@jinn-network/client 0.1.2 → 0.1.3-canary.262e5cda

package/dist/restorer/engine/engine.js

@@ -7,13 +7,17 @@
  * Transition method bodies are stubs; subsequent tasks fill them in.
  */
 import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
 import { IntentPersistence } from './persistence.js';
 import { IntentState, MissingEvidenceHashError } from './state.js';
 import { executeTwoLayerClaim, releaseClaimedNotStarted, } from './claim.js';
-import { provisionWorkingDir, provisionImplStateDir, walkArtifacts, uploadArtifacts, registerArtifacts, } from './packaging.js';
-import { assembleAndSignManifest, } from './manifest-assembly.js';
+import { provisionWorkingDir, provisionImplStateDir, walkArtifacts, uploadArtifacts, } from './packaging.js';
+import { assembleAndSignEnvelope, } from './envelope-assembly.js';
 import { deliverAndClaim, } from './delivery.js';
 import { SkippableError } from '../types.js';
+import { submitEvaluatorFeedback } from '../../erc8004/index.js';
+import { TrajectoryCollector, emitTrajectory } from '../../trajectory/index.js';
+import { buildInfo } from '../../build-info.js';
 // ── Sentinel error ────────────────────────────────────────────────────────────
 export class NotImplementedError extends Error {
     transitionName;
@@ -26,29 +30,45 @@ export class NotImplementedError extends Error {
 // ── RestorationEngine ─────────────────────────────────────────────────────────
 export class RestorationEngine {
     persistence;
-    registry;
     paths;
     claimDeps;
     packagingDeps;
-    manifestDeps;
+    envelopeDeps;
     deliveryDeps;
     implRegistry;
-    erc8004Registry;
+    identityPublisher;
+    reputationFeedback;
+    operatorConfig;
+    /** Local SQLite-backed store; used to emit `restoration-result` /
+     *  `evaluation-verdict` artifact rows when a cycle completes via a
+     *  deterministic impl (the legacy claude/MCP path writes them itself). */
+    store;
     // Transient storage for impl output between runImpl and pack transitions.
     // Keyed by requestId; cleared after successful pack.
     implOutputs = new Map();
+    // Transient storage for trajectory collectors produced in runImpl.
+    // emitTrajectory is deferred to pack() so that artifact spans can be added
+    // before the trajectory is finalised and uploaded (Task 16 bidirectional linkage).
+    // Keyed by requestId; cleared after successful pack.
+    // Protected (not private) to allow test subclasses to inject collectors.
+    trajectoryCollectors = new Map();
+    // Transient storage for trajectory CID+sha256 refs produced by runImpl.
+    // Keyed by requestId; cleared after successful pack.
+    trajectoryRefs = new Map();
     /** Set by stop(); causes runTickLoop to exit at the next iteration. */
     stopped = false;
     constructor(opts) {
         this.persistence = new IntentPersistence(opts.store.db);
-        this.registry = opts.registry;
+        this.store = opts.store;
         this.paths = opts.paths;
         this.claimDeps = opts.claimDeps;
         this.packagingDeps = opts.packagingDeps;
-        this.manifestDeps = opts.manifestDeps;
+        this.envelopeDeps = opts.envelopeDeps;
         this.deliveryDeps = opts.deliveryDeps;
         this.implRegistry = opts.implRegistry;
-        this.erc8004Registry = opts.erc8004Registry;
+        this.identityPublisher = opts.identityPublisher;
+        this.reputationFeedback = opts.reputationFeedback;
+        this.operatorConfig = opts.operatorConfig;
     }
     // ── Public API ──────────────────────────────────────────────────────────────
     /**
@@ -254,7 +274,10 @@ export class RestorationEngine {
                 throw new Error(reason);
             }
             if (impl.isReady) {
-                const status = await impl.isReady();
+                const status = await impl.isReady({
+                    kind: intent.specKind,
+                    type: intent.intentType ?? 'restoration',
+                });
                 if (!status.ready) {
                     const reason = `impl '${impl.name}' not ready: ${status.reason ?? 'unknown'}${status.nextStep?.cli ? ` — run \`${status.nextStep.cli}\`` : ''}`;
                     this.persistence.markFailed(intent.requestId, reason);
@@ -326,22 +349,25 @@ export class RestorationEngine {
     async takePreSnapshot(intent) {
         const workingDir = join(this.paths.workingDirRoot, intent.requestId);
         // Resolve the impl via registry so implStateDir matches the path runImpl uses
-        // (join(implStateDirRoot, impl.name)). Falls back to specKind then 'default'
+        // (join(implStateDirRoot, impl.name, kind)). Falls back to specKind then 'default'
         // when no impl is registered — legacy path preserved for health-check intents.
