@tiphys/kernel 0.0.0 → 0.2.0

package/dist/src/gates/schemas/citation-config.schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/citation-config.schema.json",
+  "title": "Tiphys citation linter configuration",
+  "description": "Roots (local and external), the configured document set, and the citationRequired subset for the `citations` gate. Kernel plan M2, M2-P5 step 2. Expressed entirely in the closed keyword set of M2-D-04 (src/gates/validate.ts): no oneOf/if-then-else, so root-kind-specific shape is not expressed here and is checked in code instead, the same split src/gates/manifest.ts already uses for precondition kinds.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "roots", "externalRoots", "documents", "citationRequired"],
+  "properties": {
+    "version": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "roots": {
+      "description": "Local roots: paths this checkout is expected to contain. A citation matching a local root's glob is resolved against the filesystem (existence, line count, optional content hash).",
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/root" }
+    },
+    "externalRoots": {
+      "description": "Roots naming a repository this checkout does NOT contain (kernel plan M2 section 3, M2-P5 grounding: the firstmate scouted clone). External roots are matched FIRST, before local roots, so a bare relative path that would otherwise collide with this repository's own tree (bin/fm-lock.sh vs this repo's bin/) resolves deterministically rather than being guessed. A citation matching an external root is recorded unverifiable-external with provenance and is never counted as a resolved unit.",
+      "type": "array",
+      "items": { "$ref": "#/$defs/root" }
+    },
+    "documents": {
+      "description": "Path globs identifying the configured document set this gate ever looks at, diff-scoped at run time (M2-D-10) and walked in full only by the one-shot inventory (kernel plan M2-P5 step 5, not a standing gate mode).",
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string" }
+    },
+    "citationRequired": {
+      "description": "The subset of `documents` in which zero recognized citations is red (M2R-014's narrowed vacuous guard: plans, reviews, verifications). Every glob here must also appear in `documents`; checked in code, not expressible in the closed keyword set.",
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "root": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "match"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "description": {
+          "type": "string"
+        },
+        "match": {
+          "description": "Explicit path globs (segments separated by /, * matches within one segment, ** matches zero or more segments). A glob listed under more than one root (local or external, the identical glob string) is a config error, reported as error, never guessed (kernel plan M2-P5 criterion 5).",
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/dist/src/gates/schemas/coverage-config.schema.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/coverage-config.schema.json",
+  "title": "Tiphys coverage gate configuration",
+  "description": "Declares the inventory source, the coverage-table source, and the named bucket-kind regexes the coverage gate (kernel plan M2, M2-P6) classifies bucket values against. Expressed entirely in the closed keyword set of M2-D-04.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["inventory", "coverageTable", "bucketKinds"],
+  "properties": {
+    "inventory": {
+      "description": "The document enumerating every id that must be covered (this repository's real run: delivery/requirements/migration-table.md).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "idPattern"],
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "idPattern": {
+          "description": "A regex SOURCE, compiled anchored as ^(?:<idPattern>)$ and tested against the first cell of every markdown table row in the document. A row whose first cell matches is a candidate id row; every other row (headers, separators, prose) is ignored.",
+          "type": "string"
+        }
+      }
+    },
+    "coverageTable": {
+      "description": "The document asserting, for each id, which bucket it lands in (this repository's real run: delivery/plan/kernel-plan-v1.md Appendix A).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "idPattern", "bucketColumn", "noteColumn"],
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "idPattern": {
+          "type": "string"
+        },
+        "bucketColumn": {
+          "description": "0-based index into the row's cell array (cell 0 is the id) holding the bucket value.",
+          "type": "integer",
+          "minimum": 1
+        },
+        "noteColumn": {
+          "description": "0-based index into the row's cell array holding the note, checked only for bucket kinds that declare requiresNote true.",
+          "type": "integer",
+          "minimum": 1
+        }
+      }
+    },
+    "bucketKinds": {
