@mnstry/atelier 0.2.0-alpha.12 → 0.2.0-alpha.13

package/src/inquiry/projection.mjs

@@ -0,0 +1,77 @@
+import { assertDocument } from '../capabilities/package.mjs'
+import { inquiryDigest, inquiryRef } from './contracts.mjs'
+import { inspectInquiry } from './ledger.mjs'
+import { restrictiveAudience } from '../harnesses/contracts.mjs'
+
+// Files are proposed source edits. No graph source, relation, or review status
+// is written by this function. The receiver owns disclosure and promotion.
+export function inquiryGraphProposal(records, { namespace }) {
+  if (!/^[a-z][a-z0-9-]{0,63}$/.test(namespace)) throw new Error('invalid inquiry graph namespace')
+  const state = inspectInquiry(records), stale = new Set(state.reconsider.map(r => r.id))
+  const byId = new Map(records.map(r => [r.id, r])), files = new Map(), claims = []
+  const node = r => `${namespace}:inquiry-${state.campaign.id}-${r.id}`
+  const literal = value => {
+    const text = typeof value === 'string' ? value : JSON.stringify(value, null, 2)
+    const fence = '`'.repeat(Math.max(3, ...[...text.matchAll(/`+/g)].map(m => m[0].length + 1)))
+    return `${fence}text\n${text}\n${fence}`
+  }
+  // A file carries the most restrictive audience of the campaign and of every
+  // source whose material it copies; a sensitive quote is never labelled private.
+  const fileAudience = new Map()
+  function add(record, body, audience = state.campaign.data.audience) {
+    const id = node(record)
+    if (files.has(id)) return
+    fileAudience.set(`${record.id}.md`, audience)
+    files.set(id, { path: `${record.id}.md`, content: [
+      '---', `title: ${JSON.stringify(`Inquiry ${record.kind}: ${record.id}`)}`, 'kg:', `  id: ${JSON.stringify(id)}`, '  type: "document"',
+      '  status: "draft"', `  audience: ${JSON.stringify(audience)}`, '  relations: {}', '---', '',
+      `# Inquiry ${record.kind}: ${record.id}`, '', `Record digest: ${inquiryDigest(record)}`, '',
+      'Proposed source. Review and admission belong to the receiving repository. Caller-reported evidence is not authenticated.', '', literal(body), '',
+    ].join('\n') })
+  }
+  function edge(subject, predicate, object) {
+    const claim = { schema: 'atelier-claim@v1', claimId: `claim:inquiry-${inquiryDigest([node(subject), predicate, node(object)]).slice(7)}`, subject: node(subject), predicate, object: node(object), provider: 'script', status: 'proposed', promoted: false, evidence: [inquiryDigest(subject), inquiryDigest(object)] }
+    if (!claims.some(c => c.claimId === claim.claimId)) claims.push(claim)
+  }
+  for (const decision of records.filter(r => r.kind === 'decision' && r.data.disposition === 'accepted' && !stale.has(r.id))) {
+    const assessment = byId.get(decision.data.assessment.id), hypothesis = byId.get(assessment.data.hypothesis.id)
+    // The assessment copies each cited bundle's conflicts, gaps and questions,
+    // so its label covers every source that bundle reports or asserts from.
+    const quoted = assessment.data.evidence.flatMap(item => {
+      const bundle = byId.get(item.bundle.id)
+      return [...bundle.data.reports.map(ref => ref.id), ...bundle.data.assertions.map(a => a.source.id)].map(id => byId.get(id).data.audience)
+    })
+    const audience = restrictiveAudience(state.campaign.data.audience, ...quoted)
+    add(decision, { conclusion: decision.data.conclusion, reason: decision.data.reason, reviewerReport: { by: decision.by, at: decision.at, basis: decision.data.reviewBasis }, nextQuestions: decision.data.nextQuestions }, audience)
+    add(assessment, { model: assessment.data.model, result: state.assessments[assessment.id], rationale: assessment.data.rationale,
+      evidence: assessment.data.evidence.map(item => {
+        const bundle = byId.get(item.bundle.id)
+        return { bundle: item.bundle, request: bundle.data.request, provider: bundle.data.provider,
+          assertion: bundle.data.assertions.find(a => a.id === item.assertion), conflicts: bundle.data.conflicts, gaps: bundle.data.gaps, newQuestions: bundle.data.newQuestions }
+      }) }, audience)
+    add(hypothesis, hypothesis.data)
+    edge(decision, 'depends_on', assessment); edge(assessment, 'related', hypothesis)
+    for (const item of assessment.data.evidence) {
+      const bundle = byId.get(item.bundle.id), assertion = bundle.data.assertions.find(a => a.id === item.assertion), source = byId.get(assertion.source.id)
+      // Preserve selected statements, provenance and conflicts, without copying
+      // raw captures or unrelated assertions into accepted knowledge proposals.
+      add(source, { locator: source.data.locator, digest: source.data.digest, family: source.data.family, scope: source.data.scope, method: source.data.method }, restrictiveAudience(state.campaign.data.audience, source.data.audience))
+      edge(source, 'evidences', assessment)
+      edge(source, assertion.stance === 'neutral' ? 'related' : assertion.stance, hypothesis)
+    }
+  }
+  return { schema: 'atelier-inquiry-graph-proposal@v1', campaign: state.campaign?.id ?? null, historyDigest: state.head, audience: state.campaign ? restrictiveAudience(state.campaign.data.audience, ...[...files.values()].map(file => fileAudience.get(file.path))) : null, files: [...files.values()], claims, reconsider: state.reconsider, canonicalMutation: false, authority: 'none' }
+}
+
+export function inquiryStewardObservation(records, feedbackId) {
+  inspectInquiry(records)
+  const feedback = records.find(r => r.id === feedbackId && r.kind === 'feedback')
+  if (!feedback) throw new Error('inquiry feedback missing')
+  const request = records.find(r => r.id === feedback.data.request.id), binding = request.data.binding
+  if (!binding) throw new Error('request has no capability binding provenance')
+  const reportedCause = feedback.data.cause
+  const cause = ['context', 'provider'].includes(reportedCause) ? 'unknown' : reportedCause
+  const event = { schema: 'mnstry.atelier-capability-event@v1', id: feedback.id, kind: 'feedback', ...binding, observer: feedback.by, outcome: feedback.data.outcome, cause, evidenceDigest: feedback.data.evidenceDigest, at: feedback.at }
+  assertDocument(event, 'event')
+  return { event, inquiryRecord: inquiryRef(feedback), reportedCause, causeMapping: cause === reportedCause ? 'exact' : 'unsupported-steward-cause-preserved-in-inquiry', assurance: 'caller-reported; current binding must be checked by capability observe', recorded: false }
+}