         const resolvedImpl = intent.specKind
             ? this.implRegistry?.findFor({ kind: intent.specKind, type: intent.intentType ?? 'restoration' }) ?? null
             : null;
         const implStateName = intent.implName ?? resolvedImpl?.name ?? intent.specKind ?? 'default';
-        const implStateDir = join(this.paths.implStateDirRoot, implStateName);
-        // Prefer the persisted full DesiredState; fall back to a stub for legacy
+        const kindSeg = (intent.specKind ?? '').replace(/[.:]/g, '_');
+        const implStateDir = kindSeg
+            ? join(this.paths.implStateDirRoot, implStateName, kindSeg)
+            : join(this.paths.implStateDirRoot, implStateName);
+        // Prefer the persisted full RestorationJob; fall back to a stub for legacy
         // (pre-migration) rows so the engine still works for health-check intents.
-        const desiredState = intent.desiredState ?? {
+        const restorationJob = intent.restorationJob ?? {
             id: intent.requestId,
             description: '',
             ...(intent.specKind ? { spec: { kind: intent.specKind } } : {}),
             window: { startTs: intent.windowStartTs, endTs: intent.windowEndTs },
         };
-        provisionWorkingDir(workingDir, desiredState);
+        provisionWorkingDir(workingDir, restorationJob);
         provisionImplStateDir(implStateDir);
         // takePreSnapshot transitions directly to RUNNING with the snapshot payload
         // and workingDir/implStateDir paths set.  We cannot transition
@@ -374,14 +400,22 @@ export class RestorationEngine {
             throw new NotImplementedError('runImpl');
         }
         const workingDir = intent.workingDir ?? join(this.paths.workingDirRoot, intent.requestId);
-        const implStateDir = intent.implStateDir ?? join(this.paths.implStateDirRoot, impl.name);
+        const kindSeg = specKind.replace(/[.:]/g, '_');
+        const implStateDir = intent.implStateDir ?? (kindSeg
+            ? join(this.paths.implStateDirRoot, impl.name, kindSeg)
+            : join(this.paths.implStateDirRoot, impl.name));
         const windowEndTs = intent.windowEndTs;
         const abort = new AbortController();
         const msUntilEndTs = () => Math.max(0, windowEndTs - Date.now());
         const endTimer = setTimeout(() => abort.abort(), msUntilEndTs());
+        // Create a trajectory collector for this run.
+        const trajectory = new TrajectoryCollector({
+            intentCid: intent.intentCid ?? '',
+            runId: randomUUID(),
+        });
         try {
             const ctx = {
-                intent: (intent.desiredState ?? {
+                intent: (intent.restorationJob ?? {
                     id: intent.requestId,
                     description: '',
                     ...(intent.specKind ? { spec: { kind: intent.specKind } } : {}),
@@ -395,6 +429,7 @@ export class RestorationEngine {
                 },
                 abort: abort.signal,
                 msUntilEndTs,
+                trajectory,
             };
             let output;
             try {
@@ -424,6 +459,12 @@ export class RestorationEngine {
                 }
             }
             this.implOutputs.set(intent.requestId, output);
+            // Store the trajectory collector so pack() can:
+            //   1. pass it to uploadArtifacts (artifact.emit spans + producedBy metadata)
+            //   2. call emitTrajectory AFTER artifact upload so spans are included
+            //   3. backfill trajectoryCid on artifacts before envelope assembly
+            // emitTrajectory is intentionally deferred to pack() (Task 16).
+            this.trajectoryCollectors.set(intent.requestId, trajectory);
             // Persist impl output BEFORE the state transition so that a crash after
             // the transition (RUNNING → POST_SNAPSHOT) but before pack() runs will
             // find the serialised output in the DB on restart. pack() will hydrate the
@@ -448,9 +489,9 @@ export class RestorationEngine {
     }
     /**
      * PACKAGING transition: walk workingDir, upload artifacts, assemble + sign
-     * manifest, upload manifest, persist manifest CID + artifact CIDs.
+     * envelope, upload envelope, persist envelope CID + artifact CIDs.
      *
-     * Requires packagingDeps + manifestDeps. When absent, falls back to
+     * Requires packagingDeps + envelopeDeps. When absent, falls back to
      * NotImplementedError.
      */
     async pack(intent) {
@@ -468,61 +509,148 @@ export class RestorationEngine {
                 console.warn(`[restorer-engine] ${intent.requestId}: failed to hydrate implOutputsJson: ${err instanceof Error ? err.message : err}`);
             }
         }
-        if (!this.packagingDeps || !this.manifestDeps) {
+        if (!this.packagingDeps || !this.envelopeDeps) {
             throw new NotImplementedError('pack');
         }
         const workingDir = intent.workingDir ?? join(this.paths.workingDirRoot, intent.requestId);
         const implOutput = this.implOutputs.get(intent.requestId);
         const implArtifacts = implOutput?.artifacts ?? [];
-        // 1. Walk + upload artifacts (NO registration yet — manifest CID not known)
+        // 1. Walk + upload artifacts (NO registration yet — manifest CID not known).
