approval-md 0.2.0 → 0.4.0

package/schema/fixtures/event/invalid/approval-granted-sender-hashed-false.json

@@ -0,0 +1,20 @@
+{
+  "seq": 94,
+  "ts": "2026-09-19T21:20:03Z",
+  "event": "approval.granted",
+  "task": "task-370",
+  "action_key": "task-370:chaser:2026-09-19",
+  "actor": "human:carter",
+  "channel": "telegram",
+  "payload": {
+    "sender": {
+      "channel": "telegram",
+      "id": "5551234567",
+      "hashed": false
+    },
+    "sender_source": "policy"
+  },
+  "alg": "sha256/jcs",
+  "prev": "4341a44ad46ed5c25a601f296530e5cbab7d3bfb6a3119f77a83c327ab5b54d5",
+  "hash": "bcd21fd125d9c85cc4b4eb1ff519448989c72c0fd70305cbb06b821d04926686"
+}

package/schema/fixtures/event/invalid/approval-granted-sender-hashed-raw-id.json

@@ -0,0 +1,20 @@
+{
+  "seq": 93,
+  "ts": "2026-09-19T21:18:55Z",
+  "event": "approval.granted",
+  "task": "task-370",
+  "action_key": "task-370:chaser:2026-09-19",
+  "actor": "human:carter",
+  "channel": "telegram",
+  "payload": {
+    "sender": {
+      "channel": "telegram",
+      "id": "5551234567",
+      "hashed": true
+    },
+    "sender_source": "policy"
+  },
+  "alg": "sha256/jcs",
+  "prev": "4341a44ad46ed5c25a601f296530e5cbab7d3bfb6a3119f77a83c327ab5b54d5",
+  "hash": "bcd21fd125d9c85cc4b4eb1ff519448989c72c0fd70305cbb06b821d04926686"
+}

package/schema/fixtures/event/invalid/audit-gesture-refused-human-actor.json

@@ -0,0 +1,16 @@
+{
+  "seq": 74,
+  "ts": "2026-09-17T19:02:11Z",
+  "event": "audit.gesture_refused",
+  "actor": "human:carter",
+  "channel": "telegram",
+  "payload": {
+    "actor": "human:carter",
+    "gesture": "checkpoint-signature",
+    "code": "sender-unmapped",
+    "message": "a record of a refusal authored by either party to it is a record neither party can be held to"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/invalid/audit-gesture-refused-no-actor-no-sender.json

@@ -0,0 +1,15 @@
+{
+  "seq": 74,
+  "ts": "2026-09-17T19:02:11Z",
+  "event": "audit.gesture_refused",
+  "actor": "system:gate",
+  "channel": "telegram",
+  "payload": {
+    "gesture": "review",
+    "code": "sender-unmapped",
+    "message": "a record naming neither the person nor the account it could not name says nothing about who spent the attention"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/invalid/audit-gesture-refused-unknown-gesture.json

@@ -0,0 +1,16 @@
+{
+  "seq": 74,
+  "ts": "2026-09-17T19:02:11Z",
+  "event": "audit.gesture_refused",
+  "actor": "system:gate",
+  "channel": "telegram",
+  "payload": {
+    "actor": "human:carter",
+    "gesture": "policy-attestation",
+    "code": "sender-unmapped",
+    "message": "an attestation tap is a decision and is recorded as one; the gesture vocabulary is closed"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/invalid/audit-question-preempted-agent-actor.json

@@ -0,0 +1,16 @@
+{
+  "seq": 91,
+  "ts": "2026-09-19T16:20:44Z",
+  "event": "audit.question_preempted",
+  "actor": "agent:codex",
+  "payload": {
+    "source": "codex-auto-reviewer",
+    "question": {
+      "id": "item_01H9"
+    },
+    "detail": "a record of an event authored by either party to it is a record neither party can be held to"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/invalid/audit-question-preempted-no-question-id.json

@@ -0,0 +1,16 @@
+{
+  "seq": 91,
+  "ts": "2026-09-19T16:20:44Z",
+  "event": "audit.question_preempted",
+  "actor": "system:gate",
+  "payload": {
+    "source": "codex-auto-reviewer",
+    "question": {
+      "method": "item/autoApprovalReview/completed"
+    },
+    "verdict": "approve"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/invalid/audit-question-preempted-unknown-source.json

