@riddledc/riddle-proof 0.8.52 → 0.8.54

package/dist/advanced/proof-run-engine.d.cts

@@ -1,2 +1,2 @@
-export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-DpChFR5H.cjs';
+export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-Baiv6l3A.cjs';
 import '../proof-run-core-7Dqm7RKM.cjs';

package/dist/advanced/proof-run-engine.d.ts

@@ -1,2 +1,2 @@
-export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-BqRoA3Do.js';
+export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-MiKZt9oY.js';
 import '../proof-run-core-7Dqm7RKM.js';

package/dist/advanced/runner.js

@@ -1,10 +1,10 @@
 import {
   runRiddleProof
-} from "../chunk-2CZORYB7.js";
-import "../chunk-M3IE3VNC.js";
-import "../chunk-RBAU2M4S.js";
+} from "../chunk-S5DX7Z6X.js";
+import "../chunk-WDIKPIMB.js";
+import "../chunk-JJ4IWRMJ.js";
 import "../chunk-EKZXU6MU.js";
-import "../chunk-AXWJJ2LC.js";
+import "../chunk-BLM5EIBA.js";
 import "../chunk-VY4Y5U57.js";
 import "../chunk-MLKGABMK.js";
 export {

package/dist/checkpoint.cjs

@@ -37,6 +37,7 @@ __export(checkpoint_exports, {
   buildCheckpointPacketForEngineResult: () => buildCheckpointPacketForEngineResult,
   buildProofAssessmentCheckpointPacket: () => buildProofAssessmentCheckpointPacket,
   buildStageCheckpointPacket: () => buildStageCheckpointPacket,
+  checkpointPacketIdentity: () => checkpointPacketIdentity,
   checkpointResponseIdentity: () => checkpointResponseIdentity,
   checkpointSummaryFromState: () => checkpointSummaryFromState,
   createCheckpointResponseTemplate: () => createCheckpointResponseTemplate,
@@ -105,12 +106,13 @@ function statePathsForRunState(state, engineStatePath) {
 function responseSchemaForAuthorPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "payload", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "payload", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -138,12 +140,13 @@ function responseSchemaForAuthorPacket() {
 function responseSchemaForProofAssessmentPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -179,12 +182,13 @@ function responseSchemaForProofAssessmentPacket() {
 function responseSchemaForReconPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -212,12 +216,13 @@ function responseSchemaForReconPacket() {
 function responseSchemaForImplementationPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -245,12 +250,13 @@ function responseSchemaForImplementationPacket() {
 function responseSchemaForAdvancePacket(stage) {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -276,6 +282,20 @@ function resumeTokenFor(input) {
   const hash = import_node_crypto.default.createHash("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24);
   return `rpchk_${hash}`;
 }
+function packetIdentityPayload(packet) {
+  const { packet_id: _packetId, ...identityPayload } = packet;
+  return identityPayload;
+}
+function checkpointPacketIdentity(packet) {
+  const hash = import_node_crypto.default.createHash("sha256").update(stableJson(packetIdentityPayload(packet))).digest("hex").slice(0, 24);
+  return `rppkt_${hash}`;
+}
+function withPacketIdentity(packet) {
+  return {
+    ...packet,
+    packet_id: checkpointPacketIdentity(packet)
+  };
+}
 function artifactsFromState(state) {
   const artifacts = [];
   for (const role of ["before", "prod", "after"]) {
@@ -348,7 +368,7 @@ function buildStageCheckpointPacket(input) {
   const checkpointContract = recordValue(input.engineResult.checkpointContract);
   const summary = nonEmptyString(input.engineResult.summary) || nonEmptyString(fullState.stage_summary) || `${stage} checkpoint needs a supervising decision.`;
   const kind = packetKindForStage(stage, checkpoint);
-  return {
+  return withPacketIdentity({
     version: RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
     run_id: runId,
     state_path: input.runState.state_path,
@@ -397,7 +417,7 @@ function buildStageCheckpointPacket(input) {
       stage
     }),
     created_at: input.created_at || timestamp()
-  };
+  });
 }
 function buildAuthorCheckpointPacket(input) {
   const checkpoint = nonEmptyString(input.engineResult.checkpoint) || "author_supervisor_judgment";
@@ -410,7 +430,7 @@ function buildAuthorCheckpointPacket(input) {
   const reconResults = recordValue(fullState.recon_results);
   const checkpointContract = recordValue(input.engineResult.checkpointContract);
   const summary = nonEmptyString(input.engineResult.summary) || nonEmptyString(fullState.author_summary) || "Author checkpoint needs a supervising proof packet.";
