ai-foreman 1.7.28 → 2.0.0

package/dist/markers.d.ts

@@ -1,6 +1,7 @@
 /**
- * STEP_STATUS protocol strings. Extracted from foreman.ts so tests can import
+ * Native operation instructions. Extracted from foreman.ts so tests can import
  * them without pulling in @clack/prompts (which requires Node >=20 for styleText).
  */
-export declare const MARKER_SPEC = "End EVERY turn with exactly one marker line as the LAST line, nothing after it:\n  STEP_STATUS: done | ticket=\"T001\" summary=\"what you just did\" next=\"the next ticket or step\"\n  STEP_STATUS: blocked | ticket=\"T001\" reason=\"why you cannot proceed\"\n  STEP_STATUS: plan_complete | ticket=\"T001\" summary=\"what you just did\"\n  STEP_STATUS: needs_input | ticket=\"T001\" question=\"your question for the user\" choices=\"Option A|Option B|Option C\"\nUse \"done\" after finishing a ticket or step when more remain, \"plan_complete\" after\nthe final ticket or step, \"blocked\" if you cannot proceed without help, and \"needs_input\"\nif you need the user to make a decision before continuing.\nAlways include the assigned ticket=\"<ticket-id>\" in every work response marker, including needs_input, when working from a ticket queue. Never substitute another ticket.\nAfter \"done\" or \"plan_complete\", foreman may run a QA pass on your work \u2014 expect a\nfollow-up instruction asking you to triple-check accuracy, tests, and ticket satisfaction.";
-export declare const QA_MARKER_SPEC = "End EVERY turn with exactly one marker line as the LAST line, nothing after it:\n  STEP_STATUS: qa_pass | summary=\"confirmed everything checks out\"\n  RAFI_QA_FAILURE_REPORT_START\n  {\"version\":1,\"summary\":\"...\",\"checks_run\":[...],\"findings\":[...],\"observations\":[...]}\n  RAFI_QA_FAILURE_REPORT_END\n  STEP_STATUS: qa_fail | issues=\"short plain-text synopsis\"\n  STEP_STATUS: blocked | reason=\"why QA itself cannot proceed\"\n  STEP_STATUS: needs_input | question=\"...\" choices=\"...\"";
+/** Active work protocol; legacy status parsers remain historical readers. */
+export declare const MARKER_SPEC = "Return one work-report result through the configured native JSON schema. result.kind completed is your claim that the assigned work is finished; do not add a duplicate status field. The payload contains disposition modified or already-satisfied, truthful evidence, coverage when a verification contract is supplied (otherwise null), and graphMaintenance (null unless a meaningful indexed change occurred). Blocked work and questions use their own result alternatives. Never claim completion merely because a turn ended. Include bounded continuity when requested. The host still requires independent QA before completing a ticket.";
+export declare const QA_MARKER_SPEC = "Return one qa-verdict result through the configured native JSON schema. A completed verdict payload is either passed with independent coverage, or failed with the complete structured failure report and coverage. Report blocked work or a question explicitly. A pass cannot contain blocking findings; preserve all failures and uncertainties. Include required continuity in the same object.";

package/dist/markers.js

@@ -1,23 +1,7 @@
 /**
- * STEP_STATUS protocol strings. Extracted from foreman.ts so tests can import
+ * Native operation instructions. Extracted from foreman.ts so tests can import
  * them without pulling in @clack/prompts (which requires Node >=20 for styleText).
  */
-export const MARKER_SPEC = `End EVERY turn with exactly one marker line as the LAST line, nothing after it:
-  STEP_STATUS: done | ticket="T001" summary="what you just did" next="the next ticket or step"
-  STEP_STATUS: blocked | ticket="T001" reason="why you cannot proceed"
-  STEP_STATUS: plan_complete | ticket="T001" summary="what you just did"
-  STEP_STATUS: needs_input | ticket="T001" question="your question for the user" choices="Option A|Option B|Option C"
-Use "done" after finishing a ticket or step when more remain, "plan_complete" after
-the final ticket or step, "blocked" if you cannot proceed without help, and "needs_input"
-if you need the user to make a decision before continuing.
-Always include the assigned ticket="<ticket-id>" in every work response marker, including needs_input, when working from a ticket queue. Never substitute another ticket.
-After "done" or "plan_complete", foreman may run a QA pass on your work — expect a
-follow-up instruction asking you to triple-check accuracy, tests, and ticket satisfaction.`;
-export const QA_MARKER_SPEC = `End EVERY turn with exactly one marker line as the LAST line, nothing after it:
-  STEP_STATUS: qa_pass | summary="confirmed everything checks out"
-  RAFI_QA_FAILURE_REPORT_START
-  {"version":1,"summary":"...","checks_run":[...],"findings":[...],"observations":[...]}
-  RAFI_QA_FAILURE_REPORT_END
-  STEP_STATUS: qa_fail | issues="short plain-text synopsis"
-  STEP_STATUS: blocked | reason="why QA itself cannot proceed"
-  STEP_STATUS: needs_input | question="..." choices="..."`;
+/** Active work protocol; legacy status parsers remain historical readers. */
+export const MARKER_SPEC = `Return one work-report result through the configured native JSON schema. result.kind completed is your claim that the assigned work is finished; do not add a duplicate status field. The payload contains disposition modified or already-satisfied, truthful evidence, coverage when a verification contract is supplied (otherwise null), and graphMaintenance (null unless a meaningful indexed change occurred). Blocked work and questions use their own result alternatives. Never claim completion merely because a turn ended. Include bounded continuity when requested. The host still requires independent QA before completing a ticket.`;
+export const QA_MARKER_SPEC = `Return one qa-verdict result through the configured native JSON schema. A completed verdict payload is either passed with independent coverage, or failed with the complete structured failure report and coverage. Report blocked work or a question explicitly. A pass cannot contain blocking findings; preserve all failures and uncertainties. Include required continuity in the same object.`;

package/dist/probeIpc.d.ts

@@ -0,0 +1,14 @@
+import { type HostIpc } from "rafi-spec";
+type ProbeTerminal = Extract<HostIpc, {
+    kind: "rafi-probe-result" | "rafi-probe-spawn-error";
+}>;
+/** One registered helper may publish one terminal result. Identical delivery is idempotent. */
+export declare class ProbeIpcTracker {
+    private readonly id;
+    private readonly pid;
+    private registered;
+    terminal?: ProbeTerminal;
+    constructor(id: string, pid: number | undefined);
+    accept(raw: unknown): HostIpc | "conflict" | undefined;
+}
+export {};