+        // Pass the trajectory collector (if present) so uploadArtifacts can emit
+        // jinn.artifact.emit spans and attach producedBy back-refs (Task 16 forward
+        // linkage). emitTrajectory is called AFTER upload so artifact spans are included.
+        const collector = this.trajectoryCollectors.get(intent.requestId);
+        const packagingDepsWithReq = {
+            ...this.packagingDeps,
+            requestId: intent.requestId,
+            ...(collector ? { collector } : {}),
+        };
         const rawArtifacts = await walkArtifacts(workingDir, implArtifacts);
-        const uploadedArtifacts = await uploadArtifacts(rawArtifacts, this.packagingDeps);
+        const uploadedArtifacts = await uploadArtifacts(rawArtifacts, packagingDepsWithReq);
+        // 1b. Emit trajectory to IPFS now that all artifact spans have been added.
+        // Non-fatal — envelope assembly continues with envelope.trajectory = null if upload fails.
+        let trajectoryRef = this.trajectoryRefs.get(intent.requestId) ?? null;
+        if (!trajectoryRef && collector && this.envelopeDeps) {
+            try {
+                const { privateKeyToAccount } = await import('viem/accounts');
+                const account = privateKeyToAccount(this.envelopeDeps.agentEoaPrivateKey);
+                const { cid, sha256 } = await emitTrajectory({
+                    collector,
+                    runId: collector.runId,
+                    signerPrivateKey: this.envelopeDeps.agentEoaPrivateKey,
+                    signerAddress: account.address,
+                    ipfsRegistryUrl: this.envelopeDeps.ipfsRegistryUrl,
+                });
+                trajectoryRef = { cid, sha256 };
+                console.log(`[restorer-engine] ${intent.requestId}: trajectory emitted cid=${cid}`);
+            }
+            catch (err) {
+                console.warn(`[restorer-engine] ${intent.requestId}: trajectory emit failed (non-fatal):`, err instanceof Error ? err.message : err);
+            }
+        }
+        this.trajectoryRefs.set(intent.requestId, trajectoryRef);
+        // 1c. Backward linkage: backfill trajectoryCid on all artifacts that have a
+        // producedBy back-ref. This must happen BEFORE assembleAndSignEnvelope so the
+        // signed envelope carries the complete reference (Task 16).
+        if (trajectoryRef) {
+            const trajectoryCid = trajectoryRef.cid;
+            for (const art of uploadedArtifacts) {
+                const pb = art.metadata?.['producedBy'];
+                if (pb != null && typeof pb === 'object' && 'spanId' in pb) {
+                    pb['trajectoryCid'] = trajectoryCid;
+                }
+            }
+        }
         // Map to Artifact shape (strip localPath)
         const artifacts = uploadedArtifacts.map(({ localPath: _localPath, ...art }) => art);
         // 2. Derive agentEoa from private key
         const { privateKeyToAccount } = await import('viem/accounts');
-        const account = privateKeyToAccount(this.manifestDeps.agentEoaPrivateKey);
+        const account = privateKeyToAccount(this.envelopeDeps.agentEoaPrivateKey);
         const agentEoa = account.address;
-        // Safe multisig address — sourced from manifestDeps (preferred) or deliveryDeps.
+        // Safe multisig address — sourced from envelopeDeps (preferred) or deliveryDeps.
         // Hard throw if absent: falling back to agentEoa would produce a
-        // protocol-invalid manifest (safeAddress MUST differ from agentEoa, §5.1).
-        const safeAddress = this.manifestDeps.safeAddress ?? this.deliveryDeps?.safeAddress;
+        // protocol-invalid envelope (safeAddress MUST differ from agentEoa, §5.1).
+        const safeAddress = this.envelopeDeps.safeAddress ?? this.deliveryDeps?.safeAddress;
         if (!safeAddress) {
-            throw new Error('pack: safeAddress not configured in manifestDeps or deliveryDeps');
+            throw new Error('pack: safeAddress not configured in envelopeDeps or deliveryDeps');
         }
-        // 3. Assemble + sign manifest
-        const provenance = {
-            intentCid: intent.intentCid,
-            onchainCreationTx: intent.onchainCreationTx,
-            onchainCreationBlock: intent.onchainCreationBlock,
-            requestId: intent.requestId,
-            safeAddress,
-            agentEoa,
-            windowStartTs: intent.windowStartTs,
-            windowEndTs: intent.windowEndTs,
-        };
+        // 3. Build envelope payload from impl output (kind-typed, wrapped into payload field)
         const preSnapshotPayload = intent.preSnapshotPayload;
         const postSnapshotPayload = intent.postSnapshotPayload;
-        const manifestImplOutput = {
-            preSnapshot: {
-                capturedAt: intent.preSnapshotCapturedAt ?? Date.now(),
-                hlTime: preSnapshotPayload?.hlTime ?? 0,
-                // Double-fallback: first tries the structured .payload field (normal shape),
-                // then falls back to the whole payload object (handles takePreSnapshot's
-                // synthetic shape where the snapshot IS the top-level object, not nested).
