@mettlelabs/mettle 0.0.0-0 → 0.0.0-beta.1-linux-x64

package/harness/chunk-2gt4cy7x.mjs

@@ -0,0 +1,2290 @@
+import {
+  exports_iso
+} from "./chunk-b71gpkxg.mjs";
+import {
+  ZodError,
+  string,
+  uuid,
+  url,
+  number,
+  boolean,
+  _null,
+  unknown,
+  never,
+  array,
+  object,
+  strictObject,
+  looseObject,
+  union,
+  discriminatedUnion,
+  tuple,
+  record,
+  _enum,
+  literal,
+  lazy
+} from "./chunk-1sygmp11.mjs";
+
+// packages/contract/src/providers.ts
+var PROVIDER_KEYS = Object.freeze({
+  openai: "OPENAI_API_KEY",
+  foundry: "FOUNDRY_API_KEY"
+});
+var FOUNDRY_ENDPOINT = "FOUNDRY_ENDPOINT";
+var FOUNDRY_MODELS = "FOUNDRY_MODELS";
+var FOUNDRY_LIMITS = "HARNESS_FOUNDRY_LIMITS";
+var LimitsSchema = strictObject({
+  contextTokens: number().int().positive(),
+  maxOutputTokens: number().int().positive()
+}).refine((limits) => limits.maxOutputTokens < limits.contextTokens);
+var ListedSchema = object({
+  data: array(looseObject({ id: string() }))
+});
+function foundryLimits(value) {
+  if (!value)
+    return {};
+  try {
+    const parsed = record(string(), LimitsSchema).safeParse(JSON.parse(value));
+    return parsed.success ? parsed.data : {};
+  } catch {
+    return {};
+  }
+}
+var AZURE_HOST = /^[a-z0-9][a-z0-9-]{0,62}\.(openai\.azure\.com|services\.ai\.azure\.com)$/;
+function foundryEndpoint(value) {
+  const url = URL.parse(value.trim());
+  if (url?.protocol !== "https:" || url.username || url.password || url.search || url.hash)
+    return;
+  const path = url.pathname.replace(/\/+$/, "");
+  if (!AZURE_HOST.test(url.hostname))
+    return `${url.origin}${path}`;
+  if (url.port || !["", "/openai", "/openai/v1"].includes(path))
+    return;
+  return `https://${url.hostname}/openai/v1`;
+}
+function foundryDeployments(value) {
+  return (value ?? "").split(",").map((entry) => entry.trim()).filter(Boolean).flatMap((entry) => {
+    const [name, model = name] = entry.split("=").map((part) => part.trim());
+    return name && model ? [{ name, model }] : [];
+  });
+}
+var PROVIDERS = Object.freeze(Object.keys(PROVIDER_KEYS));
+function isLoopback(host) {
+  return ["127.0.0.1", "::1", "[::1]"].includes(host);
+}
+function providerFixture(environment) {
+  const origin = environment.HARNESS_PROVIDER_FIXTURE?.trim();
+  if (!origin)
+    return;
+  const fixture = URL.parse(origin);
+  if (fixture?.protocol !== "http:" || !isLoopback(fixture.hostname))
+    throw new Error("HARNESS_PROVIDER_FIXTURE must be a loopback http origin.");
+  return (input, init) => {
+    const called = new URL(input instanceof Request ? input.url : input);
+    return fetch(new URL(`${called.pathname}${called.search}`, fixture), init);
+  };
+}
+
+// packages/contract/src/common.ts
+var CONTRACT_VERSION = "1.0.0";
+var SEAM_VERSION = {
+  oracle: "1.0.0",
+  ranges: "1.0.0",
+  model: "1.0.0"
+};
+var IdentifierSchema = string().min(1);
+var PositiveIntegerSchema = number().int().positive().max(2147483647);
+var InvestigationModeSchema = _enum(["pentest", "codereview"]);
+var RunModeSchema = _enum([
+  ...InvestigationModeSchema.options,
+  "chat"
+]);
+var ProductCapabilitySchema = _enum([
+  "code",
+  "pull_requests",
+  "agentic_pentesting",
+  "secrets",
+  "supply_chain",
+  "dependency_firewall"
+]);
+var ChangeContextSchema = strictObject({
+  repository: IdentifierSchema,
+  baseRevision: IdentifierSchema,
+  headRevision: IdentifierSchema,
+  pullRequestId: IdentifierSchema.optional()
+});
+var ContractContextSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION)
+});
+var ContractVersionErrorSchema = strictObject({
+  code: literal("contract_version_mismatch"),
+  expected: literal(CONTRACT_VERSION),
+  received: string().nullable(),
+  message: string()
+});
+var RunConfigSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  model: IdentifierSchema.optional(),
+  capabilities: array(ProductCapabilitySchema).min(1).optional(),
+  change: ChangeContextSchema.optional(),
+  continues: uuid().optional(),
+  targetKind: _enum(["repo", "web"]).optional(),
+  scope: array(IdentifierSchema).min(1).optional()
+}).superRefine((config, context) => {
+  if (config.capabilities && new Set(config.capabilities).size !== config.capabilities.length)
+    context.addIssue({
+      code: "custom",
+      message: "Capabilities must be unique."
+    });
+  if (config.capabilities?.includes("pull_requests") && !config.change)
+    context.addIssue({
+      code: "custom",
+      message: "PR capability requires pinned change context."
+    });
+});
+var RunStartSchema = strictObject({
+  target: string(),
+  config: RunConfigSchema
+});
+var BudgetSchema = strictObject({
+  tokens: number().int().nonnegative(),
+  wallSec: number().finite().nonnegative(),
+  usd: number().finite().nonnegative().optional()
+});
+var CapsSchema = strictObject({
+  tokens: PositiveIntegerSchema
+});
+var TerminalSchema = strictObject({
+  outcome: _enum(["completed", "stopped", "failed", "incomplete"]),
+  cleanupOk: boolean(),
+  reportPath: string().optional()
+});
+var MAX_STEER_MESSAGE = 32768;
+var MAX_LABEL = 128;
+var MAX_PREVIEW_LINES = 20;
+var MAX_PREVIEW_LINE = 200;
+var IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg"];
+var ImageRefSchema = strictObject({
+  ref: string().regex(/^sha256:[0-9a-f]{64}$/),
+  mediaType: _enum(IMAGE_MEDIA_TYPES),
+  label: string().regex(/^\[Image #[1-9][0-9]*\]$/)
+});
+var ImageRefsSchema = array(ImageRefSchema).min(1);
+var AgentControlSchema = discriminatedUnion("type", [
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("stop")
+  }),
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("interrupt")
+  }),
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("steer"),
+    message: string().min(1).max(MAX_STEER_MESSAGE),
+    images: ImageRefsSchema.optional()
+  }),
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("pause")
+  }),
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("resume")
+  }),
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("approve"),
+    approvalId: IdentifierSchema,
+    decision: _enum(["allow", "deny"])
+  }),
+  strictObject({
+    contractVersion: literal(CONTRACT_VERSION),
+    type: literal("review"),
+    reviewRequestId: IdentifierSchema,
+    findingId: IdentifierSchema,
+    decision: _enum(["confirm", "reject"]),
+    reason: IdentifierSchema,
+    evidenceRev: IdentifierSchema
+  })
+]);
+
+// packages/contract/src/api.ts
+var MOST_IMAGE_BYTES = 10485760;
+var ImageUploadSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  ref: ImageRefSchema.shape.ref
+});
+var ModelCatalogSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  defaultModel: string().min(1).nullable(),
+  models: array(strictObject({
+    id: string().min(1),
+    provider: string().min(1),
+    maxOutputTokens: number().int().positive(),
+    contextTokens: number().int().positive(),
+    vision: boolean()
+  }))
+});
+var MAX_RUN_PAGE = 100;
+var RunPageSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  items: array(strictObject({
+    runId: uuid(),
+    target: string(),
+    startedAt: exports_iso.datetime(),
+    seq: number().int().nonnegative(),
+    state: _enum([
+      "unfinished",
+      "completed",
+      "stopped",
+      "failed",
+      "incomplete"
+    ])
+  })).max(MAX_RUN_PAGE),
+  nextCursor: uuid().nullable()
+});
+// packages/contract/src/clients.ts
+var EngineIdentitySchema = strictObject({
+  protocol: literal("mettle/1"),
+  engineId: uuid(),
+  instanceId: uuid()
+});
+var EngineConnectionSchema = strictObject({
+  version: literal(1),
+  engineId: uuid(),
+  origin: url(),
+  tokenFile: string().min(1),
+  launch: RunStartSchema
+});
+// packages/contract/src/findings.ts
+var text = string().min(1);
+var timestamp = exports_iso.datetime();
+var change = strictObject({
+  repository: text,
+  baseRevision: text,
+  headRevision: text,
+  pullRequestId: text.optional()
+});
+var policy = strictObject({ id: text, revision: text });
+var packageIdentity = strictObject({
+  ecosystem: text,
+  name: text,
+  version: text,
+  registry: text,
+  artifactDigest: text.optional()
+});
+var EvidenceToolCallSchema = strictObject({
+  callId: text,
+  tool: text,
+  artifactRef: text
+});
+var claims = _enum([
+  "vulnerability",
+  "weak_cryptography",
+  "configuration_violation",
+  "secret_exposure",
+  "credential_validity",
+  "advisory_match",
+  "dependency_reachability",
+  "dependency_exploitability",
+  "malicious_package"
+]);
+var methods = _enum([
+  "flag",
+  "witness",
+  "replay",
+  "credential_check",
+  "advisory_match",
+  "reachability",
+  "package_analysis",
+  "policy_check",
+  "human_review"
+]);
+var VerificationReceiptSchema = strictObject({
+  receiptId: text,
+  runId: text,
+  findingId: text,
+  candidateRevision: text,
+  subjectDigest: text,
+  evidenceRev: text,
+  claim: claims,
+  policy,
+  authority: strictObject({
+    kind: _enum(["gyms_oracle", "independent_check", "human"]),
+    id: text
+  }),
+  checkedAt: timestamp,
+  expiresAt: timestamp.optional()
+});
+var ReviewSchema = strictObject({
+  reviewer: text,
+  reason: text,
+  at: timestamp,
+  evidenceRev: text,
+  decision: _enum(["confirm", "reject"])
+});
+var automaticMethods = {
+  vulnerability: ["flag", "witness", "replay"],
+  weak_cryptography: ["policy_check"],
+  configuration_violation: ["policy_check"],
+  secret_exposure: ["policy_check"],
+  credential_validity: ["credential_check"],
+  advisory_match: ["advisory_match"],
+  dependency_reachability: ["reachability"],
+  dependency_exploitability: ["witness", "replay"],
+  malicious_package: ["package_analysis"]
+};
+var VerificationSchema = strictObject({
+  result: _enum(["pending", "pass", "fail", "needs_human"]),
+  method: methods.optional(),
+  artifactRef: text.optional(),
+  receipt: VerificationReceiptSchema.optional(),
+  review: ReviewSchema.optional()
+}).superRefine((checked, context) => {
+  const reject = (message) => {
+    context.addIssue({ code: "custom", message });
+  };
+  const receipt = checked.receipt;
+  if (!receipt || !checked.method)
+    return;
+  if (checked.result !== "pass" && checked.result !== "fail")
+    return;
+  if (receipt.expiresAt && Date.parse(receipt.expiresAt) <= Date.parse(receipt.checkedAt))
+    reject("Receipt expiry must follow the check.");
+  if (receipt.authority.kind === "human") {
+    if (!checked.review || !["replay", "human_review"].includes(checked.method))
+      reject("Human adjudication requires an explicit review and method.");
