@sabaiway/agent-workflow-kit 14.4.1 → 14.4.3

package/tools/core-evidence.mjs

@@ -34,1138 +34,30 @@
 // security boundary); coverage/green verification of red-proof records lives in the final-run
 // checker, not here. Dependency-free. No side effects on import.
 
-import { readFileSync, lstatSync, realpathSync, readlinkSync, openSync, readSync, closeSync } from 'node:fs';
-import { join, dirname, normalize, sep, basename } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { writeContainedFileAtomic } from './atomic-write.mjs';
-import { parsePositiveIntKnob, probeVerdict } from './changed-surface.mjs';
 import { isDirectRun } from './direct-run.mjs';
-import { readRegularFileNoFollow } from './fs-read-nofollow.mjs';
-import { lexicalRepoRelative } from './repo-lex.mjs';
-import { GIT_MAX_BUFFER, resolveGitLocation, withGitPath } from './git-env.mjs';
-// The coverage vocabulary leaf: run-gates RECORDS the token this validator checks, and run-gates
-// imports THIS module (the sole-writer boundary), so their shared home sits below both.
-import { COVERAGE, FINAL_COVERAGE_STATES } from './coverage-state.mjs';
-
-export const CORE_EVIDENCE_STOP = 'CORE_EVIDENCE_STOP';
-const stop = (message) => Object.assign(new Error(`[agent-workflow-kit] ${message}`), { name: 'CoreEvidenceStop', code: CORE_EVIDENCE_STOP });
-const usageFail = (message) => Object.assign(new Error(`[agent-workflow-kit] ${message}`), { exitCode: 2 });
-
-const isoNow = () => new Date().toISOString();
-
-const gitRaw = (args, cwd) => spawnSync('git', args, { cwd, maxBuffer: GIT_MAX_BUFFER, windowsHide: true });
-
-// Exported so a consumer computing over the SAME domain (the exec metric producer) reads git through
-// this one runner instead of growing a second spawnSync wrapper with its own buffer bound.
-export const gitBuf = (args, cwd) => {
-  const r = gitRaw(args, cwd);
-  if (r.error || r.status !== 0) return null;
-  return r.stdout;
-};
-
-const gitLine = (args, cwd) => {
-  const buf = gitBuf(args, cwd);
-  return buf == null ? null : buf.toString('utf8').replace(/\r?\n$/, '');
-};
-
-// ── the canonical review-domain primitives (ONE home; review-state re-exports its public API) ─────
-// The uncommitted-state identity + the receipt read path + the attesting predicate live HERE — the
-// DAG bottom every checker (review-state gate, ledger cross-check, this module's summary) imports
-// from, so no two consumers can ever disagree about what a fingerprint or an attestation is.
-
-// resolveBase(cwd) → the current HEAD commit sha, or null on an unborn branch / outside a git tree.
-export const resolveBase = (cwd) => gitLine(['rev-parse', '--verify', '--quiet', 'HEAD'], cwd);
-
-// testId FORMAT: "<repo-relative test file>#<test-name-pattern>" — a "#" separator with BOTH halves
-// non-empty. Format-only (no suffix rule); resolvability is the probe's job.
-const TESTID_SEPARATOR = '#';
-export const isWellFormedTestId = (v) => {
-  if (typeof v !== 'string') return false;
-  const at = v.indexOf(TESTID_SEPARATOR);
-  return at > 0 && at < v.length - 1;
-};
-export const splitTestId = (v) => {
-  const at = v.indexOf(TESTID_SEPARATOR);
-  return { file: v.slice(0, at), pattern: v.slice(at + 1) };
-};
-
-// First 8 KiB contain a NUL byte → binary (git's own heuristic; mirrors the wrappers' is_binary
-// bash twin). An unreadable path reads as text (the fail-safe arm — the payload walk then surfaces
-// its own read failure).
-export const isBinaryFile = (path) => {
-  let fd;
-  try {
-    fd = openSync(path, 'r');
-    const buf = Buffer.alloc(8192);
-    const n = readSync(fd, buf, 0, 8192, 0);
-    return buf.subarray(0, n).includes(0);
-  } catch {
-    return false;
-  } finally {
-    if (fd !== undefined) closeSync(fd);
-  }
-};
-
-// The never-committable untracked stat classes: character/block devices, FIFOs, sockets — excluded
-// from the ENTIRE review domain (fingerprint payload, clean check); lstat-keyed because a lying
-// dirent is exactly how sandbox masks surface.
-export const isNeverCommittableStat = (stat) =>
-  stat != null &&
-  (stat.isCharacterDevice() || stat.isBlockDevice() || stat.isFIFO() || stat.isSocket());
-
-// The git runner seam the tree computations share — (args, dir, input, env) — and its guard: a
-// runner that THROWS answers as a failed spawn (measured: a raw stack out of a fingerprint).
-const defaultRunGit = (args, dir, input, env) => spawnSync('git', args, { cwd: dir, input, env: withGitPath(env ?? process.env), maxBuffer: GIT_MAX_BUFFER, windowsHide: true });
-const guardedRunner = (runGit, env) => (args, dir, input, override) => {
-  try { return runGit(args, dir, input, override ?? env); } catch (err) { return { error: err, status: null, signal: null, stdout: Buffer.alloc(0), stderr: '' }; }
-};
-const stdoutOf = (r) => (r.error || r.status !== 0 ? null : r.stdout);
-// Only a work-tree location is computed over (git-env's table under the runner's own env) — a redirecting GIT_DIR never hashes another repository in silence.
-const locateWorkTree = (cwd, run, env) => {
-  const location = resolveGitLocation(cwd, { spawn: (cmd, args, opts) => run(args, opts.cwd, undefined, opts.env), env });
-  return location.state === 'work-tree' ? location.top : null;
-};
-
-// The canonical payload bytes: staged diff + unstaged diff + the untracked-not-ignored section —
-// byte-identical to the wrappers' emit_fingerprint_payload, emitted from the work-tree ROOT. Null on
-// every location but a work tree. lstat is injectable ONLY for the never-committable filter tests.
-export const FINGERPRINT_CACHED_DIFF_ARGV = Object.freeze(['diff', '--cached', '--no-ext-diff', '--no-textconv', '--ignore-submodules=none']);
-export const FINGERPRINT_UNSTAGED_DIFF_ARGV = Object.freeze(['diff', '--no-ext-diff', '--no-textconv', '--ignore-submodules=none']);
-export const computeFingerprintPayload = (cwd, { lstat = lstatSync, runGit = null, env = process.env } = {}) => {
-  const run = guardedRunner(runGit ?? defaultRunGit, env);
-  const top = locateWorkTree(cwd, run, env);
-  if (top == null) return null;
-  const buf = (args) => stdoutOf(run(args, top));
-  const staged = buf(FINGERPRINT_CACHED_DIFF_ARGV);
-  const unstaged = buf(FINGERPRINT_UNSTAGED_DIFF_ARGV);
-  const untrackedZ = buf(['ls-files', '--others', '--exclude-standard', '-z']);
-  if (staged == null || unstaged == null || untrackedZ == null) return null;
-  const chunks = [staged, unstaged];
-  for (const rel of untrackedZ.toString('utf8').split('\0').filter(Boolean)) {
-    const full = join(top, rel);
-    let stat = null;
-    try {
-      stat = lstat(full);
-    } catch {
-      stat = null;
-    }
-    if (isNeverCommittableStat(stat)) continue;
-    if (stat?.isSymbolicLink()) {
-      let target = '?';
-      try {
-        target = readlinkSync(full);
-      } catch {
-        target = '?';
-      }
-      chunks.push(Buffer.from(`untracked-symlink:${rel} -> ${target}\n`));
-    } else if (!stat?.isFile()) {
-      chunks.push(Buffer.from(`untracked-nonregular:${rel}\n`));
-    } else if (isBinaryFile(full)) {
-      chunks.push(Buffer.from(`untracked-binary:${rel}\n`));
-    } else {
-      chunks.push(Buffer.from(`untracked:${rel}\n`));
-      chunks.push(readFileSync(full));
-    }
-  }
-  return Buffer.concat(chunks);
-};
-
-// sha256 hex of the canonical payload, or null outside a git work tree.
-export const computeTreeFingerprint = (cwd, fsx) => {
-  const payload = computeFingerprintPayload(cwd, fsx);
-  return payload == null ? null : createHash('sha256').update(payload).digest('hex');
-};
-
-// The fingerprint of a CONTENT-FREE payload — a clean work tree emits no bytes at all, so this ONE
-// value is shared by every clean moment of every repository. It therefore identifies no working
-// state and correlates to no base: evidence found at it was minted by some other clean moment,
-// possibly at another base, and can decide nothing in either direction. Two situations reach it,
-// and only the INDEX tells them apart (never the payload): an empty commit, where the index equals
-// HEAD and no byte enters the repository, and staged content the payload cannot see — a gitlink
-// hidden from `git diff` by an ignore configuration. Read by the consumers that correlate a
-// fingerprint to a base (flow-check-rungs.mjs #65) and by commit-guard's two content-free lanes.
