@openpond/evals 0.11.21 → 0.12.0

package/README.md

@@ -163,6 +163,18 @@ overrides that state.
 
 ## Runtime adapters
 
+Graders may declare `taskIds` to apply to a nonempty, unique population within
+the Taskset. Grading binds the full grader-set hash while executing and
+aggregating only the applicable checks. Reward binding sources carry the same
+scope; scoped compositions retain `taskId` and an explicit `not_applicable`
+result for each excluded source. Excluded checks cannot satisfy a required check
+or change the score, and a composition without its scope is rejected.
+
+`@openpond/evals/connected-evidence/git` verifies retained Git starting-file
+receipts against exact object identities and bytes. The receipt is evidence,
+not authorization to read a repository. Hosts remain responsible for owner
+authorization, dependency closure, and runtime qualification.
+
 Implement `HarnessRuntime` for environment state and `HarnessExecutor` around
 the host's existing model/Agent loop. Do not reimplement prompting, tool dispatch,
 session persistence, cost accounting, cancellation, or cleanup in this package.

package/dist/connected-evidence/codex-command-observations.js

@@ -0,0 +1,81 @@
+import { parse } from "acorn";
+const ast = (value) => {
+    if (!value || typeof value !== "object" || !("type" in value))
+        throw new Error("connected_command_syntax_unsupported");
+    return value;
+};
+function member(value, object, property) {
+    const node = ast(value);
+    return node.type === "MemberExpression" && !node.computed && !node.optional
+        && ast(node.object).type === "Identifier" && ast(node.object).name === object
+        && ast(node.property).type === "Identifier" && ast(node.property).name === property;
+}
+/** Interpret recorded syntax, never execute source code. Only sequential static
+ * exec_command calls have an unambiguous correspondence with retained results. */
+export function recordedCodexCommands(source) {
+    if (source.length > 128_000)
+        throw new Error("connected_command_syntax_limit");
+    const program = parse(source, { ecmaVersion: "latest", sourceType: "module" });
+    const commands = [];
+    for (const statement of program.body) {
+        const outer = ast(ast(statement).expression);
+        const args = outer.arguments;
+        if (statement.type !== "ExpressionStatement" || outer.type !== "CallExpression" || outer.optional
+            || ast(outer.callee).type !== "Identifier" || ast(outer.callee).name !== "text" || args.length !== 1)
+            throw new Error("connected_command_syntax_unsupported");
+        const awaited = ast(args[0]);
+        const call = ast(awaited.argument);
+        const innerArgs = call.arguments;
+        if (awaited.type !== "AwaitExpression" || call.type !== "CallExpression" || call.optional
+            || !member(call.callee, "tools", "exec_command") || innerArgs.length !== 1)
+            throw new Error("connected_command_syntax_unsupported");
+        const object = ast(innerArgs[0]);
+        if (object.type !== "ObjectExpression")
+            throw new Error("connected_command_syntax_unsupported");
+        const values = new Map();
+        for (const raw of object.properties) {
+            const property = ast(raw), key = ast(property.key), value = ast(property.value);
+            const name = key.type === "Identifier" ? key.name : key.type === "Literal" ? key.value : null;
+            if (property.type !== "Property" || property.computed || property.method || property.shorthand || property.kind !== "init"
+                || typeof name !== "string" || values.has(name) || value.type !== "Literal"
+                || !["cmd", "workdir", "max_output_tokens", "yield_time_ms"].includes(name))
+                throw new Error("connected_command_syntax_unsupported");
+            values.set(name, value.value);
+        }
+        const cmd = values.get("cmd"), budget = values.get("max_output_tokens"), cwd = values.get("workdir");
+        if (typeof cmd !== "string" || !cmd.length || cmd.length > 16_000
+            || typeof budget !== "number" || !Number.isInteger(budget) || budget <= 0 || budget > 100_000
+            || cwd !== undefined && typeof cwd !== "string")
+            throw new Error("connected_command_syntax_unsupported");
+        commands.push({ cmd, maxOutputTokens: budget, cwd: typeof cwd === "string" ? cwd : null });
+    }
+    if (!commands.length || commands.length > 20)
+        throw new Error("connected_command_syntax_unsupported");
+    return commands;
+}
+/** This deliberately bounded read-only prefix establishes that no earlier
+ * recorded command modified the checkout before the status observation. */
+export function isRecordedReadOnlyInventory(cmd) {
+    return cmd === "pwd" || /^pwd && rg --files(?: -g '[a-zA-Z0-9_.*\/-]+')*$/.test(cmd);
+}
+export function recordedCodexCommandResults(value, count) {
+    if (!Array.isArray(value) || value.length !== count + 1)
+        throw new Error("connected_command_results_incomplete");
+    const blocks = value.map(block => {
+        if (!block || typeof block !== "object" || !("type" in block) || block.type !== "input_text"
+            || !("text" in block) || typeof block.text !== "string")
+            throw new Error("connected_command_results_incomplete");
+        return block.text;
+    });
+    if (!/^Script completed\nWall time [0-9.]+ seconds\nOutput:\n$/.test(blocks[0]))
+        throw new Error("connected_command_results_incomplete");
+    return blocks.slice(1).map(text => {
+        const result = JSON.parse(text);
+        if (!result || typeof result !== "object" || !("exit_code" in result) || result.exit_code !== 0
+            || "session_id" in result || !("output" in result) || typeof result.output !== "string"
+            || !("original_token_count" in result) || typeof result.original_token_count !== "number"
+            || !Number.isSafeInteger(result.original_token_count) || result.original_token_count < 0)
+            throw new Error("connected_command_results_incomplete");
+        return { output: result.output, originalTokenCount: result.original_token_count };
+    });
+}

