@tangle-network/traces 0.9.7 → 0.9.9

package/README.md

@@ -81,6 +81,7 @@ The deterministic pass (free, no key) surfaces:
 |---|---|---|
 | `claude-code` (`claude`, `claudish`, `openclaw`, `nanoclaw`) | `~/.claude/projects/<cwd>/*.jsonl` (+ subagent sidechains) | verified |
 | `codex` (`codex-acp`) | `~/.codex/sessions/**/rollout-*.jsonl` | verified |
+| `codex-exec` (`codex-json`) | explicit `codex exec --json` JSONL file | fixture |
 | `opencode` | `~/.local/share/opencode/storage/` | verified |
 | `gemini` (`gemini-cli`) | `~/.gemini/tmp/<hash>/chats/session-*.json` | verified |
 | `pi` | `~/.pi/agent/sessions/<cwd>/*.jsonl` | verified |
@@ -105,6 +106,7 @@ traces convert  --harness claude-code --last 1 --otlp spans.jsonl   # OTLP only
 traces index    --all --since 24h --out session-index.json
 traces inspect  session-index.json --out inspection-report.md
 traces evidence --harness codex --last 20 --out policy-evidence.jsonl
+traces evidence --harness codex-exec --session /tmp/codex.jsonl --cwd "$PWD" --out policy-evidence.jsonl
 traces export   policy-evidence.jsonl --out spans.openinference.jsonl
 traces watch    --all                              # live observer; loops + semantic findings
 traces stream   --all --mode findings              # low-volume semantic feed
@@ -249,10 +251,13 @@ traces evidence --all --since 24h --out policy-evidence.jsonl --otlp spans.otlp.
 
 `--last` follows recent file activity and is useful for live inspection.
 For a reproducible report, run `traces list` first and pass its session ID with `--session`.
+Ephemeral `codex exec --json` output has no discovery location, so select its file with `--harness codex-exec --session <path>`.
+The adapter rejects empty, incomplete, or other JSONL formats instead of emitting zero-valued session evidence.
 
 Each JSONL row is one session:
 
 - session provenance: harness, session id, cwd, path, mtime
+- explicit-session source binding: `provenance.sourceSha256` over the exact stable input bytes
 - repo labels: `tangle.subject.key`, `git.repository`, branch, commit
 - behavior metrics: span counts, LLM turns, tool calls, errored tool calls, tokens, models, tool histogram
 - mining signals: stuck loops and tool error rate

package/dist/{chunk-NHXPTFKC.js → chunk-ELWOJS65.js}

@@ -1439,8 +1439,8 @@ function explicitOutputError(value) {
   const outputStart = text.indexOf("\nOutput:\n");
   const header = outputStart >= 0 ? text.slice(0, outputStart) : text;
   if (/^Chunk ID:/i.test(header)) {
-    const exitCode = header.match(/^Process exited with code\s+(-?\d+)\b/im)?.[1];
-    if (exitCode !== void 0) return Number(exitCode) !== 0;
+    const exitCode2 = header.match(/^Process exited with code\s+(-?\d+)\b/im)?.[1];
+    if (exitCode2 !== void 0) return Number(exitCode2) !== 0;
   }
   if (/^Script completed\s*\nWall time:/i.test(header)) return false;
   if (/^Script failed\s*\nWall time:/i.test(header)) return true;
@@ -1716,7 +1716,7 @@ var CodexAdapter = class {
       } else if (l.type === "event_msg" && l.payload?.type === "sub_agent_activity") {
         const threadId = l.payload.agent_thread_id;
         const occurredAtMs = l.payload.occurred_at_ms;
-        const eventTime = typeof occurredAtMs === "number" && Number.isFinite(occurredAtMs) ? new Date(occurredAtMs).toISOString() : ts;
+        const eventTime2 = typeof occurredAtMs === "number" && Number.isFinite(occurredAtMs) ? new Date(occurredAtMs).toISOString() : ts;
         if (l.payload.kind === "started" && threadId && !subagentByThreadId.has(threadId)) {
           const agentPath = l.payload.agent_path ?? "subagent";
           const subagentType = agentPath.split("/").filter(Boolean).at(-1) ?? "subagent";
@@ -1726,7 +1726,7 @@ var CodexAdapter = class {
             parentSpanId: lastLlm,
             name: "tool.Agent",
             kind: "TOOL",
-            startTime: eventTime,
+            startTime: eventTime2,
             service: SERVICE3,
             agent: SERVICE3,
             tool: "Agent",
@@ -1749,13 +1749,13 @@ var CodexAdapter = class {
         } else if (l.payload.kind === "completed" && threadId) {
           const toolSpan = subagentByThreadId.get(threadId);
           if (toolSpan) {
-            toolSpan.end_time = eventTime;
+            toolSpan.end_time = eventTime2;
             toolSpan.status = { code: "OK" };
           }
         } else if (["interrupted", "failed", "timed_out"].includes(l.payload.kind ?? "") && threadId) {
           const toolSpan = subagentByThreadId.get(threadId);
           if (toolSpan) {
-            toolSpan.end_time = eventTime;
+            toolSpan.end_time = eventTime2;
             toolSpan.status = { code: "ERROR", message: `subagent ${l.payload.kind}` };
           }
         }
@@ -1805,11 +1805,449 @@ var CodexAdapter = class {
   }
 };
 
