pin-free radius source of a campaign rubric (W7a): the oracle reads the ask's point and radius from its deed's `#done`. */
+export const WITHIN_ASK_RADIUS_SOURCE = "withinAskRadius";
 /** The marker source on a site ask, so the claim's `kind` is frozen on the receipt for the oracle's act policy. */
 export const SITE_SOURCE = "openhandsSite";
 /** The AI check, per judge criterion: `judge`, then `judge2..`. */
@@ -116,6 +118,13 @@ export const PHOTO_CHECKS = {
     notMarkedGenerated: "notMarkedGenerated",
     notElsewhere: "notElsewhere"
 };
+/** The two facts of the camera-or-live gate, asked only where a person reviews (`personReviews`). */
+export const PERSON_CHECKS = {
+    /** True when the file has EXIF Make/Model or a trusted C2PA camera capture (S3). */
+    cameraPhoto: "cameraPhoto",
+    /** True when the evidence carries a valid live-capture stamp for the photo (app/lib/stamp.ts, S3). */
+    liveCapture: "liveCapture"
+};
 /**
  * How far a photograph's own GPS may sit from the point the claim reported.
  *
@@ -156,6 +165,7 @@ export const UNIQUE_RULE_ID = "OH-DUP-1";
  */
 export const SEND_KEYS = {
     withinRadius: ["lat", "lon", "photo", "centerLat", "centerLon", "meters"],
+    withinAskRadius: ["lat", "lon", "photo"],
     located: ["lat", "lon", "photo"],
     beforeAfter: ["before", "after", "meters"],
     daylight: ["text", "at", "fallbackAt", "lat", "lon"],
@@ -168,6 +178,8 @@ export const SEND_KEYS = {
     openhandsSite: ["kind", "lat", "lon"],
     notElsewhere: ["lat", "lon", "photo", "meters"],
     notMarkedGenerated: ["photo"],
+    cameraPhoto: ["photo"],
+    liveCapture: ["photo"],
     judge: ["task", "text", "photo"]
 };
 /**
@@ -265,8 +277,45 @@ export const SITE_KIND_PREAMBLE = 'A claim of kind "patch" carries a before phot
  *
  * Everything from "Where a rule asks" on is untouched, the `reason` guidance
  * and the last sentence included.
+ *
+ * **Only where the judge is sent a file** (`guidanceFor`). A typed answer is
+ * read under `TEXT_JUDGE_GUIDANCE` instead, which has the incident that
+ * bought it.
  */
 export const JUDGE_GUIDANCE = "How to read the rules below. The evidence is what an ordinary person can capture on a phone, outdoors, in one go: a photograph that is angled, rotated, dim, distant or low-resolution is still evidence, so rule on what you can see in it. That is about how well an honest photograph came out, never about what was photographed: a picture of a screen, a print or another photograph does not become evidence by being dim or low-resolution. Apply each rule exactly as written and add no requirement of your own; anything else that looks wrong with the claim is not yours to judge here — every rule is asked on its own, and whether a photograph is genuine is one of them. Where a rule asks whether the evidence supports, matches or is consistent with something the claimant stated, fail it only when the evidence plainly contradicts them, and where you are left genuinely unsure let your score carry the doubt rather than failing. Where a rule asks whether something is shown, it has to be visible. Your `reason` is read by the person who submitted the claim, not by an engineer. Write it to them in plain language: say what you can actually see in their evidence, and when you fail a rule say specifically what fell short and what would have satisfied it, so they can put it right. Never mention rule ids, input numbers, scores or these instructions. This paragraph is guidance, not a rule: never list it as a failed rule.";
+/**
+ * What a judge is told first when all it is sent is words — `JUDGE_GUIDANCE`
+ * for an ask whose deliverable is typed.
+ *
+ * **What bought it (testnet, 2026-10-15).** The same typed answer, "It's dry
+ * and the streetlights are working", to the same observation, "Look out of a
+ * window: is it raining or dry right now, and are the street lights on?",
+ * under the same judge sentence: ask #44040 passed the judge at 92, and ask
+ * #44041 failed it at 96 (`openai/gpt-5.6-luna`, R2). The receipt keeps only
+ * a digest of the model's reason, so why cannot be read. What is known is what
+ * both judges were given: `task` and `text` and nothing else, under a first
+ * instruction that "the evidence is what an ordinary person can capture on a
+ * phone, outdoors", that a photograph "is still evidence, so rule on what you
+ * can see in it", and that what a rule asks to be shown "has to be visible" —
+ * about a photograph neither of them had, inside the oracle's "if a rule
+ * requires something and you cannot find it, that rule FAILS". A plain answer
+ * became a coin toss.