package/dist/connected-evidence/contracts.js

@@ -29,11 +29,24 @@ export const ConnectedBoundarySchema = z.object({
         process: z.enum(["retained", "partial", "absent"]), artifacts: z.enum(["retained", "references_only", "absent"]),
         replay: z.literal("unavailable"), gaps: z.array(z.string().max(500)).max(100) }).strict(),
 }).strict();
+/** Source-reported repository identity is reconstruction evidence, not an
+ * admitted checkout or proof that the working tree was clean. */
+export const ConnectedRepositoryContextSchema = z.object({
+    schemaVersion: z.literal("openpond.connectedRepositoryContext.v1"),
+    kind: z.literal("git"),
+    commitHash: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/),
+    branch: z.string().min(1).max(500).nullable(),
+    recordedAt: Time,
+    sourceFileHash: Hash,
+    metadataHash: Hash,
+    workingDirectoryHash: Hash.optional(),
+}).strict();
 export const ConnectedSessionSchema = z.object({
     schemaVersion: z.literal(CONNECTED_EVIDENCE_VERSION), normalizerVersion: z.literal(CONNECTED_NORMALIZER_VERSION),
     origin: ConnectedSourceKindSchema, sessionId: Id, branchId: Id.nullable(), parentSessionId: Id.nullable(),
     exporterVersion: z.string().max(200).nullable(),
     acquisition: z.object({ machineId: Id, sourceInstanceId: Id }).strict().optional(),
+    repositoryContext: ConnectedRepositoryContextSchema.optional(),
     sourceFiles: z.array(z.object({ path: Id, contentHash: Hash, sizeBytes: z.number().int().nonnegative() }).strict()).max(CONNECTED_EVIDENCE_LIMITS.files),
     events: z.array(ConnectedEventSchema).max(CONNECTED_EVIDENCE_LIMITS.events),
     unmappedEvents: z.array(ConnectedEventSchema).max(CONNECTED_EVIDENCE_LIMITS.events),

package/dist/connected-evidence/git-file-contracts.js

@@ -0,0 +1,16 @@
+import { z } from "zod";
+const ObjectHash = z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/);
+const Base64 = z.string().max(3_000_000);
+const ObjectBytes = z.object({ hash: ObjectHash, base64: Base64 }).strict();
+const safePath = (path) => !/[\x00-\x1f\x7f]/.test(path) && !path.startsWith("/") && !path.includes("\\")
+    && path.split("/").length <= 32 && path.split("/").every(part => part && part !== "." && part !== ".."
+    && part !== ".git" && !part.startsWith(".env"));
+/** A Git object proof pins bytes to recorded history. It does not establish
+ * that the historical working tree was clean or that these are all dependencies. */
+export const ConnectedGitFileProofSchema = z.object({
+    schemaVersion: z.literal("openpond.connectedGitFileProof.v1"),
+    path: z.string().min(1).max(1_000).refine(safePath),
+    commit: ObjectBytes,
+    trees: z.array(ObjectBytes).min(1).max(32),
+    contentsBase64: Base64,
+}).strict();

