@shield-agent/kya 0.27.0 → 0.28.0

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "shield-kya",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Audit trail and traceability for AI agents. See what every coding agent did, with opt-in human approval and signed certify.",
   "author": {
     "name": "Shield Agent",

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.27.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.28.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/README.md

@@ -14,7 +14,7 @@
 npm i -g @shield-agent/kya@latest && kya start
 ```
 
-Requires **Node.js 24+**. Restart Cursor / Claude Code / Codex once so MCP loads. Hosted desk: [shield-agent.com](https://shield-agent.com/install).
+Requires **Node.js 22+** (24 recommended). Restart Cursor / Claude Code / Codex once so MCP loads. Hosted desk: [shield-agent.com](https://shield-agent.com/install).
 
 
 CLI and local MCP gate for Shield’s Know Your Agent path.
@@ -27,7 +27,7 @@ Walkthrough: [how you use it](https://shield-agent.com/how-kya-works#using).
 npx @shield-agent/kya@latest --help
 ```
 
-Requires **Node.js 24+** (`engines.node: >=24`). On an older Node the CLI offers to install 24 for you (via volta / fnm / nvm / brew), reinstall itself, and finish the command - declining just prints a warning and continues.
+Requires **Node.js 22+** (`engines.node: >=22`); 24 is the recommended line. Node 20 and 21 are unsupported but work: the CLI prints a one-line warning. Node 18 and older are unsupported and some features break there (HTTP `serve-mcp`, the gateway OTLP receiver). Below 22 the CLI offers to install Node 24 for you (via volta / fnm / nvm / brew), reinstall itself, and finish the command - declining just prints the warning and continues. `kya hook` never warns or prompts.
 
 It works with any host that speaks MCP or OpenAPI. Vertical packs are optional. Shield is the only policy decision point: this gate never auto-approves an irreversible side effect.
 
@@ -252,7 +252,7 @@ MCP Registry entry: `server.json` plus package `mcpName` `io.github.The-Pixel-Bo
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.27.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.28.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "http://127.0.0.1:8090",
         "KYA_API_KEY": "${KYA_API_KEY}",
@@ -292,7 +292,7 @@ Offline evaluate by default (no network, no hosted plane); an explicit config ho
 
 ```bash
 # Prefer a preinstalled package (no registry auto-install):
-npx --no-install @shield-agent/kya@0.27.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.28.0 serve-mcp --stdio
 # Or after npm i -g / local install:
 kya serve-mcp --stdio
 ```
@@ -303,7 +303,7 @@ Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP setting
 
 ## OpenAI (Codex / Responses)
 
-**Codex CLI plugin (hooks):** see [Codex plugin](#codex-plugin). **Codex CLI / IDE (MCP):** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.27.0 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
+**Codex CLI plugin (hooks):** see [Codex plugin](#codex-plugin). **Codex CLI / IDE (MCP):** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.28.0 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
 
 **Responses API:** see `openai/responses-mcp.example.json` (`server_url` + `Authorization: Bearer <KYA_API_KEY>`).
 
@@ -355,7 +355,7 @@ ORR is a reporting board. Scanners, `--scorecard`, and `harness.agentshield` are
 
 ## Certify (continuous agent assurance)
 
-`kya certify` evaluates the open **Agent Trust Baseline** catalog (`catalog/agent-trust-baseline-v0.json` - 30 requirements across Data & Privacy, Security, Safety, Reliability, Accountability, Society) against local evidence: the global trail, ORR output, wired hosts, sandbox inventory, receipts, showback, and your recorded attestations. It writes a gap report to `.kya/certify/` (JSON + Markdown + HTML). The gap list is your work plan. The receipt report shows the same state live: a **Certify** panel recomputed on every render (so `kya start`'s live report updates as events stream in), plus a dedicated **Certify** tab with the full live requirement table - run `kya certify` for the full gap report + signed evidence bundle.
+`kya certify` evaluates the open **Agent Trust Baseline** catalog (`catalog/agent-trust-baseline-v0.json` - 31 requirements across Data & Privacy, Security, Safety, Reliability, Accountability, Society) against local evidence: the global trail, ORR output, wired hosts, sandbox inventory, receipts, showback, and your recorded attestations. It writes a gap report to `.kya/certify/` (JSON + Markdown + HTML). The gap list is your work plan. The receipt report shows the same state live: a **Certify** panel recomputed on every render (so `kya start`'s live report updates as events stream in), plus a dedicated **Certify** tab with the full live requirement table - run `kya certify` for the full gap report + signed evidence bundle.
 
 ```bash
 npx @shield-agent/kya certify                  # gap report; exit 1 when gaps exist (CI-friendly)
@@ -371,7 +371,7 @@ Certify is **evidence-only**. It never ALLOWs, DENYs, or blocks anything - the s
 
 `kya certify` is local, free, and offline: no account, no network calls, no license check (it never sends usage stats). The catalog is MIT-licensed and PRs are welcome. An EU AI Act crosswalk (baseline requirements mapped to Articles 9-15, 26, 72) ships in [docs/certify-eu-ai-act.md](docs/certify-eu-ai-act.md) and `src/certify/eu-ai-act-map.json`.
 
-## Import traces (LangSmith, Langfuse, Phoenix, OTel, AGT, ADR Sensor)
+## Import traces (LangSmith, Langfuse, Phoenix, OTel, AGT, ADR Sensor, OpenShell)
 
 Bring existing observability exports into the trail so the receipt and certify see them:
 
@@ -381,9 +381,10 @@ kya import --from langfuse ./observations.jsonl
 kya import --from otel ./otraces.json
 kya import --from agt   # Microsoft Agent Governance Toolkit audit log
 kya import --from adr-sensor ./adr-sensor-events.jsonl
+kya import --from openshell ./openshell-events.jsonl
 ```
 
