agent-hitch 0.2.9 → 0.2.11

package/dist/src/runs/verifier-diagnostic-supplement.js

@@ -0,0 +1,228 @@
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { openContainedRegularFile, sha256Bytes, statePaths } from "../foundation/index.js";
+import { verifyResultBundleIndex } from "./bundle.js";
+import { loadRunRecord } from "./records.js";
+const DIAGNOSTICS_INDEX_REF = "verifier/diagnostics.json";
+const MAX_INDEX_BYTES = 1024 * 1024;
+const ARTIFACT_NAMES = new Set(["ctrf.json", "test-stdout.txt", "test-stderr.txt", "stdout.txt", "stderr.txt"]);
+export function verifierDiagnosticSupplementRelative(runId, originalIndexSha256) {
+    if (!/^run_[a-f0-9]{32}$/.test(runId) || !/^sha256:[0-9a-f]{64}$/.test(originalIndexSha256)) {
+        throw new TypeError("verifier diagnostic supplement identity is invalid");
+    }
+    return path.join(runId, originalIndexSha256.slice("sha256:".length));
+}
+export function verifierDiagnosticSupplementBase(root) {
+    return path.join(statePaths(root).root, "derived", "verifier-diagnostics");
+}
+export async function loadVerifierDiagnosticSupplement(root, runRoot, runId) {
+    let originalIndex;
+    try {
+        originalIndex = await readContained(runRoot, DIAGNOSTICS_INDEX_REF, MAX_INDEX_BYTES);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const originalIndexSha256 = sha256Bytes(originalIndex);
+    const relative = verifierDiagnosticSupplementRelative(runId, originalIndexSha256);
+    const base = verifierDiagnosticSupplementBase(await canonicalStateRoot(root));
+    let canonicalBase;
+    try {
+        const info = await lstat(base);
+        if (info.isSymbolicLink() || !info.isDirectory())
+            throw new TypeError("verifier diagnostic supplement root is unsafe");
+        canonicalBase = await realpath(base);
+        if (canonicalBase !== path.resolve(base))
+            throw new TypeError("verifier diagnostic supplement root is unsafe");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const manifestRef = path.join(relative, "repair.json").split(path.sep).join("/");
+    let manifestBytes;
+    try {
+        manifestBytes = await readContained(canonicalBase, manifestRef, MAX_INDEX_BYTES);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const manifest = parseVerifierDiagnosticRepairManifest(JSON.parse(manifestBytes.toString("utf8")));
+    const run = await loadRunRecord(runRoot, { verifyTrajectory: false });
+    const parent = run.record.parent;
+    if (manifest.run_id !== runId || !parent || run.record.context.kind !== "benchmark_task"
+        || manifest.parent.eval_id !== parent.eval_id || manifest.parent.trial_id !== parent.trial_id
+        || manifest.parent.attempt !== parent.attempt || manifest.parent.task_id !== run.record.context.task_id) {
+        throw new TypeError("verifier diagnostic repair parent identity mismatch");
+    }
+    const bundle = await verifyResultBundleIndex(runRoot);
+    const bundleIndexSha256 = sha256Bytes(await readContained(runRoot, "bundle.index.json", MAX_INDEX_BYTES));
+    if (manifest.original.bundle_digest !== bundle.bundle_digest
+        || manifest.original.bundle_index_sha256 !== bundleIndexSha256
+        || manifest.original.diagnostics_index_sha256 !== originalIndexSha256) {
+        throw new TypeError("verifier diagnostic repair original bundle identity mismatch");
+    }
+    const expectedSources = sourceIdentitiesFromLegacyIndex(JSON.parse(originalIndex.toString("utf8")));
+    if (JSON.stringify(manifest.source.artifacts) !== JSON.stringify(expectedSources)) {
+        throw new TypeError("verifier diagnostic repair source identity mismatch");
+    }
+    const repairedIndexRef = path.join(relative, DIAGNOSTICS_INDEX_REF).split(path.sep).join("/");
+    const repairedIndex = await readContained(canonicalBase, repairedIndexRef, MAX_INDEX_BYTES);
+    if (sha256Bytes(repairedIndex) !== manifest.repaired.diagnostics_index_sha256) {
+        throw new TypeError("verifier diagnostic repair index digest mismatch");
+    }
+    const repairedValue = JSON.parse(repairedIndex.toString("utf8"));
