@melra/runtime-core 0.3.0-alpha.17 → 0.3.0-alpha.19

package/dist/task-controller.js

@@ -1,8 +1,8 @@
 // Copyright 2026 XAGI Labs Private Limited
 // SPDX-License-Identifier: Apache-2.0
 import { randomUUID } from "node:crypto";
-import { allowsRetry, delegationChain, effectContract, executionGuaranteeFor, isOutcomeUnknown, LOCAL_IDENTITY, TaskRequestSchema, } from "@melra/protocol";
-import { approvalTtl, CAPABILITY_DAY_MS, classifyOperation, defaultEvidenceFor, evaluatePolicy, validateApproval, } from "@melra/policy-core";
+import { allowsRetry, delegationChain, effectContract, executionGuaranteeFor, isOutcomeUnknown, LOCAL_IDENTITY, MelraTaskJudgeInputSchema, TaskRequestSchema, } from "@melra/protocol";
+import { approvalTtl, CAPABILITY_DAY_MS, classifyOperation, defaultEvidenceFor, digestOperation, evaluatePolicy, validateApproval, } from "@melra/policy-core";
 import { createCertificate, createReceiptId, evidenceStrength, redactSecrets, redactStructuredValue, sha256, } from "@melra/receipt-schema";
 import { CircuitBreaker } from "./circuit-breaker.js";
 function now() {
@@ -84,12 +84,80 @@ export function capabilityUsageReader(store) {
         return { operations: drawn.operations, amountToday: drawn.amountInWindow };
     };
 }
+/**
+ * A stored copy's content digests, masked as the content is. A file read's or
+ * write's `sha256` hashes exactly what redaction took out of the record, and
+ * a `file_hash` item that did not pass carries the file's real hash (one that
+ * passed equals the hash its request declared). Applied after redaction to
+ * the task's result and to receipt and certificate evidence; the marker maps
+ * to itself, so a certificate written from a stored receipt (`certify`) says
+ * what the live one did. The caller still gets the `sha256` in `output`, and
+ * recovery reads the sealed raw result. A failed item's digest is returned
+ * nowhere, since the caller gets the stored receipt and certificate; a file
+ * `hash` operation reads it again.
+ */
+const MASKED = "[REDACTED_SENSITIVE_FIELD]";
+function maskResultDigest(result, operation) {
+    return operation.kind === "file" && (operation.action === "read" || operation.action === "write") && "sha256" in result
+        ? { ...result, sha256: MASKED }
+        : result;
+}
+/** The same list when there is nothing to mask, so a caller can tell. */
+function maskEvidenceDigests(evidence) {
+    const hides = (item) => item.type === "file_hash" && !item.passed && item.digest !== undefined && item.digest !== MASKED;
+    return evidence.some(hides) ? evidence.map((item) => (hides(item) ? { ...item, digest: MASKED } : item)) : evidence;
+}
 /** Statuses a task leaves only once: by starting, by a deny, or by a refusal. */
 const UNSTARTED = ["planned", "awaiting_approval"];
 /** Whether a task waits on a question only someone outside MELRA answers (#54). */
 function asksSemantic(request) {
     return request.requiredEvidence.some((predicate) => predicate.type === "semantic");
 }
+/**
+ * A semantic task's evidence with its answers written in (#54). An answered
+ * item passes only on a yes, is inconclusive on cannot_tell, and says who
+ * judged it and, as `executedBy`, the receipt's declared principal, so the
+ * two declared chains can be compared without the receipt; an open one stays
+ * failed and inconclusive, summarised `unanswered`. Matched by index: a
+ * semantic task's receipt has one item per predicate, in order. Every other
+ * item is left as it was.