+    if (checked.review && (checked.review.reviewer !== receipt.authority.id || checked.review.evidenceRev !== receipt.evidenceRev || checked.review.at !== receipt.checkedAt || checked.review.decision !== (checked.result === "pass" ? "confirm" : "reject")))
+      reject("Human review and receipt disagree.");
+    if (checked.method === "replay" && !["vulnerability", "dependency_exploitability"].includes(receipt.claim))
+      reject("Runtime replay cannot prove a different kind of claim.");
+    return;
+  }
+  if (checked.review || !automaticMethods[receipt.claim].includes(checked.method))
+    reject("This automatic method cannot establish the named claim.");
+  const expectedAuthority = [
+    "vulnerability",
+    "dependency_exploitability"
+  ].includes(receipt.claim) ? "gyms_oracle" : "independent_check";
+  if (receipt.authority.kind !== expectedAuthority)
+    reject("Claim requires its accepted independent authority.");
+});
+var DISCOVERY_RULE_IDS_MAX = 40;
+var SeveritySchema = _enum(["critical", "high", "medium", "low"]);
+var FindingStatusSchema = _enum([
+  "candidate",
+  "confirmed",
+  "discarded"
+]);
+var common = {
+  contractVersion: literal(CONTRACT_VERSION),
+  id: text,
+  runId: text,
+  title: text,
+  severity: SeveritySchema,
+  cwe: text.optional(),
+  target: text,
+  location: text,
+  found_via: array(strictObject({
+    callId: text,
+    technique: _enum([
+      "source-inspection",
+      "saved-http-observation",
+      "live-http-observation",
+      "browser-observation",
+      "static-rule",
+      "secret-pattern",
+      "dependency-advisory",
+      "http-template",
+      "sqli-probe",
+      "active-http-rule",
+      "unknown"
+    ]),
+    version: string().min(1).max(128).optional(),
+    ruleIds: array(string().min(1).max(256)).max(DISCOVERY_RULE_IDS_MAX).optional()
+  })).min(1).max(64).optional(),
+  public_template_hit: boolean().nullable().optional(),
+  change: change.optional(),
+  evidence: strictObject({
+    revision: text,
+    toolCalls: array(EvidenceToolCallSchema),
+    detail: text
+  }),
+  poc: text.optional(),
+  chain: array(strictObject({
+    findingId: text.optional(),
+    summary: text,
+    capabilityGained: text.optional()
+  })).optional(),
+  status: FindingStatusSchema,
+  verification: VerificationSchema
+};
+var installSubject = strictObject({
+  kind: literal("install"),
+  requestId: text,
+  package: packageIdentity.extend({ artifactDigest: text }),
+  contextRef: text
+});
+var findingVariants = union([
+  strictObject({
+    ...common,
+    capability: _enum(["code", "pull_requests"]),
+    surface: literal("code"),
+    claim: _enum(["vulnerability", "weak_cryptography"]),
+    subject: strictObject({
+      kind: literal("source"),
+      repository: text,
+      revision: text,
+      path: text
+    })
+  }),
+  strictObject({
+    ...common,
+    capability: _enum(["code", "pull_requests"]),
+    surface: literal("configuration"),
+    claim: literal("configuration_violation"),
+    subject: strictObject({
+      kind: literal("configuration"),
+      revisionRef: text,
+      resourceRef: text,
+      ruleId: text
+    })
+  }),
+  strictObject({
+    ...common,
+    capability: literal("agentic_pentesting"),
+    surface: _enum(["web", "runtime"]),
+    claim: literal("vulnerability"),
+    endpoint: strictObject({
+      url: url().max(2048),
+      method: _enum([
+        "GET",
+        "HEAD",
+        "OPTIONS",
+        "POST",
+        "PUT",
+        "PATCH",
+        "DELETE"
+      ]),
+      parameter: string().regex(/^[a-zA-Z0-9_]{1,64}$/).optional()
+    }).optional(),
+    subject: strictObject({
+      kind: literal("runtime"),
+      targetRef: text,
+      buildIdentityRef: text
+    })
+  }),
+  strictObject({
+    ...common,
+    capability: literal("secrets"),
+    surface: _enum(["code", "ci", "web", "runtime"]),
+    claim: _enum(["secret_exposure", "credential_validity"]),
+    subject: strictObject({
+      kind: literal("secret"),
+      credentialRef: text,
+      locationRef: text,
+      provider: text.optional()
+    })
+  }),
+  strictObject({
+    ...common,
+    capability: literal("supply_chain"),
+    surface: literal("dependency"),
+    claim: _enum([
+      "advisory_match",
+      "dependency_reachability",
+      "dependency_exploitability",
+      "malicious_package"
+    ]),
+    subject: strictObject({
+      kind: literal("dependency"),
+      package: packageIdentity,
+      contextRef: text,
+      advisoryIds: array(text)
+    })
+  }),
+  strictObject({
+    ...common,
+    capability: literal("dependency_firewall"),
+    surface: literal("install"),
+    claim: literal("malicious_package"),
+    subject: installSubject
+  })
+]);
+var FindingSchema = findingVariants.superRefine((finding, context) => {
+  const reject = (message) => {
+    context.addIssue({ code: "custom", message });
+  };
+  const checked = finding.verification;
+  if (finding.found_via === undefined !== (finding.public_template_hit === undefined))
+    reject("Discovery provenance fields must be recorded together.");
+  if (finding.found_via && (finding.found_via.length !== finding.evidence.toolCalls.length || new Set(finding.found_via.map((entry) => entry.callId)).size !== finding.found_via.length || finding.found_via.some((entry) => !finding.evidence.toolCalls.some((call) => call.callId === entry.callId))))
+    reject("Discovery provenance must bind the cited evidence calls.");
+  if (finding.capability === "pull_requests" && !finding.change)
+    reject("PR findings require pinned change context.");
+  if (finding.subject.kind === "source" && finding.change && (finding.subject.revision !== finding.change.headRevision || finding.subject.repository !== finding.change.repository))
+    reject("Source identity must match the pinned head.");
+  if (new Set(finding.evidence.toolCalls.map((call) => call.callId)).size !== finding.evidence.toolCalls.length)
+    reject("Evidence tool-call identities must be unique.");
+  if (checked.result === "pending" || checked.result === "needs_human") {
+    if (finding.status !== "candidate")
+      reject("An unverified finding cannot be terminal.");
+    if (checked.method || checked.receipt || checked.review || checked.result === "pending" && checked.artifactRef)
+      reject("An unverified candidate cannot supply a verification receipt.");
+    return;
+  }
+  if (finding.status !== (checked.result === "pass" ? "confirmed" : "discarded"))
+    reject("Finding status and verification result disagree.");
+  if (!checked.method || !checked.artifactRef || !checked.receipt || !finding.evidence.toolCalls.length) {
+    reject("Terminal findings require independent proof and grounded observations.");
+    return;
+  }
+  const receipt = checked.receipt;
+  if (receipt.runId !== finding.runId || receipt.findingId !== finding.id || receipt.claim !== finding.claim || receipt.evidenceRev !== finding.evidence.revision)
+    reject("Receipt does not bind the original candidate and evidence.");
+  if (["flag", "witness", "replay"].includes(checked.method) && !finding.poc)
+    reject("Runtime proof requires redacted replay instructions.");
+});
+var InstallDecisionSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  id: text,
+  subject: installSubject,
+  policy,
+  decision: _enum(["allow", "block", "error"]),
+  basis: _enum(["known_malware", "policy", "heuristic", "unavailable"]),
+  effect: _enum(["released", "blocked", "unknown"]),
+  artifactRef: text,
+  at: timestamp
+}).superRefine((decision, context) => {
+  if (decision.effect === "released" && decision.decision !== "allow")
+    context.addIssue({
+      code: "custom",
+      message: "A release requires an allow decision."
+    });
+});
+
+// packages/contract/src/core.ts
+var PendingApprovalSchema = strictObject({
+  approvalId: IdentifierSchema,
+  action: IdentifierSchema,
+  permission: IdentifierSchema,
+  why: IdentifierSchema,
+  cleanup: IdentifierSchema,
+  detail: IdentifierSchema,
+  investigationId: string().min(1).optional()
+});
+var ApprovalDecisionSchema = _enum(["allow", "deny", "expired"]);
+var ToolOutcomeSchema = _enum(["ok", "failed", "rejected"]);
+var PendingReviewSchema = strictObject({
+  reviewRequestId: IdentifierSchema,
+  findingId: IdentifierSchema,
+  evidenceRev: IdentifierSchema
+});
+var envelope = {
+  contractVersion: literal(CONTRACT_VERSION),
+  runId: IdentifierSchema,
+  seq: number().int().nonnegative()
+};
+var InvestigationStageSchema = _enum([
+  "recon",
+  "hunt",
+  "triage",
+  "verify",
+  "report"
+]);
+var FindingTallySchema = strictObject({
+  confirmed: number().int().nonnegative(),
+  needsHuman: number().int().nonnegative(),
+  discarded: number().int().nonnegative()
+});
+var target = {
+  target: IdentifierSchema,
+  mode: RunModeSchema,
+  capabilities: array(ProductCapabilitySchema),
+  caps: CapsSchema
+};
+function eventVariants(envelope) {
+  const base = {
+    ...envelope,
+    type: literal("investigation.progress"),
+    investigationId: string().min(1),
+    label: string().min(1).max(MAX_LABEL),
+    kind: InvestigationModeSchema
+  };
+  const progress = discriminatedUnion("phase", [
+    strictObject({ ...base, phase: literal("started") }),
+    strictObject({
+      ...base,
+      phase: literal("stage"),
+      stage: strictObject({
+        name: InvestigationStageSchema,
+        round: number().int().nonnegative(),
+        state: _enum(["started", "completed"])
+      })
+    }),
+    strictObject({
+      ...base,
+      phase: literal("action"),
+      action: strictObject({
+        label: string().min(1).max(MAX_LABEL),
+        args: string().max(512)
+      })
+    }),
+    strictObject({
+      ...base,
+      phase: literal("finding"),
+      finding: strictObject({
+        findingId: string().min(1),
+        severity: SeveritySchema,
+        title: string(),
+        status: FindingStatusSchema
+      })
+    }),
+    strictObject({
+      ...base,
+      phase: literal("finished"),
+      outcome: strictObject({
+        outcome: TerminalSchema.shape.outcome,
+        ...FindingTallySchema.shape,
+        elapsedSec: number().finite().nonnegative()
+      })
+    })
+  ]);
+  return [
+    strictObject({ ...envelope, type: literal("run.started"), ...target }),
+    strictObject({
+      ...envelope,
+      type: literal("run.snapshot"),
+      ...target,
+      spent: BudgetSchema,
+      findings: array(FindingSchema),
+      installDecisions: array(InstallDecisionSchema),
+      pendingApprovals: array(PendingApprovalSchema),
+      pendingReviews: array(PendingReviewSchema),
+      terminal: TerminalSchema.optional()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("step"),
+      stepId: IdentifierSchema,
