@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/benchmark/benchmark-bootstrap.js

@@ -5,6 +5,7 @@ import os from "node:os";
 import path from "node:path";
 
 import { materializeBenchmarkCandidate } from "./benchmark-candidate.js";
+import { defaultBenchmarkSurfaces } from "./benchmark-cli.js";
 import {
   benchmarkPiCredentialFileIdentity,
   benchmarkPiHomeConfigIdentity,
@@ -17,11 +18,15 @@ import { inspectBenchmarkLedger } from "./benchmark-ledger.js";
 import { completedBenchmarkRecord } from "./benchmark-record-validation.js";
 import { benchmarkGitEnvironment, benchmarkHostEnvironment } from "./benchmark-runtime.js";
 import {
+  assertRegisteredBenchmarkPublicAssets,
   canonicalBuiltInBenchmarkSuiteId,
-  isReservedBenchmarkSuiteId
+  isReservedBenchmarkSuiteId,
+  loadRegisteredBenchmarkMeasurement
 } from "./benchmark-suite-identity.js";
 
 const metadataVariable = "PIAGENT_BENCHMARK_BOOTSTRAP_METADATA";
+export const registeredApprovalFileVariable = "PIAGENT_BENCHMARK_REGISTERED_APPROVAL_FILE";
+export const registeredApprovalKeyVariable = "PIAGENT_BENCHMARK_REGISTERED_APPROVAL_PUBLIC_KEY_FILE";
 
 function fail(message) {
   const error = new Error(message);
@@ -34,6 +39,49 @@ function optionValue(argv, name) {
   return index >= 0 ? argv[index + 1] : undefined;
 }
 
+function stableHostFile(file, label, maximum = 2 * 1024 * 1024) {
+  if (typeof file !== "string" || !path.isAbsolute(file) || path.normalize(file) !== file || file.includes("\0")) {
+    fail(`${label} path must be canonical and absolute`);
+  }
+  let resolved, before;
+  try { resolved = fs.realpathSync(file); before = fs.lstatSync(resolved, { bigint: true }); }
+  catch (error) { fail(`Cannot read ${label}: ${error.message}`); }
+  if (resolved !== file || !before.isFile() || before.isSymbolicLink() || before.nlink !== 1n
+    || before.size < 1n || before.size > BigInt(maximum)
+    || typeof process.getuid === "function" && before.uid !== BigInt(process.getuid())
+    || (before.mode & 0o022n) !== 0n) fail(`${label} must be one host-owned non-writable-linked regular file`);
+  const fd = fs.openSync(resolved, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  try {
+    const descriptor = fs.fstatSync(fd, { bigint: true }), bytes = fs.readFileSync(fd),
+      after = fs.fstatSync(fd, { bigint: true }), current = fs.lstatSync(resolved, { bigint: true }),
+      fields = ["dev", "ino", "mode", "nlink", "size", "mtimeNs", "ctimeNs"];
+    if (bytes.length !== Number(before.size) || fields.some(name => before[name] !== descriptor[name]
+      || before[name] !== after[name] || before[name] !== current[name])) fail(`${label} changed while read`);
+    return { path: resolved, bytes };
+  } finally { fs.closeSync(fd); }
+}
+
+function registeredManifestRequest(argv, cwd) {
+  const direct = optionValue(argv, "--registered-measurement");
+  if (direct) return direct;
+  const resume = optionValue(argv, "--resume");
+  if (!resume) return null;
+  const manifestPath = path.join(runRootFromResume(resume, cwd), "run-manifest.json");
+  if (!fs.existsSync(manifestPath)) return null;
+  const prior = jsonFile(manifestPath, "benchmark resume manifest")?.registeredMeasurement?.manifestOrigin;
+  return typeof prior === "string" ? prior : null;
+}
+
+function registeredAssetRoot(manifestFile) {
+  if (path.basename(manifestFile) !== "registered-suite.json"
+    || path.basename(path.dirname(manifestFile)) !== "measurement") {
+    fail("Registered measurement manifest must be measurement/registered-suite.json inside its exact asset root");
+  }
+  const root = path.dirname(path.dirname(manifestFile));
+  if (fs.realpathSync(root) !== root) fail("Registered measurement asset root must be canonical");
+  return root;
+}
+
 function runRootFromResume(input, cwd) {
   const target = path.resolve(cwd, input);
   let stat;
@@ -124,6 +172,7 @@ export function requestedSuite(argv, cwd, replaySnapshot) {
   if (argv.includes("--production")) return "production-v1";
   if (argv.includes("--deep")) return "deep-logic-v1";
   if (argv.includes("--capability")) return "capability-v1";
+  if (optionValue(argv, "--registered-measurement")) return "production-v2";
   return optionValue(argv, "--suite") ?? "core-v1";
 }
 
