@jinn-network/client 0.1.2 → 0.1.3-canary.262e5cda

package/dist/conformance/checks/verdict.js

@@ -0,0 +1,122 @@
+/**
+ * Layer 1 verdict-specific checks.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §3.3.
+ *
+ * Verdict envelopes must carry:
+ *   - payload.restorationEnvelope: { cid, sha256 } — back-reference to the
+ *     restoration envelope being evaluated. V1: CID shape-only check; sha256
+ *     verified against ctx.restorationEnvelopeBytes when provided.
+ *   - payload.verificationOfRestoration: { claimedTier, sdkVersion, timestamp,
+ *     checks[], overall } — structural validity.
+ *
+ * Both checks skip silently on restoration-role envelopes.
+ */
+import { createHash } from 'node:crypto';
+// ─── checkVerdictBackReference ────────────────────────────────────────────────
+/**
+ * Check id: `verdict.back-ref`
+ * Layer: 1
+ *
+ * For verdict-role envelopes:
+ *   1. payload.restorationEnvelope must be present with string `cid` + `sha256`.
+ *   2. If ctx.restorationEnvelopeBytes is provided, sha256(bytes) must match
+ *      payload.restorationEnvelope.sha256.
+ *   3. If ctx.restorationEnvelopeBytes is NOT provided, fail — restoration
+ *      CID did not resolve.
+ *
+ * Skipped on restoration-role envelopes.
+ */
+export function checkVerdictBackReference(ctx) {
+    const id = 'verdict.back-ref';
+    const layer = 1;
+    const env = ctx.envelope;
+    if (!env)
+        return { id, layer, passed: false, detail: 'envelope not loaded' };
+    if (env.role !== 'verdict') {
+        return { id, layer, passed: true, skipped: true };
+    }
+    const payload = env.payload;
+    const ref = payload?.restorationEnvelope;
+    if (!ref || typeof ref.cid !== 'string' || typeof ref.sha256 !== 'string') {
+        return {
+            id,
+            layer,
+            passed: false,
+            detail: 'payload.restorationEnvelope missing or malformed (requires cid + sha256 strings)',
+        };
+    }
+    if (!ctx.restorationEnvelopeBytes) {
+        return {
+            id,
+            layer,
+            passed: false,
+            detail: `restoration CID ${ref.cid} did not resolve from IPFS`,
+        };
+    }
+    const actualSha = createHash('sha256').update(ctx.restorationEnvelopeBytes).digest('hex');
+    if (actualSha !== ref.sha256.toLowerCase()) {
+        return {
+            id,
+            layer,
+            passed: false,
+            detail: `sha256 mismatch: fetched bytes sha256=${actualSha}, declared sha256=${ref.sha256}`,
+        };
+    }
+    return { id, layer, passed: true };
+}
+// ─── checkVerificationRecord ──────────────────────────────────────────────────
+/**
+ * Check id: `verdict.verification-record`
+ * Layer: 1
+ *
+ * For verdict-role envelopes:
+ *   payload.verificationOfRestoration must be present and structurally valid:
+ *     - claimedTier: string
+ *     - sdkVersion: string
+ *     - timestamp: number
+ *     - checks: nonempty array
+ *     - overall: 'valid' | 'invalid'
+ *
+ * Skipped on restoration-role envelopes.