-export const CONTENT_FREE_FINGERPRINT = createHash('sha256').update(Buffer.alloc(0)).digest('hex');
-
-// The index↔worktree split the fingerprint deliberately CANNOT see: the payload above concatenates
-// the staged and unstaged diffs, so against an otherwise-empty index a hunk moving into the index
-// leaves it byte-identical — while `git commit` builds the commit from the INDEX alone. This is the
-// ONE computation of that split; isTreeClean and the commit guard's index-lag arm both read it, so
-// they can never disagree about what "the index carries the verified tree" means. Submodule paths
-// are separated because a root-level `git add -A` cannot reach a submodule's own worktree, so they
-// need their own recovery. Anchored at the work-tree ROOT (ls-files is cwd-scoped); null when not
-// decidable — every consumer treats that as fail-closed, never as clean.
-const LS_FILES_TAG_SKIP_WORKTREE = 'S';
-const GITLINK_MODE = '160000';
-const SYMLINK_MODE = '120000';
-const EXECUTABLE_MODE = '100755';
-const OWNER_EXECUTE_BIT = 0o100;
-// `ls-files -v` lowercases the tag for assume-unchanged; skip-worktree is `S`, and an entry
-// carrying BOTH bits prints lowercase `s` (live-pinned by test). The skip test is therefore
-// case-INSENSITIVE — a case-sensitive one would lose skip-worktree on such an entry and turn a
-// legitimate sparse checkout into an endless refusal.
-const isAssumeUnchangedTag = (tag) => tag >= 'a' && tag <= 'z';
-const isSkipWorktreeTag = (tag) => tag.toUpperCase() === LS_FILES_TAG_SKIP_WORKTREE;
-
-// `git diff` SKIPS index entries carrying skip-worktree or assume-unchanged, so such a path can
-// hold worktree bytes the gates read while `git commit` takes the stale INDEX blob — the same
-// capture blindness one layer down, and invisible to the plain probe. Those entries are therefore
-// compared DIRECTLY against the worktree. A MISSING skip-worktree path is an ordinary sparse
-// checkout and never a lag; a missing assume-unchanged path is one. Gitlinks belong to the
-// submodule lane. Any probe that cannot answer counts the path as lagging (fail-safe).
-const flaggedIndexLag = (top, runGit, lstat, readlink) => {
-  const buf = (args) => {
-    const r = runGit(args, top);
-    return r.error || r.status !== 0 ? null : r.stdout;
-  };
-  const splitZ = (b) => b.toString('utf8').split('\0').filter(Boolean);
-  // Git emits raw path BYTES. Decoding to UTF-8 first turns a name carrying invalid bytes into a
-  // DIFFERENT path, whose lstat then answers ENOENT — which for a skip-worktree entry reads as a
-  // de-materialised sparse path and lets a stale index walk through. So each record keeps its
-  // original slice and a name that does not survive a byte round-trip is lagging by construction.
-  const splitZBytes = (b) => {
-    const out = [];
-    let start = 0;
-    for (let i = 0; i < b.length; i += 1) {
-      if (b[i] !== 0) continue;
-      if (i > start) out.push(b.subarray(start, i));
-      start = i + 1;
-    }
-    if (start < b.length) out.push(b.subarray(start));
-    return out;
-  };
-  const decodesExactly = (slice) => Buffer.from(slice.toString('utf8'), 'utf8').equals(slice);
-  const taggedZ = buf(['ls-files', '-v', '-z']);
-  if (taggedZ == null) return null;
-  // The two bits are INDEPENDENT — an entry can carry both (which is what lowercases the `S`), so
-  // they travel as a pair and the recovery clears whichever are actually set.
-  const flagged = splitZBytes(taggedZ)
-    .map((record) => {
-      const tag = record.subarray(0, 1).toString('utf8');
-      const pathBytes = record.subarray(2);
-      return {
-        rel: pathBytes.toString('utf8'),
-        pathBytes,
-        exactName: decodesExactly(pathBytes),
-        skipWorktree: isSkipWorktreeTag(tag),
-        assumeUnchanged: isAssumeUnchangedTag(tag),
-      };
-    })
-    .filter(({ skipWorktree, assumeUnchanged }) => skipWorktree || assumeUnchanged);
-  if (flagged.length === 0) return { paths: [], submodules: [], flagged: [] };
-  const stagedZ = buf(['ls-files', '-s', '-z']);
-  if (stagedZ == null) return null;
-  const entries = new Map();
-  for (const line of splitZ(stagedZ)) {
-    const tab = line.indexOf('\t');
-    if (tab === -1) continue;
-    const [mode, oid] = line.slice(0, tab).split(' ');
-    entries.set(line.slice(tab + 1), { mode, oid });
-  }
-  // `git diff` honours core.fileMode; mirroring it keeps a false-mode host (WSL, network mounts)
-  // from reading every executable bit as a lag. Exit 1 is the only "unset" (git's default is true);
-  // any other failure leaves the comparison undecidable rather than guessing.
-  const boolConfig = (key) => {
-    const r = runGit(['config', '--type=bool', '--get', key], top);
-    if (r.error || (r.status !== 0 && r.status !== 1)) return null; // undecidable — never guessed
-    return r.status === 1 || r.stdout.toString('utf8').trim() !== 'false'; // exit 1 = unset = git's default true
-  };
-  const honoursFileMode = boolConfig('core.fileMode');
-  // On a host without symlink support git materialises a symlink as a REGULAR FILE holding the
-  // target bytes; demanding a real link there would refuse forever.
-  const materialisesSymlinks = boolConfig('core.symlinks');
-  if (honoursFileMode === null || materialisesSymlinks === null) return null;
-  const lagging = [];
-  const laggingSubmodules = [];
-  const laggingFlags = [];
-  for (const { rel, pathBytes, exactName, skipWorktree, assumeUnchanged } of flagged) {
-    const entry = entries.get(rel);
-    if (entry === undefined) continue;
-    const isGitlink = entry.mode === GITLINK_MODE;
-    // Every path this loop reports needs its index bits cleared before ANY staging command can
-    // pick it up — `git add -A` alone is a recovery that silently does nothing here.
-    const lag = () => {
-      (isGitlink ? laggingSubmodules : lagging).push(rel);
-      laggingFlags.push({ rel, skipWorktree, assumeUnchanged, exactName });
-    };
-    // Probed by RAW BYTES, never by the decoded name: a lossy decode addresses a DIFFERENT path,
-    // and answering ENOENT for it would either wave a stale index through or — worse — call a
-    // legitimately absent sparse entry "lagging", whose prescribed bit-clear plus `git add -A`
-    // would then stage its DELETION.
-    const absPath = Buffer.concat([Buffer.from(top), Buffer.from(sep), pathBytes]);
-    let stat = null;
-    let absent = false;
-    try {
-      stat = lstat(absPath);
-    } catch (err) {
-      // ONLY a genuine absence is the sparse-checkout case; EACCES / EIO leave the path unproven,
-      // and an unproven path can never be waved through as "not materialised".
-      absent = err != null && err.code === 'ENOENT';
-    }
-    if (stat === null) {
-      if (!absent || !skipWorktree) lag();
-      continue;
-    }
-    if (!exactName) {
-      // Materialised, but the name cannot be addressed through an argv string, so it can never be
-      // PROVEN current — fail-safe. Absence was already decided above, on the real bytes.
-      lag();
-      continue;
-    }
-    // A flagged GITLINK is hidden from `git diff` too, so the submodule lane would never see it —
-    // and it is deliberately NOT proven current here. Three consecutive review rounds each found a
-    // new way for a nested probe to answer "clean" wrongly (inherited superproject GIT_*, status
-    // config blindness, the submodule's OWN flagged entries, a symlink standing in for the
-    // directory). The set was not shrinking, so the verdict is REDUCTION rather than another patch:
-    // a materialised flagged gitlink LAGS by construction. It is a refusal, never an endless one —
-    // the printed recovery (clear the bit, then git add -A) converges, and an UNflagged submodule
-    // is unaffected because the ordinary --ignore-submodules=none probe still judges it.
-    if (isGitlink) {
-      lag();
-      continue;
-    }
-    if (entry.mode === SYMLINK_MODE && !stat.isSymbolicLink() && !materialisesSymlinks) {
-      // The placeholder file's RAW bytes are the stored target — no filters ever apply to a link.
-      const placeholder = runGit(['hash-object', '--no-filters', '-t', 'blob', '--', join(top, rel)], top);
-      if (placeholder.error || placeholder.status !== 0 || placeholder.stdout.toString('utf8').trim() !== entry.oid) lag();
-      continue;
-    }
-    if (entry.mode === SYMLINK_MODE || stat.isSymbolicLink()) {
-      if (entry.mode !== SYMLINK_MODE || !stat.isSymbolicLink()) {
-        lag();
-        continue;
-      }
-      let target = null;
-      try {
-        target = readlink(join(top, rel));
-      } catch {
-        target = null;
-      }
-      if (target === null) {
-        lag(); // an unreadable link can never be proven current — fail-safe
-        continue;
-      }
-      const hashed = runGit(['hash-object', '-t', 'blob', '--stdin'], top, target);
-      if (hashed.error || hashed.status !== 0 || hashed.stdout.toString('utf8').trim() !== entry.oid) lag();
-      continue;
-    }
-    if (!stat.isFile()) {
-      lag();
-      continue;
-    }
-    // Git canonicalises the executable mode on the OWNER bit alone — a file with only group/other
-    // exec set is still `100644` to git, so testing 0o111 would call a stale index current.