@@ -131,6 +180,9 @@ function snapshotReplay(argv, cwd, temporaryRoot) {
   const input = optionValue(argv, "--replay-failures");
   if (!input) return null;
   const origin = path.resolve(cwd, input);
+  if (argv.includes("--failed-attempts-only") && fs.existsSync(path.join(path.dirname(origin), "aborted.json"))) {
+    fail("Failed-only replay cannot snapshot an aborted source run");
+  }
   let bytes;
   let report;
   try {
@@ -219,6 +271,16 @@ function validateOutputIsolation(argv, cwd, repositoryRoot, suiteManifest) {
   }
 }
 
+function validateRegisteredOutputIsolation(argv, cwd, assetRoot) {
+  const resume = optionValue(argv, "--resume");
+  const requested = resume
+    ? runRootFromResume(resume, cwd)
+    : optionValue(argv, "--output") ? path.resolve(cwd, optionValue(argv, "--output")) : null;
+  if (requested && inside(assetRoot, canonicalProspective(requested))) {
+    fail("Benchmark output must not be nested inside the registered measurement asset source");
+  }
+}
+
 function copyTree(source, target) {
   const pending = [[source, target]];
   while (pending.length > 0) {
@@ -291,6 +353,89 @@ function runtimeDependencies(candidateRoot, resolutionRoot) {
   };
 }
 
