@sentropic/harness 0.2.1 → 0.4.0

package/dist/artifacts/validate-verification-run.d.ts

@@ -0,0 +1,28 @@
+import type { VerificationCategory, ViolationSeverity } from './verification-run.js';
+export declare const VERIFICATION_CATEGORIES: readonly VerificationCategory[];
+export declare const VIOLATION_SEVERITIES: readonly ViolationSeverity[];
+export type ValidationMode = 'structural' | 'ingested';
+export interface ValidateOptions {
+    /** `ingested` ⇒ also enforce per-check `target` presence (adapter fail-closed). */
+    mode?: ValidationMode;
+}
+export interface ValidationResult {
+    valid: boolean;
+    /** Dot/bracket paths + messages, e.g. `checks[0].target: required for ingested check`. */
+    errors: string[];
+}
+/**
+ * Validate an unknown value against the frozen VerificationRun v0 contract. Pure, dependency-free,
+ * deterministic. Returns every error rather than throwing on the first.
+ */
+export declare function validateVerificationRunV0(run: unknown, opts?: ValidateOptions): ValidationResult;
+/**
+ * Derive the scope verdict from violations+severity (DEC-S3, the frozen cross-contract predicate):
+ * any `blocking` ⇒ `violation`; else any `advisory` ⇒ `conditional`; else `clean`. NEVER derived
+ * from `result`. The harness does NOT route on this (that is the track-side adapter); it is exposed
+ * so the predicate can be asserted against the frozen contract rather than trusted.
+ */
+export declare function deriveVerdict(violations: ReadonlyArray<{
+    severity: ViolationSeverity;
+}>): 'clean' | 'violation' | 'conditional';
+//# sourceMappingURL=validate-verification-run.d.ts.map

package/dist/artifacts/validate-verification-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-verification-run.d.ts","sourceRoot":"","sources":["../../src/artifacts/validate-verification-run.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAErF,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EASlE,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAA6B,CAAC;AAI3F,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,UAAU,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,0FAA0F;IAC1F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA6ED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,eAAoB,GAAG,gBAAgB,CAoCpG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC,GACzD,OAAO,GAAG,WAAW,GAAG,aAAa,CAIvC"}