+    if (repairedValue.schema_version !== "2" || repairedValue.kind !== "verifier-diagnostics"
+        || !Array.isArray(repairedValue.artifacts) || !Array.isArray(repairedValue.losses)
+        || repairedValue.losses.length !== 0) {
+        throw new TypeError("verifier diagnostic repair index is incomplete");
+    }
+    return {
+        directory: path.join(canonicalBase, relative),
+        manifest,
+        repair_sha256: sha256Bytes(manifestBytes),
+    };
+}
+async function canonicalStateRoot(root) {
+    const resolved = path.resolve(root);
+    const info = await lstat(resolved);
+    if (info.isSymbolicLink() || !info.isDirectory())
+        throw new TypeError("Hitch state root is unsafe");
+    const canonical = await realpath(resolved);
+    const canonicalInfo = await lstat(canonical);
+    if (canonicalInfo.isSymbolicLink() || !canonicalInfo.isDirectory())
+        throw new TypeError("Hitch state root is unsafe");
+    return canonical;
+}
+export function sourceIdentitiesFromLegacyIndex(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("verifier diagnostics index is invalid");
+    const index = value;
+    if (index.schema_version !== "1" || index.kind !== "verifier-diagnostics" || !Array.isArray(index.artifacts)) {
+        throw new TypeError("verifier diagnostics repair requires a legacy index");
+    }
+    const seen = new Set();
+    const artifacts = index.artifacts.map((raw) => {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            throw new TypeError("legacy verifier diagnostic artifact is invalid");
+        const artifact = raw;
+        const name = artifact.name;
+        if (typeof name !== "string" || !ARTIFACT_NAMES.has(name) || seen.has(name)
+            || artifact.ref !== `verifier/${name}` || typeof artifact.truncated !== "boolean"
+            || !Number.isSafeInteger(artifact.source_bytes) || Number(artifact.source_bytes) < 0
+            || typeof artifact.source_sha256 !== "string" || !/^sha256:[0-9a-f]{64}$/.test(artifact.source_sha256)) {
+            throw new TypeError("legacy verifier diagnostic artifact identity is invalid");
+        }
+        seen.add(name);
+        return {
+            name: name,
+            bytes: Number(artifact.source_bytes),
+            sha256: artifact.source_sha256,
+        };
+    });
+    return artifacts.sort((left, right) => left.name.localeCompare(right.name));
+}
+export function legacyIndexNeedsDiagnosticRepair(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const index = value;
+    return index.schema_version === "1" && Array.isArray(index.artifacts)
+        && index.artifacts.some((raw) => Boolean(raw && typeof raw === "object" && !Array.isArray(raw) && raw.truncated === true));
+}
+async function readContained(root, relative, maximumBytes) {
+    const opened = await openContainedRegularFile(root, relative, maximumBytes);
+    try {
+        const bytes = Buffer.allocUnsafe(opened.size);
+        let position = 0;
+        while (position < bytes.length) {
+            const read = await opened.handle.read(bytes, position, bytes.length - position, position);
+            if (read.bytesRead === 0)
+                throw new TypeError("verifier diagnostic evidence changed while being read");
+            position += read.bytesRead;
+        }
+        if ((await opened.handle.read(Buffer.allocUnsafe(1), 0, 1, bytes.length)).bytesRead !== 0) {
+            throw new TypeError("verifier diagnostic evidence changed while being read");
+        }
+        await opened.assertUnchanged();
+        return bytes;
+    }
+    finally {
+        await opened.handle.close();
+    }
+}
+function parseVerifierDiagnosticRepairManifest(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("verifier diagnostic repair manifest is invalid");
+    const record = value;
+    exact(record, ["schema_version", "kind", "run_id", "parent", "original", "source", "repaired", "created_at"]);
+    if (record.schema_version !== "1" || record.kind !== "verifier-diagnostics-repair"
+        || typeof record.run_id !== "string" || !/^run_[a-f0-9]{32}$/.test(record.run_id)