+ */
+export function checkVerificationRecord(ctx) {
+    const id = 'verdict.verification-record';
+    const layer = 1;
+    const env = ctx.envelope;
+    if (!env)
+        return { id, layer, passed: false, detail: 'envelope not loaded' };
+    if (env.role !== 'verdict') {
+        return { id, layer, passed: true, skipped: true };
+    }
+    const payload = env.payload;
+    const rec = payload?.verificationOfRestoration;
+    if (!rec || typeof rec !== 'object') {
+        return {
+            id,
+            layer,
+            passed: false,
+            detail: 'payload.verificationOfRestoration missing',
+        };
+    }
+    const issues = [];
+    if (typeof rec.claimedTier !== 'string') {
+        issues.push('verificationOfRestoration.claimedTier must be a string');
+    }
+    if (typeof rec.sdkVersion !== 'string') {
+        issues.push('verificationOfRestoration.sdkVersion must be a string');
+    }
+    if (typeof rec.timestamp !== 'number') {
+        issues.push('verificationOfRestoration.timestamp must be a number');
+    }
+    if (!Array.isArray(rec.checks) || rec.checks.length === 0) {
+        issues.push('verificationOfRestoration.checks must be a nonempty array');
+    }
+    if (rec.overall !== 'valid' && rec.overall !== 'invalid') {
+        issues.push(`verificationOfRestoration.overall must be 'valid' or 'invalid', got ${String(rec.overall)}`);
+    }
+    if (issues.length === 0)
+        return { id, layer, passed: true };
+    return { id, layer, passed: false, detail: issues.join('; ') };
+}
+//# sourceMappingURL=verdict.js.map

package/dist/conformance/checks/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../../../src/conformance/checks/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAuB;IAC/D,MAAM,EAAE,GAAG,kBAAkB,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAU,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IAEzB,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAkC,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,EAAE,mBAGR,CAAC;IAEd,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,kFAAkF;SAC3F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QAClC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,mBAAmB,GAAG,CAAC,GAAG,4BAA4B;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,yCAAyC,SAAS,qBAAqB,GAAG,CAAC,MAAM,EAAE;SAC5F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,EAAE,GAAG,6BAA6B,CAAC;IACzC,MAAM,KAAK,GAAG,CAAU,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IAEzB,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAkC,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,EAAE,yBAAuE,CAAC;IAE7F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,GAAG,CAAC,MAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CACT,uEAAuE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/conformance/harness.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Conformance harness — orchestrates Layer 1 + Layer 2 checks.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §4.10.
+ *
+ * `runConformance({ envelopeCid, options })` fetches the envelope + intent +
+ * trajectory + (at attested tier) source bundle from IPFS, then runs every
+ * Layer 1 and (conditionally) Layer 2 check, and assembles a ConformanceReport.
+ *
+ * All IPFS fetches can be bypassed by passing pre-loaded objects via
+ * ConformanceOptions injection fields — required for test isolation.
+ */
+import { type ConformanceOptions, type ConformanceReport } from './types.js';
+export interface RunConformanceArgs {
+    envelopeCid: string;
+    options?: ConformanceOptions;
+}
+/**
+ * Run the full conformance suite against a signed envelope CID.
+ *
+ * Steps:
+ *  1. Fetch envelope bytes (or use options.envelopeBytes).
+ *  2. Parse with SignedEnvelopeSchema.
+ *  3. Fetch intent by envelope.intent.cid (or use options.intent).
+ *  4. Fetch trajectory if envelope.trajectory?.cid is set (or use options.trajectory).
+ *  5. If role === 'verdict', fetch restoration envelope bytes (or use options.restorationEnvelopeBytes).
+ *  6. If evidenceTier === 'attested' and !skipLayer2, fetch source bundle (or use options.sourceBundle).
+ *  7. Run Layer 1 checks.
+ *  8. If attested and !skipLayer2, run Layer 2 checks.
+ *  9. Assemble ConformanceReport.
+ */
+export declare function runConformance(args: RunConformanceArgs): Promise<ConformanceReport>;

package/dist/conformance/harness.js

@@ -0,0 +1,228 @@
+/**
+ * Conformance harness — orchestrates Layer 1 + Layer 2 checks.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §4.10.
+ *
+ * `runConformance({ envelopeCid, options })` fetches the envelope + intent +
+ * trajectory + (at attested tier) source bundle from IPFS, then runs every
+ * Layer 1 and (conditionally) Layer 2 check, and assembles a ConformanceReport.
+ *
+ * All IPFS fetches can be bypassed by passing pre-loaded objects via
+ * ConformanceOptions injection fields — required for test isolation.