package/src/inquiry/store.mjs

@@ -0,0 +1,35 @@
+import { jsonAt, stat, within, workspaceRoot, replaceJson } from '../capabilities/files.mjs'
+import { withOperationLock } from '../capabilities/adoption.mjs'
+import { assertInquiry, inquiryDigest, INQUIRY_LIMITS } from './contracts.mjs'
+import { EMPTY_INQUIRY_HEAD, inspectInquiry } from './ledger.mjs'
+
+function location(id) {
+  if (typeof id !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(id)) throw new Error('invalid campaign identity')
+  return `.atelier-local/inquiry/${id}/ledger.json`
+}
+function read(root, campaign) {
+  const file = location(campaign)
+  if (!stat(within(root, file))) return { records: [], head: EMPTY_INQUIRY_HEAD }
+  const ledger = assertInquiry(jsonAt(root, file), 'ledger')
+  const state = inspectInquiry(ledger.records)
+  if (state.head !== ledger.head || state.campaign.id !== campaign) throw new Error('inquiry ledger integrity mismatch')
+  return state
+}
+export function readInquiry({ workspaceRoot: input, campaign }) {
+  return inspectInquiry(read(workspaceRoot(input), campaign).records)
+}
+export function appendInquiry({ workspaceRoot: input, record, confirm }) {
+  assertInquiry(record)
+  const root = workspaceRoot(input, { write: true })
+  return withOperationLock(root, () => {
+    const before = read(root, record.campaign)
+    if (before.head !== confirm) throw new Error('inquiry append requires the current history digest')
+    const next = inspectInquiry([...before.records, record])
+    // A single atomic replacement retains the entire immutable record history.
+    // The shared lock serializes cooperating writers; it is not an OS sandbox.
+    const ledger = { schema: 'atelier-inquiry-ledger@v1', records: next.records, head: inquiryDigest(next.records) }
+    if (Buffer.byteLength(JSON.stringify(ledger, null, 2)) + 1 > INQUIRY_LIMITS.bytes) throw new Error('serialized inquiry ledger exceeds byte ceiling')
+    replaceJson(root, location(record.campaign), ledger)
+    return { recorded: record.id, head: next.head, assessment: next.assessments[record.id] ?? null, reconsider: next.reconsider, authority: 'none' }
+  })
+}

package/src/intake/read-scope.mjs

@@ -0,0 +1,12 @@
+// Internal coordinator capability, intentionally absent from the package's
+// public exports. Only synchronous, library-owned read loops enter a scope;
+// caller callbacks and mutations must not inherit placement admission.
+const scopes = new WeakMap();
+
+export function registerIntakeReadScope(store, run) { scopes.set(store, run); }
+
+export function withIntakeReadScope(store, read) {
+  const run = scopes.get(store);
+  if (!run) throw new Error('intake read scope is unavailable');
+  return run(read);
+}

