@sema-agent/core 7.51.2 → 7.53.0

package/dist/prompt-assembly/artifact.d.ts

@@ -1,92 +1,106 @@
-import type { PromptTextDeclaration } from "../prompts/default.js";
-/** v1 overlay slots — the same reserved rank bands the stableBlocks lane mounts into. */
-export type CenterOverlaySlot = "identity" | "scenario" | "behavior";
-export interface CenterOverlaySection {
-    /** Same grammar as stableBlocks ids (manifest/trace/explain-safe, never `core/`). */
-    id: string;
-    slot: CenterOverlaySlot;
-    /** Immutable rendered text (v1: fixed text, no renderer — center compiles before publishing). */
-    text: string;
-    /** REQUIRED on the center lane (unlike caller stableBlocks): sha256 of `text`. The center
-     *  publish path always mints it — it is the reconciliation anchor (digest tiering). */
-    contentHash: string;
+import { type OverlayOp, type PromptTrait } from "./catalog/schema.js";
+import { type PromptOverlay, type SourcedOverlay } from "./overlay.js";
+/** What an artifact needs from the engine that composes it: the targets it names (each with what kind of target it
+ *  is), the operations it uses, the traits its `when` conditions read, and the bindings they name. */
+export interface PromptArtifactRequires {
+    readonly targets: readonly {
+        readonly id: string;
+        readonly kind: "message" | "section" | "band";
+    }[];
+    readonly ops: readonly OverlayOp[];
+    readonly traits: readonly PromptTrait[];
+    readonly bindings: readonly string[];
 }
-export interface PromptCatalogSnapshot {
-    /** Center pack identity, e.g. "center:acme@3". Logical name only — history identity is digests. */
-    packId: string;
-    sections: ReadonlyArray<CenterOverlaySection>;
+/** Why the artifact exists: an intent sentence (required) and references to the evaluations or goldens behind it. */
+export interface PromptArtifactEvidence {
+    readonly intent: string;
+    readonly refs: readonly string[];
 }
-export interface PromptDependencyClosure {
-    /** v1: only the bundled base is a legal foundation (exact-archive multi-base = later slice). */
-    basePackId: string;
-    promptCatalog: PromptCatalogSnapshot;
+/** The digested part of an artifact. */
+export interface PromptArtifactPayload {
+    readonly schemaVersion: 3;
+    readonly requires: PromptArtifactRequires;
+    /** Every overlay is of the `center` class; one with no `when.binding` applies under every binding. */
+    readonly overlays: readonly PromptOverlay[];
+    readonly evidence: PromptArtifactEvidence;
 }
-/** Dependency-free core-compat range: dotted-triple compares, absent bound = unbounded. */
-export interface CoreCompatRange {
-    minCore?: string;
-    maxCoreExclusive?: string;
+/** An artifact's identity: the payload and its digest (what a session pins and a store holds by digest). */
+export interface PromptArtifact {
+    readonly payload: PromptArtifactPayload;
+    readonly artifactDigest: string;
 }
-export interface PromptEpochArtifactPayload {
-    schemaVersion: 1;
-    assemblyApi: 1;
-    catalogDigest: string;
-    compatibleCore?: CoreCompatRange;
-    closure: PromptDependencyClosure;
+/** The published form: the artifact plus its opaque source revision (never ordered, never compared for recency). */
+export interface PublishedPromptArtifact extends PromptArtifact {
+    readonly sourceRevision: string;
 }
-export interface PromptEpochArtifact {
-    payload: PromptEpochArtifactPayload;
-    artifactDigest: string;
-}
-/** The publish envelope (§9.2): artifact + opaque source provenance. Attestation = later slice
- *  (protocol: first phase does not require full PKI for internal artifacts). */
-export interface PublishedPromptArtifactEnvelope {
-    artifact: PromptEpochArtifact;
-    /** Opaque ETag-like revision. State transitions key off "last successfully verified response";
