@okfit/profiles 0.9.0 → 0.10.0

package/Canonical.js

@@ -0,0 +1,68 @@
+import { body } from "./internal/body.js";
+
+//#region src/Canonical.ts
+/** Top-level keys that are bookkeeping, not authored content (spec section 4). */
+const EXCLUDED_KEYS = /* @__PURE__ */ new Set([
+	"generated",
+	"verified",
+	"integrity",
+	"stale_after",
+	"status",
+	"timestamp"
+]);
+/** `JSON.stringify` omits these in an object and writes `null` for them in an array. */
+const isSkipped = (value) => value === void 0 || typeof value === "function" || typeof value === "symbol";
+/**
+* Canonical JSON: object keys sorted (`Array.prototype.toSorted`, UTF-16 code units)
+* at every depth; arrays keep their order. Byte-for-byte `JSON.stringify` of the
+* sorted value for every JSON-representable input, plus one extension: a `bigint`
+* (what the YAML decoder yields for an integer beyond 2^53, e.g. `ticket:
+* 123456789012345678901`) is written as its bare decimal literal. A literal cannot
+* collide with a string (strings are quoted) and is deterministic, where
+* `JSON.stringify` throws `TypeError` and would defect every caller that hashes.
+*/
+const json = (value) => {
+	if (typeof value === "bigint") return value.toString();
+	if (Array.isArray(value)) return `[${value.map((item) => isSkipped(item) ? "null" : json(item)).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const record = value;
+		if (typeof record.toJSON === "function") return json(record.toJSON());
+		return `{${Object.keys(record).toSorted().filter((key) => !isSkipped(record[key])).map((key) => `${JSON.stringify(key)}:${json(record[key])}`).join(",")}}`;
+	}
+	return JSON.stringify(value);
+};
+const stripRendersDigests = (renders) => Array.isArray(renders) ? renders.map((entry) => {
+	if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return entry;
+	const { body: _body, body_sha256: _legacy, ...rest } = entry;
+	return rest;
+}) : renders;
+/**
+* The exact string a content digest hashes: canonical JSON of the authored frontmatter
+* (`raw` minus `Canonical.EXCLUDED_KEYS` and every `renders[].body`) and the
+* normalised body. `raw` is the parsed mapping (YAML 1.2 Core Schema: timestamps are
+* strings), so quoting, flow vs block style, key order and CRLF never change it.
+*/
+const contentInput = (raw, source) => {
+	const frontmatter = Object.fromEntries(Object.entries(raw).filter(([key]) => !EXCLUDED_KEYS.has(key)).map(([key, value]) => [key, key === "renders" ? stripRendersDigests(value) : value]));
+	return json({
+		body: body(source),
+		frontmatter
+	});
+};
+/**
+* Canonical encoding for okfit's content digest.
+*
+* @public
+*/
+var Canonical = class {
+	constructor() {}
+	/** Top-level frontmatter keys excluded from the content digest. */
+	static EXCLUDED_KEYS = EXCLUDED_KEYS;
+	/** Canonical JSON: sorted keys at every depth, array order kept; a `bigint` is its bare decimal literal. */
+	static json = json;
+	/** The exact string a content digest hashes. */
+	static contentInput = contentInput;
+};
+
+//#endregion
+export { Canonical };

package/Derivation.js

@@ -1,8 +1,9 @@
+import { body } from "./internal/body.js";
+import { Canonical } from "./Canonical.js";
 import { GitHistory } from "./GitHistory.js";
 import { Actor, OkfitConfig } from "@okfit/core";
 import { Crypto, DateTime, Duration, Effect, FileSystem, Option, Path, Schema } from "effect";
 import { Git } from "@effected/git";
-import { FrontmatterSource } from "@effected/markdown";
 import * as Hex from "effect/encoding/Hex";
 