-                payload: preSnapshotPayload?.payload ?? preSnapshotPayload ?? {},
-            },
-            postSnapshot: {
-                capturedAt: intent.postSnapshotCapturedAt ?? Date.now(),
-                hlTime: postSnapshotPayload?.hlTime ?? 0,
-                // Same double-fallback as above.
-                payload: postSnapshotPayload?.payload ?? postSnapshotPayload ?? {},
-            },
-            fills: intent.fillsPayload ?? [],
-            gating: intent.gatingClaim ?? {},
-            informational: intent.informationalClaim ?? undefined,
-            rationale: implOutput?.rationale ?? undefined,
-        };
+        // The specKind drives payload schema selection. Fall back to 'legacy.v0'
+        // for intents without a spec.kind (legacy health-check / daemon-loop-test
+        // intents that use the legacy-claude impl). The legacy.v0 kind accepts any
+        // Record payload so validatePayload does not reject the output.
+        const specKind = intent.specKind ?? 'legacy.v0';
+        // Derive role from intent type. Evaluator intents produce 'verdict' envelopes;
+        // all other intents produce 'restoration' envelopes.
+        const isEvaluation = intent.intentType === 'evaluation';
+        const role = isEvaluation ? 'verdict' : 'restoration';
+        let envelopePayload;
+        if (isEvaluation) {
+            // ── Verdict envelope payload ──────────────────────────────────────────────
+            // The evaluator impl populates verdictPayload on RestorationOutput with a
+            // PortfolioV0VerdictPayload-shaped object. Engine passes it through to the
+            // envelope assembler, which runs validatePayload('portfolio.v0', 'verdict', ...).
+            //
+            // If verdictPayload is absent (impl bug / crash recovery), fall back to a
+            // minimal INDETERMINATE stub so the envelope assembly does not silently succeed
+            // with a wrong shape — validatePayload will catch schema mismatches.
+            //
+            // verificationOfRestoration: stubbed — Plan D will connect the real SDK.
+            // restorationEnvelope.sha256: placeholder — Plan D wires real sha256 derivation.
+            const verdictPayload = implOutput?.verdictPayload;
+            if (!verdictPayload) {
+                throw new Error(`pack: evaluator impl for ${intent.requestId} did not produce verdictPayload on RestorationOutput; ` +
+                    `ensure the impl populates output.verdictPayload`);
+            }
+            // If the (stub) verificationOfRestoration reports 'invalid', downgrade verdict
+            // to REJECTED per scope §3.3.  For V1 the stub always returns 'valid', so this
+            // path does not fire in practice — Plan D makes it real.
+            const verif = verdictPayload['verificationOfRestoration'];
+            if (verif?.overall === 'invalid') {
+                // Override verdict to REJECTED; preserve the rest of the payload.
+                envelopePayload = {
+                    ...verdictPayload,
+                    verdict: 'REJECTED',
+                };
+            }
+            else {
+                envelopePayload = verdictPayload;
+            }
+        }
+        else if (implOutput?.restorationPayload) {
+            // ── Non-portfolio restoration envelope payload ────────────────────────────
+            // Impls for kinds with a non-portfolio payload schema (e.g. prediction.v0)
+            // declare their own fully-formed payload. Engine passes it through directly
+            // so validatePayload() can check it against the per-kind schema.
+            envelopePayload = implOutput.restorationPayload;
+        }
+        else {
+            // ── Portfolio restoration envelope payload (legacy / portfolio.v0) ─────────
+            envelopePayload = {
+                preSnapshot: {
+                    capturedAt: intent.preSnapshotCapturedAt ?? Date.now(),
+                    hlTime: preSnapshotPayload?.hlTime ?? 0,
+                    // Double-fallback: first tries the structured .payload field (normal shape),
+                    // then falls back to the whole payload object (handles takePreSnapshot's
+                    // synthetic shape where the snapshot IS the top-level object, not nested).
+                    payload: preSnapshotPayload?.payload ?? preSnapshotPayload ?? {},
+                },
+                postSnapshot: {
+                    capturedAt: intent.postSnapshotCapturedAt ?? Date.now(),
+                    hlTime: postSnapshotPayload?.hlTime ?? 0,
+                    // Same double-fallback as above.