package/dist/artifacts/validate-verification-run.js

@@ -0,0 +1,160 @@
+// Dependency-free runtime validator for the VerificationRun v0 seam.
+//
+// Hand-rolled (NO ajv / no JSON-Schema runtime): the `make test-harness` toolset is pinned to
+// vitest/typescript/@types/node only, so the package stays dependency-free. This validator is
+// the runtime counterpart of `schema/verification-run.schema.json` and of the
+// `VerificationRun` types — keep all three in lock-step.
+//
+// Modes:
+//   - `structural` (default): asserts the artifact shape (a check MAY omit `target`).
+//   - `ingested`: additionally enforces the adapter fail-closed rule — every check MUST carry a
+//     `target` with ≥1 of `scope`|`acceptance` (DEC-S1). A track-ingested check with no target
+//     FAILS CLOSED; this surfaces it BEFORE emit instead of letting the adapter reject it.
+export const VERIFICATION_CATEGORIES = [
+    'none',
+    'static',
+    'unit',
+    'integration',
+    'e2e',
+    'ci',
+    'uat',
+    'security',
+];
+export const VIOLATION_SEVERITIES = ['advisory', 'blocking'];
+const ACCEPTANCE_KINDS = ['unit', 'integration', 'e2e', 'manual'];
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function isStr(v) {
+    return typeof v === 'string';
+}
+function validateViolation(v, path, errors) {
+    if (!isRecord(v)) {
+        errors.push(`${path}: expected object`);
+        return;
+    }
+    if (!isStr(v.code))
+        errors.push(`${path}.code: expected string`);
+    if (!isStr(v.message))
+        errors.push(`${path}.message: expected string`);
+    if (!VIOLATION_SEVERITIES.includes(v.severity)) {
+        errors.push(`${path}.severity: expected one of ${VIOLATION_SEVERITIES.join('|')}`);
+    }
+    if (v.path !== undefined && !isStr(v.path))
+        errors.push(`${path}.path: expected string`);
+}
+function validateTarget(t, path, errors) {
+    if (!isRecord(t)) {
+        errors.push(`${path}: expected object`);
+        return;
+    }
+    if (t.scope === undefined && t.acceptance === undefined) {
+        errors.push(`${path}: requires at least one of scope|acceptance`);
+    }
+    if (t.scope !== undefined) {
+        if (!isRecord(t.scope) || !isStr(t.scope.wpRef)) {
+            errors.push(`${path}.scope.wpRef: expected string`);
+        }
+    }
+    if (t.acceptance !== undefined) {
+        const a = t.acceptance;
+        if (!isRecord(a)) {
+            errors.push(`${path}.acceptance: expected object`);
+        }
+        else {
+            if (!isStr(a.evidenceId))
+                errors.push(`${path}.acceptance.evidenceId: expected string`);
+            if (!ACCEPTANCE_KINDS.includes(a.kind)) {
+                errors.push(`${path}.acceptance.kind: expected one of ${ACCEPTANCE_KINDS.join('|')}`);
+            }
+            if (a.criterionIds !== undefined) {
+                if (!Array.isArray(a.criterionIds) || !a.criterionIds.every(isStr)) {
+                    errors.push(`${path}.acceptance.criterionIds: expected string[]`);
+                }
+            }
+        }
+    }
+}
+function validateCheck(c, path, mode, errors) {
+    if (!isRecord(c)) {
+        errors.push(`${path}: expected object`);
+        return;
+    }
+    if (!isStr(c.code))
+        errors.push(`${path}.code: expected string`);
+    if (!VERIFICATION_CATEGORIES.includes(c.category)) {
+        errors.push(`${path}.category: expected one of ${VERIFICATION_CATEGORIES.join('|')}`);
+    }
+    if (typeof c.pass !== 'boolean')
+        errors.push(`${path}.pass: expected boolean`);
+    if (!Array.isArray(c.violations)) {
+        errors.push(`${path}.violations: expected array`);
+    }
+    else {
+        c.violations.forEach((v, i) => validateViolation(v, `${path}.violations[${i}]`, errors));
+    }
+    if (c.target !== undefined) {
+        validateTarget(c.target, `${path}.target`, errors);
+    }
+    else if (mode === 'ingested') {
+        // Adapter fail-closed (DEC-S1): a track-ingested check with no target is rejected.
+        errors.push(`${path}.target: required for a track-ingested check (adapter fails closed)`);
+    }
+}
+/**
+ * Validate an unknown value against the frozen VerificationRun v0 contract. Pure, dependency-free,
+ * deterministic. Returns every error rather than throwing on the first.
+ */
+export function validateVerificationRunV0(run, opts = {}) {
+    const mode = opts.mode ?? 'structural';
+    const errors = [];
+    if (!isRecord(run)) {
+        return { valid: false, errors: ['$: expected object'] };
+    }
+    if (run.schemaVersion !== 1)
+        errors.push('$.schemaVersion: expected 1 (unknown version fails closed)');
+    for (const key of ['runId', 'commit', 'branch', 'env', 'runner', 'command', 'artifactLocator']) {
+        if (!isStr(run[key]))
+            errors.push(`$.${key}: expected string`);
+    }
+    if (!VERIFICATION_CATEGORIES.includes(run.category)) {
+        errors.push(`$.category: expected one of ${VERIFICATION_CATEGORIES.join('|')}`);
+    }
+    if (run.result !== 'pass' && run.result !== 'fail') {
+        errors.push('$.result: expected pass|fail');
+    }
+    if (!isStr(run.startedAt))
+        errors.push('$.startedAt: expected ISO-8601 string');
+    if (!isStr(run.finishedAt))
+        errors.push('$.finishedAt: expected ISO-8601 string');
+    if (!Array.isArray(run.checks)) {
+        errors.push('$.checks: expected array');
+    }
+    else {
+        run.checks.forEach((c, i) => validateCheck(c, `$.checks[${i}]`, mode, errors));
+    }
+    if (!Array.isArray(run.violations)) {
+        errors.push('$.violations: expected array');
+    }
+    else {
+        run.violations.forEach((v, i) => validateViolation(v, `$.violations[${i}]`, errors));
+    }
+    if (!Array.isArray(run.artifacts) || !run.artifacts.every(isStr)) {
+        errors.push('$.artifacts: expected string[]');
+    }
+    return { valid: errors.length === 0, errors };
+}
+/**
+ * Derive the scope verdict from violations+severity (DEC-S3, the frozen cross-contract predicate):
+ * any `blocking` ⇒ `violation`; else any `advisory` ⇒ `conditional`; else `clean`. NEVER derived
+ * from `result`. The harness does NOT route on this (that is the track-side adapter); it is exposed
+ * so the predicate can be asserted against the frozen contract rather than trusted.
+ */
+export function deriveVerdict(violations) {
+    if (violations.some((v) => v.severity === 'blocking'))
+        return 'violation';
+    if (violations.some((v) => v.severity === 'advisory'))
+        return 'conditional';
+    return 'clean';
+}
+//# sourceMappingURL=validate-verification-run.js.map