-  return {
+  return withPacketIdentity({
     version: RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
     run_id: runId,
     state_path: input.runState.state_path,
@@ -459,7 +479,7 @@ function buildAuthorCheckpointPacket(input) {
       stage
     }),
     created_at: input.created_at || timestamp()
-  };
+  });
 }
 function visualDeltaFromState(fullState) {
   const bundle = recordValue(fullState.evidence_bundle);
@@ -530,7 +550,7 @@ function buildProofAssessmentCheckpointPacket(input) {
   const evidenceIssueCode = visualDeltaIssueCode(visualDelta, visualDeltaRequired);
   const summary = nonEmptyString(input.engineResult.summary) || nonEmptyString(fullState.verify_summary) || "Verify captured evidence and needs a supervising proof assessment.";
   const recoveryHint = evidenceIssueCode ? "Required visual_delta evidence is incomplete. Keep this same run in verify/evidence recovery with decision=revise_capture and continue_with_stage=verify unless the evidence proves an implementation or recon problem." : "Assess whether the current artifacts prove the requested change, then choose the next stage.";
-  return {
+  return withPacketIdentity({
     version: RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
     run_id: runId,
     state_path: input.runState.state_path,
@@ -590,7 +610,7 @@ function buildProofAssessmentCheckpointPacket(input) {
       stage
     }),
     created_at: input.created_at || timestamp()
-  };
+  });
 }
 function buildCheckpointPacketForEngineResult(input) {
   const checkpoint = nonEmptyString(input.engineResult.checkpoint) || "";
@@ -619,6 +639,7 @@ function normalizeCheckpointResponse(value) {
     version: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
     run_id: runId,
     checkpoint,
+    packet_id: nonEmptyString(record.packet_id),
     resume_token: nonEmptyString(record.resume_token),
     decision,
     summary,
@@ -706,6 +727,7 @@ function createCheckpointResponseTemplate(packet, input = {}) {
     version: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
     run_id: packet.run_id,
     checkpoint: packet.checkpoint,
+    packet_id: packet.packet_id,
     resume_token: packet.resume_token,
     decision,
     summary: input.summary || `TODO: explain checkpoint decision ${decision}.`,
@@ -739,6 +761,9 @@ function checkpointSummaryFromState(state, engineStatePath) {
   const latestResponseEntry = [...responses].reverse().find((entry) => entry.response);
   const latestPacket = state.checkpoint_packet || latestPacketEntry?.packet;
   const latestResponse = latestResponseEntry?.response;
+  const latestPacketId = latestPacket?.packet_id || null;
+  const latestResponsePacketId = latestResponse?.packet_id || null;
+  const packetIdMatches = !latestResponse ? null : latestPacketId && latestResponsePacketId ? latestPacketId === latestResponsePacketId : latestPacketId || latestResponsePacketId ? false : null;
   const latestResumeToken = latestPacket?.resume_token || null;
   const latestResponseToken = latestResponse?.resume_token || null;
   const tokenMatches = !latestResponse ? null : latestResumeToken && latestResponseToken ? latestResumeToken === latestResponseToken : latestResumeToken || latestResponseToken ? false : null;
@@ -753,6 +778,9 @@ function checkpointSummaryFromState(state, engineStatePath) {
     latest_decision: latestResponse?.decision || null,
     latest_packet_summary: latestPacket?.summary || null,
     latest_response_summary: latestResponse?.summary || null,
+    latest_packet_id: latestPacketId,
+    latest_response_packet_id: latestResponsePacketId,
+    packet_id_matches: packetIdMatches,
     latest_resume_token: latestResumeToken,
     latest_response_token: latestResponseToken,
     token_matches: tokenMatches,
@@ -769,6 +797,7 @@ function checkpointResponseIdentity(response) {
   const logicalResponse = compactRecord({
     run_id: response.run_id,
     checkpoint: response.checkpoint,
+    packet_id: response.packet_id,
     resume_token: response.resume_token,
     decision: response.decision,
     summary: response.summary,
@@ -830,6 +859,7 @@ function proofContractFromAuthorCheckpointResponse(response, packet, payload) {
   buildCheckpointPacketForEngineResult,
   buildProofAssessmentCheckpointPacket,
   buildStageCheckpointPacket,
+  checkpointPacketIdentity,
   checkpointResponseIdentity,
   checkpointSummaryFromState,
   createCheckpointResponseTemplate,