package/dist/connected-evidence/git-file-proof.js

@@ -0,0 +1,86 @@
+import { createHash } from "node:crypto";
+import { ConnectedGitFileProofSchema } from "./git-file-contracts.js";
+export * from "./git-file-contracts.js";
+import { ConnectedRepositoryContextSchema } from "./contracts.js";
+function bytes(base64, limit) {
+    const value = Buffer.from(base64, "base64");
+    if (value.toString("base64") !== base64 || value.byteLength > limit)
+        throw new Error("connected_git_object_bytes_invalid");
+    return value;
+}
+function objectHash(kind, value, width) {
+    return createHash(width === 40 ? "sha1" : "sha256")
+        .update(`${kind} ${value.byteLength}\0`).update(value).digest("hex");
+}
+function treeEntry(tree, name, width) {
+    let offset = 0;
+    const names = new Set();
+    let found = null;
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    while (offset < tree.byteLength) {
+        const space = tree.indexOf(32, offset), nul = tree.indexOf(0, space + 1);
+        const end = nul + 1 + width / 2;
+        if (space < offset || nul < space || end > tree.byteLength)
+            throw new Error("connected_git_tree_invalid");
+        const mode = tree.subarray(offset, space).toString("ascii");
+        const entryName = decoder.decode(tree.subarray(space + 1, nul));
+        if (!entryName || entryName.includes("/") || names.has(entryName))
+            throw new Error("connected_git_tree_invalid");
+        names.add(entryName);
+        if (entryName === name)
+            found = { mode, hash: tree.subarray(nul + 1, end).toString("hex") };
+        offset = end;
+    }
+    if (!found)
+        throw new Error("connected_git_path_missing");
+    return found;
+}
+/** The caller must supply repositoryContext from an authorized, hash-verified
+ * connected snapshot. No filesystem access or caller-selected Git command occurs. */
+export function verifyConnectedGitFileProof(repositoryContext, raw) {
+    const context = ConnectedRepositoryContextSchema.parse(repositoryContext);
+    const proof = ConnectedGitFileProofSchema.parse(raw);
+    const width = context.commitHash.length;
+    const commit = bytes(proof.commit.base64, 256 * 1024);
+    if (proof.commit.hash !== context.commitHash || objectHash("commit", commit, width) !== context.commitHash)
+        throw new Error("connected_git_commit_mismatch");
+    const firstNewline = commit.indexOf(10);
+    if (firstNewline < 0)
+        throw new Error("connected_git_commit_invalid");
+    const firstLine = commit.subarray(0, firstNewline).toString("ascii");
+    if (!new RegExp(`^tree [a-f0-9]{${width}}$`).test(firstLine))
+        throw new Error("connected_git_commit_invalid");
+    const trees = new Map();
+    let totalBytes = commit.byteLength;
+    for (const object of proof.trees) {
+        const value = bytes(object.base64, 2 * 1024 * 1024);
+        totalBytes += value.byteLength;
+        if (totalBytes > 8 * 1024 * 1024 || trees.has(object.hash) || object.hash.length !== width
+            || objectHash("tree", value, width) !== object.hash)
+            throw new Error("connected_git_tree_mismatch");
+        trees.set(object.hash, value);
+    }
+    const parts = proof.path.split("/");
+    const visited = new Set();
+    let hash = firstLine.slice(5);
+    let mode = "";
+    for (const [index, part] of parts.entries()) {
+        const tree = trees.get(hash);
+        if (!tree || visited.has(hash))
+            throw new Error("connected_git_tree_missing");
+        visited.add(hash);
+        const entry = treeEntry(tree, part, width);
+        mode = entry.mode;
+        if (index < parts.length - 1 ? mode !== "40000" : !["100644", "100755"].includes(mode))
+            throw new Error("connected_git_file_mode_invalid");
+        hash = entry.hash;
+    }
+    if (visited.size !== trees.size)
+        throw new Error("connected_git_unreferenced_tree");
+    const content = bytes(proof.contentsBase64, 2 * 1024 * 1024);
+    if (objectHash("blob", content, width) !== hash)
+        throw new Error("connected_git_blob_mismatch");
+    return { path: proof.path, commitHash: context.commitHash, gitObjectHash: hash, mode,
+        sizeBytes: content.byteLength, sha256: createHash("sha256").update(content).digest("hex"),
+        contentsBase64: content.toString("base64") };
+}