package/dist/artifacts/validate-verification-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-verification-run.js","sourceRoot":"","sources":["../../src/artifacts/validate-verification-run.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAC9E,yDAAyD;AACzD,EAAE;AACF,SAAS;AACT,sFAAsF;AACtF,gGAAgG;AAChG,+FAA+F;AAC/F,2FAA2F;AAI3F,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,MAAM;IACN,QAAQ;IACR,MAAM;IACN,aAAa;IACb,KAAK;IACL,IAAI;IACJ,KAAK;IACL,UAAU;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAE3F,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAe3E,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,IAAY,EAAE,MAAgB;IACnE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACvE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAA6B,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,8BAA8B,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,cAAc,CAAC,CAAU,EAAE,IAAY,EAAE,MAAgB;IAChE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;YACxF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAyC,CAAC,EAAE,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,qCAAqC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY,EAAE,IAAoB,EAAE,MAAgB;IACrF,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IACjE,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAgC,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,8BAA8B,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,IAAI,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;SAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,mFAAmF;QACnF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,qEAAqE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,OAAwB,EAAE;IAChF,MAAM,IAAI,GAAmB,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACvG,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,CAAU,EAAE,CAAC;QACxG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAgC,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,+BAA+B,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAElF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA0D;IAE1D,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,aAAa,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/artifacts/verification-run.d.ts

@@ -1,4 +1,4 @@
-export type VerificationCategory = 'none' | 'static' | 'unit' | 'integration' | 'e2e' | 'ci' | 'uat';
+export type VerificationCategory = 'none' | 'static' | 'unit' | 'integration' | 'e2e' | 'ci' | 'uat' | 'security';
 export type ViolationSeverity = 'advisory' | 'blocking';
 /** A single policy violation found by a check. */
 export interface Violation {
@@ -19,12 +19,46 @@ export interface CheckResult {
         reason: string;
     };
 }
+/**
+ * Structured evidence target for a single check (DEC-S1, the freeze keystone).
+ *
+ * Carried PER-CHECK (not per-run) because one `harness verify` aggregates N checks that can
+ * span multiple WPs / acceptance criteria. A track-side adapter routes from the target, never
+ * from `category`/`branch`/`commit`/path globs (DEC-S4). ≥1 of `scope`|`acceptance` is required
+ * for any TRACK-INGESTED check; a check with no target FAILS CLOSED at the adapter (never
+ * auto-itemized, never glob-routed). The harness does NOT enforce that here — `target` is
+ * optional on the type so non-ingested / producer-local checks remain representable.
+ */
+export interface VerificationTarget {
+    /** present ⇒ adapter emits `scope.verification` (verdict derived from violations+severity). */
+    scope?: {
+        /** exact `scope.declare` itemId / stable scope key (no inference). */
+        wpRef: string;
+    };
+    /** present ⇒ adapter emits `acceptance.run` (+ one `acceptance.link` per criterionId). */
+    acceptance?: {
+        /**
+         * Caller-supplied DETERMINISTIC evidence key (DEC §7 M2=B): the harness supplies this key
+         * on `acceptance.link` and `acceptance.run` references it — single-phase, replayable,
+         * retry-safe. It is NOT a server-minted id.
+         */
+        evidenceId: string;
+        kind: 'unit' | 'integration' | 'e2e' | 'manual';
+        criterionIds?: string[];
+    };
+}
 /** One check's contribution inside a VerificationRun. */
 export interface VerificationCheck {
     code: string;
     category: VerificationCategory;
     pass: boolean;
     violations: Violation[];
+    /**
+     * Structured evidence target (DEC-S1). ≥1 of `scope`|`acceptance` is required for a
+     * track-ingested check; absent ⇒ the track-side adapter FAILS CLOSED (never auto-itemized,
+     * never glob-routed). Optional on the type so producer-local checks stay representable.
+     */
+    target?: VerificationTarget;
 }
 export interface VerificationRun {
     schemaVersion: 1;
@@ -42,7 +76,14 @@ export interface VerificationRun {
     checks: VerificationCheck[];
     /** Flattened union of all check violations (convenience for ingesters). */
     violations: Violation[];
-    /** Opaque references to produced artifacts (paths/urls). */
+    /**
+     * Immutable locator for the full VerificationRun JSON — the CANONICAL evidence (DEC-S2).
+     * `scope.verification.violations: string[]` is only a display/index projection of this run.
+     * Immutability is a PRODUCER guarantee (the track adapter RECORDS the locator, never verifies
+     * it — OQ-3); not validated here. REQUIRED.
+     */
+    artifactLocator: string;
+    /** Opaque references to OTHER produced artifacts (paths/urls). */
     artifacts: string[];
 }
 //# sourceMappingURL=verification-run.d.ts.map