@@ -0,0 +1,15 @@
+{
+  "seq": 91,
+  "ts": "2026-09-19T16:20:44Z",
+  "event": "audit.question_preempted",
+  "actor": "system:gate",
+  "payload": {
+    "source": "some-other-reviewer",
+    "question": {
+      "id": "item_01H9"
+    }
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/invalid/daemon-id-malformed.json

@@ -0,0 +1,15 @@
+{
+  "seq": 63,
+  "ts": "2026-09-20T11:06:02Z",
+  "event": "audit.sampled",
+  "task": "task-311",
+  "action_key": "task-311:digest:2026-09-20",
+  "actor": "system:auditor",
+  "daemon": "Village Goa 1\nrate: 1.0",
+  "payload": {
+    "rate": 0.1
+  },
+  "alg": "sha256/jcs",
+  "prev": "07453feb30c2b0b1a2806398cdd17b38d98f9abf52b8a75ca42878c9101d8264",
+  "hash": "9d4c0be1a7fb25308c6ef4a1d0b39724ce85f16a2b0d7c39e8145af62b0c73d8"
+}

package/schema/fixtures/event/invalid/execution-started-truncated-policy-sha256.json

@@ -0,0 +1,18 @@
+{
+  "seq": 9,
+  "ts": "2026-10-04T09:19:02Z",
+  "event": "execution.started",
+  "task": "hook:sess-1:tu-1",
+  "action_key": "hook:sess-1:tu-1:files.write.workspace",
+  "actor": "agent:claude-code",
+  "payload": {
+    "class": "files.write.workspace",
+    "est_cost_usd": "0",
+    "execution": "harness",
+    "payload_hash": "9f2b1c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f809",
+    "policy_sha256": "5f1c0de9a3b7"
+  },
+  "alg": "sha256/jcs",
+  "prev": "d973375d6aeec5e6cd2de3a0f7dc8f5bc1d9be77225f9af0f851e7fc519a07c3",
+  "hash": "707b79cfa14ec43224c8f71a4fee3ddbff52369f82525aab19bec18c369d5cad"
+}

package/schema/fixtures/event/invalid/gate-path-signed-off-absolute-path.json

@@ -0,0 +1,14 @@
+{
+  "seq": 61,
+  "ts": "2026-09-16T11:42:19Z",
+  "event": "gate.path.signed_off",
+  "actor": "human:carter",
+  "channel": "cli",
+  "payload": {
+    "path": "/Users/carter/dev/approval-md/SPEC.md",
+    "sha256": "b83a1e6f45c90d27ea1b3f8c5027d4196be0a73c85f21d604ca97e3b18d520af"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2c9a41f8e07d5b6139fbc84a2e0d97c31556a08bf4e2913d7ca60b85f9d3e70f",
+  "hash": "9d41b7ca2e08f536c1a94db7e230f85b6417cd90a2f35e8b1c76d0492ab3f158"
+}

package/schema/fixtures/event/invalid/gate-path-signed-off-agent-actor.json

@@ -0,0 +1,14 @@
+{
+  "seq": 61,
+  "ts": "2026-09-16T11:42:19Z",
+  "event": "gate.path.signed_off",
+  "actor": "agent:claude-code",
+  "channel": "cli",
+  "payload": {
+    "path": "SPEC.md",
+    "sha256": "b83a1e6f45c90d27ea1b3f8c5027d4196be0a73c85f21d604ca97e3b18d520af"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2c9a41f8e07d5b6139fbc84a2e0d97c31556a08bf4e2913d7ca60b85f9d3e70f",
+  "hash": "9d41b7ca2e08f536c1a94db7e230f85b6417cd90a2f35e8b1c76d0492ab3f158"
+}

package/schema/fixtures/event/invalid/gate-path-signed-off-missing-path.json

@@ -0,0 +1,13 @@
+{
+  "seq": 61,
+  "ts": "2026-09-16T11:42:19Z",
+  "event": "gate.path.signed_off",
+  "actor": "human:carter",
+  "channel": "cli",
+  "payload": {
+    "sha256": "b83a1e6f45c90d27ea1b3f8c5027d4196be0a73c85f21d604ca97e3b18d520af"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2c9a41f8e07d5b6139fbc84a2e0d97c31556a08bf4e2913d7ca60b85f9d3e70f",
+  "hash": "9d41b7ca2e08f536c1a94db7e230f85b6417cd90a2f35e8b1c76d0492ab3f158"
+}