+ */
+import { SignedEnvelopeSchema } from '../types/envelope.js';
+import { fetchSignedEnvelopeBytesRaw, fetchSignedIntentFromIpfs, fetchTrajectoryFromIpfs, fetchSourceBundleFromIpfs, } from '../adapters/mech/ipfs.js';
+import { checkEnvelopeSchema } from './checks/envelope-schema.js';
+import { checkPayload } from './checks/payload.js';
+import { checkHashAndSignature } from './checks/hash-signature.js';
+import { checkTrajectorySchema } from './checks/trajectory-schema.js';
+import { checkHashChainIntegrity } from './checks/trajectory-chain.js';
+import { checkSpanProfile } from './checks/trajectory-profile.js';
+import { checkArtifactVocabulary, checkArtifactLinkage } from './checks/artifacts.js';
+import { checkVerdictBackReference, checkVerificationRecord } from './checks/verdict.js';
+import { checkSecretScrub } from './checks/secret-scrub.js';
+import { checkTracedHttpBoundary, checkMcpShimBoundary, checkSubprocessBoundary, checkRawSockets, checkDynamicCode, checkArtifactEmitPath, } from './checks/source-static.js';
+import { checkSeccompPolicy, checkNamespacePolicy, checkTlsTranscriptCapture, } from './checks/source-runtime.js';
+import { summarize, overallFromChecks, } from './types.js';
+// ─── Layer 1 sync checks ──────────────────────────────────────────────────────
+// (checkHashAndSignature is async, run separately)
+const LAYER1_SYNC_CHECKS = [
+    checkEnvelopeSchema,
+    checkPayload,
+    checkTrajectorySchema,
+    checkHashChainIntegrity,
+    checkSpanProfile,
+    checkArtifactVocabulary,
+    checkArtifactLinkage,
+    checkVerdictBackReference,
+    checkVerificationRecord,
+    checkSecretScrub,
+];
+// ─── Layer 2 static checks ───────────────────────────────────────────────────
+const LAYER2_STATIC_CHECKS = [
+    checkTracedHttpBoundary,
+    checkMcpShimBoundary,
+    checkSubprocessBoundary,
+    checkRawSockets,
+    checkDynamicCode,
+    checkArtifactEmitPath,
+];
+// ─── Layer 2 runtime stubs ───────────────────────────────────────────────────
+const LAYER2_RUNTIME_CHECKS = [
+    checkSeccompPolicy,
+    checkNamespacePolicy,
+    checkTlsTranscriptCapture,
+];
+/**
+ * Run the full conformance suite against a signed envelope CID.
+ *
+ * Steps:
+ *  1. Fetch envelope bytes (or use options.envelopeBytes).
+ *  2. Parse with SignedEnvelopeSchema.
+ *  3. Fetch intent by envelope.intent.cid (or use options.intent).
+ *  4. Fetch trajectory if envelope.trajectory?.cid is set (or use options.trajectory).
+ *  5. If role === 'verdict', fetch restoration envelope bytes (or use options.restorationEnvelopeBytes).
+ *  6. If evidenceTier === 'attested' and !skipLayer2, fetch source bundle (or use options.sourceBundle).
+ *  7. Run Layer 1 checks.
+ *  8. If attested and !skipLayer2, run Layer 2 checks.
+ *  9. Assemble ConformanceReport.
+ */
+export async function runConformance(args) {
+    const options = args.options ?? {};
+    const ctx = { envelopeCid: args.envelopeCid, options };
+    // ── Step 1–2: Envelope ────────────────────────────────────────────────────
+    try {
+        const bytes = options.envelopeBytes
+            ? (options.envelopeBytes instanceof Uint8Array
+                ? options.envelopeBytes
+                : new Uint8Array(options.envelopeBytes))
+            : await fetchEnvelopeBytes(args.envelopeCid, options);
+        ctx.envelopeBytes = bytes;
+        let parsed;
+        try {
+            parsed = JSON.parse(new TextDecoder().decode(bytes));
+        }
+        catch (err) {
+            return buildReport(args.envelopeCid, 'self-signed', [
+                {
+                    id: 'envelope.fetch',
+                    layer: 1,
+                    passed: false,
+                    detail: `envelope bytes could not be parsed as JSON: ${err.message}`,
+                },
+            ]);
+        }
+        // Attempt strict parse — store result regardless so checkEnvelopeSchema can
+        // report the exact Zod errors.