+function fileDigest(file) {
+  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+function suiteNeedsWebUiAssets(manifest) {
+  const suite = jsonFile(manifest, "benchmark suite manifest");
+  return Array.isArray(suite?.scenarios) && suite.scenarios.some((scenario) => scenario?.userJourney);
+}
+
+function snapshotWebUiAssets(candidateRoot, liveRoot, temporaryRoot, candidateProvenance) {
+  const sourcePackage = path.join(candidateRoot, "packages", "piagent-webui");
+  const sourceManifest = jsonFile(path.join(sourcePackage, "package.json"), "candidate WebUI package manifest");
+  const nodeModules = fs.realpathSync(path.join(liveRoot, "node_modules"));
+  const installed = (name) => jsonFile(path.join(nodeModules, ...name.split("/"), "package.json"), `WebUI build dependency ${name}`);
+  const vite = installed("vite"), reactPlugin = installed("@vitejs/plugin-react");
+  if (sourceManifest.devDependencies?.vite !== vite.version
+    || sourceManifest.devDependencies?.["@vitejs/plugin-react"] !== reactPlugin.version) {
+    fail("Cannot build frozen WebUI assets: installed Vite toolchain does not match the candidate manifest");
+  }
+  const buildRoot = path.join(temporaryRoot, "webui-build-source");
+  const buildPackage = path.join(buildRoot, "packages", "piagent-webui");
+  const assetRoot = path.join(temporaryRoot, "webui-assets");
+  fs.mkdirSync(path.dirname(buildPackage), { recursive: true, mode: 0o700 });
+  copyTree(sourcePackage, buildPackage);
+  chmodTree(buildRoot, true);
+  fs.symlinkSync(nodeModules, path.join(buildRoot, "node_modules"), "dir");
+  try {
+    const viteCli = path.join(nodeModules, "vite", String(vite.bin?.vite ?? "bin/vite.js"));
+    execFileSync(process.execPath, [viteCli, "build", "--config", path.join(buildPackage, "vite.config.ts"),
+      "--outDir", assetRoot, "--emptyOutDir"], {
+      cwd: buildRoot,
+      env: benchmarkHostEnvironment({ ...process.env, NO_COLOR: "1" }),
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 32 * 1024 * 1024
+    });
+  } catch (error) {
+    fail(`Cannot build frozen WebUI assets: ${String(error?.stderr ?? error?.message ?? error).trim()}`);
+  } finally {
+    chmodTree(buildRoot, true);
+    fs.rmSync(buildRoot, { recursive: true, force: true });
+  }
+  if (!fs.existsSync(path.join(assetRoot, "index.html"))) fail("Frozen WebUI build did not produce index.html");
+  chmodTree(assetRoot, false);
+  const identity = {
+    schemaVersion: 1,
+    sourceCandidateDigest: candidateProvenance.contentDigest,
+    lockfileDigest: fileDigest(path.join(candidateRoot, "package-lock.json")),
+    pipeline: "vite-production-build-v1",
+    node: process.version,
+    tools: { vite: vite.version, reactPlugin: reactPlugin.version },
+    tree: benchmarkTreeIdentity(assetRoot, { rejectSymlinks: true })
+  };
+  return {
+    ...identity,
+    digest: crypto.createHash("sha256").update(JSON.stringify(identity)).digest("hex"),
+    root: assetRoot
+  };
+}
+
+function validWebUiAssets(value, candidateProvenance) {
+  if (value === null) return true;
+  if (!value || typeof value !== "object" || Array.isArray(value)
+    || value.schemaVersion !== 1 || typeof value.root !== "string" || !path.isAbsolute(value.root)
+    || value.sourceCandidateDigest !== candidateProvenance?.contentDigest
+    || !/^[a-f0-9]{64}$/.test(String(value.lockfileDigest ?? ""))
+    || value.pipeline !== "vite-production-build-v1" || value.node !== process.version
+    || typeof value.tools?.vite !== "string" || typeof value.tools?.reactPlugin !== "string"
+    || value.tree?.schemaVersion !== 1 || typeof value.tree?.algorithm !== "string"
+    || !/^[a-f0-9]{64}$/.test(String(value.tree?.contentDigest ?? ""))
+    || !Number.isInteger(value.tree?.entryCount) || value.tree.entryCount < 1
+    || !/^[a-f0-9]{64}$/.test(String(value.digest ?? ""))) return false;
+  const identity = {
+    schemaVersion: value.schemaVersion,
+    sourceCandidateDigest: value.sourceCandidateDigest,
+    lockfileDigest: value.lockfileDigest,
+    pipeline: value.pipeline,
+    node: value.node,
+    tools: value.tools,
+    tree: value.tree
+  };
+  return crypto.createHash("sha256").update(JSON.stringify(identity)).digest("hex") === value.digest;
+}
+
 function writeBoundJson(file, value) {
   const bytes = Buffer.from(`${JSON.stringify(value)}\n`, "utf8");
   fs.writeFileSync(file, bytes, { mode: 0o400 });
@@ -329,9 +474,11 @@ function piAuthInvocation(argv, cwd, replay) {
     if (!/^[a-f0-9]{32}$/.test(String(manifest.piCredentialVaultId ?? ""))) fail("Cannot resume benchmark: private Pi credential vault identity is missing or unsupported");
     return { authorized: manifest.allowPiAuthWriteback === true, model: manifest.model ?? null, vaultId: manifest.piCredentialVaultId };
   }
+  const registered = registeredManifestRequest(argv, cwd);
   return {
     authorized: argv.includes("--allow-pi-auth-writeback"),
-    model: optionValue(argv, "--model") ?? replay?.manifest?.model ?? replay?.report?.environment?.requestedModel ?? null,
+    model: (registered ? "openai-codex/gpt-5.6-luna" : optionValue(argv, "--model"))
+      ?? replay?.manifest?.model ?? replay?.report?.environment?.requestedModel ?? null,
     vaultId: crypto.randomBytes(16).toString("hex")
   };
 }
@@ -358,7 +505,8 @@ function snapshotPiAgentHome(temporaryRoot, runtimeParent, argv, cwd, replay, {
     catch (error) { if (error?.code === "ENOENT") continue; throw error; }
     copied.push(name);
   }
-  writeBoundJson(path.join(configRoot, "settings.json"), {});
+  // Cache refreshes are provider requests; keep them outside the staged measurement.
+  writeBoundJson(path.join(configRoot, "settings.json"), { cacheWarming: "off" });
   fs.chmodSync(configRoot, 0o500);
   fs.chmodSync(runtimeParent, 0o700);
   const seedIdentity = benchmarkPiHomeConfigIdentity(configRoot, { requiredFileMode: "400" });
@@ -372,7 +520,7 @@ function snapshotPiAgentHome(temporaryRoot, runtimeParent, argv, cwd, replay, {
   } : null;
   const identity = {
     ...benchmarkPiHomePublicIdentity(configRoot, credentialReadiness.map(({ providerId, type }) => ({ providerId, type }))),
-    settingsPolicy: "deterministic-empty",
+    settingsPolicy: "deterministic-cache-warming-off-v1",
     operatorPackagesAndResources: "excluded"
   };
   return {
@@ -396,37 +544,42 @@ function snapshotPiAgentHome(temporaryRoot, runtimeParent, argv, cwd, replay, {
 function snapshotCodexCredential(temporaryRoot) {
   const source = path.join(path.resolve(process.env.CODEX_HOME || path.join(os.homedir(), ".codex")), "auth.json");
   if (!fs.existsSync(source)) return null;
-  if (!fs.statSync(source).isFile()) fail(`Codex credential is not a regular file: ${source}`);
+  const stable = stableHostFile(source, "Codex credential", 2 * 1024 * 1024);
   const targetRoot = path.join(temporaryRoot, "codex-credential");
   fs.mkdirSync(targetRoot, { recursive: true, mode: 0o700 });
   const target = path.join(targetRoot, "auth.json");
-  fs.copyFileSync(source, target);
-  fs.chmodSync(target, 0o400);
+  fs.writeFileSync(target, stable.bytes, { flag: "wx", mode: 0o400 });
   fs.chmodSync(targetRoot, 0o500);
   return {
     path: target,
     privateIdentity: benchmarkTreeIdentity(targetRoot, { rejectSymlinks: true }),
-    identity: { schemaVersion: 1, credentialPresent: true, contentBinding: "private-runtime-only" }
+    identity: { schemaVersion: 1, credentialPresent: true, contentBinding: "private-runtime-only",
+      environmentCredentialPolicy: "excluded-from-frozen-controlled-runtime" }
   };
 }
 