package/src/intake/store.mjs

@@ -1,4 +1,4 @@
-import { withPrivateLock, publishPrivateFile } from '../project/durable-state.mjs';
+import { withPrivateLock, publishPrivateFile, isPendingPrivateWrite } from '../project/durable-state.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
@@ -6,6 +6,7 @@ import { execFileSync } from 'node:child_process';
 import { canonicalize } from '../attestation/jcs.mjs';
 import { validateJsonSchema } from '../export/atelier-export-contract.mjs';
 import { ensureContainedPrivateDirectory, openRegularFileNoFollow } from '../project/private-state.mjs';
+import { registerIntakeReadScope } from './read-scope.mjs';
 
 export const INTAKE_MAX_BYTES = 16 * 1024 * 1024;
 const schema = JSON.parse(fs.readFileSync(new URL('../../contracts/atelier-intake.v1.schema.json', import.meta.url), 'utf8'));
@@ -34,21 +35,44 @@ function immutable(file, bytes) {
 // authority. Callers retain their source trees and choose their existing extractor.
 export function createIntakeStore({ workspaceRoot = process.cwd() } = {}) {
   const root = fs.realpathSync(workspaceRoot);
-  function placement() {
+  let readScopeActive = false, placementChecked = false;
+  function placement(force = false) {
+    if (readScopeActive && placementChecked && !force) return;
     const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith('GIT_')));
     try {
       if (execFileSync('git', ['-C', root, 'ls-files', '-z', '--', '.atelier-local'], { env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })) throw new Error('tracked state');
       execFileSync('git', ['-C', root, 'check-ignore', '--quiet', '.atelier-local/'], { env, stdio: 'ignore' });
     } catch { throw new Error('intake requires ignored, untracked .atelier-local/ in a Git workspace'); }
+    placementChecked = readScopeActive;
   }
   placement();
+  function readScope(read) {
+    const active = readScopeActive;
+    readScopeActive = true; placementChecked = false;
+    try {
+      placement();
+      const result = read();
+      // Result inspection must not pass admission to a thenable's accessor,
+      // and asynchronous work must obtain fresh admission after it resumes.
+      readScopeActive = false; placementChecked = false;
+      if (typeof result?.then === 'function') throw new Error('intake read scope requires a synchronous result');
+      // No result escapes if placement changed during the read-only operation.
+      placement(true);
+      return result;
+    } finally { readScopeActive = active; placementChecked = false; }
+  }
   function directory(...parts) {
     return ensureContainedPrivateDirectory({ workspaceRoot: root, directory: path.join(root, '.atelier-local', 'intake', ...parts), label: 'intake state' });
   }
   function locked(fn) {
-    placement();
-    const file = path.join(directory(), 'operation.lock');
-    return withPrivateLock(file, fn);
+    // A mutation cannot inherit or leave behind read-scope admission.
+    const active = readScopeActive;
+    readScopeActive = false; placementChecked = false;
+    try {
+      placement();
+      const file = path.join(directory(), 'operation.lock');
+      return withPrivateLock(file, fn);
+    } finally { readScopeActive = active; placementChecked = false; }
   }
   function sourceFile(ref) {
     if (typeof ref !== 'string' || !ref || path.isAbsolute(ref) || ref.includes('\\') ||
@@ -66,7 +90,44 @@ export function createIntakeStore({ workspaceRoot = process.cwd() } = {}) {
     return bytes;
   }
   function record(dir, name, value) { valid(value); immutable(path.join(dir, name), canonicalize(value) + '\n'); return value; }
-  return Object.freeze({
+  const store = Object.freeze({
+    // Explicit current-source reads stay behind intake's containment and byte
+    // checks. They do not enroll a source or interpret its contents.
+    readSource({ ref, expectedDigest } = {}) {
+      placement();
+      if (expectedDigest !== undefined) digest(expectedDigest);
+      const bytes = read(sourceFile(ref)), actual = intakeDigest(bytes);
+      if (expectedDigest !== undefined && actual !== expectedDigest) throw Object.assign(new Error('current source digest differs'), { code: 'INTAKE_SOURCE_CHANGED' });
+      return { ref, digest: actual, bytes };
+    },
+    // A missing directory is a cache miss. A broken committed attempt is an
+    // integrity failure, never permission to overwrite or retry it silently.
+    readAttempt(attemptId) {
+      placement(); id(attemptId);
+      const dir = path.join(directory('attempts'), attemptId);
+      try { fs.lstatSync(dir); }
+      catch (error) { if (error.code === 'ENOENT') return { status: 'absent', attempt: null, completion: null, output: null }; throw error; }
+      directory('attempts', attemptId);
+      try {
+        const names = fs.readdirSync(dir).filter(name => !isPendingPrivateWrite(name));
+        if (names.some(name => !['attempt.json', 'completion.json', 'output.txt'].includes(name))) throw new Error('unknown attempt file');
+        if (!names.includes('attempt.json')) {
+          if (names.length) throw new Error('orphaned attempt bytes');
+          return { status: 'absent', attempt: null, completion: null, output: null };
+        }
+        const attemptBytes = read(path.join(dir, 'attempt.json')), attempt = valid(JSON.parse(attemptBytes));
+        if (attempt.schema !== 'mnstry.atelier-intake-attempt@v1' || attempt.attemptId !== attemptId) throw new Error('attempt identity differs');
+        blob(attempt.blobId);
+        const outputBytes = names.includes('output.txt') ? read(path.join(dir, 'output.txt')) : null;
+        const output = outputBytes === null ? null : new TextDecoder('utf-8', { fatal: true }).decode(outputBytes);
+        if (!names.includes('completion.json')) return { status: output === null ? 'begun' : 'partial', attempt, completion: null, output };
+        const completion = valid(JSON.parse(read(path.join(dir, 'completion.json'))));
+        if (completion.schema !== 'mnstry.atelier-intake-completion@v1' || completion.attemptId !== attemptId ||
+          completion.integrity !== 'verified' || completion.semanticAcceptance !== 'pending' || outputBytes === null ||
+          completion.attemptDigest !== intakeDigest(attemptBytes) || completion.outputDigest !== intakeDigest(outputBytes) || completion.bytes !== outputBytes.length) throw new Error('completion integrity differs');
+        return { status: 'complete', attempt, completion, output };
+      } catch { throw Object.assign(new Error('intake attempt integrity refused'), { code: 'INTAKE_INTEGRITY' }); }
+    },
     ingest({ ref, expectedDigest }) {
       return locked(() => {
         digest(expectedDigest);
@@ -116,4 +177,6 @@ export function createIntakeStore({ workspaceRoot = process.cwd() } = {}) {
       return receipt;
     },
   });
+  registerIntakeReadScope(store, readScope);
+  return store;
 }