 //#region src/Derivation.ts
@@ -35,15 +36,40 @@ var AgentActorUnconfiguredError = class extends Schema.TaggedError()("AgentActor
 		return "writer is agent but actors.agent is not configured";
 	}
 };
+/**
+* `git config okfit.actor` is set but is not a `human:<id>` actor without `@`
+* or glob characters. The value stays on the person's machine; okfit never
+* writes it anywhere.
+*
+* @public
+*/
+var ActorConfigInvalidError = class extends Schema.TaggedError()("ActorConfigInvalidError", { value: Schema.String }) {
+	get message() {
+		return `git config okfit.actor is "${this.value}"; it must be a human:<id> actor with no "@" and no * or ? (for example human:ada)`;
+	}
+};
+/**
+* The resolved human is not on a non-empty `[actors].humans` allow-list, so it
+* may not verify or revoke (spec section 8).
+*
+* @public
+*/
+var HumanActorNotAllowedError = class extends Schema.TaggedError()("HumanActorNotAllowedError", { actor: Schema.String }) {
+	get message() {
+		return `${this.actor} is not in [actors].humans, so it cannot verify or revoke; set your id with git config --global okfit.actor human:<id> to a listed id, or add ${this.actor} to [actors].humans`;
+	}
+};
 const HUMAN_PREFIX = "human:";
 const FALLBACK_STALE_AFTER = Duration.days(90);
 const decodeActor = Schema.decodeSync(Actor);
-const normalise = (text) => text.replace(/\r\n?/g, "\n").trimEnd();
-const body = (text) => normalise(FrontmatterSource.split(text).body);
-const bodyDigest = (text) => Effect.gen(function* () {
-	const bytes = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(body(text)));
+const digestFull = (text) => Effect.gen(function* () {
+	const bytes = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(text));
 	return Hex.encode(bytes);
 });
+/** 16-hex okfit digest (spec section 3): the first 64 bits of SHA-256. */
+const digest = (text) => Effect.map(digestFull(text), (hex) => hex.slice(0, 16));
+const bodyDigest = (source) => digest(body(source));
+const contentDigest = (raw, source) => digest(Canonical.contentInput(raw, source));
 /** The text before the first `@` (the whole value when there is none), or undefined when empty or containing whitespace. */
 const localPartOf = (email) => {
 	if (email === void 0) return void 0;
@@ -75,8 +101,8 @@ const humanActorId = (identity, humans) => {
 	const slug = slugOf(identity.name);
 	const candidates = [local, slug].filter((candidate) => candidate !== void 0).map((candidate) => candidate.toLowerCase());
 	for (const entry of humans) {
-		if (!entry.startsWith(HUMAN_PREFIX)) continue;
-		if (candidates.includes(entry.slice(6).toLowerCase())) return Option.some(entry);
+		if (!entry.startsWith(HUMAN_PREFIX) || Actor.isPattern(entry)) continue;
+		if (candidates.includes(entry.slice(6).toLowerCase())) return Option.some(decodeActor(entry));
 	}
 	if (local !== void 0) return Option.some(decodeActor(`${HUMAN_PREFIX}${local}`));
 	if (slug !== void 0) return Option.some(decodeActor(`${HUMAN_PREFIX}${slug}`));
@@ -104,7 +130,7 @@ const uncommitted = (reason) => ({
 *
 * @public
 */
-var Derivation = class {
+var Derivation = class Derivation {
 	constructor() {}
 	/**
 	* `FrontmatterSource.split(text).body`, then CRLF and lone CR to LF, then trailing whitespace at end of
@@ -112,12 +138,33 @@ var Derivation = class {
 	*/
 	static body = body;
 	/**
-	* Lowercase 64-char hex sha256 of `Derivation.body(text)`, through `effect`'s platform-agnostic
-	* `Crypto` service (issue #19). Same normalization as `body`, so a frontmatter-only edit or a
-	* `core.autocrlf` worktree never changes the digest.
+	* Full lowercase 64-char hex sha256 of a string. Tests only.
+	*
+	* @internal
+	*/
+	static digestFull = digestFull;
+	/**
+	* The okfit digest of a string: the first 16 lowercase hex characters of its SHA-256, through
+	* `effect`'s platform-agnostic `Crypto` service.
+	*/
+	static digest = digest;
+	/**
+	* 16-hex digest of `Derivation.body(source)` (issue #19). Same normalization as `body`, so a
+	* frontmatter-only edit or a `core.autocrlf` worktree never changes the digest.
 	*/
 	static bodyDigest = bodyDigest;
 	/**
+	* The body digest recorded for a generated concept: `integrity.generated.body`, else the legacy
+	* `generated.body_sha256` cut to its first 16 hex characters. `undefined` when neither is present.
+	* Pure; every "is the stamped body still current" comparison reads through this.
+	*/
+	static recordedBody = (concept) => concept.frontmatter.integrity?.generated?.body ?? concept.frontmatter.generated?.body_sha256?.slice(0, 16);
+	/**
+	* 16-hex digest of the canonical content input (`Canonical.contentInput`): authored frontmatter
+	* plus the normalised body, insensitive to style, key order and CRLF.
+	*/
+	static contentDigest = contentDigest;
+	/**
 	* Spec 5.4 rule 2 as P-2 (DERIVE option C). Steps:
 	*  1. `root = Git.repoRoot(dirname(file))`: a file outside any repository surfaces `NotARepositoryError`;
 	*     submodules and worktrees work because the question is asked from the file's directory (P-39).
@@ -172,14 +219,15 @@ var Derivation = class {
 	});
 	/**
 	* P-13 / P-14, pure. Candidates: the email local part (returned as written, lower-cased only for matching)
-	* and the `user.name` slug. Order, first hit wins: (1) a `human:` entry of `humans` whose id equals a
-	* candidate case-insensitively, returned verbatim; (2) `human:<local>`; (3) `human:<slug>`; (4) none.
+	* and the `user.name` slug. Order, first hit wins: (1) a literal `human:` entry of `humans` (glob entries,
+	* those with `*` or `?`, are skipped) whose id equals a candidate case-insensitively, returned verbatim; (2) `human:<local>`; (3) `human:<slug>`; (4) none.
 	* The result is branded through core's `Actor` codec and always passes it.
 	*/
 	static humanActorId = humanActorId;
 	/**
 	* Spec 5.4 rule 1 (P-16, P-45). `"agent"`: `config.actors.agent`, else {@link AgentActorUnconfiguredError}
-	* (P-17). `"human"`: `Git.configGet(cwd, "user.name")` and `Git.configGet(cwd, "user.email")` in merged
+	* (P-17). `"human"`: first `Git.configGet(cwd, "okfit.actor")`, which wins when set and must be a
+	* `human:<id>` with no `@` or glob ({@link ActorConfigInvalidError} otherwise), returned in the spelling of an exact `[actors].humans` entry that equals it case-insensitively (P-14); else `Git.configGet(cwd, "user.name")` and `Git.configGet(cwd, "user.email")` in merged
 	* scope (P-15) through {@link Derivation.humanActorId}; none is {@link HumanActorUnresolvedError}.
 	* Answers only "who is writing now" (P-40).
 	*/
@@ -190,6 +238,13 @@ var Derivation = class {
 			return agent;
 		}
 		const git = yield* Git;
+		const chosen = Option.getOrUndefined(yield* git.configGet(options.cwd, "okfit.actor"));
+		if (chosen !== void 0) {
+			if (!(Schema.is(Actor)(chosen) && Actor.isHuman(chosen) && !chosen.includes("@") && !Actor.isPattern(chosen))) return yield* new ActorConfigInvalidError({ value: chosen });
+			const lower = chosen.toLowerCase();
+			const spelled = (options.config.actors?.humans ?? []).find((entry) => !Actor.isPattern(entry) && entry.toLowerCase() === lower);
+			return spelled === void 0 ? chosen : decodeActor(spelled);
+		}
 		const name = Option.getOrUndefined(yield* git.configGet(options.cwd, "user.name"));
 		const email = Option.getOrUndefined(yield* git.configGet(options.cwd, "user.email"));
 		const identity = {
@@ -204,6 +259,22 @@ var Derivation = class {
 		return resolved.value;
 	});
 	/**
+	* The human allowed to verify now: {@link Derivation.generatedBy} for a human
+	* writer, then the `[actors].humans` allow-list (`Actor.allowed`): empty or
+	* absent allows anyone, otherwise the actor must match an entry or this fails
+	* {@link HumanActorNotAllowedError}. `okfit verify`, `--revoke` and the LSP
+	* verify actions all resolve through this.
+	*/
+	static verifier = Effect.fn("Derivation.verifier")(function* (options) {
+		const actor = yield* Derivation.generatedBy({
+			writer: "human",
+			cwd: options.cwd,
+			config: options.config
+		});
+		if (!Actor.allowed(actor, options.config.actors?.humans ?? [])) return yield* new HumanActorNotAllowedError({ actor });
+		return actor;
+	});
+	/**
 	* P-19, pure: `from` plus `config.lifecycle.default_stale_after`, falling back to `OkfitConfig.DEFAULTS`'
 	* 90 days. `from` is the caller's: `generated.at` when committed, else its own `now`.
 	*/
@@ -211,4 +282,4 @@ var Derivation = class {
 };
 