+      "description": "A named set of regexes, each tested anchored full-string against a bucket value. A value matching more than one declared kind is the ambiguous-kind finding (CR-992), never a silent first-match. A pattern's first capturing group, when present and participating in the match, is read as a milestone digit (bare group value, e.g. 2 for M2); a kind whose pattern carries no such group, or whose match did not use it, buckets by the kind's own name in the per-milestone view (this is how 'parked' appears in that view rather than as a milestone).",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["kind", "pattern", "requiresNote"],
+        "properties": {
+          "kind": {
+            "type": "string",
+            "pattern": "^[a-z][a-z-]*$"
+          },
+          "pattern": {
+            "type": "string"
+          },
+          "requiresNote": {
+            "type": "boolean"
+          }
+        }
+      }
+    },
+    "expectedUnits": {
+      "description": "CR-986: the exact expected count of DISTINCT inventory ids. A row deleted from BOTH documents leaves every other check silent (the two documents still agree with each other), so this is the only check that can catch it. Optional; when absent, no floor is enforced. This repository's real run sets it to 115.",
+      "type": "integer",
+      "minimum": 0
+    }
+  }
+}

package/dist/src/gates/schemas/gate-manifest.schema.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/gate-manifest.schema.json",
+  "title": "Tiphys gate manifest",
+  "description": "One manifest per repository: which gates exist, how each is invoked, and which commands can destroy work. Kernel plan M2, M2-P1 step 6. Expressed entirely in the closed keyword set of M2-D-04.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "gates", "destructiveCommands"],
+  "properties": {
+    "note": {
+      "description": "Free prose for the manifest's own readers. JSON carries no comments and a manifest has things worth saying about itself (CR-813).",
+      "type": "string"
+    },
+    "version": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "gates": {
+      "description": "Append-only registry keyed by id. No minItems: a manifest with zero gates must reach the runner and be reported as no applicable gate (M2R-012), not rejected at load.",
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/gate"
+      }
+    },
+    "destructiveCommands": {
+      "description": "CLI commands and module paths whose operations can destroy work (kernel plan M2 section 2 item 11). Consumed by M2-P2 rule (e) to DERIVE a witness class rather than trust the implementer's declaration.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "$defs": {
+    "gate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "command", "unitLabel", "applicability"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "command": {
+          "description": "argv array. The runner appends --result and --evidence, plus one flag per declared parameter.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "unitLabel": {
+          "type": "string"
+        },
+        "applicability": {
+          "description": "required: an unmet precondition fails the run. conditional: an unmet precondition does not.",
+          "type": "string",
+          "enum": ["required", "conditional"]
+        },
+        "parameters": {
+          "description": "Run parameters this gate's command REQUIRES. Declared rather than inferred: deciding what another program needs by pattern-matching its command line is the mechanism MECHANISMS.md forbids. An absent declared parameter makes the gate error, never not-applicable (M2-C-3, M2R-003).",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["base", "head", "phase"]
+          }
+        },
+        "precondition": {
+          "$ref": "#/$defs/precondition"
+        },
+        "modes": {
+          "description": "Reserved for M3's assurance modes (section 2 item 1). Validated if present, ignored by the M2 runner, so the promotion is additive.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "precondition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "kind"],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "kind": {
+          "description": "The closed set. Kind-specific required fields are checked by src/gates/manifest.ts, which emits the same INVALID <pointer> <message> diagnostics, because this validator's keyword set has no conditional composition and M2-D-04 forbids growing it.",
+          "type": "string",
+          "enum": [
+            "file-exists",
+            "file-absent",
+            "branch-matches",
+            "diff-touches",
+            "command-exit-zero"
+          ]
+        },
+        "path": {
+          "description": "file-exists and file-absent.",
+          "type": "string"
+        },
+        "pattern": {