+      summary: string()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("tool.call"),
+      callId: IdentifierSchema,
+      tool: IdentifierSchema,
+      label: string().min(1).max(MAX_LABEL),
+      quiet: boolean(),
+      argsSummary: string()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("tool.result"),
+      callId: IdentifierSchema,
+      outcome: ToolOutcomeSchema,
+      summary: string(),
+      preview: array(string().max(MAX_PREVIEW_LINE)).max(MAX_PREVIEW_LINES).optional(),
+      artifactRef: IdentifierSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("model.call"),
+      requestId: IdentifierSchema,
+      model: IdentifierSchema,
+      deadline: exports_iso.datetime()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("model.result"),
+      requestId: IdentifierSchema,
+      ok: boolean()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("coverage"),
+      surface: IdentifierSchema,
+      outcome: _enum(["checked", "cleared", "ruled_out"])
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("dependency.decision"),
+      decision: InstallDecisionSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("finding.candidate"),
+      finding: FindingSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("finding.update"),
+      findingId: IdentifierSchema,
+      status: FindingStatusSchema,
+      verification: VerificationSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("budget"),
+      caps: CapsSchema,
+      spent: BudgetSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("approval.request"),
+      ...PendingApprovalSchema.shape
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("approval.decision"),
+      approvalId: IdentifierSchema,
+      decision: ApprovalDecisionSchema,
+      decidedBy: IdentifierSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("review.request"),
+      ...PendingReviewSchema.shape
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("run.finished"),
+      ...TerminalSchema.shape,
+      ...FindingTallySchema.shape
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("operator.message"),
+      message: string().min(1).max(MAX_STEER_MESSAGE),
+      images: ImageRefsSchema.optional()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("operator.message.taken"),
+      messageSeq: number().int().positive()
+    }),
+    progress,
+    strictObject({ ...envelope, type: literal("turn.interrupted") }),
+    strictObject({
+      ...envelope,
+      type: literal("turn.finished"),
+      elapsedSec: number().finite().nonnegative(),
+      usd: number().finite().nonnegative().optional()
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("recovery.needed"),
+      reason: IdentifierSchema
+    }),
+    strictObject({
+      ...envelope,
+      type: literal("error"),
+      message: string(),
+      fatal: boolean()
+    })
+  ];
+}
+var EventSchema = discriminatedUnion("type", eventVariants(envelope)).superRefine((event, context) => {
+  const reject = (message) => {
+    context.addIssue({ code: "custom", message });
+  };
+  const unique = (values) => {
+    if (new Set(values).size !== values.length)
+      reject("Duplicate event identities.");
+  };
+  if (event.type === "run.started" || event.type === "run.snapshot")
+    unique(event.capabilities);
+  if (event.type === "operator.message.taken" && event.messageSeq >= event.seq)
+    reject("A message is taken only after it was sent.");
+  if (event.type === "finding.candidate" && (event.finding.runId !== event.runId || event.finding.status !== "candidate" || event.finding.verification.result !== "pending"))
+    reject("A candidate event must introduce a pending candidate in this run.");
+  if (event.type === "finding.update") {
+    const checked = event.verification;
+    const status = checked.result === "pass" ? "confirmed" : checked.result === "fail" ? "discarded" : "candidate";
+    if (event.status !== status)
+      reject("Finding update status disagrees with verification.");
+    if (checked.result === "pending")
+      reject("A finding update must report a check outcome.");
+    if (status !== "candidate" && (!checked.method || !checked.artifactRef || !checked.receipt))
+      reject("Terminal updates require independent proof.");
+    if (status === "candidate" && (checked.method || checked.receipt || checked.review || checked.result === "pending" && checked.artifactRef))
+      reject("Pending updates cannot claim proof.");
+    if (checked.receipt && (checked.receipt.runId !== event.runId || checked.receipt.findingId !== event.findingId))
+      reject("Receipt identity differs from the update.");
+  }
+  if (event.type === "run.snapshot") {
+    unique(event.findings.map((finding) => finding.id));
+    unique(event.installDecisions.map((decision) => decision.id));
+    unique(event.pendingApprovals.map((approval) => approval.approvalId));
+    unique(event.pendingReviews.map((review) => review.reviewRequestId));
+    unique(event.pendingReviews.map((review) => review.findingId));
+    for (const finding of event.findings) {
+      if (finding.runId !== event.runId || !event.capabilities.includes(finding.capability))
+        reject("Snapshot finding is outside this run.");
+    }
+    for (const review of event.pendingReviews) {
+      const finding = event.findings.find((entry) => entry.id === review.findingId);
+      if (finding?.verification.result !== "needs_human" || finding.evidence.revision !== review.evidenceRev)
+        reject("Review does not bind an inconclusive finding and its evidence.");
+    }
+  }
+});
+// packages/contract/src/evidence.ts
+var EVIDENCE_MAX_BYTES = 65536;
+var INLINE_EVIDENCE_STORE_ID = "postgres-inline-v1";
+var EVIDENCE_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+var EVIDENCE_PREDICATE_TYPE = "https://pazago.com/mettle/attestation/evidence/v1";
+var EVIDENCE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+var ArtifactRefSchema = string().regex(/^sha256:[a-f0-9]{64}$/);
+var Hex64Schema = string().regex(/^[a-f0-9]{64}$/);
+var Base64Schema = string().min(1).max(1048576).regex(/^[A-Za-z0-9+/]+={0,2}$/);
+var ArtifactManifestSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  runId: uuid(),
+  artifactRef: ArtifactRefSchema,
+  authorityDigest: Hex64Schema,
+  byteLength: number().int().nonnegative().max(EVIDENCE_MAX_BYTES),
+  capturePolicy: literal("structured-secrets-v1"),
+  redacted: literal(true),
+  storage: discriminatedUnion("kind", [
+    strictObject({
+      kind: literal("postgres"),
+      storeId: literal(INLINE_EVIDENCE_STORE_ID)
+    }),
+    strictObject({
+      kind: literal("local"),
+      storeId: string().min(1).max(256),
+      key: string().regex(/^[a-f0-9]{64}_[a-f0-9]{64}$/),
+      version: Hex64Schema
+    }),
+    strictObject({
+      kind: literal("s3"),
+      storeId: string().min(1).max(256),
+      key: string().regex(/^[a-f0-9]{64}_[a-f0-9]{64}$/),
+      version: string().min(1).max(1024).refine((value) => value !== "null")
+    })
+  ])
+});
+var EvidencePredicateSchema = strictObject({
+  runId: uuid(),
+  authorityDigest: Hex64Schema,
+  runtimeVersion: string().min(1).max(512),
+  capturedAt: exports_iso.datetime(),
+  tool: string().min(1).max(256).optional(),
+  callId: string().min(1).max(512).optional()
+});
+var EvidenceStatementSchema = strictObject({
+  _type: literal(EVIDENCE_STATEMENT_TYPE),
+  subject: tuple([
+    strictObject({
+      name: ArtifactRefSchema,
+      digest: strictObject({ sha256: Hex64Schema })
+    })
+  ]),
+  predicateType: literal(EVIDENCE_PREDICATE_TYPE),
+  predicate: EvidencePredicateSchema
+});
+var EvidenceEnvelopeSchema = strictObject({
+  payloadType: literal(EVIDENCE_PAYLOAD_TYPE),
+  payload: Base64Schema,
+  signatures: tuple([
+    strictObject({ keyid: Hex64Schema, sig: Base64Schema })
+  ])
+});
+var EvidenceSigningKeySchema = strictObject({
+  keyId: Hex64Schema,
+  algorithm: literal("ed25519"),
+  publicKey: string().regex(/^-----BEGIN PUBLIC KEY-----\n[A-Za-z0-9+/=\n]+-----END PUBLIC KEY-----\n?$/)
+});
+// packages/contract/src/gyms.ts
+var TargetIdentitySchema = strictObject({
+  rangeId: IdentifierSchema,
+  instanceId: IdentifierSchema,
+  resetGeneration: IdentifierSchema,
+  taskRevision: IdentifierSchema,
+  targetRevision: IdentifierSchema
+});
+var VerificationIdentitySchema = TargetIdentitySchema.extend({
+  runId: IdentifierSchema,
+  attemptId: IdentifierSchema,
+  candidateId: IdentifierSchema,
+  candidateRevision: IdentifierSchema,
+  pocInputsDigest: IdentifierSchema,
+  predicateRevision: IdentifierSchema,
+  executionPathDigest: IdentifierSchema
+});
+var VerifyRequestSchema = strictObject({
+  seamVersion: literal(SEAM_VERSION.oracle),
+  identity: VerificationIdentitySchema,
+  mode: InvestigationModeSchema,
+  candidate: FindingSchema,
+  pocInputs: array(string()),
+  executionPathRef: IdentifierSchema
+}).superRefine((request, context) => {
+  if (request.candidate.id !== request.identity.candidateId || request.candidate.runId !== request.identity.runId || request.candidate.status !== "candidate" || request.candidate.verification.result !== "pending") {
+    context.addIssue({
+      code: "custom",
+      message: "Verification requires a pending candidate with matching run and candidate identity."
+    });
+  }
+});
+var verdictEnvelope = {
+  seamVersion: literal(SEAM_VERSION.oracle),
+  identity: VerificationIdentitySchema
+};
+var VerifyVerdictSchema = union([
+  strictObject({
+    ...verdictEnvelope,
+    result: _enum(["pass", "fail"]),
+    method: _enum(["flag", "witness", "replay"]),
+    artifactRef: IdentifierSchema,
+    receipt: VerificationReceiptSchema,
+    detail: string().optional()
+  }),
+  strictObject({
+    ...verdictEnvelope,
+    result: literal("needs_human"),
+    reason: _enum(["unsupported", "insufficient_evidence", "human_replay"]),
+    artifactRef: IdentifierSchema.optional(),
+    detail: string()
+  })
+]).superRefine((verdict, context) => {
+  if (verdict.result === "needs_human")
+    return;
+  const receipt = verdict.receipt;
+  if (receipt.authority.kind !== "gyms_oracle" || !["vulnerability", "dependency_exploitability"].includes(receipt.claim) || receipt.claim === "dependency_exploitability" && verdict.method === "flag" || receipt.runId !== verdict.identity.runId || receipt.findingId !== verdict.identity.candidateId || receipt.candidateRevision !== verdict.identity.candidateRevision || receipt.policy.revision !== verdict.identity.predicateRevision) {
+    context.addIssue({
+      code: "custom",
+      message: "Oracle receipt does not bind a supported runtime claim and predicate."