package/dist/connected-evidence/git-starting-state.js

@@ -0,0 +1,81 @@
+import { contentHash } from "@openpond/harness";
+import { ConnectedSessionSchema, resolveConnectedBoundaryMetadata } from "./contracts.js";
+import { recordedCodexCommands, recordedCodexCommandResults, isRecordedReadOnlyInventory } from "./codex-command-observations.js";
+import { verifyConnectedGitFileProof } from "./git-file-proof.js";
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("connected_starting_state_unavailable");
+    return value;
+}
+function dirtyPaths(output) {
+    const paths = [];
+    for (const line of output.split("\n")) {
+        if (!line)
+            continue;
+        // Quoted/escaped paths and rename pairs need a distinct binary porcelain
+        // protocol. Treat them as unavailable instead of guessing path identities.
+        if (!/^[ MADRCU?!]{2} [^\x00-\x1f\x7f]+$/.test(line) || line.slice(3).includes('"')
+            || line.slice(3).includes(" -> ") || line.slice(3).includes("\\"))
+            throw new Error("connected_git_status_format_unsupported");
+        const path = line.slice(3);
+        if (path.startsWith("/") || path.split("/").some(part => part === "." || part === ".."))
+            throw new Error("connected_git_status_format_unsupported");
+        paths.push(path.replace(/\/$/, ""));
+    }
+    return paths;
+}
+/** Verify only the original first-tool boundary. Later requests need their own
+ * captured state. Both the repository context and observations come from the
+ * authorized immutable snapshot, never caller-supplied cleanliness claims. */
+export function verifyConnectedGitStartingAssets(input) {
+    const session = ConnectedSessionSchema.parse(input.session);
+    const boundary = resolveConnectedBoundaryMetadata(session, input.boundaryId);
+    const context = session.repositoryContext;
+    if (session.origin !== "codex" || !context?.workingDirectoryHash || !context.recordedAt || boundary.projection !== "turn"
+        || !session.sourceFiles.some(file => file.contentHash === context.sourceFileHash)
+        || !input.proofs.length || input.proofs.length > 100)
+        throw new Error("connected_starting_state_unavailable");
+    const firstCallIndex = session.events.findIndex(event => event.kind === "tool_call");
+    if (firstCallIndex <= boundary.start || firstCallIndex >= boundary.end
+        || session.events.slice(0, firstCallIndex).some(event => event.kind === "compaction"))
+        throw new Error("connected_starting_state_boundary_unavailable");
+    const callEvent = session.events[firstCallIndex];
+    const requestEvent = session.events[boundary.start];
+    if (!callEvent.occurredAt || !requestEvent.occurredAt
+        || Date.parse(requestEvent.occurredAt) < Date.parse(context.recordedAt)
+        || Date.parse(callEvent.occurredAt) < Date.parse(requestEvent.occurredAt))
+        throw new Error("connected_starting_state_observation_time_unavailable");
+    const call = object(callEvent.content);
+    if (call.name !== "exec" || typeof call.input !== "string" || !callEvent.callId)
+        throw new Error("connected_starting_state_command_unsupported");
+    const commands = recordedCodexCommands(call.input);
+    const statusIndex = commands.findIndex(command => command.cmd === "git status --short");
+    if (statusIndex !== commands.length - 1 || statusIndex < 1
+        || commands.some(command => command.cwd !== null)
+        || !commands.slice(0, statusIndex).every(command => isRecordedReadOnlyInventory(command.cmd)))
+        throw new Error("connected_starting_state_command_unsupported");
+    const observations = session.events.slice(firstCallIndex + 1, boundary.end);
+    const resultIndex = observations.findIndex(event => event.kind === "tool_result" && event.callId === callEvent.callId);
+    if (resultIndex < 0 || observations.slice(0, resultIndex).some(event => ["tool_call", "tool_result", "compaction", "message"].includes(event.kind))
+        || observations.filter(event => event.kind === "tool_result" && event.callId === callEvent.callId).length !== 1)
+        throw new Error("connected_starting_state_observation_unavailable");
+    const resultEvent = observations[resultIndex];
+    const results = recordedCodexCommandResults(resultEvent.content, commands.length);
+    if (results.some((result, index) => result.originalTokenCount >= commands[index].maxOutputTokens
+        || /output truncated|truncated output|\[\.\.\./i.test(result.output)))
+        throw new Error("connected_starting_state_observation_truncated");
+    if (contentHash(results[0].output.split("\n")[0]) !== context.workingDirectoryHash)
+        throw new Error("connected_starting_state_directory_mismatch");
+    const dirty = dirtyPaths(results[statusIndex].output);
+    const assets = input.proofs.map(proof => verifyConnectedGitFileProof(context, proof));
+    if (new Set(assets.map(asset => asset.path)).size !== assets.length)
+        throw new Error("connected_starting_state_duplicate_path");
+    for (const asset of assets)
+        if (dirty.some(path => asset.path === path || asset.path.startsWith(path + "/")))
+            throw new Error("connected_starting_state_selected_file_modified");
+    return { schemaVersion: "openpond.connectedGitStartingAssets.v1",
+        sessionHash: session.contentHash, boundaryId: boundary.id, inputHash: boundary.inputHash,
+        revisionHash: boundary.revisionHash, commitHash: context.commitHash,
+        observationHash: contentHash({ call: callEvent, result: resultEvent }),
+        selectedPathsUnmodified: true, dependencyClosureQualified: false, assets };
+}