-The AGT importer verifies AGT's hash chain, flags tampered logs with chainVerified=false, and never duplicates rows on re-import; see [docs/import-agt.md](docs/import-agt.md). ADR Sensor events map one `AgentEvent` to one or more trail events, with stable `uuid` dedup on re-import; see [docs/import-adr-sensor.md](docs/import-adr-sensor.md). AGT's hash chain is unkeyed, so "verified" means internally consistent, not authentic. The hosted console accepts the same formats ([docs/import-agt-hosted.md](docs/import-agt-hosted.md)).
+The AGT importer verifies AGT's hash chain, flags tampered logs with chainVerified=false, and never duplicates rows on re-import; see [docs/import-agt.md](docs/import-agt.md). ADR Sensor events map one `AgentEvent` to one or more trail events, with stable `uuid` dedup on re-import; see [docs/import-adr-sensor.md](docs/import-adr-sensor.md). OpenShell OCSF logs map one record to one trail event, with stable `uid` dedup on re-import; see [docs/import-openshell.md](docs/import-openshell.md). AGT's hash chain is unkeyed, so "verified" means internally consistent, not authentic. The hosted console accepts the same formats ([docs/import-agt-hosted.md](docs/import-agt-hosted.md)).
 
 Imports land as observe-mode events (`host: import`, `reasonCode: IMPORTED`, error runs become `DENY`/`IMPORTED_ERROR`), with latency and token counts mapped when the source carries them. Files over 50MB are refused; malformed records are skipped, never fatal. The report (`kya start` / `kya receipt`) shows an **Import** card with per-format counts, error count, and the latest imported event once any import has landed.
 
@@ -434,7 +435,7 @@ Route DENY / REQUIRE_APPROVE events to Slack, Linear, Jira, or any webhook. Conf
 
 `KYA_NOTIFY_WEBHOOK=<url>` is the zero-config variant (generic payload). Delivery retries with exponential backoff (250ms/1s/4s + jitter), per-attempt timeouts, a per-URL circuit breaker, and a send rate limiter; payloads are built only from redacted trail fields, with an automatic minimized fallback if the secret scan trips. From short-lived hook/wrap spawns delivery rides a detached helper (`kya notify-flush`), so the gate path never waits on the network. Every delivery attempt is appended to `~/.kya/notify-log.jsonl` (target host only, never the full URL; capped at the last 500 entries), and the report's System tab shows an **Alerts** panel with per-target delivered/failed counts and the last attempt.
 
-## Optional sandbox wrap (Firecracker)
+## Optional sandbox wrap (Firecracker, OpenShell)
 
 Beside the gate, not inside MCP. Opt-in only:
 