-     *  NEVER ordered or compared for recency. */
-    sourceRevision: string;
-}
-/** Validator hard limits (§9.2: sections/bytes caps so a untrusted or runaway publish cannot wedge
- *  the composer). Deliberately generous — these bound abuse, not legitimate catalogs. */
-export declare const ARTIFACT_LIMITS: {
-    readonly maxSections: 64;
-    readonly maxSectionBytes: 32000;
-    readonly maxTotalBytes: 131072;
-    readonly maxIdLength: 128;
-    readonly maxPackIdLength: 200;
-};
-export declare function sha256Hex(text: string): string;
-export declare function computeCatalogDigest(catalog: PromptCatalogSnapshot): string;
-export declare function computeArtifactDigest(payload: PromptEpochArtifactPayload): string;
+/** Validator bounds: they bound abuse and runaway publishes, not legitimate artifacts. A `…Chars` bound counts Unicode
+ *  code points (`codePointsOver`, the verifier's one character unit); a `…Bytes` bound counts UTF-8 bytes. */
+export declare const ARTIFACT_LIMITS: Readonly<{
+    maxOverlays: 64;
+    maxOverlayTextBytes: 32000;
+    maxTotalTextBytes: 131072;
+    maxIntentChars: 2000;
+    maxRefs: 32;
+    maxRefChars: 500;
+    maxSourceRevisionChars: 500;
+}>;
+export declare function computeArtifactDigest(payload: PromptArtifactPayload): string;
+/** The requirement set an overlay list implies — the one derivation the builder stores and the verifier recomputes. */
+export declare function requiresOf(overlays: readonly PromptOverlay[]): PromptArtifactRequires;
+/** The requirements this engine does not meet (empty ⇒ all met): a target its catalog lacks, an op or a trait outside
+ *  its vocabulary. Bindings are the deployment's open vocabulary and are always met. */
+export declare function unmetRequirements(requires: PromptArtifactRequires): string[];
 export type ArtifactVerifyResult = {
     ok: true;
-    artifact: PromptEpochArtifact;
+    artifact: PublishedPromptArtifact;
+} | {
+    ok: false;
+    code: ArtifactVerifyCode;
+    reason: string;
+};
+type BodyVerifyResult = {
+    ok: true;
+    artifact: PromptArtifact;
 } | {
     ok: false;
-    code: string;
+    code: ArtifactVerifyCode;
     reason: string;
 };
+/** Why an artifact is invalid (docs/CLOSED-SETS.md). */
+export type ArtifactVerifyCode = "shape" | "schema" | "limits" | "requires" | "overlay" | "evidence" | "digest";
 /**
- * Full §9.2 verify pipeline over an UNTRUSTED envelope (network body or disk bytes — the store
- * re-verifies on read; nothing on disk is trusted by location). Every arm is a distinct coded
- * rejection so the source-state machine can log honestly. Verification is pure — no IO.
+ * Verify an UNTRUSTED published artifact (a network body or stored bytes — a store re-verifies on read). Pure. Any
+ * failure invalidates the whole artifact: shape, schema version, bounds, each overlay under the center class's band
+ * columns and the locked-text guard, the stored requirement list (recomputed, then checked against this engine),
+ * same-target replace conflicts, the evidence rule, and the digest.
  */
-export declare function verifyPromptArtifact(raw: unknown, opts: {
-    engineVersion: string;
-}): ArtifactVerifyResult;
+export declare function verifyPromptArtifact(raw: unknown): ArtifactVerifyResult;
 /**
- * Compile a VERIFIED artifact into the declaration lane (v1 adoption channel — see file header).
- * Deterministic order: catalog order preserved (it entered the digest, so it is stable).
+ * The same verifier over an artifact without its provenance — what a run re-checks when it adopts an artifact from
+ * its source (a candidate, a pinned digest, a parent's layer): requirements are met by THIS engine, every overlay is
+ * legal here, the digest holds. A source is a deployment seat; what it hands the run is checked, not trusted.