package/dist/probeIpc.js

@@ -0,0 +1,29 @@
+import { parseHostIpc } from "rafi-spec";
+/** One registered helper may publish one terminal result. Identical delivery is idempotent. */
+export class ProbeIpcTracker {
+    id;
+    pid;
+    registered = false;
+    terminal;
+    constructor(id, pid) {
+        this.id = id;
+        this.pid = pid;
+    }
+    accept(raw) {
+        const message = parseHostIpc(raw);
+        if (!message || !("id" in message) || message.id !== this.id || message.pid !== this.pid)
+            return;
+        if (message.kind === "rafi-probe-registered") {
+            if (this.registered)
+                return;
+            this.registered = true;
+            return message;
+        }
+        if (!this.registered || (message.kind !== "rafi-probe-result" && message.kind !== "rafi-probe-spawn-error"))
+            return;
+        if (this.terminal)
+            return JSON.stringify(this.terminal) === JSON.stringify(message) ? undefined : "conflict";
+        this.terminal = message;
+        return message;
+    }
+}

package/dist/qaBuildGate.d.ts

@@ -1,9 +1,30 @@
 import type { BuilderAdapter, TurnResult } from "./adapters/types.js";
 import type { QaSessionHandle } from "./qaReview.js";
+import { resolveEffectiveQaConfiguration } from "./qaEffectiveConfig.js";
 /** A received response missing only continuity metadata is a bounded format defect. */
 export declare function preparationTurnPayload(turn: TurnResult): {
     text: string;
     formatErrors: string[];
 };
+/**
+ * The selected QA bundle is already injected as immutable system context for
+ * the isolated provider session.  Repeat only its identity here: the exact
+ * requirements remain in the authoritative inventory, while repeating full
+ * rules and skill bodies in every operation wastes context and makes native
+ * structured submission needlessly fragile.
+ */
+export declare function preparationConfigurationReference(effective: ReturnType<typeof resolveEffectiveQaConfiguration>): {
+    digest: string;
+    configRoot: string;
+    roleSource: "compiled" | "library" | "fallback";
+    checklistDigest: string;
+    qaRulesDigest: string;
+    builderRulesDigest: string;
+    skills: {
+        name: string;
+        path: string;
+        digest: string;
+    }[];
+};
 /** Shared by ordinary, branch, synthetic, remediation and Manager followups. */
 export declare function ensureBuilderContract(projectDir: string, runId: string, workId: string, workspace: string, builder: BuilderAdapter, qaFactory?: (cwd: string) => Promise<QaSessionHandle>): Promise<string>;