+        || typeof record.created_at !== "string" || !Number.isFinite(Date.parse(record.created_at))) {
+        throw new TypeError("verifier diagnostic repair manifest identity is invalid");
+    }
+    const parent = object(record.parent, "verifier diagnostic repair parent");
+    exact(parent, ["eval_id", "trial_id", "attempt", "task_id"]);
+    if (typeof parent.eval_id !== "string" || !/^eval_[a-f0-9]{32}$/.test(parent.eval_id)
+        || typeof parent.trial_id !== "string" || !parent.trial_id || typeof parent.task_id !== "string" || !parent.task_id
+        || !Number.isSafeInteger(parent.attempt) || Number(parent.attempt) < 1)
+        throw new TypeError("verifier diagnostic repair parent is invalid");
+    const original = object(record.original, "verifier diagnostic repair original identity");
+    exact(original, ["bundle_digest", "bundle_index_sha256", "diagnostics_index_sha256"]);
+    const source = object(record.source, "verifier diagnostic repair source");
+    exact(source, ["kind", "relative_trial_directory", "artifacts"]);
+    const repaired = object(record.repaired, "verifier diagnostic repair output");
+    exact(repaired, ["diagnostics_index_sha256"]);
+    for (const digest of [original.bundle_digest, original.bundle_index_sha256, original.diagnostics_index_sha256, repaired.diagnostics_index_sha256]) {
+        if (typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest))
+            throw new TypeError("verifier diagnostic repair digest is invalid");
+    }
+    if (source.kind !== "harbor-trial" || typeof source.relative_trial_directory !== "string"
+        || !validRelativePath(source.relative_trial_directory) || !Array.isArray(source.artifacts)) {
+        throw new TypeError("verifier diagnostic repair source is invalid");
+    }
+    const artifacts = source.artifacts.map((raw) => {
+        const artifact = object(raw, "verifier diagnostic repair source artifact");
+        exact(artifact, ["name", "bytes", "sha256"]);
+        if (typeof artifact.name !== "string" || !ARTIFACT_NAMES.has(artifact.name)
+            || !Number.isSafeInteger(artifact.bytes) || Number(artifact.bytes) < 0
+            || typeof artifact.sha256 !== "string" || !/^sha256:[0-9a-f]{64}$/.test(artifact.sha256)) {
+            throw new TypeError("verifier diagnostic repair source artifact is invalid");
+        }
+        return { name: artifact.name, bytes: Number(artifact.bytes), sha256: artifact.sha256 };
+    });
+    const canonical = [...artifacts].sort((left, right) => left.name.localeCompare(right.name));
+    if (new Set(artifacts.map((entry) => entry.name)).size !== artifacts.length || JSON.stringify(canonical) !== JSON.stringify(artifacts)) {
+        throw new TypeError("verifier diagnostic repair source artifacts are not canonical");
+    }
+    return {
+        schema_version: "1", kind: "verifier-diagnostics-repair", run_id: record.run_id,
+        parent: { eval_id: parent.eval_id, trial_id: parent.trial_id, attempt: Number(parent.attempt), task_id: parent.task_id },
+        original: {
+            bundle_digest: original.bundle_digest,
+            bundle_index_sha256: original.bundle_index_sha256,
+            diagnostics_index_sha256: original.diagnostics_index_sha256,
+        },
+        source: { kind: "harbor-trial", relative_trial_directory: source.relative_trial_directory, artifacts },
+        repaired: { diagnostics_index_sha256: repaired.diagnostics_index_sha256 },
+        created_at: record.created_at,
+    };
+}
+function object(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError(`${label} is invalid`);
+    return value;
+}
+function exact(value, fields) {
+    if (Object.keys(value).some((field) => !fields.includes(field)))
+        throw new TypeError("verifier diagnostic repair has unknown fields");
+}
+function validRelativePath(value) {
+    return value === value.normalize("NFC") && !path.posix.isAbsolute(value) && !value.includes("\\")
+        && value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+//# sourceMappingURL=verifier-diagnostic-supplement.js.map