package/schema/fixtures/event/invalid/harness-cap-at-margin.json

@@ -0,0 +1,16 @@
+{
+  "seq": 76,
+  "ts": "2026-09-22T08:34:20Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-12",
+  "action_key": "hook:hermes-sess-1:tool-12:deps.add",
+  "actor": "agent:hermes",
+  "payload": {
+    "class": "deps.add",
+    "execution": "harness",
+    "harness_cap_ms": 60000
+  },
+  "alg": "sha256/jcs",
+  "prev": "1515151515151515151515151515151515151515151515151515151515151515",
+  "hash": "1616161616161616161616161616161616161616161616161616161616161616"
+}

package/schema/fixtures/event/invalid/harness-cap-fractional.json

@@ -0,0 +1,16 @@
+{
+  "seq": 74,
+  "ts": "2026-09-22T08:33:19Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-10",
+  "action_key": "hook:hermes-sess-1:tool-10:deps.add",
+  "actor": "agent:hermes",
+  "payload": {
+    "class": "deps.add",
+    "execution": "harness",
+    "harness_cap_ms": 299999.5
+  },
+  "alg": "sha256/jcs",
+  "prev": "1313131313131313131313131313131313131313131313131313131313131313",
+  "hash": "1414141414141414141414141414141414141414141414141414141414141414"
+}

package/schema/fixtures/event/invalid/harness-cap-negative.json

@@ -0,0 +1,16 @@
+{
+  "seq": 73,
+  "ts": "2026-09-22T08:32:44Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-9",
+  "action_key": "hook:hermes-sess-1:tool-9:deps.add",
+  "actor": "agent:hermes",
+  "payload": {
+    "class": "deps.add",
+    "execution": "harness",
+    "harness_cap_ms": -300000
+  },
+  "alg": "sha256/jcs",
+  "prev": "1212121212121212121212121212121212121212121212121212121212121212",
+  "hash": "1313131313131313131313131313131313131313131313131313131313131313"
+}

package/schema/fixtures/event/invalid/harness-cap-string.json

@@ -0,0 +1,16 @@
+{
+  "seq": 75,
+  "ts": "2026-09-22T08:33:52Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-11",
+  "action_key": "hook:hermes-sess-1:tool-11:deps.add",
+  "actor": "agent:hermes",
+  "payload": {
+    "class": "deps.add",
+    "execution": "harness",
+    "harness_cap_ms": "300s"
+  },
+  "alg": "sha256/jcs",
+  "prev": "1414141414141414141414141414141414141414141414141414141414141414",
+  "hash": "1515151515151515151515151515151515151515151515151515151515151515"
+}

package/schema/fixtures/event/invalid/harness-cap-without-harness-execution.json

@@ -0,0 +1,16 @@
+{
+  "seq": 77,
+  "ts": "2026-09-22T08:34:51Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-13",
+  "action_key": "hook:hermes-sess-1:tool-13:deps.add",
+  "actor": "agent:hermes",
+  "payload": {
+    "class": "deps.add",
+    "harness_cap_ms": 300000,
+    "payload_hash": "5f1c2a6f3e9d4b8a7c0e1d2b3a4958677889aabbccddeeff0011223344556677"
+  },
+  "alg": "sha256/jcs",
+  "prev": "1616161616161616161616161616161616161616161616161616161616161616",
+  "hash": "1717171717171717171717171717171717171717171717171717171717171717"
+}

package/schema/fixtures/event/invalid/harness-cap-zero.json

@@ -0,0 +1,16 @@
+{
+  "seq": 72,
+  "ts": "2026-09-22T08:32:01Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-8",
+  "action_key": "hook:hermes-sess-1:tool-8:deps.add",
+  "actor": "agent:hermes",
+  "payload": {
+    "class": "deps.add",
+    "execution": "harness",
+    "harness_cap_ms": 0
+  },
+  "alg": "sha256/jcs",
+  "prev": "1111111111111111111111111111111111111111111111111111111111111111",
+  "hash": "1212121212121212121212121212121212121212121212121212121212121212"
+}