package/dist/qaBuildGate.js

@@ -1,3 +1,5 @@
+import { operationPayload } from "./structuredOperation.js";
+import { loadGraphConfig } from "./graph/config.js";
 import { resolveQaPreparationConfig } from "./qaPreparationPolicy.js";
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync } from "node:fs";
@@ -10,11 +12,12 @@ import { checkQaPrerequisites } from "./qaPrerequisites.js";
 import { OperationDeadline } from "./util/deadline.js";
 import { sendPreparationGraphTurn } from "./graph/preparation.js";
 import { withGraphDerivedAccess } from "./graph/derived.js";
+import { assessmentOutput, challengeOutput, depthOutput, draftOutput } from "rafi-spec";
 import { WorkflowDb } from "./workflowDb.js";
 import { createRoleBuilder, readOnlyPermissionConfig } from "./agentRun.js";
 import { captureBuildSource, assertBuildAssignmentReconciled } from "./buildAssignment.js";
 import { createDisposableQaSnapshotAsync } from "./qaSnapshot.js";
-import { allocateStableCheckIds, authoritativeInventory, bindUniqueBaselineCheckIds, contractDigest, mapSnapshotWorkingDirectories, normalizeSnapshotPaths, renderVerificationContract, rewriteProviderHostScopeChecks } from "./qaVerificationContract.js";
+import { allocateStableCheckIds, authoritativeInventory, bindUniqueBaselineCheckIds, contractDigest, ensureHostScopeCheck, mapSnapshotWorkingDirectories, normalizeSnapshotPaths, renderVerificationContract } from "./qaVerificationContract.js";
 import { resolveEffectiveQaConfiguration } from "./qaEffectiveConfig.js";
 import { prepareVerificationContract } from "./qaPreparation.js";
 import { qaHostGraphFact } from "./qaHostFacts.js";
@@ -23,6 +26,7 @@ import { BUILDER_WORK_COVERAGE_INSTRUCTIONS } from "./qaContractCoverage.js";
 import { renderBuildWorkContext } from "./buildWorkContext.js";
 import { compareContractInputs } from "./qaContractFreshness.js";
 import { readBuildRuns } from "./buildRuns.js";
+import { normalizeGraphQaChecks } from "./hostGraphApplicability.js";
 /** A received response missing only continuity metadata is a bounded format defect. */
 export function preparationTurnPayload(turn) {
     const formatErrors = turn.continuityErrors ?? [];
@@ -31,6 +35,24 @@ export function preparationTurnPayload(turn) {
         formatErrors,
     };
 }
+/**
+ * The selected QA bundle is already injected as immutable system context for
+ * the isolated provider session.  Repeat only its identity here: the exact
+ * requirements remain in the authoritative inventory, while repeating full
+ * rules and skill bodies in every operation wastes context and makes native
+ * structured submission needlessly fragile.
+ */
+export function preparationConfigurationReference(effective) {
+    return {
+        digest: effective.digest,
+        configRoot: effective.configRoot,
+        roleSource: effective.roleSource,
+        checklistDigest: contractDigest("input-checklist", effective.checklist),
+        qaRulesDigest: contractDigest("qa-rules", effective.qaRules),
+        builderRulesDigest: contractDigest("builder-rules", effective.builderRules),
+        skills: effective.skills.map(skill => ({ name: skill.name, path: skill.path, digest: skill.digest })),
+    };
+}
 /** Shared by ordinary, branch, synthetic, remediation and Manager followups. */
 export async function ensureBuilderContract(projectDir, runId, workId, workspace, builder, qaFactory) {
     return withGraphDerivedAccess([], () => ensureBuilderContractWithProvenance(projectDir, runId, workId, workspace, builder, qaFactory));
@@ -59,6 +81,9 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
         if (!store.eventRecord(configurationEvent))
             store.event(runId, workId, configurationEvent, "effective-preparation-configuration", { policy, effectiveDigest: effective.digest, configRoot: effective.configRoot, roleSource: effective.roleSource, provider: builder.agent, capabilities: builder.contractCapabilities?.() ?? null, finalReviewEnabled: db.getRun(runId)?.state?.qaEnabled ?? null });
         const inputs = [
+            { id: "communication-contract", kind: "policy", reference: "structured-provider-output-v1", digest: contractDigest("communication-contract", {
+                    protocolVersion: 1, hostValidation: "typed-invariants-v1", schemas: [draftOutput, depthOutput, assessmentOutput, challengeOutput].map(output => ({ operation: output.operation, version: output.schemaVersion, digest: output.schemaDigest })),
+                }), authority: "planner-policy", revision: "1", availability: "available" },
             { id: "admitted-ticket", kind: "ticket", reference: admission.assignmentId, digest: contractDigest("input-ticket", ticket), authority: "approved-scope", revision: admission.scopeRevision, availability: "available" },
             { id: "project-checklist", kind: "checklist", reference: "tickets.build.validation_checklist", digest: contractDigest("input-checklist", effective.checklist), authority: "project-rule", revision: "current", availability: "available" },
             { id: "effective-rules", kind: "rules", reference: effective.configRoot, digest: effective.digest, authority: "project-rule", revision: "current", availability: "available" },
@@ -107,6 +132,8 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
                 const qaHead = db.qaTicketHead(runId, workId);
                 if (["completed", "waived", "finalizing", "turn-intended", "turn-uncertain", "remediation-intended", "remediation-uncertain"].includes(qaHead.state))
                     throw new Error("Active or finalized QA authority requires explicit recovery/reopen before contract amendment");
+                if (!priorBudget)
+                    throw new Error("Retained contract lacks its preparation budget; explicit recovery is required before amendment");
                 const budget = priorBudget;
                 if (retainedIntent?.inputDigest !== inputDigest || retainedIntent.predecessorDigest !== old.contentDigest)
                     store.beginAmendment(budget, inventory, { reason: `Canonical authorized inputs changed: ${[...comparison.changed, ...comparison.unavailable].join(", ") || "inputs reverted during amendment"}`, inputDigest, predecessorDigest: old.contentDigest });
@@ -129,7 +156,14 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
             provider: builder.agent,
             store, now: Date.now, hostFacts: `${qaHostGraphFact(projectDir)}\n${deliveryFact}\nHost-owned baseline fact: Rafi captured the complete preimplementation per-file path manifest and will perform the exact unchanged-file and scope comparison. Its digest is ${preimplementationPathManifestDigest}. Do not require the provider to receive or reproduce the raw manifest; cite the retained host-preimplementation-source observation and assess the host comparison result instead. Do not author a provider-executed check for Rafi's host postimplementation path manifest, complete changed-path inventory, or unchanged-file comparison; Rafi performs that comparison outside the provider snapshot. Ordinary approved product paths, exports, and tests are not a material QA concern merely because the provider cannot prove whether they were present before implementation; Rafi owns that comparison. Do not reconstruct or disclose the full baseline. For current-branch additive tickets, a provider-authored or inferred request to test the branch with an already-completed sibling feature removed is not an applicable requirement when the approved scope says not to remove or reconstruct that sibling; verify the ticket's own behavior and tests against the shared baseline instead. Treat sibling-absence testing as binding only when the user explicitly approved that absence requirement. Escalate only an actual host-observed out-of-scope, destructive, protected-file, or requirement-relevant change.`,
             normalizeDraft: (draft, response) => {
-                const normalized = rewriteProviderHostScopeChecks(bindUniqueBaselineCheckIds(allocateStableCheckIds(draft)), hostBaseline.id);
+                // The dispatch already retains the selected contract digest. Do not
+                // recursively embed its validator/schema in every evidence summary.
+                const { output, ...providerReceipt } = response;
+                const investigationEvidence = store.putArtifact("investigation-evidence", {
+                    ...providerReceipt,
+                    ...(output ? { selectedContract: { operation: output.operation, schemaVersion: output.schemaVersion, schemaDigest: output.schemaDigest } } : {}),
+                });
+                const normalized = allocateStableCheckIds(bindUniqueBaselineCheckIds(normalizeGraphQaChecks(ensureHostScopeCheck(draft, hostBaseline.id), loadGraphConfig(projectDir).enabled)));
                 if (!normalized.baseline.some(observation => observation.id === hostBaseline.id))
                     normalized.baseline.unshift(structuredClone(hostBaseline));
                 for (const check of normalized.checks)
@@ -142,7 +176,7 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
                     observation.sourceDigest = source.digest;
                     observation.observedAt = new Date().toISOString();
                     observation.phase = "preimplementation-investigation";
-                    observation.evidenceDigest = store.putArtifact("baseline-observation", { observation: original, sourceDigest: source.digest, operationId: response.operationId, sessionId: response.sessionId, providerReceipt: store.putArtifact("investigation-evidence", response) });
+                    observation.evidenceDigest = store.putArtifact("baseline-observation", { observation: original, sourceDigest: source.digest, operationId: response.operationId, sessionId: response.sessionId, providerReceipt: investigationEvidence });
                 }
                 for (const evidence of normalized.preparationEvidence) {
                     evidence.operationId = response.operationId;