package/dist/src/runs/verifier-diagnostic-supplement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-diagnostic-supplement.js","sourceRoot":"","sources":["../../../src/runs/verifier-diagnostic-supplement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,CAAC;AACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AAiChH,MAAM,UAAU,oCAAoC,CAAC,KAAa,EAAE,mBAA2B;IAC7F,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,qBAAqB,EAAE,eAAe,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,mBAAmB,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,oCAAoC,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,gCAAgC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACvH,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACjH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,gBAAgB;WACnF,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WAC1F,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1G,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1G,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;WACvD,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,KAAK,iBAAiB;WAC3D,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,KAAK,mBAAmB,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,eAAe,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAC5F,IAAI,aAAa,CAAC,cAAc,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,KAAK,sBAAsB;WACpF,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC;WAC/E,aAAa,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC7C,QAAQ;QACR,aAAa,EAAE,WAAW,CAAC,aAAa,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,aAAa,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACtH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,cAAc,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACjI,MAAM,QAAQ,GAAG,GAA8B,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;eACtE,QAAQ,CAAC,GAAG,KAAK,YAAY,IAAI,EAAE,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,SAAS;eAC9E,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC;eACjF,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;YACL,IAAI,EAAE,IAAyC;YAC/C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;YACpC,MAAM,EAAE,QAAQ,CAAC,aAAuB;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,KAAK,CAAC,cAAc,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;WAChE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAK,GAA+B,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC;AAC5J,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,YAAoB;IAC/E,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;YACvG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,qCAAqC,CAAC,KAAc;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9G,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,6BAA6B;WAC7E,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;WAC9E,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;IAC1E,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;WAChF,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO;WAChH,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IACzF,KAAK,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;IAC1E,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,0BAA0B,EAAE,WAAW,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;IAC9E,KAAK,CAAC,QAAQ,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClJ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,MAAM,CAAC,wBAAwB,KAAK,QAAQ;WACpF,CAAC,iBAAiB,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;QAC3E,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;eACtE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;eACnE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAyC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAgB,EAAE,CAAC;IACxI,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACvI,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QAC/E,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QACxH,QAAQ,EAAE;YACR,aAAa,EAAE,QAAQ,CAAC,aAAuB;YAC/C,mBAAmB,EAAE,QAAQ,CAAC,mBAA6B;YAC3D,wBAAwB,EAAE,QAAQ,CAAC,wBAAkC;SACtE;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,EAAE,SAAS,EAAE;QACtG,QAAQ,EAAE,EAAE,wBAAwB,EAAE,QAAQ,CAAC,wBAAkC,EAAE;QACnF,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IAC5G,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,KAA8B,EAAE,MAAyB;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;AACxI,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WAC5F,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAClG,CAAC"}