-    if (honoursFileMode && (entry.mode === EXECUTABLE_MODE) !== ((stat.mode & OWNER_EXECUTE_BIT) !== 0)) {
-      lag();
-      continue;
-    }
-    const hashed = runGit(['hash-object', '--path', rel, '--', join(top, rel)], top);
-    if (hashed.error || hashed.status !== 0 || hashed.stdout.toString('utf8').trim() !== entry.oid) lag();
-  }
-  return { paths: lagging, submodules: laggingSubmodules, flagged: laggingFlags };
-};
-
-export const computeWorkingState = (cwd, { lstat = lstatSync, readlink = readlinkSync, runGit = null, env = process.env } = {}) => {
-  const run = guardedRunner(runGit ?? defaultRunGit, env);
-  const top = locateWorkTree(cwd, run, env);
-  if (top == null) return null;
-  // `--ignore-submodules=none` on the staged probe too: a config-hidden STAGED gitlink would
-  // otherwise make stagedDirty false, and isTreeClean would call such a tree clean.
-  const staged = run(['diff', '--cached', '--quiet', '--ignore-submodules=none'], top);
-  // ONLY 0 or 1 is a usable answer: a signal-killed probe reports status null, which the old
-  // `> 1` guard let through as "nothing staged" — a fail-OPEN the whole arm cannot afford.
-  if (staged.error || (staged.status !== 0 && staged.status !== 1)) return null;
-  const buf = (args) => stdoutOf(run(args, top));
-  // The FULL probe forces submodules back in: diff.ignoreSubmodules / submodule.<n>.ignore would
-  // otherwise erase a dirty submodule from the comparison entirely.
-  const changedZ = buf(['diff', '--name-only', '-z', '--ignore-submodules=none']);
-  const plainZ = buf(['diff', '--name-only', '-z', '--ignore-submodules=all']);
-  const untrackedZ = buf(['ls-files', '--others', '--exclude-standard', '-z']);
-  if (changedZ == null || plainZ == null || untrackedZ == null) return null;
-  const split = (b) => b.toString('utf8').split('\0').filter(Boolean);
-  const changed = [...new Set(split(changedZ))]; // an unmerged path is listed once per conflict side
-  const plain = new Set(split(plainZ));
-  const flagged = flaggedIndexLag(top, run, lstat, readlink);
-  if (flagged == null) return null;
-  const unstaged = changed.filter((rel) => plain.has(rel));
-  const submodules = changed.filter((rel) => !plain.has(rel));
-  return {
-    stagedDirty: staged.status === 1,
-    unstagedPaths: [...unstaged, ...flagged.paths.filter((rel) => !unstaged.includes(rel))],
-    unstagedSubmodulePaths: [...submodules, ...flagged.submodules.filter((rel) => !submodules.includes(rel))],
-    // Which lagging paths carry index bits, and which — `git add -A` cannot restage these at all.
-    flaggedPaths: flagged.flagged,
-    untrackedPaths: split(untrackedZ).filter((rel) => {
-      try {
-        return !isNeverCommittableStat(lstat(join(top, rel)));
-      } catch {
-        return true;
-      }
-    }),
-  };
-};
-
-// Clean = nothing staged, nothing unstaged, no REVIEWABLE untracked-not-ignored paths — the same
-// never-committable filter as the fingerprint, so the two can never disagree about a masks-only
-// tree. Null when not decidable.
-export const isTreeClean = (cwd, fsx) => {
-  const state = computeWorkingState(cwd, fsx);
-  if (state == null) return null;
-  return (
-    !state.stagedDirty &&
-    state.unstagedPaths.length === 0 &&
-    state.unstagedSubmodulePaths.length === 0 &&
-    state.untrackedPaths.length === 0
-  );
-};
-
-// ── the review-receipt read path + attesting predicate (ONE home) ────────────────────────────────
-
-export const RECEIPTS_BASENAME = 'agent-workflow-review-receipts.jsonl';
-
-export const resolveReceiptsPath = (cwd, env = process.env) => {
-  if (env.AW_REVIEW_RECEIPTS) return env.AW_REVIEW_RECEIPTS;
-  const gitDir = gitLine(['rev-parse', '--absolute-git-dir'], cwd);
-  return gitDir == null ? null : join(gitDir, RECEIPTS_BASENAME);
-};
-
-// Parse the receipt file → { receipts, malformed, readError? }. Absent file → empty (not an
-// error: no review ever ran). The read rides the fs-read-nofollow leaf (RECEIPTS-READER-NOFOLLOW):
-// a symlinked/FIFO/directory receipts path surfaces as readError — never content, never an empty
-// success — and any NON-ENOENT failure surfaces as readError too; an unreadable store must never
-// silently read as "no receipts" (the summary withholds its verdicts section on it). A malformed
-// line is counted + reported, never silently dropped. `io` is the injectable-read test seam
-// (readRegularFileNoFollow's descriptor-level io).
-export const readReceipts = (path, io = {}) => {
-  const read = readRegularFileNoFollow(path, io);
-  if (read.outcome === 'absent') return { receipts: [], malformed: 0 };
-  if (read.outcome === 'foreign') {
-    return { receipts: [], malformed: 0, readError: `the receipts store is a ${read.className}, not a regular file — refusing to read it (fail closed)` };
-  }
-  if (read.outcome === 'error') return { receipts: [], malformed: 0, readError: read.code };
-  const raw = read.content;
-  const receipts = [];
-  let malformed = 0;
-  for (const line of raw.split('\n')) {
-    if (line.trim() === '') continue;
-    try {
-      const parsed = JSON.parse(line);
-      if (parsed && typeof parsed === 'object' && typeof parsed.backend === 'string') receipts.push(parsed);
-      else malformed += 1;
-    } catch {
-      malformed += 1;
-    }
-  }
-  return { receipts, malformed };
-};
-
-// The closed review-verdict vocabulary (the union of both wrappers' closed grammars). Any
-// RECOGNIZED verdict is review EVIDENCE (a recognized negative is an authoritative veto); ONLY
-// ship-class SATISFIES the review-state gate.
-const SHIP_VERDICTS = new Set(['ship', 'ship with nits']);
-const NEGATIVE_VERDICTS = new Set(['revise', 'rethink', 'rework']);
-// Type-strict: only a STRING can enter the closed grammar — String() coercion would admit an
-// array like ["ship"] as ship-class.
-const normalizeVerdict = (verdict) => (typeof verdict === 'string' ? verdict.trim().toLowerCase() : null);
-export const isShipVerdict = (verdict) => {
-  const v = normalizeVerdict(verdict);
-  return v !== null && SHIP_VERDICTS.has(v);
-};
-export const isRecognizedVerdict = (verdict) => {
-  const v = normalizeVerdict(verdict);
-  return v !== null && (SHIP_VERDICTS.has(v) || NEGATIVE_VERDICTS.has(v));
-};
-
-export const REVIEW_RECEIPT_CLASS = Object.freeze({
-  NOT_CURRENT: 'not-current',
-  ATTESTING: 'attesting',
-  UNGROUNDED: 'ungrounded',
-  UNRECOGNIZED_VERDICT: 'unrecognized-verdict',
-  PROBE: 'probe',
-  UNMARKED: 'unmarked',
-  MALFORMED_MARKER: 'malformed-marker',
-  POSTURE_UNMARKED: 'posture-unmarked',
-  MALFORMED_POSTURE: 'malformed-posture',
-  DELIVERY_UNMARKED: 'delivery-unmarked',
-  MALFORMED_DELIVERY: 'malformed-delivery',
-});
-
-// Backends whose `code` receipts must SELF-DECLARE how the change set reached the model (D8b).
-// Scoped, not universal: agy's oversized lane was the one observed returning a confident
-// fabrication, and codex's receipt semantics are deliberately untouched.
-const DELIVERY_DECLARING_BACKENDS = new Set(['agy']);
-
-// A delivery declaration is a lowercase token naming HOW delivery was established (`inline` when
-// the whole change set rode one prompt, `fed` when a chunked feed proved it by echo). The gate
-// requires PRESENT and WELL-FORMED, never a PARTICULAR value — which lane was used is the
-// wrapper's business; that the receipt declares one at all is the gate's.
-const isValidReceiptDelivery = (delivery) =>
-  typeof delivery === 'string' && delivery.length > 0 && delivery.length <= 32 && /^[a-z][a-z0-9-]*$/.test(delivery);
-
-// The D5 posture declaration (strip Phase 4): an object whose `model` is a NON-EMPTY string;
-// `effort` (when present) a non-empty string; `tier` (when present) a non-empty string or null.
-// Backend-agnostic — the wrapper is the writer authority on WHICH keys it declares.
-const isValidReceiptPosture = (posture) => {
-  if (posture === null || typeof posture !== 'object' || Array.isArray(posture)) return false;
-  if (typeof posture.model !== 'string' || posture.model.length === 0) return false;
-  if (Object.hasOwn(posture, 'effort') && (typeof posture.effort !== 'string' || posture.effort.length === 0)) return false;
-  if (Object.hasOwn(posture, 'tier') && posture.tier !== null && (typeof posture.tier !== 'string' || posture.tier.length === 0)) return false;
-  return true;
-};
-
-// Classify ONE receipt against a tree fingerprint. Order is load-bearing: identity first (is this
-// even about the current tree?), then the probe marker (may it attest at all?), then the D5
-// posture marker (same self-declaration doctrine — an absent/invalid posture is non-attesting,
-// fail closed; pre-D5 receipts stop satisfying, the recovery is re-running the review), then the
-// verdict-in-recognized-vocabulary arm BEFORE grounding — an unrecognized verdict is an
-// unconditional refusal that grounding must never reclassify (an ungrounded `unknown` receipt
-// otherwise reads UNGROUNDED and can be masked by another backend's SHIP), then grounding.