+ */
+function overlay(evidence, judgements, unanswered, executedBy) {
+    return evidence.map((item, index) => {
+        if (item.type !== "semantic")
+            return item;
+        const { inconclusive: _inconclusive, ...rest } = item;
+        const judgedBy = judgements.find((judgement) => judgement.predicateIndex === index)?.judgedBy;
+        if (judgedBy === undefined)
+            return { ...rest, passed: false, inconclusive: true, summary: unanswered };
+        return {
+            ...rest,
+            passed: judgedBy.verdict === "yes",
+            ...(judgedBy.verdict === "cannot_tell" ? { inconclusive: true } : {}),
+            summary: `semantic_judgement_${judgedBy.verdict}`,
+            judgedBy,
+            ...(executedBy === undefined ? {} : { executedBy }),
+        };
+    });
+}
+/**
+ * Whether a judge is the actor it would judge (#54): its declared principal
+ * is the actor's, or a non-human link the actor acts for; or its declared
+ * chain names the actor's principal, as a grader the actor spawned would. The
+ * person the work was for may judge it, and so may another session under a
+ * link the actor's chain shares. `client`, the link a transport authenticated,
+ * heads the judge's chain undeclared and is not compared: an OAuth client that
+ * planned as itself would otherwise refuse every judge it sends. Claims on
+ * both sides, so it stops one loop grading itself, not a harness that
+ * declares someone else.
+ */
+function judgesItself(judge, actor, client) {
+    const same = (one, other) => one.kind === other.kind && one.id === other.id;
+    const declared = judge.onBehalfOf.slice(client === undefined ? 0 : 1);
+    return (same(actor.principal, judge.principal) ||
+        actor.onBehalfOf.some((link) => link.kind !== "human" && same(link, judge.principal)) ||
+        declared.some((link) => same(link, actor.principal)));
+}
 /** The one browser action that reads each list. */
 const BROWSER_LIST_ACTIONS = [
     ["values", "select"],
@@ -182,7 +250,7 @@ export class TaskController {
                 ? {}
                 : { idempotencyKey: options.idempotencyKey }),
             ...(options.attempt === undefined ? {} : { attempt: options.attempt }),
-            ...(policy.challenge === undefined ? {} : { approval: policy.challenge }),
+            ...(policy.challenge === undefined ? {} : { approval: this.keyedChallenge(policy.challenge) }),
             receiptIds: [],
             createdAt: timestamp,
             updatedAt: timestamp,
@@ -296,8 +364,13 @@ export class TaskController {
             return this.finishWithoutReceipt(task, []);
         }
         if (rechecked.decision.outcome === "confirm") {
-            if (rechecked.challenge === undefined ||
-                task.approval?.actionDigest !== rechecked.challenge.actionDigest) {
+            // Stored keyed (`keyedChallenge`). One a 0.3.0-alpha.17 or alpha.18
+            // process planned holds the plain digest, which binds the same exact
+            // operation; it stays executable until it expires.
+            const fresh = rechecked.challenge?.actionDigest;
+            if (fresh === undefined ||
+                (task.approval?.actionDigest !== this.payloadCipher.digest(fresh, "action") &&
+                    task.approval?.actionDigest !== fresh)) {
                 throw new Error("approval_action_digest_mismatch");
             }
             // Enforced mode asserts the agent holds no credential, so anything it
@@ -307,7 +380,10 @@ export class TaskController {
                 throw new Error("approval_in_band_refused");
             }
             // A decision an operator recorded wins over anything the caller sent.
-            const render = this.approvalRender(task, request).renderDigest;
+            const { contract, renderDigest: render } = this.approvalRender(task, request);
+            // Recorded keyed, whatever form `render` takes: an older executor reads
+            // the plain form only from a decision row.
+            const bound = this.payloadCipher.digest(contract, "render");
             const decision = this.store.getApprovalDecision(task.approval.approvalId);
             // Waiting is only worth it while an operator could still say yes:
             // `decide` refuses an expired challenge, so past it the task is re-planned.
@@ -315,15 +391,20 @@ export class TaskController {
                 throw new Error(Date.parse(task.approval.expiresAt) <= Date.now() ? "approval_expired" : "approval_awaiting_operator");
             }
             if (decision !== undefined) {
-                if (decision.renderDigest !== render)
+                // A row a 0.3.0-alpha.17 or alpha.18 `melra approve` or console wrote
+                // holds the plain digest of the same contract.
+                if (decision.renderDigest !== render && decision.renderDigest !== sha256(contract)) {
                     throw new Error("approval_render_mismatch");
+                }
                 if (!this.usable(task, decision))
                     throw new Error("approval_expired");
                 // Out of band is this kernel's claim to make, not the row's: a
                 // developer-mode kernel cannot vouch that nothing the agent touched
-                // wrote it, whatever mode the process that recorded it was in.
