@riddledc/riddle-proof 0.8.62 → 0.8.64

package/dist/advanced/index.cjs

@@ -5107,6 +5107,9 @@ function shouldIterate(assessment) {
   const nextStage = assessment.continue_with_stage || assessment.recommended_stage;
   return nextStage === "implement" || nextStage === "author";
 }
+function hasTrustedReadySource(assessment) {
+  return assessment.source === "supervising_agent" || assessment.source === "supervisor";
+}
 async function notifyIfConfigured(input) {
   if (!input.notification) return input.result;
   try {
@@ -5442,6 +5445,7 @@ async function runRiddleProof(input) {
           decision: assessment.decision,
           recommended_stage: assessment.recommended_stage,
           continue_with_stage: assessment.continue_with_stage,
+          source: assessment.source,
           reasons: assessment.reasons
         }
       });
@@ -5453,7 +5457,27 @@ async function runRiddleProof(input) {
         evidence_bundle: evidenceBundle
       });
     }
-    if (assessment.decision === "ready_to_ship") break;
+    if (assessment.decision === "ready_to_ship") {
+      if (!hasTrustedReadySource(assessment)) {
+        return blockRun({
+          state,
+          stage: "verify",
+          blocker: adapterBlocker(
+            "proof_assessment_untrusted_source",
+            "A ready_to_ship proof assessment must come from a supervising source.",
+            "judge_completed",
+            {
+              decision: assessment.decision,
+              source: assessment.source || null,
+              trusted_sources: ["supervising_agent", "supervisor"]
+            }
+          ),
+          evidence_bundle: evidenceBundle,
+          raw: { assessment }
+        });
+      }
+      break;
+    }
     if (attempt + 1 < maxIterations && shouldIterate(assessment)) {
       evidenceContext = evidenceBundle;
       appendRunEvent(state, {

package/dist/advanced/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-VYJD6XYF.js";
 import {
   runner_exports
-} from "../chunk-HRY2IHXM.js";
+} from "../chunk-LD2YTPD7.js";
 import {
   engine_harness_exports
 } from "../chunk-P4BHU5NM.js";

package/dist/advanced/runner.cjs

@@ -633,6 +633,9 @@ function shouldIterate(assessment) {
   const nextStage = assessment.continue_with_stage || assessment.recommended_stage;
   return nextStage === "implement" || nextStage === "author";
 }
+function hasTrustedReadySource(assessment) {
+  return assessment.source === "supervising_agent" || assessment.source === "supervisor";
+}
 async function notifyIfConfigured(input) {
   if (!input.notification) return input.result;
   try {
@@ -968,6 +971,7 @@ async function runRiddleProof(input) {
           decision: assessment.decision,
           recommended_stage: assessment.recommended_stage,
           continue_with_stage: assessment.continue_with_stage,
+          source: assessment.source,
           reasons: assessment.reasons
         }
       });
@@ -979,7 +983,27 @@ async function runRiddleProof(input) {
         evidence_bundle: evidenceBundle
       });
     }
-    if (assessment.decision === "ready_to_ship") break;
+    if (assessment.decision === "ready_to_ship") {
+      if (!hasTrustedReadySource(assessment)) {
+        return blockRun({
+          state,
+          stage: "verify",
+          blocker: adapterBlocker(
+            "proof_assessment_untrusted_source",
+            "A ready_to_ship proof assessment must come from a supervising source.",
+            "judge_completed",
+            {
+              decision: assessment.decision,
+              source: assessment.source || null,
+              trusted_sources: ["supervising_agent", "supervisor"]
+            }
+          ),
+          evidence_bundle: evidenceBundle,
+          raw: { assessment }
+        });
+      }
+      break;
+    }
     if (attempt + 1 < maxIterations && shouldIterate(assessment)) {
       evidenceContext = evidenceBundle;
       appendRunEvent(state, {

package/dist/advanced/runner.js

@@ -1,6 +1,6 @@
 import {
   runRiddleProof
-} from "../chunk-HRY2IHXM.js";
+} from "../chunk-LD2YTPD7.js";
 import "../chunk-NMQIWBSB.js";
 import "../chunk-2OTPBHSM.js";
 import "../chunk-EKZXU6MU.js";