package/src/interaction/index.mjs

@@ -0,0 +1,91 @@
+import { assertInteraction, qualifyReflection, reflectionReference, validateInteraction } from '../reflection/index.mjs'
+import { boundedLearningValue, learningDigest as digest } from '../learning/contracts.mjs'
+export { validateInteraction }
+
+// Host contexts contain current source records, not just self-reported hashes.
+// Intention/preference owners provide exact revision pins after their own checks.
+export function selectInteractionAct({ act, policy, context, state, at }) {
+  assertInteraction(act, 'act'); assertInteraction(policy, 'policy')
+  boundedLearningValue(context); boundedLearningValue(state)
+  if (!Number.isFinite(Date.parse(at))) throw new Error('selection time required')
+  const reasons = [], scope = policy.scope, purpose = policy.purpose
+  if (act.scope !== scope || act.purpose !== purpose) reasons.push('scope-or-purpose-differs')
+  if (Date.parse(act.expiresAt) <= Date.parse(at)) reasons.push('expired')
+  // Reflective and coaching acts are Reflection whatever their origin; only
+  // ordinary Companion and work acts function with Reflection off.
+  const reflective = act.origin === 'witness' || act.mode !== 'ordinary'
+  if (act.origin === 'witness' && act.mode === 'ordinary') reasons.push('reflective-mode-required')
+  if (reflective && !policy.reflectionEnabled) reasons.push('reflection-disabled')
+  if (act.mode === 'coaching' && (!policy.coachingEnabled || !act.dependencies.some(p => p.kind === 'intention'))) reasons.push('coaching-unavailable')
+  if (act.kind === 'challenge' && !policy.challengeEnabled) reasons.push('challenge-disabled')
+  if (reflective && !act.dependencies.some(p => p.kind === 'assessment')) reasons.push('reflective-assessment-missing')
+  if (reflective && policy.initiative === 'responsive' && state.requestedReflection !== true) reasons.push('reflection-not-requested')
+  if (!context || Object.keys(context).sort().join() !== 'assessments,observations,orientations' || !Array.isArray(context.observations) || !Array.isArray(context.assessments) || !Array.isArray(context.orientations) || context.observations.length > 128 || context.assessments.length > 64 || context.orientations.length > 64) throw new Error('bounded current interaction context required')
+  const refs = []
+  for (const observation of context.observations) {
+    assertInteraction(observation, 'observation')
+    if (observation.scope === scope && observation.purpose === purpose && observation.status === 'active') refs.push(reflectionReference(observation))
+  }
+  for (const assessment of context.assessments) if (qualifyReflection({ assessment, observations: context.observations, scope, purpose }).current) refs.push(reflectionReference(assessment))
+  for (const orientation of context.orientations) {
+    if (!orientation || Object.keys(orientation).sort().join() !== 'active,digest,id,kind,purpose,scope' || !['intention', 'preference'].includes(orientation.kind) || typeof orientation.id !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(orientation.id) || !/^sha256:[a-f0-9]{64}$/.test(orientation.digest) || typeof orientation.active !== 'boolean') throw new Error('invalid orientation reference')
+    if (orientation.active && orientation.scope === scope && orientation.purpose === purpose) refs.push({ kind: orientation.kind, id: orientation.id, digest: orientation.digest })
+  }
+  if (new Set(refs.map(r => `${r.kind}:${r.id}`)).size !== refs.length) throw new Error('ambiguous current context identity')
+  for (const pin of act.dependencies) if (!refs.some(r => digest(r) === digest(pin))) reasons.push(`dependency-not-current:${pin.kind}:${pin.id}`)
+  const defer = state.paused === true || state.busy === true || state.floor !== 'assistant'
+  return { actDigest: digest(act), policyDigest: digest(policy), contextDigest: digest(context),