+// src/adapters/codex-exec.ts
+var SERVICE4 = "codex-exec";
+var SUPPORTED_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "thread.started",
+  "turn.started",
+  "item.started",
+  "item.completed",
+  "turn.completed",
+  "turn.failed",
+  "error"
+]);
+var CodexExecStreamError = class extends Error {
+  sourcePath;
+  constructor(sourcePath, message) {
+    super(`Invalid Codex exec event stream at ${sourcePath}: ${message}`);
+    this.name = "CodexExecStreamError";
+    this.sourcePath = sourcePath;
+  }
+};
+function objectValue(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function isoTime(value) {
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed)) return new Date(parsed).toISOString();
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    const milliseconds = value < 1e10 ? value * 1e3 : value;
+    return new Date(milliseconds).toISOString();
+  }
+  return void 0;
+}
+function eventTime(event, fallback) {
+  for (const key of [
+    "timestamp",
+    "created_at",
+    "started_at",
+    "completed_at",
+    "timestamp_ms",
+    "started_at_ms",
+    "completed_at_ms"
+  ]) {
+    const time = isoTime(event[key]);
+    if (time) return { time, source: "event" };
+  }
+  return { time: fallback, source: "file_mtime" };
+}
+function earlier(left, right) {
+  return Date.parse(left) <= Date.parse(right) ? left : right;
+}
+function later(left, right) {
+  return Date.parse(left) >= Date.parse(right) ? left : right;
+}
+function requireObject(value, sourcePath, label) {
+  const object = objectValue(value);
+  if (!object) throw new CodexExecStreamError(sourcePath, `${label} must be an object`);
+  return object;
+}
+function requireString(value, sourcePath, label) {
+  const string = stringValue(value);
+  if (!string) throw new CodexExecStreamError(sourcePath, `${label} must be a non-empty string`);
+  return string;
+}
+function optionalTokenCount(usage, key, sourcePath) {
+  const value = usage?.[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new CodexExecStreamError(sourcePath, `usage.${key} must be a non-negative integer`);
+  }
+  return value;
+}
+function exitCode(item, sourcePath) {
+  const value = item.exit_code;
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    throw new CodexExecStreamError(sourcePath, "command_execution.exit_code must be an integer or null");
+  }
+  return value;
+}
+function fileChanges(item, sourcePath) {
+  if (!Array.isArray(item.changes) || item.changes.length === 0) {
+    throw new CodexExecStreamError(sourcePath, "file_change.changes must be a non-empty array");
+  }
+  return item.changes.map((raw, index) => {
+    const change = requireObject(raw, sourcePath, `file_change.changes[${index}]`);
+    return {
+      path: requireString(change.path, sourcePath, `file_change.changes[${index}].path`),
+      kind: requireString(change.kind, sourcePath, `file_change.changes[${index}].kind`)
+    };
+  });
+}
+function toolInput(itemType2, item, sourcePath) {
+  if (itemType2 === "command_execution") {
+    const command = requireString(item.command, sourcePath, "command_execution.command");
+    const cwd = stringValue(item.cwd);
+    return { cmd: command, ...cwd ? { cwd } : {} };
+  }
+  return { changes: fileChanges(item, sourcePath) };
+}
+function completedStatus(itemType2, item, sourcePath) {
+  const status = requireString(item.status, sourcePath, `${itemType2}.status`);
+  if (status !== "completed" && status !== "failed") {
+    throw new CodexExecStreamError(
+      sourcePath,
+      `${itemType2}.status on item.completed must be "completed" or "failed"`
+    );
+  }
+  const code = itemType2 === "command_execution" ? exitCode(item, sourcePath) : void 0;
+  const failed = status === "failed" || code !== void 0 && code !== 0;
+  return {
+    code: failed ? "ERROR" : "OK",
+    ...failed ? { message: code === void 0 ? `${itemType2} failed` : `command exited ${code}` } : {},
+    ...code === void 0 ? {} : { exitCode: code }
+  };
+}
+function itemType(item) {
+  return stringValue(item.type);
+}
+function toolItemType(item) {
+  const type = itemType(item);
+  return type === "command_execution" || type === "file_change" ? type : void 0;
+}
+function toolName(type) {
+  return type === "command_execution" ? "exec_command" : "apply_patch";
+}
+var CodexExecAdapter = class {
+  harness = SERVICE4;
+  aliases = ["codex-json"];
+  async locate(_opts = {}) {
+    return [];
+  }
+  async parse(ref, options = {}) {
+    const fallbackTime = Number.isFinite(ref.mtimeMs) && ref.mtimeMs >= 0 ? new Date(ref.mtimeMs).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString();
+    const spans = [];
+    let root;
+    let threadId;
+    let activeTurn;
+    let turnIndex = 0;
+    let step = 0;
+    let recognizedEventCount = 0;
+    let ignoredEventCount = 0;
+    let ignoredItemCount = 0;
+    let eventTimestampCount = 0;
+    let terminalCount = 0;
+    let fatalError = false;
+    const fail = (message) => {
+      throw new CodexExecStreamError(ref.path, message);
+    };
+    const touchRoot = (timed) => {
+      if (!root) return;
+      root.start_time = earlier(root.start_time, timed.time);
+      root.end_time = later(root.end_time, timed.time);
+      if (timed.source === "event") eventTimestampCount += 1;
+    };
+    const requireRoot = (type) => {
+      const current = root;
+      if (!current) throw new CodexExecStreamError(ref.path, `${type} appeared before thread.started`);
+      return current;
+    };
+    const requireTurn = (type) => {
+      requireRoot(type);
+      const current = activeTurn;
+      if (!current) throw new CodexExecStreamError(ref.path, `${type} appeared without an active turn.started`);
+      return current;
+    };
+    const createTool = (turn, item, type, time, lifecycle) => {
+      const id = requireString(item.id, ref.path, `${type}.id`);
+      const name = toolName(type);
+      const input = toolInput(type, item, ref.path);
+      const cwd = stringValue(item.cwd);
+      if (!ref.cwd && cwd) ref.cwd = cwd;
+      const toolSpan = span({
+        traceId: threadId,
+        spanId: `tool:${turn.index}:${id}`,
+        parentSpanId: turn.spanId,
+        name: `tool.${name}`,
+        kind: "TOOL",
+        startTime: time,
+        status: "UNSET",
+        service: SERVICE4,
+        agent: SERVICE4,
+        tool: name,
+        step: step++,
+        extra: {
+          ...toolIoAttributes({ input, argsCaptured: true }),
+          "traces.codex.exec_item_id": id,
+          "traces.codex.exec_item_type": type,
+          "traces.codex.exec_lifecycle": lifecycle
+        }
+      });
+      spans.push(toolSpan);
+      return { itemType: type, span: toolSpan };
+    };
+    const completeTool = (turn, item, time) => {
+      const type = toolItemType(item);
+      if (!type) throw new CodexExecStreamError(ref.path, "item.completed tool item has an unsupported type");
+      const id = requireString(item.id, ref.path, `${type}.id`);
+      if (turn.completedItemIds.has(id)) fail(`item ${id} completed more than once`);
+      const existing = turn.pendingTools.get(id);
+      if (existing && existing.itemType !== type) {
+        fail(`item ${id} changed type from ${existing.itemType} to ${type}`);
+      }
+      const pending = existing ?? createTool(turn, item, type, time, "completed_only");
+      const result = completedStatus(type, item, ref.path);
+      pending.span.end_time = later(pending.span.start_time, time);
+      pending.span.status = {
+        code: result.code,
+        ...result.message ? { message: result.message } : {}
+      };
+      pending.span.attributes["traces.codex.exec_item_status"] = item.status;
+      if (result.exitCode !== void 0) {
+        pending.span.attributes["traces.codex.exec_exit_code"] = result.exitCode;
+      }
+      if (type === "command_execution") {
+        recordToolOutput(pending.span, typeof item.aggregated_output === "string" ? item.aggregated_output : void 0);
+      }
+      turn.pendingTools.delete(id);
+      turn.completedItemIds.add(id);
+    };
+    const closeTurn = (code, time, usage, message) => {
+      const turn = requireTurn(code === "OK" ? "turn.completed" : "turn.failed");
+      if (code === "OK" && turn.pendingTools.size > 0) {
+        fail(`turn.completed left ${turn.pendingTools.size} item(s) without item.completed`);
+      }
+      if (code === "ERROR") {
+        for (const pending of turn.pendingTools.values()) {
+          pending.span.end_time = later(pending.span.start_time, time);
+          pending.span.status = { code: "ERROR", message: message ?? "turn failed before item completion" };
+          pending.span.attributes["traces.codex.exec_item_status"] = "interrupted";
+        }
+        turn.pendingTools.clear();
+      }
+      spans.push(span({
+        traceId: threadId,
+        spanId: turn.spanId,
+        parentSpanId: root.span_id,
+        name: "llm.turn",
+        kind: "LLM",
+        startTime: turn.startTime,
+        endTime: later(turn.startTime, time),
+        status: code,
+        statusMessage: message,
+        service: SERVICE4,
+        agent: SERVICE4,
+        inputTokens: optionalTokenCount(usage, "input_tokens", ref.path),
+        cachedInputTokens: optionalTokenCount(usage, "cached_input_tokens", ref.path) ?? optionalTokenCount(usage, "cache_read_input_tokens", ref.path),