 function requestsCodexSurface(argv, cwd, replay) {
-  const explicit = optionValue(argv, "--surfaces");
-  if (explicit) return explicit.split(",").map((value) => value.trim()).includes("codex-cli");
+  if (registeredManifestRequest(argv, cwd)) return true;
   const resume = optionValue(argv, "--resume");
   if (resume) {
     const manifestPath = path.join(runRootFromResume(resume, cwd), "run-manifest.json");
     return fs.existsSync(manifestPath) && jsonFile(manifestPath, "benchmark resume manifest")?.surfaces?.includes("codex-cli") === true;
   }
-  return replay?.manifest?.surfaces?.includes("codex-cli") === true;
+  if (replay) {
+    const surfaces = replay.manifest?.surfaces ?? replay.report?.environment?.surfaces;
+    return Array.isArray(surfaces) && surfaces.includes("codex-cli");
+  }
+  const explicit = optionValue(argv, "--surfaces");
+  if (explicit) return explicit.split(",").map((value) => value.trim()).includes("codex-cli");
+  return defaultBenchmarkSurfaces.includes("codex-cli");
 }
 
 function isolatedSnapshotParent() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), "piagent-benchmark-snapshot-"));
+  return fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), "piagent-benchmark-snapshot-")));
 }
 
 function isolatedPiRuntimeParent() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), "piagent-benchmark-pi-runtime-"));
+  return fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), "piagent-benchmark-pi-runtime-")));
 }
 
 function gitSourceIdentity(root) {
@@ -447,6 +600,60 @@ function gitSourceIdentity(root) {
   };
 }
 