package/dist/src/runs/verifier-evidence.js

@@ -4,21 +4,19 @@ import { validateRelativePath } from "../domain/index.js";
 import { HitchError, PROVIDER_ENVIRONMENT_NAMES, credentialValuesFromEnv, openContainedRegularFile, safeDiagnosticMessage, sha256Bytes, statePaths, } from "../foundation/index.js";
 import { verifyResultBundleIndex } from "./bundle.js";
 import { loadRunRecord } from "./records.js";
+import { readVerifierDiagnosticStorage, VERIFIER_DIAGNOSTIC_ARTIFACT_NAMES, } from "./verifier-diagnostic-storage.js";
 import { sanitizeVerifierJson, sanitizeVerifierText } from "./verifier-evidence-redaction.js";
+import { loadVerifierDiagnosticSupplement } from "./verifier-diagnostic-supplement.js";
 import { loadStructuredVerifierEvidence } from "./verifier-structured-evidence.js";
 export const MAX_VERIFIER_RESULT_BYTES = 1024 * 1024;
 export const MAX_VERIFIER_ARTIFACT_OUTPUT_BYTES = 64 * 1024;
-const DIAGNOSTICS_INDEX_REF = "verifier/diagnostics.json";
-const ARTIFACT_NAMES = [
-    "ctrf.json", "test-stdout.txt", "test-stderr.txt", "stdout.txt", "stderr.txt",
-];
+export const MAX_VERIFIER_DIAGNOSTIC_PAGE_BYTES = 64 * 1024;
 const JSON_DIAGNOSTIC_REFS = [
     "verifier/infrastructure-error.json",
     "verifier/infrastructure-retry-history.json",
 ];
 const TRUNCATION_MARKER = "\n[... verifier artifact truncated ...]\n";
 const MAX_EVAL_IDENTITY_BYTES = 16 * 1024 * 1024;
-const MAX_PERSISTED_VERIFIER_ARTIFACT_BYTES = 16 * 1024 * 1024;
 export async function loadVerifierEvidence(root, runId, options = {}) {
     if (!/^run_[a-f0-9]{32}$/.test(runId))
         throw new TypeError(`invalid run ID: ${runId}`);
@@ -76,7 +74,8 @@ export async function loadVerifierEvidence(root, runId, options = {}) {
     }
     let diagnostics;
     try {
-        diagnostics = await loadDiagnostics(runRoot, maxArtifactBytes, credentialValues, redactions);
+        const supplement = await loadVerifierDiagnosticSupplement(root, runRoot, runId);
+        diagnostics = await loadDiagnostics(runRoot, supplement?.directory ?? runRoot, maxArtifactBytes, credentialValues, redactions);
     }
     catch (error) {
         corrupt = true;
@@ -144,11 +143,103 @@ export async function loadVerifierEvidence(root, runId, options = {}) {
         ...(redactions.size === 0 ? {} : { redactions: canonicalCounts(redactions) }),
     };
 }
-async function loadDiagnostics(runRoot, maxBytes, credentialValues, redactions) {
-    const indexFile = path.join(runRoot, ...DIAGNOSTICS_INDEX_REF.split("/"));
-    const artifacts = await exists(indexFile)
-        ? await indexedArtifacts(runRoot, maxBytes, credentialValues, redactions)
-        : await legacyArtifacts(runRoot, maxBytes, credentialValues, redactions);
+export async function loadVerifierDiagnosticPage(root, runId, name, options = {}) {
+    if (!/^run_[a-f0-9]{32}$/.test(runId))
+        throw new TypeError(`invalid run ID: ${runId}`);
+    if (!VERIFIER_DIAGNOSTIC_ARTIFACT_NAMES.includes(name))
+        throw new TypeError(`invalid verifier diagnostic artifact: ${name}`);
+    const offset = options.offset ?? 0;
+    if (!Number.isSafeInteger(offset) || offset < 0)
+        throw new TypeError("verifier diagnostic offset is invalid");
+    const maxBytes = options.maxBytes ?? MAX_VERIFIER_DIAGNOSTIC_PAGE_BYTES;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 4 || maxBytes > MAX_VERIFIER_DIAGNOSTIC_PAGE_BYTES) {
+        throw new TypeError("verifier diagnostic page limit is invalid");
+    }
+    const runDirectory = path.join(statePaths(root).runs, runId);
+    const runRoot = await safeRunRoot(runDirectory, runId);
+    let loaded;
+    try {
+        loaded = await loadRunRecord(runDirectory, { verifyTrajectory: false });