+    });
+  }
+});
+var OracleErrorSchema = strictObject({
+  code: _enum([
+    "engine_failure",
+    "timeout",
+    "version_mismatch",
+    "unavailable",
+    "invalid_request",
+    "identity_mismatch",
+    "attempt_conflict",
+    "in_progress",
+    "uncertain_execution"
+  ]),
+  message: string()
+});
+var RangeEligibilitySchema = discriminatedUnion("eligible", [
+  strictObject({
+    eligible: literal(true),
+    identity: TargetIdentitySchema,
+    endpoint: IdentifierSchema,
+    expiresAt: exports_iso.datetime({ offset: true })
+  }),
+  strictObject({ eligible: literal(false), reason: IdentifierSchema })
+]);
+// packages/contract/src/investigations.ts
+var WorkflowKindSchema = _enum([
+  "repository-review",
+  "pr-review",
+  "pentest"
+]);
+var WorkflowBindingSchema = strictObject({
+  id: string().regex(/^[a-zA-Z0-9_-]{1,128}$/),
+  revision: number().int().positive(),
+  digest: Hex64Schema
+});
+var WebsiteEngagementSchema = strictObject({
+  target: url().max(2048),
+  model: string().min(1).max(128),
+  authorization: literal(true),
+  policy: literal("website-live-v1"),
+  scope: array(url().max(2048)).max(7).optional(),
+  browser: boolean().optional()
+});
+var InvestigationUrlSchema = strictObject({
+  target: string().min(1).max(2048),
+  model: string().min(1).max(128)
+});
+var InvestigationPrepareSchema = strictObject({
+  workflow: WorkflowBindingSchema.optional(),
+  profileId: string().regex(/^[a-zA-Z0-9_-]{1,128}$/),
+  target: string().min(1).max(2048),
+  model: string().min(1).max(256)
+});
+var WorkflowDefinitionSchema = strictObject({
+  kind: WorkflowKindSchema,
+  label: string().min(1).max(128),
+  profileId: InvestigationPrepareSchema.shape.profileId,
+  model: InvestigationPrepareSchema.shape.model
+});
+var WorkflowRevisionSchema = WorkflowBindingSchema.extend({
+  definition: WorkflowDefinitionSchema
+});
+var WorkflowSaveSchema = strictObject({
+  expectedRevision: number().int().nonnegative(),
+  definition: WorkflowDefinitionSchema
+});
+var WorkflowPrepareSchema = strictObject({
+  workflow: WorkflowBindingSchema,
+  target: string().min(1).max(2048)
+});
+var PreparationStateSchema = _enum([
+  "pending",
+  "preparing",
+  "ready",
+  "failed",
+  "started"
+]);
+var PreparationViewSchema = InvestigationPrepareSchema.extend({
+  preparationId: uuid(),
+  state: PreparationStateSchema,
+  expiresAt: exports_iso.datetime(),
+  grantDigest: string().regex(/^[a-f0-9]{64}$/).optional(),
+  runId: uuid().optional(),
+  coverage: array(string()),
+  source: strictObject({
+    revision: string().min(1),
+    files: number().int().nonnegative(),
+    excluded: number().int().nonnegative()
+  }).optional(),
+  error: string().optional(),
+  cleanupError: string().optional()
+});
+var InvestigationStartSchema = strictObject({
+  preparationId: uuid(),
+  grantDigest: string().regex(/^[a-f0-9]{64}$/)
+});
+var InvestigationRunIdSchema = strictObject({ runId: uuid() });
+var InvestigationModelSchema = strictObject({
+  id: string().min(1).max(256),
+  provider: string().min(1).max(256)
+});
+var execution = {
+  runtime: _enum(["runc", "mettle-runsc", "host-read"]),
+  location: _enum(["local", "vm", "backend-host"]),
+  engineId: string().nullable(),
+  image: string().nullable()
+};
+var InvestigationCapabilitiesSchema = strictObject({
+  profiles: array(strictObject({
+    id: InvestigationPrepareSchema.shape.profileId,
+    mode: _enum(["codereview", "pentest"]),
+    ...execution,
+    targets: array(string()),
+    models: array(InvestigationModelSchema),
+    expiresAt: exports_iso.datetime()
+  }))
+});
+var InvestigationLaunchResultSchema = InvestigationRunIdSchema.extend({
+  created: boolean().optional(),
+  recovered: boolean().optional()
+});
+var InvestigationProgressSchema = InvestigationRunIdSchema.extend({
+  target: string(),
+  model: string().optional(),
+  terminal: TerminalSchema.nullable(),
+  stopRequested: boolean(),
+  stages: array(strictObject({ stage: string(), committed: literal(true) })),
+  actions: array(strictObject({
+    tool: string(),
+    state: _enum(["prepared", "dispatched", "completed", "failed"]),
+    callId: string()
+  })).max(30),
+  spent: BudgetSchema,
+  reservations: array(strictObject({
+    requestId: string(),
+    state: _enum(["reserved", "completed", "failed"]),
+    tokens: number().int().nonnegative(),
+    nanousd: string().regex(/^\d+$/).nullable()
+  })),
+  pendingApprovals: array(strictObject({
+    id: string(),
+    action: string(),
+    permission: string(),
+    expiresAt: exports_iso.datetime()
+  })),
+  execution: strictObject({
+    workflow: WorkflowBindingSchema.optional(),
+    profileId: InvestigationPrepareSchema.shape.profileId,
+    ...execution
+  }),
+  coverage: array(string()),
+  recovery: _enum([
+    "approval_required",
+    "running",
+    "reconciliation_required",
+    "finished",
+    "recoverable_after_lease_expiry"
+  ])
+});
+
+// packages/contract/src/http.ts
+var wireRecord = looseObject({
+  contractVersion: never().optional()
+});
+var record2 = record(string(), unknown());
+
+class HttpProtocol {
+  path = "/v1";
+  readRecord(value) {
+    return { ...wireRecord.parse(value), contractVersion: CONTRACT_VERSION };
+  }
+  writeRecord(value) {
+    const { contractVersion, ...fields } = value;
+    return fields;
+  }
+  start(value) {
+    return { ...value, config: this.writeRecord(value.config) };
+  }
+  readStart(value) {
+    const input = record2.parse(value);
+    return RunStartSchema.parse({
+      ...input,
+      config: this.readRecord(input.config)
+    });
+  }
+  readControl(value) {
+    return AgentControlSchema.parse(this.readRecord(value));
+  }
+  readContext(value) {
+    return ContractContextSchema.parse(this.readRecord(value));
+  }
+  event(event) {
+    return this.writeRecord({
+      ...event,
+      ...event.type === "finding.candidate" ? { finding: this.writeRecord(event.finding) } : event.type === "dependency.decision" ? { decision: this.writeRecord(event.decision) } : event.type === "run.snapshot" ? {
+        findings: event.findings.map((entry) => this.writeRecord(entry)),
+        installDecisions: event.installDecisions.map((entry) => this.writeRecord(entry))
+      } : {}
+    });
+  }
+  readEvent(value) {
+    try {
+      const event = this.readRecord(value);
+      if (event.type === "finding.candidate")
+        event.finding = this.readRecord(event.finding);
+      if (event.type === "dependency.decision")
+        event.decision = this.readRecord(event.decision);
+      if (event.type === "run.snapshot") {
+        event.findings = array(unknown()).parse(event.findings).map((entry) => this.readRecord(entry));
+        event.installDecisions = array(unknown()).parse(event.installDecisions).map((entry) => this.readRecord(entry));
+      }
+      return EventSchema.parse(event);
+    } catch (error) {
+      if (error instanceof ZodError)
+        throw new Error(error.issues[0].message);
+      throw error;
+    }
+  }
+  capabilities(value) {
+    return InvestigationCapabilitiesSchema.parse(value);
+  }
+  preparation(value) {
+    return PreparationViewSchema.parse(value);
+  }
+  investigationLaunch(value) {
+    return InvestigationLaunchResultSchema.parse(value);
+  }
+  investigationProgress(value) {
+    return InvestigationProgressSchema.parse(value);
+  }
+  catalog(value) {
+    return this.writeRecord(value);
+  }
+  readCatalog(value) {
+    return ModelCatalogSchema.parse(this.readRecord(value));
+  }
+  imageUpload(value) {
+    return this.writeRecord(value);
+  }
+  readImageUpload(value) {
+    return ImageUploadSchema.parse(this.readRecord(value));
+  }
+  page(value) {
+    return this.writeRecord(value);
+  }
+  manifest(value) {
+    return this.writeRecord(value);
+  }
+  report(report) {
+    return this.writeRecord({
+      ...report,
+      findings: report.findings.map((entry) => this.writeRecord(entry)),
+      installDecisions: report.installDecisions.map((entry) => this.writeRecord(entry))
+    });
+  }
+}
+var tuiProtocol = new HttpProtocol;
+// packages/contract/src/model.ts
+var JsonValueSchema = lazy(() => union([
+  _null(),
+  boolean(),
+  number().finite(),
+  string(),
+  array(JsonValueSchema),
+  record(string(), JsonValueSchema)
+]));
+var JsonObjectSchema = record(string(), JsonValueSchema);
+var ModelContinuationSchema = strictObject({
+  provider: string().min(1),
+  items: array(JsonObjectSchema).max(128)
+});
+var ModelUsageSchema = strictObject({
+  inputTokens: number().int().nonnegative(),
+  outputTokens: number().int().nonnegative(),
+  costNanousd: number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional()
+});
+var ModelToolCallSchema = strictObject({
+  callId: IdentifierSchema,
+  name: IdentifierSchema,
+  arguments: JsonObjectSchema
+});
+var ModelMessageSchema = union([
+  strictObject({ role: literal("system"), content: string() }),
+  strictObject({
+    role: literal("user"),
+    content: string(),
+    images: ImageRefsSchema.optional()
+  }),
+  strictObject({
+    role: literal("assistant"),
+    content: string(),
+    toolCalls: array(ModelToolCallSchema).optional(),
+    continuation: ModelContinuationSchema.optional()
+  }),
+  strictObject({
+    role: literal("tool"),
+    callId: IdentifierSchema,
+    content: string(),
+    isError: boolean()
+  })
+]);
+var ModelToolSchema = strictObject({
+  name: IdentifierSchema,
+  description: string(),
+  inputSchema: JsonObjectSchema
+});
+var ModelRequestSchema = strictObject({
+  seamVersion: literal(SEAM_VERSION.model),
+  requestId: IdentifierSchema,
+  model: IdentifierSchema,
+  messages: array(ModelMessageSchema).min(1),
+  tools: array(ModelToolSchema),
+  toolChoice: _enum(["auto", "none"]).optional(),
+  maxOutputTokens: PositiveIntegerSchema,
+  sampling: strictObject({
+    temperature: number().finite().optional(),
+    seed: number().int().optional()
+  }).optional()
+}).superRefine((request, context) => {
+  const reject = (message) => {
+    context.addIssue({ code: "custom", message });
+  };
+  const names = new Set(request.tools.map((tool) => tool.name));
+  if (names.size !== request.tools.length)
+    reject("Tool names must be unique.");
+  const seen = new Set;
+  const pending = new Set;
+  for (const message of request.messages) {
+    if (message.role !== "tool" && pending.size)
+      reject("Tool results must resolve preceding calls before another message.");
+    if (message.role === "assistant") {
+      for (const call of message.toolCalls ?? []) {
+        if (seen.has(call.callId) || !names.has(call.name))
+          reject("Duplicate call identity or unregistered tool.");
+        seen.add(call.callId);
+        pending.add(call.callId);
+      }
+    } else if (message.role === "tool" && !pending.delete(message.callId))
+      reject("Tool result has no unique preceding call.");
+  }
+  if (pending.size)
+    reject("Unresolved tool calls cannot be submitted for inference.");
+});
+var ModelResponseSchema = strictObject({
+  requestId: IdentifierSchema,
+  model: IdentifierSchema,
+  content: string(),
+  toolCalls: array(ModelToolCallSchema),
+  finishReason: _enum(["stop", "tool_calls", "length", "refusal"]),
+  usage: ModelUsageSchema,
+  continuation: ModelContinuationSchema.optional()
+}).superRefine((response, context) => {
+  if (new Set(response.toolCalls.map((call) => call.callId)).size !== response.toolCalls.length)
+    context.addIssue({
+      code: "custom",
+      message: "Tool-call identities must be unique."
+    });
+  if (response.finishReason === "tool_calls" !== response.toolCalls.length > 0)
+    context.addIssue({
+      code: "custom",
+      message: "Only a finalized tool-call response may expose executable calls."