+        const parseResult = SignedEnvelopeSchema.safeParse(parsed);
+        if (parseResult.success) {
+            ctx.envelope = parseResult.data;
+        }
+        else {
+            // Store the raw object so downstream checks see it and report appropriately.
+            ctx.envelope = parsed;
+        }
+    }
+    catch (err) {
+        return buildReport(args.envelopeCid, 'self-signed', [
+            {
+                id: 'envelope.fetch',
+                layer: 1,
+                passed: false,
+                detail: `envelope could not be fetched: ${err.message}`,
+            },
+        ]);
+    }
+    // ── Step 3: Intent ────────────────────────────────────────────────────────
+    if (options.intent !== undefined) {
+        ctx.intent = options.intent;
+    }
+    else {
+        const intentCid = ctx.envelope?.intent?.cid;
+        if (intentCid) {
+            try {
+                ctx.intent = await fetchSignedIntentFromIpfs(options.ipfsGatewayUrl ?? '', intentCid);
+            }
+            catch {
+                // Leave undefined — checkIntentReference (if wired) captures this.
+                // Note: checkIntentReference isn't in this harness's Layer 1 set because
+                // the intent CID resolution is optional at V1 (many envelopes are tested
+                // with stub CIDs). The harness populates ctx.intent for checks that need it.
+            }
+        }
+    }
+    // ── Step 4: Trajectory ────────────────────────────────────────────────────
+    if (options.trajectory !== undefined) {
+        ctx.trajectory = options.trajectory;
+    }
+    else {
+        const trajCid = ctx.envelope
+            ?.trajectory?.cid;
+        if (trajCid) {
+            try {
+                ctx.trajectory = await fetchTrajectoryFromIpfs(options.ipfsGatewayUrl ?? '', trajCid);
+            }
+            catch {
+                /* leave undefined — trajectory checks will skip */
+            }
+        }
+    }
+    // ── Step 5: Restoration envelope (for verdict back-ref) ──────────────────
+    const envelopeRole = ctx.envelope?.role;
+    if (envelopeRole === 'verdict') {
+        if (options.restorationEnvelopeBytes !== undefined) {
+            ctx.restorationEnvelopeBytes = options.restorationEnvelopeBytes instanceof Uint8Array
+                ? options.restorationEnvelopeBytes
+                : new Uint8Array(options.restorationEnvelopeBytes);
+        }
+        else {
+            const refCid = ctx.envelope?.payload
+                ?.restorationEnvelope?.cid;
+            if (refCid) {
+                try {
+                    ctx.restorationEnvelopeBytes = await fetchEnvelopeBytes(refCid, options);
+                }
+                catch {
+                    /* leave undefined — checkVerdictBackReference captures */
+                }
+            }
+        }
+    }
+    // ── Step 6: Source bundle (attested tier only) ────────────────────────────
+    const envelopeTier = ctx.envelope?.evidenceTier;
+    const isAttested = envelopeTier === 'attested';
+    if (isAttested && !options.skipLayer2) {
+        if (options.sourceBundle !== undefined) {
+            ctx.sourceBundle = options.sourceBundle;
+        }
+        else {
+            const bundleCid = ctx.envelope?.executor?.source?.bundleCid;
+            if (bundleCid) {
+                try {
+                    ctx.sourceBundle = await fetchSourceBundleFromIpfs(options.ipfsGatewayUrl ?? '', bundleCid);
+                }
+                catch {
+                    /* leave undefined — static checks will skip */
+                }
+            }
+        }
+    }
+    // ── Steps 7–8: Run checks ─────────────────────────────────────────────────
+    const checks = [];
+    // Layer 1 sync checks
+    for (const fn of LAYER1_SYNC_CHECKS) {
+        checks.push(fn(ctx));
+    }
+    // Layer 1 async check (hash + signature)
+    checks.push(await checkHashAndSignature(ctx));
+    // Layer 2 checks (attested tier only, unless skipLayer2)
+    if (isAttested && !options.skipLayer2) {
+        for (const fn of LAYER2_STATIC_CHECKS) {
+            checks.push(fn(ctx));
+        }
+        for (const fn of LAYER2_RUNTIME_CHECKS) {
+            checks.push(fn(ctx));
+        }
+    }
+    // ── Step 9: Assemble report ───────────────────────────────────────────────
+    const resolvedTier = envelopeTier ?? 'self-signed';
+    return buildReport(args.envelopeCid, resolvedTier, checks);
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+async function fetchEnvelopeBytes(cid, options) {
+    // Fetch the exact bytes stored at the CID — no JSON parse/re-encode roundtrip
+    // so the bytes hashed here match the bytes hashed at upload time.