+        if (loaded.record_status === "corrupt" || loaded.record.run_id !== runId)
+            throw new TypeError("run record integrity is corrupt");
+        if (await exists(path.join(runDirectory, "bundle.index.json")))
+            await verifyResultBundleIndex(runDirectory);
+    }
+    catch (error) {
+        throw new HitchError(`run ${runId} record is corrupt`, { code: "verifier_evidence_corrupt", exitCode: 3, cause: error });
+    }
+    const parentIssue = await verifierParentIssue(root, loaded.record);
+    if (parentIssue) {
+        throw new HitchError(`run ${runId} verifier parent is corrupt: ${parentIssue}`, {
+            code: "verifier_evidence_corrupt", exitCode: 3,
+        });
+    }
+    const credentialValues = await runCredentialValues(runRoot, loaded.record, options.env ?? process.env);
+    let source;
+    try {
+        const supplement = await loadVerifierDiagnosticSupplement(root, runRoot, runId);
+        const stored = await readVerifierDiagnosticStorage(supplement?.directory ?? runRoot, credentialValues);
+        const found = stored.artifacts.find((artifact) => artifact.name === name);
+        if (!found)
+            throw diagnosticNotFound(name);
+        source = found;
+    }
+    catch (error) {
+        if (error instanceof HitchError)
+            throw error;
+        throw new HitchError(`verifier diagnostic ${name} is corrupt`, {
+            code: "verifier_evidence_corrupt", exitCode: 3, cause: error,
+        });
+    }
+    if (options.expectedSha256 !== undefined && options.expectedSha256 !== source.sha256) {
+        throw new HitchError(`verifier diagnostic ${name} changed`, {
+            code: "verifier_diagnostic_version_mismatch", exitCode: 3,
+        });
+    }
+    const artifact = {
+        name,
+        media_type: source.mediaType,
+        bytes: source.bytes.length,
+        sha256: source.sha256,
+        source_complete: source.sourceComplete,
+        ...(source.lossReason ? { loss_reason: source.lossReason } : {}),
+    };
+    if (!source.sourceComplete) {
+        if (offset !== 0)
+            throw new TypeError("unavailable verifier diagnostic requires offset zero");
+        return {
+            schema_version: "1", kind: "verifier-diagnostic-page", run_id: runId, artifact,
+            page: { offset: 0, bytes: 0, text: "", eof: true },
+        };
+    }
+    if (offset > source.bytes.length || !isUtf8Boundary(source.bytes, offset)) {
+        throw new TypeError("verifier diagnostic offset is invalid");
+    }
+    let end = Math.min(source.bytes.length, offset + maxBytes);
+    while (end > offset && end < source.bytes.length && !isUtf8Boundary(source.bytes, end))
+        end -= 1;
+    if (end === offset && end < source.bytes.length)
+        throw new TypeError("verifier diagnostic page limit is too small");
+    const page = source.bytes.subarray(offset, end);
+    const eof = end === source.bytes.length;
+    return {
+        schema_version: "1", kind: "verifier-diagnostic-page", run_id: runId, artifact,
+        page: {
+            offset,
+            bytes: page.length,
+            text: page.toString("utf8"),
+            eof,
+            ...(eof ? {} : { next_offset: end }),
+        },
+    };
+}
+async function loadDiagnostics(runRoot, artifactRoot, maxBytes, credentialValues, redactions) {
+    const stored = await readVerifierDiagnosticStorage(artifactRoot, credentialValues);
+    mergeCounts(redactions, stored.redactions);
+    const artifacts = stored.artifacts.map((artifact) => {
+        const bounded = truncate(artifact.bytes, maxBytes);
+        return excerpt(artifact.name, artifact.mediaType, artifact.bytes.length, artifact.sha256, !artifact.sourceComplete || bounded.truncated, bounded.bytes);
+    });
     const ctrf = artifacts.find((artifact) => artifact.name === "ctrf.json");
     const stdout = artifacts.filter((artifact) => artifact.name === "test-stdout.txt" || artifact.name === "stdout.txt");
     const stderr = artifacts.filter((artifact) => artifact.name === "test-stderr.txt" || artifact.name === "stderr.txt");