package/dist/checkpoint.d.cts

@@ -3,6 +3,7 @@ import { RiddleProofCheckpointResponse, RiddleProofRunParams, RiddleProofRunStat
 declare const RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION: "riddle-proof.checkpoint.v1";
 declare const RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION: "riddle-proof.checkpoint_response.v1";
 declare function statePathsForRunState(state: RiddleProofRunState, engineStatePath?: string | null): RiddleProofStatePaths;
+declare function checkpointPacketIdentity(packet: RiddleProofCheckpointPacket): string;
 declare function buildStageCheckpointPacket(input: {
     request: RiddleProofRunParams;
     runState: RiddleProofRunState;
@@ -76,4 +77,4 @@ declare function checkpointResponseIdentity(response: RiddleProofCheckpointRespo
 declare function authorPacketPayloadFromCheckpointResponse(response: RiddleProofCheckpointResponse): Record<string, unknown> | null;
 declare function proofContractFromAuthorCheckpointResponse(response: RiddleProofCheckpointResponse, packet: RiddleProofCheckpointPacket, payload: Record<string, unknown>): RiddleProofProofContract;
 
-export { RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION, RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION, authorPacketPayloadFromCheckpointResponse, buildAuthorCheckpointPacket, buildCheckpointPacketForEngineResult, buildProofAssessmentCheckpointPacket, buildStageCheckpointPacket, checkpointResponseIdentity, checkpointSummaryFromState, createCheckpointResponseTemplate, isDuplicateCheckpointResponse, normalizeCheckpointResponse, proofContractFromAuthorCheckpointResponse, statePathsForRunState };
+export { RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION, RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION, authorPacketPayloadFromCheckpointResponse, buildAuthorCheckpointPacket, buildCheckpointPacketForEngineResult, buildProofAssessmentCheckpointPacket, buildStageCheckpointPacket, checkpointPacketIdentity, checkpointResponseIdentity, checkpointSummaryFromState, createCheckpointResponseTemplate, isDuplicateCheckpointResponse, normalizeCheckpointResponse, proofContractFromAuthorCheckpointResponse, statePathsForRunState };

package/dist/checkpoint.d.ts

@@ -3,6 +3,7 @@ import { RiddleProofCheckpointResponse, RiddleProofRunParams, RiddleProofRunStat
 declare const RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION: "riddle-proof.checkpoint.v1";
 declare const RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION: "riddle-proof.checkpoint_response.v1";
 declare function statePathsForRunState(state: RiddleProofRunState, engineStatePath?: string | null): RiddleProofStatePaths;
+declare function checkpointPacketIdentity(packet: RiddleProofCheckpointPacket): string;
 declare function buildStageCheckpointPacket(input: {
     request: RiddleProofRunParams;
     runState: RiddleProofRunState;
@@ -76,4 +77,4 @@ declare function checkpointResponseIdentity(response: RiddleProofCheckpointRespo
 declare function authorPacketPayloadFromCheckpointResponse(response: RiddleProofCheckpointResponse): Record<string, unknown> | null;
 declare function proofContractFromAuthorCheckpointResponse(response: RiddleProofCheckpointResponse, packet: RiddleProofCheckpointPacket, payload: Record<string, unknown>): RiddleProofProofContract;
 