-export const classifyReviewReceiptForTree = (receipt, fingerprint) => {
-  if (!(receipt !== null && typeof receipt === 'object' && !Array.isArray(receipt)) || receipt.fresh !== true || receipt.artifact !== 'code' || receipt.fingerprint !== fingerprint) {
-    return REVIEW_RECEIPT_CLASS.NOT_CURRENT;
-  }
-  if (!Object.hasOwn(receipt, 'probe')) return REVIEW_RECEIPT_CLASS.UNMARKED;
-  if (typeof receipt.probe !== 'boolean') return REVIEW_RECEIPT_CLASS.MALFORMED_MARKER;
-  if (receipt.probe === true) return REVIEW_RECEIPT_CLASS.PROBE;
-  if (!Object.hasOwn(receipt, 'posture')) return REVIEW_RECEIPT_CLASS.POSTURE_UNMARKED;
-  if (!isValidReceiptPosture(receipt.posture)) return REVIEW_RECEIPT_CLASS.MALFORMED_POSTURE;
-  if (!isRecognizedVerdict(receipt.verdict)) return REVIEW_RECEIPT_CLASS.UNRECOGNIZED_VERDICT;
-  if (receipt.grounded !== true) return REVIEW_RECEIPT_CLASS.UNGROUNDED;
-  // LAST on purpose. The delivery arm may only intercept a receipt that would otherwise ATTEST:
-  // placing it earlier pulled delivery-less `unrecognized-verdict` / `ungrounded` agy receipts out
-  // of summarize's latest-NORMAL selection, so an EARLIER ship survived a LATER bad receipt — the
-  // selection-first doctrine, broken silently. Those two classes stay byte-identical to before;
-  // the ONE class this arm changes is the previously-attesting one, which is the point.
-  if (DELIVERY_DECLARING_BACKENDS.has(receipt.backend)) {
-    if (!Object.hasOwn(receipt, 'delivery')) return REVIEW_RECEIPT_CLASS.DELIVERY_UNMARKED;
-    if (!isValidReceiptDelivery(receipt.delivery)) return REVIEW_RECEIPT_CLASS.MALFORMED_DELIVERY;
-  }
-  return REVIEW_RECEIPT_CLASS.ATTESTING;
-};
-
-// Summarize one backend's receipts for a tree → { state, receipt, counts… }. The LATEST NORMAL
-// (probe-free, marker-valid, current-fingerprint) receipt is selected FIRST and THEN judged — a
-// later unknown-verdict or ungrounded receipt never lets an earlier SHIP survive, and a probe (or
-// forged marker) written after a real review never becomes the authoritative verdict.
-export const summarizeReviewReceiptsForTree = (receipts, fingerprint) => {
-  const classified = receipts
-    .map((receipt) => ({ receipt, classification: classifyReviewReceiptForTree(receipt, fingerprint) }))
-    .filter(({ classification }) => classification !== REVIEW_RECEIPT_CLASS.NOT_CURRENT);
-  const rowsFor = (classification) => classified.filter((row) => row.classification === classification);
-  const normal = classified.filter(({ classification }) =>
-    classification === REVIEW_RECEIPT_CLASS.ATTESTING ||
-    classification === REVIEW_RECEIPT_CLASS.UNGROUNDED ||
-    classification === REVIEW_RECEIPT_CLASS.UNRECOGNIZED_VERDICT);
-  const probe = rowsFor(REVIEW_RECEIPT_CLASS.PROBE);
-  const unmarked = rowsFor(REVIEW_RECEIPT_CLASS.UNMARKED);
-  const malformedMarker = rowsFor(REVIEW_RECEIPT_CLASS.MALFORMED_MARKER);
-  const postureUnmarked = rowsFor(REVIEW_RECEIPT_CLASS.POSTURE_UNMARKED);
-  const malformedPosture = rowsFor(REVIEW_RECEIPT_CLASS.MALFORMED_POSTURE);
-  const deliveryUnmarked = rowsFor(REVIEW_RECEIPT_CLASS.DELIVERY_UNMARKED);
-  const malformedDelivery = rowsFor(REVIEW_RECEIPT_CLASS.MALFORMED_DELIVERY);
-  const counts = {
-    currentCount: classified.length,
-    ungroundedCount: rowsFor(REVIEW_RECEIPT_CLASS.UNGROUNDED).length,
-    unrecognizedVerdictCount: rowsFor(REVIEW_RECEIPT_CLASS.UNRECOGNIZED_VERDICT).length,
-    probeExcluded: probe.length,
-    markerRejected: malformedMarker.length,
-    unmarkedRejected: unmarked.length,
-    postureRejected: postureUnmarked.length + malformedPosture.length,
-    deliveryRejected: deliveryUnmarked.length + malformedDelivery.length,
-  };
-  if (normal.length > 0) {
-    const latest = normal[normal.length - 1];
-    if (latest.classification === REVIEW_RECEIPT_CLASS.ATTESTING) return { state: 'current', receipt: latest.receipt, ...counts };
-    if (latest.classification === REVIEW_RECEIPT_CLASS.UNGROUNDED) return { state: 'ungrounded', receipt: latest.receipt, ...counts };
-    return { state: 'unrecognized-verdict', receipt: latest.receipt, ...counts };
-  }
-  if (classified.length > 0) {
-    return {
-      state: malformedMarker.length > 0 || unmarked.length > 0 || counts.postureRejected > 0 || counts.deliveryRejected > 0 ? 'rejected' : 'probe',
-      receipt: null,
-      ...counts,
-    };
-  }
-  return { state: 'none', receipt: null, ...counts };
-};
-
-// Why this backend has no attestation — one stated sentence per distinct recovery.
-export const describeMissingReviewAttestation = (summary) => {
-  if (summary.state === 'current') return null;
-  const exclusions = [
-    summary.probeExcluded > 0 ? `${summary.probeExcluded} probe receipt(s)` : null,
-    summary.markerRejected > 0 ? `${summary.markerRejected} receipt(s) with a malformed probe marker` : null,
-    summary.unmarkedRejected > 0 ? `${summary.unmarkedRejected} receipt(s) with no probe marker` : null,
-    (summary.postureRejected ?? 0) > 0 ? `${summary.postureRejected} receipt(s) with an absent/invalid run posture (a pre-D5 wrapper — re-run the review on the current bridge)` : null,
-    (summary.deliveryRejected ?? 0) > 0 ? `${summary.deliveryRejected} agy receipt(s) with an absent/invalid delivery declaration (minted before the change set was PROVEN delivered — re-run the review on the current bridge)` : null,
-  ].filter(Boolean);
-  const exclusionSuffix = exclusions.length > 0 ? `; excluded ${exclusions.join(', ')}` : '';
-  if (summary.state === 'ungrounded') return `the latest normal receipt for the current tree is ungrounded${exclusionSuffix}`;
-  if (summary.state === 'unrecognized-verdict') return `the latest normal receipt carries an unrecognized verdict (${JSON.stringify(summary.receipt?.verdict ?? null)}) — an unknown verdict never attests${exclusionSuffix}`;
-  if (summary.state === 'probe') return 'only probe receipts exist for the current tree — a probe review never attests';
-  if (summary.state === 'rejected') return `current-tree receipts have an untrustworthy probe marker, run posture or delivery declaration${exclusionSuffix}`;
-  return 'no fresh code receipt exists for the current tree';
-};
-
-// ── the store: ONE git-dir JSONL file (D7) ────────────────────────────────────────────────────────
-
-export const EVIDENCE_BASENAME = 'agent-workflow-core-evidence.jsonl';
-export const EVIDENCE_SCHEMA_VERSION = 1;
-
-// AW_CORE_EVIDENCE overrides (the AW_REVIEW_RECEIPTS idiom); else <git dir>/basename; null outside
-// a git work tree.
-export const resolveEvidencePath = (cwd, env = process.env) => {
-  if (env.AW_CORE_EVIDENCE) return env.AW_CORE_EVIDENCE;
-  const gitDir = gitLine(['rev-parse', '--absolute-git-dir'], cwd);
-  return gitDir == null ? null : join(gitDir, EVIDENCE_BASENAME);
-};
-
-// ── schema validation (closed kinds, per-kind arms; unknown schema/kind fail CLOSED) ──────────────
-
-const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-const isNonEmptyString = (v) => typeof v === 'string' && v.length > 0;
-const HEX64_RE = /^[0-9a-f]{64}$/;
-const HEX40_RE = /^[0-9a-f]{40}$/;
+import { EVIDENCE_BASENAME } from './core-evidence-store-read.mjs';
+import { usageFail, runRedProof, runDegrade } from './core-evidence-store.mjs';
+import { buildSummaryState, renderSummary } from './core-evidence-summary.mjs';
 
 // The LEXICAL half of the repo-relative rule lives in the repo-lex.mjs LEAF (ONE home shared by
-// the record validators — flow-record has no fs to resolve against — and the fs resolver below,
-// so the two can never drift); re-exported here so every historical consumer keeps its import site.