+    });
+});
+var ModelStreamEventSchema = discriminatedUnion("type", [
+  strictObject({
+    type: literal("text.delta"),
+    requestId: IdentifierSchema,
+    text: string()
+  }),
+  strictObject({
+    type: literal("tool_call.delta"),
+    requestId: IdentifierSchema,
+    callId: IdentifierSchema,
+    name: IdentifierSchema.optional(),
+    argumentsDelta: string()
+  }),
+  strictObject({
+    type: literal("usage"),
+    requestId: IdentifierSchema,
+    usage: ModelUsageSchema
+  }),
+  strictObject({
+    type: literal("completed"),
+    requestId: IdentifierSchema,
+    response: ModelResponseSchema
+  })
+]).superRefine((event, context) => {
+  if (event.type === "completed" && event.response.requestId !== event.requestId)
+    context.addIssue({
+      code: "custom",
+      message: "Completed response identity differs from its envelope."
+    });
+});
+var ModelErrorSchema = strictObject({
+  code: _enum([
+    "version_mismatch",
+    "invalid_request",
+    "unsupported",
+    "timeout",
+    "aborted",
+    "provider_failure",
+    "unavailable",
+    "incomplete_stream"
+  ]),
+  requestId: IdentifierSchema,
+  message: string()
+});
+// packages/contract/src/patches.ts
+var PatchEditSchema = strictObject({
+  path: string().min(1).max(512),
+  beforeSha256: Hex64Schema,
+  afterSha256: Hex64Schema,
+  content: string().max(8192)
+});
+var PatchProposalSchema = strictObject({
+  proposalId: string().min(1).max(256),
+  repository: string(),
+  revision: string(),
+  status: literal("unverified-proposal"),
+  findingId: string().min(1).optional(),
+  unifiedDiff: string().max(131072).optional(),
+  diffSha256: Hex64Schema.optional(),
+  edits: array(PatchEditSchema).min(1).max(4)
+});
+var TestRunResultSchema = strictObject({
+  repository: string(),
+  revision: string(),
+  profileId: string(),
+  patchProposalId: string().nullable(),
+  verification: literal("not-independent"),
+  status: _enum([
+    "passed",
+    "failed",
+    "timed_out",
+    "output_limit",
+    "unavailable"
+  ]),
+  exitCode: number().int().nullable(),
+  stdout: string(),
+  stderr: string(),
+  truncated: boolean()
+});
+var PatchRecommendationSchema = PatchProposalSchema.omit({
+  edits: true,
+  diffSha256: true
+}).extend({
+  artifactRef: ArtifactRefSchema,
+  applicability: _enum(["exact", "redacted", "legacy"]),
+  validation: _enum(["not_run", "passed", "failed", "incomplete"]),
+  files: array(PatchEditSchema.omit({ content: true })).min(1).max(4),
+  tests: array(EvidenceToolCallSchema.extend({
+    status: TestRunResultSchema.shape.status
+  })).max(2000)
+});
+// packages/contract/src/report.ts
+var ReportFormatSchema = _enum(["json", "markdown", "sarif"]);
+var ReportSchema = strictObject({
+  contractVersion: literal(CONTRACT_VERSION),
+  reportVersion: _enum(["1.0.0", "1.1.0"]),
+  patchRecommendations: array(PatchRecommendationSchema).max(500).optional(),
+  generatedAt: exports_iso.datetime(),
+  coverage: array(string().max(2048)).max(500).optional(),
+  scope: _enum(["development-fixture", "assessment"]),
+  runId: IdentifierSchema,
+  seq: number().int().nonnegative(),
+  target: IdentifierSchema,
+  mode: InvestigationModeSchema,
+  capabilities: array(ProductCapabilitySchema).min(1),
+  caps: CapsSchema,
+  spent: BudgetSchema,
+  consumption: BudgetSchema.extend({
+    steps: number().int().nonnegative()
+  }).optional(),
+  terminal: TerminalSchema,
+  findings: array(FindingSchema).max(500),
+  installDecisions: array(InstallDecisionSchema).max(500),
+  pendingApprovals: array(PendingApprovalSchema).max(500),
+  pendingReviews: array(PendingReviewSchema).max(500),
+  observations: array(EvidenceToolCallSchema).max(2000),
+  evidence: array(strictObject({
+    artifactRef: ArtifactRefSchema,
+    byteLength: number().int().nonnegative().max(1048576)
+  })).max(2500)
+}).superRefine((report, context) => {
+  const {
+    reportVersion: _version,
+    patchRecommendations: _patches,
+    generatedAt: _generatedAt,
+    scope: _scope,
+    observations: _observations,
+    evidence: _evidence,
+    consumption: _consumption,
+    coverage: _coverage,
+    ...snapshot
+  } = report;
+  if (report.reportVersion === "1.0.0" && report.patchRecommendations !== undefined)
+    context.addIssue({
+      code: "custom",
+      path: ["reportVersion"],
+      message: "Patch recommendations require report version 1.1.0."
+    });
+  const result = EventSchema.safeParse({ ...snapshot, type: "run.snapshot" });
+  if (!result.success)
+    for (const issue of result.error.issues)
+      context.addIssue({
+        code: "custom",
+        path: issue.path,
+        message: issue.message
+      });
+});
+// packages/foundation/src/errors.ts
+class HarnessError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "HarnessError";
+  }
+}
+function publicError(error) {
+  if (error instanceof HarnessError)
+    return `${error.code}: ${error.message}`;
+  return "internal_failure: The operation failed; no further execution is authorized.";
+}
+
+// packages/foundation/src/digest.ts
+import { createHash } from "node:crypto";
+function canonicalJson(value) {
+  const ancestors = new WeakSet;
+  function encode(entry) {
+    if (entry === null || typeof entry === "boolean" || typeof entry === "string")
+      return JSON.stringify(entry);
+    if (typeof entry === "number" && Number.isFinite(entry))
+      return JSON.stringify(entry);
+    if (typeof entry === "object" && entry !== null && (Array.isArray(entry) || Object.getPrototypeOf(entry) === Object.prototype)) {
+      if (ancestors.has(entry))
+        throw new HarnessError("invalid_json", "Cyclic values are not JSON.");
+      ancestors.add(entry);
+      try {
+        if (Array.isArray(entry))
+          return `[${Array.from(entry, encode).join(",")}]`;
+        return `{${Object.entries(entry).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => `${JSON.stringify(key)}:${encode(child)}`).join(",")}}`;
+      } finally {
+        ancestors.delete(entry);
+      }
+    }
+    throw new HarnessError("invalid_json", "Only finite JSON values are accepted.");
+  }
+  return encode(value);
+}
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function digest(value) {
+  return sha256(canonicalJson(value));
+}
+function digestUuid(value) {
+  const hash = digest(value);
+  return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-5${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+}
+
+// packages/foundation/src/fixture-contract.ts
+var FIXTURE_TARGET = "fixture://counter";
+var COORDINATOR_TARGET = "mettle://coordinator";
+var FIXTURE_MODEL = "harness-fixture-v1";
+var RUNTIME_VERSION = "harness-mastra-fixture/0.6.0";
+var FIXTURE_CONTEXT_TOKENS = 1000;
+var envelope2 = {
+  contractVersion: literal(CONTRACT_VERSION),
+  runId: uuid(),
+  seq: number().int().nonnegative()
+};
+var FixtureEventSchema = discriminatedUnion("type", eventVariants(envelope2));
+function validateVersion(value) {
+  if (typeof value !== "object" || value === null || !("contractVersion" in value) || value.contractVersion !== CONTRACT_VERSION) {
+    throw new HarnessError("contract_version_mismatch", `Expected contract ${CONTRACT_VERSION}.`);
+  }
+}
+function validateRunConfig(input) {
+  validateVersion(input);
+  const result = RunConfigSchema.safeParse(input);
+  if (!result.success)
+    throw new HarnessError("invalid_config", "Run configuration does not match the supported contract.");
+  return result.data;
+}
+function validateFixtureRun(target, input) {
+  const config = validateRunConfig(input);
+  if (target !== FIXTURE_TARGET || config.model !== FIXTURE_MODEL || config.targetKind !== "web" || config.change !== undefined || config.capabilities !== undefined && (config.capabilities.length !== 1 || config.capabilities[0] !== "agentic_pentesting")) {
+    throw new HarnessError("unsupported_profile", "Only the explicit local counter fixture and fixture model are implemented. Live targets are disabled.");
+  }
+  return config;
+}
+function fixtureConfig(overrides = {}) {
+  return {
+    contractVersion: CONTRACT_VERSION,
+    model: FIXTURE_MODEL,
+    targetKind: "web",
+    capabilities: ["agentic_pentesting"],
+    ...overrides
+  };
+}
+
+// packages/foundation/src/attestation.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  sign,
+  verify
+} from "node:crypto";
+function preAuthenticationEncoding(payloadType, payload) {
+  const type = Buffer.from(payloadType, "utf8");
+  return Buffer.concat([
+    Buffer.from(`DSSEv1 ${type.byteLength} `, "utf8"),
+    type,
+    Buffer.from(` ${payload.byteLength} `, "utf8"),
+    payload
+  ]);
+}
+function evidenceKeyId(publicKey) {
+  return createHash2("sha256").update(publicKey.export({ type: "spki", format: "der" })).digest("hex");
+}
+function evidenceStatement(subject, predicate) {
+  return EvidenceStatementSchema.parse({
+    _type: EVIDENCE_STATEMENT_TYPE,
+    subject: [
+      { name: subject.artifactRef, digest: { sha256: subject.sha256 } }
+    ],
+    predicateType: EVIDENCE_PREDICATE_TYPE,
+    predicate
+  });
+}
+function signEvidence(statement, privateKeyPem) {
+  const privateKey = createPrivateKey(privateKeyPem);
+  if (privateKey.asymmetricKeyType !== "ed25519")
+    throw new HarnessError("evidence_key", "Evidence signing requires an Ed25519 private key.");
+  const payload = Buffer.from(canonicalJson(EvidenceStatementSchema.parse(statement)), "utf8");
+  return EvidenceEnvelopeSchema.parse({
+    payloadType: EVIDENCE_PAYLOAD_TYPE,
+    payload: payload.toString("base64"),
+    signatures: [
+      {
+        keyid: evidenceKeyId(createPublicKey(privateKey)),
+        sig: sign(null, preAuthenticationEncoding(EVIDENCE_PAYLOAD_TYPE, payload), privateKey).toString("base64")
+      }
+    ]
+  });
+}
+function verifyEvidence(envelope, publicKeyPem, subject, expected) {
+  const deny = () => {
+    throw new HarnessError("verification_denied", "The evidence attestation is missing, malformed or not signed for this artifact.");
+  };
+  try {
+    const parsed = EvidenceEnvelopeSchema.parse(envelope);
+    const publicKey = createPublicKey(publicKeyPem);
+    if (publicKey.asymmetricKeyType !== "ed25519" || evidenceKeyId(publicKey) !== parsed.signatures[0].keyid)
+      deny();
+    const payload = Buffer.from(parsed.payload, "base64");
+    if (!verify(null, preAuthenticationEncoding(parsed.payloadType, payload), publicKey, Buffer.from(parsed.signatures[0].sig, "base64")))
+      deny();
+    const text = payload.toString("utf8");
+    const statement = EvidenceStatementSchema.parse(JSON.parse(text));
+    if (canonicalJson(statement) !== text || statement.subject[0].name !== subject.artifactRef || statement.subject[0].digest.sha256 !== subject.sha256 || statement.predicate.runId !== expected.runId || statement.predicate.authorityDigest !== expected.authorityDigest)
+      deny();
+    return statement;
+  } catch (error) {
+    if (error instanceof HarnessError)
+      throw error;
+    return deny();
+  }
+}