package/dist/connected-evidence/git.js

@@ -0,0 +1,2 @@
+export * from "./git-file-proof.js";
+export * from "./git-starting-state.js";

package/dist/connected-evidence/imports.js

@@ -10,7 +10,7 @@ import { parseClaudeSession } from "./sources/claude-code.js";
 import { parseHermesEvidence, parseOpenClawEvidence, } from "./sources/history.js";
 /** Cache identity includes source projection policy, independent of file mtimes. */
 export function agentImportNormalizerRevision(source) {
-    return source === "codex" ? `${CONNECTED_NORMALIZER_VERSION}/${CODEX_AUTHORIZATION_PROJECTION_POLICY}` : CONNECTED_NORMALIZER_VERSION;
+    return source === "codex" ? `${CONNECTED_NORMALIZER_VERSION}/${CODEX_AUTHORIZATION_PROJECTION_POLICY}/fork-repository-starting-state-v1` : CONNECTED_NORMALIZER_VERSION;
 }
 /** Never admits malformed files partly or executes referenced paths/commands. */
 export function previewAgentImport(input) {
@@ -49,6 +49,7 @@ export function previewAgentImport(input) {
                     warnings: session.warnings,
                     contextComplete: !session.boundaries.some((boundary) => boundary.coverage.context === "unknown"),
                     acquisition: input.acquisition,
+                    ...(session.repositoryContext ? { repositoryContext: session.repositoryContext } : {}),
                 })
                 : session));
         }

package/dist/connected-evidence/index.js

@@ -4,3 +4,4 @@ export * from "./imports.js";
 export * from "./usage-summary.js";
 export * from "./python-correctness.js";
 export * from "./collector-coverage-contracts.js";
+export * from "./git-file-contracts.js";

package/dist/connected-evidence/normalize.js

@@ -67,6 +67,7 @@ export function normalizeConnectedSession(input) {
         origin: input.origin, sessionId: input.sessionId, branchId: input.branchId ?? null, parentSessionId: input.parentSessionId ?? null,
         exporterVersion: input.exporterVersion ?? null, sourceFiles: input.files.map(connectedFileIdentity).sort((a, b) => a.path.localeCompare(b.path)),
         ...(input.acquisition ? { acquisition: input.acquisition } : {}),
+        ...(input.repositoryContext ? { repositoryContext: input.repositoryContext } : {}),
         events, unmappedEvents: (input.unmappedEvents ?? []).map((event, sequence) => ({ ...event, sequence })), boundaries, warnings: input.warnings ?? [] };
     const session = ConnectedSessionSchema.parse({ ...body, contentHash: contentHash(body) });
     if (new TextEncoder().encode(JSON.stringify(session)).length > CONNECTED_EVIDENCE_LIMITS.decodedBytes)