  */
-export declare function artifactDeclarations(artifact: PromptEpochArtifact): PromptTextDeclaration[];
-/** Test/fixture helper: build a correctly-digested envelope from plain sections (the shape a
- *  center's publish pipeline produces). Exported for tests and the fixture-center harness. */
-export declare function buildPromptArtifactEnvelope(opts: {
-    packId: string;
-    sections: ReadonlyArray<{
-        id: string;
-        slot: CenterOverlaySlot;
-        text: string;
-    }>;
+export declare function verifyPromptArtifactBody(raw: unknown): BodyVerifyResult;
+/** The center layer a run composes under: the adopted artifact and, when the source stamped one, its revision. */
+export type CenterAdoption = {
+    artifact: PromptArtifact;
+    sourceRevision?: string;
+};
+/** The center class's overlays for an adopted artifact, in the artifact's order. Which of them apply to a run is their
+ *  `when` (the binding included), read where every class's is — at the composition. */
+export declare function centerOverlaysOf(adoption: CenterAdoption | undefined): readonly SourcedOverlay[];
+/** An artifact a source handed a run, re-checked by this engine before the run adopts it; undefined when it fails. */
+export declare function adoptCenter(artifact: PromptArtifact, sourceRevision: string | undefined): CenterAdoption | undefined;
+/**
+ * Build a published artifact from overlays and evidence — the one builder (a center's publish pipeline calls it):
+ * `requires` is derived, the digest computed over the payload's JSON form (what travels) with each overlay as the
+ * overlay door leaves it (its `when` in normal form, so one meaning is one digest), and the result goes through the
+ * verifier, so the caller holds either a valid artifact or the reason it is not one. An overlay the door refuses goes on
+ * as it was given: the verifier names it, in its own order of checks.
+ */
+export declare function buildPromptArtifact(opts: {
+    overlays: readonly PromptOverlay[];
+    evidence: PromptArtifactEvidence;
     sourceRevision: string;
-    compatibleCore?: CoreCompatRange;
-}): PublishedPromptArtifactEnvelope;
+}): ArtifactVerifyResult;
+export {};

package/dist/prompt-assembly/artifact.js

@@ -1,169 +1,221 @@
 import { createHash } from "node:crypto";
+import { isBandId } from "./bands.js";
+import { SEMA_DEFAULT_CATALOG } from "./catalog/index.js";
+import { OVERLAY_OPS, PROMPT_TRAITS, isWordOf } from "./catalog/schema.js";
 import { canonical } from "./epoch.js";
-export const ARTIFACT_LIMITS = {
-    maxSections: 64,
-    maxSectionBytes: 32_000,
-    maxTotalBytes: 131_072,
-    maxIdLength: 128,
-    maxPackIdLength: 200,
-};
-const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
+import { codePointsOver, sectionOfMessage, validateOverlay } from "./overlay.js";
+export const ARTIFACT_LIMITS = Object.freeze({
+    maxOverlays: 64,
+    maxOverlayTextBytes: 32_000,
+    maxTotalTextBytes: 131_072,
+    maxIntentChars: 2_000,
+    maxRefs: 32,
+    maxRefChars: 500,
+    maxSourceRevisionChars: 500,
+});
 const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
-const SLOTS = new Set(["identity", "scenario", "behavior"]);
-export function sha256Hex(text) {
+const MESSAGE_IDS = new Set(SEMA_DEFAULT_CATALOG.messages.map((m) => m.id));
+const SECTION_IDS = new Set(SEMA_DEFAULT_CATALOG.sections.map((s) => s.id));
+function sha256Hex(text) {
     return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
 }
-export function computeCatalogDigest(catalog) {
-    return sha256Hex(canonical(catalog));
-}
 export function computeArtifactDigest(payload) {