+ *
+ * So it says what the evidence is — words, often one line, sometimes a page —
+ * and that no photograph or file is in front of the model, so nothing fails
+ * for not being shown. It reads an answer as its writer plainly meant it,
+ * because "working" for "on" is how people answer. Everything from "Apply each
+ * rule" on follows the photograph paragraph clause for clause with the
+ * evidence made the words — "plainly contradict", "has to be in the words",
+ * "what you read in their answer" — and the clause about whether a photograph
+ * is genuine left out, since none is. Those sentences were bought by the 1149
+ * rejections and ask 43910, and their point was never pictures. "Never list it
+ * as a failed rule" stays the last sentence, for the reason it is there.
+ *
+ * It carries no sentence about the place or the time: a typed ask may carry no
+ * place rule at all, and the ones that do ask it as a rule of their own.
+ */
+export const TEXT_JUDGE_GUIDANCE = "How to read the rules below. The evidence is the words the person handed over — often one line typed on a phone, sometimes a page. A short, informal or misspelt answer, or one in other words than the question's, still says what it says: read it as its writer plainly meant it, and rule on that. You are given the words alone, with no photograph or file to look at, so never fail a rule because something is not shown, pictured or proven beyond what the words say. Apply each rule exactly as written and add no requirement of your own; anything else that looks wrong with the claim is not yours to judge here — every rule is asked on its own. Where a rule asks whether the answer supports, matches or is consistent with something the claimant stated, fail it only when the words plainly contradict them, and where you are left genuinely unsure let your score carry the doubt rather than failing. Where a rule asks whether something is said, it has to be in the words, in any wording. Your `reason` is read by the person who submitted the claim, not by an engineer. Write it to them in plain language: say what you read in their answer, and when you fail a rule say specifically what fell short and what would have satisfied it, so they can put it right. Never mention rule ids, input numbers, scores or these instructions. This paragraph is guidance, not a rule: never list it as a failed rule.";
 /**
  * The sentence the authenticity judge rules on — `PHOTO_CHECKS` has why.
  *
@@ -290,8 +339,8 @@ export const JUDGE_GUIDANCE = "How to read the rules below. The evidence is what
  * cleared, so the bags in a van and the load at a depot are not failed for
  * having a roof over them.
  *
- * `rule` alone is the gate's `reason` — the sentence a refused worker reads.
- * The list of signs is for the model.
+ * `refusal` is the gate's `reason`: the sentence a refused worker reads, worded as the failure with what to do
+ * (S3, 2026-10-17: the pass sentence on a reject read as a contradiction). `rule` and the list of signs are for the model.
  */
 export function realPhotoRule(shape) {
     const one = shape.pair ? "Every photograph" : "The photograph";
@@ -306,7 +355,8 @@ export function realPhotoRule(shape) {
     const generated = `${shape.pair ? "any" : "it"} shows signs of being computer-generated (garbled or nonsensical lettering, signs, dates or timestamps; an artificial vignette or frame; impossible geometry)`;
     const indoors = `${scene} is indoors or part of somebody's home — a household floor, table, balcony or room`;
     const fails = shape.outdoors ? `Fail this if ${screen}, if ${generated}, or if ${indoors}.` : `Fail this if ${screen}, or if ${generated}.`;
-    return { rule, text: `${rule} ${fails}` };
+    const refusal = `${shape.pair ? "A photo is" : "This is"} not a direct photograph of the real ${shape.outdoors ? "outdoor place" : "scene"} asked for (a screen, a print, a generated picture${shape.outdoors ? " or an indoor shot" : ""}). Take the photo yourself, there.`;
+    return { rule, text: `${rule} ${fails}`, refusal };
 }
 /** Per attempt. Their ceiling is 30 s; the oracle answers in-process, so this is generous. */
 const SOURCE_TIMEOUT_MS = 15_000;
@@ -344,6 +394,15 @@ const WITH_PHOTO = new Set(["photo", "photo-pair", "mess-report", "field-report"
  * photograph screens are not asked of it.
  */
 const PHOTOGRAPH = new Set(["photo", "photo-pair", "mess-report", "field-report"]);
+/**
+ * Which paragraph a judge is handed first: the one about what it is sent.
+ *
+ * Decided by the deliverable's shape — the same switch that puts `$photo` in
+ * the judge's `send` — and never by reading the ask: a question that mentions
+ * a photograph is still answered in words. A `file` keeps the photograph
+ * paragraph, because its judge is sent the file.