package/dist/artifacts/verification-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-run.d.ts","sourceRoot":"","sources":["../../src/artifacts/verification-run.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,QAAQ,GACR,MAAM,GACN,aAAa,GACb,KAAK,GACL,IAAI,GACJ,KAAK,CAAC;AAEV,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,CAAC;AAExD,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,2EAA2E;IAC3E,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,CAAC,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}
+{"version":3,"file":"verification-run.d.ts","sourceRoot":"","sources":["../../src/artifacts/verification-run.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,QAAQ,GACR,MAAM,GACN,aAAa,GACb,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,CAAC;AAEf,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,CAAC;AAExD,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,2EAA2E;IAC3E,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,KAAK,CAAC,EAAE;QACN,sEAAsE;QACtE,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,0FAA0F;IAC1F,UAAU,CAAC,EAAE;QACX;;;;WAIG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,KAAK,GAAG,QAAQ,CAAC;QAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;CACH;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,CAAC,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/artifacts/verification-run.js

@@ -5,6 +5,8 @@
 // superset of track's `TestRun{ commit, env, runner, result, at }` so the seam holds.
 //
 // `category` is the BR25 **D3** verification taxonomy (APPROVED 2026-06-04), bound to this
-// field. (`security` is added when the security verify-hook lands — out of this slice.)
+// field. `security` is reserved NOW as a frozen v0 slot (DEC §2 / §6): adding an enum value
+// after the freeze would be a major bump, so the slot is locked even though the security
+// verify-hook is not wired yet. In v0 `security` stays schema-artifact-only / OFF-WIRE (OQ-7).
 export {};
 //# sourceMappingURL=verification-run.js.map

package/dist/artifacts/verification-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-run.js","sourceRoot":"","sources":["../../src/artifacts/verification-run.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,sFAAsF;AACtF,EAAE;AACF,2FAA2F;AAC3F,wFAAwF"}
+{"version":3,"file":"verification-run.js","sourceRoot":"","sources":["../../src/artifacts/verification-run.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,sFAAsF;AACtF,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,yFAAyF;AACzF,+FAA+F"}

package/dist/cli/command-intent.d.ts

@@ -0,0 +1,10 @@
+export declare const harnessCliCommandIntentAdapter: Readonly<{
+    runnerId: "harness";
+    source: "@sentropic/harness";
+    parseIntent(argv: readonly string[]): {
+        runnerId: "harness";
+        source: "@sentropic/harness";
+        argv: string[];
+    };
+}>;
+//# sourceMappingURL=command-intent.d.ts.map

package/dist/cli/command-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-intent.d.ts","sourceRoot":"","sources":["../../src/cli/command-intent.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,8BAA8B;;;sBAGvB,SAAS,MAAM,EAAE;;;;;EAGnC,CAAC"}