package/dist/connected-evidence/sources/codex-metadata.js

@@ -0,0 +1,33 @@
+/** Forked Codex rollouts retain their own header followed by ancestor headers.
+ * Only the declared, contiguous ancestry is metadata for that source. */
+export class CodexMetadataChain {
+    metadata = null;
+    parentId = null;
+    closed = false;
+    ids = new Set();
+    accept(row) {
+        if (row.type !== "session_meta") {
+            this.closed = true;
+            return true;
+        }
+        const payload = row.payload;
+        if (this.closed || !payload || typeof payload !== "object" || Array.isArray(payload))
+            return false;
+        const value = payload;
+        if (typeof value.id !== "string" || !value.id || value.id.length > 500
+            || this.ids.has(value.id) || this.ids.size >= 16)
+            return false;
+        if (this.metadata) {
+            if (value.id !== this.parentId)
+                return false;
+            for (const key of ["creator_user_id", "creator_account_id"])
+                if (this.metadata[key] != null && value[key] != null && this.metadata[key] !== value[key])
+                    return false;
+        }
+        else
+            this.metadata = value;
+        this.ids.add(value.id);
+        this.parentId = typeof value.forked_from_id === "string" ? value.forked_from_id : null;
+        return true;
+    }
+}

package/dist/connected-evidence/sources/codex.js

@@ -1,11 +1,24 @@
 import { contentHash } from "@openpond/harness";
-import { connectedTimestamp, event, json, normalizeConnectedSession, object } from "../normalize.js";
+import { connectedFileIdentity, connectedTimestamp, event, json, normalizeConnectedSession, object } from "../normalize.js";
 import { projectCodexAuthorization } from "./codex-authorization.js";
 import { sourceUsage } from "./usage.js";
+import { CodexMetadataChain } from "./codex-metadata.js";
 export function parseCodexSession(file, rows) {
-    const metadata = object(rows.find(row => row.type === "session_meta")?.payload);
+    const chain = new CodexMetadataChain();
+    if (rows.some(row => !chain.accept(row)))
+        throw new Error("Codex rollout metadata does not match its declared fork ancestry.");
+    const metadata = chain.metadata ?? {};
     if (typeof metadata.id !== "string")
         throw new Error("This is not a supported Codex rollout: session_meta.id is missing.");
+    const git = object(metadata.git);
+    const repositoryContext = typeof git.commit_hash === "string" && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(git.commit_hash)
+        ? { schemaVersion: "openpond.connectedRepositoryContext.v1", kind: "git",
+            commitHash: git.commit_hash, branch: typeof git.branch === "string" && git.branch.length > 0 && git.branch.length <= 500 ? git.branch : null,
+            recordedAt: connectedTimestamp(metadata.timestamp), sourceFileHash: connectedFileIdentity(file).contentHash,
+            metadataHash: contentHash(git) }
+        : undefined;
+    if (repositoryContext && typeof metadata.cwd === "string")
+        Object.assign(repositoryContext, { workingDirectoryHash: contentHash(metadata.cwd) });
     const events = [];
     let turnId = null;
     let authorizationOmissions = 0;
@@ -52,5 +65,6 @@ export function parseCodexSession(file, rows) {
     }
     return normalizeConnectedSession({ origin: "codex", sessionId: metadata.id, parentSessionId: typeof metadata.forked_from_id === "string" ? metadata.forked_from_id : null,
         exporterVersion: typeof metadata.cli_version === "string" ? metadata.cli_version : null, files: [file], events,
+        ...(repositoryContext ? { repositoryContext } : {}),
         warnings: ["Codex cumulative usage is retained as reported totals and is not summed as billed invocations.", "Referenced files are unavailable unless separately admitted.", ...(authorizationOmissions ? [`Codex native authorization state excluded by codex-native-authorization-v1 from ${authorizationOmissions} locations. Omission markers retain source-section hashes; sourceFiles retains original byte hashes. Other conversation evidence is unchanged and still requires privacy admission.`] : [])] });
 }