+        outputTokens: optionalTokenCount(usage, "output_tokens", ref.path),
+        reasoningTokens: optionalTokenCount(usage, "reasoning_output_tokens", ref.path),
+        step: turn.step
+      }));
+      activeTurn = void 0;
+      terminalCount += 1;
+      if (code === "ERROR") fatalError = true;
+    };
+    for await (const raw of readJsonl(ref.path, sessionJsonlOptions(ref, options))) {
+      const event = objectValue(raw);
+      const type = event ? stringValue(event.type) : void 0;
+      if (!event || !type || !SUPPORTED_EVENT_TYPES.has(type)) {
+        ignoredEventCount += 1;
+        continue;
+      }
+      recognizedEventCount += 1;
+      const timed = eventTime(event, fallbackTime);
+      if (type === "thread.started") {
+        if (root) fail("thread.started appeared more than once");
+        threadId = requireString(event.thread_id, ref.path, "thread.started.thread_id");
+        ref.sessionId = threadId;
+        root = span({
+          traceId: threadId,
+          spanId: `root:${threadId}`,
+          parentSpanId: null,
+          name: "session",
+          kind: "AGENT",
+          startTime: timed.time,
+          status: "UNSET",
+          service: SERVICE4,
+          agent: SERVICE4,
+          extra: {
+            "traces.codex.stream_format": "exec-jsonl",
+            "traces.session.role": "operator"
+          }
+        });
+        spans.push(root);
+        touchRoot(timed);
+        continue;
+      }
+      touchRoot(timed);
+      requireRoot(type);
+      if (type === "turn.started") {
+        if (activeTurn) fail("turn.started appeared before the prior turn reached a terminal event");
+        activeTurn = {
+          index: turnIndex,
+          spanId: `llm:${turnIndex}`,
+          startTime: timed.time,
+          step: step++,
+          pendingTools: /* @__PURE__ */ new Map(),
+          completedItemIds: /* @__PURE__ */ new Set()
+        };
+        turnIndex += 1;
+        continue;
+      }
+      if (type === "item.started") {
+        const turn = requireTurn(type);
+        const item = requireObject(event.item, ref.path, "item.started.item");
+        const toolType = toolItemType(item);
+        if (!toolType) {
+          ignoredItemCount += 1;
+          continue;
+        }
+        const id = requireString(item.id, ref.path, `${toolType}.id`);
+        if (turn.pendingTools.has(id) || turn.completedItemIds.has(id)) {
+          fail(`item ${id} started more than once`);
+        }
+        const status = stringValue(item.status);
+        if (status !== void 0 && status !== "in_progress") {
+          fail(`${toolType}.status on item.started must be "in_progress" when present`);
+        }
+        turn.pendingTools.set(id, createTool(turn, item, toolType, timed.time, "paired"));
+        continue;
+      }
+      if (type === "item.completed") {
+        const turn = requireTurn(type);
+        const item = requireObject(event.item, ref.path, "item.completed.item");
+        const completedType = itemType(item);
+        if (completedType === "command_execution" || completedType === "file_change") {
+          completeTool(turn, item, timed.time);
+        } else if (completedType === "agent_message") {
+          const id = requireString(item.id, ref.path, "agent_message.id");
+          if (turn.completedItemIds.has(id)) fail(`item ${id} completed more than once`);
+          const text = typeof item.text === "string" ? capText(item.text) : "";
+          if (text) {
+            spans.push(span({
+              traceId: threadId,
+              spanId: `message:${turn.index}:${id}`,
+              parentSpanId: turn.spanId,
+              name: "message.assistant",
+              kind: "CHAIN",
+              startTime: timed.time,
+              service: SERVICE4,
+              agent: SERVICE4,
+              step: step++,
+              content: text,
+              extra: {
+                "traces.codex.exec_item_id": id,
+                "traces.codex.exec_item_type": completedType
+              }
+            }));
+          }
+          turn.completedItemIds.add(id);
+        } else if (completedType === "error") {
+          const id = requireString(item.id, ref.path, "error.id");
+          if (turn.completedItemIds.has(id)) fail(`item ${id} completed more than once`);
+          const message2 = requireString(item.message, ref.path, "error.message");
+          spans.push(span({
+            traceId: threadId,
+            spanId: `error:${turn.index}:${id}`,
+            parentSpanId: turn.spanId,
+            name: "error.codex_item",
+            kind: "CHAIN",
+            startTime: timed.time,
+            status: "ERROR",
+            statusMessage: message2,
+            service: SERVICE4,
+            agent: SERVICE4,
+            step: step++,
+            content: capText(message2),
+            extra: {
+              "traces.codex.exec_item_id": id,
+              "traces.codex.exec_item_type": completedType
+            }
+          }));
+          turn.completedItemIds.add(id);
+        } else {
+          ignoredItemCount += 1;
+        }
+        continue;
+      }
+      if (type === "turn.completed") {
+        const usage = event.usage === void 0 ? void 0 : requireObject(event.usage, ref.path, "turn.completed.usage");
+        closeTurn("OK", timed.time, usage);
+        continue;
+      }
+      if (type === "turn.failed") {
+        const error = requireObject(event.error, ref.path, "turn.failed.error");
+        const message2 = requireString(error.message, ref.path, "turn.failed.error.message");
+        closeTurn("ERROR", timed.time, void 0, message2);
+        continue;
+      }
+      const message = requireString(event.message, ref.path, "error.message");
+      spans.push(span({
+        traceId: threadId,
+        spanId: `error:stream:${step}`,
+        parentSpanId: activeTurn?.spanId ?? root.span_id,
+        name: "error.codex_stream",
+        kind: "CHAIN",
+        startTime: timed.time,
+        status: "ERROR",
+        statusMessage: message,
+        service: SERVICE4,
+        agent: SERVICE4,
+        step: step++,
+        content: capText(message)
+      }));
+      if (activeTurn) closeTurn("ERROR", timed.time, void 0, message);
+      else {
+        fatalError = true;
+        terminalCount += 1;
+      }
+    }
+    if (recognizedEventCount === 0) {
+      throw new CodexExecStreamError(
+        ref.path,
+        "no supported events found; expected codex exec --json output beginning with thread.started"
+      );
+    }
+    if (!root || !threadId) {
+      throw new CodexExecStreamError(ref.path, "thread.started was not found");
+    }
+    if (activeTurn) {
+      throw new CodexExecStreamError(ref.path, "stream ended before turn.completed, turn.failed, or error");
+    }
+    if (terminalCount === 0) {
+      throw new CodexExecStreamError(ref.path, "stream has no terminal turn.completed, turn.failed, or error event");
+    }
+    root.status = fatalError ? { code: "ERROR", message: "Codex exec stream failed" } : { code: "OK" };
+    root.attributes["traces.codex.exec_event_count"] = recognizedEventCount;
+    root.attributes["traces.codex.exec_ignored_event_count"] = ignoredEventCount;
+    root.attributes["traces.codex.exec_ignored_item_count"] = ignoredItemCount;
+    root.attributes["traces.codex.exec_event_timestamp_count"] = eventTimestampCount;
+    root.attributes["traces.codex.exec_time_source"] = eventTimestampCount === 0 ? "file_mtime" : eventTimestampCount === recognizedEventCount ? "event" : "mixed";
+    return spans;
+  }
+};
+
 // src/adapters/copilot.ts
 import { readdir as readdir5, stat as stat4 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
-var SERVICE4 = "github-copilot";
+var SERVICE5 = "github-copilot";
 var CopilotAdapter = class {
   harness = "github-copilot";
   aliases = ["copilot"];
@@ -1874,8 +2312,8 @@ var CopilotAdapter = class {
             name: "message.assistant",
             kind: "LLM",
             startTime: ts,
-            service: SERVICE4,
-            agent: SERVICE4,
+            service: SERVICE5,
+            agent: SERVICE5,
             model: d.model ?? null,
             inputTokens: pendingInputTokens,
             outputTokens: d.outputTokens ?? null,
@@ -1895,8 +2333,8 @@ var CopilotAdapter = class {
           name: `tool.${name}`,
           kind: "TOOL",
           startTime: ts,
-          service: SERVICE4,
-          agent: SERVICE4,
+          service: SERVICE5,
+          agent: SERVICE5,
           tool: name,
           step,
           extra: toolIoAttributes({ input: d.arguments })
@@ -1922,8 +2360,8 @@ var CopilotAdapter = class {
       kind: "AGENT",
       startTime: firstTimestamp ?? (/* @__PURE__ */ new Date(0)).toISOString(),
       endTime: lastTimestamp,
-      service: SERVICE4,
-      agent: SERVICE4
+      service: SERVICE5,
+      agent: SERVICE5
     });
     return [root, ...spans];
   }
@@ -1933,7 +2371,7 @@ var CopilotAdapter = class {
 import { readdir as readdir6, stat as stat5 } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { basename as basename4, join as join5 } from "path";
-var SERVICE5 = "factory";
+var SERVICE6 = "factory";
 function textOf4(content) {
   return capText(