package/dist/cli/command-intent.js

@@ -0,0 +1,8 @@
+export const harnessCliCommandIntentAdapter = Object.freeze({
+    runnerId: 'harness',
+    source: '@sentropic/harness',
+    parseIntent(argv) {
+        return { runnerId: this.runnerId, source: this.source, argv: [...argv] };
+    },
+});
+//# sourceMappingURL=command-intent.js.map

package/dist/cli/command-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-intent.js","sourceRoot":"","sources":["../../src/cli/command-intent.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,oBAAoB;IAC5B,WAAW,CAAC,IAAuB;QACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAC3E,CAAC;CACF,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export declare const HARNESS_PACKAGE: "@sentropic/harness";
-export type { VerificationRun, VerificationCheck, VerificationCategory, Violation, ViolationSeverity, CheckResult, } from './artifacts/verification-run.js';
+export type { VerificationRun, VerificationCheck, VerificationTarget, VerificationCategory, Violation, ViolationSeverity, CheckResult, } from './artifacts/verification-run.js';
+export { validateVerificationRunV0, deriveVerdict, VERIFICATION_CATEGORIES, VIOLATION_SEVERITIES, } from './artifacts/validate-verification-run.js';
+export type { ValidationMode, ValidateOptions, ValidationResult, } from './artifacts/validate-verification-run.js';
 export type { WorkEvent, WorkEventVerb, WorkEventStatus, WorkEventValue, } from './artifacts/work-event.js';
 export { toWorkEvent } from './run/work-event.js';
 export type { WorkEventInput, WorkEventContext } from './run/work-event.js';
@@ -19,4 +21,5 @@ export type { NamedCheck, VerificationContext } from './run/emit.js';
 export { HARNESS_SKILLS, HOST_SKILL_DIR, isHostId } from './skills/manifest.js';
 export type { SkillEntry, HostId } from './skills/manifest.js';
 export { runHarnessCli } from './cli/run.js';
+export { harnessCliCommandIntentAdapter } from './cli/command-intent.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,eAAe,sBAAgC,CAAC;AAG7D,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,WAAW,GACZ,MAAM,iCAAiC,CAAC;AAGzC,YAAY,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5E,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAClF,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChF,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,eAAe,sBAAgC,CAAC;AAG7D,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,WAAW,GACZ,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,yBAAyB,EACzB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,0CAA0C,CAAC;AAClD,YAAY,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5E,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAClF,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChF,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -3,6 +3,8 @@
 // Tooling-only: no product-runtime imports (no Drizzle/Hono/Svelte/Mistral), no
 // `@sentropic/*` deps, and NO track import — harness only EMITS neutral artifacts.
 export const HARNESS_PACKAGE = '@sentropic/harness';
+// Dependency-free runtime validator + frozen verdict-derivation predicate for the v0 seam.
+export { validateVerificationRunV0, deriveVerdict, VERIFICATION_CATEGORIES, VIOLATION_SEVERITIES, } from './artifacts/validate-verification-run.js';
 export { toWorkEvent } from './run/work-event.js';
 export { sentropicProfile } from './profile/sentropic.js';
 export { stubProfile } from './profile/stub.js';
@@ -18,4 +20,5 @@ export { toVerificationRun } from './run/emit.js';
 export { HARNESS_SKILLS, HOST_SKILL_DIR, isHostId } from './skills/manifest.js';
 // Pure, arg-based CLI driver (the `harness` bin is a thin wrapper over this).
 export { runHarnessCli } from './cli/run.js';
+export { harnessCliCommandIntentAdapter } from './cli/command-intent.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,oBAA6B,CAAC;AAmB7D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,wBAAwB;AACxB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGlF,uDAAuD;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhF,8EAA8E;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,oBAA6B,CAAC;AAa7D,2FAA2F;AAC3F,OAAO,EACL,yBAAyB,EACzB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,0CAA0C,CAAC;AAclD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,wBAAwB;AACxB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGlF,uDAAuD;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhF,8EAA8E;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/run/emit.d.ts