package/dist/{chunk-HRY2IHXM.js → chunk-LD2YTPD7.js}

@@ -61,6 +61,9 @@ function shouldIterate(assessment) {
   const nextStage = assessment.continue_with_stage || assessment.recommended_stage;
   return nextStage === "implement" || nextStage === "author";
 }
+function hasTrustedReadySource(assessment) {
+  return assessment.source === "supervising_agent" || assessment.source === "supervisor";
+}
 async function notifyIfConfigured(input) {
   if (!input.notification) return input.result;
   try {
@@ -396,6 +399,7 @@ async function runRiddleProof(input) {
           decision: assessment.decision,
           recommended_stage: assessment.recommended_stage,
           continue_with_stage: assessment.continue_with_stage,
+          source: assessment.source,
           reasons: assessment.reasons
         }
       });
@@ -407,7 +411,27 @@ async function runRiddleProof(input) {
         evidence_bundle: evidenceBundle
       });
     }
-    if (assessment.decision === "ready_to_ship") break;
+    if (assessment.decision === "ready_to_ship") {
+      if (!hasTrustedReadySource(assessment)) {
+        return blockRun({
+          state,
+          stage: "verify",
+          blocker: adapterBlocker(
+            "proof_assessment_untrusted_source",
+            "A ready_to_ship proof assessment must come from a supervising source.",
+            "judge_completed",
+            {
+              decision: assessment.decision,
+              source: assessment.source || null,
+              trusted_sources: ["supervising_agent", "supervisor"]
+            }
+          ),
+          evidence_bundle: evidenceBundle,
+          raw: { assessment }
+        });
+      }
+      break;
+    }
     if (attempt + 1 < maxIterations && shouldIterate(assessment)) {
       evidenceContext = evidenceBundle;
       appendRunEvent(state, {

package/dist/index.cjs

@@ -5402,6 +5402,9 @@ function shouldIterate(assessment) {
   const nextStage = assessment.continue_with_stage || assessment.recommended_stage;
   return nextStage === "implement" || nextStage === "author";
 }
+function hasTrustedReadySource(assessment) {
+  return assessment.source === "supervising_agent" || assessment.source === "supervisor";
+}
 async function notifyIfConfigured(input) {
   if (!input.notification) return input.result;
   try {
@@ -5737,6 +5740,7 @@ async function runRiddleProof(input) {
           decision: assessment.decision,
           recommended_stage: assessment.recommended_stage,
           continue_with_stage: assessment.continue_with_stage,
+          source: assessment.source,
           reasons: assessment.reasons
         }
       });
@@ -5748,7 +5752,27 @@ async function runRiddleProof(input) {
         evidence_bundle: evidenceBundle
       });
     }
-    if (assessment.decision === "ready_to_ship") break;
+    if (assessment.decision === "ready_to_ship") {
+      if (!hasTrustedReadySource(assessment)) {
+        return blockRun({
+          state,
+          stage: "verify",
+          blocker: adapterBlocker(
+            "proof_assessment_untrusted_source",
+            "A ready_to_ship proof assessment must come from a supervising source.",
+            "judge_completed",
+            {
+              decision: assessment.decision,
+              source: assessment.source || null,
+              trusted_sources: ["supervising_agent", "supervisor"]
+            }
+          ),
+          evidence_bundle: evidenceBundle,
+          raw: { assessment }
+        });
+      }
+      break;
+    }
     if (attempt + 1 < maxIterations && shouldIterate(assessment)) {
       evidenceContext = evidenceBundle;
       appendRunEvent(state, {

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   runRiddleProof
-} from "./chunk-HRY2IHXM.js";
+} from "./chunk-LD2YTPD7.js";
 import "./chunk-6F4PWJZI.js";
 import {
   RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION,