     return sha256Hex(canonical(payload));
 }
-function triple(v) {
-    const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
-    if (!m)
-        return undefined;
-    return [Number(m[1]), Number(m[2]), Number(m[3])];
+export function requiresOf(overlays) {
+    const targets = new Map();
+    const need = (id, kind) => {
+        targets.set(`${kind}:${id}`, { id, kind });
+    };
+    const ops = new Set();
+    const traits = new Set();
+    const bindings = new Set();
+    for (const o of overlays) {
+        ops.add(o.op);
+        need(o.target, o.op === "add" ? "band" : o.op === "drop" ? "section" : "message");
+        if (o.message !== undefined)
+            need(o.message, "message");
+        for (const t of [...(o.when?.traits?.allOf ?? []), ...(o.when?.traits?.noneOf ?? [])])
+            traits.add(t);
+        for (const b of [...(o.when?.binding?.anyOf ?? []), ...(o.when?.binding?.noneOf ?? [])])
+            bindings.add(b);
+    }
+    const byText = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+    return {
+        targets: [...targets.values()].sort((a, b) => byText(`${a.kind}:${a.id}`, `${b.kind}:${b.id}`)),
+        ops: OVERLAY_OPS.filter((op) => ops.has(op)),
+        traits: PROMPT_TRAITS.filter((t) => traits.has(t)),
+        bindings: [...bindings].sort(byText),
+    };
 }
-function tripleCmp(a, b) {
-    for (let i = 0; i < 3; i++) {
-        if (a[i] !== b[i])
-            return a[i] < b[i] ? -1 : 1;
+export function unmetRequirements(requires) {
+    const unmet = [];
+    for (const t of requires.targets) {
+        const has = t.kind === "message" ? MESSAGE_IDS.has(t.id) : t.kind === "section" ? SECTION_IDS.has(t.id) : isBandId(t.id);
+        if (!has)
+            unmet.push(`${t.kind} "${t.id}"`);
     }
-    return 0;
+    for (const op of requires.ops)
+        if (!isWordOf(OVERLAY_OPS, op))
+            unmet.push(`op "${String(op)}"`);
+    for (const tr of requires.traits)
+        if (!isWordOf(PROMPT_TRAITS, tr))
+            unmet.push(`trait "${String(tr)}"`);
+    return unmet;
 }
-export function verifyPromptArtifact(raw, opts) {
-    const fail = (code, reason) => ({ ok: false, code, reason });
-    if (raw === null || typeof raw !== "object")
-        return fail("shape", "envelope is not an object");
-    const env = raw;
-    if (typeof env.sourceRevision !== "string" || !env.sourceRevision || env.sourceRevision.length > 500) {
-        return fail("shape", "sourceRevision missing/oversized");
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function requiresShaped(v) {
+    if (!isRecord(v))
+        return false;
+    const strings = (a) => Array.isArray(a) && a.every((s) => typeof s === "string");
+    return (Object.keys(v).every((k) => k === "targets" || k === "ops" || k === "traits" || k === "bindings") &&
+        Array.isArray(v.targets) &&
+        v.targets.every((t) => isRecord(t) && typeof t.id === "string" && (t.kind === "message" || t.kind === "section" || t.kind === "band") && Object.keys(t).every((k) => k === "id" || k === "kind")) &&
+        strings(v.ops) &&
+        strings(v.traits) &&
+        strings(v.bindings));
+}
+const bindingListOf = (b) => {
+    if (b === undefined)
+        return undefined;
+    const names = b.anyOf !== undefined ? b.anyOf : b.noneOf;
+    return { anyOf: b.anyOf !== undefined, names, set: new Set(names) };
+};
+function bindingsMeet(a, b) {
+    if (a === undefined || b === undefined)
+        return true;
+    if (a.anyOf && b.anyOf)
+        return a.names.some((x) => b.set.has(x));
+    if (a.anyOf)
+        return a.names.some((x) => !b.set.has(x));