@@ -164,95 +255,13 @@ async function loadDiagnostics(runRoot, maxBytes, credentialValues, redactions)
         ...(retryHistory === undefined ? {} : { retry_history: [retryHistory] }),
     };
 }
-async function indexedArtifacts(runRoot, maxBytes, credentialValues, redactions) {
-    const indexBytes = await secureRead(runRoot, DIAGNOSTICS_INDEX_REF, MAX_VERIFIER_RESULT_BYTES);
-    const index = asRecord(JSON.parse(indexBytes.toString("utf8")), "verifier diagnostics index");
-    if (index.schema_version !== "1" || index.kind !== "verifier-diagnostics" || !Array.isArray(index.artifacts) || !Array.isArray(index.redactions)) {
-        throw new TypeError("verifier diagnostics index is invalid");
-    }
-    const seen = new Set();
-    for (const rule of index.redactions) {
-        const parsed = asRecord(rule, "verifier diagnostics redaction");
-        exactFields(parsed, ["rule_id", "count"], "verifier diagnostics redaction");
-        if (typeof parsed.rule_id !== "string" || !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(parsed.rule_id)
-            || !Number.isSafeInteger(parsed.count) || Number(parsed.count) < 1) {
-            throw new TypeError("verifier diagnostics redaction is invalid");
-        }
-        if (seen.has(`redaction:${parsed.rule_id}`))
-            throw new TypeError("verifier diagnostics redactions are duplicated");
-        seen.add(`redaction:${parsed.rule_id}`);
-        increment(redactions, parsed.rule_id, Number(parsed.count));
-    }
-    const result = [];
-    for (const raw of index.artifacts) {
-        const artifact = asRecord(raw, "verifier diagnostic artifact");
-        exactFields(artifact, [
-            "name", "ref", "media_type", "source_bytes", "source_sha256", "bytes", "sha256",
-            "stored_bytes", "stored_sha256", "truncated",
-        ], "verifier diagnostic artifact");
-        const name = artifact.name;
-        if (!ARTIFACT_NAMES.includes(name) || seen.has(name) || artifact.ref !== `verifier/${name}`) {
-            throw new TypeError("verifier diagnostic artifact identity is invalid");
-        }
-        seen.add(name);
-        const mediaType = name === "ctrf.json" ? "application/json" : "text/plain";
-        if (artifact.media_type !== mediaType)
-            throw new TypeError("verifier diagnostic artifact media type is invalid");
-        const persistedBytes = nonNegativeInteger(artifact.bytes, "verifier diagnostic bytes");
-        const persistedDigest = sha256Value(artifact.sha256, "verifier diagnostic digest");
-        nonNegativeInteger(artifact.source_bytes, "source verifier diagnostic bytes");
-        sha256Value(artifact.source_sha256, "source verifier diagnostic digest");
-        const storedBytes = nonNegativeInteger(artifact.stored_bytes, "stored verifier diagnostic bytes");
-        const storedDigest = sha256Value(artifact.stored_sha256, "stored verifier diagnostic digest");
-        if (typeof artifact.truncated !== "boolean" || storedBytes > MAX_PERSISTED_VERIFIER_ARTIFACT_BYTES) {
-            throw new TypeError("stored verifier diagnostic exceeds its persistence limit");
-        }
-        const stored = await secureRead(runRoot, String(artifact.ref), MAX_PERSISTED_VERIFIER_ARTIFACT_BYTES);
-        if (stored.length !== storedBytes || sha256Bytes(stored) !== storedDigest)
-            throw new TypeError("stored verifier diagnostic integrity mismatch");
-        if (artifact.truncated === false && (persistedBytes !== storedBytes || persistedDigest !== storedDigest)) {
-            throw new TypeError("complete verifier diagnostic metadata mismatch");
-        }
-        const full = sanitizedArtifact(stored, mediaType, artifact.truncated === false, credentialValues, redactions);
-        const bounded = truncate(full, maxBytes);
-        result.push(excerpt(name, mediaType, full.length, sha256Bytes(full), artifact.truncated === true || bounded.truncated, bounded.bytes));
-    }
-    return result;
+function diagnosticNotFound(name) {
+    return new HitchError(`verifier diagnostic not found: ${name}`, {
+        code: "verifier_diagnostic_not_found", exitCode: 3,