+                    payload: postSnapshotPayload?.payload ?? postSnapshotPayload ?? {},
+                },
+                fills: intent.fillsPayload ?? [],
+                gating: intent.gatingClaim ?? {},
+                ...(intent.informationalClaim != null
+                    ? { informational: intent.informationalClaim }
+                    : {}),
+                ...(implOutput?.rationale != null ? { rationale: implOutput.rationale } : {}),
+            };
+        }
         // 4. Persist generatedAt once (first pack); reuse on retry for CID determinism.
         const generatedAt = intent.manifestGeneratedAt ?? Date.now();
         if (!intent.manifestGeneratedAt) {
@@ -530,54 +658,77 @@ export class RestorationEngine {
             // transition still gets the same generatedAt on the next attempt.
             this.persistence.setManifestGeneratedAt(intent.requestId, generatedAt);
         }
-        const manifestOpts = { generatedAt };
-        // 5. Sign + upload manifest → manifest CID now known
-        const { manifest: _manifest, manifestCid, signatureHash } = await assembleAndSignManifest(provenance, manifestImplOutput, artifacts, this.manifestDeps, manifestOpts);
-        // 6. Register artifacts with back-pointer to parent manifest CID (spec §6.1)
-        registerArtifacts(uploadedArtifacts, manifestCid, this.packagingDeps);
-        // 6b. ERC-8004 Identity Registry registration (Plan E Task 11). Best-effort:
-        // failures emit a warning but do not fail the pack() transition — the envelope
-        // + on-chain claimDelivery evidenceHash remain the canonical substrate.
-        if (this.erc8004Registry) {
-            const intentType = (intent.intentType ?? 'restoration');
-            const envelopeRegistrationPromise = this.erc8004Registry
-                .registerEnvelope({
-                envelopeCid: manifestCid,
-                kind: intent.specKind ?? 'unknown',
-                role: intentType,
-                evidenceTier: 'self-signed',
-                intentCid: intent.intentCid ?? '',
-                parentEnvelopeCid: intent.intentType === 'evaluation'
-                    ? intent['parentEnvelopeCid']
-                    : undefined,
-                participant: safeAddress,
-                generatedAt,
-            })
-                .catch((err) => {
-                console.warn(`[restorer-engine] registerEnvelope failed for ${intent.requestId}: ${err instanceof Error ? err.message : err}`);
-                return null;
-            });
-            const artifactRegistrationPromises = uploadedArtifacts.map((art) => this.erc8004Registry
-                .registerArtifactWithParent({
-                id: art.cid,
-                title: art.role ?? 'unknown',
-                tags: [intent.specKind ?? 'unknown'],
-                outcome: 'restored',
-                endpoint: `ipfs://${art.cid}`,
-                parentEnvelopeCid: manifestCid,
-            })
-                .catch((err) => {
-                console.warn(`[restorer-engine] registerArtifactWithParent failed for ${art.cid}: ${err instanceof Error ? err.message : err}`);
-                return null;
-            }));
-            // Await all registrations so uncaught-promise warnings don't fire.
-            // We do NOT block the state transition on these — they are fire-and-resolve.
-            await Promise.all([envelopeRegistrationPromise, ...artifactRegistrationPromises]);
-        }
-        // 7. Build artifact CID map for persistence
+        // 5. Assemble + sign envelope → envelope CID now known.
+        // trajectoryRef was computed in step 1b above (emitted after artifact upload).
+        // Per the post-gating-fix schema, trajectory references carry sha256 + access
+        // (the operator HTTP endpoint that serves the bytes). Phase 3 (jinn-mono-vy37.1.3)
+        // sources this from the engine's operatorConfig; absent operatorConfig (e.g. test
+        // fixtures) falls back to packagingDeps.operatorEndpoint, then to a localhost
+        // sentinel so suites that don't exercise the publish path still pack cleanly.
+        const operatorEndpointForTraj = this.operatorConfig?.publicEndpoint
+            ?? this.packagingDeps?.operatorEndpoint
+            ?? 'http://localhost:7331';
+        const envelopeTrajectory = trajectoryRef
+            ? {
+                sha256: trajectoryRef.sha256,
+                access: { endpoint: operatorEndpointForTraj, priceUsdc: '0' },
+            }
+            : null;
+        // evidenceTier reflects the on-chain commitment state at the time of signing.
+        // For the V2 claim flow, claimDelivery will write an evidenceHash on-chain,
+        // so the envelope should be declared 'committed'. For V1 or unknown flows,
+        // 'self-signed' is accurate (no on-chain hash commitment).
+        const evidenceTier = this.deliveryDeps?.claimDeliveryVariant === 'v2' ? 'committed' : 'self-signed';
+        const envelopeInputs = {
+            kind: specKind,
+            role,
+            intent: {
+                cid: intent.intentCid,
+                onchainCreationTx: intent.onchainCreationTx,
+                onchainCreationBlock: intent.onchainCreationBlock,
+                requestId: intent.requestId,
+            },
+            participant: { safeAddress, agentEoa },
+            window: { startTs: intent.windowStartTs, endTs: intent.windowEndTs },
+            executor: {
+                implName: intent.implName ?? specKind,
+                // buildInfo resolves to real values in production builds; falls back to
+                // clearly-labelled placeholders ('dev' / 'sha256:dev-build') when running
+                // via tsx without a prior `yarn build` (dev mode).