@@ -444,7 +445,7 @@ KYA_SANDBOX=mock kya sandbox exec --sandbox-id <id> --cmd "true"
 KYA_SANDBOX=mock kya sandbox kill --sandbox-id <id>
 ```
 
-`org.sample.sandbox.exec` without `--sandbox-id` is **DENY** `MISSING_SANDBOX_ID`. Real Firecracker needs `firecracker` + `jailer` on PATH and kernel/rootfs env (`KYA_SANDBOX_KERNEL`, `KYA_SANDBOX_ROOTFS`). We do not ship those binaries. `serve-mcp` still exposes only evaluate / ingest / request_approval.
+`org.sample.sandbox.exec` without `--sandbox-id` is **DENY** `MISSING_SANDBOX_ID`. Real Firecracker needs `firecracker` + `jailer` on PATH and kernel/rootfs env (`KYA_SANDBOX_KERNEL`, `KYA_SANDBOX_ROOTFS`). We do not ship those binaries. `KYA_SANDBOX=openshell` drives [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) through the `openshell` CLI and needs `openshell` plus `docker` or `podman` on PATH; KYA renders an OpenShell policy per spawn, pins a minimum CLI version, and always sets `OPENSHELL_TELEMETRY_ENABLED=false`. See [docs/sandbox.md](docs/sandbox.md) for backend details. `serve-mcp` still exposes only evaluate / ingest / request_approval.
 
 ## Cost showback (observe only)
 
@@ -475,6 +476,7 @@ pnpm build
 - [Import the AGT audit log (CLI)](docs/import-agt.md) · [hosted](docs/import-agt-hosted.md)
 - [kya certify - Agent Trust Baseline gap reports](docs/certify.md)
 - [EU AI Act crosswalk for the Agent Trust Baseline](docs/certify-eu-ai-act.md)
+- [Sandbox backends (mock / firecracker / openshell)](docs/sandbox.md)
 - [Works with your observability stack](docs/marketing/observability-stack.md)
 - [SDK & framework integrations (in-process shims)](docs/sdk-integrations.md)
 - [Hosted operator SSO / SCIM (not in OSS CLI)](docs/hosted-operator-sso.md)

package/amp/settings.example.json

@@ -2,7 +2,7 @@
   "amp.mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.27.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.28.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/catalog/agent-trust-baseline-v0.json

@@ -51,6 +51,9 @@
     { "id": "SAFE-05", "domain": "safety", "title": "Blocked actions have a retry policy",
       "text": "A documented policy bounds automated retries of DENYed or held actions so blocks cannot be brute-forced.",
       "severity": "medium", "check": { "kind": "attest", "prompt": "Confirm a policy bounds automated retries of blocked actions (no bypass loops)." } },
+    { "id": "SAFE-06", "domain": "safety", "title": "Sandbox boundary verified by openshell-prover",
+      "text": "The OpenShell sandbox boundary policy is formally verified by openshell-prover (SMT, deterministic) to grant no more than the intended boundary.",
+      "severity": "medium", "check": { "kind": "openshell_prover" } },
 
     { "id": "REL-01", "domain": "reliability", "title": "Trail recording is active",
       "text": "At least one trail event in the last 7 days proves the evidence pipeline is live.",

package/claude/claude_desktop_config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.27.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.28.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/cline/cline_mcp_settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.27.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.28.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/copilot/mcp-config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.27.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.28.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/dist/certify/catalog.d.ts

@@ -38,6 +38,8 @@ export type RequirementCheck = {
 } | {
     readonly kind: "sandbox_inventory";
     readonly min: number;
+} | {
+    readonly kind: "openshell_prover";
 } | {
     readonly kind: "receipts_present";
     readonly min: number;

package/dist/certify/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/certify/catalog.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7G;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpH;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACtD;AAED,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAqB5C,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAqBlD;AAsID,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CA2DrD"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/certify/catalog.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7G;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpH;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACtD;AAED,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAsB5C,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAqBlD;AAwID,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CA2DrD"}

package/dist/certify/catalog.js

@@ -19,6 +19,7 @@ const CHECK_KINDS = new Set([
     "orr_category",
     "orr_fresh",
     "sandbox_inventory",
+    "openshell_prover",
     "receipts_present",
     "showback_present",
     "attest",
@@ -128,6 +129,8 @@ function parseCheck(id, raw) {
             return { kind: "hooks_wired", min: minOf(id, c, "hooks_wired") };
         case "sandbox_inventory":
             return { kind: "sandbox_inventory", min: minOf(id, c, "sandbox_inventory") };
+        case "openshell_prover":
+            return { kind: "openshell_prover" };
         case "receipts_present":
             return { kind: "receipts_present", min: minOf(id, c, "receipts_present") };
         case "trail_zero":