+                // wrote it, whatever mode the process that recorded it was in. The
+                // digest is keyed, whichever form the row holds.
                 task.approvedBy = {
                     ...decision,
+                    renderDigest: bound,
                     channel: decision.channel === "out_of_band" && this.policy.mode === "enforced"
                         ? "out_of_band"
                         : "in_band",
@@ -334,12 +415,12 @@ export class TaskController {
                 if (!approvalResult.ok) {
                     throw new Error(approvalResult.reason);
                 }
-                // The phrase is derivable by anyone who knows the task, so an echo of
-                // it says only that something echoed it.
+                // The phrase is readable by anyone who can read the task, so an echo
+                // of it says only that something echoed it.
                 task.approvedBy = {
                     approvalId: task.approval.approvalId,
                     taskId: task.id,
-                    renderDigest: render,
+                    renderDigest: bound,
                     channel: "in_band",
                     approver: "phrase",
                     decidedAt: now(),
@@ -363,7 +444,10 @@ export class TaskController {
         let budgetExhausted = false;
         let shortCircuited = false;
         let effectReturned = false;
-        let settled;
+        // Set once verification is done, until what it decided is committed: the
+        // writes are undone together if any fails, and the catch puts back what
+        // was true before them.
+        let unwritten;
         if (rechecked.grantId !== undefined) {
             const held = this.reserved.get(rechecked.grantId) ?? new Map();
             held.set(task.id, classified.spend?.amount ?? 0);
@@ -377,13 +461,15 @@ export class TaskController {
         // Any other throw is an adapter saying nothing went out, and costs
         // nothing; so does a refusal before it was called. Counting an effect
         // that did not happen is preferred to a grant funding more than it says.
-        const charge = (ran) => {
+        const draw = () => {
             if (rechecked.grantId === undefined)
                 return;
-            if (ran) {
-                this.store.recordCapabilityUse(rechecked.grantId, task.id, classified.spend?.amount ?? 0, now());
-            }
-            this.reserved.get(rechecked.grantId)?.delete(task.id);
+            this.store.recordCapabilityUse(rechecked.grantId, task.id, classified.spend?.amount ?? 0, now());
+        };
+        // Only once the draw is committed, or the effect is known not to have run.
+        const release = () => {
+            if (rechecked.grantId !== undefined)
+                this.reserved.get(rechecked.grantId)?.delete(task.id);
         };
         try {
             const opened = this.breaker.check(classified.target);
@@ -402,8 +488,12 @@ export class TaskController {
             effectReturned = true;
             const sanitizedResult = redactStructuredValue(result);
             task.status = "verifying";
-            task.result = sanitizedResult.value;
+            task.result = maskResultDigest(sanitizedResult.value, request.operation);
             task.updatedAt = now();
+            // Committed on its own, ahead of the rest, on purpose: recovery settles
+            // a `verifying` change it can look at again against this result
+            // (`recoverTask`), and no transaction is held across the verifier,
+            // which may wait on an HTTP probe.
             this.store.saveTaskExecutionResult(task, this.payloadCipher.seal(result, `task:${task.id}:result`));
             const verification = await this.verifier.verify(request.requiredEvidence, result);
             const actionSucceeded = result.success === undefined || result.success === true;
@@ -433,57 +523,73 @@ export class TaskController {
             // The effect ran and passed every kernel check, so it is committed now:
             // a key that ran must not run again, even while it waits for its verdict.
             const checksHeld = verified || awaitingJudgement;
-            if (checksHeld &&
-                task.idempotencyKey !== undefined &&
-                !this.store.commitIdempotency(task.idempotencyKey, task.id, task.attempt ?? 1, now())) {
-                task.status = "cancelled";
-                task.error = "duplicate_attempt_prevented";
-            }
-            // The adapter returned, so the effect ran: drawn down for a `partial`,
-            // a `failed` or a duplicate collapsed just above as for a verified task.
-            charge(true);
+            unwritten = { checksHeld, receiptIds: [...task.receiptIds] };
             const receipt = this.createReceipt(task, request, classified.capability, classified.target, classified.effect, startedAt, actionSucceeded, result, evidence);
-            this.store.saveReceipt(receipt);
-            task.receiptIds.push(receipt.receiptId);
-            if (task.status !== "cancelled") {
-                task.status = verified
-                    ? "verified_success"
-                    : awaitingJudgement
-                        ? "waiting_user"
-                        : actionSucceeded
-                            ? "partial"
-                            : "failed";
-            }
-            // Written in the same save as the status, so a waiting row always says
-            // what it waits on, and until when.