-export { RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION, RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION, authorPacketPayloadFromCheckpointResponse, buildAuthorCheckpointPacket, buildCheckpointPacketForEngineResult, buildProofAssessmentCheckpointPacket, buildStageCheckpointPacket, checkpointResponseIdentity, checkpointSummaryFromState, createCheckpointResponseTemplate, isDuplicateCheckpointResponse, normalizeCheckpointResponse, proofContractFromAuthorCheckpointResponse, statePathsForRunState };
+export { RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION, RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION, authorPacketPayloadFromCheckpointResponse, buildAuthorCheckpointPacket, buildCheckpointPacketForEngineResult, buildProofAssessmentCheckpointPacket, buildStageCheckpointPacket, checkpointPacketIdentity, checkpointResponseIdentity, checkpointSummaryFromState, createCheckpointResponseTemplate, isDuplicateCheckpointResponse, normalizeCheckpointResponse, proofContractFromAuthorCheckpointResponse, statePathsForRunState };

package/dist/checkpoint.js

@@ -6,6 +6,7 @@ import {
   buildCheckpointPacketForEngineResult,
   buildProofAssessmentCheckpointPacket,
   buildStageCheckpointPacket,
+  checkpointPacketIdentity,
   checkpointResponseIdentity,
   checkpointSummaryFromState,
   createCheckpointResponseTemplate,
@@ -13,7 +14,7 @@ import {
   normalizeCheckpointResponse,
   proofContractFromAuthorCheckpointResponse,
   statePathsForRunState
-} from "./chunk-AXWJJ2LC.js";
+} from "./chunk-BLM5EIBA.js";
 import "./chunk-VY4Y5U57.js";
 import "./chunk-MLKGABMK.js";
 export {
@@ -24,6 +25,7 @@ export {
   buildCheckpointPacketForEngineResult,
   buildProofAssessmentCheckpointPacket,
   buildStageCheckpointPacket,
+  checkpointPacketIdentity,
   checkpointResponseIdentity,
   checkpointSummaryFromState,
   createCheckpointResponseTemplate,