package/dist/certify/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/certify/catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA0C1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS;IAClC,aAAa;IACb,aAAa;IACb,YAAY;IACZ,WAAW;IACX,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAClB,IAAI,GAAG,CAAC,4CAA4C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,UAAU,CAAC,mBAAmB,iBAAiB,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,GAAW;IACrC,OAAO,IAAI,UAAU,CAAC,uBAAuB,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,GAAY;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAKL,EAAE,CAAC;IACP,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACvF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAA0B,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAC5F,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,CAA0B;IAC1D,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kDAAkD,CAAC,CAAC;IAChG,OAAO,CAAC,CAAC,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,CAA0B,EAAE,IAAY;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,CAA0B;IACtD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,CAAC,GAAwB,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,aAAa;YAChB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,MAAM,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACjD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;QACnE,KAAK,mBAAmB;YACtB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC/E,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC7E,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;aAC/B,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC9B,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;aAC/B,CAAC;QACJ,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,CAAC,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC9B,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,gDAAgD,CAAC,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACzD,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QACtC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC9E,sEAAsE;YACtE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,MAAM,MAAM,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,8CAA8C;IAC9C,MAAM,MAAM,CAAC,EAAE,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAmB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,UAAU,CAClB,oDAAoD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,CAAC,EAAE,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,MAAM,CAAC,EAAE,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,YAAY,CAAC,IAAI,CAAC;YAChB,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAA+B;YAC7C,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAY;QAClB,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/certify/catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA2C1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS;IAClC,aAAa;IACb,aAAa;IACb,YAAY;IACZ,WAAW;IACX,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAClB,IAAI,GAAG,CAAC,4CAA4C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,MAAM,IAAI,GAAG,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,UAAU,CAAC,mBAAmB,iBAAiB,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,GAAW;IACrC,OAAO,IAAI,UAAU,CAAC,uBAAuB,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,GAAY;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAKL,EAAE,CAAC;IACP,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACvF,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,EAAE,yCAAyC,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAA0B,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAC5F,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,CAA0B;IAC1D,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kDAAkD,CAAC,CAAC;IAChG,OAAO,CAAC,CAAC,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,CAA0B,EAAE,IAAY;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,GAAG,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,CAA0B;IACtD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,CAAC,GAAwB,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,aAAa;YAChB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,MAAM,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACjD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;QACnE,KAAK,mBAAmB;YACtB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC/E,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QACtC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC7E,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;aAC/B,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC9B,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC;aAC/B,CAAC;QACJ,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACpE,MAAM,MAAM,CAAC,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC9B,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,gDAAgD,CAAC,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACzD,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QACtC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC9E,sEAAsE;YACtE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,MAAM,MAAM,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,8CAA8C;IAC9C,MAAM,MAAM,CAAC,EAAE,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAmB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,UAAU,CAClB,oDAAoD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,CAAC,EAAE,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,MAAM,CAAC,EAAE,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,YAAY,CAAC,IAAI,CAAC;YAChB,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAA+B;YAC7C,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAY;QAClB,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/certify/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/certify/context.ts"],"names":[],"mappings":"AAeA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,yDAAyD;AACzD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQjD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,GAAE,IAAiB,GACrB,eAAe,CAkBjB"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/certify/context.ts"],"names":[],"mappings":"AAiBA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,yDAAyD;AACzD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQjD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,GAAE,IAAiB,GACrB,eAAe,CAmBjB"}