package/schema/fixtures/event/valid/approval-granted-sender-hashed.json

@@ -0,0 +1,20 @@
+{
+  "seq": 91,
+  "ts": "2026-09-19T21:14:08Z",
+  "event": "approval.granted",
+  "task": "task-370",
+  "action_key": "task-370:chaser:2026-09-19",
+  "actor": "human:carter",
+  "channel": "telegram",
+  "payload": {
+    "sender": {
+      "channel": "telegram",
+      "id": "hmac-sha256:3f2a9c11b4d7e6085a1c2f9d8e7b6a5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a",
+      "hashed": true
+    },
+    "sender_source": "policy"
+  },
+  "alg": "sha256/jcs",
+  "prev": "4341a44ad46ed5c25a601f296530e5cbab7d3bfb6a3119f77a83c327ab5b54d5",
+  "hash": "bcd21fd125d9c85cc4b4eb1ff519448989c72c0fd70305cbb06b821d04926686"
+}

package/schema/fixtures/event/valid/approval-requested-harness-cap.json

@@ -0,0 +1,18 @@
+{
+  "seq": 71,
+  "ts": "2026-09-22T08:31:14Z",
+  "event": "approval.requested",
+  "task": "hook:hermes-sess-1:tool-7",
+  "action_key": "hook:hermes-sess-1:tool-7:deps.add",
+  "actor": "agent:hermes",
+  "channel": "telegram",
+  "payload": {
+    "class": "deps.add",
+    "execution": "harness",
+    "harness_cap_ms": 300000,
+    "payload_hash": "5f1c2a6f3e9d4b8a7c0e1d2b3a4958677889aabbccddeeff0011223344556677"
+  },
+  "alg": "sha256/jcs",
+  "prev": "1010101010101010101010101010101010101010101010101010101010101010",
+  "hash": "1111111111111111111111111111111111111111111111111111111111111111"
+}

package/schema/fixtures/event/valid/audit-gesture-refused-review-note.json

@@ -0,0 +1,21 @@
+{
+  "seq": 75,
+  "ts": "2026-09-17T19:04:38Z",
+  "event": "audit.gesture_refused",
+  "actor": "system:gate",
+  "channel": "telegram",
+  "payload": {
+    "actor": "human:carter",
+    "gesture": "review-note",
+    "code": "policy-not-attested",
+    "sender": {
+      "channel": "telegram",
+      "id": "5559876543"
+    },
+    "sender_source": "policy",
+    "message": "the policy file has changed since it was attested at seq 44607; the sender mapping it declares is not in force, so nothing was recorded"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f",
+  "hash": "8b40e27c5f1a936d04e8b2c6a1d3f5079e2b4c6d8a0f2e4160a8c2e406283bda"
+}

package/schema/fixtures/event/valid/audit-gesture-refused-sender-key-unavailable.json

@@ -0,0 +1,19 @@
+{
+  "seq": 92,
+  "ts": "2026-09-19T21:16:40Z",
+  "event": "audit.gesture_refused",
+  "actor": "system:gate",
+  "channel": "telegram",
+  "payload": {
+    "gesture": "checkpoint-signature",
+    "code": "sender-key-unavailable",
+    "sender": {
+      "channel": "telegram",
+      "id": "5551234567"
+    },
+    "message": "the attested policy maps telegram senders in the keyed form and APPROVAL_SENDER_KEY is unset or empty in this process, so no account on this channel can be resolved and nothing was signed"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f",
+  "hash": "9d4f1b73e0a6c58217f3b9d0e6a4c2815f7b3d9e1a0c6f48273b5d9e0a6c4f81"
+}

package/schema/fixtures/event/valid/audit-gesture-refused.json

@@ -0,0 +1,19 @@
+{
+  "seq": 74,
+  "ts": "2026-09-17T19:02:11Z",
+  "event": "audit.gesture_refused",
+  "actor": "system:gate",
+  "channel": "telegram",
+  "payload": {
+    "gesture": "checkpoint-signature",
+    "code": "sender-unmapped",
+    "sender": {
+      "channel": "telegram",
+      "id": "5551234567"
+    },
+    "message": "the attested policy maps no approver to telegram sender 5551234567, so this checkpoint was not signed and nothing was appended to the chain"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/audit-question-preempted-no-verdict.json

@@ -0,0 +1,16 @@
+{
+  "seq": 92,
+  "ts": "2026-09-19T16:20:45Z",
+  "event": "audit.question_preempted",
+  "actor": "system:gate",
+  "payload": {
+    "source": "codex-auto-reviewer",
+    "question": {
+      "id": "item_01HA",
+      "method": "item/autoApprovalReview/started"
+    }
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/audit-question-preempted.json