+                implVersion: buildInfo.implVersion,
+                clientGitSha: buildInfo.clientGitSha,
+                codeDigest: buildInfo.codeDigest,
+                signingKey: { kind: 'agent-eoa', pubkey: agentEoa },
+            },
+            evidenceTier,
+            trajectory: envelopeTrajectory,
+            artifacts,
+            payload: envelopePayload,
+            generatedAt,
+        };
+        const { envelopeCid, envelopeHash } = await assembleAndSignEnvelope(envelopeInputs, this.envelopeDeps);
+        const manifestCid = envelopeCid;
+        const signatureHash = envelopeHash;
+        // 6. ERC-8004 IdentityRegistry per-execution `setMetadata` fires in
+        //    deliver() AFTER claimDelivery succeeds. 'committed' must mean
+        //    "observable on-chain evidenceHash exists" — publishing before claim
+        //    would lie during failures. The evidenceHash (signatureHash) is
+        //    persisted to DELIVERING state below and reused by deliver().
+        //    Operator-rooted entity model: docs/superpowers/specs/2026-04-27-erc-8004-entity-model-design.md.
+        // 7. Build artifact sha256 map for persistence.
+        // Post-gating-fix (spec §1): artifacts no longer have IPFS CIDs — bytes
+        // live in served_artifacts keyed by sha256. We reuse the legacy
+        // `artifactCids` persistence column (key: localPath) but populate it with
+        // sha256 hashes so downstream readers still get a stable identifier.
         const artifactCids = {};
         for (const art of uploadedArtifacts) {
-            artifactCids[art.localPath] = art.cid;
+            artifactCids[art.localPath] = art.sha256;
+        }
+        // Backfill envelope_cid (manifestCid) on every served_artifacts row so
+        // the operator can answer manifest-rooted lookups later. Done after the
+        // manifest CID is known.
+        for (const art of uploadedArtifacts) {
+            this.store.setServedArtifactEnvelopeCid(art.sha256, manifestCid);
         }
         // 8. Persist DELIVERING with manifest CID + artifact CIDs + evidence hash.
         //    evidenceHash gets its own dedicated column (not stashed in informationalClaim).
@@ -587,8 +738,10 @@ export class RestorationEngine {
             evidenceHash: signatureHash,
         });
         console.log(`[restorer-engine] ${intent.requestId} PACKAGING → DELIVERING manifestCid=${manifestCid}`);
-        // Clean up impl output (no longer needed)
+        // Clean up transient state (no longer needed after DELIVERING)
         this.implOutputs.delete(intent.requestId);
+        this.trajectoryCollectors.delete(intent.requestId);
+        this.trajectoryRefs.delete(intent.requestId);
     }
     /**
      * DELIVERING transition: call mech.deliverToMarketplace + JinnRouter.claimDelivery.
@@ -627,6 +780,234 @@ export class RestorationEngine {
             deliveryTxHash,
         });
         console.log(`[restorer-engine] ${requestId} DELIVERING → COMPLETE deliveryTx=${deliveryTxHash} claimTx=${claimTxHash}`);
+        // Emit a SQLite artifact row so consumers (release acceptance gate, search
+        // API) see this cycle alongside legacy-claude / MCP-emitted rows. The
+        // legacy claude path writes via the MCP `submit_restoration_result` tool;
+        // deterministic impls (prediction-v0-baseline, prediction-v0-evaluator,
+        // …) don't go through MCP, so the engine emits on their behalf here.
+        // Idempotent: skips when a row for this requestId+tag already exists
+        // (legacy path may have already inserted).
+        this.emitCycleArtifact(intent, manifestCid, evidenceHash);
+        // ── ERC-8004 setMetadata — fires AFTER claimDelivery succeeds ────────────
+        //
+        // Moved here from pack() per PR#37 review2 must-fix #2. 'committed' means
+        // "observable on-chain evidenceHash exists" — publishing before claim would
+        // lie during failures. evidenceHash comes from intent (persisted in
+        // DELIVERING state by pack()); idempotent on retry (setMetadata is a pure
+        // key-value write; re-running with the same payload is safe).
+        //
+        // Restoration-only for now. Evaluator setMetadata lands with jinn-mono-2ff.
+        if (this.identityPublisher) {
+            const intentTypeRaw = intent.intentType ?? 'restoration';
+            if (intentTypeRaw === 'restoration') {
+                const signatureHash = evidenceHash;
+                // v0 tier rule: with an evidenceHash on chain we declare `committed` (tier=1);
+                // higher tiers (`attested`, `proved`) come later when TEE work lands.