package/dist/certify/context.js

@@ -2,13 +2,16 @@
  * Shared evidence-context assembly for `kya certify` and live report panels.
  * Single source of truth: runCertify and the receipt report panel both build
  * their EvidenceContext here so they can never diverge. Local readers only:
- * no network, no account, no key check.
+ * no network, no account, no key check. The one exception is the optional
+ * openshell-prover subprocess (SAFE-06): it only spawns when the binary is
+ * present and never throws (see certify/openshell-prover.ts).
  */
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { kyaHome, resolveGateMode } from "../config.js";
 import { loadOrrCard, loadOrrCategoryRatings, loadSandboxes, loadShowbackCard, loadWiredHosts, } from "../receipt/enrich.js";
 import { readTrail, receiptsDir } from "../trail.js";
 import { loadAttestations } from "./attest.js";
+import { runOpenshellProver } from "./openshell-prover.js";
 /** Receipt artifacts (html/json/md) in .kya/receipts. */
 export function countReceipts(cwd) {
     try {
@@ -49,6 +52,7 @@ export function assembleEvidenceContext(cwd, env, now = new Date()) {
         orr: loadOrrCard(cwd),
         orrCategories: loadOrrCategoryRatings(cwd),
         sandboxCount: sandboxes.sandboxes.length,
+        openshellProver: runOpenshellProver(cwd, env),
         receiptCount: countReceipts(cwd),
         showbackPresent: loadShowbackCard(cwd) !== undefined,
         attestations: loadAttestations(cwd),

package/dist/certify/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/certify/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,GAAsB,EACtB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG;QACH,MAAM;QACN,qEAAqE;QACrE,uDAAuD;QACvD,QAAQ,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACvC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM;QACnE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC;QAC1C,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM;QACxC,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC;QAChC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,SAAS;QACpD,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/certify/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,GAAsB,EACtB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG;QACH,MAAM;QACN,qEAAqE;QACrE,uDAAuD;QACvD,QAAQ,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACvC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM;QACnE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC;QAC1C,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM;QACxC,eAAe,EAAE,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;QAC7C,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC;QAChC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,SAAS;QACpD,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC"}

package/dist/certify/evaluate.d.ts

@@ -7,6 +7,7 @@
 import type { OrrRating } from "../commands/orr.js";
 import type { OrrCard } from "../receipt/enrich.js";
 import type { TrailEvent } from "../trail.js";
+import type { OpenshellProverOutcome } from "./openshell-prover.js";
 import type { CatalogRequirement, RequirementSeverity, TrailMatch } from "./catalog.js";
 export type RequirementStatus = "pass" | "gap" | "insufficient_evidence" | "attested";
 export interface RequirementAttestation {
@@ -74,6 +75,13 @@ export interface EvidenceContext {
     /** Category id → rating from the latest ORR report, when present. */
     readonly orrCategories: Readonly<Record<string, OrrRating>> | undefined;
     readonly sandboxCount: number;
+    /**
+     * openshell-prover verdict over the sandbox boundary policy, assembled by
+     * certify/context.ts. Absent binary or unparseable output stays optional
+     * evidence: insufficient_evidence, never a fail on machines without
+     * OpenShell.
+     */
+    readonly openshellProver?: OpenshellProverOutcome;
     readonly receiptCount: number;
     readonly showbackPresent: boolean;
     readonly attestations: ReadonlyMap<string, RequirementAttestation>;

package/dist/certify/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/certify/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EACV,kBAAkB,EAElB,mBAAmB,EACnB,UAAU,EACX,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,GAAG,uBAAuB,GAAG,UAAU,CAAC;AAEtF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;KACjC,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,MAAM,QAAsB,CAAC;AAE1C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,SAAS,wBAAwB,EAAE,GAChD,oBAAoB,CAStB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,GAC3B,aAAa,CAAC,SAAS,CAAC,CAK1B;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,iBAAiB,CAa3E;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAQhE;AAcD,+DAA+D;AAC/D,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,UAAU,EAAE,CAMd;AAaD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,eAAe,GACnB,wBAAwB,CA0L1B"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/certify/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EACV,kBAAkB,EAElB,mBAAmB,EACnB,UAAU,EACX,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,GAAG,uBAAuB,GAAG,UAAU,CAAC;AAEtF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;KACjC,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,MAAM,QAAsB,CAAC;AAE1C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,SAAS,wBAAwB,EAAE,GAChD,oBAAoB,CAStB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,GAC3B,aAAa,CAAC,SAAS,CAAC,CAK1B;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,iBAAiB,CAa3E;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAQhE;AAcD,+DAA+D;AAC/D,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,UAAU,EAAE,CAMd;AAaD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,eAAe,GACnB,wBAAwB,CAoM1B"}