-            if (task.status === "waiting_user") {
-                const expiresAt = new Date(Date.now() + approvalTtl(this.policy)).toISOString();
-                task.judgements = request.requiredEvidence.flatMap((predicate, predicateIndex) => predicate.type === "semantic" ? [{ judgementId: randomUUID(), predicateIndex, expiresAt }] : []);
-            }
-            task.updatedAt = now();
-            // A wait lands with its certificate in one transaction: written apart, a
-            // peer's expiry between the two was overwritten by the second. Either
-            // failing writes neither, so `settled` stays unset for the catch.
-            if (task.status === "waiting_user") {
-                const certificate = this.store.transaction(() => {
-                    this.store.saveTask(task);
+            // Everything that records the outcome commits at once: the key, the
+            // draw, the receipt, the task and its certificate. A crash before the
+            // commit leaves the task `verifying`, as a crash during verification
+            // does, and never a part of the outcome.
+            const certificate = this.store.transaction(() => {
+                if (checksHeld &&
+                    task.idempotencyKey !== undefined &&
+                    !this.store.commitIdempotency(task.idempotencyKey, task.id, task.attempt ?? 1, now())) {
+                    task.status = "cancelled";
+                    task.error = "duplicate_attempt_prevented";
+                }
+                // The adapter returned, so the effect ran: drawn down for a `partial`,
+                // a `failed` or a duplicate collapsed just above as for a verified task.
+                draw();
+                this.store.saveReceipt(receipt);
+                task.receiptIds.push(receipt.receiptId);
+                if (task.status !== "cancelled") {
+                    task.status = verified
+                        ? "verified_success"
+                        : awaitingJudgement
+                            ? "waiting_user"
+                            : actionSucceeded
+                                ? "partial"
+                                : "failed";
+                }
+                // Written in the same save as the status, so a waiting row always says
+                // what it waits on, and until when.
+                if (task.status === "waiting_user") {
+                    const expiresAt = new Date(Date.now() + approvalTtl(this.policy)).toISOString();
+                    task.judgements = request.requiredEvidence.flatMap((predicate, predicateIndex) => predicate.type === "semantic" ? [{ judgementId: randomUUID(), predicateIndex, expiresAt }] : []);
+                }
+                task.updatedAt = now();
+                this.store.saveTask(task);
+                // A wait lands with its certificate or not at all: written apart, a
+                // peer's expiry between the two was overwritten by the second.
+                if (task.status === "waiting_user")
                     return this.createAndSaveCertificate(task, evidence, true);
-                });
-                return { task, output: result, receipt, certificate };
-            }
-            this.store.saveTask(task);
-            settled = { task, output: result, receipt };
-            const certificate = this.createAndSaveCertificate(task, evidence, true);
-            return { ...settled, certificate };
+                // Any other outcome stands without its certificate. Rewriting it
+                // would contradict its receipt and commit, and an error would read
+                // as the effect not having happened, so the caller gets what was
+                // recorded; a workflow step's certificate is written by the run's
+                // next advance (`certify`). A failure SQLite rolled the whole
+                // transaction back for fails the commit instead, and the catch has it.
+                try {
+                    return this.createAndSaveCertificate(task, evidence, true);
+                }
+                catch {
+                    return undefined;
+                }
+            });
+            unwritten = undefined;
+            release();
+            return { task, output: result, receipt, ...(certificate === undefined ? {} : { certificate }) };
         }
         catch (error) {
-            // The outcome is recorded, beside its receipt and idempotency commit,
-            // and only the certificate summarising it failed to write. Rewriting it
-            // would contradict them, and an error would read as the effect not
-            // having happened, so the caller gets what was recorded. A workflow
-            // step's certificate is written by the run's next advance (`certify`).
-            if (settled !== undefined)
-                return settled;
+            // The writes after verification were undone together. The receipt they
+            // stored is gone, and a key whose effect passed every check is committed
+            // here on its own, as it was before anything after it could fail: a
+            // parked task settles on that commit (`settleCommitted`).