package/dist/{chunk-AXWJJ2LC.js → chunk-BLM5EIBA.js}

@@ -51,12 +51,13 @@ function statePathsForRunState(state, engineStatePath) {
 function responseSchemaForAuthorPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "payload", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "payload", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -84,12 +85,13 @@ function responseSchemaForAuthorPacket() {
 function responseSchemaForProofAssessmentPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -125,12 +127,13 @@ function responseSchemaForProofAssessmentPacket() {
 function responseSchemaForReconPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -158,12 +161,13 @@ function responseSchemaForReconPacket() {
 function responseSchemaForImplementationPacket() {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -191,12 +195,13 @@ function responseSchemaForImplementationPacket() {
 function responseSchemaForAdvancePacket(stage) {
   return {
     type: "object",
-    required: ["version", "run_id", "checkpoint", "decision", "summary", "created_at"],
+    required: ["version", "run_id", "checkpoint", "packet_id", "decision", "summary", "created_at"],
     additionalProperties: false,
     properties: {
       version: { const: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION },
       run_id: { type: "string" },
       checkpoint: { type: "string" },
+      packet_id: { type: "string" },
       resume_token: { type: "string" },
       decision: {
         type: "string",
@@ -222,6 +227,20 @@ function resumeTokenFor(input) {
   const hash = crypto.createHash("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24);
   return `rpchk_${hash}`;
 }
+function packetIdentityPayload(packet) {
+  const { packet_id: _packetId, ...identityPayload } = packet;
+  return identityPayload;
+}
+function checkpointPacketIdentity(packet) {
+  const hash = crypto.createHash("sha256").update(stableJson(packetIdentityPayload(packet))).digest("hex").slice(0, 24);
+  return `rppkt_${hash}`;
+}
+function withPacketIdentity(packet) {
+  return {
+    ...packet,
+    packet_id: checkpointPacketIdentity(packet)
+  };
+}
 function artifactsFromState(state) {
   const artifacts = [];
   for (const role of ["before", "prod", "after"]) {
@@ -294,7 +313,7 @@ function buildStageCheckpointPacket(input) {
   const checkpointContract = recordValue(input.engineResult.checkpointContract);
   const summary = nonEmptyString(input.engineResult.summary) || nonEmptyString(fullState.stage_summary) || `${stage} checkpoint needs a supervising decision.`;
   const kind = packetKindForStage(stage, checkpoint);
-  return {
+  return withPacketIdentity({
     version: RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
     run_id: runId,
     state_path: input.runState.state_path,
@@ -343,7 +362,7 @@ function buildStageCheckpointPacket(input) {
       stage
     }),
     created_at: input.created_at || timestamp()
-  };
+  });
 }
 function buildAuthorCheckpointPacket(input) {
   const checkpoint = nonEmptyString(input.engineResult.checkpoint) || "author_supervisor_judgment";
@@ -356,7 +375,7 @@ function buildAuthorCheckpointPacket(input) {
   const reconResults = recordValue(fullState.recon_results);
   const checkpointContract = recordValue(input.engineResult.checkpointContract);
   const summary = nonEmptyString(input.engineResult.summary) || nonEmptyString(fullState.author_summary) || "Author checkpoint needs a supervising proof packet.";
-  return {
+  return withPacketIdentity({
     version: RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
     run_id: runId,
     state_path: input.runState.state_path,
@@ -405,7 +424,7 @@ function buildAuthorCheckpointPacket(input) {
       stage
     }),
     created_at: input.created_at || timestamp()
-  };
+  });
 }
 function visualDeltaFromState(fullState) {
   const bundle = recordValue(fullState.evidence_bundle);
@@ -476,7 +495,7 @@ function buildProofAssessmentCheckpointPacket(input) {
   const evidenceIssueCode = visualDeltaIssueCode(visualDelta, visualDeltaRequired);
   const summary = nonEmptyString(input.engineResult.summary) || nonEmptyString(fullState.verify_summary) || "Verify captured evidence and needs a supervising proof assessment.";
   const recoveryHint = evidenceIssueCode ? "Required visual_delta evidence is incomplete. Keep this same run in verify/evidence recovery with decision=revise_capture and continue_with_stage=verify unless the evidence proves an implementation or recon problem." : "Assess whether the current artifacts prove the requested change, then choose the next stage.";
-  return {
+  return withPacketIdentity({
     version: RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
     run_id: runId,
     state_path: input.runState.state_path,
@@ -536,7 +555,7 @@ function buildProofAssessmentCheckpointPacket(input) {
       stage
     }),
     created_at: input.created_at || timestamp()
-  };
+  });
 }
 function buildCheckpointPacketForEngineResult(input) {
   const checkpoint = nonEmptyString(input.engineResult.checkpoint) || "";
@@ -565,6 +584,7 @@ function normalizeCheckpointResponse(value) {
     version: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
     run_id: runId,
     checkpoint,
+    packet_id: nonEmptyString(record.packet_id),
     resume_token: nonEmptyString(record.resume_token),
     decision,
     summary,
@@ -652,6 +672,7 @@ function createCheckpointResponseTemplate(packet, input = {}) {
     version: RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
     run_id: packet.run_id,
     checkpoint: packet.checkpoint,
+    packet_id: packet.packet_id,
     resume_token: packet.resume_token,
     decision,
     summary: input.summary || `TODO: explain checkpoint decision ${decision}.`,
@@ -685,6 +706,9 @@ function checkpointSummaryFromState(state, engineStatePath) {
   const latestResponseEntry = [...responses].reverse().find((entry) => entry.response);
   const latestPacket = state.checkpoint_packet || latestPacketEntry?.packet;
   const latestResponse = latestResponseEntry?.response;
+  const latestPacketId = latestPacket?.packet_id || null;
+  const latestResponsePacketId = latestResponse?.packet_id || null;
+  const packetIdMatches = !latestResponse ? null : latestPacketId && latestResponsePacketId ? latestPacketId === latestResponsePacketId : latestPacketId || latestResponsePacketId ? false : null;
   const latestResumeToken = latestPacket?.resume_token || null;
   const latestResponseToken = latestResponse?.resume_token || null;
   const tokenMatches = !latestResponse ? null : latestResumeToken && latestResponseToken ? latestResumeToken === latestResponseToken : latestResumeToken || latestResponseToken ? false : null;
@@ -699,6 +723,9 @@ function checkpointSummaryFromState(state, engineStatePath) {
     latest_decision: latestResponse?.decision || null,
     latest_packet_summary: latestPacket?.summary || null,
     latest_response_summary: latestResponse?.summary || null,
+    latest_packet_id: latestPacketId,
+    latest_response_packet_id: latestResponsePacketId,
+    packet_id_matches: packetIdMatches,
     latest_resume_token: latestResumeToken,
     latest_response_token: latestResponseToken,
     token_matches: tokenMatches,
@@ -715,6 +742,7 @@ function checkpointResponseIdentity(response) {
   const logicalResponse = compactRecord({
     run_id: response.run_id,
     checkpoint: response.checkpoint,
+    packet_id: response.packet_id,
     resume_token: response.resume_token,
     decision: response.decision,
     summary: response.summary,
@@ -772,6 +800,7 @@ export {
   RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
   RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
   statePathsForRunState,
+  checkpointPacketIdentity,
   buildStageCheckpointPacket,
   buildAuthorCheckpointPacket,
   buildProofAssessmentCheckpointPacket,