@@ -150,8 +184,10 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
                     delete evidence.graphReceiptRefs;
                     if (response.graphReceiptRefs?.length)
                         evidence.graphReceiptRefs = [...response.graphReceiptRefs];
-                    evidence.evidenceDigest = store.putArtifact("investigation-evidence", response);
+                    evidence.evidenceDigest = investigationEvidence;
                     for (const reference of evidence.references) {
+                        if (response.workspacePaths && Object.hasOwn(response.workspacePaths, reference.path))
+                            reference.path = response.workspacePaths[reference.path];
                         let path;
                         try {
                             path = realpathSync(resolve(workspace, reference.path));
@@ -182,7 +218,7 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
                 const compared = compareContractInputs(candidate, inputs.map(input => input.id === "effective-rules" ? { ...input, digest: current.digest } : input.id === "project-checklist" ? { ...input, digest: contractDigest("input-checklist", current.checklist) } : input.id === "preimplementation-source" ? { ...input, digest: currentSource.digest, revision: currentSource.head } : input));
                 return !compared.changed.length && !compared.unavailable.length;
             },
-            dispatch: async (phase, instruction, operationId, remainingMs) => new OperationDeadline("QA preparation operation", remainingMs).run(async () => {
+            dispatch: async (phase, instruction, operationId, remainingMs, output) => new OperationDeadline("QA preparation operation", remainingMs).run(async () => {
                 const started = performance.now();
                 const remaining = () => {
                     const value = remainingMs - (performance.now() - started);
@@ -194,14 +230,14 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
                 if (phase === "planner") {
                     const role = await createRoleBuilder({ projectDir: workspace, configRoot: projectDir, role: "planner", label: "QA depth assessment", sandboxMode: "read-only", permissionConfig: readOnlyPermissionConfig(), yes: true, allowSwitch: false });
                     try {
-                        const turn = await sendPreparationGraphTurn(role.builder, `This is a read-only QA planning subturn, not Builder work. Do not implement anything, edit files, run project tests, or describe a TDD implementation plan. Your response must begin with RAFI_QA_DEPTH_START and contain only the requested depth JSON, ending with RAFI_QA_DEPTH_END.\n${instruction}\nFrozen admitted work definition: ${JSON.stringify(ticket)}\nOriginal approved plan context: ${JSON.stringify(planInput?.plan ?? null)}\nFrozen effective configuration: ${JSON.stringify(effective)}`, { phase, projectDir, workspace, sourceRef: before.digest, runId, workId, operationId, remainingMs: remaining() });
+                        const turn = await sendPreparationGraphTurn(role.builder, `This is a read-only QA planning subturn, not Builder work. Do not implement anything, edit files, run project tests, or describe a TDD implementation plan. Return the requested native depth result.\n${instruction}\nFrozen admitted work definition: ${JSON.stringify(ticket)}\nOriginal approved plan context: ${JSON.stringify(planInput?.plan ?? null)}\nFrozen effective configuration reference (authoritative requirements are in the candidate): ${JSON.stringify(preparationConfigurationReference(effective))}`, { phase, projectDir, workspace, sourceRef: before.digest, runId, workId, operationId, remainingMs: remaining(), output });
                         store.event(runId, workId, `${operationId}:raw`, "preparation-provider-return", turn);
                         if (captureBuildSource(workspace).contentDigest !== before.contentDigest)
                             throw new Error("Product source changed during confined planning; reconcile retained dispatch");
                         const payload = preparationTurnPayload(turn);
-                        if ((turn.isError && !payload.formatErrors.length) || turn.failure || !role.builder.sessionId())
+                        if (turn.isError || turn.failure || !role.builder.sessionId())
                             throw new Error(`planner-unavailable: ${turn.text}`);
-                        return { text: payload.text, graphReceiptRefs: turn.graphReceiptRefs, sessionId: role.builder.sessionId(), usage: { inputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.inputTokens : turn.inputTokens, outputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.outputTokens : turn.outputTokens, costUsd: turn.costAuthoritative ? turn.costUsd : undefined } };
+                        return { text: payload.text, structured: turn.structured, selectedDispatch: turn.selectedDispatch, output, graphReceiptRefs: turn.graphReceiptRefs, sessionId: role.builder.sessionId(), usage: { inputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.inputTokens : turn.inputTokens, outputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.outputTokens : turn.outputTokens, costUsd: turn.costAuthoritative ? turn.costUsd : undefined } };
                     }
                     finally {
                         await role.builder.close();
@@ -212,21 +248,21 @@ async function ensureBuilderContractWithProvenance(projectDir, runId, workId, wo
                 try {
                     remaining();
                     const prerequisites = await checkQaPrerequisites({ snapshotPath: snapshot.path, sourceDigest: snapshot.frozenState.digest, ticket });
-                    const prerequisiteDigest = db.putEvidence("qa", JSON.stringify(prerequisites));
+                    const prerequisiteDigest = db.putEvidence("qa", Buffer.from(JSON.stringify(prerequisites)));
                     remaining();
                     if (qaFactory)
                         adapter = (await qaFactory(snapshot.path)).adapter;
                     else
                         adapter = (await createRoleBuilder({ projectDir: snapshot.path, configRoot: projectDir, role: "qa", agent: state?.qa?.settings?.make ?? builder.agent, preloadedSkillContent: effective.skills.map(skill => ({ name: skill.name, content: skill.content })), label: "QA preparation", sandboxMode: "read-only", permissionConfig: readOnlyPermissionConfig(), yes: true, allowSwitch: false })).builder;
-                    const turn = await sendPreparationGraphTurn(adapter, `${instruction}\nOriginal approved plan context: ${JSON.stringify(planInput?.plan ?? null)}\nFrozen admitted work definition: ${JSON.stringify(ticket)}\nHost early prerequisite observations (host availability is not provider access; classify readiness versus final-only dependencies): ${JSON.stringify({ ...prerequisites, evidenceDigest: prerequisiteDigest })}\nFrozen effective configuration: ${JSON.stringify(effective)}\nOperation: ${operationId}; remaining wall time: ${remainingMs}ms; source: ${source.digest}`, { phase, projectDir, workspace: snapshot.path, accessWorkspace: workspace, sourceRef: snapshot.frozenState.digest, runId, workId, operationId, remainingMs: remaining() });
+                    const turn = await sendPreparationGraphTurn(adapter, `${instruction}\nOriginal approved plan context: ${JSON.stringify(planInput?.plan ?? null)}\nFrozen admitted work definition: ${JSON.stringify(ticket)}\nHost early prerequisite observations (host availability is not provider access; classify readiness versus final-only dependencies): ${JSON.stringify({ ...prerequisites, evidenceDigest: prerequisiteDigest })}\nFrozen effective configuration reference (the exact QA rules and skills are already loaded as immutable system context; authoritative requirements are in the inventory): ${JSON.stringify(preparationConfigurationReference(effective))}\nOperation: ${operationId}; remaining wall time: ${remainingMs}ms; source: ${source.digest}`, { phase, projectDir, workspace: snapshot.path, accessWorkspace: workspace, sourceRef: snapshot.frozenState.digest, runId, workId, operationId, remainingMs: remaining(), output });
                     store.event(runId, workId, `${operationId}:raw`, "preparation-provider-return", turn);
                     const payload = preparationTurnPayload(turn);
                     payload.text = normalizeSnapshotPaths(payload.text);
-                    if ((turn.isError && !payload.formatErrors.length) || turn.failure || !adapter.sessionId())
+                    if (turn.isError || turn.failure || !adapter.sessionId())
                         throw new Error(`Preparation provider unavailable: ${turn.text}`);
                     if (captureBuildSource(workspace).contentDigest !== before.contentDigest)
                         throw new Error("Source changed during preparation; retained dispatch requires reconciliation");
-                    return { text: payload.text, graphReceiptRefs: turn.graphReceiptRefs, sessionId: adapter.sessionId(), workspacePaths: mapSnapshotWorkingDirectories(payload.text, snapshot.path), usage: { inputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.inputTokens : turn.inputTokens, outputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.outputTokens : turn.outputTokens, costUsd: turn.costAuthoritative ? turn.costUsd : undefined } };
+                    return { text: payload.text, structured: turn.structured, selectedDispatch: turn.selectedDispatch, output, graphReceiptRefs: turn.graphReceiptRefs, sessionId: adapter.sessionId(), workspacePaths: mapSnapshotWorkingDirectories(operationPayload(turn, output), snapshot.path), usage: { inputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.inputTokens : turn.inputTokens, outputTokens: turn.usage?.scope === "turn-delta" ? turn.usage.outputTokens : turn.outputTokens, costUsd: turn.costAuthoritative ? turn.costUsd : undefined } };
                 }
                 finally {
                     try {