 //#endregion
-export { AgentActorUnconfiguredError, Derivation, HumanActorUnresolvedError };
+export { ActorConfigInvalidError, AgentActorUnconfiguredError, Derivation, HumanActorNotAllowedError, HumanActorUnresolvedError };

package/Provenance.js

@@ -12,17 +12,20 @@ const encodeAt = Schema.encodeSync(Timestamp);
 * like every other lint (S-7). `Profile.check` and `ProfileDiagnosticCode`
 * are unchanged.
 *
-* Two tiers per concept (issue #19, body-digest design): when
-* `generated.body_sha256` is present, drift is decided ENTIRELY by comparing it to
+* Two tiers per concept (issue #19, body-digest design): when a body digest
+* is recorded (`integrity.generated.body`, else the 16-hex prefix of a legacy
+* `generated.body_sha256`, via `Derivation.recordedBody`), drift is decided
+* ENTIRELY by comparing it to
 * `Derivation.bodyDigest` of the concept's current source -- no git call at
 * all, so this works for a dirty worktree too (that is the point: an edited
 * body is caught immediately, before it is even committed) and survives a
 * squash/rebase merge that only rewrites commit dates, since the body
-* itself, and therefore its digest, never changed. When `body_sha256` is
-* absent (an un-migrated concept), this falls back to the original
+* itself, and therefore its digest, never changed. When no digest is recorded
+* at all (a concept `okfit sync` has never stamped), this falls back to the original
 * git-derived date comparison against `Derivation.generatedAt`, preserving
 * `--skip-provenance`'s meaning for bundles that have not run `okfit sync`
-* since this field was introduced.
+* since the digest was introduced. The drift message names the field the
+* recorded value came from, so a legacy concept reads `generated.body_sha256`.
 *
 * The tier-2 fallback returns `[]` the moment a `NotARepositoryError`
 * surfaces: a bundle outside git has nothing to derive for any concept still
@@ -40,8 +43,8 @@ const encodeAt = Schema.encodeSync(Timestamp);
 * calling at all; the two agree by construction (both skip the walk).
 *
 * A third, optional options argument carries `skipGitTier`: when `true`, a
-* concept that falls through to tier 2 (no `generated.body_sha256`
-* recorded) is skipped entirely -- no `Derivation.generatedAt` call, no
+* concept that falls through to tier 2 (no body digest recorded) is
+* skipped entirely -- no `Derivation.generatedAt` call, no
 * git spawn at all -- while tier 1 still runs, unaffected, for every
 * concept that DOES carry a digest. This is a runtime skip, not a
 * type-level narrowing: the R channel still lists `Git | GitHistory` even
@@ -72,11 +75,13 @@ var Provenance = class {
 		};
 		for (const [, concept] of bundle.concepts) {
 			if (concept.frontmatter.generated === void 0) continue;
-			const recordedDigest = concept.frontmatter.generated.body_sha256;
+			const recordedDigest = Derivation.recordedBody(concept);
 			if (recordedDigest !== void 0) {
 				const currentDigest = yield* Derivation.bodyDigest(concept.document.source);
 				if (currentDigest === recordedDigest) continue;
-				pushDrift(concept.path, `the body has changed since generated.at was last stamped: generated.body_sha256 is ${recordedDigest}, the current body hashes to ${currentDigest}`, DiagnosticRange.forFrontmatterPath(concept.document, ["generated", "at"]));
+				const legacy = concept.frontmatter.generated.body_sha256;
+				const recordedAs = concept.frontmatter.integrity?.generated?.body === void 0 && legacy !== void 0 ? `generated.body_sha256 is ${legacy}` : `integrity.generated.body is ${recordedDigest}`;
+				pushDrift(concept.path, `the body has changed since generated.at was last stamped: ${recordedAs}, the current body hashes to ${currentDigest}`, DiagnosticRange.forFrontmatterPath(concept.document, ["generated", "at"]));
 				continue;
 			}
 			if (skipGitTier) continue;

package/Publications.js

@@ -34,14 +34,16 @@ const rendersOf = (concept) => {
 	const out = [];
 	for (const [index, entry] of value.entries()) {
 		if (typeof entry !== "object" || entry === null || typeof entry.path !== "string") return void 0;
-		const digest = typeof entry.body_sha256 === "string" && entry.body_sha256 !== "" ? entry.body_sha256 : void 0;
+		const current = typeof entry.body === "string" && entry.body !== "" ? entry.body : void 0;
+		const legacy = typeof entry.body_sha256 === "string" && entry.body_sha256 !== "" ? entry.body_sha256.slice(0, 16) : void 0;
+		const digest = current ?? legacy;
 		out.push(digest === void 0 ? {
 			index,
 			path: entry.path
 		} : {
 			index,
 			path: entry.path,
-			body_sha256: digest
+			body: digest
 		});
 	}
 	return out;
@@ -51,7 +53,7 @@ const compare = (a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.code <
 * A profiles-owned lint over Publication concepts: `publication-orphan` when a
 * `surface` or `renders[].path` does not resolve to a bundle concept (or
 * `renders` is malformed), and `publication-drift` when a rendered source's
-* body digest no longer matches the stamped `body_sha256`. Total over
+* body digest no longer matches the stamped `renders[].body`. Total over
 * severity: returns `[]` before any digest work when both codes are `"off"`.
 *
 * @public
@@ -94,7 +96,7 @@ var Publications = class {
 			}
 			const renders = rendersOf(concept);
 			if (renders === void 0) {
-				if (orphanSeverity !== "off") push(concept, "publication-orphan", orphanSeverity, "renders must be a list of { path, body_sha256 } entries", ["renders"]);
+				if (orphanSeverity !== "off") push(concept, "publication-orphan", orphanSeverity, "renders must be a list of { path, body } entries", ["renders"]);
 				continue;
 			}
 			if (renders.length === 0) {
@@ -117,11 +119,11 @@ var Publications = class {
 					continue;
 				}
 				if (driftSeverity === "off") continue;
-				if (entry.body_sha256 === void 0) {
+				if (entry.body === void 0) {
 					stale.push(`${sourceId} (never stamped)`);
 					continue;
 				}
-				if ((yield* Derivation.bodyDigest(source.document.source)) !== entry.body_sha256) stale.push(`${sourceId} (changed)`);
+				if ((yield* Derivation.bodyDigest(source.document.source)) !== entry.body) stale.push(`${sourceId} (changed)`);
 			}
 			if (stale.length > 0 && driftSeverity !== "off") push(concept, "publication-drift", driftSeverity, `Rendered page ${resource} is stale against: ${stale.join(", ")}; re-render it, then run okfit sync --publication ${id}`, ["renders"]);
 		}

package/README.md

@@ -49,7 +49,7 @@ kind = "path"
 
 [types.Decision]
 description = "A choice made, the alternatives rejected, and why."
-guidance = "Never edit a stable Decision; deprecate it and write a new one that names it in supersedes. A Decision counts as settled only once a human has verified it."
+guidance = "Edit a Decision when the choice still stands and its text has drifted or is incomplete; the edit voids its verification until a human verifies it again. Deprecate it and write a successor that names it in supersedes only when the choice itself changes and its history matters."
 require_verified = true
 