+          "description": "branch-matches. A JavaScript regular expression source that is ANCHORED: it is compiled as ^(?:<pattern>)$ and must match the WHOLE branch name, so a prefix rule is written claude/{phase}-.* and not claude/{phase}-. The token {phase} is replaced by the --phase value, REGEX-ESCAPED, so a phase id containing a metacharacter is a literal. Both were faults: unanchored, claude/m2-p4- matched the decoy branch evil/claude/m2-p4-scope-auditor-DECOY, and unescaped, a phase id m2.p4 matched m2xp4 (CR-805). An author who forgets the .* gets not-applicable, which is the safe direction.",
+          "type": "string"
+        },
+        "paths": {
+          "description": "diff-touches. Path prefixes; the precondition is met when the diff changes a path under any of them.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "command": {
+          "description": "command-exit-zero. argv array, run in the runner's working directory.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  }
+}

package/dist/src/gates/schemas/gate-result.schema.json

@@ -0,0 +1,160 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/gate-result.schema.json",
+  "title": "Tiphys gate result record",
+  "description": "One record per gate the runner evaluated. Kernel plan M2, M2-P1 step 2. Expressed entirely in the closed keyword set of M2-D-04.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "gate",
+    "status",
+    "units",
+    "unitLabel",
+    "startedAt",
+    "endedAt",
+    "detail",
+    "evidence"
+  ],
+  "properties": {
+    "gate": {
+      "description": "The gate id, matching the manifest entry that produced this record.",
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    },
+    "status": {
+      "description": "The four-word status vocabulary. not-applicable ASSERTS that a precondition was evaluated and found unmet (SC-011).",
+      "type": "string",
+      "enum": ["green", "red", "not-applicable", "error"]
+    },
+    "units": {
+      "description": "How much the gate examined, in unitLabel units. M2-C-2: green with 0 is rewritten to error.",
+      "type": "integer",
+      "minimum": 0
+    },
+    "unitLabel": {
+      "description": "What one unit is, declared per gate in kernel plan M2 section 1.4.",
+      "type": "string"
+    },
+    "startedAt": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]+)?Z$"
+    },
+    "endedAt": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]+)?Z$"
+    },
+    "vacuous": {
+      "description": "Set only when the M2-C-2 rewrite fired: this error was a green with zero units. A strict subset of error in the summary counts.",
+      "type": "boolean"
+    },
+    "precondition": {
+      "$ref": "#/$defs/precondition"
+    },
+    "pin": {
+      "$ref": "#/$defs/pinPair"
+    },
+    "detail": {
+      "description": "One human-facing reason line. Never the machine authority for anything.",
+      "type": "string"
+    },
+    "evidence": {
+      "description": "Paths relative to the evidence directory.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "$defs": {
+    "precondition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "met", "reason"],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "met": {
+          "description": "false means EVALUATED AND UNMET. An evaluation that could not conclude produces no precondition record at all, because the gate is error.",
+          "type": "boolean"
+        },
+        "reason": {
+          "type": "string"
+        },
+        "evidence": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "pinPair": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["start", "end"],
+      "properties": {
+        "start": {
+          "$ref": "#/$defs/pin"
+        },
+        "end": {
+          "$ref": "#/$defs/pin"
+        }
+      }
+    },
+    "pin": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["roots", "takenAt", "fileCount", "files"],
+      "properties": {
+        "fileCount": {
+          "description": "files.length, carried explicitly so a vacuous pin is visible in the record (CR-804). Zero makes a green record error under M2-C-5.",
+          "type": "integer",
+          "minimum": 0
+        },
+        "roots": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "takenAt": {
+          "type": "string"
+        },
+        "files": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/pinFile"
+          }
+        }
+      }
+    },
+    "pinFile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256", "size", "mtimeMs", "ctimeMs"],
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "size": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "mtimeMs": {
+          "type": "number",
+          "minimum": 0
+        },
+        "ctimeMs": {
+          "description": "Inode change time. Pinned in addition to M2-C-5's four fields because mtime is settable from userspace and cp -p, rsync -a and tar -x all restore it exactly (CR-809).",
+          "type": "number",
+          "minimum": 0
+        }
+      }
+    }
+  }
+}

package/dist/src/gates/schemas/phase-declaration.schema.json

@@ -0,0 +1,87 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/phase-declaration.schema.json",