+// packages/foundation/src/bounded-json.ts
+async function readBoundedJson(response, limit, options = {}) {
+  if (!response.ok || !response.body || options.contentType !== undefined && response.headers.get("content-type")?.split(";")[0]?.trim() !== options.contentType) {
+    await response.body?.cancel();
+    throw new Error("The response was refused, empty or not JSON.");
+  }
+  const reader = response.body.getReader();
+  const abort = () => {
+    reader.cancel().catch(() => {
+      return;
+    });
+  };
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      if (options.signal?.aborted)
+        throw new Error("The read was aborted.");
+      const chunk = await reader.read();
+      if (options.signal?.aborted)
+        throw new Error("The read was aborted.");
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > limit)
+        throw new Error("The response exceeded its limit.");
+      chunks.push(chunk.value);
+    }
+  } finally {
+    options.signal?.removeEventListener("abort", abort);
+    await reader.cancel().catch(() => {
+      return;
+    });
+  }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)));
+}
+// packages/foundation/src/capture.ts
+var CAPTURE_POLICY = "structured-secrets-v1";
+var sensitiveKey = /^(?:authorization|proxyauthorization|cookie|setcookie|password|passwd|pwd|secret|secretkey|clientsecret|token|accesstoken|refreshtoken|idtoken|apitoken|apikey|xapikey|accesskey|clientkey|privatekey|credential|credentials|sessionid|ssn|connectionstring|databaseurl|awsaccesskeyid|awssecretaccesskey|awssessiontoken|xauthtoken|xamzsecuritytoken|sessiontoken|securitytoken)$/;
+var credentialText = /\b(?:[Bb]earer|[Bb]asic)\s+[A-Za-z0-9._~+/=]+(?:-[A-Za-z0-9._~+/=]+)*|\b[a-z][a-z0-9+.-]*:\/\/[^\s/@]+:[^\s/@]+@|\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16}|AIza[0-9A-Za-z_-]{35}|xox[baprse]-[0-9A-Za-z-]{10,}|xapp-[0-9A-Za-z-]{10,})(?![A-Za-z0-9_-])|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?![A-Za-z0-9_-])|-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g;
+var credentialAssignment = /(?:password|passwd|pwd|secret|token|apikey|api_key|access_key|secret_key)=[^\s&"';]+/gi;
+function redactText(value) {
+  let current = value;
+  for (let pass = 0;pass < 8; pass += 1) {
+    const next = current.replace(credentialText, "[REDACTED]").replace(credentialAssignment, "[REDACTED]");
+    if (next === current)
+      return next;
+    current = next;
+  }
+  throw new Error("Redaction did not converge.");
+}
+function sanitize(value, depth) {
+  if (depth > 32)
+    throw new Error;
+  if (typeof value === "string")
+    return redactText(value);
+  if (Array.isArray(value))
+    return value.map((entry) => sanitize(entry, depth + 1));
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+      key,
+      sensitiveKey.test(key.normalize("NFKC").toLowerCase().replace(/[-_\s]/g, "")) ? "[REDACTED]" : sanitize(entry, depth + 1)
+    ]));
+  return value;
+}
+function captureResponseText(text) {
+  try {
+    if (Buffer.byteLength(text, "utf8") > 1048576)
+      throw new Error;
+    let value;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      value = text;
+    }
+    const sanitized = sanitize(value, 0);
+    const result = typeof value === "string" && value === text ? String(sanitized) : canonicalJson(sanitized);
+    if (Buffer.byteLength(result, "utf8") > 1048576)
+      throw new Error;
+    return result;
+  } catch {
+    throw new HarnessError("capture_rejected", "Response text exceeds the bounded redaction policy.");
+  }
+}
+function captureEvidence(input) {
+  try {
+    const raw = canonicalJson(input);
+    if (Buffer.byteLength(raw, "utf8") > EVIDENCE_MAX_BYTES)
+      throw new Error;
+    const value = sanitize(JSON.parse(raw), 0);
+    const bytes = canonicalJson(value);
+    if (Buffer.byteLength(bytes, "utf8") > EVIDENCE_MAX_BYTES)
+      throw new Error;
+    return { value, bytes, policy: CAPTURE_POLICY };
+  } catch {
+    throw new HarnessError("capture_rejected", "Evidence capture requires bounded JSON compatible with the redaction policy.");
+  }
+}
+// packages/foundation/src/evidence.ts
+async function groundEvidence(calls, additionalRefs, context) {
+  const deny = (cause) => {
+    process.stderr.write(`${JSON.stringify({ component: "evidence", runId: context.runId, code: "evidence_integrity", cause })}
+`);
+    throw new HarnessError("evidence_integrity", "Evidence is missing, unredacted, misbound, oversized or modified.");
+  };
+  try {
+    if (calls.length > 2000 || additionalRefs.length > 2500)
+      deny("record_count");
+    const captured = calls.map((call) => EvidenceToolCallSchema.parse(call));
+    const references = new Set([
+      ...captured.map((call) => call.artifactRef),
+      ...additionalRefs
+    ]);
+    if (references.size > 2500)
+      deny("reference_count");
+    const identities = new Set;
+    for (const call of captured) {
+      if (identities.has(call.callId))
+        deny("duplicate_call");
+      identities.add(call.callId);
+      const recorded = await context.getToolCall(context.runId, call.callId);
+      if (!recorded || recorded.callId !== call.callId || recorded.tool !== call.tool || recorded.artifactRef !== call.artifactRef)
+        deny("tool_call_binding");
+    }
+    let totalBytes = 0;
+    const evidence = new Map;
+    for (const artifactRef of [...references].sort()) {
+      if (!ArtifactRefSchema.safeParse(artifactRef).success)
+        deny("reference_format");
+      const artifact = await context.getArtifact(context.runId, artifactRef);
+      if (typeof artifact.bytes !== "string" || artifact.redacted !== true)
+        deny("unredacted_artifact");
+      const byteLength = Buffer.byteLength(artifact.bytes, "utf8");
+      totalBytes += byteLength;
+      if (byteLength > 1048576)
+        deny("artifact_too_large");
+      if (totalBytes > 8388608)
+        deny("evidence_too_large");
+      if (artifactRef !== `sha256:${sha256(artifact.bytes)}`)
+        deny("artifact_digest");
+      evidence.set(artifactRef, { bytes: artifact.bytes, byteLength });
+    }
+    return evidence;
+  } catch (error) {
+    if (error instanceof HarnessError)
+      throw error;
+    if (error instanceof ZodError)
+      deny("malformed_record");
+    return deny("storage_error");
+  }
+}
+// packages/foundation/src/findings.ts
+function candidateRevision(finding) {
+  return digest({
+    ...finding,
+    status: "candidate",
+    verification: { result: "pending" }
+  });
+}
+function subjectDigest(finding) {
+  return digest({
+    subject: finding.subject,
+    ...finding.change ? { change: finding.change } : {}
+  });
+}
+var AdmittedFindingSchema = FindingSchema.superRefine((finding, context) => {
+  const receipt = finding.verification.receipt;
+  if (receipt && (receipt.candidateRevision !== candidateRevision(finding) || receipt.subjectDigest !== subjectDigest(finding))) {
+    context.addIssue({
+      code: "custom",
+      message: "Receipt does not bind the original candidate and subject."
+    });
+  }
+});
+var independentVerdict = VerificationSchema.safeExtend({
+  result: _enum(["pass", "fail"]),
+  method: VerificationSchema.shape.method.unwrap(),
+  artifactRef: string().min(1),
+  receipt: VerificationReceiptSchema,
+  review: never().optional()
+});
+function checkedBefore(receipt, now) {
+  const time = now.getTime();
+  return Number.isFinite(time) && Date.parse(receipt.checkedAt) <= time;
+}
+async function admitIndependentVerification(candidate, verdict, context) {
+  validateVersion(candidate);
+  const finding = AdmittedFindingSchema.parse(candidate);
+  const checked = independentVerdict.parse(verdict);
+  const deny = () => {
+    throw new HarnessError("verification_denied", "Verification identity, policy, authority, freshness or evidence was not accepted.");
+  };
+  if (finding.status !== "candidate" || finding.verification.result !== "pending" || finding.runId !== context.runId || !context.capabilities.includes(finding.capability) || !context.policy.claims.includes(finding.claim))
+    deny();
+  const receipt = checked.receipt;
+  if (receipt.authority.kind !== context.authority.kind || receipt.authority.id !== context.authority.id || receipt.policy.id !== context.policy.id || receipt.policy.revision !== context.policy.revision)
+    deny();
+  const now = context.now.getTime();
+  if (!checkedBefore(receipt, context.now) || receipt.expiresAt && Date.parse(receipt.expiresAt) <= now || (context.policy.requiresExpiry || finding.claim === "credential_validity") && !receipt.expiresAt)
+    deny();
+  const terminal = AdmittedFindingSchema.parse({
+    ...finding,
+    status: checked.result === "pass" ? "confirmed" : "discarded",
+    verification: checked
+  });
+  try {
+    await groundEvidence(finding.evidence.toolCalls, [checked.artifactRef], context);
+  } catch {
+    deny();
+  }
+  return terminal;
+}
+// packages/foundation/src/report-patches.ts
+var TestSchema = TestRunResultSchema.pick({
+  repository: true,
+  revision: true,
+  patchProposalId: true,
+  verification: true,
+  status: true
+}).strip();
+function reportPatches(calls, findings, artifacts) {
+  const tests = calls.filter((call) => call.tool === "test_run").map((call) => ({
+    call,
+    result: TestSchema.parse(JSON.parse(artifacts.get(call.artifactRef).bytes))
+  }));
+  return calls.filter((call) => call.tool === "patch_propose").map((call) => {
+    const proposal = PatchProposalSchema.parse(JSON.parse(artifacts.get(call.artifactRef).bytes));
+    const finding = findings.find((entry) => entry.id === proposal.findingId);
+    if (proposal.proposalId !== call.callId || proposal.findingId && (finding?.subject.kind !== "source" || finding.subject.repository !== proposal.repository || finding.subject.revision !== proposal.revision))
+      throw new HarnessError("evidence_integrity", "A patch recommendation must bind its committed proposal and source finding.");
+    const results = tests.filter((test) => test.result.patchProposalId === proposal.proposalId && test.result.repository === proposal.repository && test.result.revision === proposal.revision);
+    const exact = proposal.unifiedDiff !== undefined && proposal.diffSha256 === sha256(proposal.unifiedDiff) && proposal.edits.every((edit) => sha256(edit.content) === edit.afterSha256);
+    return PatchRecommendationSchema.parse({
+      proposalId: proposal.proposalId,
+      repository: proposal.repository,
+      revision: proposal.revision,
+      status: proposal.status,
+      ...proposal.findingId ? { findingId: proposal.findingId } : {},
+      artifactRef: call.artifactRef,
+      applicability: proposal.unifiedDiff === undefined ? "legacy" : exact ? "exact" : "redacted",
+      ...exact ? { unifiedDiff: proposal.unifiedDiff } : {},
+      validation: !results.length ? "not_run" : results.some((test) => test.result.status === "failed") ? "failed" : results.every((test) => test.result.status === "passed") ? "passed" : "incomplete",