+    selection: reasons.length ? 'declined' : defer ? 'deferred' : 'selected', reasons: reasons.length ? reasons : defer ? ['conversation-floor-unavailable'] : [],
+    qualityCriteria: [...policy.qualities], qualityEvaluated: false, executionAuthorized: false }
+}
+
+// One host owns floor, durable reservations and native delivery. This controller
+// composes typed contributions; it never starts a second conversation or monitor.
+export function createInteractionController({ authorityId, host }) {
+  if (typeof authorityId !== 'string' || !authorityId || host?.authorityId !== authorityId || ['current', 'authorize', 'reserve', 'send', 'read', 'interrupt'].some(k => typeof host[k] !== 'function')) throw new Error('one complete conversation authority required')
+  const active = new Map()
+  function checked(receipt, key, act) {
+    if (!receipt || receipt.key !== key || receipt.authorityId !== authorityId || receipt.actDigest !== digest(act) || !['reserved', 'begun', 'completed', 'interrupted', 'failed', 'unknown'].includes(receipt.status) || typeof receipt.deliveredText !== 'string' || !act.text.startsWith(receipt.deliveredText) || (receipt.status === 'completed' && receipt.deliveredText !== act.text)) throw new Error('native delivery readback does not match the intended act')
+    return { ...structuredClone(receipt), understandingVerified: false, improvementVerified: false }
+  }
+  return Object.freeze({
+    async deliver(act) {
+      act = boundedLearningValue(act); assertInteraction(act, 'act')
+      const key = digest({ authorityId, scope: act.scope, id: act.id })
+      if (active.has(key)) throw new Error('delivery already active; inspect or interrupt it')
+      const current = await host.current(), selection = selectInteractionAct({ act, ...current })
+      if (selection.selection !== 'selected') return { selection, delivery: null }
+      if (await host.authorize({ actDigest: digest(act), scope: act.scope, purpose: act.purpose, authorityId }) !== true) throw new Error('host did not authorize this interaction')
+      const reservation = await host.reserve({ key, authorityId, actDigest: digest(act), selection })
+      if (reservation?.created !== true) {
+        // A previous attempt may already have emitted content. Read it instead
+        // of turning uncertainty or a lost reply into duplicate guidance.
+        return { selection, delivery: checked(await host.read(key), key, act), replayed: true }
+      }
+      const controller = new AbortController(); active.set(key, controller)
+      try {
+        const fresh = await host.current(), recheck = selectInteractionAct({ act, ...fresh })
+        if (recheck.selection !== 'selected' || recheck.policyDigest !== selection.policyDigest || recheck.contextDigest !== selection.contextDigest) {
+          await host.interrupt({ key, reason: 'context-changed-before-delivery', authorityId })
+          return { selection: recheck, delivery: checked(await host.read(key), key, act) }
+        }
+        try { await host.send({ key, authorityId, act: structuredClone(act), signal: controller.signal }) }
+        catch { /* Native readback determines failed, interrupted or unknown. */ }
+        return { selection, delivery: checked(await host.read(key), key, act) }
+      } finally { active.delete(key) }
+    },
+    async interrupt(act, reason) {
+      assertInteraction(act, 'act')
+      if (typeof reason !== 'string' || !reason || reason.length > 1024) throw new Error('bounded interruption reason required')
+      const key = digest({ authorityId, scope: act.scope, id: act.id })
+      active.get(key)?.abort()
+      await host.interrupt({ key, reason, authorityId })
+      return checked(await host.read(key), key, act)
+    },
+    async inspect(act) {
+      assertInteraction(act, 'act')
+      const key = digest({ authorityId, scope: act.scope, id: act.id })
+      return checked(await host.read(key), key, act)
+    },
+  })
+}