package/dist/graders.js

@@ -39,9 +39,15 @@ export const GraderEvidenceContentSchema = z.object({
     modelJudgeReceipt: ModelJudgeReceiptSchema.optional(),
 }).strict();
 export const GraderEvidenceSchema = GraderEvidenceContentSchema.extend({ contentHash: ReleaseHashSchema }).strict();
+/** Scope is part of the immutable grader. An absent scope applies to every
+ * task; an explicit scope is never inferred from answer content or metadata. */
+export function gradersForTask(graders, task) {
+    return graders.filter(grader => !grader.taskIds || grader.taskIds.includes(task.id));
+}
 export async function gradeEvidence(input) {
+    const graders = gradersForTask(input.graders, input.task);
     if (input.evidence.infrastructureError) {
-        return input.graders.map((grader) => evidence(grader, {
+        return graders.map((grader) => evidence(grader, {
             score: null,
             passed: false,
             rewardEligible: false,
@@ -51,7 +57,7 @@ export async function gradeEvidence(input) {
             privilegedEvidenceRefs: [],
         }));
     }
-    return Promise.all(input.graders.map(async (grader) => {
+    return Promise.all(graders.map(async (grader) => {
         if (grader.kind === "model_judge") {
             if (!input.modelJudge || (grader.calibrationStatus !== "passed" && input.purpose !== "fixture_calibration"))
                 return evidence(grader, unavailable("Model judge is unavailable or uncalibrated."));
@@ -148,7 +154,7 @@ export async function gradeTaskEvidence(input) {
     const components = await gradeEvidence(input);
     const content = { schemaVersion: "openpond.taskGrade.v1",
         taskHash: contentHash(input.task), evidenceHash: contentHash(input.evidence), graderSetHash: contentHash(input.graders), components,
-        ...aggregateGraderScores({ graders: input.graders, components, infrastructureError: input.evidence.infrastructureError }) };
+        ...aggregateGraderScores({ graders: gradersForTask(input.graders, input.task), components, infrastructureError: input.evidence.infrastructureError }) };
     return TaskGradeSchema.parse({ ...content, contentHash: contentHash(content) });
 }
 /** Verify retained results against the exact admitted inputs without rerunning
@@ -163,7 +169,7 @@ export function verifyTaskGrade(value, input) {
         if (componentHash !== contentHash(body))
             throw new Error("Grader evidence integrity failed.");
     }
-    const summary = aggregateGraderScores({ graders: input.graders, components: result.components, infrastructureError: input.evidence.infrastructureError });
+    const summary = aggregateGraderScores({ graders: gradersForTask(input.graders, input.task), components: result.components, infrastructureError: input.evidence.infrastructureError });
     if (contentHash(GradeSummarySchema.parse({ score: result.score, passed: result.passed, rewardEligible: result.rewardEligible, failureClass: result.failureClass, gradingStatus: result.gradingStatus })) !== contentHash(summary))
         throw new Error("Task grade summary differs from its grader evidence.");
     return result;

package/dist/javascript-verifier.js

@@ -1,6 +1,7 @@
 import { executeJavaScriptIsolate } from "./javascript-isolate.js";
 import { assertIsolatedVerifierRuntime, JavaScriptVerifierResultSchema } from "./javascript-verifier-contract.js";
 export { JavaScriptVerifierResultSchema } from "./javascript-verifier-contract.js";
+export { PREPARED_PROCESS_ISOLATION_SOURCE } from "./prepared-process-isolation.js";
 /** A fresh interpreter with no filesystem, network, timers or module loader.
  * Hosts should use the worker entrypoint for cancellation and responsiveness. */
 export async function executeJavaScriptVerifier(input) {

package/dist/native-conversations/codex-window-inventory.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { open } from "node:fs/promises";
 import { CONNECTED_EVIDENCE_LIMITS } from "../connected-evidence/contracts.js";
+import { CodexMetadataChain } from "../connected-evidence/sources/codex-metadata.js";
 /** Streaming inventory may prove an irrelevant source without retaining it.
  * It never truncates a selected conversation into an admissible snapshot. */
 export async function inspectCodexWindow(input) {
@@ -14,7 +15,8 @@ export async function inspectCodexWindow(input) {
         const decoder = new TextDecoder("utf-8", { fatal: true });
         const from = input.since === null ? -Infinity : Date.parse(input.since);
         const to = Date.parse(input.until);
-        let metadata = false, records = 0, bytes = 0;
+        const metadata = new CodexMetadataChain();
+        let records = 0, bytes = 0;
         let pending = [], pendingBytes = 0;
         const inspect = (line) => {
             if (++records > 1_000_000 || line.byteLength > CONNECTED_EVIDENCE_LIMITS.lineBytes)
@@ -40,11 +42,8 @@ export async function inspectCodexWindow(input) {
             const value = row;
             const payload = value.payload && typeof value.payload === "object" && !Array.isArray(value.payload)
                 ? value.payload : {};
-            if (value.type === "session_meta") {
-                if (metadata || payload.id !== input.sessionId)
-                    return false;
-                metadata = true;
-            }
+            if (!metadata.accept(value) || (metadata.metadata && metadata.metadata.id !== input.sessionId))
+                return false;
             // The Codex normalizer maps other native records to unknown events;
             // they cannot create request boundaries. Missing metadata is still refused.
             const request = value.type === "response_item" && payload.type === "message" && payload.role === "user"
@@ -89,7 +88,7 @@ export async function inspectCodexWindow(input) {
         if (initial.dev !== final.dev || initial.ino !== final.ino || initial.size !== final.size
             || initial.mtimeMs !== final.mtimeMs || initial.ctimeMs !== final.ctimeMs || bytes !== final.size)
             throw new Error("Native source changed during window inventory.");
-        return metadata ? { sha256: digest.digest("hex") } : null;
+        return metadata.metadata ? { sha256: digest.digest("hex") } : null;
     }
     finally {
         await handle.close();