+      files: proposal.edits.map(({ path, beforeSha256, afterSha256 }) => ({
+        path,
+        beforeSha256,
+        afterSha256
+      })),
+      tests: results.map(({ call: testCall, result }) => ({
+        ...testCall,
+        status: result.status
+      }))
+    });
+  });
+}
+
+// packages/foundation/src/report.ts
+function humanReviewArtifact(review, receipt) {
+  return canonicalJson({ review, receipt });
+}
+var notice = "Only recorded observations are included. No findings is not proof of security or complete coverage.";
+function escapedCharacter(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
+var controlCharacter = /[\p{Cc}\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff]/u;
+var controlCharacters = new RegExp(controlCharacter, "gu");
+function markdownLiteral(value) {
+  return value.replace(/[\p{Cc}\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff&<>"'\\`*_[\]{}()#+.!|~:@-]/gu, (character) => controlCharacter.test(character) ? escapedCharacter(character) : `&#${character.charCodeAt(0)};`);
+}
+function json(value) {
+  return `${JSON.stringify(value, null, 2).replace(/[\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff]/gu, escapedCharacter)}
+`;
+}
+function markdown(report) {
+  const lines = [
+    "# Mettle run report",
+    "",
+    ...report.scope === "development-fixture" ? ["**Development fixture only; not a security assessment.**", ""] : [],
+    notice,
+    "",
+    `- Run: ${markdownLiteral(report.runId)}`,
+    `- Target: ${markdownLiteral(report.target)}`,
+    `- Mode: ${report.mode}`,
+    `- Committed sequence: ${report.seq}`,
+    `- Outcome: ${report.terminal.outcome}`,
+    `- Cleanup complete: ${report.terminal.cleanupOk ? "yes" : "no"}`,
+    `- Generated: ${markdownLiteral(report.generatedAt)}`,
+    `- Context tokens: ${report.spent.tokens}; wall seconds: ${report.spent.wallSec}`,
+    ...report.consumption ? [
+      `- Cumulative tokens: ${report.consumption.tokens}; steps: ${report.consumption.steps}`
+    ] : [],
+    ...report.spent.usd === undefined ? ["- USD accounting: not recorded"] : [`- Recorded USD: ${report.spent.usd}`],
+    `- Pending approvals: ${report.pendingApprovals.length}; pending reviews: ${report.pendingReviews.length}`,
+    `- Operational install decisions: ${report.installDecisions.length} (see JSON; not vulnerability verdicts)`,
+    "",
+    ...report.coverage ? [
+      "## Coverage",
+      "",
+      ...report.coverage.map((line) => `- ${markdownLiteral(line)}`),
+      ""
+    ] : [],
+    "## Findings",
+    "",
+    ...report.findings.length ? [] : ["No findings recorded.", ""]
+  ];
+  for (const finding of report.findings) {
+    lines.push(`### ${markdownLiteral(finding.title)}`, "", `- ID: ${markdownLiteral(finding.id)}`, `- Status: ${finding.status}; verification: ${finding.verification.result}`, `- Severity: ${finding.severity}; claim: ${markdownLiteral(finding.claim)}`, `- Location: ${markdownLiteral(finding.location)}`, `- Evidence revision: ${markdownLiteral(finding.evidence.revision)}`, `- Detail: ${markdownLiteral(finding.evidence.detail)}`);
+    if (finding.subject.kind === "source")
+      lines.push(`- Source: ${markdownLiteral(finding.subject.repository)} at ${markdownLiteral(finding.subject.revision)}; path: ${markdownLiteral(finding.subject.path)}`);
+    if (finding.change)
+      lines.push(`- Change: ${markdownLiteral(finding.change.baseRevision)} → ${markdownLiteral(finding.change.headRevision)}`);
+    if (finding.found_via)
+      lines.push(`- Discovery: ${markdownLiteral(finding.found_via.map((entry) => `${finding.evidence.toolCalls.find((call) => call.callId === entry.callId).tool}: ${entry.technique}`).join(", "))}; public rule/template hit: ${finding.public_template_hit === null ? "unknown" : finding.public_template_hit ? "yes" : "not recorded"}`);
+    for (const call of finding.evidence.toolCalls)
+      lines.push(`- Evidence: ${markdownLiteral(call.callId)} / ${markdownLiteral(call.tool)} / ${markdownLiteral(call.artifactRef)}`);
+    if (finding.verification.artifactRef)
+      lines.push(`- Verification artifact: ${markdownLiteral(finding.verification.artifactRef)}`);
+    if (finding.verification.receipt) {
+      const receipt = finding.verification.receipt;
+      lines.push(`- Authority: ${receipt.authority.kind} / ${markdownLiteral(receipt.authority.id)}`, `- Policy: ${markdownLiteral(receipt.policy.id)} / ${markdownLiteral(receipt.policy.revision)}`);
+    }
+    lines.push("");
+  }
+  if (report.patchRecommendations?.length) {
+    lines.push("", "## Recommended patches", "", "Proposals only. Passing repository tests does not independently prove a repair.", "");
+    for (const patch of report.patchRecommendations) {
+      lines.push(`### ${markdownLiteral(patch.findingId ?? patch.proposalId)}`, "", `- Revision: ${markdownLiteral(patch.revision)}`, `- Validation: ${patch.validation}; applicability: ${patch.applicability}`, `- Proposal evidence: ${markdownLiteral(patch.artifactRef)}`, "");
+      if (patch.unifiedDiff !== undefined) {
+        const fence = "`".repeat(Math.max(3, ...[...patch.unifiedDiff.matchAll(/`+/g)].map((match) => match[0].length + 1)));
+        lines.push(`${fence}diff`, ...patch.unifiedDiff.split(`
+`).map((line) => line.replace(controlCharacters, escapedCharacter)), fence, "");
+      }
+    }
+  }
+  lines.push("## Committed observations", "");
+  for (const call of report.observations)
+    lines.push(`- ${markdownLiteral(call.callId)} / ${markdownLiteral(call.tool)} / ${markdownLiteral(call.artifactRef)}`);
+  lines.push("", "## Checked evidence manifest", "");
+  for (const artifact of report.evidence)
+    lines.push(`- ${markdownLiteral(artifact.artifactRef)} (${artifact.byteLength} bytes)`);
+  return `${lines.join(`
+`)}
+`;
+}
+function sourceUri(path) {
+  if (!path || /[\\:\p{Cc}\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff]/u.test(path) || path.split("/").some((part) => !part || part === "." || part === ".."))
+    return;
+  return path.split("/").map(encodeURIComponent).join("/");
+}
+function sarif(report) {
+  const results = [];
+  const omitted = [];
+  for (const finding of report.findings) {
+    const discovery = finding.found_via ? {
+      found_via: finding.found_via,
+      public_template_hit: finding.public_template_hit
+    } : {};
+    const uri = finding.subject.kind === "source" ? sourceUri(finding.subject.path) : undefined;
+    if (finding.status !== "confirmed" || !uri) {
+      omitted.push({
+        findingId: finding.id,
+        ...discovery,
+        reason: finding.status !== "confirmed" ? "not_confirmed" : "unsupported_location"
+      });
+      continue;
+    }
+    results.push({
+      ruleId: `mettle/${finding.claim}`,
+      level: finding.severity === "low" ? "note" : finding.severity === "medium" ? "warning" : "error",
+      message: { text: `${finding.title}
+${finding.evidence.detail}` },
+      locations: [{ physicalLocation: { artifactLocation: { uri } } }],
+      properties: {
+        findingId: finding.id,
+        severity: finding.severity,
+        claim: finding.claim,
+        ...finding.cwe ? { cwe: finding.cwe } : {},
+        subject: finding.subject,
+        ...finding.change ? { change: finding.change } : {},
+        evidence: finding.evidence.toolCalls,
+        ...discovery,
+        verification: finding.verification
+      }
+    });
+  }
+  return json({
+    $schema: "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: { driver: { name: "Mettle Harness", version: "0.1.0" } },
+        invocations: [
+          {
+            executionSuccessful: report.scope === "assessment" && report.terminal.outcome === "completed" && report.terminal.cleanupOk && report.pendingApprovals.length === 0 && report.pendingReviews.length === 0 && !report.findings.some((finding) => finding.status === "candidate") && !omitted.some((entry) => entry.reason === "unsupported_location")
+          }
+        ],
+        results,
+        properties: {
+          runId: report.runId,
+          committedSequence: report.seq,
+          generatedAt: report.generatedAt,
+          scope: report.scope,
+          target: report.target,
+          terminal: report.terminal,
+          notice,
+          ...report.coverage ? { coverage: report.coverage } : {},
+          omittedFindings: omitted,
+          evidence: report.evidence,
+          ...report.patchRecommendations ? { patchRecommendations: report.patchRecommendations } : {}
+        }
+      }
+    ]
+  });
+}
+function representable(build) {
+  try {
+    return build();
+  } catch (error) {
+    if (error instanceof HarnessError)
+      throw error;
+    throw new HarnessError("report_not_representable", "The run cannot be represented as a bounded report.");
+  }
+}
+async function exportRunReport(snapshot, observations, context, format, protocol) {
+  ReportFormatSchema.parse(format);
+  const encoded = canonicalJson({ snapshot, observations });
+  if (Buffer.byteLength(encoded, "utf8") > 1048576)
+    throw new HarnessError("report_too_large", "Report input exceeds its size limit.");
+  const captured = JSON.parse(encoded);
+  const event = EventSchema.parse(captured.snapshot);
+  if (event.type !== "run.snapshot" || !event.terminal)
+    throw new HarnessError("report_not_ready", "A committed terminal snapshot is required.");
+  if (event.runId !== context.runId)
+    throw new HarnessError("report_denied", "The report belongs to another run.");
+  const { type: _type, ...state } = event;
+  let report = representable(() => ReportSchema.parse({
+    ...state,
+    ...context.consumption ? { consumption: context.consumption } : {},
+    scope: context.scope,
+    ...context.coverage ? { coverage: context.coverage } : {},
+    reportVersion: "1.0.0",
+    generatedAt: context.now.toISOString(),
+    observations: captured.observations,
+    evidence: []
+  }));
+  if (report.scope === "development-fixture" && report.findings.length)
+    throw new HarnessError("report_denied", "Development fixtures cannot export assessment findings.");
+  for (const finding of report.findings) {
+    if (finding.status === "candidate")
+      continue;
+    const receipt = finding.verification.receipt;
+    if (receipt.authority.kind === "human") {
+      const verification = finding.verification;
+      if (verification.method !== "human_review" || !verification.review || verification.review.reviewer !== receipt.authority.id || receipt.policy.id !== "human-review" || !AdmittedFindingSchema.safeParse(finding).success || !checkedBefore(receipt, context.now) || receipt.expiresAt !== undefined)
+        throw new HarnessError("verification_denied", "The human verdict must name its reviewer and a current human-review receipt.");
+      const grounded = await groundEvidence(finding.evidence.toolCalls, [verification.artifactRef], context);
+      if (grounded.get(verification.artifactRef).bytes !== humanReviewArtifact(verification.review, receipt))