package/dist/runner.cjs

@@ -633,6 +633,9 @@ function shouldIterate(assessment) {
   const nextStage = assessment.continue_with_stage || assessment.recommended_stage;
   return nextStage === "implement" || nextStage === "author";
 }
+function hasTrustedReadySource(assessment) {
+  return assessment.source === "supervising_agent" || assessment.source === "supervisor";
+}
 async function notifyIfConfigured(input) {
   if (!input.notification) return input.result;
   try {
@@ -968,6 +971,7 @@ async function runRiddleProof(input) {
           decision: assessment.decision,
           recommended_stage: assessment.recommended_stage,
           continue_with_stage: assessment.continue_with_stage,
+          source: assessment.source,
           reasons: assessment.reasons
         }
       });
@@ -979,7 +983,27 @@ async function runRiddleProof(input) {
         evidence_bundle: evidenceBundle
       });
     }
-    if (assessment.decision === "ready_to_ship") break;
+    if (assessment.decision === "ready_to_ship") {
+      if (!hasTrustedReadySource(assessment)) {
+        return blockRun({
+          state,
+          stage: "verify",
+          blocker: adapterBlocker(
+            "proof_assessment_untrusted_source",
+            "A ready_to_ship proof assessment must come from a supervising source.",
+            "judge_completed",
+            {
+              decision: assessment.decision,
+              source: assessment.source || null,
+              trusted_sources: ["supervising_agent", "supervisor"]
+            }
+          ),
+          evidence_bundle: evidenceBundle,
+          raw: { assessment }
+        });
+      }
+      break;
+    }
     if (attempt + 1 < maxIterations && shouldIterate(assessment)) {
       evidenceContext = evidenceBundle;
       appendRunEvent(state, {

package/dist/runner.js

@@ -1,6 +1,6 @@
 import {
   runRiddleProof
-} from "./chunk-HRY2IHXM.js";
+} from "./chunk-LD2YTPD7.js";
 import "./chunk-NMQIWBSB.js";
 import "./chunk-2OTPBHSM.js";
 import "./chunk-EKZXU6MU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.8.62",
+  "version": "0.8.64",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",

package/runtime/lib/ship.py

@@ -676,6 +676,64 @@ def first_url_from_command_output(*parts):
     return ''
 
 
+def dict_value(value):
+    return value if isinstance(value, dict) else {}
+
+
+def proof_provenance_facts(state):
+    assessment = dict_value(state.get('proof_assessment'))
+    bundle = dict_value(state.get('evidence_bundle'))
+    bundle_session = dict_value(bundle.get('proof_session'))
+    proof_session = dict_value(state.get('proof_session')) or bundle_session
+    publication = dict_value(state.get('proof_artifact_publication'))
+    checkpoint_packet = dict_value(state.get('checkpoint_packet'))
+    checkpoint_summary = dict_value(state.get('checkpoint_summary'))
+    return {
+        'version': 'riddle-proof.provenance.v1',
+        'run_id': str(state.get('run_id') or ''),
+        'checkpoint_packet_id': str(
+            checkpoint_packet.get('packet_id')
+            or checkpoint_summary.get('latest_packet_id')
+            or ''
+        ),
+        'checkpoint_response_packet_id': str(
+            checkpoint_summary.get('latest_response_packet_id')
+            or ''
+        ),
+        'evidence_bundle_id': str(
+            bundle.get('evidence_bundle_id')
+            or bundle.get('bundle_id')
+            or bundle.get('id')
+            or ''
+        ),
+        'proof_session_id': str(
+            proof_session.get('session_id')
+            or bundle_session.get('session_id')
+            or ''
+        ),
+        'proof_session_fingerprint': str(
+            state.get('proof_session_fingerprint')
+            or proof_session.get('fingerprint')
+            or bundle_session.get('fingerprint')
+            or ''
+        ),
+        'proof_assessment_id': str(
+            assessment.get('assessment_id')
+            or assessment.get('id')
+            or ''
+        ),
+        'proof_assessment_source': str(
+            assessment.get('source')
+            or state.get('proof_assessment_source')
+            or ''
+        ),
+        'proof_assessment_decision': str(assessment.get('decision') or ''),
+        'artifact_publication_commit': str(publication.get('commit') or ''),
+        'artifact_manifest_url': str(publication.get('manifest_url') or ''),
+        'artifact_source_fingerprint': str(publication.get('source_fingerprint') or ''),
+    }
+
+
 def build_ship_report(state, marked_ready=None):
     branch = state.get('target_branch') or state.get('branch') or ''
     if marked_ready is None:
@@ -685,6 +743,7 @@ def build_ship_report(state, marked_ready=None):
     after_artifact_url = first_public_artifact_url(state, 'after', 'image') or state.get('after_cdn', '')
     artifact_publication = state.get('proof_artifact_publication') or {}
     ship_gate = ship_gate_report_facts(state)
+    proof_provenance = proof_provenance_facts(state)
     return {
         'pr_url': state.get('pr_url', ''),
         'pr_branch': branch,
@@ -703,6 +762,7 @@ def build_ship_report(state, marked_ready=None):
         'proof_artifacts_manifest_url': artifact_publication.get('manifest_url', '') if isinstance(artifact_publication, dict) else '',
         'proof_artifact_publication': artifact_publication if isinstance(artifact_publication, dict) else {},
         'ship_gate': ship_gate,
+        'proof_provenance': proof_provenance,
     }
 