+    });
 }
-async function legacyArtifacts(runRoot, maxBytes, credentialValues, redactions) {
-    const result = [];
-    for (const name of ARTIFACT_NAMES) {
-        const ref = `verifier/${name}`;
-        if (!await exists(path.join(runRoot, ...ref.split("/"))))
-            continue;
-        let raw;
-        try {
-            raw = await secureRead(runRoot, ref, MAX_PERSISTED_VERIFIER_ARTIFACT_BYTES);
-        }
-        catch (error) {
-            if (error?.message === "contained file exceeds its limit")
-                continue;
-            throw error;
-        }
-        const mediaType = name === "ctrf.json" ? "application/json" : "text/plain";
-        const full = sanitizedArtifact(raw, mediaType, mediaType === "application/json", credentialValues, redactions);
-        const stored = truncate(full, maxBytes);
-        result.push(excerpt(name, mediaType, full.length, sha256Bytes(full), stored.truncated, stored.bytes));
-    }
-    return result;
-}
-function sanitizedArtifact(stored, mediaType, parseJson, credentials, redactions) {
-    if (mediaType === "application/json" && parseJson) {
-        const parsed = JSON.parse(stored.toString("utf8"));
-        if (!isJsonValue(parsed))
-            throw new TypeError("CTRF artifact is not JSON data");
-        const safe = sanitizeVerifierJson(parsed, credentials);
-        mergeCounts(redactions, safe.redactions);
-        return Buffer.from(JSON.stringify(safe.value), "utf8");
-    }
-    const safe = sanitizeVerifierText(stored.toString("utf8"), credentials);
-    mergeCounts(redactions, safe.redactions);
-    return Buffer.from(safe.text, "utf8");
+function isUtf8Boundary(value, offset) {
+    return offset === 0 || offset === value.length || (value[offset] & 0xc0) !== 0x80;
 }
 function excerpt(name, mediaType, bytes, digest, truncated, stored) {
     const common = { name, media_type: mediaType, bytes, sha256: digest, truncated: truncated === true };
@@ -351,10 +360,18 @@ async function secureRead(root, ref, maxBytes) {
     const relative = validateRelativePath(ref, "verifier evidence ref");
     const opened = await openContainedRegularFile(root, relative, maxBytes);
     try {
-        const bytes = await opened.handle.readFile();
-        await opened.assertUnchanged();
-        if (bytes.length !== opened.size)
+        const bytes = Buffer.allocUnsafe(opened.size);
+        let position = 0;
+        while (position < bytes.length) {
+            const read = await opened.handle.read(bytes, position, bytes.length - position, position);
+            if (read.bytesRead === 0)
+                throw new TypeError(`${path.basename(ref)} changed while being read`);
+            position += read.bytesRead;
+        }
+        if ((await opened.handle.read(Buffer.allocUnsafe(1), 0, 1, bytes.length)).bytesRead !== 0) {
             throw new TypeError(`${path.basename(ref)} changed while being read`);
+        }
+        await opened.assertUnchanged();
         return bytes;
     }
     finally {
@@ -400,27 +417,11 @@ function positiveLimit(value, label) {
         throw new TypeError(`${label} limit is invalid`);
     return value;
 }
-function nonNegativeInteger(value, label) {
-    if (!Number.isSafeInteger(value) || Number(value) < 0)
-        throw new TypeError(`${label} is invalid`);
-    return Number(value);
-}
-function sha256Value(value, label) {
-    if (typeof value !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value))
-        throw new TypeError(`${label} is invalid`);
-    return value;
-}
 function asRecord(value, label) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new TypeError(`${label} must be an object`);
     return value;
 }
-function exactFields(record, allowed, label) {
-    const fields = new Set(allowed);
-    const unexpected = Object.keys(record).find((field) => !fields.has(field));
-    if (unexpected)
-        throw new TypeError(`${label} has unknown field: ${unexpected}`);
-}
 function isJsonValue(value) {
     if (value === null || typeof value === "string" || typeof value === "boolean")
         return true;