+            if (unwritten !== undefined) {
+                task.receiptIds = unwritten.receiptIds;
+                if (unwritten.checksHeld && task.idempotencyKey !== undefined) {
+                    this.store.commitIdempotency(task.idempotencyKey, task.id, task.attempt ?? 1, now());
+                }
+            }
             const rawMessage = error instanceof Error ? error.message : String(error);
             // Capped after redaction, which can lengthen it, at the 10,000 characters
             // a workflow node's `error` holds: a longer one failed the node's write
@@ -501,7 +607,9 @@ export class TaskController {
             // that fails to write leaves the reservation held, and the task running
             // for recovery to charge.
             const ran = effectReturned || isOutcomeUnknown(rawMessage);
-            charge(ran);
+            if (ran)
+                draw();
+            release();
             // Ahead of every other outcome, because it is the strongest thing known:
             // the effect may already have happened, either because the adapter says
             // so or because it returned and a write after it failed. `failed`,
@@ -750,9 +858,12 @@ export class TaskController {
             // Settled already, it is left as it stands rather than certified again.
             // Asked of the stored row: a peer may have settled it since `task` was
             // read, and its status says `recovery_required` either way.
+            // A verdict of cannot_tell settled it as well: settling it again would
+            // rewrite that answer, and any yes beside it, as expired.
             const stored = this.status(task.id);
-            if (stored.error === "semantic_judgement_expired")
+            if (stored.error === "semantic_judgement_expired" || stored.error === "semantic_judgement_cannot_tell") {
                 return { task: stored };
+            }
             // Cut off before it reached `waiting_user`, maybe before its draw too.
             this.drawGrant(task, request, classified);
             return this.settleUnanswered(task);
@@ -812,11 +923,13 @@ export class TaskController {
     /**
      * A waiting task whose judgements are past their `expiresAt` settles
      * closed. Re-read and written in one transaction, so a peer settling the
-     * same task wins once.
+     * same task, or a verdict, wins once.
      *
      * ponytail: runs on the startup pass and the 30 s recovery sweep, so a wait
      * can outlive its `expiresAt` by one interval, or until a runtime next opens
-     * this data directory; a verdict tool must check `expiresAt` itself.
+     * this data directory. `judge` refuses a verdict from `expiresAt` on and
+     * writes nothing, so nothing is answered in that gap; every runtime runs
+     * this pass before it serves, `melra judge` included.
      */
     expireJudgements(failures) {
         for (const listed of this.store.listExpiredJudgements(now())) {
@@ -836,21 +949,101 @@ export class TaskController {
      * No answer is not a yes (#54). A task whose semantic question went
      * unanswered, at expiry or cut off after its commit, settles closed: its
      * effect ran, so a change is `recovery_required` (never `failed`) and a
-     * read is `partial`. Nothing runs here, so it writes no receipt: the
-     * certificate, replaced, carries the evidence of the task's last one, the
-     * live path's or the one recovery wrote.
+     * read is `partial`. A yes given before expiry stays on the certificate.
      */
     settleUnanswered(task) {
+        return this.settleSemantic(task, task.policyDecision.effect === "read" ? "partial" : "recovery_required", "semantic_judgement_expired", "semantic_judgement_expired");
+    }
+    /**
+     * Settles a semantic task. Nothing runs here, so it writes no receipt: the
+     * certificate, replaced, carries the evidence of the task's last one, the
+     * live path's or the one recovery wrote, with the answers given so far.
+     */
+    settleSemantic(task, status, error, unanswered) {
         const last = task.receiptIds[task.receiptIds.length - 1];
         const receipt = last === undefined ? undefined : this.store.getReceipt(last);
-        const evidence = (receipt?.evidence ?? []).map((item) => item.type === "semantic"
-            ? { ...item, passed: false, inconclusive: true, summary: "semantic_judgement_expired" }
-            : item);
-        task.status = task.policyDecision.effect === "read" ? "partial" : "recovery_required";
-        task.error = "semantic_judgement_expired";
+        const evidence = overlay(receipt?.evidence ?? [], task.judgements ?? [], unanswered, receipt?.principal);
+        task.status = status;
+        if (error === undefined)
+            delete task.error;
+        else
+            task.error = error;
         task.updatedAt = now();
         return { task, certificate: this.createAndSaveCertificate(task, evidence) };
     }
+    /**
+     * Records the answer to one semantic question of a waiting task (#54). The
+     * first verdict other than yes settles the task: no ends it `partial`,
+     * cannot_tell ends a change `recovery_required` and a read `partial`. The
+     * yes that answers the last open question verifies it; an earlier one is
+     * recorded, and the task waits on.