     (content ?? []).filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("")
@@ -2021,8 +2459,8 @@ var FactoryAdapter = class {
               parentSpanId: sourceRootId,
               startTime: ts,
               content: text,
-              service: SERVICE5,
-              agent: SERVICE5,
+              service: SERVICE6,
+              agent: SERVICE6,
               step
             })
           );
@@ -2038,8 +2476,8 @@ var FactoryAdapter = class {
             name: `message.${role ?? "unknown"}`,
             kind: "LLM",
             startTime: ts,
-            service: SERVICE5,
-            agent: SERVICE5,
+            service: SERVICE6,
+            agent: SERVICE6,
             model: settings.model ?? null,
             step,
             content: text || null
@@ -2057,8 +2495,8 @@ var FactoryAdapter = class {
             name: `tool.${b.name}`,
             kind: "TOOL",
             startTime: ts,
-            service: SERVICE5,
-            agent: SERVICE5,
+            service: SERVICE6,
+            agent: SERVICE6,
             tool: b.name,
             step,
             extra: toolIoAttributes({ input: b.input })
@@ -2089,8 +2527,8 @@ var FactoryAdapter = class {
       kind: "AGENT",
       startTime: sessionLine?.timestamp ?? firstTimestamp ?? (/* @__PURE__ */ new Date(0)).toISOString(),
       endTime: lastTimestamp,
-      service: SERVICE5,
-      agent: SERVICE5,
+      service: SERVICE6,
+      agent: SERVICE6,
       model: settings.model ?? null,
       extra: settings.tokenUsage ? {
         "session.input_tokens": settings.tokenUsage.inputTokens ?? 0,
@@ -2105,7 +2543,7 @@ var FactoryAdapter = class {
 import { readdir as readdir7, stat as stat6 } from "fs/promises";
 import { homedir as homedir6 } from "os";
 import { basename as basename5, join as join6 } from "path";
-var SERVICE6 = "forge";
+var SERVICE7 = "forge";
 function tokens(t) {
   if (!t) return null;
   return t.actual ?? t.approx ?? null;
@@ -2154,7 +2592,7 @@ var ForgeAdapter = class {
     const rootId = `root:${traceId}`;
     const messages = ctx.messages ?? [];
     const spans = [
-      span({ traceId, spanId: rootId, parentSpanId: null, name: "session", kind: "AGENT", startTime: (/* @__PURE__ */ new Date(0)).toISOString(), service: SERVICE6, agent: SERVICE6 })
+      span({ traceId, spanId: rootId, parentSpanId: null, name: "session", kind: "AGENT", startTime: (/* @__PURE__ */ new Date(0)).toISOString(), service: SERVICE7, agent: SERVICE7 })
     ];
     const toolByCallId = /* @__PURE__ */ new Map();
     let step = 0;
@@ -2172,8 +2610,8 @@ var ForgeAdapter = class {
               parentSpanId: rootId,
               startTime: ts,
               content: prompt,
-              service: SERVICE6,
-              agent: SERVICE6,
+              service: SERVICE7,
+              agent: SERVICE7,
               step
             })
           );
@@ -2189,8 +2627,8 @@ var ForgeAdapter = class {
             name: `message.${entry.text.role ?? "unknown"}`,
             kind: "LLM",
             startTime: ts,
-            service: SERVICE6,
-            agent: SERVICE6,
+            service: SERVICE7,
+            agent: SERVICE7,
             model: entry.text.model ?? null,
             inputTokens: tokens(raw.usage?.prompt_tokens),
             outputTokens: tokens(raw.usage?.completion_tokens),
@@ -2209,8 +2647,8 @@ var ForgeAdapter = class {
             name: `tool.${tc.name ?? "tool"}`,
             kind: "TOOL",
             startTime: ts,
-            service: SERVICE6,
-            agent: SERVICE6,
+            service: SERVICE7,
+            agent: SERVICE7,
             tool: tc.name ?? "tool",
             step,
             extra: toolIoAttributes({ input: tc.arguments })
@@ -2410,7 +2848,7 @@ var GeminiAdapter = class extends GeminiFamilyAdapter {
 import { readdir as readdir9, stat as stat8 } from "fs/promises";
 import { homedir as homedir8 } from "os";
 import { join as join8 } from "path";
-var SERVICE7 = "opencode";
+var SERVICE8 = "opencode";
 function isoOf(ms) {
   return new Date(ms ?? 0).toISOString();
 }
@@ -2470,8 +2908,8 @@ var OpencodeAdapter = class {
         kind: "AGENT",
         startTime: isoOf(messages[0]?.time?.created),
         endTime: isoOf(messages.at(-1)?.time?.completed ?? messages.at(-1)?.time?.created),
-        service: SERVICE7,
-        agent: SERVICE7
+        service: SERVICE8,
+        agent: SERVICE8
       })
     ];
     let step = 0;
@@ -2499,8 +2937,8 @@ var OpencodeAdapter = class {
               spanId: `${llmId}:user`,
               parentSpanId: rootId,
               startTime: isoOf(msg.time?.created),
-              service: SERVICE7,
-              agent: SERVICE7,
+              service: SERVICE8,
+              agent: SERVICE8,
               step,
               content: turnText
             })
@@ -2517,8 +2955,8 @@ var OpencodeAdapter = class {
             kind: "LLM",
             startTime: isoOf(msg.time?.created),
             endTime: isoOf(msg.time?.completed ?? msg.time?.created),
-            service: SERVICE7,
-            agent: SERVICE7,
+            service: SERVICE8,
+            agent: SERVICE8,
             model: msg.modelID ?? null,
             inputTokens: msg.tokens?.input ?? null,
             outputTokens: msg.tokens?.output ?? null,
@@ -2545,8 +2983,8 @@ var OpencodeAdapter = class {
             endTime: isoOf(msg.time?.completed ?? msg.time?.created),
             status: err ? "ERROR" : "OK",
             statusMessage: err ? (part.state?.error ?? "").slice(0, 500) : void 0,
-            service: SERVICE7,
-            agent: SERVICE7,
+            service: SERVICE8,
+            agent: SERVICE8,
             tool: part.tool,
             step,
             extra: toolIoAttributes({
@@ -2566,7 +3004,7 @@ var OpencodeAdapter = class {
 import { readdir as readdir10, stat as stat9 } from "fs/promises";
 import { homedir as homedir9 } from "os";
 import { basename as basename6, join as join9 } from "path";
-var SERVICE8 = "pi";
+var SERVICE9 = "pi";
 function isToolBlock(b) {
   return typeof b.type === "string" && /tool[_-]?call|tool[_-]?use|^tool$/i.test(b.type);
 }
@@ -2655,8 +3093,8 @@ var PiAdapter = class {
               spanId: `${mid}:user`,
               parentSpanId: sourceRootId,
               startTime: ts,
-              service: SERVICE8,
-              agent: SERVICE8,
+              service: SERVICE9,
+              agent: SERVICE9,
               step,
               content: prompt
             })
@@ -2675,8 +3113,8 @@ var PiAdapter = class {
             startTime: ts,
             status: errored ? "ERROR" : "OK",
             statusMessage: errored ? msg.errorMessage.slice(0, 500) : void 0,
-            service: SERVICE8,
-            agent: SERVICE8,
+            service: SERVICE9,
+            agent: SERVICE9,
             model: msg.model ?? null,
             inputTokens: msg.usage?.input ?? null,
             outputTokens: msg.usage?.output ?? null,
@@ -2697,8 +3135,8 @@ var PiAdapter = class {
             name: `tool.${name}`,
             kind: "TOOL",
             startTime: ts,
-            service: SERVICE8,
-            agent: SERVICE8,
+            service: SERVICE9,
+            agent: SERVICE9,
             tool: name,
             step,
             extra: toolIoAttributes({ input: b.input ?? b.args })
@@ -2732,8 +3170,8 @@ var PiAdapter = class {
       kind: "AGENT",
       startTime: sessionLine?.timestamp ?? firstTimestamp ?? (/* @__PURE__ */ new Date(0)).toISOString(),
       endTime: lastTimestamp,
-      service: SERVICE8,
-      agent: SERVICE8
+      service: SERVICE9,
+      agent: SERVICE9
     });
     return [root, ...spans];
   }
@@ -2743,7 +3181,7 @@ var PiAdapter = class {
 import { readdir as readdir11, stat as stat10 } from "fs/promises";
 import { homedir as homedir10 } from "os";
 import { basename as basename7, join as join10 } from "path";
-var SERVICE9 = "qwen";
+var SERVICE10 = "qwen";
 function textOf9(parts) {
   if (!parts) return "";
   return parts.filter((p) => typeof p.text === "string").map((p) => p.text).join("");
@@ -2819,8 +3257,8 @@ var QwenAdapter = class {
             name: "llm.turn",
             kind: "LLM",
             startTime: ts,
-            service: SERVICE9,
-            agent: SERVICE9,
+            service: SERVICE10,
+            agent: SERVICE10,
             model: r.model ?? null,
             inputTokens: r.usageMetadata?.promptTokenCount ?? null,
             outputTokens: r.usageMetadata?.candidatesTokenCount ?? null,
@@ -2839,8 +3277,8 @@ var QwenAdapter = class {
             name: `tool.${name}`,
             kind: "TOOL",
             startTime: ts,
-            service: SERVICE9,
-            agent: SERVICE9,
+            service: SERVICE10,
+            agent: SERVICE10,
             tool: name,
             step,
             extra: toolIoAttributes({ input: p.functionCall.args })
@@ -2860,8 +3298,8 @@ var QwenAdapter = class {
               spanId: `user:${r.uuid ?? step}`,
               parentSpanId: sourceRootId,
               startTime: ts,
-              service: SERVICE9,
-              agent: SERVICE9,
+              service: SERVICE10,
+              agent: SERVICE10,
               step,
               content: prompt
             })
@@ -2896,8 +3334,8 @@ var QwenAdapter = class {