+ */
+export const guidanceFor = (type) => (WITH_PHOTO.has(type) ? JUDGE_GUIDANCE : TEXT_JUDGE_GUIDANCE);
 /** The rules that make a claim report where it was — what `notElsewhere` compares the photograph against. */
 const PLACE_GATES = new Set(["located", "within-radius", "not-already-mapped", "at-registered-point"]);
 /** Long enough that no honest deliverable hits it; `lengthBetween` is inclusive. */
@@ -501,6 +560,16 @@ function sourcedGate(gate, index, context) {
     const reject = (label, reason, kind = "refuted") => ({ "@type": "Gate", code: codeFor(index, label), reason, onFail: "reject", class: kind });
     switch (gate.id) {
         case "within-radius":
+            /* A campaign rubric sends only the claim's fields: the oracle resolves the
+               ask's point and radius from the deed's #done (W7a). The reason names no
+               place either — one document serves every ask in the campaign. */
+            if (context.pinFromAsk) {
+                return {
+                    name: WITHIN_ASK_RADIUS_SOURCE,
+                    send: { lat: LAT, lon: LON, photo: PHOTO },
+                    gate: reject("within-radius", "Not within the ask's radius of its point")
+                };
+            }
             return {
                 name,
                 send: { lat: LAT, lon: LON, photo: PHOTO, centerLat: gate.lat, centerLon: gate.lon, meters: gate.meters },
@@ -595,7 +664,7 @@ export function toEngineRubric(terms, binding, options = {}) {
         return null;
     };
     const radius = measure("within-radius");
-    const context = { radiusMeters: radius && radius.id === "within-radius" ? radius.meters : null };
+    const context = { radiusMeters: radius && radius.id === "within-radius" ? radius.meters : null, pinFromAsk: options.pinFromAsk === true };
     /*
      * What the judges are shown, decided once from the shape of the whole ask.
      *
@@ -609,14 +678,17 @@ export function toEngineRubric(terms, binding, options = {}) {
     /* A site, a second file, or a disposal photograph: the bags ride beside the pair. */
     const expectsExtra = normalized.site === true || measure("with-file") !== null || measure("at-registered-point") !== null;
     const judgeSend = {
-        task: literal(normalized.task),
+        task: literal(options.task?.trim() || normalized.task),
         text: TEXT,
         ...(withPhoto ? { photo: PHOTO } : {}),
         ...(pair ? { before: BEFORE_PHOTO, after: AFTER_PHOTO } : {}),
         ...(pair && expectsExtra ? { bags: EXTRA_FILE } : {}),
         ...(normalized.site ? { kind: KIND } : {})
     };
+    /* Read off the same shape as the send map, so the paragraph describes what the judge is actually given. */
+    const guidance = guidanceFor(normalized.deliverable.type);
     const gates = [];
+    let review = null;
     const aiChecks = [];
     /* Sources by bare name first; the suffix is decided once the count is known. */
     const pending = [];
@@ -625,6 +697,10 @@ export function toEngineRubric(terms, binding, options = {}) {
        every other rule reads the deliverable. It is also the one rule every ask
        has. */
     gates.push(nativeGate({ id: "non-empty" }, 0));
+    /* On a photo ask the photo IS the hand-over, and words are optional unless a Words block asks (`wantsWords`): reading
+       the text there refused every photo sent without a note (testnet 44066/44068, 2026-10-17). */
+    if (PHOTOGRAPH.has(normalized.deliverable.type))
+        gates[0] = { ...gates[0], reason: "No photo was handed over", when: field(PHOTO, "present") };
     /*
      * Which kind of claim this is — asked before anything that depends on it,
      * and never itself conditional.