+// the record validators — flow-record has no fs to resolve against — and the fs resolver in the
+// red-proof leaf, so the two can never drift); re-exported here so every historical consumer keeps its import site.
 export { lexicalRepoRelative } from './repo-lex.mjs';
-
-export const validateEvidenceRecord = (record) => {
-  if (!isPlainObject(record)) return { ok: false, reason: 'record is not an object' };
-  if (record.schema !== EVIDENCE_SCHEMA_VERSION) {
-    return { ok: false, reason: `unknown schema ${JSON.stringify(record.schema)} — this reader accepts schema ${EVIDENCE_SCHEMA_VERSION} only (fail closed)` };
-  }
-  if (record.kind === 'red-proof') {
-    if (!isWellFormedTestId(record.testId)) return { ok: false, reason: 'red-proof: testId must be "<test-file>#<test-name-pattern>" (a "#" separator, both halves non-empty)' };
-    if (!isNonEmptyString(record.file)) return { ok: false, reason: 'red-proof: file must be the non-empty repo-relative test-file path' };
-    const lex = lexicalRepoRelative(record.file);
-    if (!lex.ok) return { ok: false, reason: `red-proof: file must be lexically repo-relative — ${lex.reason}` };
-    if (record.file !== splitTestId(record.testId).file) return { ok: false, reason: 'red-proof: file must equal the testId file half — one path source of truth (a mismatched declaration is refused)' };
-    if (typeof record.fileHash !== 'string' || !HEX64_RE.test(record.fileHash)) return { ok: false, reason: 'red-proof: fileHash must be a 64-hex sha256 of the test-file bytes' };
-    if (!Number.isInteger(record.runs) || record.runs < 1) return { ok: false, reason: 'red-proof: runs must be a positive integer' };
-    if (record.reds !== record.runs) return { ok: false, reason: 'red-proof: reds must equal runs — an observed-red declaration is N/N by construction' };
-    if (record.base !== null && (typeof record.base !== 'string' || !(HEX40_RE.test(record.base) || HEX64_RE.test(record.base)))) return { ok: false, reason: 'red-proof: base must be the 40- or 64-hex HEAD sha (git sha1/sha256 object formats), or null on an unborn branch' };
-    if (typeof record.fingerprint !== 'string' || !HEX64_RE.test(record.fingerprint)) return { ok: false, reason: 'red-proof: fingerprint must be the 64-hex PRE-FIX tree fingerprint' };
-    if (!isNonEmptyString(record.timestamp)) return { ok: false, reason: 'red-proof: timestamp must be a non-empty string' };
-    return { ok: true };
-  }
-  if (record.kind === 'degrade') {
-    if (typeof record.backend !== 'string' || record.backend.trim() === '') return { ok: false, reason: 'degrade: backend must be a non-empty string (whitespace-only is refused)' };
-    if (typeof record.reason !== 'string' || record.reason.trim() === '') return { ok: false, reason: 'degrade: reason must be a non-empty string — a degrade without a stated reason is refused (fail closed)' };
-    if (typeof record.fingerprint !== 'string' || !HEX64_RE.test(record.fingerprint)) return { ok: false, reason: 'degrade: fingerprint must be the 64-hex tree fingerprint the degrade attests' };
-    if (!isNonEmptyString(record.timestamp)) return { ok: false, reason: 'degrade: timestamp must be a non-empty string' };
-    return { ok: true };
-  }
-  if (record.kind === 'final-start') {
-    if (typeof record.fingerprint !== 'string' || !HEX64_RE.test(record.fingerprint)) return { ok: false, reason: 'final-start: fingerprint must be the 64-hex tree fingerprint the attempt targets' };
-    if (!isNonEmptyString(record.attempt)) return { ok: false, reason: 'final-start: attempt must be a non-empty id — the completion closes exactly THIS start (linkage)' };
-    if (!isNonEmptyString(record.timestamp)) return { ok: false, reason: 'final-start: timestamp must be a non-empty string' };
-    return { ok: true };
-  }
-  if (record.kind === 'final') {
-    if (record.status !== 'green' && record.status !== 'red') return { ok: false, reason: `final: status must be "green" or "red" (got ${JSON.stringify(record.status)})` };
-    if (!isNonEmptyString(record.attempt)) return { ok: false, reason: 'final: attempt must be the non-empty id of the start this completion closes' };
-    for (const field of ['fingerprintBefore', 'fingerprintAfter']) {
-      if (typeof record[field] !== 'string' || !HEX64_RE.test(record[field])) return { ok: false, reason: `final: ${field} must be a 64-hex tree fingerprint` };
-    }
-    if (!Array.isArray(record.declared) || record.declared.length === 0 || !record.declared.every((d) => isPlainObject(d) && isNonEmptyString(d.id) && isNonEmptyString(d.cmd))) {
-      return { ok: false, reason: 'final: declared must be the non-empty ordered {id, cmd} array the run executed — an empty declaration never attests' };
-    }
-    if (!Array.isArray(record.results) || !record.results.every((r) => isPlainObject(r) && isNonEmptyString(r.id) && typeof r.ok === 'boolean' && (r.code === null || Number.isInteger(r.code)))) {
-      return { ok: false, reason: 'final: results must be the per-gate {id, ok, code} array (code integer, or null on a spawn failure)' };
-    }
-    if (record.results.length !== record.declared.length || !record.results.every((r, i) => r.id === record.declared[i].id)) {
-      return { ok: false, reason: 'final: results must mirror the declared gates 1:1 IN ORDER — a partial or shuffled attribution never attests' };
-    }
-    if (record.integrityFailure !== null && !isNonEmptyString(record.integrityFailure)) {
-      return { ok: false, reason: 'final: integrityFailure must be null or a non-empty reason (an artifact moved under the run)' };
-    }
-    const derived = record.results.every((r) => r.ok) && record.integrityFailure === null ? 'green' : 'red';
-    if (record.status !== derived) {
-      return { ok: false, reason: `final: status ${JSON.stringify(record.status)} contradicts the results/integrity content (derived ${JSON.stringify(derived)}) — status is DERIVED, never asserted` };
-    }
-    if (!isPlainObject(record.evidenceHashes)
-      || typeof record.evidenceHashes.redProof !== 'string' || !HEX64_RE.test(record.evidenceHashes.redProof)
-      || typeof record.evidenceHashes.degrade !== 'string' || !HEX64_RE.test(record.evidenceHashes.degrade)) {
-      return { ok: false, reason: 'final: evidenceHashes must carry 64-hex sha256 of the canonical red-proof and degrade serializations' };
-    }
-    // The D10 flow binding (Plan 4 Decision 2) is ADDITIVE: absent = a pre-flow-binding final
-    // (still valid); present must be the 64-hex owner-scoped projection hash.
-    if ('flow' in record.evidenceHashes && (typeof record.evidenceHashes.flow !== 'string' || !HEX64_RE.test(record.evidenceHashes.flow))) {
-      return { ok: false, reason: 'final: evidenceHashes.flow, when present, must be a 64-hex sha256 of the owner-scoped flow projection' };
-    }
-    if (record.lcovSha256 !== null && (typeof record.lcovSha256 !== 'string' || !HEX64_RE.test(record.lcovSha256))) {
-      return { ok: false, reason: 'final: lcovSha256 must be a 64-hex sha256 of the consumed lcov file, or null when none was produced' };
-    }
-    // The run's coverage token is ADDITIVE (absent = a pre-token receipt, still valid) and CLOSED.
-    // `certified` is cross-checked against the bound digest — a run that certified a verdict read
-    // bytes, so the two fields can never disagree in the store.
-    if ('coverage' in record) {
-      if (!FINAL_COVERAGE_STATES.includes(record.coverage)) {
-        return { ok: false, reason: `final: coverage, when present, must be one of ${FINAL_COVERAGE_STATES.join(' | ')} (got ${JSON.stringify(record.coverage)}; a final run always selects the canonical checker, so "none" never rides a final receipt)` };
-      }
-      if (record.coverage === COVERAGE.certified && record.lcovSha256 === null) {
-        return { ok: false, reason: 'final: coverage "certified" requires a bound lcovSha256 — a certified verdict was issued over lcov bytes that were read' };
-      }
-    }
-    if (!isNonEmptyString(record.timestamp)) return { ok: false, reason: 'final: timestamp must be a non-empty string' };
-    return { ok: true };
-  }
-  return { ok: false, reason: `unknown kind ${JSON.stringify(record.kind)} — closed set: red-proof | degrade | final-start | final (fail closed)` };
-};
-
-// ── the fail-closed reader ────────────────────────────────────────────────────────────────────────
-
-// parseEvidenceText(raw) → { records, malformed, malformedReasons } — the ONE per-line parse +
-// validation pass. readEvidence AND the append preflight consume it over the SAME captured bytes
-// (a second read between check and write would be a TOCTOU gap).
-export const parseEvidenceText = (raw) => {
-  const records = [];
-  const malformedReasons = [];
-  const lines = String(raw).split('\n');
-  for (let i = 0; i < lines.length; i += 1) {
-    if (lines[i].trim() === '') continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(lines[i]);
-    } catch {
-      malformedReasons.push(`line ${i + 1}: invalid JSON`);
-      continue;
-    }
-    const v = validateEvidenceRecord(parsed);
-    if (v.ok) records.push(parsed);
-    else malformedReasons.push(`line ${i + 1}: ${v.reason}`);
-  }
-  return { records, malformed: malformedReasons.length, malformedReasons };
-};
-
-// readEvidence(path) → { records, malformed, malformedReasons, readError? }. Absent file → empty
-// (no evidence yet is not an error). Every non-parsing / non-validating line is COUNTED with its
-// reason — consumers fail closed on malformed > 0, never silently drop.