+    if (b.anyOf)
+        return b.names.some((x) => !a.set.has(x));
+    return true;
+}
+function replaceConflict(overlays) {
+    const groups = new Map();
+    for (const o of overlays) {
+        if (o.op !== "replace")
+            continue;
+        const { binding, ...rest } = o.when ?? {};
+        const key = canonical({ target: o.target, when: rest });
+        groups.set(key, [...(groups.get(key) ?? []), { o, list: bindingListOf(binding) }]);
     }
-    const art = env.artifact;
-    if (art === null || typeof art !== "object")
-        return fail("shape", "artifact is not an object");
-    const payload = art.payload;
-    if (payload === null || typeof payload !== "object")
-        return fail("shape", "payload is not an object");
-    if (payload.schemaVersion !== 1)
-        return fail("schema", `unsupported schemaVersion ${String(payload.schemaVersion)}`);
-    if (payload.assemblyApi !== 1)
-        return fail("schema", `unsupported assemblyApi ${String(payload.assemblyApi)}`);
-    if (typeof payload.catalogDigest !== "string" || !DIGEST_RE.test(payload.catalogDigest))
-        return fail("shape", "catalogDigest malformed");
-    let compatibleCore;
-    if (payload.compatibleCore !== undefined) {
-        const cc = payload.compatibleCore;
-        if (cc === null || typeof cc !== "object")
-            return fail("shape", "compatibleCore malformed");
-        compatibleCore = {};
-        for (const key of ["minCore", "maxCoreExclusive"]) {
-            const v = cc[key];
-            if (v === undefined)
-                continue;
-            if (typeof v !== "string" || triple(v) === undefined)
-                return fail("shape", `compatibleCore.${key} is not a dotted triple`);
-            compatibleCore[key] = v;
-        }
-        const engine = triple(opts.engineVersion);
-        if (engine === undefined)
-            return fail("core-range", `engine version "${opts.engineVersion}" is not a dotted triple`);
-        if (compatibleCore.minCore !== undefined && tripleCmp(engine, triple(compatibleCore.minCore)) < 0) {
-            return fail("core-range", `engine ${opts.engineVersion} < minCore ${compatibleCore.minCore}`);
+    for (const group of groups.values()) {
+        for (let i = 0; i < group.length; i++) {
+            for (let j = i + 1; j < group.length; j++) {
+                const [{ o: p, list: pl }, { o: q, list: ql }] = [group[i], group[j]];
+                if (bindingsMeet(pl, ql)) {
+                    return `overlays "${p.id}" and "${q.id}" both replace "${p.target}" under one condition that can hold in the same run (write exclusive binding conditions: "noneOf": [x] beside "anyOf": [x])`;
+                }
+            }
         }
-        if (compatibleCore.maxCoreExclusive !== undefined && tripleCmp(engine, triple(compatibleCore.maxCoreExclusive)) >= 0) {
-            return fail("core-range", `engine ${opts.engineVersion} >= maxCoreExclusive ${compatibleCore.maxCoreExclusive}`);
-        }
-    }
-    const closure = payload.closure;
-    if (closure === null || typeof closure !== "object")
-        return fail("shape", "closure is not an object");
-    if (closure.basePackId !== "sema-default@1") {
-        return fail("base-pack", `unsupported basePackId ${JSON.stringify(closure.basePackId).slice(0, 120)} (v1: bundled base only)`);
     }
-    const catalog = closure.promptCatalog;
-    if (catalog === null || typeof catalog !== "object")
-        return fail("shape", "promptCatalog is not an object");
-    if (typeof catalog.packId !== "string" || !catalog.packId.trim() || catalog.packId.length > ARTIFACT_LIMITS.maxPackIdLength) {