package/dist/native-conversations/git-assets.js

@@ -0,0 +1,61 @@
+import { execFile } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { promisify } from "node:util";
+import { ConnectedRepositoryContextSchema } from "../connected-evidence/contracts.js";
+import { ConnectedGitFileProofSchema, verifyConnectedGitFileProof } from "../connected-evidence/git-file-proof.js";
+const execute = promisify(execFile);
+/** Capture only recorded Git objects. A missing historical object is an explicit
+ * gap; this operation never reads the current worktree or fetches another repo. */
+export async function captureNativeGitAssetProofs(input) {
+    const context = ConnectedRepositoryContextSchema.parse(input.repositoryContext);
+    if (!isAbsolute(input.repositoryPath) || !input.paths.length || input.paths.length > 100
+        || new Set(input.paths).size !== input.paths.length)
+        throw new Error("native_git_asset_selection_invalid");
+    // Validate selections before invoking Git, including paths prohibited by the
+    // source asset policy. The remaining fields are filled from immutable objects.
+    for (const path of input.paths)
+        ConnectedGitFileProofSchema.shape.path.parse(path);
+    const repository = await realpath(input.repositoryPath);
+    const read = async (args, maxBuffer = 2 * 1024 * 1024) => {
+        input.signal?.throwIfAborted();
+        const result = await execute("git", ["-C", repository, ...args], {
+            encoding: "buffer", timeout: 15_000, maxBuffer, signal: input.signal,
+        });
+        return result.stdout;
+    };
+    const objectId = async (ref) => {
+        const hash = (await read(["rev-parse", "--verify", ref], 1_024)).toString("ascii").trim();
+        if (!new RegExp(`^[a-f0-9]{${context.commitHash.length}}$`).test(hash))
+            throw new Error("native_git_object_identity_invalid");
+        return hash;
+    };
+    const commit = await read(["cat-file", "commit", context.commitHash], 256 * 1024);
+    const cache = new Map();
+    let totalBytes = 0;
+    const proofs = [];
+    for (const path of input.paths) {
+        const directories = ["", ...path.split("/").slice(0, -1).map((_, index, parts) => parts.slice(0, index + 1).join("/"))];
+        const trees = [];
+        for (const directory of directories) {
+            const ref = directory ? `${context.commitHash}:${directory}` : `${context.commitHash}^{tree}`;
+            let tree = cache.get(ref);
+            if (!tree) {
+                const hash = await objectId(ref);
+                tree = { hash, base64: (await read(["cat-file", "tree", hash])).toString("base64") };
+                cache.set(ref, tree);
+            }
+            trees.push(tree);
+        }
+        const blob = await objectId(`${context.commitHash}:${path}`);
+        const proof = ConnectedGitFileProofSchema.parse({ schemaVersion: "openpond.connectedGitFileProof.v1", path,
+            commit: { hash: context.commitHash, base64: commit.toString("base64") }, trees,
+            contentsBase64: (await read(["cat-file", "blob", blob])).toString("base64") });
+        const verified = verifyConnectedGitFileProof(context, proof);
+        totalBytes += Buffer.byteLength(JSON.stringify(proof));
+        if (totalBytes > 16 * 1024 * 1024)
+            throw new Error("native_git_asset_capture_limit");
+        proofs.push({ proof, verified });
+    }
+    return proofs;
+}

package/dist/native-conversations/index.js

@@ -10,3 +10,4 @@ export * from "./location.js";
 export * from "./collector-branches.js";
 export * from "./collector-destinations.js";
 export * from "./collector-schedule.js";
+export { captureNativeGitAssetProofs } from "./git-assets.js";