-export const readEvidence = (path, readFile = readFileSync) => {
-  let raw;
-  try {
-    raw = readFile(path, 'utf8');
-  } catch (err) {
-    if (err && err.code === 'ENOENT') return { records: [], malformed: 0, malformedReasons: [] };
-    return { records: [], malformed: 0, malformedReasons: [], readError: (err && err.code) || (err && err.message) || 'read failed' };
-  }
-  return parseEvidenceText(raw);
-};
-
-// ── the ONE append (validated, duplicate-refusing, atomic) ────────────────────────────────────────
-
-export const appendEvidenceRecord = ({ path, record }) => {
-  const v = validateEvidenceRecord(record);
-  if (!v.ok) throw stop(`refusing to write a malformed evidence record: ${v.reason}`);
-  const line = JSON.stringify(record);
-  let existing = '';
-  try {
-    existing = readFileSync(path, 'utf8');
-  } catch (err) {
-    if (err && err.code === 'ENOENT') existing = '';
-    else throw stop(`cannot read the evidence store before appending (${(err && err.code) || (err && err.message) || err}) — refusing to overwrite it (fail closed)`);
-  }
-  // Write-side D6a fail-closed: never extend a store whose existing lines are unreadable — the
-  // SAME captured bytes are validated here and appended below (one snapshot, no second read).
-  const existingIssues = parseEvidenceText(existing).malformedReasons;
-  if (existingIssues.length > 0) {
-    throw stop(`refusing to append to an evidence store carrying ${existingIssues.length} malformed line(s) (${existingIssues[0]}) — inspect ${path}; nothing was written (fail closed)`);
-  }
-  if (existing.split('\n').some((l) => l === line)) {
-    throw stop(`refusing a byte-identical replayed line (duplicate) — a genuine re-observation carries new content or timestamp; nothing was written`);
-  }
-  const prefix = existing === '' ? '' : existing.endsWith('\n') ? existing : `${existing}\n`;
-  writeContainedFileAtomic(dirname(path), path, `${prefix}${line}\n`, {}, { stop, label: path });
-  return { writtenPath: path, record };
-};
-
-// ── D6a: per-kind keys, authoritative selection, canonical serialization ──────────────────────────
-
-// Space-joined with the CLOSED (validated hex-or-null) field in the MIDDLE, the free-form field
-// last — content can then never forge a separator collision (base/fingerprint carry no spaces by
-// validation; the last field absorbs anything).
-export const evidenceKey = (r) =>
-  r.kind === 'red-proof' ? `red-proof ${r.base} ${r.testId}`
-  : r.kind === 'degrade' ? `degrade ${r.fingerprint} ${r.backend}`
-  : r.kind === 'final' ? `final ${r.fingerprintBefore}`
-  : r.kind === 'final-start' ? `final-start ${r.fingerprint}`
-  : null;
-
-// The authoritative subset: the LATEST record per key, in file order of that latest appearance.
-export const authoritativeEvidence = (records) => {
-  const lastByKey = new Map();
-  records.forEach((r, i) => {
-    const k = evidenceKey(r);
-    if (k != null) lastByKey.set(k, i);
-  });
-  const keep = new Set(lastByKey.values());
-  return records.filter((_, i) => keep.has(i));
-};
-
-export const authoritativeOfKind = (records, kind) => authoritativeEvidence(records).filter((r) => r.kind === kind);
-
-// Canonical bytes: key-sorted JSON per record, one line each, newline-terminated ('' when empty) —
-// independent of the byte layout the record was originally written with. The D3(a) receipt hashes
-// EXACTLY these bytes per kind, so receipts (a different kind/file) are outside the domain by
-// construction.
-const stableStringify = (v) => {
-  if (Array.isArray(v)) return `[${v.map(stableStringify).join(',')}]`;
-  if (v !== null && typeof v === 'object') {
-    return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(v[k])}`).join(',')}}`;
-  }
-  return JSON.stringify(v);
-};
-
-export const canonicalKindSerialization = (records, kind) => {
-  const lines = authoritativeOfKind(records, kind).map(stableStringify);
-  return lines.length === 0 ? '' : `${lines.join('\n')}\n`;
-};
-
-// ── the probe safeguards (moved verbatim from the retired fold runner) ────────────────────────────
-
-// Node sets NODE_TEST_CONTEXT for any process running UNDER `node --test`; a fresh `node --test`
-// that inherits it silently SKIPS running its files. The probe spawns `node --test`, so it strips
-// that var (a no-op in normal invocation).
-export const childTestEnv = (env, extra = {}) => {
-  const out = { ...env, ...extra };
-  delete out.NODE_TEST_CONTEXT;
-  return out;
-};
-
-const PROBE_RESULT_RE = /^(ok|not ok) \d+ - (.*)$/;
-const PROBE_FAIL_RE = /^# fail (\d+)$/;
-const PROBE_DIRECTIVE_RE = /#\s*(?:skip|todo)\b/i; // a TAP SKIP/TODO directive — the test did NOT run
-
-// parseProbeOutput({ stdout, code, fileArg }) → { resolvable, executed, baselineGreen }. The file
-// wrapper is matched by BASENAME (node normalizes the echoed path); a directive-carrying result
-// line never counts (some Node lines emit pattern-filtered tests as SKIP — the guard is
-// version-agnostic on purpose).
-export const parseProbeOutput = ({ stdout, code, fileArg }) => {
-  let matched = 0;
-  let notOk = 0;
-  let failCount = null;
-  const wanted = basename(String(fileArg).trim());
-  for (const line of String(stdout).split('\n')) {
-    const m = PROBE_RESULT_RE.exec(line);
-    if (m && !PROBE_DIRECTIVE_RE.test(m[2]) && basename(m[2].trim()) !== wanted) {
-      matched += 1;
-      if (m[1] === 'not ok') notOk += 1;
-    }
-    const f = PROBE_FAIL_RE.exec(line.trim());
-    if (f) failCount = Number(f[1]);
-  }
-  const resolvable = matched > 0;
-  const fails = (failCount ?? 0) + notOk;
-  return { resolvable, executed: matched, baselineGreen: resolvable && code === 0 && fails === 0 };
-};
-
-// The shell-free node:test argv. The pattern rides `=`-joined: as a separate token a pattern
-// beginning with "-" would parse as an OPTION and silently select no test.
-export const defaultBoundArgv = (file, pattern) => ['node', '--test', '--test-reporter', 'tap', `--test-name-pattern=${pattern}`, file];
-
-// containsPath(realRoot, realAbs) → strictly INSIDE. Segment-safe ('/a' never contains '/ab') and
-// correct for a repo at the filesystem root.
-export const containsPath = (realRoot, realAbs) => realAbs.startsWith(realRoot.endsWith(sep) ? realRoot : realRoot + sep);
-
-// resolveTestFile(rootTop, rel, deps?) → { ok: true, abs } | { ok: false, reason } (never throws).
-// Repo-relative only; a REGULAR file under no-follow lstat; the RESOLVED real path contained under
-// the REAL repo root (a leaf check alone would let a symlinked PARENT directory escape).
-export const resolveTestFile = (rootTop, rel, deps = {}) => {
-  const lstat = deps.lstat ?? lstatSync;
-  const realpath = deps.realpath ?? realpathSync;
-  const lex = lexicalRepoRelative(rel);
-  if (!lex.ok) return { ok: false, reason: lex.reason };
-  const abs = join(rootTop, normalize(rel));
-  let st;
-  try {
-    st = lstat(abs);
-  } catch {
-    return { ok: false, reason: `file "${rel}" does not exist` };
-  }
-  if (!st.isFile()) return { ok: false, reason: `"${rel}" is not a regular file (a symlink/directory/device is never followed — fail closed)` };
-  let realAbs;
-  let realRoot;
-  try {
-    realAbs = realpath(abs);
-    realRoot = realpath(rootTop);
-  } catch {
-    return { ok: false, reason: `cannot resolve the real path of "${rel}"` };
-  }
-  if (!containsPath(realRoot, realAbs)) return { ok: false, reason: `"${rel}" resolves outside the repo root (a symlinked parent directory) — fail closed` };
-  return { ok: true, abs: realAbs };
-};
-
-// sha-256 over the file's BYTES; null on a read failure (the caller reads that as unresolvable).
-export const hashFileBytes = (abs) => {
-  try {
-    return createHash('sha256').update(readFileSync(abs)).digest('hex');
-  } catch {
-    return null;
-  }
-};
-
-// N and the per-run timeout — pinned from the old runner's own constants (AW_FOLD_RERUNS default 3,
-// AW_FOLD_PROBE_TIMEOUT_S default 120); zero/negative/fractional/non-numeric refused by name.
-export const probeKnobsFromEnv = (env = process.env) => ({
-  reruns: parsePositiveIntKnob(env, 'AW_CORE_EVIDENCE_RERUNS', 3, stop),
-  timeoutS: parsePositiveIntKnob(env, 'AW_CORE_EVIDENCE_TIMEOUT_S', 120, stop),
-});
-
-// The N-rerun probe. The custody hash is taken BEFORE the runs (the content the observation
-// attests); the spawn ALWAYS uses the resolver's canonical absolute path — the executed file must
-// be the hashed file independent of runner path semantics. A timed-out or signal-killed run is
-// neither red nor green — it lands in `timeouts` (quarantine fuel).