+                const tier = signatureHash ? 1 : 0;
+                const setMetadataPayload = {
+                    version: 1,
+                    tier,
+                    manifestHash: signatureHash ?? '0x',
+                    attestationQuoteCid: '0x',
+                    sourceMeasurement: '0x0000000000000000000000000000000000000000000000000000000000000000',
+                };
+                try {
+                    const pubTxHash = await this.identityPublisher.publishContent({
+                        kind: 'envelope',
+                        cid: manifestCid,
+                        payload: setMetadataPayload,
+                    });
+                    console.log(`[restorer-engine] ${requestId}: setMetadata envelope:${manifestCid} tx=${pubTxHash}`);
+                }
+                catch (err) {
+                    console.warn(`[restorer-engine] ${requestId}: setMetadata envelope publish failed (non-fatal): ${err instanceof Error ? err.message : err}`);
+                }
+            }
+        }
+        // ── Reputation feedback hook (jinn-mono-yg4) ─────────────────────────────
+        //
+        // Evaluator-only path: after `claimDelivery` settles the verdict, fire
+        // `ReputationRegistry.giveFeedback(restorerAgentId, ...)` so the
+        // restorer's agent NFT accrues a rating (DR §4.3).
+        //
+        // Best-effort: any failure inside the hook is logged but does not
+        // change the COMPLETE state. claimDelivery is already authoritative.
+        if (intent.intentType === 'evaluation' && this.reputationFeedback) {
+            await this._maybePostEvaluatorFeedback(intent).catch((err) => {
+                console.warn(`[restorer-engine] ${requestId}: reputation feedback hook errored unexpectedly (non-fatal): ${err instanceof Error ? err.message : err}`);
+            });
+        }
+    }
+    /**
+     * Post evaluator feedback on the restorer's agent NFT.
+     *
+     * Pulls the verdict from the persisted gating claim (the evaluator impl
+     * writes `{ verdict, score, scoreBasis, ... }` into `output.gating`),
+     * resolves the restorer's `agentId` via the configured subgraph
+     * resolver, and submits a single `ReputationRegistry.giveFeedback` tx.
+     *
+     * Skipped silently when:
+     *   - No `reputationFeedback` deps wired.
+     *   - `gatingClaim` doesn't carry a verdict (impl shape mismatch — log and
+     *     return).
+     *   - The parent restorer's manifest hash isn't reachable from the
+     *     persisted state (legacy intents that pre-date evidenceHash
+     *     threading — log and return).
+     *   - `resolveAgentId` returns null (subgraph not indexed yet, or no
+     *     subgraph URL configured at all — log and return).
+     *
+     * The mapping policy (PASS / FAIL / REJECTED / INDETERMINATE → score) lives
+     * inside `submitEvaluatorFeedback` / `mapVerdictToScore` in the
+     * feedback-hook module; we just hand it the verdict.
+     */
+    /**
+     * Insert a SQLite `artifacts` row for a successfully delivered cycle so the
+     * release acceptance gate (and the search API) can observe completion via
+     * the same surface as the legacy claude / MCP path.
+     *
+     * The legacy `legacy-claude` impl writes via the MCP `submit_restoration_result`
+     * tool when Claude reports success; deterministic impls don't go through MCP.
+     * This emitter closes that gap by writing the row from the engine when the
+     * cycle hits COMPLETE.
+     *
+     * Idempotent: if a row already exists for (requestId, tag) — e.g. the legacy
+     * MCP path got there first — we leave it alone.
+     */
+    emitCycleArtifact(intent, manifestCid, evidenceHash) {
+        const desiredStateId = intent.restorationJob?.id;
+        if (!desiredStateId) {
+            // Pre-migration intent rows had no desired_state_payload; the legacy
+            // path is the only thing that can emit artifacts for them, and it
+            // does so via MCP. Skip rather than synthesise an id.
+            return;
+        }
+        const intentType = intent.intentType ?? 'restoration';
+        const tag = intentType === 'evaluation' ? 'evaluation-verdict' : 'restoration-result';
+        const existing = this.store.getArtifactByRequestId(intent.requestId, tag);
+        if (existing)
+            return;
+        this.store.insertArtifact({
+            id: randomUUID(),
+            desiredStateId,
+            requestId: intent.requestId,
+            title: `${tag}: ${intent.specKind ?? 'cycle'} (${intent.implName ?? 'engine'})`,
+            content: JSON.stringify({
+                manifestCid,
+                evidenceHash: evidenceHash ?? null,
+                implName: intent.implName,
+            }),
+            tags: [tag, 'success'],
+            outcome: 'SUCCESS',
+        });
+    }
+    async _maybePostEvaluatorFeedback(intent) {
+        if (!this.reputationFeedback)
+            return;
+        const gating = intent.gatingClaim;
+        const verdictRaw = gating?.['verdict'];
+        if (verdictRaw !== 'PASS' &&
+            verdictRaw !== 'FAIL' &&
+            verdictRaw !== 'REJECTED' &&
+            verdictRaw !== 'INDETERMINATE') {
+            console.warn(`[restorer-engine] ${intent.requestId}: reputation feedback skipped — gatingClaim has no recognised verdict (got=${String(verdictRaw)})`);
+            return;
+        }
+        const verdict = verdictRaw;
+        // Pull the parent restorer's manifest evidence from the inlined eval
+        // payload. The evaluator impl receives the restorer's signed manifest
+        // JSON via `intent.context.restorationResult` (see
+        // `MechAdapter.tryCreateEvaluationJob`). Its `signature.hash` is
+        // exactly what the restorer committed via `claimDelivery(evidenceHash)`.