+  "title": "Tiphys phase declaration",
+  "description": "One document per plan phase, a projection of kernel plan M2 section 3's files-to-touch list, committed to main before the phase branch is created (delivery/plan/phase-declarations/README.md). Read by the scope auditor (M2-P4) from the MERGE BASE of the audited branch, never from the head, so editing the declaration on the audited branch cannot widen the audited scope (kernel plan M2, M2-P4 step 4, the anti-widening property). Shape fixed by M2-P4 step 2. Expressed entirely in the closed keyword set of M2-D-04 (src/gates/validate.ts).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "branch", "filesToTouch", "declaredExtras", "citations"],
+  "properties": {
+    "id": {
+      "description": "The phase id as the plan spells it, for example M2-P4.",
+      "type": "string",
+      "pattern": "^M[0-9]+-P[0-9]+$"
+    },
+    "branch": {
+      "description": "The phase's one governing branch (kernel plan M2 section 3: one phase, one branch, one PR).",
+      "type": "string",
+      "pattern": "^claude/m[0-9]+-p[0-9]+-.+$"
+    },
+    "filesToTouch": {
+      "description": "Literal paths, or literal directories written with a trailing slash. Never a description (M2R-016): the scope auditor matches these strings exactly or as a directory prefix and does not interpret prose.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "declaredExtras": {
+      "description": "Paths this phase is authorized to touch beyond filesToTouch, over and above the two standing pre-authorized extras (test/behaviors.json and this phase's own delivery/work-history/<id>.md), which the auditor adds itself and which never need to be listed here.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "citations": {
+      "description": "Requirement, finding, decision or constraint ids the plan cites for this phase (for example R-020, DR-0014, M2-C-6, T-003).",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "gateClasses": {
+      "description": "DR-0029 part 2a (M4-P14). The kernel requires a PHASE to declare at least one gate in each required CLASS and never says what the command is. THE SHAPE IS DECLARED HERE AND THE SEMANTICS ARE NOT, deliberately: an absent reason on a not-applicable class, or a missing establishing phase on a not-yet-establishable one, must reach a reader as a RED gate naming the phase and the class, and a schema rejection would instead surface as the gate's `error` status, which M2-C-3 reserves for a check that could not reach a verdict. So this property admits every shape src/gates/gate-classes.ts is able to report on, and that module refuses the ones DR-0029 forbids. The property is OPTIONAL because every declaration written before this phase lacks it and a required field would make all of them fail to load, turning a red verdict into an error for a defect this schema is not the right instrument for.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "correctness": {
+          "$ref": "#/$defs/classDeclaration"
+        },
+        "scope": {
+          "$ref": "#/$defs/classDeclaration"
+        },
+        "review": {
+          "$ref": "#/$defs/classDeclaration"
+        }
+      }
+    }
+  },
+  "$defs": {
+    "classDeclaration": {
+      "description": "One class's disposition. EITHER `gates` names one or more gate ids that assert this class, OR `status` declares an escape: `not-applicable` carrying a `reason`, or `not-yet-establishable` carrying `establishedBy`, the phase id that will establish it. DR-0029: a phase may start from nothing and may never SILENTLY have nothing, so the escape is data, it is visible, and it is carried forward.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "gates": {
+          "description": "Gate ids from this repository's own gate registry that assert this class for this phase.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "status": {
+          "description": "The declared escape, when this phase asserts no gate in this class.",
+          "type": "string",
+          "enum": ["not-applicable", "not-yet-establishable"]
+        },
+        "reason": {
+          "description": "Required by src/gates/gate-classes.ts when status is not-applicable. Not required HERE: an empty or absent reason is a RED verdict naming the class, not a document that fails to load.",
+          "type": "string"
+        },
+        "establishedBy": {
+          "description": "Required by src/gates/gate-classes.ts when status is not-yet-establishable: the phase id that will establish this class. The IOU's due date.",
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/dist/src/gates/schemas/release-record.schema.json

@@ -0,0 +1,119 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/release-record.schema.json",
+  "title": "Tiphys release-verification adapter response",