 [types.Decision.fields.supersedes]
@@ -290,8 +290,8 @@ Each directory carries its own `index.md`. What `okfit init` writes into these f
 - **`generated.at` is the author date, not the stamp date (P-4).** Walking a path's git history newest-first, the commit that changed the body is the one whose blob first differs from its predecessor's; that commit's *author* date (`%aI`) is `generated.at`. Its committer date, author name, and author email are carried on the result for callers that want a history-based policy later, but `generated.at` itself is never the date of a later frontmatter-only stamp.
 - **The path log is `@effected/git`'s `Git.log(cwd, { paths: [path], follow: true, firstParentDiffMerges: true })` (P-5, amended P-46, decision 56).** `firstParentDiffMerges` surfaces a conflict-resolving merge whose blob differs from both parents (probed on git 2.54.0), which plain `--follow` can omit and which would otherwise attribute that body change to the wrong commit. `Git.log`'s unconditional `-z` makes `--name-only` emit paths raw — no C-style quoting — so no `core.quotePath` override is needed and a path containing a space, a quote, or a newline round-trips verbatim. The dirty check compares the worktree body against `Git.show(root, "HEAD", path)`, never against the newest log entry. `--follow`'s rename detection can itself stop at a commit that renames a file and rewrites its content enough that git no longer treats it as a continuation of the same history; when that happens, `generated.at` answers that rename commit rather than an older one.
 - **Uncommitted is the caller's to interpret (P-10).** `Derivation.generatedAt` reports `{ _tag: "uncommitted", reason: "untracked" | "dirty" | "unborn" }` and never substitutes `now`. The recommended policy, followed by the snippet below: omit `generated.at` entirely until the body is committed.
-- **The body digest answers "has the body changed", where dates cannot (issue #19).** `Derivation.bodyDigest(text)` is a sha256, hex-encoded, over the same normalised body `Derivation.body` produces (CRLF and lone CR to LF, trailing whitespace at end of text removed), so a `core.autocrlf` worktree and a trailing-newline change hash identically and a frontmatter-only edit does not move the digest at all. It is computed through effect's own `Crypto` service rather than `node:crypto`, so it carries `Crypto.Crypto` in its R channel; `NodeServices.layer` already supplies it wherever this package is used. `okfit sync` records it as `generated.body_sha256` — okfit's own extension key, not an OKF v0.2 field — and `Provenance.lint` compares it. Git cannot make this judgement on its own: the stamp lives in the same blob as the body, so a squash merge (one new commit carrying both) is indistinguishable by history from a body edited without a re-stamp.
-- **Human actor resolution (P-13).** Given git identity `{ name?, email? }` and `config.actors.humans`, the first hit wins: (1) a `human:<id>` entry whose id matches the email's local part or the name's slug, case-insensitively (config spelling returned); (2) `human:<local part>`; (3) `human:<slug of name>`; (4) unresolved. The slug lowercases `name`, replaces runs of whitespace and characters outside `[A-Za-z0-9._-]` with `-`, and trims leading and trailing `-`.
+- **The body digest answers "has the body changed", where dates cannot (issue #19).** `Derivation.bodyDigest(text)` is a 16-hex SHA-256 prefix over the same normalised body `Derivation.body` produces (CRLF and lone CR to LF, trailing whitespace at end of text removed), so a `core.autocrlf` worktree and a trailing-newline change hash identically and a frontmatter-only edit does not move the digest at all. It is computed through effect's own `Crypto` service rather than `node:crypto`, so it carries `Crypto.Crypto` in its R channel; `NodeServices.layer` already supplies it wherever this package is used. `okfit sync` records it as `integrity.generated.body` — okfit's own extension key, not an OKF v0.2 field — and `Provenance.lint` compares it. Git cannot make this judgement on its own: the stamp lives in the same blob as the body, so a squash merge (one new commit carrying both) is indistinguishable by history from a body edited without a re-stamp.
+- **Human actor resolution (P-13).** Given git identity `{ name?, email? }` and `config.actors.humans`, the first hit wins: (1) `git config okfit.actor`, which must be a `human:<id>` with no `@` and no `*` or `?` (`ActorConfigInvalidError` otherwise); (2) a literal `human:<id>` entry (glob entries are skipped) whose id matches the email's local part or the name's slug, case-insensitively (config spelling returned); (3) `human:<local part>`; (4) `human:<slug of name>`; (5) unresolved (`HumanActorUnresolvedError`). `Derivation.verifier` runs that resolution and then checks the `[actors].humans` allow-list with core's `Actor.allowed`: an empty or absent list allows anyone, a non-empty one fails with `HumanActorNotAllowedError`, which is what `okfit verify`, `--revoke` and the language server's verify actions surface. okfit never stores an email; the trust signal reports `actor-not-allowed` (a `DriftReason`) for a verifier outside the list. The slug lowercases `name`, replaces runs of whitespace and characters outside `[A-Za-z0-9._-]` with `-`, and trims leading and trailing `-`.
 - **Identity is read at merged config scope (P-15).** `Derivation.generatedBy` calls `Git.configGet(cwd, "user.name")` and `Git.configGet(cwd, "user.email")` with no `scope` option. Environment overrides (`GIT_AUTHOR_NAME`, `GIT_AUTHOR_EMAIL`, `EMAIL`, `user.useConfigOnly`) are out of scope for phase 1.
 - **`stale_after` is pure addition (P-19).** `Derivation.staleAfter(from, config)` is `from + (config.lifecycle?.default_stale_after ?? OkfitConfig.DEFAULTS.lifecycle.default_stale_after)`, falling back to 90 days. `from` should be `generated.at` when the provenance is `committed`, otherwise the caller's own `now`; re-stamp whenever `generated.at` changes.
 
@@ -313,7 +313,7 @@ Frontmatter serialisation, the uncommitted policy's enforcement, `now`, layer co
 lint (`lint.generated_at_drift`, config default `"warn"`), and it runs in
 two tiers (issue #19).
 
-Tier 1 applies to a concept that records `generated.body_sha256`: the
+Tier 1 applies to a concept that records `integrity.generated.body`: the
 recorded digest is compared against
 `Derivation.bodyDigest(concept.document.source)`, a pure comparison over
 text already in memory with no git call and no filesystem read. Drift here

package/SoftwareProject.js

@@ -58,7 +58,7 @@ const config = {
 		},
 		Decision: {
 			description: "A choice made, the alternatives rejected, and why.",
-			guidance: "Never edit a stable Decision; deprecate it and write a new one that names it in supersedes. A Decision counts as settled only once a human has verified it.",
+			guidance: "Edit a Decision when the choice still stands and its text has drifted or is incomplete; the edit voids its verification until a human verifies it again. Deprecate it and write a successor that names it in supersedes only when the choice itself changes and its history matters.",
 			require_verified: true,
 			fields: { supersedes: {
 				description: "The Decision this one replaces.",