-const probeBound = ({ testId, rootTop, env, reruns, timeoutS }) => {
-  const { file, pattern } = splitTestId(testId);
-  const resolved = resolveTestFile(rootTop, file);
-  const fileHash = resolved.ok ? hashFileBytes(resolved.abs) : null;
-  let executed = 0;
-  let greens = 0;
-  let reds = 0;
-  let timeouts = 0;
-  if (resolved.ok && fileHash != null) {
-    for (let i = 0; i < reruns; i += 1) {
-      const argv = defaultBoundArgv(resolved.abs, pattern);
-      const res = spawnSync(argv[0], argv.slice(1), {
-        cwd: rootTop, env: childTestEnv(env), encoding: 'utf8', maxBuffer: GIT_MAX_BUFFER, timeout: timeoutS * 1000,
-      });
-      if ((res.error && res.error.code === 'ETIMEDOUT') || res.signal != null) {
-        timeouts += 1;
-        continue;
-      }
-      const p = parseProbeOutput({ stdout: res.stdout ?? '', code: res.error ? 1 : res.status ?? 1, fileArg: file });
-      executed = Math.max(executed, p.executed);
-      if (!p.resolvable) continue;
-      if (p.baselineGreen) greens += 1;
-      else reds += 1;
-    }
-  }
-  const entry = { executed, runs: reruns, greens, reds, timeouts, fileHash };
-  return { entry, file, resolveReason: resolved.ok ? (fileHash == null ? `cannot read "${file}"` : null) : resolved.reason };
-};
-
-// ── the red-proof verb (D3(c)): observed red or nothing ───────────────────────────────────────────
-
-// runRedProof({ cwd, env, testId }) → { writtenPath, record }. Observes `testId` on the CURRENT
-// (pre-fix) tree: N/N red → appends the declaration; anything else is a DISTINGUISHED refusal and
-// NOTHING is written.
-export const runRedProof = ({ cwd = process.cwd(), env = process.env, testId } = {}) => {
-  if (!isWellFormedTestId(testId)) {
-    throw usageFail(`red-proof needs a well-formed testId "<test-file>#<test-name-pattern>" (a "#" separator, both halves non-empty; got ${JSON.stringify(testId)})`);
-  }
-  const rootTop = gitLine(['rev-parse', '--show-toplevel'], cwd);
-  if (rootTop == null) throw stop('not a git work tree — nothing to observe');
-  const { reruns, timeoutS } = probeKnobsFromEnv(env);
-  // Pre-run capture: the record's base/fingerprint and the custody hash must attest ONE tree —
-  // captured BEFORE the runs and re-checked after them; any drift refuses below.
-  const base = resolveBase(cwd);
-  const fingerprint = computeTreeFingerprint(cwd);
-  if (fingerprint == null) throw stop('cannot compute the tree fingerprint — the git location is not a work tree; nothing was observed, no runs were spent');
-  const { entry, file, resolveReason } = probeBound({ testId, rootTop, env, reruns, timeoutS });
-  const verdict = probeVerdict(entry);
-  const counts = `${entry.greens} green / ${entry.reds} red / ${entry.timeouts} timed out / ${entry.runs - entry.greens - entry.reds - entry.timeouts} unresolved of ${entry.runs} run(s)`;
-  if (verdict === 'unresolvable') {
-    throw stop(
-      `red-proof refused for "${testId}": unresolvable — ${resolveReason ?? 'the pattern selects no test'} (${counts}). ` +
-        `If the test cannot even LOAD pre-fix (it imports an export the fix introduces), author it with a dynamic import() so it loads and FAILS pre-fix. Nothing was recorded.`,
-    );
-  }
-  if (verdict === 'green') {
-    throw stop(
-      `red-proof refused for "${testId}": observed GREEN on ${entry.greens}/${entry.runs} runs — the test does not fail on the current (pre-fix) tree, so it proves nothing about the fix. ` +
-        `Write a test that FAILS before the fix is applied, then record the red-proof BEFORE folding the fix. Nothing was recorded.`,
-    );
-  }
-  if (verdict === 'quarantine') {
-    const flavor = entry.timeouts > 0
-      ? `${entry.timeouts} of ${entry.runs} probe run(s) timed out (AW_CORE_EVIDENCE_TIMEOUT_S=${timeoutS}) — a timed-out run is neither red nor green`
-      : `mixed outcomes (${counts}) — a flaky test can launder a fake red`;
-    throw stop(
-      `red-proof refused for "${testId}": QUARANTINE — ${flavor}. QUARANTINE never converts and has no override lane: ` +
-        `${entry.timeouts > 0 ? 'raise the timeout or make the test faster' : 'replace the flaky test'}, then re-observe. Nothing was recorded.`,
-    );
-  }
-  // Post-run drift recheck: fingerprint, base, and the test-file bytes must all equal the
-  // pre-run capture — a mutating test / parallel edit / commit would otherwise mint a record
-  // whose fields attest different trees.
-  const resolvedAfter = resolveTestFile(rootTop, file);
-  const hashAfter = resolvedAfter.ok ? hashFileBytes(resolvedAfter.abs) : null;
-  if (computeTreeFingerprint(cwd) !== fingerprint || resolveBase(cwd) !== base || hashAfter !== entry.fileHash) {
-    throw stop(
-      `red-proof refused for "${testId}": the tree moved during the observation (fingerprint, base, or test-file bytes drifted between the pre-run capture and the post-run recheck) — a record would bind fields from different trees. Re-observe on a quiescent tree. Nothing was recorded.`,
-    );
-  }
-  const record = {
-    schema: EVIDENCE_SCHEMA_VERSION,
-    kind: 'red-proof',
-    testId,
-    file,
-    fileHash: entry.fileHash,
-    runs: entry.runs,
-    reds: entry.reds,
-    base,
-    fingerprint,
-    timestamp: isoNow(),
-  };
-  const path = resolveEvidencePath(cwd, env);
-  if (path == null) throw stop('cannot resolve the evidence-store path — not a git work tree and AW_CORE_EVIDENCE is unset');
-  return appendEvidenceRecord({ path, record });
-};
-
-// ── the degrade verb (D3(b)): the explicit per-backend, per-tree escape ───────────────────────────
-
-export const runDegrade = ({ cwd = process.cwd(), env = process.env, backend, reason } = {}) => {
-  if (typeof backend !== 'string' || backend.trim() === '') throw usageFail('degrade needs --backend <name> — a missing or whitespace-only backend is refused (the gate matches records by backend name)');
-  if (typeof reason !== 'string' || reason.trim() === '') throw usageFail('degrade needs a non-empty --reason "<why this backend cannot review this tree>" — a reasonless degrade is refused');
-  const fingerprint = computeTreeFingerprint(cwd);
-  if (fingerprint == null) throw stop('not a git work tree — a degrade attests a specific tree fingerprint');
-  const record = {
-    schema: EVIDENCE_SCHEMA_VERSION,
-    kind: 'degrade',
-    backend: backend.trim(),
-    reason: reason.trim(),
-    fingerprint,
-    timestamp: isoNow(),
-  };
-  const path = resolveEvidencePath(cwd, env);
-  if (path == null) throw stop('cannot resolve the evidence-store path — not a git work tree and AW_CORE_EVIDENCE is unset');
-  return appendEvidenceRecord({ path, record });
-};
-
-// ── the summary verb (D6): ONE stateless render — receipts + evidence store, no ledger ────────────
-
-// A red-proof binds the BYTES of the test file it was observed on, and the final-run checker refuses
-// when those bytes have moved (coverage-check.mjs, the hash-mismatch arm). This render used to print a
-// stale record byte-identically to a live one, so the only place staleness surfaced was that gate —
-// after both council dispatches, at the commit boundary, which is the most expensive discovery point
-// in the loop. The currency is therefore computed HERE, from the SAME two helpers the checker uses, so
-// the render and the gate can never disagree about what stale means.
-//
-// An unresolvable or unreadable file is STALE, not unknown: a proof nobody can re-check is not a proof
-// anyone should read as current.