       kind: "AGENT",
       startTime: firstTimestamp ?? (/* @__PURE__ */ new Date(0)).toISOString(),
       endTime: lastTimestamp,
-      service: SERVICE9,
-      agent: SERVICE9
+      service: SERVICE10,
+      agent: SERVICE10
     });
     return [root, ...spans];
   }
@@ -2907,6 +3345,7 @@ var QwenAdapter = class {
 var ADAPTERS = [
   new ClaudeAdapter(),
   new CodexAdapter(),
+  new CodexExecAdapter(),
   new OpencodeAdapter(),
   new GeminiAdapter(),
   new QwenAdapter(),
@@ -3407,6 +3846,9 @@ function summarizeTools(spans) {
   return [...byTool.entries()].map(([name, row]) => ({ name, calls: row.calls, errors: row.errors })).sort((a, b) => b.calls - a.calls || a.name.localeCompare(b.name));
 }
 async function buildPolicyEvidenceRecord(ref, spans, opts = {}) {
+  if (opts.sourceSha256 && !/^[a-f0-9]{64}$/.test(opts.sourceSha256)) {
+    throw new Error("sourceSha256 must be a lowercase SHA-256 hex digest");
+  }
   const toolSpans = spans.filter((span2) => spanKind(span2) === "TOOL");
   const erroredToolCallCount = toolSpans.filter((span2) => span2.status.code === "ERROR").length;
   const pipelines = await runPipelines(spans, { minLoopOccurrences: opts.minLoopOccurrences });
@@ -3456,6 +3898,7 @@ async function buildPolicyEvidenceRecord(ref, spans, opts = {}) {
       source: "traces",
       evidenceKind: "session-summary",
       ...opts.otlpPath ? { otlpPath: opts.otlpPath } : {},
+      ...opts.sourceSha256 ? { sourceSha256: opts.sourceSha256 } : {},
       notCampaignCell: true,
       note: "This is normalized coding-agent session evidence for downstream policy mining; it is not an eval campaign cell."
     }
@@ -3693,10 +4136,10 @@ import {
 function isObject(value) {
   return value != null && typeof value === "object" && !Array.isArray(value);
 }
-function stringValue(value) {
+function stringValue2(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function objectValue(value) {
+function objectValue2(value) {
   return isObject(value) ? value : void 0;
 }
 function stableJson(value) {
@@ -3711,7 +4154,7 @@ function stableJson(value) {
 function hashId(value, chars = 16) {
   return createHash5("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
 }
-function isoTime(value) {
+function isoTime2(value) {
   if (typeof value === "string") {
     const trimmed = value.trim();
     const normalized = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(?:\.\d+)?$/.test(trimmed) ? `${trimmed.replace(" ", "T")}Z` : trimmed;
@@ -3726,7 +4169,7 @@ function isoTime(value) {
 }
 function firstTime(obj, keys) {
   for (const key of keys) {
-    const value = isoTime(obj[key]);
+    const value = isoTime2(obj[key]);
     if (value) return value;
   }
   return void 0;
@@ -3787,7 +4230,7 @@ function isIntelligenceSpanRow(row) {
   return typeof row.trace_id === "string" && typeof row.name === "string" && isObject(row.attributes) && (row.start_unix_nano != null || row.start_time != null || row.received_at != null);
 }
 function eventType(row) {
-  return stringValue(row.type) ?? stringValue(row.event) ?? stringValue(row.name) ?? stringValue(row.kind);
+  return stringValue2(row.type) ?? stringValue2(row.event) ?? stringValue2(row.name) ?? stringValue2(row.kind);
 }
 function looksLikeSandboxEvent(row) {
   if (!isObject(row)) return false;
@@ -3859,6 +4302,7 @@ function policyEvidenceToSpans(records) {
       "traces.provenance.source": record.provenance.source,
       "traces.provenance.evidence_kind": record.provenance.evidenceKind,
       "traces.provenance.otlp_path": record.provenance.otlpPath,
+      "traces.provenance.source_sha256": record.provenance.sourceSha256,
       [ATTR.SUBJECT_KEY]: record.repo.subjectKey,
       [ATTR.GIT_REPOSITORY]: record.repo.repository,
       [ATTR.GIT_BRANCH_NAME]: record.repo.branch,
@@ -3896,7 +4340,7 @@ function findStringKey(value, keys, depth = 4) {
   if (depth < 0) return void 0;
   if (isObject(value)) {
     for (const key of keys) {
-      const found = stringValue(value[key]);
+      const found = stringValue2(value[key]);
       if (found) return found;
     }
     for (const child of Object.values(value)) {
@@ -3912,7 +4356,7 @@ function findStringKey(value, keys, depth = 4) {
   return void 0;
 }
 function eventValue(row, keys) {
-  const scopes = [row, objectValue(row.data), objectValue(row.payload)];
+  const scopes = [row, objectValue2(row.data), objectValue2(row.payload)];
   for (const scope of scopes) {
     if (!scope) continue;
     for (const key of keys) {
@@ -3947,9 +4391,9 @@ function eventEndTimestamp(row, fallback) {
 }
 function eventStatus(row, type) {
   const lowered = type.toLowerCase();
-  const errorMessage = stringValue(row.error) ?? findStringKey(row, ["error", "errorMessage", "error_message"], 3);
+  const errorMessage = stringValue2(row.error) ?? findStringKey(row, ["error", "errorMessage", "error_message"], 3);
   if (lowered.includes("error") || errorMessage) {
-    const message = errorMessage ?? stringValue(row.message);
+    const message = errorMessage ?? stringValue2(row.message);
     return { status: "ERROR", ...message ? { message: capText(message) } : {} };
   }
   return { status: "OK" };
@@ -4000,21 +4444,21 @@ function sandboxEventsToSpans(rows, wrapper) {
     const { status, message } = eventStatus(row, type);
     const { kind, tool } = eventKind(row, type);
     const name = kind === "TOOL" && tool ? `tool.${tool}` : `event.${type}`;
-    const toolInput = kind === "TOOL" ? eventValue(row, ["toolInput", "tool_input", "input", "args", "arguments", "full_command"]) : void 0;
+    const toolInput2 = kind === "TOOL" ? eventValue(row, ["toolInput", "tool_input", "input", "args", "arguments", "full_command"]) : void 0;
     const extra = {
       "traces.source_format": "sandbox-events",
       "traces.event.type": type,
       "traces.event.index": index,
       ...kind === "TOOL" ? toolIoAttributes({
-        input: toolInput,
+        input: toolInput2,
         output: eventValue(row, ["toolOutput", "tool_output", "output", "result"]),
-        argsCaptured: toolInput !== void 0
+        argsCaptured: toolInput2 !== void 0
       }) : {}
     };
     copyDefined(extra, {
-      "traces.event.id": stringValue(row.id),
-      "traces.event.raw_type": stringValue(row.type),
-      "traces.event.raw_event": stringValue(row.event)
+      "traces.event.id": stringValue2(row.id),
+      "traces.event.raw_type": stringValue2(row.type),
+      "traces.event.raw_event": stringValue2(row.event)
     });
     spans.push(span({
       traceId,
@@ -4105,7 +4549,7 @@ function capturedToolIo(attrs) {
   });
 }
 function isToolTelemetrySpan(attrs) {
-  const spanType = stringValue(attrs["span.type"])?.toLowerCase();
+  const spanType = stringValue2(attrs["span.type"])?.toLowerCase();
   return spanType === "tool.execution" || spanType === "tool.blocked_on_user";
 }
 function otlpSpanKind(value) {
@@ -4113,7 +4557,7 @@ function otlpSpanKind(value) {
 }
 function intelligenceSpanKind(name, attrs) {
   const lowered = name.toLowerCase();
-  const spanType = stringValue(attrs["span.type"])?.toLowerCase();
+  const spanType = stringValue2(attrs["span.type"])?.toLowerCase();
   if (spanType === "llm_request" || lowered.includes("llm")) return "LLM";
   if (isToolTelemetrySpan(attrs)) return "CHAIN";
   if (spanType === "tool" || lowered.includes("tool") || attrs["tool.name"] != null || attrs.tool_name != null || attrs["mcp.tool.name"] != null || attrs["tool.input"] != null || attrs["tool.output"] != null) {
@@ -4124,15 +4568,15 @@ function intelligenceSpanKind(name, attrs) {
 }
 function intelligenceSpansToSpans(rows) {
   return rows.map((row, index) => {
-    const attrs = { ...objectValue(row.attributes) ?? {} };
-    const name = stringValue(row.name) ?? "intelligence.span";
-    const startTime = unixNanoTime(row.start_unix_nano) ?? isoTime(row.start_time) ?? stringValue(row.start_time) ?? isoTime(row.received_at) ?? (/* @__PURE__ */ new Date(0)).toISOString();
-    const endTime = unixNanoTime(row.end_unix_nano) ?? isoTime(row.end_time) ?? stringValue(row.end_time) ?? startTime;
-    const model = stringValue(row.model) ?? stringValue(attrs["llm.model_name"]) ?? stringValue(attrs.model) ?? stringValue(attrs["gen_ai.request.model"]);
-    const tool = stringValue(attrs["tool.name"]) ?? stringValue(attrs.tool_name) ?? stringValue(attrs["mcp.tool.name"]);
+    const attrs = { ...objectValue2(row.attributes) ?? {} };
+    const name = stringValue2(row.name) ?? "intelligence.span";
+    const startTime = unixNanoTime(row.start_unix_nano) ?? isoTime2(row.start_time) ?? stringValue2(row.start_time) ?? isoTime2(row.received_at) ?? (/* @__PURE__ */ new Date(0)).toISOString();
+    const endTime = unixNanoTime(row.end_unix_nano) ?? isoTime2(row.end_time) ?? stringValue2(row.end_time) ?? startTime;
+    const model = stringValue2(row.model) ?? stringValue2(attrs["llm.model_name"]) ?? stringValue2(attrs.model) ?? stringValue2(attrs["gen_ai.request.model"]);
+    const tool = stringValue2(attrs["tool.name"]) ?? stringValue2(attrs.tool_name) ?? stringValue2(attrs["mcp.tool.name"]);
     const kind = intelligenceSpanKind(name, attrs);
-    const sourceStatus = objectValue(row.status);
-    const sessionId = stringValue(row.session_id) ?? sessionIdFromAttributes(attrs);
+    const sourceStatus = objectValue2(row.status);