package/Trust.js

@@ -0,0 +1,156 @@
+import { Derivation } from "./Derivation.js";
+import { Actor, Derive, Diagnostic, DiagnosticRange, OkfitConfig, Timestamp } from "@okfit/core";
+import { DateTime, Effect, Schema } from "effect";
+
+//#region src/Trust.ts
+const encodeAt = Schema.encodeSync(Timestamp);
+/**
+* Why a human verification no longer binds: the content changed, the entry has
+* no `integrity.verified` binding, a later human entry is not the bound one, or
+* the bound actor fails a non-empty `[actors].humans` allow-list.
+*
+* @public
+*/
+const DriftReason = Schema.Literals([
+	"content-changed",
+	"unbound",
+	"entry-superseded",
+	"actor-not-allowed"
+]);
+/** Only `human:` entries bind; machine entries neither bind nor break a binding. */
+const latestHumanOf = (entries) => entries.filter((entry) => Actor.isHuman(entry.by)).reduce((latest, entry) => latest === void 0 || DateTime.isGreaterThanOrEqualTo(entry.at, latest.at) ? entry : latest, void 0);
+const latestHuman = (concept) => latestHumanOf(concept.frontmatter.verified ?? []);
+const inputOf = (concept, config) => ({
+	verified: concept.frontmatter.verified ?? [],
+	binding: concept.frontmatter.integrity?.verified,
+	generated: concept.frontmatter.generated,
+	humans: config.actors?.humans ?? []
+});
+/** The binding when it names the latest human entry; `undefined` when none, unbound or superseded. */
+const boundEntry = (input) => {
+	const latest = latestHumanOf(input.verified);
+	const binding = input.binding;
+	if (latest === void 0 || binding === void 0) return void 0;
+	return binding.by === latest.by && DateTime.Equivalence(binding.at, latest.at) ? binding : void 0;
+};
+const needsDigest = (input) => {
+	const bound = boundEntry(input);
+	return bound !== void 0 && Actor.allowed(bound.by, input.humans);
+};
+const evaluate = (input, content) => {
+	if (latestHumanOf(input.verified) === void 0) return { integrity: "none" };
+	const binding = input.binding;
+	if (binding === void 0) return {
+		integrity: "drifted",
+		drift: { reason: "unbound" }
+	};
+	if (boundEntry(input) === void 0) return {
+		integrity: "drifted",
+		drift: { reason: "entry-superseded" }
+	};
+	if (!Actor.allowed(binding.by, input.humans)) return {
+		integrity: "drifted",
+		drift: { reason: "actor-not-allowed" }
+	};
+	if (content === void 0) throw new Error("Trust.evaluate: a bound verification needs a content digest");
+	if (content === binding.content) return { integrity: "current" };
+	const generated = input.generated;
+	return {
+		integrity: "drifted",
+		drift: {
+			reason: "content-changed",
+			...generated?.at !== void 0 && DateTime.isGreaterThan(generated.at, binding.at) ? {
+				editedBy: generated.by,
+				editedAt: encodeAt(generated.at)
+			} : {}
+		}
+	};
+};
+const signal = Effect.fn("Trust.signal")(function* (concept, config, now) {
+	const tier = Derive.trustTier(concept.frontmatter);
+	const stale = Derive.isStale(concept.frontmatter, now);
+	const input = inputOf(concept, config);
+	const content = needsDigest(input) ? yield* Derivation.contentDigest(concept.frontmatter.raw, concept.document.source) : void 0;
+	return {
+		tier,
+		stale,
+		...evaluate(input, content)
+	};
+});
+const signals = Effect.fn("Trust.signals")(function* (bundle, config, now) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [id, concept] of bundle.concepts) out.set(id, yield* signal(concept, config, now));
+	return out;
+});
+const messageFor = (concept, drift) => {
+	const latest = latestHuman(concept);
+	const by = latest?.by ?? "a human";
+	const at = latest === void 0 ? "an unknown time" : encodeAt(latest.at);
+	if (drift.reason === "unbound") return `verified by ${by} at ${at}, but no integrity.verified binding records what was verified; re-run okfit verify`;
+	if (drift.reason === "entry-superseded") return `the latest human verification (${by} at ${at}) is not the one integrity.verified binds; re-run okfit verify`;
+	const binding = concept.frontmatter.integrity?.verified;
+	if (drift.reason === "actor-not-allowed") return `verified by ${binding?.by ?? by}, who is not in [actors].humans; a listed human re-runs okfit verify`;
+	const edited = drift.editedBy === void 0 ? "" : ` (edited by ${drift.editedBy} at ${drift.editedAt})`;
+	return `content changed since ${binding?.by ?? by} verified it at ${binding === void 0 ? at : encodeAt(binding.at)}${edited}; re-run okfit verify`;
+};
+/**
+* Where a `verified-drift` finding points (spec section 6): the binding when one exists,
+* else the latest human `verified` entry -- by its list index when `verified` is a
+* sequence, the key itself when it is a single bare mapping.
+*/
+const rangePath = (concept) => {
+	if (concept.frontmatter.integrity?.verified !== void 0) return ["integrity", "verified"];
+	const latest = latestHuman(concept);
+	const index = latest === void 0 ? -1 : (concept.frontmatter.verified ?? []).indexOf(latest);
+	return Array.isArray(concept.frontmatter.raw.verified) && index >= 0 ? ["verified", index] : ["verified"];
+};
+const lint = Effect.fn("Trust.lint")(function* (bundle, config, now, given) {
+	const severity = OkfitConfig.severityFor(config, "verified-drift");
+	if (severity === "off") return [];
+	const diagnostics = [];
+	for (const [id, concept] of bundle.concepts) {
+		const status = Derive.status(concept.frontmatter);
+		if (status === "draft" || status === "deprecated") continue;
+		const result = given?.get(id) ?? (yield* signal(concept, config, now));
+		if (result.drift === void 0) continue;
+		const range = DiagnosticRange.forFrontmatterPath(concept.document, rangePath(concept));
+		diagnostics.push(Diagnostic.make({
+			file: concept.path,
+			code: "verified-drift",
+			severity,
+			message: messageFor(concept, result.drift),
+			...range === void 0 ? {} : { range }
+		}));
+	}
+	return diagnostics;
+});
+/**
+* The integrity trust signal: whether a human verification still binds the
+* content it covered, and the `verified-drift` lint built on it. A signal, not
+* a tamper seal. Named `Trust` so it does not collide with core's `Integrity`
+* schema.
+*
+* @public
+*/
+var Trust = class {
+	constructor() {}
+	/** The signal for one concept under `config`; hashes only when a human entry is bound by an allowed actor. */
+	static signal = signal;
+	/** The signal for every concept in a bundle, keyed by concept id. */
+	static signals = signals;
+	/** Pure integrity decision; no hashing. `content` may be `undefined` only when {@link Trust.needsDigest} is false. */
+	static evaluate = evaluate;
+	/** True iff the latest human entry is bound by `integrity.verified` and its actor passes the allow-list, i.e. a digest is needed. */
+	static needsDigest = needsDigest;
+	/** The {@link EvaluateInput} of a loaded concept. */
+	static inputOf = inputOf;
+	/**
+	* `verified-drift` diagnostics for drifted concepts (drafts and deprecated concepts are exempt: `okfit verify` refuses them); `[]` (no hashing) when the severity is `off`.
+	* Given `signals` (from {@link Trust.signals}) it reuses each concept's entry and hashes nothing for it;
+	* a concept absent from `signals` falls back to computing its own signal (hashing if it needs a digest).
+	*/
+	static lint = lint;
+};
+
+//#endregion
+export { DriftReason, Trust };