@@ -15,6 +15,12 @@ export interface VerificationContext {
     startedAt: string;
     finishedAt: string;
     artifacts?: string[];
+    /**
+     * Immutable locator for the full run JSON (DEC-S2). Producer-supplied; when omitted a
+     * deterministic `verification-run:{runId}` placeholder is used so the field stays REQUIRED
+     * on the artifact. Immutability is a producer guarantee, not enforced here.
+     */
+    artifactLocator?: string;
 }
 /**
  * Assemble a NEUTRAL `VerificationRun` from check results. harness EMITS this artifact and

package/dist/run/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/run/emit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAEf,oBAAoB,EAErB,MAAM,kCAAkC,CAAC;AAE1C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,eAAe,CAyBjG"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/run/emit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAEf,oBAAoB,EAErB,MAAM,kCAAkC,CAAC;AAE1C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,eAAe,CA0BjG"}

package/dist/run/emit.js

@@ -25,6 +25,7 @@ export function toVerificationRun(checks, ctx) {
         finishedAt: ctx.finishedAt,
         checks: verificationChecks,
         violations,
+        artifactLocator: ctx.artifactLocator ?? `verification-run:${ctx.runId}`,
         artifacts: ctx.artifacts ?? [],
     };
 }

package/dist/run/emit.js.map

@@ -1 +1 @@
-{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/run/emit.ts"],"names":[],"mappings":"AA2BA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB,EAAE,GAAwB;IAC9E,MAAM,kBAAkB,GAAwB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;KAChC,CAAC,CAAC,CAAC;IACJ,MAAM,UAAU,GAAgB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,UAAU;QACV,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/run/emit.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB,EAAE,GAAwB;IAC9E,MAAM,kBAAkB,GAAwB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;KAChC,CAAC,CAAC,CAAC;IACJ,MAAM,UAAU,GAAgB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,UAAU;QACV,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,oBAAoB,GAAG,CAAC,KAAK,EAAE;QACvE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/harness",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Neutral, host-agnostic code-work / PR-workflow tooling for AI dev: a homogeneous `harness <verb>` method layer (branch/scope/verify/test/debug/review/brainstorm/plan), the native superpowers replacement. Tooling-only, zero product-runtime deps. (BR-42h)",
   "type": "module",
   "license": "MIT",
@@ -22,6 +22,7 @@
   },
   "files": [
     "dist",
+    "schema",
     "skills",
     "README.md",
     "LICENSE"
@@ -34,6 +35,6 @@
   "devDependencies": {
     "@types/node": "^20.12.0",
     "typescript": "5.4.5",
-    "vitest": "4.0.18"
+    "vitest": "4.1.0"
   }
 }