+  "description": "What an adapter writes to the kernel-supplied record path after one bounded observation (kernel plan M2, M2-P7 step 3; investigation section 2.5). The adapter returns an OUTCOME, never a status path: JSON-pointer extraction exists only inside the http-json adapter's own configuration and the kernel never learns what a statusPath is. Conditional requirements (satisfied requires resolved and observation, which are fail-closed rules 4 and 5; reason is required for failed, absent, not-applicable and error) need conditional composition, which is outside the closed keyword set of M2-D-04, so they are enforced in code by src/gates/release.ts with the response schema's own INVALID <pointer> <message> diagnostic shape. The outcome enum is deliberately NOT expressed here: an out-of-enum outcome is fail-closed rule 7's own named error, never coerced and never a generic schema failure, and the subject echo (rule 3) must be checked before the outcome is read at all. Expressed entirely in the closed keyword set.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["contractVersion", "adapter", "subject", "outcome", "observedAt"],
+  "properties": {
+    "contractVersion": {
+      "description": "The versions the kernel accepts are enumerated in src/gates/release.ts; an unrecognized value is error naming them (fail-closed rule 6).",
+      "type": "string"
+    },
+    "adapter": {
+      "description": "The adapter's own name, for the record.",
+      "type": "string"
+    },
+    "subject": {
+      "$ref": "#/$defs/subject"
+    },
+    "outcome": {
+      "description": "One of satisfied, failed, pending, absent, not-applicable, error. Enforced in code as fail-closed rule 7 (see the document description).",
+      "type": "string"
+    },
+    "resolved": {
+      "description": "The platform identity the adapter actually inspected, verbatim. Required for satisfied (fail-closed rule 4): a verifier that cannot say what it looked at did not look. kind and id are the contract; everything else is platform vocabulary the adapter may record and the kernel never interprets, except createdAt, which the kernel compares against the subject's mergedAt for the older-than-the-merge observation.",
+      "type": "object",
+      "required": ["kind", "id"],
+      "properties": {
+        "kind": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        }
+      }
+    },
+    "observedAt": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]+)?Z$"
+    },
+    "observation": {
+      "description": "The captured evidence behind the outcome. Required for satisfied (fail-closed rule 5): a claim with no captured evidence behind it is treated as unknown. raw is a verbatim extract of the observed response and is deliberately unconstrained; detail is one line. For pending, detail carries the observed value verbatim, because the deadline conversion names the last observed value.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["detail"],
+      "properties": {
+        "raw": {
+          "description": "Verbatim extract. Any JSON value."
+        },
+        "detail": {
+          "type": "string"
+        }
+      }
+    },
+    "reason": {
+      "description": "Required for failed, absent, not-applicable and error (checked in code as part of fail-closed rule 2's conditional half).",
+      "type": "string"
+    },
+    "units": {
+      "description": "How many units of the verification's declared unit the adapter examined (e.g. migrations compared). Absent, a satisfied verification counts 1 (kernel plan M2, M2-P7 step 3's mapping). Declared as design decision D-p7-3 in the phase work history.",
+      "type": "integer",
+      "minimum": 0
+    },
+    "precondition": {
+      "description": "Present only with outcome not-applicable from an adapter-evaluated precondition (the declared-false state of M2-P7 step 7): the precondition id and the evidence of its evaluation.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id"],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "evidence": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "transport": {
+      "description": "Transport-level detail for the attempt record: for HTTP, the status code; a command's exit code is observed by the kernel itself.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "httpStatus": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    }
+  },
+  "$defs": {
+    "subject": {
+      "description": "The kernel-owned subject, echoed VERBATIM from the request. The kernel compares it field by field before reading the outcome (fail-closed rule 3): an adapter that verified something else cannot report success for this subject by accident.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "integrationRef", "mergedSha", "mergedAt", "phaseId"],
+      "properties": {
+        "repository": {
+          "type": "string"
+        },
+        "integrationRef": {
+          "type": "string"
+        },
+        "mergedSha": {
+          "type": "string"
+        },
+        "mergedAt": {
+          "type": "string"
+        },
+        "phaseId": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}