+export function snapshotRegisteredBenchmarkMeasurement({ argv, cwd, temporaryRoot, scenarioIds }) {
+  const requested = registeredManifestRequest(argv, cwd);
+  if (!requested) return null;
+  if (!path.isAbsolute(requested) || path.normalize(requested) !== requested || requested.includes("\0")) {
+    fail("Registered measurement manifest path must be canonical and absolute");
+  }
+  let manifestFile;
+  try { manifestFile = fs.realpathSync(requested); }
+  catch (error) { fail(`Cannot resolve registered measurement manifest: ${error.message}`); }
+  if (manifestFile !== requested) fail("Registered measurement manifest path must be canonical and absolute");
+  const approval = stableHostFile(process.env[registeredApprovalFileVariable],
+    "registered measurement detached approval");
+  const publicKeyFile = stableHostFile(process.env[registeredApprovalKeyVariable],
+    "registered measurement trusted public key", 64 * 1024);
+  let publicKey;
+  try { publicKey = crypto.createPublicKey(publicKeyFile.bytes); }
+  catch { fail("Registered measurement trusted public key is invalid"); }
+  const registration = loadRegisteredBenchmarkMeasurement(manifestFile, {
+    approvalFile: approval.path,
+    approvalPublicKey: publicKey,
+    scenarioIds
+  });
+  const sourceRoot = registeredAssetRoot(manifestFile);
+  validateRegisteredOutputIsolation(argv, cwd, sourceRoot);
+  const sourceInventory = assertRegisteredBenchmarkPublicAssets(registration, sourceRoot, scenarioIds);
+  const targetRoot = path.join(temporaryRoot, "registered-assets");
+  copyTree(sourceRoot, targetRoot);
+  chmodTree(targetRoot, false);
+  const snapshotRoot = fs.realpathSync(targetRoot), snapshotManifest = path.join(snapshotRoot,
+    "measurement", "registered-suite.json"), snapshotInventory = assertRegisteredBenchmarkPublicAssets(
+      registration, snapshotRoot, scenarioIds);
+  if (JSON.stringify(sourceInventory) !== JSON.stringify(snapshotInventory)
+    || fileDigest(snapshotManifest) !== registration.identity.manifestSha256) {
+    fail("Registered measurement snapshot identity changed while it was frozen");
+  }
+  return {
+    schemaVersion: 1,
+    manifestOrigin: manifestFile,
+    manifestSnapshot: snapshotManifest,
+    assetRoot: snapshotRoot,
+    payload: registration.payload,
+    identity: registration.identity,
+    inventory: snapshotInventory,
+    tree: benchmarkTreeIdentity(snapshotRoot, { rejectSymlinks: true })
+  };
+}
+
+function requestedCandidateTreatment(argv, cwd) {
+  const resume = optionValue(argv, "--resume");
+  const manifest = resume ? jsonFile(path.join(runRootFromResume(resume, cwd), "run-manifest.json"), "resume treatment") : null;
+  return { piagentTreatment: manifest?.piagentTreatment ?? optionValue(argv, "--piagent-treatment"),
+    measurementOnly: manifest ? manifest.measurementOnly === true : argv.includes("--measurement-only") };
+}
+
 export function createBenchmarkExecutionSnapshot({ liveRoot, argv, cwd }) {
   const root = fs.realpathSync(liveRoot);
   let temporaryRoot;
@@ -461,7 +668,7 @@ export function createBenchmarkExecutionSnapshot({ liveRoot, argv, cwd }) {
   try {
     const sourceIdentityBefore = gitSourceIdentity(root);
     const candidateRoot = path.join(temporaryRoot, "candidate");
-    const candidate = materializeBenchmarkCandidate(root, candidateRoot);
+    const candidate = materializeBenchmarkCandidate(root, candidateRoot, requestedCandidateTreatment(argv, cwd));
     const sourceIdentityAfter = gitSourceIdentity(root);
     if (JSON.stringify(sourceIdentityBefore) !== JSON.stringify(sourceIdentityAfter)) {
       fail("Benchmark Git source identity changed while the candidate snapshot was being created");
@@ -487,6 +694,19 @@ export function createBenchmarkExecutionSnapshot({ liveRoot, argv, cwd }) {
     } else {
       suiteRoot = path.join(candidateRoot, "benchmarks", suite.origin);
     }
+    const frozenSuiteManifest = suiteSnapshot ?? path.join(suiteRoot, "suite.json");
+    const frozenSuite = jsonFile(frozenSuiteManifest, "frozen benchmark suite manifest");
+    const registeredMeasurement = snapshotRegisteredBenchmarkMeasurement({ argv, cwd, temporaryRoot,
+      scenarioIds: frozenSuite.scenarios?.map(value => value.id) });
+    if (registeredMeasurement && suite.origin !== registeredMeasurement.payload.baseSuiteId) {
+      fail("Registered measurement base suite does not match its frozen benchmark suite");
+    }
+    if (registeredMeasurement && !providerFreeFinalization && !codexCredential) {