package/schema/verification-run.schema.json

@@ -0,0 +1,154 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/rhanka/sentropic/packages/harness/schema/verification-run.schema.json",
+  "title": "VerificationRun (harness↔track seam v0)",
+  "description": "Neutral verification artifact emitted by @sentropic/harness checks and ingested by a track-side adapter. Frozen v0 per spec/SPEC_DECISION_SEAM_HARNESS_TRACK_V0.md. harness EMITS this artifact and never imports @sentropic/track; the adapter is 100% track-side. Versioning: unknown major/schemaVersion ⇒ fail-closed reject; minor ⇒ additive OPTIONAL fields only; consumers ignore unknown optional fields but MUST NOT route an unknown target-kind / enum value silently.",
+  "type": "object",
+  "$comment": "VERDICT-DERIVATION INVARIANT (DEC-S3, frozen cross-contract): the track-side adapter DERIVES the scope verdict from violations+severity, NEVER from `result`. Predicate: any violation with severity='blocking' ⇒ verdict='violation'; else any violation with severity='advisory' ⇒ verdict='conditional'; else verdict='clean'. The harness does NOT derive the verdict; this predicate is frozen here so it holds cross-contract, not on trust. `acceptance.run.result` uses VerificationRun.result / the check pass flag directly (binary pass|fail).",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runId",
+    "commit",
+    "branch",
+    "env",
+    "runner",
+    "category",
+    "command",
+    "result",
+    "startedAt",
+    "finishedAt",
+    "checks",
+    "violations",
+    "artifactLocator",
+    "artifacts"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": 1,
+      "description": "v0 freeze. Unknown schemaVersion ⇒ fail-closed reject."
+    },
+    "runId": {
+      "type": "string",
+      "description": "Stable id per invocation. The track adapter MINTS a globally-unique runId PER EMITTED VERDICT (a per-check/per-target projection id ≠ this physical run id — DEC §7 M1). This physical id lives in the artifact behind artifactLocator."
+    },
+    "commit": { "type": "string" },
+    "branch": { "type": "string" },
+    "env": { "type": "string" },
+    "runner": { "type": "string" },
+    "category": { "$ref": "#/definitions/VerificationCategory" },
+    "command": { "type": "string" },
+    "result": {
+      "enum": ["pass", "fail"],
+      "description": "Run-level binary outcome. NEVER the source of the scope verdict (see the verdict-derivation invariant)."
+    },
+    "startedAt": { "type": "string", "format": "date-time" },
+    "finishedAt": { "type": "string", "format": "date-time" },
+    "checks": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/VerificationCheck" }
+    },
+    "violations": {
+      "type": "array",
+      "description": "Flattened union of all check violations (convenience for ingesters).",
+      "items": { "$ref": "#/definitions/Violation" }
+    },
+    "artifactLocator": {
+      "type": "string",
+      "description": "Immutable locator for the full VerificationRun JSON — the CANONICAL evidence (DEC-S2). Immutability is a PRODUCER guarantee the adapter RECORDS, never verifies (OQ-3). REQUIRED."
+    },
+    "artifacts": {
+      "type": "array",
+      "description": "Opaque references to OTHER produced artifacts (paths/urls).",
+      "items": { "type": "string" }
+    }
+  },
+  "definitions": {
+    "VerificationCategory": {
+      "enum": [
+        "none",
+        "static",
+        "unit",
+        "integration",
+        "e2e",
+        "ci",
+        "uat",
+        "security"
+      ],
+      "description": "BR25 D3 verification taxonomy. `security` is a frozen v0 slot reserved NOW (adding an enum value post-freeze would be a major bump); it stays schema-artifact-only / OFF-WIRE in v0 (OQ-7). An unknown category MUST NOT route silently."
+    },
+    "ViolationSeverity": {
+      "enum": ["advisory", "blocking"],
+      "description": "FROZEN v0 enum (DEC §7 SHOULD-FIX). Feeds the verdict-derivation invariant; the freeze pins the predicate cross-contract."
+    },
+    "Violation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "message", "severity"],
+      "properties": {
+        "code": { "type": "string" },
+        "path": {
+          "type": "string",
+          "description": "Offending path, when the violation is path-scoped (e.g. C2)."
+        },
+        "message": { "type": "string" },
+        "severity": { "$ref": "#/definitions/ViolationSeverity" }
+      }
+    },
+    "VerificationTarget": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Structured evidence target (DEC-S1, freeze keystone). Carried per-check. The adapter routes from the target, never from category/branch/commit/path globs (DEC-S4). At least one of `scope`|`acceptance` should be present for a track-ingested check; a check with no target FAILS CLOSED at the adapter.",
+      "minProperties": 1,
+      "properties": {
+        "scope": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["wpRef"],
+          "description": "present ⇒ adapter emits scope.verification (verdict derived from violations+severity).",
+          "properties": {
+            "wpRef": {
+              "type": "string",
+              "description": "Exact scope.declare itemId / stable scope key (no inference)."
+            }
+          }
+        },
+        "acceptance": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["evidenceId", "kind"],
+          "description": "present ⇒ adapter emits acceptance.run (+ one acceptance.link per criterionId).",
+          "properties": {
+            "evidenceId": {
+              "type": "string",
+              "description": "Caller-supplied DETERMINISTIC evidence key (DEC §7 M2=B) — NOT a server-minted id."
+            },
+            "kind": { "enum": ["unit", "integration", "e2e", "manual"] },
+            "criterionIds": {
+              "type": "array",
+              "items": { "type": "string" }
+            }
+          }
+        }
+      }
+    },
+    "VerificationCheck": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "category", "pass", "violations"],
+      "properties": {
+        "code": { "type": "string" },
+        "category": { "$ref": "#/definitions/VerificationCategory" },
+        "pass": { "type": "boolean" },
+        "violations": {
+          "type": "array",
+          "items": { "$ref": "#/definitions/Violation" }
+        },
+        "target": {
+          "$ref": "#/definitions/VerificationTarget",
+          "description": "≥1 of scope|acceptance required for a track-ingested check; absent ⇒ adapter fail-closed (never auto-itemized, never glob-routed). Optional so producer-local checks stay representable."
+        }
+      }
+    }
+  }
+}