@@ -0,0 +1,20 @@
+{
+  "seq": 91,
+  "ts": "2026-09-19T16:20:44Z",
+  "event": "audit.question_preempted",
+  "actor": "system:gate",
+  "payload": {
+    "source": "codex-auto-reviewer",
+    "question": {
+      "id": "item_01H9",
+      "method": "item/autoApprovalReview/completed",
+      "thread": "thread_7f2",
+      "turn": "turn_3"
+    },
+    "verdict": "approve",
+    "detail": "approval codex bridge stopped the session under bridge-auto-reviewer-active"
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/daemon-identity-declared.json

@@ -0,0 +1,17 @@
+{
+  "seq": 62,
+  "ts": "2026-09-20T11:05:44Z",
+  "event": "envelope.drift",
+  "task": "task-311",
+  "actor": "system:daemon",
+  "daemon": "village-goa-1",
+  "payload": {
+    "file": "backlog/tasks/task-311.md",
+    "declared_state": "requested",
+    "derived_state": "granted",
+    "reason": "state-mismatch"
+  },
+  "alg": "sha256/jcs",
+  "prev": "c0a1dd6b0f5a9b7fe7cf7d90cbb4aa4cf0a1eb2d5c7318cbbbd7a2b9efc33150",
+  "hash": "5b2f0c8419a7dd3e6f0b4a1c93de8027f5cbb1a40de92f7c3ab6051d8e4f29c7"
+}

package/schema/fixtures/event/valid/daemon-identity.json

@@ -0,0 +1,15 @@
+{
+  "seq": 61,
+  "ts": "2026-09-20T11:04:19Z",
+  "event": "audit.sampled",
+  "task": "task-311",
+  "action_key": "task-311:digest:2026-09-20",
+  "actor": "system:auditor",
+  "daemon": "daemon-3f2a9c11",
+  "payload": {
+    "rate": 0.1
+  },
+  "alg": "sha256/jcs",
+  "prev": "07453feb30c2b0b1a2806398cdd17b38d98f9abf52b8a75ca42878c9101d8264",
+  "hash": "c0a1dd6b0f5a9b7fe7cf7d90cbb4aa4cf0a1eb2d5c7318cbbbd7a2b9efc33150"
+}

package/schema/fixtures/event/valid/execution-started-policy-sha256.json

@@ -0,0 +1,18 @@
+{
+  "seq": 9,
+  "ts": "2026-10-04T09:19:02Z",
+  "event": "execution.started",
+  "task": "hook:sess-1:tu-1",
+  "action_key": "hook:sess-1:tu-1:files.write.workspace",
+  "actor": "agent:claude-code",
+  "payload": {
+    "class": "files.write.workspace",
+    "est_cost_usd": "0",
+    "execution": "harness",
+    "payload_hash": "9f2b1c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f809",
+    "policy_sha256": "5f1c0de9a3b7e2d4c6f8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e"
+  },
+  "alg": "sha256/jcs",
+  "prev": "d973375d6aeec5e6cd2de3a0f7dc8f5bc1d9be77225f9af0f851e7fc519a07c3",
+  "hash": "707b79cfa14ec43224c8f71a4fee3ddbff52369f82525aab19bec18c369d5cad"
+}

package/schema/fixtures/event/valid/gate-path-signed-off.json

@@ -0,0 +1,14 @@
+{
+  "seq": 61,
+  "ts": "2026-09-16T11:42:19Z",
+  "event": "gate.path.signed_off",
+  "actor": "human:carter",
+  "channel": "cli",
+  "payload": {
+    "path": "SPEC.md",
+    "sha256": "b83a1e6f45c90d27ea1b3f8c5027d4196be0a73c85f21d604ca97e3b18d520af"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2c9a41f8e07d5b6139fbc84a2e0d97c31556a08bf4e2913d7ca60b85f9d3e70f",
+  "hash": "9d41b7ca2e08f536c1a94db7e230f85b6417cd90a2f35e8b1c76d0492ab3f158"
+}