package/index.d.ts

@@ -1,6 +1,6 @@
 import { Context, Crypto, DateTime, Effect, FileSystem, Layer, Option, Path, PlatformError, Schema } from "effect";
 import { Git, GitCommandError, NotARepositoryError, UnknownRefError } from "@effected/git";
-import { Actor, Diagnostic, DiagnosticRange, LoadedBundle, LoadedConcept, OkfitConfig } from "@okfit/core";
+import { Actor, Diagnostic, DiagnosticRange, Digest, LoadedBundle, LoadedConcept, OkfitConfig, TrustTier } from "@okfit/core";
 import { ChildProcessSpawner } from "effect/process";
 //#region src/BodyProvenance.d.ts
 /**
@@ -60,6 +60,22 @@ export type BodyProvenance = typeof BodyProvenance.Type;
  */
 type UncommittedReason = typeof BodyUncommitted.fields.reason.Type;
 //#endregion
+//#region src/Canonical.d.ts
+/**
+ * Canonical encoding for okfit's content digest.
+ *
+ * @public
+ */
+export declare class Canonical {
+  private constructor();
+  /** Top-level frontmatter keys excluded from the content digest. */
+  static readonly EXCLUDED_KEYS: ReadonlySet<string>;
+  /** Canonical JSON: sorted keys at every depth, array order kept; a `bigint` is its bare decimal literal. */
+  static readonly json: (value: unknown) => string;
+  /** The exact string a content digest hashes. */
+  static readonly contentInput: (raw: Readonly<Record<string, unknown>>, source: string) => string;
+}
+//#endregion
 //#region src/GitHistory.d.ts
 declare const PathHistoryEntry_base: Schema.Class<PathHistoryEntry, Schema.Struct<{
   readonly sha: Schema.String;
@@ -178,6 +194,31 @@ declare const AgentActorUnconfiguredError_base: Schema.Class<AgentActorUnconfigu
 export declare class AgentActorUnconfiguredError extends AgentActorUnconfiguredError_base {
   get message(): string;
 }
+declare const ActorConfigInvalidError_base: Schema.Class<ActorConfigInvalidError, Schema.TaggedStruct<"ActorConfigInvalidError", {
+  readonly value: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * `git config okfit.actor` is set but is not a `human:<id>` actor without `@`
+ * or glob characters. The value stays on the person's machine; okfit never
+ * writes it anywhere.
+ *
+ * @public
+ */
+export declare class ActorConfigInvalidError extends ActorConfigInvalidError_base {
+  get message(): string;
+}
+declare const HumanActorNotAllowedError_base: Schema.Class<HumanActorNotAllowedError, Schema.TaggedStruct<"HumanActorNotAllowedError", {
+  readonly actor: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The resolved human is not on a non-empty `[actors].humans` allow-list, so it
+ * may not verify or revoke (spec section 8).
+ *
+ * @public
+ */
+export declare class HumanActorNotAllowedError extends HumanActorNotAllowedError_base {
+  get message(): string;
+}
 /**
  * Options for {@link Derivation.generatedAt} (P-39).
  *
@@ -214,7 +255,13 @@ interface GeneratedByOptions {
  *
  * @public
  */
-type GeneratedByError = AgentActorUnconfiguredError | HumanActorUnresolvedError | GitCommandError | NotARepositoryError | UnknownRefError;
+type GeneratedByError = ActorConfigInvalidError | AgentActorUnconfiguredError | HumanActorUnresolvedError | GitCommandError | NotARepositoryError | UnknownRefError;
+/**
+ * Everything {@link Derivation.verifier} can fail with.
+ *
+ * @public
+ */
+type VerifierError = GeneratedByError | HumanActorNotAllowedError;
 /**
  * Trimmed `user.name` / `user.email` as `Git.configGet` answers them; a key is absent when git has no value.
  *
@@ -240,11 +287,32 @@ export declare class Derivation {
    */
   static readonly body: (text: string) => string;
   /**
-   * Lowercase 64-char hex sha256 of `Derivation.body(text)`, through `effect`'s platform-agnostic
-   * `Crypto` service (issue #19). Same normalization as `body`, so a frontmatter-only edit or a
-   * `core.autocrlf` worktree never changes the digest.
+   * Full lowercase 64-char hex sha256 of a string. Tests only.
+   *
+   * @internal
+   */
+  static readonly digestFull: (text: string) => Effect.Effect<string, PlatformError.PlatformError, Crypto.Crypto>;
+  /**
+   * The okfit digest of a string: the first 16 lowercase hex characters of its SHA-256, through
+   * `effect`'s platform-agnostic `Crypto` service.
+   */
+  static readonly digest: (text: string) => Effect.Effect<Digest, PlatformError.PlatformError, Crypto.Crypto>;
+  /**
+   * 16-hex digest of `Derivation.body(source)` (issue #19). Same normalization as `body`, so a
+   * frontmatter-only edit or a `core.autocrlf` worktree never changes the digest.
+   */
+  static readonly bodyDigest: (source: string) => Effect.Effect<Digest, PlatformError.PlatformError, Crypto.Crypto>;
+  /**
+   * The body digest recorded for a generated concept: `integrity.generated.body`, else the legacy
+   * `generated.body_sha256` cut to its first 16 hex characters. `undefined` when neither is present.
+   * Pure; every "is the stamped body still current" comparison reads through this.
+   */
+  static readonly recordedBody: (concept: LoadedConcept) => string | undefined;
+  /**
+   * 16-hex digest of the canonical content input (`Canonical.contentInput`): authored frontmatter
+   * plus the normalised body, insensitive to style, key order and CRLF.
    */
-  static readonly bodyDigest: (text: string) => Effect.Effect<string, PlatformError.PlatformError, Crypto.Crypto>;
+  static readonly contentDigest: (raw: Readonly<Record<string, unknown>>, source: string) => Effect.Effect<Digest, PlatformError.PlatformError, Crypto.Crypto>;
   /**
    * Spec 5.4 rule 2 as P-2 (DERIVE option C). Steps:
    *  1. `root = Git.repoRoot(dirname(file))`: a file outside any repository surfaces `NotARepositoryError`;
@@ -265,18 +333,30 @@ export declare class Derivation {
   static readonly generatedAt: (options: GeneratedAtOptions) => Effect.Effect<BodyProvenance, GeneratedAtError, Git | GitHistory | FileSystem.FileSystem | Path.Path>;
   /**
    * P-13 / P-14, pure. Candidates: the email local part (returned as written, lower-cased only for matching)
-   * and the `user.name` slug. Order, first hit wins: (1) a `human:` entry of `humans` whose id equals a
-   * candidate case-insensitively, returned verbatim; (2) `human:<local>`; (3) `human:<slug>`; (4) none.
+   * and the `user.name` slug. Order, first hit wins: (1) a literal `human:` entry of `humans` (glob entries,
+   * those with `*` or `?`, are skipped) whose id equals a candidate case-insensitively, returned verbatim; (2) `human:<local>`; (3) `human:<slug>`; (4) none.
    * The result is branded through core's `Actor` codec and always passes it.
    */
-  static readonly humanActorId: (identity: GitIdentity, humans: ReadonlyArray<Actor>) => Option.Option<Actor>;
+  static readonly humanActorId: (identity: GitIdentity, humans: ReadonlyArray<string>) => Option.Option<Actor>;
   /**
    * Spec 5.4 rule 1 (P-16, P-45). `"agent"`: `config.actors.agent`, else {@link AgentActorUnconfiguredError}
-   * (P-17). `"human"`: `Git.configGet(cwd, "user.name")` and `Git.configGet(cwd, "user.email")` in merged
+   * (P-17). `"human"`: first `Git.configGet(cwd, "okfit.actor")`, which wins when set and must be a
+   * `human:<id>` with no `@` or glob ({@link ActorConfigInvalidError} otherwise), returned in the spelling of an exact `[actors].humans` entry that equals it case-insensitively (P-14); else `Git.configGet(cwd, "user.name")` and `Git.configGet(cwd, "user.email")` in merged
    * scope (P-15) through {@link Derivation.humanActorId}; none is {@link HumanActorUnresolvedError}.
    * Answers only "who is writing now" (P-40).
    */
   static readonly generatedBy: (options: GeneratedByOptions) => Effect.Effect<Actor, GeneratedByError, Git>;
+  /**
+   * The human allowed to verify now: {@link Derivation.generatedBy} for a human
+   * writer, then the `[actors].humans` allow-list (`Actor.allowed`): empty or
+   * absent allows anyone, otherwise the actor must match an entry or this fails
+   * {@link HumanActorNotAllowedError}. `okfit verify`, `--revoke` and the LSP
+   * verify actions all resolve through this.
+   */
+  static readonly verifier: (options: {
+    readonly cwd: string;
+    readonly config: OkfitConfig;
+  }) => Effect.Effect<Actor, VerifierError, Git>;
   /**
    * P-19, pure: `from` plus `config.lifecycle.default_stale_after`, falling back to `OkfitConfig.DEFAULTS`'
    * 90 days. `from` is the caller's: `generated.at` when committed, else its own `now`.
@@ -431,17 +511,20 @@ export declare class Profiles {
  * like every other lint (S-7). `Profile.check` and `ProfileDiagnosticCode`
  * are unchanged.
  *
- * Two tiers per concept (issue #19, body-digest design): when