-        return fail("shape", "promptCatalog.packId missing/oversized");
+    return undefined;
+}
+export function verifyPromptArtifact(raw) {
+    if (!isRecord(raw))
+        return { ok: false, code: "shape", reason: "the published artifact is not an object" };
+    if (typeof raw.sourceRevision !== "string" || raw.sourceRevision.length === 0 || codePointsOver(raw.sourceRevision, ARTIFACT_LIMITS.maxSourceRevisionChars)) {
+        return { ok: false, code: "shape", reason: `sourceRevision missing or over ${ARTIFACT_LIMITS.maxSourceRevisionChars} characters (code points)` };
     }
-    if (!Array.isArray(catalog.sections))
-        return fail("shape", "promptCatalog.sections is not an array");
-    if (catalog.sections.length === 0)
-        return fail("shape", "promptCatalog.sections is empty — publish at least one section, or disable the source instead");
-    if (catalog.sections.length > ARTIFACT_LIMITS.maxSections) {
-        return fail("limits", `${catalog.sections.length} sections > max ${ARTIFACT_LIMITS.maxSections}`);
+    const v = verifyPromptArtifactBody(raw);
+    return v.ok ? { ok: true, artifact: { ...v.artifact, sourceRevision: raw.sourceRevision } } : v;
+}
+export function verifyPromptArtifactBody(raw) {
+    const fail = (code, reason) => ({ ok: false, code, reason });
+    if (!isRecord(raw))
+        return fail("shape", "the artifact is not an object");
+    for (const k of Object.keys(raw))
+        if (k !== "payload" && k !== "artifactDigest" && k !== "sourceRevision")
+            return fail("shape", `the artifact carries ${JSON.stringify(k).slice(0, 60)}`);
+    if (typeof raw.artifactDigest !== "string" || !DIGEST_RE.test(raw.artifactDigest))
+        return fail("shape", "artifactDigest malformed");
+    const payload = raw.payload;
+    if (!isRecord(payload))
+        return fail("shape", "payload is not an object");
+    if (payload.schemaVersion !== 3) {
+        const republish = payload.schemaVersion === 2 ? `; republish under schemaVersion 3 — an overlay's "scope": { "binding": b } becomes "when": { "binding": { "anyOf": [b] } }` : "";
+        return fail("schema", `unsupported schemaVersion ${JSON.stringify(payload.schemaVersion)?.slice(0, 40)} (this engine reads schemaVersion 3 only${republish})`);
     }
-    const ids = new Set();
+    for (const k of Object.keys(payload))
+        if (k !== "schemaVersion" && k !== "requires" && k !== "overlays" && k !== "evidence")
+            return fail("shape", `payload carries ${JSON.stringify(k).slice(0, 60)}`);
+    if (!Array.isArray(payload.overlays))
+        return fail("shape", "overlays is not an array");
+    if (payload.overlays.length === 0)
+        return fail("shape", "overlays is empty — publish at least one overlay, or disable the source instead");
+    if (payload.overlays.length > ARTIFACT_LIMITS.maxOverlays)
+        return fail("limits", `${payload.overlays.length} overlays > max ${ARTIFACT_LIMITS.maxOverlays}`);
+    const requires = payload.requires;
+    if (!requiresShaped(requires))
+        return fail("shape", "requires is not { targets: { id, kind }[], ops: string[], traits: string[], bindings: string[] }");
+    const unmet = unmetRequirements(requires);
+    if (unmet.length > 0)
+        return fail("requires", `this engine does not meet the artifact's requirements: ${unmet.slice(0, 6).join(", ")}${unmet.length > 6 ? ` and ${unmet.length - 6} more` : ""}`);
+    const overlays = [];
     let totalBytes = 0;
-    const sections = [];
-    for (const rawSection of catalog.sections) {
-        if (rawSection === null || typeof rawSection !== "object")