package/dist/qaBuilderCoverage.js

@@ -2,11 +2,13 @@ import { dispatchWithGraphAccess, withGraphSessionAccess } from "./graph/session
 import { WorkflowDb } from "./workflowDb.js";
 import { actualContractSession, assertContractReceipt } from "./qaContractDelivery.js";
 import { captureBuildSource } from "./buildAssignment.js";
-import { COVERAGE_INSTRUCTIONS, bindCoverageHostFields, parseContractCoverage, validateContractCoverage } from "./qaContractCoverage.js";
+import { COVERAGE_INSTRUCTIONS, bindCoverageHostFields, validateContractCoverage } from "./qaContractCoverage.js";
 import { contractDigest } from "./qaVerificationContract.js";
 import { OperationDeadline } from "./util/deadline.js";
 import { hostTestSequenceEvidence } from "./qaBuilderEvidence.js";
 import { qaHostGraphFact } from "./qaHostFacts.js";
+import { builderCoverageOutput, workReportOutput, remediationOutput } from "rafi-spec";
+import { operationPayload, operationInstruction, nativePolicy } from "./structuredOperation.js";
 /** Claims are collected after source capture so the provider can name the actual completed source. */
 export async function collectBuilderContractCoverage(projectDir, runId, workId, workspace, adapter, operationId, instruction, implementation, hostObservations = [], initialSourceDigest) {
     return withGraphSessionAccess(projectDir, adapter, () => collectBuilderContractCoverageOwned(projectDir, runId, workId, workspace, adapter, operationId, instruction, implementation, hostObservations, initialSourceDigest));
@@ -34,13 +36,19 @@ async function collectBuilderContractCoverageOwned(projectDir, runId, workId, wo
             return;
         }
         // Preserve the implementation response before a failed acknowledgment or a crash.
-        const implementationDigest = db.putEvidence("qa", implementation.rawResponse ?? implementation.text);
-        db.planOperation({ runId, idempotencyKey: eventId, kind: "builder-coverage", intent: { workId, contractDigest: contract.contentDigest, binding, implementationDigest, session } });
-        db.updateOperation(eventId, "in_progress");
+        const implementationDigest = db.putEvidence("qa", Buffer.from(JSON.stringify({ structured: implementation.structured, rawResponse: implementation.rawResponse ?? implementation.text })));
+        // Persist host-owned command metadata before dispatching the response-only
+        // acknowledgement. This survives a process restart and does not retain
+        // commands or output, only bounded sequence/status/digest facts.
+        const hostObservationDigest = db.putEvidence("qa", Buffer.from(JSON.stringify({ version: 1, kind: "host-builder-tool-observations", workId, operationId, observations: hostObservations })));
+        db.planOperation({ runId, idempotencyKey: eventId, kind: "builder-coverage", intent: { workId, contractDigest: contract.contentDigest, binding, implementationDigest, hostObservationDigest, session } });
+        db.updateOperation(eventId, "in_progress", { result: { hostObservationDigest } });
         try {
             const prompt = `Response-only evidence collection for completed implementation ${operationId}. Do not run tools, modify files, repeat work, or invent verification. Record failed, blocked or not-run truthfully. The implementation response is retained as ${implementationDigest}.\n${COVERAGE_INSTRUCTIONS}\nExact coverage binding: ${JSON.stringify({ version: 1, runId, workId, revision: contract.revision, contractDigest: contract.contentDigest, ...binding })}\nAll checks: ${JSON.stringify(contract.checks)}`;
-            const response = await new OperationDeadline("Builder coverage acknowledgment", 120_000).run(() => dispatchWithGraphAccess(projectDir, adapter, prompt, { purpose: "response-repair", responseOnly: true }, (text, policy) => adapter.sendTurn(text, policy)), () => { void adapter.close(); });
-            const responseDigest = db.putEvidence("qa", response.rawResponse ?? response.text);
+            const composed = implementation.structured?.state === "candidate" ? implementation.structured.operation === "builder-remediation"
+                ? operationPayload(implementation, remediationOutput).coverage : operationPayload(implementation, workReportOutput).coverage : undefined;
+            const response = composed ? implementation : await new OperationDeadline("Builder coverage acknowledgment", 120_000).run(() => dispatchWithGraphAccess(projectDir, adapter, `${prompt}\n\n${operationInstruction(builderCoverageOutput)}`, nativePolicy(builderCoverageOutput, { purpose: "response-repair", responseOnly: true, logicalActionId: operationId, journalRunId: runId }), (text, policy) => adapter.sendTurn(text, policy)), () => { void adapter.close(); });
+            const responseDigest = db.putEvidence("qa", Buffer.from(JSON.stringify({ structured: response.structured, rawResponse: response.rawResponse ?? response.text })));
             db.updateOperation(eventId, "uncertain", { result: { responseDigest } });
             if (response.isError || response.failure)
                 throw new Error("Builder coverage provider failed; retained response requires reconciliation");
@@ -55,13 +63,14 @@ async function collectBuilderContractCoverageOwned(projectDir, runId, workId, wo
             // Bind the retained coverage to the host-observed post-compaction session
             // while continuing to reject unscoped session changes and source edits.
             binding = { ...binding, sessionId: afterSession.sessionId };
-            const coverage = bindCoverageHostFields(parseContractCoverage(response.text), contract, binding);
+            const claims = composed ?? operationPayload(response, builderCoverageOutput);
+            const coverage = bindCoverageHostFields(claims, contract, binding);
             bindHostOwnedBuilderFacts(db, coverage, contract, hostObservations, initialSourceDigest, source.digest, workId, projectDir);
             const errors = validateContractCoverage(contract, coverage, binding, false);
             if (errors.length)
                 throw new Error(`Builder coverage invalid: ${errors.join("; ")}`);
             const coverageDigest = store.putArtifact("builder-coverage", coverage);
-            db.updateOperation(eventId, "confirmed", { result: { responseDigest, coverageDigest, binding, implementationDigest } });
+            db.updateOperation(eventId, "confirmed", { result: { responseDigest, coverageDigest, binding, implementationDigest, hostObservationDigest } });
         }
         catch (error) {
             throw new Error(`Builder evidence collection blocked: ${String(error)}`);
@@ -74,7 +83,7 @@ async function collectBuilderContractCoverageOwned(projectDir, runId, workId, wo
 function checkText(check) {
     return JSON.stringify(check);
 }
-function bindHostOwnedBuilderFacts(db, coverage, contract, observations, _initialSourceDigest, finalSourceDigest, workId, projectDir) {
+function bindHostOwnedBuilderFacts(db, coverage, contract, observations, initialSourceDigest, finalSourceDigest, workId, projectDir) {
     const graphFact = qaHostGraphFact(projectDir);
     const graphDisabled = /"enabled":false/.test(graphFact);
     for (const row of coverage.checks ?? []) {
@@ -89,8 +98,8 @@ function bindHostOwnedBuilderFacts(db, coverage, contract, observations, _initia
                 row.evidence = [...(row.evidence ?? []), { procedure: "Rafi retained preimplementation baseline observation", cwd: ".", runtime: "rafi host", sourceDigest: baseline.sourceDigest, reference: baseline.evidenceDigest }];
             }
         }
-        if (graphDisabled && /graph/i.test(text) && /disabled|not.?adopt|no graph/i.test(text)) {
-            const factDigest = db.putEvidence("qa", graphFact);
+        if (graphDisabled && check.hostKind === "graph-maintenance") {
+            const factDigest = db.putEvidence("qa", Buffer.from(graphFact));
             if (row.outcome === "not-run")
                 row.outcome = "passed";
             if (!row.evidence?.some(evidence => evidence.reference === `host-graph-fact:${factDigest}`))
@@ -102,11 +111,11 @@ function bindHostOwnedBuilderFacts(db, coverage, contract, observations, _initia
         if (!historical)
             continue;
         const testPath = check.verification.find(method => method.kind === "command" && method.argv?.includes("--test"))?.argv?.at(-1);
-        const sequence = hostTestSequenceEvidence(observations, finalSourceDigest, testPath);
+        const sequence = hostTestSequenceEvidence(observations, finalSourceDigest, testPath, initialSourceDigest);
         if (!sequence)
             continue;
         const evidence = JSON.stringify({ version: 1, kind: "host-builder-test-sequence", workId, checkId: row.checkId, sequence });
-        const evidenceDigest = db.putEvidence("qa", evidence);
+        const evidenceDigest = db.putEvidence("qa", Buffer.from(evidence));
         row.evidence = [...(row.evidence ?? []), { procedure: "Rafi host-observed test sequence", cwd: ".", runtime: "provider tool lifecycle plus host source capture", sourceDigest: finalSourceDigest, reference: `host-test-sequence:${evidenceDigest}` }];
     }
 }