package/dist/{chunk-FWHJN3QG.js → chunk-ECLGGGAI.js}

@@ -28,10 +28,10 @@ import {
   createDisabledRiddleProofAgentAdapter,
   readRiddleProofRunStatus,
   runRiddleProofEngineHarness
-} from "./chunk-WURLFN72.js";
+} from "./chunk-IV4DVWPR.js";
 import {
   createCheckpointResponseTemplate
-} from "./chunk-AXWJJ2LC.js";
+} from "./chunk-BLM5EIBA.js";
 import {
   createCodexExecAgentAdapter,
   runCodexExecAgentDoctor
@@ -1088,6 +1088,7 @@ function formatCheckpointMarkdown(input) {
     `Status: ${input.status || "awaiting_checkpoint"}`,
     `Stage: ${packet.stage}`,
     `Checkpoint: ${packet.checkpoint}`,
+    `Packet ID: ${packet.packet_id || "legacy"}`,
     `Kind: ${packet.kind}`,
     "",
     "## Goal",

package/dist/{chunk-WURLFN72.js → chunk-IV4DVWPR.js}

@@ -5,10 +5,10 @@ import {
   createRunStatusSnapshot,
   normalizeRunParams,
   setRunStatus
-} from "./chunk-M3IE3VNC.js";
+} from "./chunk-WDIKPIMB.js";
 import {
   createRiddleProofRunCard
-} from "./chunk-RBAU2M4S.js";
+} from "./chunk-JJ4IWRMJ.js";
 import {
   canonicalProofAssessmentStageForDecision,
   noImplementationModeFor,
@@ -27,7 +27,7 @@ import {
   normalizeCheckpointResponse,
   proofContractFromAuthorCheckpointResponse,
   statePathsForRunState
-} from "./chunk-AXWJJ2LC.js";
+} from "./chunk-BLM5EIBA.js";
 import {
   applyTerminalMetadata,
   compactRecord,
@@ -361,6 +361,32 @@ function isReadyShipGate(result) {
 function proofAssessmentRequestsShip(payload) {
   return String(payload.decision || "").trim() === "ready_to_ship";
 }
+var TRUSTED_PROOF_ASSESSMENT_READY_SOURCES = /* @__PURE__ */ new Set([
+  "supervising_agent",
+  "supervisor",
+  "openclaw_auto_ship_mode_none"
+]);
+function proofAssessmentSourceTrustedForShip(payload) {
+  const source = nonEmptyString(payload.source)?.toLowerCase();
+  if (!source) return true;
+  return TRUSTED_PROOF_ASSESSMENT_READY_SOURCES.has(source);
+}
+function proofAssessmentSourceBlocker(input) {
+  if (!proofAssessmentRequestsShip(input.payload)) return null;
+  if (proofAssessmentSourceTrustedForShip(input.payload)) return null;
+  const source = nonEmptyString(input.payload.source) || "unknown";
+  return {
+    code: input.code || "proof_assessment_source_not_trusted",
+    checkpoint: input.checkpoint || null,
+    message: `Riddle Proof cannot mark ready_to_ship from untrusted proof assessment source: ${source}.`,
+    details: compactRecord({
+      stage: input.stage || null,
+      proofAssessment: input.payload,
+      checkpoint_response_source: input.response?.source || null,
+      response: input.response || null
+    })
+  };
+}
 function proofAssessmentHardBlockers(state, payload) {
   const blockers = proofAssessmentHardBlockersForState(state || {});
   if (Array.isArray(payload.hard_blockers)) {
@@ -391,6 +417,15 @@ function stageFromCheckpointResponse(response, packet) {
   const stage = response.continue_with_stage || nonEmptyString(payload.continue_with_stage) || nonEmptyString(payload.recommended_stage) || nonEmptyString(resume?.continue_with_stage) || (response.decision === "retry_stage" ? packet.stage : "");
   return stage ? stage : null;
 }
+function proofAssessmentSourceFromCheckpointResponse(response) {
+  const kind = nonEmptyString(response.source?.kind)?.toLowerCase();
+  if (!kind) return "supervising_agent";
+  if (kind === "human") return "supervisor";
+  if (kind === "codex" || kind === "openclaw-main" || kind === "claude-code") {
+    return "supervising_agent";
+  }
+  return `checkpoint_response:${kind}`;
+}