+     *
+     * A verdict writes the task row and nothing else, its certificate on a
+     * settle included: no receipt, grant draw, breaker record or idempotency
+     * commit, all of which the effect settled when it ran. Every check reads
+     * the row inside one transaction, and each refusal writes nothing, so a
+     * question is answered once, and a peer's verdict or the expiry sweep wins
+     * against this one at most once.
+     *
+     * `by` is the surface. An agent's declared identity is checked against the
+     * task's actor, with `client` the link its transport authenticated, if any;
+     * an operator's is not, as `decide` checks no approver. Only
+     * an operator in an enforced process, on a task that ran enforced, judges
+     * out of band, and an in-band verdict counts for nothing where approvals
+     * come only from an operator.
+     */
+    judge(input, by) {
+        const parsed = MelraTaskJudgeInputSchema.omit({ identity: true }).parse(input);
+        const operator = "operator" in by && this.enforced;
+        return this.store.transaction(() => {
+            const task = this.status(parsed.taskId);
+            // The task and its question before the channel: told to change it, a
+            // caller would only meet a settled task or a wrong id there (#384).
+            // Nothing here is news to it: `melra_task_status` and `melra inspect`
+            // show both.
+            if (task.status !== "waiting_user")
+                throw new Error(`task_not_awaiting_judgement:${task.status}`);
+            const judgement = task.judgements?.find((entry) => entry.judgementId === parsed.judgementId);
+            if (judgement === undefined)
+                throw new Error("judgement_not_found");
+            if (judgement.judgedBy !== undefined)
+                throw new Error("judgement_already_answered");
+            // Refused rather than settled here, which the throw would roll back:
+            // the recovery pass settles it closed.
+            if (Date.parse(judgement.expiresAt) <= Date.now())
+                throw new Error("judgement_expired");
+            const runEnforced = this.runMode(task) === "enforced";
+            // Every door an agent has to an enforced kernel is its harness's, and a
+            // developer process sharing the home must not settle an enforced run.
+            if (!operator && (this.enforced || runEnforced))
+                throw new Error("judgement_in_band_refused");
+            // Out of band only on an enforced run, as `execute` downgrades an
+            // approval: on a developer run the agent's own shell could have sent it.
+            const channel = operator && runEnforced ? "out_of_band" : "in_band";
+            // After the channel: where no agent's verdict counts, who it claims to
+            // be is moot.
+            if ("identity" in by && judgesItself(by.identity, this.loadRequest(task.id).identity ?? LOCAL_IDENTITY, by.client)) {
+                throw new Error("semantic_judge_is_actor");
+            }
+            judgement.judgedBy = redactStructuredValue({
+                verdict: parsed.verdict,
+                judge: "identity" in by ? delegationChain(by.identity) : by.operator,
+                channel,
+                judgedAt: now(),
+                ...(parsed.rationale === undefined ? {} : { rationale: parsed.rationale }),
+            }).value;
+            if (parsed.verdict === "yes" && task.judgements.some((entry) => entry.judgedBy === undefined)) {
+                task.updatedAt = now();
+                this.store.saveTask(task);
+                return { task };
+            }
+            return this.settleSemantic(task, parsed.verdict === "yes"
+                ? "verified_success"
+                : parsed.verdict === "cannot_tell" && task.policyDecision.effect !== "read"
+                    ? "recovery_required"
+                    : "partial", parsed.verdict === "yes" ? undefined : `semantic_judgement_${parsed.verdict}`, "semantic_judgement_unanswered");
+        });
+    }
     async recoverTask(task) {
         const request = this.loadRequest(task.id);
         const classified = classifyOperation(request.operation);
@@ -920,7 +1113,24 @@ export class TaskController {
      */
     approvalRender(task, request) {
         const { authorization: _authorization, policy: _policy, ...contract } = effectContract({ ...task, request }, classifyOperation(request.operation));
-        return { contract, renderDigest: sha256(contract) };
+        // Keyed, like the challenge. A task a 0.3.0-alpha.17 or alpha.18 process
+        // planned is shown its plain digest, the one that version's executor
+        // recomputes, so a decision recorded here is one it accepts.