 

package/runtime/tests/ship_artifact_publication.py

@@ -138,12 +138,27 @@ def main():
             "proof_summary": "All assertions passed.",
             "proof_assessment_source": "supervising_agent",
             "proof_assessment": {
+                "assessment_id": "assessment_ship_artifact_test",
                 "source": "supervising_agent",
                 "decision": "ready_to_ship",
                 "summary": "Evidence is strong enough to ship.",
             },
+            "checkpoint_summary": {
+                "latest_packet_id": "rppkt_ship_artifact_test",
+                "latest_response_packet_id": "rppkt_ship_artifact_test",
+            },
+            "proof_session": {
+                "session_id": "session_ship_artifact_test",
+                "fingerprint": "fingerprint_ship_artifact_test",
+            },
+            "proof_session_fingerprint": "fingerprint_ship_artifact_test",
             "evidence_bundle": {
+                "id": "bundle_ship_artifact_test",
                 "verification_mode": "proof",
+                "proof_session": {
+                    "session_id": "session_ship_artifact_test",
+                    "fingerprint": "fingerprint_ship_artifact_test",
+                },
                 "after": {
                     "observation": {"valid": True, "reason": "ok", "telemetry_ready": True},
                     "supporting_artifacts": {
@@ -204,6 +219,46 @@ def main():
             "ship gate should expose proof decision"
         )
         assert gate_evidence.get("hard_blockers") == [], "ship gate should expose hard blockers"
+        provenance = ship_report.get("proof_provenance") or {}
+        assert provenance.get("version") == "riddle-proof.provenance.v1", (
+            "ship report should expose proof provenance version"
+        )
+        assert provenance.get("run_id") == "rp_ship_artifact_test", (
+            "ship report provenance should expose the run id"
+        )
+        assert provenance.get("checkpoint_packet_id") == "rppkt_ship_artifact_test", (
+            "ship report provenance should expose the checkpoint packet id"
+        )
+        assert provenance.get("checkpoint_response_packet_id") == "rppkt_ship_artifact_test", (
+            "ship report provenance should expose the checkpoint response packet id"
+        )
+        assert provenance.get("evidence_bundle_id") == "bundle_ship_artifact_test", (
+            "ship report provenance should expose the evidence bundle id"
+        )
+        assert provenance.get("proof_session_id") == "session_ship_artifact_test", (
+            "ship report provenance should expose the proof session id"
+        )
+        assert provenance.get("proof_session_fingerprint") == "fingerprint_ship_artifact_test", (
+            "ship report provenance should expose the proof session fingerprint"
+        )
+        assert provenance.get("proof_assessment_id") == "assessment_ship_artifact_test", (
+            "ship report provenance should expose the proof assessment id"
+        )
+        assert provenance.get("proof_assessment_source") == "supervising_agent", (
+            "ship report provenance should expose the proof assessment source"
+        )
+        assert provenance.get("proof_assessment_decision") == "ready_to_ship", (
+            "ship report provenance should expose the proof assessment decision"
+        )
+        assert provenance.get("artifact_publication_commit") == publication.get("commit"), (
+            "ship report provenance should expose the artifact publication commit"
+        )
+        assert provenance.get("artifact_manifest_url") == ship_report.get("proof_artifacts_manifest_url"), (
+            "ship report provenance should expose the artifact manifest URL"
+        )
+        assert provenance.get("artifact_source_fingerprint") == publication.get("source_fingerprint"), (
+            "ship report provenance should expose the artifact source fingerprint"
+        )
 
         comment = comment_body_path.read_text(encoding="utf-8")
         assert "file://" not in comment, "PR proof comment must not expose local file URLs"