+        throw new HarnessError("verification_denied", "The human review artifact does not bind the recorded decision.");
+      continue;
+    }
+    const policies = context.verificationPolicies.filter((entry) => entry.authority.kind === receipt.authority.kind && entry.authority.id === receipt.authority.id && entry.policy.id === receipt.policy.id && entry.policy.revision === receipt.policy.revision);
+    if (policies.length !== 1)
+      throw new HarnessError("verification_denied", "Report verification authority is not configured uniquely.");
+    try {
+      await admitIndependentVerification({
+        ...finding,
+        status: "candidate",
+        verification: { result: "pending" }
+      }, finding.verification, {
+        ...context,
+        ...policies[0],
+        capabilities: report.capabilities,
+        now: context.verifiedAt ?? context.now
+      });
+    } catch (error) {
+      if (error instanceof HarnessError)
+        throw error;
+      throw new HarnessError("verification_denied", "Independent verification could not be admitted for a finding.");
+    }
+  }
+  const calls = new Map(report.observations.map((call) => [call.callId, call]));
+  if (calls.size !== report.observations.length)
+    throw new HarnessError("evidence_integrity", "Duplicate report observations are not accepted.");
+  for (const finding of report.findings) {
+    for (const call of finding.evidence.toolCalls) {
+      const observation = calls.get(call.callId);
+      if (!observation || canonicalJson(observation) !== canonicalJson(call))
+        throw new HarnessError("evidence_integrity", "A finding references an unrecorded observation.");
+    }
+  }
+  const artifacts = await groundEvidence(report.observations, report.findings.flatMap((finding) => finding.verification.artifactRef ? [finding.verification.artifactRef] : []), context);
+  report.evidence = [...artifacts].map(([artifactRef, { byteLength }]) => ({
+    artifactRef,
+    byteLength
+  }));
+  report = representable(() => {
+    const patches = reportPatches(report.observations, report.findings, artifacts);
+    return patches.length ? ReportSchema.parse({
+      ...report,
+      reportVersion: "1.1.0",
+      patchRecommendations: patches
+    }) : report;
+  });
+  const rendered = protocol ? protocol.report(report) : report;
+  const body = format === "json" ? json(rendered) : format === "markdown" ? markdown(rendered) : sarif(rendered);
+  if (Buffer.byteLength(body, "utf8") > 8388608)
+    throw new HarnessError("report_too_large", "Report output exceeds its size limit.");
+  return {
+    body,
+    mediaType: format === "markdown" ? "text/markdown; charset=utf-8" : format === "sarif" ? "application/sarif+json" : "application/json",
+    extension: format === "markdown" ? "md" : format === "sarif" ? "sarif" : "json"
+  };
+}
+// packages/foundation/src/target.ts
+var OWNER = "([a-zA-Z0-9][a-zA-Z0-9-]*)";
+var NAME = "([a-zA-Z0-9_.-]+?)";
+var REPOSITORY = [
+  new RegExp(`^https://github\\.com/${OWNER}/${NAME}(?:\\.git)?/?$`),
+  new RegExp(`^git@github\\.com:${OWNER}/${NAME}(?:\\.git)?$`),
+  new RegExp(`^ssh://git@github\\.com/${OWNER}/${NAME}(?:\\.git)?/?$`)
+];
+var PULL = new RegExp(`^https://github\\.com/${OWNER}/${NAME}/pull/([1-9][0-9]*)(?:/(?:files|changes|commits|checks))?/?(?:[?#].*)?$`);
+var GIT_HOSTS = ["gitlab.com", "bitbucket.org", "codeberg.org"];
+var SCP = /^[^\s/@:]+@([^\s/:]+):/;
+var SCHEME = /^([a-z][a-z0-9+.-]*):\/\//i;
+var LOCAL = /^\/[^\p{Cc}]*$/u;
+var ROUTE_CAPABILITIES = {
+  repository: ["code"],
+  pull_request: ["pull_requests", "code"],
+  web: ["agentic_pentesting"],
+  local: ["code"]
+};
+var ambiguous = () => new HarnessError("target_ambiguous", "The target is ambiguous. Use https://github.com/<owner>/<repo>, https://github.com/<owner>/<repo>/pull/<number>, git@github.com:<owner>/<repo>.git or a credential-free http(s) site URL; no request was sent.");
+var unsupported = (message) => new HarnessError("target_unsupported", `${message} No request was sent.`);
+function sourceRoute(repository, pullRequestId) {
+  return pullRequestId === undefined ? {
+    kind: "repository",
+    targetKind: "repo",
+    target: `https://github.com/${repository}`,
+    repository,
+    capabilities: ROUTE_CAPABILITIES.repository
+  } : {
+    kind: "pull_request",
+    targetKind: "repo",
+    target: `https://github.com/${repository}/pull/${pullRequestId}`,
+    repository,
+    pullRequestId,
+    capabilities: ROUTE_CAPABILITIES.pull_request
+  };
+}
+function github(target) {
+  const pull = PULL.exec(target);
+  const match = pull ?? REPOSITORY.map((pattern) => pattern.exec(target)).find(Boolean);
+  if (!match)
+    return;
+  const [, owner, name, id] = match;
+  if (name === "." || name === ".." || pull && name.endsWith(".git"))
+    return;
+  return sourceRoute(`${owner}/${name}`, id);
+}
+function local(target) {
+  if (!LOCAL.test(target))
+    return;
+  if (target.split("/").slice(1).some((segment) => segment === "" || segment === "." || segment === ".."))
+    return;
+  return {
+    kind: "local",
+    targetKind: "repo",
+    target,
+    capabilities: ROUTE_CAPABILITIES.local
+  };
+}
+function targetLabel(target) {
+  try {
+    const route = routeTarget(target);
+    if (route.kind === "pull_request")
+      return `PR #${route.pullRequestId} in ${route.repository}`;
+    if (route.kind === "repository")
+      return route.repository;
+    return new URL(target).host;
+  } catch {
+    return target.slice(0, MAX_LABEL);
+  }
+}
+function routeTarget(target) {
+  if (!target || target.length > 2048)
+    throw ambiguous();
+  if (target.startsWith("/")) {
+    const route = local(target);
+    if (!route)
+      throw ambiguous();
+    return route;
+  }
+  if (/[^!-~]/.test(target))
+    throw ambiguous();
+  const scheme = SCHEME.exec(target)?.[1]?.toLowerCase();
+  const url = scheme ? URL.parse(target) : undefined;
+  if (url === null)
+    throw ambiguous();
+  const host = (url ? url.hostname : SCP.exec(target)?.[1])?.toLowerCase().replace(/\.+$/, "");
+  if (host === undefined)
+    throw ambiguous();
+  if (host === "github.com" || host.endsWith(".github.com")) {
+    const route = github(target);
+    if (!route)
+      throw ambiguous();
+    return route;
+  }
+  if (!url || GIT_HOSTS.some((name) => host === name || host === `www.${name}`) || scheme !== "http" && scheme !== "https")
+    throw unsupported(scheme && !["http", "https", "ssh", "git", "git+ssh"].includes(scheme) ? "Use an https GitHub repository or pull request, or an http(s) site." : "Only GitHub repositories and pull requests are supported.");
+  if (url.username || url.password || url.search || url.hash)
+    throw unsupported("A site target must not carry credentials, a query or a fragment.");
+  return {
+    kind: "web",
+    targetKind: "web",
+    target: url.href,
+    capabilities: ROUTE_CAPABILITIES.web
+  };
+}
+// packages/foundation/src/verification.ts
+function validateVerificationRequest(input, executionPathBytes) {
+  if (!input || typeof input !== "object" || !("seamVersion" in input) || input.seamVersion !== SEAM_VERSION.oracle) {
+    throw new HarnessError("version_mismatch", "Expected the supported Oracle seam version.");
+  }
+  const request = VerifyRequestSchema.parse(input);
+  AdmittedFindingSchema.parse(request.candidate);
+  if (["vulnerability", "dependency_exploitability"].includes(request.candidate.claim) && !request.candidate.poc)
+    throw new HarnessError("invalid_request", "Runtime verification requires redacted replay instructions before dispatch.");
+  if (request.identity.candidateRevision !== candidateRevision(request.candidate) || request.identity.pocInputsDigest !== digest(request.pocInputs) || request.identity.executionPathDigest !== sha256(executionPathBytes)) {
+    throw new HarnessError("identity_mismatch", "Verification input differs from its captured identity.");
+  }
+  return request;
+}
+function validateOracleVerdict(request, input) {
+  VerifyRequestSchema.parse(request);
+  const parsed = VerifyVerdictSchema.safeParse(input);
+  if (!parsed.success)
+    throw new HarnessError("identity_mismatch", "Oracle receipt does not bind the verified candidate and predicate.");
+  const verdict = parsed.data;
+  if (canonicalJson(verdict.identity) !== canonicalJson(request.identity))
+    throw new HarnessError("identity_mismatch", "Oracle returned a different verification identity.");
+  if (verdict.result !== "needs_human") {
+    const admitted = AdmittedFindingSchema.safeParse({
+      ...request.candidate,
+      status: verdict.result === "pass" ? "confirmed" : "discarded",
+      verification: {
+        result: verdict.result,
+        method: verdict.method,
+        artifactRef: verdict.artifactRef,
+        receipt: verdict.receipt
+      }
+    });
+    if (!admitted.success)
+      throw new HarnessError("identity_mismatch", "Oracle receipt does not bind the verified candidate and evidence.");
+  }
+  return verdict;
+}
+export { CONTRACT_VERSION, SEAM_VERSION, PositiveIntegerSchema, ProductCapabilitySchema, ChangeContextSchema, ContractContextSchema, RunConfigSchema, CapsSchema, TerminalSchema, MAX_LABEL, MAX_PREVIEW_LINES, MAX_PREVIEW_LINE, ImageRefSchema, ImageRefsSchema, AgentControlSchema, MOST_IMAGE_BYTES, ModelCatalogSchema, MAX_RUN_PAGE, RunPageSchema, EngineIdentitySchema, DISCOVERY_RULE_IDS_MAX, FindingSchema, InvestigationStageSchema, EventSchema, EVIDENCE_MAX_BYTES, INLINE_EVIDENCE_STORE_ID, ArtifactRefSchema, ArtifactManifestSchema, EvidenceEnvelopeSchema, EvidenceSigningKeySchema, TargetIdentitySchema, VerifyRequestSchema, OracleErrorSchema, RangeEligibilitySchema, WorkflowBindingSchema, WebsiteEngagementSchema, InvestigationUrlSchema, InvestigationPrepareSchema, WorkflowRevisionSchema, WorkflowSaveSchema, WorkflowPrepareSchema, PreparationViewSchema, InvestigationStartSchema, InvestigationRunIdSchema, InvestigationModelSchema, InvestigationCapabilitiesSchema, InvestigationLaunchResultSchema, InvestigationProgressSchema, tuiProtocol, JsonObjectSchema, ModelContinuationSchema, ModelUsageSchema, ModelMessageSchema, ModelRequestSchema, ModelResponseSchema, ModelStreamEventSchema, PatchProposalSchema, TestRunResultSchema, PROVIDER_KEYS, FOUNDRY_ENDPOINT, FOUNDRY_MODELS, FOUNDRY_LIMITS, foundryLimits, foundryEndpoint, foundryDeployments, isLoopback, providerFixture, ReportFormatSchema, HarnessError, publicError, canonicalJson, sha256, digest, digestUuid, evidenceKeyId, evidenceStatement, signEvidence, verifyEvidence, readBoundedJson, CAPTURE_POLICY, captureResponseText, captureEvidence, groundEvidence, FIXTURE_TARGET, COORDINATOR_TARGET, FIXTURE_MODEL, RUNTIME_VERSION, FIXTURE_CONTEXT_TOKENS, FixtureEventSchema, validateVersion, validateRunConfig, validateFixtureRun, fixtureConfig, candidateRevision, subjectDigest, AdmittedFindingSchema, admitIndependentVerification, humanReviewArtifact, exportRunReport, ROUTE_CAPABILITIES, sourceRoute, targetLabel, routeTarget, validateVerificationRequest, validateOracleVerdict };