+      fail("Registered measurement requires one frozen Codex auth.json credential");
+    }
+    const webUiAssets = suiteNeedsWebUiAssets(frozenSuiteManifest)
+      ? snapshotWebUiAssets(candidateRoot, root, temporaryRoot, candidate.provenance)
+      : null;
     const metadata = {
       schemaVersion: 1,
       liveRoot: root,
@@ -495,11 +715,14 @@ export function createBenchmarkExecutionSnapshot({ liveRoot, argv, cwd }) {
       sourceIdentity: sourceIdentityAfter,
       defaultOutputRoot: piAgentHome.defaultOutputRoot,
       candidateProvenance: candidate.provenance,
+      ...(candidate.treatmentDerivation ? { treatmentDerivation: candidate.treatmentDerivation } : {}),
       candidateIndex,
       runtimeDependencies: runtimeDependencies(candidateRoot, root),
+      webUiAssets,
       providerFreeFinalization,
       piAgentHome,
       codexCredential,
+      registeredMeasurement,
       replay: replay ? {
         origin: replay.origin,
         snapshot: replay.snapshot,
@@ -537,6 +760,12 @@ export function cleanupBenchmarkExecutionSnapshot(temporaryRoot, runtimeParent,
 export function benchmarkBootstrapEnvironment(metadata, base = process.env) {
   const environment = benchmarkHostEnvironment(base);
   delete environment.PI_CODING_AGENT_DIR;
+  delete environment[registeredApprovalFileVariable];
+  delete environment[registeredApprovalKeyVariable];
+  if (metadata.registeredMeasurement) {
+    delete environment.OPENAI_API_KEY;
+    delete environment.CODEX_ACCESS_TOKEN;
+  }
   return {
     ...environment,
     ...(metadata.codexCredential ? { PIAGENT_BENCHMARK_CODEX_AUTH_SNAPSHOT: metadata.codexCredential.path } : {}),
@@ -563,6 +792,7 @@ export function benchmarkBootstrapMetadata(env = process.env) {
     || typeof value.candidateIndex?.path !== "string"
     || !/^[a-f0-9]{64}$/.test(String(value.candidateIndex?.digest ?? ""))
     || typeof value.runtimeDependencies?.digest !== "string"
+    || !validWebUiAssets(value.webUiAssets, value.candidateProvenance)
     || typeof value.providerFreeFinalization !== "boolean"
     || typeof value.piAgentHome?.configRoot !== "string"
     || typeof value.piAgentHome?.runtimeParent !== "string"
@@ -581,6 +811,27 @@ export function benchmarkBootstrapMetadata(env = process.env) {
       typeof value.codexCredential?.path !== "string"
       || typeof value.codexCredential?.privateIdentity?.contentDigest !== "string"
     ))
+    || (value.registeredMeasurement !== undefined && value.registeredMeasurement !== null
+      && value.providerFreeFinalization === false && value.codexCredential === null)
+    || (value.registeredMeasurement !== undefined && value.registeredMeasurement !== null && (
+      value.registeredMeasurement?.schemaVersion !== 1
+      || typeof value.registeredMeasurement?.manifestOrigin !== "string"
+      || typeof value.registeredMeasurement?.manifestSnapshot !== "string"
+      || typeof value.registeredMeasurement?.assetRoot !== "string"
+      || value.registeredMeasurement?.payload?.suiteId !== "production-v2-da2"
+      || value.registeredMeasurement?.payload?.baseSuiteId !== "production-v2"
+      || !/^[a-f0-9]{64}$/.test(String(value.registeredMeasurement?.identity?.manifestSha256 ?? ""))
+      || !/^[a-f0-9]{64}$/.test(String(value.registeredMeasurement?.identity?.payloadSha256 ?? ""))
+      || !/^[a-f0-9]{64}$/.test(String(value.registeredMeasurement?.identity?.approvalRecordSha256 ?? ""))
+      || !/^[a-f0-9]{64}$/.test(String(value.registeredMeasurement?.identity?.authorityKeyId ?? ""))
+      || value.registeredMeasurement?.inventory?.version !== "registered-public-asset-inventory-v1"
+      || !/^[a-f0-9]{64}$/.test(String(value.registeredMeasurement?.inventory?.publicAssetsDigest ?? ""))
+      || value.registeredMeasurement?.inventory?.publicAssetsDigest !== value.registeredMeasurement?.payload?.publicAssetsDigest
+      || value.registeredMeasurement?.inventory?.publicContractDigest !== value.registeredMeasurement?.payload?.publicContractDigest
+      || !Array.isArray(value.registeredMeasurement?.inventory?.entries)
+      || value.registeredMeasurement.inventory.entries.length !== 48
+      || !/^[a-f0-9]{64}$/.test(String(value.registeredMeasurement?.tree?.contentDigest ?? ""))
+    ))
     || typeof value.suite?.origin !== "string"
     || !(value.suite?.builtInId === null || isReservedBenchmarkSuiteId(value.suite?.builtInId))
     || (value.suite?.builtInId === null && typeof value.suite?.snapshot !== "string")