+    const sessionId = stringValue2(row.session_id) ?? sessionIdFromAttributes(attrs);
     const extra = {
       ...preserveRawAttributes(attrs),
       ...kind === "TOOL" ? capturedToolIo(attrs) : {},
@@ -4140,30 +4584,30 @@ function intelligenceSpansToSpans(rows) {
       "traces.row.index": index
     };
     copyDefined(extra, {
-      "traces.row.id": stringValue(row.id),
+      "traces.row.id": stringValue2(row.id),
       [ATTR.SESSION_ID]: sessionId,
       "session.id": sessionId,
-      "run.id": stringValue(row.run_id),
-      "thread.id": stringValue(row.thread_id),
-      "scenario.id": stringValue(row.scenario_id),
-      "generation.id": stringValue(row.generation),
-      "cell.id": stringValue(row.cell_id),
-      "project.key": stringValue(row.project_key),
-      "redaction.version": stringValue(row.redaction_version),
-      "traces.received_at": isoTime(row.received_at)
+      "run.id": stringValue2(row.run_id),
+      "thread.id": stringValue2(row.thread_id),
+      "scenario.id": stringValue2(row.scenario_id),
+      "generation.id": stringValue2(row.generation),
+      "cell.id": stringValue2(row.cell_id),
+      "project.key": stringValue2(row.project_key),
+      "redaction.version": stringValue2(row.redaction_version),
+      "traces.received_at": isoTime2(row.received_at)
     });
     return span({
-      traceId: stringValue(row.trace_id) ?? hashId(row, 32),
-      spanId: stringValue(row.id) ?? hashId({ row, field: "span" }),
-      parentSpanId: stringValue(row.parent_span_id) ?? null,
+      traceId: stringValue2(row.trace_id) ?? hashId(row, 32),
+      spanId: stringValue2(row.id) ?? hashId({ row, field: "span" }),
+      parentSpanId: stringValue2(row.parent_span_id) ?? null,
       name,
       kind,
       startTime,
       endTime,
       status: statusCode(row.status_code ?? sourceStatus?.code),
-      statusMessage: stringValue(row.status_message) ?? stringValue(sourceStatus?.message),
-      service: stringValue(attrs["service.name"]) ?? stringValue(attrs.service_name) ?? "tangle-intelligence",
-      agent: stringValue(attrs["agent.name"]) ?? stringValue(attrs["service.name"]) ?? null,
+      statusMessage: stringValue2(row.status_message) ?? stringValue2(sourceStatus?.message),
+      service: stringValue2(attrs["service.name"]) ?? stringValue2(attrs.service_name) ?? "tangle-intelligence",
+      agent: stringValue2(attrs["agent.name"]) ?? stringValue2(attrs["service.name"]) ?? null,
       model,
       tool,
       inputTokens: firstNumber(row, attrs, ["input_tokens", ...LLM_INPUT_TOKEN_ATTR_KEYS]),
@@ -4173,7 +4617,7 @@ function intelligenceSpansToSpans(rows) {
       cacheWriteInputTokens: firstNumber(row, attrs, LLM_CACHE_WRITE_TOKEN_ATTR_KEYS),
       costUsd: firstNumber(row, attrs, ["cost_usd", ...LLM_COST_ATTR_KEYS]),
       step: numberValue(attrs["interaction.sequence"]) ?? index,
-      content: stringValue(attrs.user_prompt) ?? stringValue(attrs["gen_ai.prompt.messages"]) ?? stringValue(attrs["log.content.task"]) ?? null,
+      content: stringValue2(attrs.user_prompt) ?? stringValue2(attrs["gen_ai.prompt.messages"]) ?? stringValue2(attrs["log.content.task"]) ?? null,
       extra
     });
   });
@@ -4181,10 +4625,10 @@ function intelligenceSpansToSpans(rows) {
 function openInferenceToSpans(rows) {
   return rows.map((row) => {
     const attrs = isObject(row.attributes) ? { ...row.attributes } : {};
-    const resource = objectValue(row.resource);
-    const resourceAttrs = objectValue(resource?.attributes);
+    const resource = objectValue2(row.resource);
+    const resourceAttrs = objectValue2(resource?.attributes);
     if (resourceAttrs) copyDefined(attrs, resourceAttrs);
-    const name = stringValue(row.name) ?? "span";
+    const name = stringValue2(row.name) ?? "span";
     const declaredKind = otlpSpanKind(attrs["openinference.span.kind"]) ?? otlpSpanKind(row.kind);
     const kind = isToolTelemetrySpan(attrs) ? "CHAIN" : declaredKind ?? intelligenceSpanKind(name, attrs);
     if (declaredKind && declaredKind !== kind) {
@@ -4192,15 +4636,15 @@ function openInferenceToSpans(rows) {
     }
     attrs["openinference.span.kind"] = kind;
     if (kind === "TOOL") Object.assign(attrs, capturedToolIo(attrs));
-    const status = objectValue(row.status);
-    const message = stringValue(status?.message);
+    const status = objectValue2(row.status);
+    const message = stringValue2(status?.message);
     return {
-      trace_id: stringValue(row.trace_id) ?? hashId(row, 32),
-      span_id: stringValue(row.span_id) ?? hashId({ row, field: "span" }),
-      parent_span_id: stringValue(row.parent_span_id) || null,
+      trace_id: stringValue2(row.trace_id) ?? hashId(row, 32),
+      span_id: stringValue2(row.span_id) ?? hashId({ row, field: "span" }),
+      parent_span_id: stringValue2(row.parent_span_id) || null,
       name,
-      start_time: stringValue(row.start_time) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
-      end_time: stringValue(row.end_time) ?? stringValue(row.start_time) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      start_time: stringValue2(row.start_time) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      end_time: stringValue2(row.end_time) ?? stringValue2(row.start_time) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
       status: { code: statusCode(status?.code), ...message ? { message } : {} },
       attributes: attrs
     };
@@ -4322,7 +4766,7 @@ function topLoopTools(row) {
     current.maxOccurrences = Math.max(current.maxOccurrences, loop.occurrences);
     byTool.set(loop.toolName, current);
   }
-  const loops = [...byTool.entries()].sort(([, a], [, b]) => b.groups - a.groups || b.maxOccurrences - a.maxOccurrences).slice(0, 3).map(([toolName3, stats]) => `${toolName3} ${stats.groups} group(s), max x${stats.maxOccurrences}`);
+  const loops = [...byTool.entries()].sort(([, a], [, b]) => b.groups - a.groups || b.maxOccurrences - a.maxOccurrences).slice(0, 3).map(([toolName4, stats]) => `${toolName4} ${stats.groups} group(s), max x${stats.maxOccurrences}`);
   const suffix = row.signals.stuckLoopsOmitted > 0 ? `, +${row.signals.stuckLoopsOmitted} omitted` : "";
   return loops.length > 0 ? `${loops.join(", ")}${suffix}` : `${row.signals.stuckLoopCount} loop(s)`;
 }
@@ -4588,7 +5032,7 @@ async function writeInspectionReportFile(report, outPath) {
 // src/adoption.ts
 import { readFile as readFile4 } from "fs/promises";
 import { join as join15 } from "path";
-function toolName(s) {
+function toolName2(s) {
   const n = s.attributes["tool.name"];
   if (typeof n === "string") return n;
   if (s.name.startsWith("tool.")) return s.name.slice("tool.".length);
@@ -4747,7 +5191,7 @@ async function analyzeAdoption(spans, opts = {}) {
       sessionsWithSkillFileReference.add(group);
       addCounts(skillDocumentReads, skillDocuments);
     }
-    const tn = toolName(s);
+    const tn = toolName2(s);
     if (tn === "Skill") {
       sessionCapabilities.set(group, "supported");
       const name = skillNameOf(parseInput(s));
@@ -5981,12 +6425,12 @@ function spanKind2(span2) {
 function spanContent(span2) {
   return asString(span2.attributes.content) ?? asString(span2.attributes["input.value"]) ?? asString(span2.attributes["llm.input"]) ?? asString(span2.attributes["gen_ai.prompt"]) ?? "";
 }
-function toolName2(span2) {
+function toolName3(span2) {
   return asString(span2.attributes["tool.name"]) ?? span2.name.replace(/^tool\./, "");
 }
 function toolSignature(span2) {
   const content = spanContent(span2).replace(/\s+/g, " ").trim();
-  return `${toolName2(span2)}:${content || span2.name}`;
+  return `${toolName3(span2)}:${content || span2.name}`;
 }
 function isTool(span2) {
   return spanKind2(span2) === "TOOL" || span2.attributes["tool.name"] != null || span2.name.startsWith("tool.");
@@ -5996,15 +6440,15 @@ function isTextSpan(span2) {
 }
 function isVerification(span2) {
   if (!isTool(span2)) return false;
-  return VERIFY_RE.test(`${toolName2(span2)} ${span2.name} ${spanContent(span2)}`);
+  return VERIFY_RE.test(`${toolName3(span2)} ${span2.name} ${spanContent(span2)}`);
 }
 function isChange(span2) {
   if (!isTool(span2)) return false;
-  return CHANGE_RE.test(`${toolName2(span2)} ${span2.name} ${spanContent(span2)}`);
+  return CHANGE_RE.test(`${toolName3(span2)} ${span2.name} ${spanContent(span2)}`);
 }
 function isRead(span2) {
   if (!isTool(span2)) return false;
-  return /\b(read|cat|less|grep|rg|sed -n|nl|ls|find|git show|git diff)\b/i.test(`${toolName2(span2)} ${span2.name} ${spanContent(span2)}`);
+  return /\b(read|cat|less|grep|rg|sed -n|nl|ls|find|git show|git diff)\b/i.test(`${toolName3(span2)} ${span2.name} ${spanContent(span2)}`);
 }
 function actionKind(span2) {
   if (isVerification(span2)) return "verify";
@@ -6016,7 +6460,7 @@ function actionKind(span2) {
 }
 function classifyLiveActions(spans) {
   return orderSpans(spans).map((span2) => {
-    const tool = isTool(span2) ? toolName2(span2) : void 0;
+    const tool = isTool(span2) ? toolName3(span2) : void 0;
     return {
       kind: actionKind(span2),
       spanId: span2.span_id,
@@ -6911,6 +7355,8 @@ export {
   CORRECTIVE_REACTIONS,
   ClaudeAdapter,
   CodexAdapter,
+  CodexExecStreamError,
+  CodexExecAdapter,
   CopilotAdapter,
   FactoryAdapter,
   ForgeAdapter,