package/dist/certify/evaluate.js

@@ -166,6 +166,16 @@ export function evaluateRequirement(req, ctx) {
             }
             return result("gap", `no sandbox inventory - KYA_SANDBOX=mock kya sandbox spawn`);
         }
+        case "openshell_prover": {
+            const prover = ctx.openshellProver;
+            if (!prover || prover.status === "unavailable" || prover.status === "unparseable") {
+                return result("insufficient_evidence", prover?.detail ?? "openshell-prover not evaluated");
+            }
+            if (prover.status === "violation") {
+                return result("gap", prover.detail);
+            }
+            return result("pass", prover.detail);
+        }
         case "receipts_present": {
             if (ctx.receiptCount >= check.min) {
                 return result("pass", `${ctx.receiptCount} receipt file(s) in .kya/receipts`);

package/dist/certify/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/certify/evaluate.ts"],"names":[],"mappings":"AA4FA,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAS1C,MAAM,UAAU,iBAAiB,CAC/B,YAAiD;IAEjD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAClC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;;YAC/C,MAAM,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA4B;IAE5B,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA6B;IACtD,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,OAAO;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;aACjC,IAAI,CAAC,KAAK,MAAM;YAAE,UAAU,CAAC,IAAI,EAAE,CAAC;aACpC,IAAI,CAAC,KAAK,iBAAiB;YAAE,UAAU,CAAC,eAAe,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,EAAE,CAAC;;YACpC,KAAK,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,CAAa,EAAE,CAAa;IACpD,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC7F,OAAO,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CACzB,MAA6B,EAC7B,UAAkB,EAClB,GAAS;IAET,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,CAAa;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1D,CAAC;AAED,MAAM,WAAW,GAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAE9E,MAAM,UAAU,mBAAmB,CACjC,GAAuB,EACvB,GAAoB;IAEpB,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,QAAgB,EAA4B,EAAE,CAAC,CAAC;QACzF,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAqB,GAAG,CAAC,KAAK,CAAC;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,MAAM,CACX,MAAM,EACN,KAAK,MAAM,CAAC,MAAM,iBAAiB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,GAAG,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7B,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,CAAC,MAAM,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,aAAa,MAAM,GAAG,CAC5G,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9E,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,MAAM,CACX,MAAM,EACN,GAAG,OAAO,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,UAAU,KAAK,CAAC,GAAG,GAAG,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,WAAW,KAAK,CAAC,GAAG,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxE,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,wEAAwE;YACxE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,MAAM,CACX,MAAM,EACN,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,QAAQ,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,QAAQ,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,MAAM,CACX,KAAK,EACL,gBAAgB,GAAG,CAAC,QAAQ,qEAAqE,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,wBAAwB,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,GAAG,CAAC,cAAc,wBAAwB,KAAK,CAAC,GAAG,+BAA+B,CACtF,CAAC;QACJ,CAAC;QACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,oBAAoB,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,mCAAmC,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,eAAe;gBACxB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,gEAAgE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,WAAW;gBAAE,OAAO,MAAM,CAAC,UAAU,EAAE,YAAY,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CACX,KAAK,EACL,kDAAkD,GAAG,CAAC,EAAE,gBAAgB,KAAK,CAAC,MAAM,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3D,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CACX,uBAAuB,EACvB,gBAAgB,KAAK,CAAC,EAAE,+BAA+B,CACxD,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,EAAE,IAAI,MAAM,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;gBACd,OAAO,MAAM,CACX,uBAAuB,EACvB,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;YACxB,sEAAsE;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,OAAO,cAAc,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,UAAU,OAAO,cAAc,KAAK,CAAC,UAAU,yBAAyB,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,MAAM,UAAU,GAAU,KAAK,CAAC;IAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/certify/evaluate.ts"],"names":[],"mappings":"AAoGA,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAS1C,MAAM,UAAU,iBAAiB,CAC/B,YAAiD;IAEjD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAClC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;;YAC/C,MAAM,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA4B;IAE5B,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA6B;IACtD,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,OAAO;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;aACjC,IAAI,CAAC,KAAK,MAAM;YAAE,UAAU,CAAC,IAAI,EAAE,CAAC;aACpC,IAAI,CAAC,KAAK,iBAAiB;YAAE,UAAU,CAAC,eAAe,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,EAAE,CAAC;;YACpC,KAAK,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,CAAa,EAAE,CAAa;IACpD,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC7F,OAAO,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CACzB,MAA6B,EAC7B,UAAkB,EAClB,GAAS;IAET,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