-            return fail("shape", "section is not an object");
-        const s = rawSection;
-        if (typeof s.id !== "string" || s.id.startsWith("core/") || s.id.length > ARTIFACT_LIMITS.maxIdLength || !ID_RE.test(s.id)) {
-            return fail("shape", `invalid section id ${JSON.stringify(s.id).slice(0, 120)}`);
+    for (const rawOverlay of payload.overlays) {
+        const v = validateOverlay(rawOverlay, { source: "center" });
+        if ("violation" in v)
+            return fail("overlay", v.violation);
+        const text = v.overlay.text;
+        if (text !== undefined) {
+            const bytes = Buffer.byteLength(text, "utf8");
+            if (bytes > ARTIFACT_LIMITS.maxOverlayTextBytes)
+                return fail("limits", `overlay "${v.overlay.id}" text ${bytes} bytes > max ${ARTIFACT_LIMITS.maxOverlayTextBytes}`);
+            totalBytes += bytes;
         }
-        if (ids.has(s.id))
-            return fail("shape", `duplicate section id "${s.id}"`);
-        ids.add(s.id);
-        if (typeof s.slot !== "string" || !SLOTS.has(s.slot))
-            return fail("shape", `unknown slot ${JSON.stringify(s.slot).slice(0, 60)} ("${s.id}")`);
-        if (typeof s.text !== "string" || s.text.length === 0)
-            return fail("shape", `empty/missing text ("${s.id}")`);
-        const bytes = Buffer.byteLength(s.text, "utf8");
-        if (bytes > ARTIFACT_LIMITS.maxSectionBytes)
-            return fail("limits", `section "${s.id}" ${bytes} bytes > max ${ARTIFACT_LIMITS.maxSectionBytes}`);
-        totalBytes += bytes;
-        if (typeof s.contentHash !== "string" || !DIGEST_RE.test(s.contentHash))
-            return fail("shape", `contentHash missing/malformed ("${s.id}")`);
-        if (s.contentHash !== sha256Hex(s.text))
-            return fail("content-hash", `contentHash does not match text ("${s.id}")`);
-        sections.push({ id: s.id, slot: s.slot, text: s.text, contentHash: s.contentHash });
+        overlays.push(v.overlay);
     }
-    if (totalBytes > ARTIFACT_LIMITS.maxTotalBytes)
-        return fail("limits", `catalog ${totalBytes} bytes > max ${ARTIFACT_LIMITS.maxTotalBytes}`);
-    const normalizedCatalog = { packId: catalog.packId, sections };
-    const normalizedPayload = {
-        schemaVersion: 1,
-        assemblyApi: 1,
-        catalogDigest: payload.catalogDigest,
-        ...(compatibleCore !== undefined ? { compatibleCore } : {}),
-        closure: { basePackId: "sema-default@1", promptCatalog: normalizedCatalog },
-    };
-    if (computeCatalogDigest(normalizedCatalog) !== payload.catalogDigest) {
-        return fail("digest", "catalogDigest does not match canonical(promptCatalog)");
+    if (totalBytes > ARTIFACT_LIMITS.maxTotalTextBytes)
+        return fail("limits", `overlay text ${totalBytes} bytes > max ${ARTIFACT_LIMITS.maxTotalTextBytes}`);
+    if (canonical(requiresOf(overlays)) !== canonical(requires))
+        return fail("requires", "requires differs from what the overlays require (build the artifact with buildPromptArtifact)");
+    const conflict = replaceConflict(overlays);
+    if (conflict !== undefined)
+        return fail("overlay", conflict);
+    const evidence = payload.evidence;
+    if (!isRecord(evidence) || typeof evidence.intent !== "string" || evidence.intent.trim() === "" || codePointsOver(evidence.intent, ARTIFACT_LIMITS.maxIntentChars)) {
+        return fail("evidence", `evidence.intent is a non-blank string of at most ${ARTIFACT_LIMITS.maxIntentChars} characters (code points)`);
     }
-    if (typeof art.artifactDigest !== "string" || !DIGEST_RE.test(art.artifactDigest))