package/dist/cli.js

@@ -40,10 +40,11 @@ import {
   writePolicyEvidenceFile,
   writeSessionIndexFile,
   writeTraceEvidenceExportFile
-} from "./chunk-NHXPTFKC.js";
+} from "./chunk-ELWOJS65.js";
 
 // src/cli.ts
-import { readFileSync } from "fs";
+import { createHash } from "crypto";
+import { createReadStream, readFileSync } from "fs";
 import { readFile, stat } from "fs/promises";
 import { basename, resolve } from "path";
 import {
@@ -351,10 +352,22 @@ async function cmdConvert(args) {
   const path = await writeOtlpFile(spans, args.otlp);
   console.log(`wrote ${spans.length} spans \u2192 ${path}`);
 }
-async function collectSessionRows(args) {
+async function sourceSha256(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function collectSessionRows(args, bindExplicitSource = false) {
   if (args.session) {
     const { adapter, ref } = await resolveSelectedSession(args);
-    return [{ ref, spans: await parseSession(adapter, ref) }];
+    if (!bindExplicitSource) return [{ ref, spans: await parseSession(adapter, ref) }];
+    const before = await sourceSha256(ref.path);
+    const spans = await parseSession(adapter, ref);
+    const after = await sourceSha256(ref.path);
+    if (before !== after) {
+      throw new Error(`session source changed while parsing; refusing unbound evidence: ${ref.path}`);
+    }
+    return [{ ref, spans, sourceSha256: after }];
   }
   const groups = await discover({ ...args, last: args.last || 20 });
   const rows = [];
@@ -364,7 +377,7 @@ async function collectSessionRows(args) {
   return rows;
 }
 async function cmdEvidence(args) {
-  const rows = (await collectSessionRows(args)).filter((row) => row.spans.length > 0);
+  const rows = (await collectSessionRows(args, true)).filter((row) => row.spans.length > 0);
   if (rows.length === 0) throw new Error("no spans found for the given selection");
   const otlpPath = args.otlp ? await writeOtlpFile(rows.flatMap((row) => row.spans), args.otlp) : void 0;
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -373,7 +386,8 @@ async function cmdEvidence(args) {
       generatedAt,
       minLoopOccurrences: args.minLoop,
       maxLoopExamples: 25,
-      otlpPath
+      otlpPath,
+      sourceSha256: row.sourceSha256
     })
   ));
   if (args.out) {

package/dist/index.d.ts

@@ -440,6 +440,27 @@ declare class CodexAdapter implements HarnessTraceAdapter {
     parse(ref: SessionRef, options?: ParseOptions): Promise<OtlpSpan[]>;
 }
 
+/**
+ * Ephemeral `codex exec --json` adapter.
+ *
+ * Unlike Codex rollout files under `~/.codex/sessions`, this stream has no
+ * durable discovery path and normally carries no timestamps, model name, or
+ * user prompt. Callers select it explicitly with `--session`; event order is
+ * preserved with `step`, and missing timestamps use the source file mtime
+ * without inventing durations.
+ */
+
+declare class CodexExecStreamError extends Error {
+    readonly sourcePath: string;
+    constructor(sourcePath: string, message: string);
+}
+declare class CodexExecAdapter implements HarnessTraceAdapter {
+    readonly harness = "codex-exec";
+    readonly aliases: readonly ["codex-json"];
+    locate(_opts?: LocateOptions): Promise<SessionRef[]>;
+    parse(ref: SessionRef, options?: ParseOptions): Promise<OtlpSpan[]>;
+}
+
 /**
  * OpenCode adapter — `~/.local/share/opencode/storage/`.
  *
@@ -1025,6 +1046,8 @@ interface PolicyEvidenceRecord {
         readonly source: 'traces';
         readonly evidenceKind: 'session-summary';
         readonly otlpPath?: string;
+        /** SHA-256 of the stable explicit session file consumed by the CLI. */
+        readonly sourceSha256?: string;
         readonly notCampaignCell: true;
         readonly note: string;
     };
@@ -1034,6 +1057,8 @@ interface BuildPolicyEvidenceOptions {
     readonly minLoopOccurrences?: number;
     readonly maxLoopExamples?: number;
     readonly otlpPath?: string;
+    /** SHA-256 of the exact stable source bytes used to produce this record. */
+    readonly sourceSha256?: string;
 }
 interface CollectPolicyEvidenceOptions extends ScanOptions, BuildPolicyEvidenceOptions {
 }
@@ -1780,4 +1805,4 @@ interface ExecuteOptions {
 /** Send the final, new outbound items (or write their dry-run OTLP). */
 declare function executeUpload(plan: UploadPlan, opts?: ExecuteOptions): Promise<UploadResult>;
 