- * `generated.body_sha256` is present, drift is decided ENTIRELY by comparing it to
+ * Two tiers per concept (issue #19, body-digest design): when a body digest
+ * is recorded (`integrity.generated.body`, else the 16-hex prefix of a legacy
+ * `generated.body_sha256`, via `Derivation.recordedBody`), drift is decided
+ * ENTIRELY by comparing it to
  * `Derivation.bodyDigest` of the concept's current source -- no git call at
  * all, so this works for a dirty worktree too (that is the point: an edited
  * body is caught immediately, before it is even committed) and survives a
  * squash/rebase merge that only rewrites commit dates, since the body
- * itself, and therefore its digest, never changed. When `body_sha256` is
- * absent (an un-migrated concept), this falls back to the original
+ * itself, and therefore its digest, never changed. When no digest is recorded
+ * at all (a concept `okfit sync` has never stamped), this falls back to the original
  * git-derived date comparison against `Derivation.generatedAt`, preserving
  * `--skip-provenance`'s meaning for bundles that have not run `okfit sync`
- * since this field was introduced.
+ * since the digest was introduced. The drift message names the field the
+ * recorded value came from, so a legacy concept reads `generated.body_sha256`.
  *
  * The tier-2 fallback returns `[]` the moment a `NotARepositoryError`
  * surfaces: a bundle outside git has nothing to derive for any concept still
@@ -459,8 +542,8 @@ export declare class Profiles {
  * calling at all; the two agree by construction (both skip the walk).
  *
  * A third, optional options argument carries `skipGitTier`: when `true`, a
- * concept that falls through to tier 2 (no `generated.body_sha256`
- * recorded) is skipped entirely -- no `Derivation.generatedAt` call, no
+ * concept that falls through to tier 2 (no body digest recorded) is
+ * skipped entirely -- no `Derivation.generatedAt` call, no
  * git spawn at all -- while tier 1 still runs, unaffected, for every
  * concept that DOES carry a digest. This is a runtime skip, not a
  * type-level narrowing: the R channel still lists `Git | GitHistory` even
@@ -499,13 +582,13 @@ export declare const PUBLICATION_TYPE: "Publication";
 interface RendersEntry {
   readonly index: number;
   readonly path: string;
-  readonly body_sha256?: string;
+  readonly body?: string;
 }
 /**
  * A profiles-owned lint over Publication concepts: `publication-orphan` when a
  * `surface` or `renders[].path` does not resolve to a bundle concept (or
  * `renders` is malformed), and `publication-drift` when a rendered source's
- * body digest no longer matches the stamped `body_sha256`. Total over
+ * body digest no longer matches the stamped `renders[].body`. Total over
  * severity: returns `[]` before any digest work when both codes are `"off"`.
  *
  * @public
@@ -520,5 +603,98 @@ export declare class Publications {
   static readonly lint: (bundle: LoadedBundle, config: OkfitConfig) => Effect.Effect<ReadonlyArray<Diagnostic>, PlatformError.PlatformError, Crypto.Crypto>;
 }
 //#endregion
-export type { DocsPreset, GeneratedAtError, GeneratedAtOptions, GeneratedByError, GeneratedByOptions, GitHistoryShape, GitIdentity, Layout, LayoutDirectory, PathLogOptions, Profile, ProfileName, RendersEntry, SurfaceTemplate, UncommittedReason, Writer };
+//#region src/Trust.d.ts
+/**
+ * Whether a concept's human verification still covers its content: `none` (no
+ * `human:` entry in `verified`), `current` (the latest human entry is bound by
+ * `integrity.verified` and the content digest still matches), or `drifted`.
+ *
+ * @public
+ */
+type IntegrityState = "current" | "drifted" | "none";
+/**
+ * Why a human verification no longer binds: the content changed, the entry has
+ * no `integrity.verified` binding, a later human entry is not the bound one, or
+ * the bound actor fails a non-empty `[actors].humans` allow-list.
+ *
+ * @public
+ */
+export declare const DriftReason: Schema.Literals<readonly ["content-changed", "unbound", "entry-superseded", "actor-not-allowed"]>;
+/**
+ * The type of {@link (DriftReason:variable)}.
+ * @public
+ */
+export type DriftReason = typeof DriftReason.Type;
+/**
+ * The trust signal for one concept: its tier, whether its human verification
+ * still binds, and staleness. `drift` is present only when `integrity` is
+ * `drifted`.
+ *
+ * @public
+ */
+interface ConceptSignal {
+  readonly tier: TrustTier;
+  readonly integrity: IntegrityState;
+  readonly drift?: {
+    readonly reason: DriftReason;
+    readonly editedBy?: Actor;
+    readonly editedAt?: string;
+  };
+  readonly stale: boolean;
+}
+/**
+ * What the integrity decision reads from a concept: its `verified` entries, the
+ * `integrity.verified` binding, and `generated`. Built by {@link Trust.inputOf}.
+ *
+ * @public
+ */
+interface EvaluateInput {
+  readonly verified: ReadonlyArray<{
+    readonly by: Actor;
+    readonly at: DateTime.Utc;
+  }>;
+  readonly binding: {
+    readonly by: Actor;
+    readonly at: DateTime.Utc;
+    readonly content: string;
+  } | undefined;
+  readonly generated: {
+    readonly by: Actor;
+    readonly at?: DateTime.Utc;
+  } | undefined;
+  /** The `[actors].humans` allow-list; empty allows anyone. */
+  readonly humans: ReadonlyArray<string>;
+}
+/**
+ * The integrity trust signal: whether a human verification still binds the
+ * content it covered, and the `verified-drift` lint built on it. A signal, not
+ * a tamper seal. Named `Trust` so it does not collide with core's `Integrity`
+ * schema.
+ *
+ * @public
+ */
+export declare class Trust {
+  private constructor();
+  /** The signal for one concept under `config`; hashes only when a human entry is bound by an allowed actor. */
+  static readonly signal: (concept: LoadedConcept, config: OkfitConfig, now: DateTime.Utc) => Effect.Effect<ConceptSignal, PlatformError.PlatformError, Crypto.Crypto>;
+  /** The signal for every concept in a bundle, keyed by concept id. */
+  static readonly signals: (bundle: LoadedBundle, config: OkfitConfig, now: DateTime.Utc) => Effect.Effect<Map<string, ConceptSignal>, PlatformError.PlatformError, Crypto.Crypto>;
+  /** Pure integrity decision; no hashing. `content` may be `undefined` only when {@link Trust.needsDigest} is false. */
+  static readonly evaluate: (input: EvaluateInput, content: string | undefined) => {
+    readonly integrity: IntegrityState;
+    readonly drift?: NonNullable<ConceptSignal["drift"]>;
+  };
+  /** True iff the latest human entry is bound by `integrity.verified` and its actor passes the allow-list, i.e. a digest is needed. */
+  static readonly needsDigest: (input: EvaluateInput) => boolean;
+  /** The {@link EvaluateInput} of a loaded concept. */
+  static readonly inputOf: (concept: LoadedConcept, config: OkfitConfig) => EvaluateInput;
+  /**
+   * `verified-drift` diagnostics for drifted concepts (drafts and deprecated concepts are exempt: `okfit verify` refuses them); `[]` (no hashing) when the severity is `off`.
+   * Given `signals` (from {@link Trust.signals}) it reuses each concept's entry and hashes nothing for it;
+   * a concept absent from `signals` falls back to computing its own signal (hashing if it needs a digest).
+   */
+  static readonly lint: (bundle: LoadedBundle, config: OkfitConfig, now: DateTime.Utc, signals?: ReadonlyMap<string, ConceptSignal>) => Effect.Effect<Array<Diagnostic>, PlatformError.PlatformError, Crypto.Crypto>;
+}
+//#endregion
+export type { ConceptSignal, DocsPreset, EvaluateInput, GeneratedAtError, GeneratedAtOptions, GeneratedByError, GeneratedByOptions, GitHistoryShape, GitIdentity, IntegrityState, Layout, LayoutDirectory, PathLogOptions, Profile, ProfileName, RendersEntry, SurfaceTemplate, UncommittedReason, VerifierError, Writer };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,9 +1,11 @@
 import { BodyCommitted, BodyProvenance, BodyUncommitted } from "./BodyProvenance.js";
+import { Canonical } from "./Canonical.js";
 import { GitHistory, GitHistoryError, PathHistoryEntry } from "./GitHistory.js";
-import { AgentActorUnconfiguredError, Derivation, HumanActorUnresolvedError } from "./Derivation.js";
+import { ActorConfigInvalidError, AgentActorUnconfiguredError, Derivation, HumanActorNotAllowedError, HumanActorUnresolvedError } from "./Derivation.js";
 import { PROFILE_NAMES, ProfileDiagnostic, ProfileDiagnosticCode } from "./Profile.js";
 import { Profiles } from "./Profiles.js";
 import { Provenance } from "./Provenance.js";
 import { PUBLICATION_TYPE, Publications, SURFACE_TYPE } from "./Publications.js";
+import { DriftReason, Trust } from "./Trust.js";
 