-export const redProofCurrency = (rootTop, record) => {
-  if (rootTop == null) return { state: 'stale', detail: 'the work-tree root is not resolvable' };
-  const resolved = resolveTestFile(rootTop, record.file);
-  if (!resolved.ok) return { state: 'stale', detail: resolved.reason };
-  const current = hashFileBytes(resolved.abs);
-  if (current == null) return { state: 'stale', detail: `cannot read "${record.file}"` };
-  return current === record.fileHash
-    ? { state: 'current' }
-    : { state: 'stale', detail: 'the bound test file changed after the mint' };
-};
-
-export const buildSummaryState = ({ cwd = process.cwd(), env = process.env } = {}) => {
-  const fingerprint = computeTreeFingerprint(cwd);
-  const base = resolveBase(cwd);
-  const storePath = resolveEvidencePath(cwd, env);
-  const store = storePath ? readEvidence(storePath) : { records: [], malformed: 0, malformedReasons: [] };
-  const receiptsPath = resolveReceiptsPath(cwd, env);
-  const receiptsRead = receiptsPath ? readReceipts(receiptsPath) : { receipts: [], malformed: 0 };
-  const { receipts, malformed: receiptsMalformed } = receiptsRead;
-  const receiptsReadError = receiptsRead.readError ?? null;
-  const backends = [...new Set(receipts.map((r) => r.backend))].sort();
-  const verdicts = backends.map((b) => ({
-    backend: b,
-    summary: summarizeReviewReceiptsForTree(receipts.filter((r) => r.backend === b), fingerprint),
-  }));
-  const rootTop = gitLine(['rev-parse', '--show-toplevel'], cwd);
-  const redProofs = authoritativeOfKind(store.records, 'red-proof')
-    .filter((r) => r.base === base)
-    .map((r) => ({ ...r, currency: redProofCurrency(rootTop, r) }));
-  const degrades = authoritativeOfKind(store.records, 'degrade').filter((r) => r.fingerprint === fingerprint);
-  const finalRun = authoritativeOfKind(store.records, 'final').find((r) => r.fingerprintBefore === fingerprint) ?? null;
-  // A malformed/unreadable store makes the AUTHORITATIVE selection untrustworthy (a dropped later
-  // line could resurrect a superseded record — or hide a newer verdict) — the summary WITHHOLDS
-  // the affected sections and exits non-zero instead of rendering a lie. Both stores get the same
-  // posture: the evidence store and the receipts store.
-  const evidenceUnavailable = store.malformed > 0 || store.readError != null;
-  const receiptsUnavailable = receiptsMalformed > 0 || receiptsReadError != null;
-  return {
-    fingerprint, base, storePath,
-    storeRecords: store.records.length, storeMalformed: store.malformed, storeReadError: store.readError ?? null,
-    evidenceUnavailable, receiptsUnavailable, receiptsReadError,
-    receiptsPath, receiptsMalformed, verdicts, redProofs, degrades, finalRun,
-  };
-};
-
-const verdictLine = ({ backend, summary }) => {
-  if (summary.state === 'current') return `${backend}: ${summary.receipt.verdict ?? 'unknown'} (attesting, ${summary.receipt.timestamp ?? '?'})`;
-  if (summary.state === 'ungrounded') return `${backend}: ${summary.receipt.verdict ?? 'unknown'} (ungrounded — never attests)`;
-  if (summary.state === 'unrecognized-verdict') return `${backend}: unrecognized verdict (${JSON.stringify(summary.receipt?.verdict ?? null)}) — never attests (fail-closed)`;
-  if (summary.state === 'probe') return `${backend}: probe receipts only for the current tree (never attest)`;
-  if (summary.state === 'rejected') return `${backend}: current-tree receipts rejected (untrustworthy probe marker)`;
-  return `${backend}: no attesting receipt for the current tree (stale or missing)`;
-};
-
-// Why the run issued no verdict, keyed by the token IT recorded. `certified` maps to nothing —
-// there is no absence to name. A legacy receipt predates the token: the only honest thing to say
-// is what the RECORD carries, which is true by construction. Exported as a test seam (keyFor).
-const COVERAGE_QUALIFIER = Object.freeze({
-  [COVERAGE.notRun]: 'the recorded run issued no coverage verdict',
-  [COVERAGE.unknown]: 'the recorded run produced no readable coverage signal',
-});
-const LEGACY_COVERAGE_QUALIFIER = `coverage=${COVERAGE.unknown}: this legacy receipt carries no coverage token and binds no lcov digest`;
-
-export const coverageQualifierFor = (finalRun) => {
-  if (!finalRun) return '';
-  if (typeof finalRun.coverage === 'string') {
-    const why = COVERAGE_QUALIFIER[finalRun.coverage];
-    return why ? ` — coverage=${finalRun.coverage}: ${why}` : '';
-  }
-  return finalRun.lcovSha256 == null ? ` — ${LEGACY_COVERAGE_QUALIFIER}` : '';
-};
-
-export const renderSummary = (s) => {
-  const short = (hex) => (typeof hex === 'string' ? `${hex.slice(0, 12)}…` : String(hex));
-  const evidenceSections = s.evidenceUnavailable
-    ? [`  evidence sections WITHHELD — the store is unavailable (${s.storeMalformed} malformed line(s)${s.storeReadError ? `, read error: ${s.storeReadError}` : ''}); a dropped line could resurrect a superseded record — inspect ${s.storePath}`]
-    : [
-        `  red-proof records (current base): ${s.redProofs.length ? '' : '(none)'}`,
-        ...s.redProofs.map((r) => {
-          const stale = r.currency?.state === 'stale';
-          const mark = stale ? `STALE (${r.currency.detail})` : 'CURRENT';
-          return `    ${r.testId} — ${mark} · ${r.reds}/${r.runs} red, hash ${short(r.fileHash)}, pre-fix fingerprint ${short(r.fingerprint)}`;
-        }),
-        // The recovery, printed once and only when it is needed — it was written down nowhere, and
-        // the loop paid for that three times.
-        ...(s.redProofs.some((r) => r.currency?.state === 'stale')
-          ? ['    ↳ a STALE proof is refused by run-gates --final: park the fix so the bound test fails again, re-observe it with `core-evidence red-proof "<testId>"`, then restore the fix. Edit test files FIRST and re-observe ONCE per park — every proof bound to an edited file goes stale together.']
-          : []),
-        `  degrade records (current tree): ${s.degrades.length ? '' : '(none)'}`,
-        ...s.degrades.map((d) => `    ${d.backend} — ${d.reason} (${d.timestamp})`),
-      ];
-  const verdictsSection = s.receiptsUnavailable
-    ? [`  review verdicts WITHHELD — the receipts store is unavailable (${s.receiptsMalformed} malformed line(s)${s.receiptsReadError ? `, read error: ${s.receiptsReadError}` : ''}); a dropped line could hide a newer verdict — inspect ${s.receiptsPath}`]
-    : [
-        '  review verdicts (current tree):',
-        ...(s.verdicts.length ? s.verdicts.map((v) => `    ${verdictLine(v)}`) : ['    (no receipts)']),
-      ];
-  // The withheld coverage verdict travels here too: an unqualified GREEN repeats, one surface
-  // further on, the false reassurance the checker's own attested=no exists to close. It is read
-  // from the token the RUN recorded — `lcovSha256` says what the receipt binds, never whether a
-  // verdict was issued — and it rides RED as well: an absent verdict is a property of the run, not
-  // of its colour. A LEGACY receipt (no token) is named as exactly that, never as a claim about
-  // what it read. DETAIL beside an unchanged status word.
-  const coverageQualifier = coverageQualifierFor(s.finalRun);
-  const finalLine = s.evidenceUnavailable
-    ? null
-    : s.finalRun
-      ? `  final gate run: ${s.finalRun.status === 'green' ? 'GREEN' : 'RED'}${coverageQualifier} (${s.finalRun.results.filter((r) => r.ok).length}/${s.finalRun.results.length} gates, ${s.finalRun.timestamp})`
-      : '  final gate run: (none recorded for the current tree)';
-  const lines = [
-    'core-evidence summary — stateless render (review receipts + evidence store; no ledger, no rounds)',
-    `  tree fingerprint: ${s.fingerprint ?? '(not a git work tree)'}`,
-    `  base: ${s.base ?? '(unborn branch)'}`,
-    ...(finalLine ? [finalLine] : []),
-    ...verdictsSection,
-    ...evidenceSections,
-    `  evidence store: ${s.storePath ?? '(unresolvable — no git dir)'} (${s.storeRecords} record(s)${s.storeMalformed ? `, ${s.storeMalformed} malformed — inspect the file` : ''}${s.storeReadError ? `, read error: ${s.storeReadError}` : ''})`,
-  ];
-  return lines.join('\n');
-};
+export {
+  gitBuf, resolveBase, isBinaryFile, isNeverCommittableStat, FINGERPRINT_CACHED_DIFF_ARGV, FINGERPRINT_UNSTAGED_DIFF_ARGV,
+  computeFingerprintPayload, computeTreeFingerprint, CONTENT_FREE_FINGERPRINT, computeWorkingState, isTreeClean,
+} from './core-evidence-tree.mjs';
+export {
+  RECEIPTS_BASENAME, resolveReceiptsPath, readReceipts, isShipVerdict, isRecognizedVerdict, REVIEW_RECEIPT_CLASS,
+  classifyReviewReceiptForTree, summarizeReviewReceiptsForTree, describeMissingReviewAttestation,
+} from './core-evidence-receipts.mjs';
+export {
+  isWellFormedTestId, splitTestId, EVIDENCE_BASENAME, EVIDENCE_SCHEMA_VERSION, resolveEvidencePath, validateEvidenceRecord,
+  parseEvidenceText, readEvidence, evidenceKey, authoritativeEvidence, authoritativeOfKind, canonicalKindSerialization,
+} from './core-evidence-store-read.mjs';
+export { childTestEnv, parseProbeOutput, defaultBoundArgv, containsPath, resolveTestFile, hashFileBytes } from './core-evidence-red-proof.mjs';
+export { CORE_EVIDENCE_STOP, appendEvidenceRecord, probeKnobsFromEnv, runRedProof, runDegrade } from './core-evidence-store.mjs';
+export { redProofCurrency, buildSummaryState, coverageQualifierFor, renderSummary } from './core-evidence-summary.mjs';
 
 // ── CLI ───────────────────────────────────────────────────────────────────────────────────────────