+    return fetchSignedEnvelopeBytesRaw(options.ipfsGatewayUrl ?? '', cid);
+}
+function buildReport(envelopeCid, envelopeTier, checks) {
+    const summary = summarize(checks);
+    const overall = overallFromChecks(checks);
+    const layer1 = checks.filter((c) => c.layer === 1);
+    const layer2 = checks.filter((c) => c.layer === 2);
+    const layer1Passed = layer1.every((c) => c.skipped === true || c.passed);
+    const layer2Passed = envelopeTier !== 'attested'
+        ? 'N/A'
+        : layer2.every((c) => c.skipped === true || c.passed);
+    return { envelopeCid, envelopeTier, checks, summary, overall, layer1Passed, layer2Passed };
+}
+//# sourceMappingURL=harness.js.map

package/dist/conformance/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/conformance/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,SAAS,EACT,iBAAiB,GAKlB,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,mDAAmD;AAEnD,MAAM,kBAAkB,GAAoD;IAC1E,mBAAmB;IACnB,YAAY;IACZ,qBAAqB;IACrB,uBAAuB;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,oBAAoB;IACpB,yBAAyB;IACzB,uBAAuB;IACvB,gBAAgB;CACjB,CAAC;AAEF,gFAAgF;AAEhF,MAAM,oBAAoB,GAAoD;IAC5E,uBAAuB;IACvB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;CACtB,CAAC;AAEF,gFAAgF;AAEhF,MAAM,qBAAqB,GAAoD;IAC7E,kBAAkB;IAClB,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC;AASF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,OAAO,GAAuB,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACvD,MAAM,GAAG,GAAuB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;IAE3E,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa;YACjC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,YAAY,UAAU;gBAC1C,CAAC,CAAC,OAAO,CAAC,aAAa;gBACvB,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACxD,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;QAE1B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE;gBAClD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,+CAAgD,GAAa,CAAC,OAAO,EAAE;iBAChF;aACF,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,6EAA6E;YAC7E,GAAG,CAAC,QAAQ,GAAG,MAA6B,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE;YAClD;gBACE,EAAE,EAAE,gBAAgB;gBACpB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,kCAAmC,GAAa,CAAC,OAAO,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAI,GAAG,CAAC,QAAsD,EAAE,MAAM,EAAE,GAAG,CAAC;QAC3F,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,GAAG,CAAC,MAAM,GAAG,MAAM,yBAAyB,CAC1C,OAAO,CAAC,cAAc,IAAI,EAAE,EAC5B,SAAS,CACV,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,yEAAyE;gBACzE,yEAAyE;gBACzE,6EAA6E;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAI,GAAG,CAAC,QAAiE;YACpF,EAAE,UAAU,EAAE,GAAG,CAAC;QACpB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,GAAG,CAAC,UAAU,GAAG,MAAM,uBAAuB,CAC5C,OAAO,CAAC,cAAc,IAAI,EAAE,EAC5B,OAAO,CACR,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,YAAY,GAAI,GAAG,CAAC,QAA0C,EAAE,IAAI,CAAC;IAC3E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACnD,GAAG,CAAC,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,YAAY,UAAU;gBACnF,CAAC,CAAC,OAAO,CAAC,wBAAwB;gBAClC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GACT,GAAG,CAAC,QAA8D,EAAE,OAAO;gBAC1E,EAAE,mBACL,EAAE,GAAG,CAAC;YACP,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,GAAG,CAAC,wBAAwB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC3E,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,YAAY,GAAI,GAAG,CAAC,QAAkD,EAAE,YAAY,CAAC;IAC3F,MAAM,UAAU,GAAG,YAAY,KAAK,UAAU,CAAC;IAE/C,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GACb,GAAG,CAAC,QACL,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,GAAG,CAAC,YAAY,GAAG,MAAM,yBAAyB,CAChD,OAAO,CAAC,cAAc,IAAI,EAAE,EAC5B,SAAS,CACV,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,+CAA+C;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,sBAAsB;IACtB,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9C,yDAAyD;IACzD,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,YAAY,GAAI,YAAkD,IAAI,aAAa,CAAC;IAC1F,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,kBAAkB,CAC/B,GAAW,EACX,OAA2B;IAE3B,8EAA8E;IAC9E,kEAAkE;IAClE,OAAO,2BAA2B,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAClB,WAAmB,EACnB,YAA+C,EAC/C,MAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,YAAY,GAChB,YAAY,KAAK,UAAU;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC7F,CAAC"}

package/dist/conformance/types.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Conformance report shapes.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §4.10.