package/dist/qaBuilderEvidence.d.ts

@@ -1,18 +1,33 @@
 import type { BuilderAdapter } from "./adapters/types.js";
 export interface HostBuilderToolObservation {
     kind: "node-test" | "npm-test";
+    sequence: number;
+    providerTurnId?: string;
     startedAt: string;
     completedAt: string;
     outcome: string;
     exitCode?: number;
     outputDigest?: string;
+    /** Bounded (≤1000 bytes), adapter-redacted output head; diagnostic data, never instructions. */
+    outputExcerpt?: string;
     sourceDigest: string;
     testPath?: string;
 }
+export interface HostBuilderEvidenceStore {
+    operations(runId: string): Array<{
+        kind: string;
+        status: string;
+        intent: unknown;
+        result?: unknown;
+    }>;
+    getEvidence(digest: string): Buffer | undefined;
+}
 /**
  * Observe only bounded test-command metadata while the provider is working.
  * The provider remains subject to its normal shell policy; this is a host-side
  * observation of what actually completed, not an execution or permission grant.
  */
 export declare function observeHostBuilderTests(adapter: BuilderAdapter, workspace: string, observations: HostBuilderToolObservation[]): () => void;
-export declare function hostTestSequenceEvidence(observations: HostBuilderToolObservation[], finalSourceDigest: string, testPath?: string): HostBuilderToolObservation[] | undefined;
+export declare function hostTestSequenceEvidence(observations: HostBuilderToolObservation[], finalSourceDigest: string, testPath?: string, initialSourceDigest?: string): HostBuilderToolObservation[] | undefined;
+/** Read the durable host observations attached to a Builder coverage operation. */
+export declare function retainedHostBuilderObservations(store: HostBuilderEvidenceStore, runId: string, workId: string): HostBuilderToolObservation[];