,CAAa;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1D,CAAC;AAED,MAAM,WAAW,GAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAE9E,MAAM,UAAU,mBAAmB,CACjC,GAAuB,EACvB,GAAoB;IAEpB,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,QAAgB,EAA4B,EAAE,CAAC,CAAC;QACzF,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAqB,GAAG,CAAC,KAAK,CAAC;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,MAAM,CACX,MAAM,EACN,KAAK,MAAM,CAAC,MAAM,iBAAiB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,GAAG,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7B,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,CAAC,MAAM,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,aAAa,MAAM,GAAG,CAC5G,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9E,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,MAAM,CACX,MAAM,EACN,GAAG,OAAO,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,UAAU,KAAK,CAAC,GAAG,GAAG,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,mBAAmB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,UAAU,WAAW,KAAK,CAAC,GAAG,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,uBAAuB,EACvB,+BAA+B,KAAK,CAAC,UAAU,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxE,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,wEAAwE;YACxE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,MAAM,CACX,MAAM,EACN,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,QAAQ,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,QAAQ,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,MAAM,CACX,KAAK,EACL,gBAAgB,GAAG,CAAC,QAAQ,qEAAqE,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,wBAAwB,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,GAAG,GAAG,CAAC,cAAc,wBAAwB,KAAK,CAAC,GAAG,+BAA+B,CACtF,CAAC;QACJ,CAAC;QACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,oBAAoB,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBAClF,OAAO,MAAM,CAAC,uBAAuB,EAAE,MAAM,EAAE,MAAM,IAAI,gCAAgC,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,mCAAmC,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,eAAe;gBACxB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,gEAAgE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,WAAW;gBAAE,OAAO,MAAM,CAAC,UAAU,EAAE,YAAY,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CACX,KAAK,EACL,kDAAkD,GAAG,CAAC,EAAE,gBAAgB,KAAK,CAAC,MAAM,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3D,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CACX,uBAAuB,EACvB,gBAAgB,KAAK,CAAC,EAAE,+BAA+B,CACxD,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,EAAE,IAAI,MAAM,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,uBAAuB,EAAE,sCAAsC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;gBACd,OAAO,MAAM,CACX,uBAAuB,EACvB,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;YACxB,sEAAsE;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,OAAO,cAAc,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CACX,KAAK,EACL,UAAU,OAAO,cAAc,KAAK,CAAC,UAAU,yBAAyB,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,MAAM,UAAU,GAAU,KAAK,CAAC;IAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/certify/openshell-prover.d.ts

@@ -0,0 +1,31 @@
+export type OpenshellProverStatus = "verified" | "violation" | "unavailable" | "unparseable";
+export interface OpenshellProverOutcome {
+    readonly status: OpenshellProverStatus;
+    /** One line, redacted, safe for reports and bundles. */
+    readonly detail: string;
+}
+/**
+ * Locate the prover binary: KYA_OPENSHELL_PROVER (absolute path, basename
+ * openshell-prover) wins, else PATH. Returns undefined when absent; the
+ * certify row is optional evidence, so absence is never an error here.
+ */
+export declare function resolveOpenshellProver(env: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Parse the prover verdict out of stdout/stderr + exit code. Only a clear
+ * violation report fails; only a clear verification with exit 0 passes;
+ * anything else is unparseable (insufficient_evidence), never a crash.
+ */
+export declare function parseOpenshellProverOutput(input: {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}): {
+    readonly status: "verified" | "violation" | "unparseable";
+    readonly detail: string;
+};
+/**
+ * Run the prover against the boundary policy. Never throws: every failure
+ * mode lands in the outcome and maps to insufficient_evidence.
+ */
+export declare function runOpenshellProver(cwd: string, env?: NodeJS.ProcessEnv): OpenshellProverOutcome;
+//# sourceMappingURL=openshell-prover.d.ts.map

package/dist/certify/openshell-prover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openshell-prover.d.ts","sourceRoot":"","sources":["../../src/certify/openshell-prover.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,qBAAqB,GAC7B,UAAU,GACV,WAAW,GACX,aAAa,GACb,aAAa,CAAC;AAElB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAkBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBjF;AA+BD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqBzF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,sBAAsB,CA8CxB"}

package/dist/certify/openshell-prover.js

@@ -0,0 +1,169 @@
+/**
+ * openshell-prover evidence for `kya certify` (NVIDIA OpenShell,
+ * github.com/NVIDIA/OpenShell). OpenShell ships `openshell-prover`, a
+ * standalone SMT-based formal-verification binary (release artifacts for
+ * linux amd64/arm64 and macOS arm64): deterministic, never LLM-as-judge.
+ * KYA runs it against the Phase 2 boundary policy and reports the verdict as
+ * optional certify evidence (SAFE-06).
+ *
+ * Defensive by contract: a missing binary or unparseable output yields
+ * "unavailable" / "unparseable" and therefore insufficient_evidence - never
+ * a crash, never a fabricated pass, and never a fail on machines without