+ *
+ * A ConformanceReport is the output of running the harness against an envelope
+ * CID. Layer 1 checks apply at every tier (structural). Layer 2 checks apply
+ * only at the `attested` tier (traced-I/O boundary). Layer 2 runtime checks
+ * are stubbed in V1 (skipped); Layer 2 static checks run fully.
+ */
+import type { EvidenceTier, SignedEnvelope } from '../types/envelope.js';
+import type { SignedIntentV1 } from '../types/intent.js';
+export interface CheckResult {
+    /** Dotted identifier: `<area>.<check>` — e.g. `envelope.schema`, `trajectory.hash-chain`. */
+    id: string;
+    /** Layer 1 = structural; Layer 2 = attested-tier traced-I/O boundary. */
+    layer: 1 | 2;
+    /** Whether the check passed. A skipped check is considered passing for overall verdict purposes. */
+    passed: boolean;
+    /** Set to true when the check was intentionally not run (e.g. Layer 2 at non-attested tier, or V1 runtime stub). */
+    skipped?: boolean;
+    /** Short human-readable reason on failure. */
+    detail?: string;
+}
+export type Overall = 'PASS' | 'FAIL' | 'SKIP';
+export interface ConformanceSummary {
+    total: number;
+    passed: number;
+    failed: number;
+    skipped: number;
+}
+export interface ConformanceReport {
+    envelopeCid: string;
+    envelopeTier: EvidenceTier;
+    checks: CheckResult[];
+    summary: ConformanceSummary;
+    overall: Overall;
+    layer1Passed: boolean;
+    /** 'N/A' when envelopeTier !== 'attested'. */
+    layer2Passed: boolean | 'N/A';
+}
+export interface ConformanceOptions {
+    /** Skip Layer 2 source-bundle static checks even at attested tier. Useful during plan-D-only dogfood. */
+    skipLayer2?: boolean;
+    /** Override IPFS gateway URL (defaults to config). */
+    ipfsGatewayUrl?: string;
+    /** Override IPFS registry URL (defaults to config). */
+    ipfsRegistryUrl?: string;
+    /** Pre-fetched envelope bytes (skip IPFS fetch). */
+    envelopeBytes?: Buffer | Uint8Array;
+    /** Pre-loaded intent (skip IPFS fetch). */
+    intent?: SignedIntentV1;
+    /** Pre-fetched trajectory bytes (skip IPFS fetch). */
+    trajectoryBytes?: Buffer | Uint8Array;
+    /** Pre-loaded trajectory (skip IPFS fetch). */
+    trajectory?: unknown;
+    /** Pre-fetched restoration envelope bytes (skip IPFS fetch). */
+    restorationEnvelopeBytes?: Buffer | Uint8Array;
+    /** Pre-loaded source bundle (skip IPFS fetch). */
+    sourceBundle?: {
+        files: Map<string, string>;
+        manifest?: Record<string, unknown>;
+    };
+}
+/**
+ * ConformanceContext carries pre-fetched objects between checks so each
+ * check doesn't re-fetch from IPFS. The harness populates this incrementally
+ * as checks pass.