package/src/judgment/index.mjs

@@ -0,0 +1,82 @@
+import fs from 'node:fs'
+import Ajv from 'ajv/dist/2020.js'
+import { boundedLearningValue, learningDigest } from '../learning/contracts.mjs'
+import { assertAudience, contentDigest, harnessRef } from '../harnesses/contracts.mjs'
+import { inspectKnowledge } from '../knowledge/ledger.mjs'
+import { createHarnessHandoff, verifyHarnessHandoff } from '../harnesses/exchange.mjs'
+
+const schema = JSON.parse(fs.readFileSync(new URL('../../contracts/atelier-judgment.v1.schema.json', import.meta.url)))
+const ajv = new Ajv({ strict: true, allErrors: true }), validators = new Map()
+export function validateJudgment(value, profile = 'case') {
+  try { boundedLearningValue(value) } catch (error) { return [error.message] }
+  if (!['case', 'decision'].includes(profile)) return ['unknown judgment profile']
+  if (!validators.has(profile)) validators.set(profile, ajv.compile({ $schema: schema.$schema, $defs: schema.$defs, $ref: `#/$defs/${profile}` }))
+  const validate = validators.get(profile)
+  if (!validate(value)) return validate.errors.map(e => `${e.instancePath || '/'}: ${e.message}`)
+  const errors = []
+  if (profile === 'case') {
+    const options = new Set(value.alternatives.map(a => a.id))
+    if (options.size !== value.alternatives.length) errors.push('alternative identities must be unique')
+    if (value.disposition.choice !== null && !options.has(value.disposition.choice)) errors.push('choice must name a considered alternative')
+    if (value.disposition.status === 'chosen' && value.disposition.choice === null) errors.push('chosen disposition requires an alternative')
+    if (value.disposition.status !== 'chosen' && value.disposition.choice !== null) errors.push('open deliberation cannot claim a choice')
+  } else {
+    if (value.supersedes?.id === value.native.id) errors.push('a decision cannot supersede its own native identity')
+    if (value.evidence.status === 'current' && !value.evidence.references.length) errors.push('current evidence requires exact references')
+    if (value.implementation.status === 'verified' && value.implementation.receipt === null) errors.push('verified implementation requires its own receipt')
+  }
+  return errors
+}
+function assert(value, profile) {
+  const errors = validateJudgment(value, profile)
+  if (errors.length) throw new Error(`invalid judgment ${profile}: ${errors.join('; ')}`)
+  return value
+}
+export function inspectPracticalCase(value) {
+  assert(value, 'case')
+  return { case: structuredClone(value), digest: learningDigest(value),
+    ruleRequired: false, disposition: value.disposition.status, wisdomVerified: false,
+    nextQuestions: value.questions, unresolvedDissent: value.voices.filter(v => v.position === 'dissent') }
+}
+// Native identity and decision status belong to the source repository. This
+// adapter records a declared interpretation of exact source bytes, not a new ADR
+// number, signature, status transition or repository-wide adoption.
+export function importArchitectureDecision({ decision, sourceText }) {
+  assert(decision, 'decision')
+  if (typeof sourceText !== 'string' || Buffer.byteLength(sourceText) > 256 * 1024 || contentDigest(sourceText) !== decision.native.digest) throw new Error('native ADR source bytes differ')
+  return { schema: 'atelier-decision-import@v1', decision: structuredClone(decision), sourceVerified: true,
+    sourceDigest: contentDigest(sourceText), interpretationVerified: false, authorityTransferred: false }
+}
+export function renderArchitectureDecision(decision) {
+  assert(decision, 'decision')
+  return [`# ${decision.native.id}: ${decision.title}`, '', `Decision: ${decision.decision.status}`, `Implementation: ${decision.implementation.status}`, `Evidence: ${decision.evidence.status}`, '',
+    '## Context', '', decision.context, '', '## Choice and rationale', '', decision.decision.choice, '', decision.decision.reason,
+    '', '## Alternatives', '', ...decision.alternatives.map(a => `- ${a}`), '', '## Consequences and reconsideration', '', ...decision.consequences.map(c => `- ${c}`),
+    '', ...decision.reconsiderWhen.map(c => `- Reconsider when ${c}`), '', 'Native status remains owned by the source repository.', ''].join('\n')
+}
+export function prepareJudgmentContribution({ records, value, profile, title, term, rightsBasis, sourceText }) {
+  assert(value, profile)
+  if (profile === 'decision') importArchitectureDecision({ decision: value, sourceText })
+  const domain = inspectKnowledge(records).domain
+  if (!domain) throw new Error('establish a knowledge domain first')
+  assertAudience(domain.data.audience, value.audience)
+  const body = JSON.stringify({ profile: `atelier-judgment-${profile}@v1`, value }, null, 2)
+  return { data: { domain: harnessRef(domain), category: 'decision-rationale', title, term, body, audience: domain.data.audience, scope: domain.data.scope,
+    origin: { method: 'captured', locator: profile === 'decision' ? value.native.ref : `practical-case:${value.id}`, contentDigest: contentDigest(body), rightsBasis }, basedOn: [] },
+    semanticAcceptance: 'pending', authority: 'none' }
+}
+// Reviewed judgment travels through the existing Knowledge writer and Build
+// dependency protocol. The typed payload is validated again, not hidden in ext.
+export function createJudgmentDependency({ records, subjectId, target, dependencySnapshots = [], nativeSourceText }) {
+  const subject = records.find(r => r.id === subjectId)
+  if (subject?.kind !== 'contribution') throw new Error('judgment contribution required')
+  let payload
+  try { payload = JSON.parse(subject.data.body) } catch { throw new Error('typed judgment payload required') }
+  const profile = payload.profile === 'atelier-judgment-case@v1' ? 'case' : payload.profile === 'atelier-judgment-decision@v1' ? 'decision' : null
+  assert(payload.value, profile)
+  if (profile === 'decision') importArchitectureDecision({ decision: payload.value, sourceText: nativeSourceText })
+  const state = inspectKnowledge(records)
+  const handoff = createHarnessHandoff({ profile: 'knowledge', repository: state.domain.data.repository, records, subjectId, target, dependencySnapshots })
+  verifyHarnessHandoff({ handoff, records, dependencySnapshots })
+  return { profile: `atelier-judgment-${profile}@v1`, subjectDigest: learningDigest(payload.value), handoff, nativeAuthorityTransferred: false }
+}