+        const legacy = task.approval?.actionDigest === digestOperation(task.id, request.operation);
+        return { contract, renderDigest: legacy ? sha256(contract) : this.payloadCipher.digest(contract, "render") };
+    }
+    /**
+     * The challenge as stored beside the redacted request: its digest keyed by
+     * this home's payload key, and the phrase still `APPROVE` plus that digest's
+     * first twelve hex digits, as clients read it.
+     */
+    keyedChallenge(challenge) {
+        const actionDigest = this.payloadCipher.digest(challenge.actionDigest, "action");
+        return {
+            ...challenge,
+            actionDigest,
+            ...(challenge.phrase === undefined ? {} : { phrase: `APPROVE ${actionDigest.slice(0, 12)}` }),
+        };
     }
     /** A pending challenge as an operator surface shows it. */
     approvalView(taskId) {
@@ -1044,20 +1254,32 @@ export class TaskController {
         const approvalId = task.approvedBy?.approvalId ??
             (task.policyDecision.outcome === "confirm" ? task.approval?.approvalId : undefined);
         const sanitized = redactStructuredValue(result);
+        const observedEffect = maskResultDigest(sanitized.value, request.operation);
         // A verifier's summary and source are stored text like any other.
         const sanitizedEvidence = redactStructuredValue(evidence);
+        const storedEvidence = maskEvidenceDigests(sanitizedEvidence.value);
+        // The declared chain, redacted as the task row, a judge's name and a
+        // certificate's `executedBy` are, so it reads the same as `executedBy`.
+        const principal = redactSecrets(delegationChain(request.identity ?? LOCAL_IDENTITY));
         const adapterRedactions = Array.isArray(result.redactions)
             ? result.redactions.filter((item) => typeof item === "string")
             : [];
+        const masked = observedEffect !== sanitized.value || storedEvidence !== sanitizedEvidence.value ? [MASKED] : [];
         const redactions = [
-            ...new Set([...adapterRedactions, ...sanitized.redactions, ...sanitizedEvidence.redactions]),
+            ...new Set([
+                ...adapterRedactions,
+                ...sanitized.redactions,
+                ...sanitizedEvidence.redactions,
+                ...principal.redactions,
+                ...masked,
+            ]),
         ];
         return {
             schemaVersion: "1.0.0",
             receiptId: createReceiptId(),
             taskId: task.id,
             capability,
-            principal: delegationChain(request.identity ?? LOCAL_IDENTITY),
+            principal: principal.value,
             effect,
             executionGuarantee: executionGuaranteeFor(effect, request.reconciliation.length > 0),
             mode: this.runMode(task) ?? this.policy.mode,
@@ -1079,12 +1301,14 @@ export class TaskController {
             // The target is built from the request (a URL, a memory key) and stored
             // as it is, so it takes the same secret shapes out as everything else.
             target: redactSecrets(target).value,
-            inputDigest: sha256(request.operation),
+            // Keyed and bound to the task: it still pins the exact input for a
+            // holder of the home's key, and two tasks' digests are never comparable.
+            inputDigest: this.payloadCipher.digest({ taskId: task.id, operation: request.operation }, "input"),
             startedAt,
             endedAt: now(),
             success,
-            observedEffect: sanitized.value,
-            evidence: sanitizedEvidence.value,
+            observedEffect,
+            evidence: storedEvidence,
             redactions,
             ...(error === undefined ? {} : { error }),
         };
@@ -1149,10 +1373,10 @@ export class TaskController {
             result: certificateResult(task),
             policyVersion: task.policyDecision.policyVersion,
             receiptIds: task.receiptIds,
-            // Redacted as a receipt's is, before the digest is taken. Redacting
-            // again changes nothing, so one written from a stored receipt's items
-            // (`certify`) says what one written from the verifier's would.
-            evidence: redactStructuredValue(evidence).value,
+            // Redacted and masked as a receipt's is, before the digest is taken.
+            // Doing either again changes nothing, so one written from a stored
+            // receipt's items (`certify`) says what one written from the verifier's would.
+            evidence: maskEvidenceDigests(redactStructuredValue(evidence).value),
             createdAt: now(),
             ...(mode === undefined ? {} : { mode }),
             ...(approvalChannel === undefined ? {} : { approvalChannel }),