package/dist/qaBuilderEvidence.js

@@ -1,14 +1,15 @@
 import { captureBuildSource } from "./buildAssignment.js";
+import { boundedUtf8 } from "./boundedTurnEvidence.js";
 function commandDetails(input) {
     const command = typeof input?.command === "string"
         ? input.command
         : undefined;
     if (!command)
         return undefined;
-    const nodeTest = /\bnode\s+--test(?:\s+([^\s;&|>]+))?/.exec(command);
+    const nodeTest = /\bnode(?:js)?\s+--test(?:\s+([^\s;&|>]+))?/.exec(command);
     if (nodeTest)
         return { kind: "node-test", ...(nodeTest[1] ? { testPath: nodeTest[1] } : {}) };
-    if (/\bnpm\s+test\b/.test(command))
+    if (/\b(?:npm|pnpm|yarn)\s+(?:run\s+)?test\b/.test(command))
         return { kind: "npm-test" };
     return undefined;
 }
@@ -19,12 +20,13 @@ function commandDetails(input) {
  */
 export function observeHostBuilderTests(adapter, workspace, observations) {
     const open = new Map();
-    const stop = adapter.observeEvents?.((event) => {
+    let sequence = observations.length;
+    const listener = (event) => {
         if (event.kind !== "tool")
             return;
         const details = commandDetails(event.input);
         if (event.lifecycle === "started" && details && event.callId) {
-            open.set(event.callId, { ...details, startedAt: event.observedAt ?? new Date().toISOString() });
+            open.set(event.callId, { ...details, startedAt: event.observedAt ?? new Date().toISOString(), providerTurnId: event.providerTurnId });
             return;
         }
         if (event.lifecycle !== "completed" || !event.callId || !event.completionKnown)
@@ -37,6 +39,8 @@ export function observeHostBuilderTests(adapter, workspace, observations) {
             return;
         observations.push({
             kind: prior.kind,
+            sequence: sequence++,
+            ...(prior.providerTurnId ? { providerTurnId: prior.providerTurnId } : {}),
             startedAt: prior.startedAt,
             completedAt: event.observedAt ?? new Date().toISOString(),
             // Some adapters label every finished tool call "completed" even when
@@ -45,16 +49,52 @@ export function observeHostBuilderTests(adapter, workspace, observations) {
             outcome: event.exitCode !== undefined ? event.exitCode === 0 ? "completed" : "failed" : event.status ?? "completed",
             ...(event.exitCode === undefined ? {} : { exitCode: event.exitCode }),
             ...(event.outputDigest && /^[a-f0-9]{64}$/.test(event.outputDigest) ? { outputDigest: event.outputDigest } : {}),
+            ...(typeof event.outputSummary === "string" && event.outputSummary ? { outputExcerpt: boundedUtf8(event.outputSummary, 1000).toString() } : {}),
             sourceDigest: captureBuildSource(workspace).digest,
             ...(prior.testPath ? { testPath: prior.testPath } : {}),
         });
-    }) ?? (() => { });
+    };
+    // This supplementary telemetry must not preempt the delivery journal's own
+    // correlated-terminal check. Wrapper adapters deliberately throw when a
+    // provider lacks observation; dispatchOwned records that as
+    // delivery-uncertain without sending a turn. Treating this optional
+    // subscription as fatal here would bypass that durable fail-closed path.
+    let stop = () => { };
+    try {
+        stop = adapter.observeEvents?.(listener) ?? stop;
+    }
+    catch {
+        open.clear();
+    }
     return () => { stop(); open.clear(); };
 }
-export function hostTestSequenceEvidence(observations, finalSourceDigest, testPath) {
-    const relevant = observations.filter(observation => (observation.kind === "node-test" || observation.kind === "npm-test") && (!testPath || observation.testPath === testPath));
-    const red = relevant.find(observation => observation.outcome !== "completed" && observation.outcome !== "denied");
+export function hostTestSequenceEvidence(observations, finalSourceDigest, testPath, initialSourceDigest) {
+    const relevant = observations
+        .filter(observation => (observation.kind === "node-test" || observation.kind === "npm-test") && (!testPath || observation.testPath === testPath))
+        .sort((a, b) => a.sequence - b.sequence || a.startedAt.localeCompare(b.startedAt));
+    const red = relevant.find(observation => observation.outcome !== "completed" && observation.outcome !== "denied" && (!initialSourceDigest || observation.sourceDigest === initialSourceDigest));
     const redIndex = red ? relevant.indexOf(red) : -1;
     const green = red ? relevant.slice(redIndex + 1).find(observation => observation.sourceDigest === finalSourceDigest && observation.outcome === "completed" && observation.sourceDigest !== red.sourceDigest) : undefined;
     return red && green ? [red, green] : undefined;
 }
+/** Read the durable host observations attached to a Builder coverage operation. */
+export function retainedHostBuilderObservations(store, runId, workId) {
+    for (const operation of store.operations(runId).filter(item => item.kind === "builder-coverage").reverse()) {
+        const intent = operation.intent;
+        if (intent.workId !== workId)
+            continue;
+        const result = operation.result;
+        const digest = typeof result?.hostObservationDigest === "string" ? result.hostObservationDigest
+            : typeof intent.hostObservationDigest === "string" ? intent.hostObservationDigest : undefined;
+        if (!digest)
+            continue;
+        try {
+            const parsed = JSON.parse(store.getEvidence(digest)?.toString("utf8") ?? "null");
+            if (!Array.isArray(parsed?.observations))
+                continue;
+            return parsed.observations.filter((item) => Boolean(item && typeof item === "object" && typeof item.kind === "string" && Number.isSafeInteger(item.sequence)));
+        }
+        catch { /* malformed optional evidence is not a QA pass */ }
+    }
+    return [];
+}

package/dist/qaContractCoverage.d.ts

@@ -1,7 +1,7 @@
 import type { QaContractCoverageV1, QaVerificationContractV1 } from "rafi-spec";
 export declare const COVERAGE_INSTRUCTIONS: string;
-export declare const BUILDER_WORK_COVERAGE_INSTRUCTIONS = "Carry out the applicable contract checks and report your work and evidence honestly in your normal final response. When a check requires historical ordering, retain bounded output for each required step and an explicit ordering record while performing it; a later passing test cannot prove an earlier failing step. Do not emit RAFI_QA_COVERAGE JSON during this implementation turn or stop for coverage binding values. After the implementation turn, Rafi will capture the completed source and request a separate response-only coverage record with the exact host-owned bindings.";
-export declare function parseContractCoverage(text: string): QaContractCoverageV1;
+export declare const BUILDER_WORK_COVERAGE_INSTRUCTIONS = "Carry out the applicable contract checks and report your work and evidence honestly in your normal final response. When a check requires historical ordering, retain bounded output for each required step and an explicit ordering record while performing it; a later passing test cannot prove an earlier failing step. Include the coverage claims in the completed work-report payload when a contract is supplied. Follow the contract applicability.kind exactly: an unconditional check is always applicable, including a check that verifies documentation is disabled or a skill is not requested. Such a check can pass with concrete evidence of that absence; do not mark the check itself not-applicable. Conditional checks need observed predicate evidence. Report a genuine conflict as blocked instead of silently waiving an unconditional check. Do not wait for or invent host binding values: Rafi captures and attaches the completed source after your result.";
+export declare function parseContractCoverage(_text: string): never;
 /** Source identity is host-owned; providers may copy a stale Builder digest. */
 export declare function bindCoverageSourceDigest(coverage: QaContractCoverageV1, sourceDigest: string): QaContractCoverageV1;
 /** All coverage identity fields are host-owned; provider output supplies only claims and evidence text. */