+        const parent = this._extractRestorerManifestRef(intent);
+        if (!parent) {
+            console.warn(`[restorer-engine] ${intent.requestId}: reputation feedback skipped — could not extract restorer manifest hash from inlined evaluation payload`);
+            return;
+        }
+        let resolved;
+        try {
+            resolved = await this.reputationFeedback.resolveAgentId(parent.evidenceHash);
+        }
+        catch (err) {
+            console.warn(`[restorer-engine] ${intent.requestId}: reputation feedback resolver threw (non-fatal): ${err instanceof Error ? err.message : err}`);
+            return;
+        }
+        if (!resolved) {
+            console.log(`[restorer-engine] ${intent.requestId}: reputation feedback skipped — no agentId resolved for restorer manifestHash=${parent.evidenceHash} (subgraph not indexed yet, or no envelope published)`);
+            return;
+        }
+        // CID resolution priority: subgraph row's `manifestCid` (cheapest, the
+        // operator already published an envelope under it), else the inlined
+        // CID hint when present, else fall back to the bare hash. The subgraph
+        // parses `manifest:<cid>` to a `manifestRef` regardless.
+        const manifestCid = resolved.manifestCid ?? parent.manifestCid ?? '';
+        // The intent kind is the same `spec.kind` used by the restoration —
+        // `intent.specKind` is "portfolio.v0" both for the restoration and its
+        // evaluation. Tag1 is indexed on the on-chain event, so cheap to filter.
+        const kind = intent.specKind ?? undefined;
+        const verdictArg = kind ? { verdict, kind } : { verdict };
+        let outcome;
+        try {
+            outcome = await submitEvaluatorFeedback({
+                registry: this.reputationFeedback.client,
+                ref: {
+                    restorerAgentId: resolved.agentId,
+                    restorerManifestCid: manifestCid,
+                    restorerEvidenceHash: parent.evidenceHash,
+                },
+                verdict: verdictArg,
+            });
+        }
+        catch (err) {
+            // submitEvaluatorFeedback already swallows known reverts, but a
+            // truly unexpected throw still must not propagate past delivery.
+            console.warn(`[restorer-engine] ${intent.requestId}: reputation feedback unexpected throw (non-fatal): ${err instanceof Error ? err.message : err}`);
+            return;
+        }
+        console.log(`[restorer-engine] ${intent.requestId}: reputation feedback ${outcome.kind} verdict=${verdict} restorerAgentId=${resolved.agentId.toString()}`);
+    }
+    /**
+     * Extract the restorer's `evidenceHash` (and best-effort `manifestCid`)
+     * from the persisted evaluation intent.
+     *
+     * The evaluator's `intent.context.restorationResult` holds the restorer's
+     * full signed manifest JSON inlined as a string (per
+     * `MechAdapter.tryCreateEvaluationJob`). We parse it and pull the
+     * `signature.hash`, which is exactly the on-chain `evidenceHash`.
+     *
+     * The CID is not always inlined — the manifest carries its own
+     * `intent.cid` field (the *original intent* CID), not its self-CID. We
+     * therefore return `manifestCid: null` here and rely on the subgraph
+     * resolver to surface the published manifest CID. Returns `null` when
+     * the inlined payload is missing or malformed.
+     */
+    _extractRestorerManifestRef(intent) {
+        const ds = intent.restorationJob;
+        const inlined = ds?.context?.['restorationResult'];
+        if (typeof inlined !== 'string' || inlined.length === 0) {
+            return null;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(inlined);
+        }
+        catch {
+            return null;
+        }
+        if (typeof parsed !== 'object' || parsed === null) {
+            return null;
+        }
+        const sig = parsed['signature'];
+        if (typeof sig !== 'object' || sig === null) {
+            return null;
+        }
+        const hashRaw = sig['hash'];
+        if (typeof hashRaw !== 'string' || !/^0x[0-9a-fA-F]{64}$/.test(hashRaw)) {
+            return null;
+        }
+        return {
+            evidenceHash: hashRaw,
+            manifestCid: null,
+        };
     }
     // ── Internal helpers ────────────────────────────────────────────────────────
     /**