-        return fail("shape", "artifactDigest malformed");
-    if (computeArtifactDigest(normalizedPayload) !== art.artifactDigest) {
-        return fail("digest", "artifactDigest does not match canonical(payload)");
+    if (!Array.isArray(evidence.refs) || evidence.refs.length > ARTIFACT_LIMITS.maxRefs || evidence.refs.some((r) => typeof r !== "string" || r.trim() === "" || codePointsOver(r, ARTIFACT_LIMITS.maxRefChars))) {
+        return fail("evidence", `evidence.refs is a list of at most ${ARTIFACT_LIMITS.maxRefs} non-blank references of at most ${ARTIFACT_LIMITS.maxRefChars} characters (code points) each`);
     }
-    return { ok: true, artifact: { payload: normalizedPayload, artifactDigest: art.artifactDigest } };
+    for (const k of Object.keys(evidence))
+        if (k !== "intent" && k !== "refs")
+            return fail("shape", `evidence carries ${JSON.stringify(k).slice(0, 60)}`);
+    const behaviorReplace = overlays.find((o) => o.op === "replace" && sectionOfMessage(o.target)?.band === "core-behavior");
+    if (behaviorReplace !== undefined && evidence.refs.length === 0) {
+        return fail("evidence", `overlay "${behaviorReplace.id}" replaces core-behavior text; evidence.refs names at least one evaluation or golden`);
+    }
+    const normalized = {
+        schemaVersion: 3,
+        requires: requiresOf(overlays),
+        overlays,
+        evidence: { intent: evidence.intent, refs: [...evidence.refs] },
+    };
+    if (computeArtifactDigest(normalized) !== raw.artifactDigest)
+        return fail("digest", "artifactDigest does not match canonical(payload)");
+    return { ok: true, artifact: { payload: normalized, artifactDigest: raw.artifactDigest } };
 }
-export function artifactDeclarations(artifact) {
-    return artifact.payload.closure.promptCatalog.sections.map((s) => ({
-        id: s.id,
-        slot: s.slot,
-        text: s.text,
-        contentHash: s.contentHash,
-    }));
+const CENTER_ORIGIN = Object.freeze({ source: "center", by: "center" });
+export function centerOverlaysOf(adoption) {
+    if (adoption === undefined)
+        return [];
+    return adoption.artifact.payload.overlays.map((overlay) => ({ overlay, origin: CENTER_ORIGIN }));
 }
-export function buildPromptArtifactEnvelope(opts) {
-    const catalog = {
-        packId: opts.packId,
-        sections: opts.sections.map((s) => ({ ...s, contentHash: sha256Hex(s.text) })),
-    };
-    const payload = {
-        schemaVersion: 1,
-        assemblyApi: 1,
-        catalogDigest: computeCatalogDigest(catalog),
-        ...(opts.compatibleCore !== undefined ? { compatibleCore: opts.compatibleCore } : {}),
-        closure: { basePackId: "sema-default@1", promptCatalog: catalog },
-    };
-    return {
-        artifact: { payload, artifactDigest: computeArtifactDigest(payload) },
-        sourceRevision: opts.sourceRevision,
-    };
+export function adoptCenter(artifact, sourceRevision) {
+    const v = verifyPromptArtifactBody(artifact);
+    return v.ok ? { artifact: v.artifact, ...(sourceRevision !== undefined ? { sourceRevision } : {}) } : undefined;
+}
+export function buildPromptArtifact(opts) {
+    const overlays = opts.overlays.map((o) => {
+        const v = validateOverlay(o, { source: "center" });
+        return "overlay" in v ? v.overlay : o;
+    });
+    const payload = JSON.parse(JSON.stringify({ schemaVersion: 3, requires: requiresOf(overlays), overlays, evidence: opts.evidence }));
+    return verifyPromptArtifact({ payload, artifactDigest: sha256Hex(canonical(payload)), sourceRevision: opts.sourceRevision });
 }