+ * OpenShell. KYA never ships the binary; it is operator-supplied on PATH or
+ * via KYA_OPENSHELL_PROVER. Telemetry stays disabled on the spawned
+ * environment, same as the sandbox driver.
+ */
+import { execFileSync } from "node:child_process";
+import { accessSync, constants, existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { OPENSHELL_WORKDIR, openshellPolicyPath, renderOpenshellPolicy, } from "../sandbox/openshell-policy.js";
+import { loadSandboxState } from "../sandbox/runtime.js";
+/** Rendered-policy sandbox id when no live openshell sandbox exists. */
+const CERTIFY_SANDBOX_ID = "sbx-00000000-0000-0000-0000-000000000000";
+function proverEnv(env) {
+    return { ...env, OPENSHELL_TELEMETRY_ENABLED: "false" };
+}
+function executable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Locate the prover binary: KYA_OPENSHELL_PROVER (absolute path, basename
+ * openshell-prover) wins, else PATH. Returns undefined when absent; the
+ * certify row is optional evidence, so absence is never an error here.
+ */
+export function resolveOpenshellProver(env) {
+    const fromEnv = env.KYA_OPENSHELL_PROVER?.trim();
+    if (fromEnv) {
+        // Same contract as the sandbox drivers: absolute path, expected basename.
+        if (!fromEnv.startsWith("/") || basename(fromEnv) !== "openshell-prover")
+            return undefined;
+        if (!executable(fromEnv))
+            return undefined;
+        return fromEnv;
+    }
+    const path = env.PATH ?? "";
+    for (const dir of path.split(":")) {
+        if (!dir || dir === "." || dir.startsWith("."))
+            continue;
+        const candidate = join(dir, "openshell-prover");
+        if (!candidate.startsWith("/"))
+            continue;
+        if (executable(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * Policy to prove against: the on-disk policy of the newest running openshell
+ * sandbox when one exists (the live boundary), else a freshly rendered
+ * default-deny policy. `tempDir` is set only for the rendered fallback so
+ * the caller can clean it up.
+ */
+function resolvePolicyPath(cwd) {
+    try {
+        const rows = loadSandboxState(cwd);
+        const live = [...rows]
+            .reverse()
+            .find((r) => r.backend === "openshell" && r.status === "running");
+        if (live) {
+            const path = openshellPolicyPath(cwd, live.sandboxId);
+            if (existsSync(path))
+                return { path };
+        }
+        const tempDir = mkdtempSync(join(tmpdir(), "kya-openshell-prover-"));
+        const path = join(tempDir, "policy.yaml");
+        writeFileSync(path, renderOpenshellPolicy({ sandboxId: CERTIFY_SANDBOX_ID, workdir: OPENSHELL_WORKDIR }), "utf8");
+        return { path, tempDir };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse the prover verdict out of stdout/stderr + exit code. Only a clear
+ * violation report fails; only a clear verification with exit 0 passes;
+ * anything else is unparseable (insufficient_evidence), never a crash.
+ */
+export function parseOpenshellProverOutput(input) {
+    const text = `${input.stdout}\n${input.stderr}`.toLowerCase();
+    // Strip negations before scanning for violation markers ("no violations"
+    // would otherwise match the plain "violation" pattern).
+    const withoutNegations = text.replace(/no violations?/g, " ");
+    if (/violation|counterexample|falsified/.test(withoutNegations)) {
+        return {
+            status: "violation",
+            detail: "openshell-prover reported a boundary violation",
+        };
+    }
+    if (input.exitCode === 0 && /verified|no violations|holds/.test(text)) {
+        return {
+            status: "verified",
+            detail: "openshell-prover verified the policy grants no more than the boundary",
+        };
+    }
+    return {
+        status: "unparseable",
+        detail: `openshell-prover output unparseable (exit ${input.exitCode})`,
+    };
+}
+/**
+ * Run the prover against the boundary policy. Never throws: every failure
+ * mode lands in the outcome and maps to insufficient_evidence.
+ */
+export function runOpenshellProver(cwd, env = process.env) {
+    const bin = resolveOpenshellProver(env);
+    if (!bin) {
+        return {
+            status: "unavailable",
+            detail: "openshell-prover not found - install OpenShell (https://github.com/NVIDIA/OpenShell) or set KYA_OPENSHELL_PROVER",
+        };
+    }
+    const policy = resolvePolicyPath(cwd);
+    if (!policy) {
+        return { status: "unavailable", detail: "openshell boundary policy could not be resolved" };
+    }
+    let exitCode = 0;
+    let stdout = "";
+    let stderr = "";
+    try {
+        stdout = execFileSync(bin, ["verify", "--policy", policy.path], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            env: proverEnv(env),
+            timeout: 30_000,
+        });
+    }
+    catch (err) {
+        const e = err;
+        if (typeof e.status !== "number") {
+            return {
+                status: "unavailable",
+                detail: `openshell-prover could not run: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        exitCode = e.status;
+        stdout = typeof e.stdout === "string" ? e.stdout : "";
+        stderr = typeof e.stderr === "string" ? e.stderr : "";
+    }
+    finally {
+        // The temp dir only exists for the rendered-policy fallback; removing a
+        // missing path is a no-op.
+        if (policy.tempDir) {
+            try {
+                rmSync(policy.tempDir, { recursive: true, force: true });
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+        }
+    }
+    return parseOpenshellProverOutput({ exitCode, stdout, stderr });
+}
+//# sourceMappingURL=openshell-prover.js.map