package/src/judgment/practice-evaluation.mjs

@@ -0,0 +1,70 @@
+import { validateEvidenceDocument } from '../evidence-navigation/contracts.mjs'
+import { assessEvidenceCurrency } from '../evidence-navigation/evaluate.mjs'
+import { validateDecisionRequest, validateDecisionResult, decisionRequestDigest } from '../decisions/contracts.mjs'
+import { contentDigest, harnessRef } from '../harnesses/contracts.mjs'
+import { inspectKnowledge } from '../knowledge/ledger.mjs'
+import { decisionPracticeJson, decisionPracticeDraftValid, readAdoptedDecisionPractice } from './practice.mjs'
+
+const flags = { executionAuthorized: false, authorityTransferred: false, semanticTruthVerified: false }
+const outcome = (status, reason) => ({ status, reason, ...flags })
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+const closed = (value, keys) => object(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key))
+const canonical = value => JSON.stringify(value, (_key, item) => object(item) ? Object.fromEntries(Object.keys(item).sort().map(key => [key, item[key]])) : item)
+const rubricFields = ({ id, state, evidence, ...rubric }) => rubric
+const countKeys = ['stages', 'evidence', 'assessments', 'proposals']
+
+/** Inspect supplied facts and assessments. Outcomes never execute a stage. */
+export function evaluateDecisionPractice(input) {
+  try {
+    const value = decisionPracticeJson(input)
+    if (!closed(value, ['records', 'definitionRef', 'instance']) ||
+        !closed(value.instance, ['id', 'evidence', 'snapshots', 'at', 'prerequisites', 'spent', 'request', 'result', 'proposal']) ||
+        typeof value.instance.id !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(value.instance.id)) return outcome('refuse', 'invalid-instance')
+    const adopted = readAdoptedDecisionPractice({ records: value.records, definitionRef: value.definitionRef })
+    if (adopted.status !== 'resolved') return outcome('refuse', adopted.reason)
+    const definition = adopted.definition, instance = value.instance
+    const protectedIds = new Set([adopted.definitionRef.id, adopted.activationRef.id, ...value.records.filter(record => record.kind === 'review' && record.data.target.id === adopted.definitionRef.id).map(record => record.id)])
+    if (!closed(instance.proposal, ['type', 'target', 'term', 'title'])) return outcome('refuse', 'unsupported-proposal-type')
+    if (protectedIds.has(instance.proposal.target?.id)) return outcome('refuse', 'self-definition-proposal')
+    if (!definition.allowedProposals.includes(instance.proposal.type)) return outcome('refuse', 'unsupported-proposal-type')
+    if (!Array.isArray(instance.evidence) || instance.evidence.length < definition.evidenceRoles.length ||
+        instance.evidence.some(item => !closed(item, ['role', 'requestId', 'sourceRef', 'text', 'reference'])) ||
+        instance.evidence.some(item => !definition.evidenceRoles.includes(item.role)) ||
+        !definition.evidenceRoles.every(role => instance.evidence.some(item => item.role === role)) ||
+        new Set(instance.evidence.map(item => item.requestId)).size !== instance.evidence.length) return outcome('refuse', 'missing-evidence')
+    if (!closed(instance.spent, countKeys) || !Object.values(instance.spent).every(count => Number.isSafeInteger(count) && count >= 0 && count <= 256)) return outcome('refuse', 'invalid-budget')
+    const required = { stages: 1, evidence: instance.evidence.length, assessments: 1, proposals: 1 }
+    if (countKeys.some(key => instance.spent[key] + required[key] > definition.limits[key])) return outcome('refuse', 'budget-exhausted')
+    if (!Array.isArray(instance.prerequisites) || instance.prerequisites.length !== definition.prerequisites.length ||
+        instance.prerequisites.some(item => !closed(item, ['id', 'value']) || !definition.prerequisites.includes(item.id) || typeof item.value !== 'boolean') ||