+ */
+export interface ConformanceContext {
+    envelopeCid: string;
+    envelopeBytes?: Uint8Array;
+    envelope?: SignedEnvelope;
+    intent?: SignedIntentV1;
+    trajectoryBytes?: Uint8Array;
+    trajectory?: unknown;
+    sourceBundle?: {
+        files: Map<string, string>;
+        manifest?: Record<string, unknown>;
+    };
+    /** Pre-fetched bytes of the referenced restoration envelope (for verdict checks). */
+    restorationEnvelopeBytes?: Uint8Array;
+    /** Pre-loaded restoration envelope object (for verdict checks). */
+    restorationEnvelope?: SignedEnvelope;
+    options: ConformanceOptions;
+}
+export declare function summarize(checks: CheckResult[]): ConformanceSummary;
+export declare function overallFromChecks(checks: CheckResult[]): Overall;

package/dist/conformance/types.js

@@ -0,0 +1,31 @@
+/**
+ * Conformance report shapes.
+ *
+ * Scope: docs/superpowers/specs/2026-04-23-jinn-execution-envelope-tee-scope.md §4.10.
+ *
+ * A ConformanceReport is the output of running the harness against an envelope
+ * CID. Layer 1 checks apply at every tier (structural). Layer 2 checks apply
+ * only at the `attested` tier (traced-I/O boundary). Layer 2 runtime checks
+ * are stubbed in V1 (skipped); Layer 2 static checks run fully.
+ */
+export function summarize(checks) {
+    let passed = 0;
+    let failed = 0;
+    let skipped = 0;
+    for (const c of checks) {
+        if (c.skipped)
+            skipped++;
+        else if (c.passed)
+            passed++;
+        else
+            failed++;
+    }
+    return { total: checks.length, passed, failed, skipped };
+}
+export function overallFromChecks(checks) {
+    if (checks.length === 0)
+        return 'SKIP';
+    const anyFailed = checks.some((c) => !c.skipped && !c.passed);
+    return anyFailed ? 'FAIL' : 'PASS';
+}
+//# sourceMappingURL=types.js.map

package/dist/conformance/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/conformance/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA+EH,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;aACpB,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,EAAE,CAAC;;YACvB,MAAM,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC"}

package/dist/corpus/acquire.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Per-artifact resolution chain: cache → self-store → routeResolver → origin.
+ *
+ * Always hash-verifies before persisting to cache.
+ *
+ * Spec §2.3 step 4-6.
+ */
+import type { Store } from '../store/store.js';
+import { type AcquireWithPaymentResult } from '../x402/acquire.js';
+import type { ArtifactContent, RouteResolver } from './types.js';
+/**
+ * Origin acquire function. Historically returned `Buffer | null`; the new
+ * discriminated union lets callers distinguish not_found vs payment_failed
+ * vs network_error. We accept either shape so test fakes that still return
+ * `Buffer | null` keep working.
+ */
+type AcquireFnLegacy = (endpoint: string, sha256: string, privateKey: string) => Promise<Buffer | null>;
+type AcquireFnNew = (endpoint: string, sha256: string, privateKey: string) => Promise<AcquireWithPaymentResult>;
+type AcquireFn = AcquireFnLegacy | AcquireFnNew;
+export interface AcquireArtifactArgs {
+    sha256: string;
+    artifactType: string;
+    access: {
+        endpoint: string;
+        priceUsdc: string;
+    };
+    store: Store;
+    selfSafeAddress: string;
+    privateKey: string;
+    routeResolver?: RouteResolver;
+    envelopeCid?: string;
+    /** Safe address that produced this artifact, when known (from envelope.participant). */
+    ownerSafe?: string;
+    acquireFn?: AcquireFn;
+}
+export declare function acquireArtifactContent(args: AcquireArtifactArgs): Promise<ArtifactContent>;
+export {};