package/schema/fixtures/event/valid/harness-kind-claude-code.json

@@ -0,0 +1,23 @@
+{
+  "seq": 51,
+  "ts": "2026-09-19T08:14:02Z",
+  "event": "task.registered",
+  "task": "hook:claude-sess-1:toolu-11",
+  "actor": "agent:claude-code",
+  "payload": {
+    "state": "proposed",
+    "actions": [
+      {
+        "class": "deps.add",
+        "summary": "npm install --save-dev oxlint",
+        "idempotency_key": "hook:claude-sess-1:toolu-11:deps.add",
+        "payload_hash": "4d0a9c2b7e5f13860ad4c9b217e3f508cc61a7d2394b8e05f7ca61d3b8092e4f"
+      }
+    ],
+    "harness": "claude-code",
+    "harness_version": "2.0.14 (Claude Code)"
+  },
+  "alg": "sha256/jcs",
+  "prev": "b1cbb27b12bd811a9d197f5fb1c494c191040271901214286f0c10bc84820173",
+  "hash": "129eaa2bad261af1367f963979287653173eba8adce9961f09f08970f38d838f"
+}

package/schema/fixtures/event/valid/harness-kind-codex.json

@@ -0,0 +1,23 @@
+{
+  "seq": 53,
+  "ts": "2026-09-19T08:16:27Z",
+  "event": "task.registered",
+  "task": "hook:codex-sess-1:toolu-13",
+  "actor": "agent:codex",
+  "payload": {
+    "state": "proposed",
+    "actions": [
+      {
+        "class": "deps.add",
+        "summary": "npm install --save-dev oxlint",
+        "idempotency_key": "hook:codex-sess-1:toolu-13:deps.add",
+        "payload_hash": "4d0a9c2b7e5f13860ad4c9b217e3f508cc61a7d2394b8e05f7ca61d3b8092e4f"
+      }
+    ],
+    "harness": "codex",
+    "harness_version": "codex-cli 0.155.0"
+  },
+  "alg": "sha256/jcs",
+  "prev": "2f7c4ab1d0e58936b47c0f1a85d2e6b390c47f1825ad9603be7cd41f5029a8b7",
+  "hash": "83b5e1097cd264af3b0e7195c84fd6a201e73bc94f58026dae1f7c3b950de846"
+}

package/schema/fixtures/event/valid/harness-kind-cursor.json

@@ -0,0 +1,23 @@
+{
+  "seq": 52,
+  "ts": "2026-09-19T08:15:11Z",
+  "event": "task.registered",
+  "task": "hook:cursor-sess-1:toolu-12",
+  "actor": "agent:cursor",
+  "payload": {
+    "state": "proposed",
+    "actions": [
+      {
+        "class": "deps.add",
+        "summary": "npm install --save-dev oxlint",
+        "idempotency_key": "hook:cursor-sess-1:toolu-12:deps.add",
+        "payload_hash": "4d0a9c2b7e5f13860ad4c9b217e3f508cc61a7d2394b8e05f7ca61d3b8092e4f"
+      }
+    ],
+    "harness": "cursor",
+    "harness_version": "cursor-agent 2026.08.19"
+  },
+  "alg": "sha256/jcs",
+  "prev": "129eaa2bad261af1367f963979287653173eba8adce9961f09f08970f38d838f",
+  "hash": "2f7c4ab1d0e58936b47c0f1a85d2e6b390c47f1825ad9603be7cd41f5029a8b7"
+}

package/schema/fixtures/event/valid/harness-kind-grok.json

@@ -0,0 +1,23 @@
+{
+  "seq": 54,
+  "ts": "2026-09-19T08:17:44Z",
+  "event": "task.registered",
+  "task": "hook:grok-sess-1:toolu-14",
+  "actor": "agent:grok",
+  "payload": {
+    "state": "proposed",
+    "actions": [
+      {
+        "class": "deps.add",
+        "summary": "npm install --save-dev oxlint",
+        "idempotency_key": "hook:grok-sess-1:toolu-14:deps.add",
+        "payload_hash": "4d0a9c2b7e5f13860ad4c9b217e3f508cc61a7d2394b8e05f7ca61d3b8092e4f"
+      }
+    ],
+    "harness": "grok",
+    "harness_version": "grok 0.4.2"
+  },
+  "alg": "sha256/jcs",
+  "prev": "83b5e1097cd264af3b0e7195c84fd6a201e73bc94f58026dae1f7c3b950de846",
+  "hash": "c6410d97b28e53fa0716d8c4b93e250fa8d17c6b4093e5ad21fc80b7e5943d1a"
+}