-export { ACTOR_ATTR, ATTR, type Actor, type AdoptionOptions, type AdoptionReport, AmpAdapter, type AnalyzeOptions, type AnalyzeResult, type BuildPolicyEvidenceOptions, type BuildSessionIndexOptions, type BuildTraceFindingPacketOptions, CODING_REDACTION_RULES, CONTENT_CAP, CORRECTIVE_REACTIONS, ClaudeAdapter, CodexAdapter, type CollectOptions, type CollectPolicyEvidenceOptions, type CollectSessionIndexOptions, CopilotAdapter, type CorruptionMode, DEFAULT_HARNESS, EmptySessionError, type ExecuteOptions, type ExternalAnalysisResult, type ExternalAnalyzer, FactoryAdapter, ForgeAdapter, GeminiAdapter, type HarnessTraceAdapter, INGEST_SOURCE_CLI, type InspectSessionIndexOptions, JsonSourceError, type JsonlCorruptionReceipt, JsonlParseError, type JsonlReadOptions, type LiveBatchOptions, type LocateOptions, type ObservedLoop, type ObserverOptions, OpencodeAdapter, type OtlpSpan, type OtlpSpanKind, type OtlpStatusCode, type ParseOptions, PartialUploadError, PiAdapter, type PipelineOptions, type PipelineReport, type PlanOptions, type PolicyEvidenceLoopSummary, type PolicyEvidenceRecord, type PolicyEvidenceToolSummary, QwenAdapter, REACTIONS, type Reaction, type ReactionReport, type ReactionSessionReport, type Redactor, type RepoAttrs, type RepoResolution, type RepoResolutionSource, type RunResult, type RuntimeTrace, type ScanOptions, type ScannedSession, type SessionBatch, type SessionCorruptionReceipt, type SessionIdentityConflict, type SessionIdentityIndex, type SessionIntegrity, type SessionRef, type SpanInput, type SpanRedaction, TRACES_REDACTION_RULES, type TraceAgenticRoute, type TraceAgenticRouteReason, type TraceAgenticRouteReasonCode, type TraceContextIndex, type TraceContextRoot, type TraceEvidenceExportOptions, type TraceEvidenceExportResult, type TraceEvidenceFormatOption, type TraceEvidenceInputFormat, type TraceEvidenceRow, type TraceExecutionOptions, type TraceFindingPacket, type TraceImprovementArtifacts, type TraceImprovementOptions, type TraceImprovementResult, type TraceIndexedFile, type TraceInspectionArea, type TraceInspectionFinding, type TraceInspectionReport, type TraceInspectionSeverity, type TraceInvestigationOptions, type TraceInvestigationResult, type TraceLiveAction, type TraceLiveActionKind, type TraceLiveAnalysisContext, type TraceLiveAnalyst, type TraceLiveBatch, type TraceLiveEvidence, type TraceLiveFinding, type TraceLiveLoop, type TraceLiveSeverity, type TraceSessionIndex, type TraceSessionIndexRow, type TraceStoreInvestigationOptions, type TraceStoreInvestigationResult, type TraceStreamEvent, type TraceStreamOptions, type TraceStreamReplayOptions, type TraceStreamSession, type TracesConfig, type TriggerPair, type UploadBackend, type UploadIdentity, type UploadItem, type UploadPlan, type UploadRecord, type UploadResult, type UploadState, type UserPromptInput, alreadyUploaded, analyzeAdoption, analyzeLiveBatch, analyzeReactions, analyzeSpans, applyRedactor, buildPolicyEvidenceRecord, buildSessionIndex, buildSessionIndexFromRows, buildTraceFindingPacket, capText, classifyLiveActions, classifyReaction, claudeActor, codexActor, collectPolicyEvidence, collectSessionIndex, collectSessions, commandAnalyzer, commandRedactor, countSkillRunsJsonl, cwdMatchesSelection, defaultTraceLiveAnalysts, equivalentGitCwds, executeUpload, exportTraceEvidenceFile, exportTraceEvidenceRows, exportTraceEvidenceText, haloAnalyzer, indexSessionIdsByTrace, inspectSessionIndex, knownHarnesses, listAdapters, loadState, loadTracesConfig, locateSessions, looksLikeAgentPrompt, mergeTracesConfig, normalizeRemote, outboundHash, parseIsoToEpochMs, parseSession, parseSince, planTraceAgenticRoute, planUpload, readJsonFile, readJsonl, readSessionIndexFile, recordSessionCorruption, redactSpans, renderInspectionReport, resolveAdapter, resolveRepoAttrs, resolveSessionRepoAttrs, runCommand, runExternalAnalyzers, runPipelines, runTraceImprovement, runTraceInvestigation, runTraceStoreInvestigation, saveReport, saveState, scanSessions, selectAdapters, serializeInspectionReport, serializePolicyEvidence, serializeSessionIndex, serializeSpans, serializeTraceStreamEvent, sessionHash, sessionIdFromAttributes, sessionIntegrityAttributes, span, stampRepoAttrs, stampSessionIdentity, stampSessionIntegrity, stampSpanWorkdirRepoAttrs, streamSessions, summarizeOtlpExecution, summarizeSpanExecution, takeJsonl, textIsSynthetic, toOpenInferenceSpan, toRuntimeStore, toTraceSpanEvents, traceAgenticKinds, traceStreamEventsFromSpans, uploadKey, userPromptSpan, watchSessions, writeInspectionReportFile, writeOtlpFile, writePolicyEvidenceFile, writeSessionIndexFile, writeTraceEvidenceExportFile, writeTraceImprovementArtifacts };
+export { ACTOR_ATTR, ATTR, type Actor, type AdoptionOptions, type AdoptionReport, AmpAdapter, type AnalyzeOptions, type AnalyzeResult, type BuildPolicyEvidenceOptions, type BuildSessionIndexOptions, type BuildTraceFindingPacketOptions, CODING_REDACTION_RULES, CONTENT_CAP, CORRECTIVE_REACTIONS, ClaudeAdapter, CodexAdapter, CodexExecAdapter, CodexExecStreamError, type CollectOptions, type CollectPolicyEvidenceOptions, type CollectSessionIndexOptions, CopilotAdapter, type CorruptionMode, DEFAULT_HARNESS, EmptySessionError, type ExecuteOptions, type ExternalAnalysisResult, type ExternalAnalyzer, FactoryAdapter, ForgeAdapter, GeminiAdapter, type HarnessTraceAdapter, INGEST_SOURCE_CLI, type InspectSessionIndexOptions, JsonSourceError, type JsonlCorruptionReceipt, JsonlParseError, type JsonlReadOptions, type LiveBatchOptions, type LocateOptions, type ObservedLoop, type ObserverOptions, OpencodeAdapter, type OtlpSpan, type OtlpSpanKind, type OtlpStatusCode, type ParseOptions, PartialUploadError, PiAdapter, type PipelineOptions, type PipelineReport, type PlanOptions, type PolicyEvidenceLoopSummary, type PolicyEvidenceRecord, type PolicyEvidenceToolSummary, QwenAdapter, REACTIONS, type Reaction, type ReactionReport, type ReactionSessionReport, type Redactor, type RepoAttrs, type RepoResolution, type RepoResolutionSource, type RunResult, type RuntimeTrace, type ScanOptions, type ScannedSession, type SessionBatch, type SessionCorruptionReceipt, type SessionIdentityConflict, type SessionIdentityIndex, type SessionIntegrity, type SessionRef, type SpanInput, type SpanRedaction, TRACES_REDACTION_RULES, type TraceAgenticRoute, type TraceAgenticRouteReason, type TraceAgenticRouteReasonCode, type TraceContextIndex, type TraceContextRoot, type TraceEvidenceExportOptions, type TraceEvidenceExportResult, type TraceEvidenceFormatOption, type TraceEvidenceInputFormat, type TraceEvidenceRow, type TraceExecutionOptions, type TraceFindingPacket, type TraceImprovementArtifacts, type TraceImprovementOptions, type TraceImprovementResult, type TraceIndexedFile, type TraceInspectionArea, type TraceInspectionFinding, type TraceInspectionReport, type TraceInspectionSeverity, type TraceInvestigationOptions, type TraceInvestigationResult, type TraceLiveAction, type TraceLiveActionKind, type TraceLiveAnalysisContext, type TraceLiveAnalyst, type TraceLiveBatch, type TraceLiveEvidence, type TraceLiveFinding, type TraceLiveLoop, type TraceLiveSeverity, type TraceSessionIndex, type TraceSessionIndexRow, type TraceStoreInvestigationOptions, type TraceStoreInvestigationResult, type TraceStreamEvent, type TraceStreamOptions, type TraceStreamReplayOptions, type TraceStreamSession, type TracesConfig, type TriggerPair, type UploadBackend, type UploadIdentity, type UploadItem, type UploadPlan, type UploadRecord, type UploadResult, type UploadState, type UserPromptInput, alreadyUploaded, analyzeAdoption, analyzeLiveBatch, analyzeReactions, analyzeSpans, applyRedactor, buildPolicyEvidenceRecord, buildSessionIndex, buildSessionIndexFromRows, buildTraceFindingPacket, capText, classifyLiveActions, classifyReaction, claudeActor, codexActor, collectPolicyEvidence, collectSessionIndex, collectSessions, commandAnalyzer, commandRedactor, countSkillRunsJsonl, cwdMatchesSelection, defaultTraceLiveAnalysts, equivalentGitCwds, executeUpload, exportTraceEvidenceFile, exportTraceEvidenceRows, exportTraceEvidenceText, haloAnalyzer, indexSessionIdsByTrace, inspectSessionIndex, knownHarnesses, listAdapters, loadState, loadTracesConfig, locateSessions, looksLikeAgentPrompt, mergeTracesConfig, normalizeRemote, outboundHash, parseIsoToEpochMs, parseSession, parseSince, planTraceAgenticRoute, planUpload, readJsonFile, readJsonl, readSessionIndexFile, recordSessionCorruption, redactSpans, renderInspectionReport, resolveAdapter, resolveRepoAttrs, resolveSessionRepoAttrs, runCommand, runExternalAnalyzers, runPipelines, runTraceImprovement, runTraceInvestigation, runTraceStoreInvestigation, saveReport, saveState, scanSessions, selectAdapters, serializeInspectionReport, serializePolicyEvidence, serializeSessionIndex, serializeSpans, serializeTraceStreamEvent, sessionHash, sessionIdFromAttributes, sessionIntegrityAttributes, span, stampRepoAttrs, stampSessionIdentity, stampSessionIntegrity, stampSpanWorkdirRepoAttrs, streamSessions, summarizeOtlpExecution, summarizeSpanExecution, takeJsonl, textIsSynthetic, toOpenInferenceSpan, toRuntimeStore, toTraceSpanEvents, traceAgenticKinds, traceStreamEventsFromSpans, uploadKey, userPromptSpan, watchSessions, writeInspectionReportFile, writeOtlpFile, writePolicyEvidenceFile, writeSessionIndexFile, writeTraceEvidenceExportFile, writeTraceImprovementArtifacts };

package/dist/index.js

@@ -7,6 +7,8 @@ import {
   CORRECTIVE_REACTIONS,
   ClaudeAdapter,
   CodexAdapter,
+  CodexExecAdapter,
+  CodexExecStreamError,
   CopilotAdapter,
   DEFAULT_HARNESS,
   EmptySessionError,
@@ -117,7 +119,7 @@ import {
   writeSessionIndexFile,
   writeTraceEvidenceExportFile,
   writeTraceImprovementArtifacts
-} from "./chunk-NHXPTFKC.js";
+} from "./chunk-ELWOJS65.js";
 
 // src/collect.ts
 async function collectSessions(opts = {}) {
@@ -151,6 +153,8 @@ export {
   CORRECTIVE_REACTIONS,
   ClaudeAdapter,
   CodexAdapter,
+  CodexExecAdapter,
+  CodexExecStreamError,
   CopilotAdapter,
   DEFAULT_HARNESS,
   DEFAULT_REDACTION_RULES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/traces",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Point it at your coding-agent session traces (Claude Code, Codex, OpenCode, Gemini, Pi, …) and get failure-mode + efficiency findings. CLI + SDK over the @tangle-network/agent-eval analyst suite — observe live sessions, run your own analysts, redact, and upload to the Tangle Intelligence Platform.",
   "type": "module",
   "license": "MIT",
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@ax-llm/ax": "^23.0.1",
-    "@tangle-network/agent-eval": "^0.133.0"
+    "@tangle-network/agent-eval": "^0.134.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",