 function proofAssessmentPayloadFromCheckpointResponse(response) {
   if (![
     "ready_to_ship",
@@ -411,7 +446,7 @@ function proofAssessmentPayloadFromCheckpointResponse(response) {
     continue_with_stage: stage || void 0,
     escalation_target: nonEmptyString(payload.escalation_target) || "agent",
     reasons: Array.isArray(response.reasons) ? response.reasons : Array.isArray(payload.reasons) ? payload.reasons : [],
-    source: "supervising_agent",
+    source: proofAssessmentSourceFromCheckpointResponse(response),
     checkpoint_response_source: response.source || null,
     checkpoint_response_created_at: response.created_at
   }));
@@ -738,6 +773,22 @@ function checkpointResponseContinuation(state, value) {
       }
     };
   }
+  if (packet.packet_id && response.packet_id !== packet.packet_id) {
+    return {
+      blocker: {
+        code: "checkpoint_response_packet_id_mismatch",
+        checkpoint: packet.checkpoint,
+        message: "Checkpoint response packet_id does not match the pending checkpoint packet.",
+        details: {
+          stage: packet.stage,
+          expected_packet_id: packet.packet_id,
+          actual_packet_id: response.packet_id || null,
+          expected_resume_token: packet.resume_token || null,
+          actual_resume_token: response.resume_token || null
+        }
+      }
+    };
+  }
   if (!packet.allowed_decisions.includes(response.decision)) {
     return {
       blocker: {
@@ -846,6 +897,14 @@ function checkpointResponseContinuation(state, value) {
   if (packet.kind === "assess_proof" || packet.kind === "recover_evidence" || packet.stage === "verify") {
     const assessment = proofAssessmentPayloadFromCheckpointResponse(response);
     if (assessment) {
+      const sourceBlocker = proofAssessmentSourceBlocker({
+        checkpoint: packet.checkpoint,
+        stage: packet.stage,
+        payload: assessment,
+        response,
+        code: "checkpoint_response_source_not_trusted"
+      });
+      if (sourceBlocker) return { blocker: sourceBlocker };
       appendCheckpointResponse(state, response);
       if (state.request.ship_mode !== "ship" && proofAssessmentRequestsShip(assessment)) {
         const result = {
@@ -1404,6 +1463,25 @@ async function routeCheckpoint(request, state, result, agent, input) {
         }
       };
     }
+    const sourceBlocker = proofAssessmentSourceBlocker({
+      checkpoint,
+      stage: "verify",
+      payload,
+      code: "proof_assessment_source_not_trusted"
+    });
+    if (sourceBlocker) {
+      recordEvent(state, {
+        kind: "agent.proof_assessment.source_blocked",
+        checkpoint,
+        stage: "verify",
+        summary: sourceBlocker.message,
+        details: compactRecord({
+          proof_assessment: payload,
+          agent_duration_ms: durationMs
+        })
+      });
+      return { blocker: sourceBlocker };
+    }
     const visualBlocker = proofAssessmentVisualBlocker({
       ...context.fullRiddleState || {},
       verification_mode: context.fullRiddleState?.verification_mode || request.verification_mode

package/dist/{chunk-RBAU2M4S.js → chunk-JJ4IWRMJ.js}

@@ -1,6 +1,6 @@
 import {
   statePathsForRunState
-} from "./chunk-AXWJJ2LC.js";
+} from "./chunk-BLM5EIBA.js";
 import {
   compactRecord,
   isTerminalStatus,

package/dist/{chunk-OYWZGDTS.js → chunk-LNWJAHAQ.js}

@@ -1,7 +1,7 @@
 import {
   normalizeIntegrationContext,
   normalizeRunParams
-} from "./chunk-M3IE3VNC.js";
+} from "./chunk-WDIKPIMB.js";
 import {
   compactRecord
 } from "./chunk-VY4Y5U57.js";