package/dist/qaContractCoverage.js

@@ -1,11 +1,10 @@
 import { Ajv } from "ajv";
-import { qaContractCoverageV1Schema } from "rafi-spec";
+import { qaContractCoverageV1Schema, coverageClaimsSchema } from "rafi-spec";
 const coverageSchema = new Ajv({ allErrors: true }).compile(qaContractCoverageV1Schema);
-import { parsePreparationArtifact } from "./qaVerificationContract.js";
-export const COVERAGE_INSTRUCTIONS = `Return RAFI_QA_COVERAGE_START, one QaContractCoverageV1 JSON object, RAFI_QA_COVERAGE_END before the final status marker. The exact schema is ${JSON.stringify(qaContractCoverageV1Schema)}. Put every binding field at the TOP LEVEL, not inside a binding object, and copy the host-supplied binding values exactly. For each check use checkId (not id), applicability as applicable/not-applicable/unresolved, predicateEvidence as an array of strings, outcome as passed/failed/blocked/not-run, and evidence as an array of objects with procedure, cwd, runtime, sourceDigest and reference. For postimplementation evidence sourceDigest is the exact host-supplied sourceDigest, not an individual file hash. Unconditional checks cannot be marked not-applicable or unresolved; for an absence or non-impact check, mark it applicable and provide bounded inspection evidence showing that the absent change or impact was assessed. For independent QA coverage of an applicable passed preimplementation-only check, inspect its matching passed contract.baseline observation and set at least one evidence reference to that observation's exact evidenceDigest; the historical observation is bound to its original source, not the current source. Assess its relevance rather than inventing or claiming a new baseline. Host-owned checks whose applicability decisionOwner is host are the exception to provider execution: include the check truthfully as applicable/not-run with evidence that the host-owned comparison is pending, and do not block or fail QA over it; Rafi will execute the comparison and replace that row before accepting the pass. Before emitting qa_pass, run every other applicable mandatory check that is not backed by a passed retained baseline; do not leave such a provider-owned check as not-run merely because an earlier turn omitted it. If an exact required command is blocked by the provider shell policy, use a semantically equivalent permitted read-only procedure, record the substitution and limitation truthfully, and assess the same predicate; do not mark the check blocked merely because the literal command syntax was denied. If a required command is permitted and read-only, run it now and retain its bounded result. Do not add unsupported fields. Include every check with truthful applicability and concrete evidence. Missing, blocked, not-run, unresolved applicability, or failed provider-owned mandatory coverage cannot authorize normal completion. Builder coverage is a claim; final QA independently verifies it.`;
+export const COVERAGE_INSTRUCTIONS = `Include coverage claims in the native operation payload. The claims schema is ${JSON.stringify(coverageClaimsSchema)}. Do not invent or echo host-owned run, source, attempt, revision or session bindings; Rafi attaches them after source capture. For each check use checkId (not id), applicability as applicable/not-applicable/unresolved, predicateEvidence as an array of strings, outcome as passed/failed/blocked/not-run, and evidence as an array of objects with procedure, cwd, runtime and reference. For postimplementation evidence, cite what you actually observed; Rafi binds the source digest. Unconditional checks cannot be marked not-applicable or unresolved; for an absence or non-impact check, mark it applicable and provide bounded inspection evidence showing that the absent change or impact was assessed. For independent QA coverage of an applicable passed preimplementation-only check, inspect its matching passed contract.baseline observation and set at least one evidence reference to that observation's exact evidenceDigest; the historical observation is bound to its original source, not the current source. Assess its relevance rather than inventing or claiming a new baseline. Graphify is optional evidence: do not install, refresh, scan, or claim Graphify execution unless the host says Rafi-managed Graphify is adopted and enabled. Host-owned Graphify applicability is authoritative; disabled, unadopted, or unavailable Graphify is not a QA blocker, while adopted-enabled Graphify is applicable and cannot be waived by provider output. Other host-owned checks whose applicability decisionOwner is host are the exception to provider execution: include the check truthfully as applicable/not-run with evidence that the host-owned comparison is pending, and do not block or fail QA over it; Rafi will execute the comparison and replace that row before accepting the pass. Before reporting a passed verdict, run every other applicable mandatory check that is not backed by a passed retained baseline; do not leave such a provider-owned check as not-run merely because an earlier turn omitted it. If an exact required command is blocked by the provider shell policy, use a semantically equivalent permitted read-only procedure, record the substitution and limitation truthfully, and assess the same predicate; do not mark the check blocked merely because the literal command syntax was denied. If a required command is permitted and read-only, run it now and retain its bounded result. For command exit status, use the host-retained tool event's exitCode and bounded output when available; that is authoritative evidence, and you must not create an echo wrapper, compound command, or other shell scaffold solely to print a numeric status. Do not add unsupported fields. Include every check with truthful applicability and concrete evidence. Missing, blocked, not-run, unresolved applicability, or failed provider-owned mandatory coverage cannot authorize normal completion. Builder coverage is a claim; final QA independently verifies it.`;
 // The source and attempt binding do not exist until the implementation turn has finished.
-export const BUILDER_WORK_COVERAGE_INSTRUCTIONS = `Carry out the applicable contract checks and report your work and evidence honestly in your normal final response. When a check requires historical ordering, retain bounded output for each required step and an explicit ordering record while performing it; a later passing test cannot prove an earlier failing step. Do not emit RAFI_QA_COVERAGE JSON during this implementation turn or stop for coverage binding values. After the implementation turn, Rafi will capture the completed source and request a separate response-only coverage record with the exact host-owned bindings.`;
-export function parseContractCoverage(text) { return parsePreparationArtifact(text, "RAFI_QA_COVERAGE"); }
+export const BUILDER_WORK_COVERAGE_INSTRUCTIONS = `Carry out the applicable contract checks and report your work and evidence honestly in your normal final response. When a check requires historical ordering, retain bounded output for each required step and an explicit ordering record while performing it; a later passing test cannot prove an earlier failing step. Include the coverage claims in the completed work-report payload when a contract is supplied. Follow the contract applicability.kind exactly: an unconditional check is always applicable, including a check that verifies documentation is disabled or a skill is not requested. Such a check can pass with concrete evidence of that absence; do not mark the check itself not-applicable. Conditional checks need observed predicate evidence. Report a genuine conflict as blocked instead of silently waiving an unconditional check. Do not wait for or invent host binding values: Rafi captures and attaches the completed source after your result.`;
+export function parseContractCoverage(_text) { throw new Error("Legacy coverage markers cannot provide workflow authority; use the verified native payload"); }
 /** Source identity is host-owned; providers may copy a stale Builder digest. */
 export function bindCoverageSourceDigest(coverage, sourceDigest) {
     const copy = structuredClone(coverage);
@@ -20,10 +19,11 @@ export function bindCoverageHostFields(coverage, contract, binding) {
     // Optional schema fields may be emitted as JSON null by providers. Null is
     // not a meaningful limitation, so omit only that representation variant;
     // non-string values elsewhere remain validation errors.
-    for (const check of copy.checks ?? [])
+    for (const check of copy.checks ?? []) {
         for (const evidence of check.evidence ?? [])
             if (evidence.limitation === null)
                 delete evidence.limitation;
+    }
     copy.version = 1;
     copy.runId = contract.runId;
     copy.workId = contract.workId;
@@ -61,7 +61,11 @@ export function validateContractCoverage(contract, coverage, binding, requirePas
             issues.push(`Unconditional applicability cannot be waived ${row.checkId}`);
         if (row.applicability === "not-applicable" && !row.predicateEvidence?.length)
             issues.push(`Not-applicable requires predicate evidence ${row.checkId}`);
-        if (check.applicability.kind === "conditional" && row.applicability === "applicable" && !row.predicateEvidence?.length)
+        // Host-owned conditional predicates are resolved by the host augmentation
+        // after provider coverage is collected (for example Graphify adoption).
+        // Requiring provider predicate evidence here would make the host-owned,
+        // fail-open path block before the authoritative host observation exists.
+        if (check.applicability.kind === "conditional" && check.applicability.decisionOwner !== "host" && row.applicability === "applicable" && !row.predicateEvidence?.length)
             issues.push(`Conditional applicability requires predicate evidence ${row.checkId}`);
         if (requirePass && check.obligation === "mandatory" && (row.applicability === "unresolved" || row.applicability === "applicable" && row.outcome !== "passed"))
             issues.push(`Mandatory check incomplete ${row.checkId}: run its permitted verification now and resubmit passed evidence, or report a truthful blocked result for host recovery`);