-export { AgentActorUnconfiguredError, BodyCommitted, BodyProvenance, BodyUncommitted, Derivation, GitHistory, GitHistoryError, HumanActorUnresolvedError, PROFILE_NAMES, PUBLICATION_TYPE, PathHistoryEntry, ProfileDiagnostic, ProfileDiagnosticCode, Profiles, Provenance, Publications, SURFACE_TYPE };
+export { ActorConfigInvalidError, AgentActorUnconfiguredError, BodyCommitted, BodyProvenance, BodyUncommitted, Canonical, Derivation, DriftReason, GitHistory, GitHistoryError, HumanActorNotAllowedError, HumanActorUnresolvedError, PROFILE_NAMES, PUBLICATION_TYPE, PathHistoryEntry, ProfileDiagnostic, ProfileDiagnosticCode, Profiles, Provenance, Publications, SURFACE_TYPE, Trust };

package/internal/body.js

@@ -0,0 +1,13 @@
+import { FrontmatterSource } from "@effected/markdown";
+
+//#region src/internal/body.ts
+const normalise = (text) => text.replace(/\r\n?/g, "\n").trimEnd();
+/**
+* The normalised body of a concept source (`FrontmatterSource.split(text).body`, then P-6 normalisation).
+*
+* @internal
+*/
+const body = (text) => normalise(FrontmatterSource.split(text).body);
+
+//#endregion
+export { body };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@okfit/profiles",
-	"version": "0.9.0",
+	"version": "0.10.0",
 	"private": false,
 	"description": "Named OKF configuration profiles for okfit, starting with the software-project profile.",
 	"keywords": [
@@ -35,9 +35,9 @@
 		"./package.json": "./package.json"
 	},
 	"peerDependencies": {
-		"@effected/git": "^0.20.0",
-		"@effected/markdown": "^0.15.0",
-		"@okfit/core": "^0.9.0",
+		"@effected/git": "^0.21.0",
+		"@effected/markdown": "^0.16.0",
+		"@okfit/core": "^0.10.0",
 		"effect": "^4.0.0"
 	},
 	"engines": {