+        new Set(instance.prerequisites.map(item => item.id)).size !== instance.prerequisites.length) return outcome('refuse', 'unknown-prerequisite')
+    for (const item of instance.evidence) {
+      if (!validateEvidenceDocument('evidenceRef', item.reference).valid || typeof item.text !== 'string' || contentDigest(item.text) !== item.reference.contentDigest) return outcome('refuse', 'changed-evidence-text')
+      if (assessEvidenceCurrency(item.reference, instance.snapshots, { at: instance.at }).status !== 'current') return outcome('refuse', 'stale-evidence')
+    }
+    const request = instance.request
+    if (!validateDecisionRequest(request).ok || canonical(rubricFields(request)) !== canonical(rubricFields(definition.rubric))) return outcome('refuse', 'changed-rubric')
+    if (request.evidence.length !== instance.evidence.length || !request.evidence.every(pin => closed(pin, ['id', 'sourceRef']) && instance.evidence.some(item => item.requestId === pin.id && item.sourceRef === pin.sourceRef)) ||
+        request.state !== request.evidence.map(pin => `${pin.id}: ${instance.evidence.find(item => item.requestId === pin.id).text}`).join('\n')) return outcome('refuse', 'unbound-request-evidence')
+    if (!validateDecisionResult(request, instance.result).ok) return outcome('refuse', 'invalid-rubric-result')
+    if (instance.prerequisites.some(item => !item.value)) return outcome('stop', 'prerequisite-false')
+    if (instance.result.status === 'abstained') return outcome('escalate', 'rubric-abstained')
+    const disposition = definition.outcomeMap.choices[instance.result.answers[definition.outcomeMap.question].choice]
+    if (disposition !== 'proceed') return outcome(disposition, 'rubric-disposition')
+    const state = inspectKnowledge(value.records), target = state.records.find(record => record.id === instance.proposal.target?.id)
+    if (!target || target.kind !== 'contribution' || !closed(instance.proposal.target, ['id', 'digest']) || harnessRef(target).digest !== instance.proposal.target.digest) return outcome('refuse', 'changed-proposal-target')
+    if (!state.domain.data.vocabulary.types.some(term => term.id === instance.proposal.term) ||
+        typeof instance.proposal.title !== 'string' || !instance.proposal.title.trim() || instance.proposal.title.length > 4000) return outcome('refuse', 'invalid-proposal')
+    const body = JSON.stringify({ format: 'atelier.decision-reconsideration/v0', instanceId: instance.id,
+      definitionRef: adopted.definitionRef, activationRef: adopted.activationRef, target: harnessRef(target),
+      evidence: instance.evidence.map(item => ({ role: item.role, reference: item.reference })), requestDigest: decisionRequestDigest(request),
+      assessment: instance.result, nativeAuthorityTransferred: false }, null, 2)
+    const data = { domain: harnessRef(state.domain), category: 'interpretation', term: instance.proposal.term, title: instance.proposal.title,
+        body, audience: state.domain.data.audience, scope: state.domain.data.scope,
+        origin: { method: 'captured', locator: `decision-reconsideration:${instance.id}`, contentDigest: contentDigest(body), rightsBasis: definition.rightsBasis }, basedOn: [] }
+    if (!decisionPracticeDraftValid(data)) return outcome('refuse', 'practice-output-exceeds-bounds')
+    return { ...outcome('proceed', 'reconsideration-draft-prepared'),
+      proposal: { data, semanticAcceptance: 'pending', ...flags },
+      declaredRemaining: Object.fromEntries(countKeys.map(key => [key, definition.limits[key] - instance.spent[key] - required[key]])) }
+  } catch (error) { return outcome('refuse', Object.getOwnPropertyDescriptor(error ?? {}, 'message')?.value === 'evidence value exceeds bounds' ? 'practice-input-exceeds-bounds' : 'invalid-instance') }
+}