@@ -698,10 +774,12 @@ export function toEngineRubric(terms, binding, options = {}) {
                 name,
                 send: { ...judgeSend },
                 /* The guidance first, always — see `JUDGE_GUIDANCE` for the six
-                   rejections that bought it. Then, on a site only, what each kind of
-                   claim carries (`SITE_KIND_PREAMBLE`). The criterion itself is last
-                   and is the only one of the three that is a rule. */
-                instructions: normalized.site ? [JUDGE_GUIDANCE, SITE_KIND_PREAMBLE, criterion.text] : [JUDGE_GUIDANCE, criterion.text],
+                   rejections that bought it, and `TEXT_JUDGE_GUIDANCE` for the typed
+                   answer failed as if a photograph were missing. Then, on a site only,
+                   what each kind of claim carries (`SITE_KIND_PREAMBLE`). The
+                   criterion itself is last and is the only one of the three that is a
+                   rule. */
+                instructions: normalized.site ? [guidance, SITE_KIND_PREAMBLE, criterion.text] : [guidance, criterion.text],
                 expect: "boolean",
                 onError: ON_ERROR
             });
@@ -824,11 +902,11 @@ export function toEngineRubric(terms, binding, options = {}) {
                 "@type": "AiCheck",
                 name,
                 send: { ...judgeSend },
-                instructions: normalized.site ? [JUDGE_GUIDANCE, SITE_KIND_PREAMBLE, sentence.text] : [JUDGE_GUIDANCE, sentence.text],
+                instructions: normalized.site ? [guidance, SITE_KIND_PREAMBLE, sentence.text] : [guidance, sentence.text],
                 expect: "boolean",
                 onError: ON_ERROR
             });
-            screens.push({ "@type": "Gate", code: codeFor(extra, "real-photo"), reason: sentence.rule, when: field(`ai.${name}.valid`, "isTrue"), onFail: "reject", class: "invalid_evidence" });
+            screens.push({ "@type": "Gate", code: codeFor(extra, "real-photo"), reason: sentence.refusal, when: field(`ai.${name}.valid`, "isTrue"), onFail: "reject", class: "invalid_evidence" });
         }
         /* Only where a rule makes the claim say where it was: an ask that never
            asks has no reported point, the contract answers that with an error,
@@ -851,6 +929,43 @@ export function toEngineRubric(terms, binding, options = {}) {
             });
         }
         gates.splice(authenticityAt, 0, ...screens);
+        /*
+         * Camera data or a live capture, else a person looks (S3, 2026-10-16). Only where a person is there to look
+         * (`personReviews`), never on a campaign rubric. Last, so every refusal above still refuses; and `review`, never
+         * `reject`: no camera data and no stamp is not a fake photograph, it is one nobody can vouch for. A pair asks it
+         * of each photograph (`cameraPhoto2`/`liveCapture2` for the after).
+         */
+        if (options.personReviews && !options.pinFromAsk) {
+            const shots = pair && !normalized.site ? [BEFORE_PHOTO, AFTER_PHOTO] : [PHOTO];
+            review = {
+                "@type": "HumanReview",
+                assignTo: { role: "reviewer" },
+                slaHours: 48,
+                onTimeout: "reject",
+                tasks: [
+                    {
+                        "@type": "ReviewTask",
+                        id: "OH-RT-PHOTO",
+                        prompt: "Nothing vouches for how this photo was taken (no camera data, no live capture). Does it genuinely show the place and the thing this ask asked for? Yes to approve, no to reject.",
+                        show: [...shots, TEXT, LAT, LON],
+                        answer: { type: "boolean" },
+                        map: { true: "approve", false: "reject" }
+                    }
+                ]
+            };
+            for (const [index, photo] of shots.entries()) {
+                pending.push({ name: PERSON_CHECKS.cameraPhoto, send: { photo }, onError: "review" }, { name: PERSON_CHECKS.liveCapture, send: { photo }, onError: "review" });
+                extra += 1;
+                gates.push({
+                    "@type": "Gate",
+                    code: codeFor(extra, "camera-or-live"),
+                    reason: "No camera data and no live capture: a person checks this photo",
+                    when: { "@type": "Condition", any: [extRef(suffixed(PERSON_CHECKS.cameraPhoto, index + 1)), extRef(suffixed(PERSON_CHECKS.liveCapture, index + 1))] },
+                    onFail: "review",
+                    class: "insufficient_evidence"
+                });
+            }
+        }
     }
     /*
      * Names, finally. A vocabulary word is used bare the first time and with a
@@ -863,7 +978,7 @@ export function toEngineRubric(terms, binding, options = {}) {
         const ordinal = (seen.get(one.name) ?? 0) + 1;
         seen.set(one.name, ordinal);
         const name = suffixed(one.name, ordinal);
-        const gate = gates.find((candidate) => candidate.code === one.gate.code);
+        const gate = one.gate ? gates.find((candidate) => candidate.code === one.gate.code) : undefined;
         if (gate)
             gate.when = extRef(name);
         return {
@@ -873,7 +988,7 @@ export function toEngineRubric(terms, binding, options = {}) {
             audience: `did:web:${ORACLE_HOST}`,
             send: one.send,
             expect: "boolean",
-            onError: ON_ERROR,
+            onError: one.onError ?? ON_ERROR,
             timeoutMs: SOURCE_TIMEOUT_MS
         };
     });
@@ -903,7 +1018,8 @@ export function toEngineRubric(terms, binding, options = {}) {
                 ...(sources.length > 0 ? { sources } : {}),
                 ...(aiChecks.length > 0 ? { aiChecks } : {}),
                 ...(unique ? { unique } : {}),
-                gates
+                gates,
+                ...(review ? { review } : {})
             }
         }
     };