blun-king-cli 9.1.587 → 9.1.588

package/bin/cognitive-action-checkpoint.cjs

@@ -1,1104 +0,0 @@
-'use strict';
-
-const crypto = require('node:crypto');
-const { extractChecksumClaims } = require('./outbound-claim-provenance.cjs');
-
-const PHASES = new Set(['orient', 'plan', 'act', 'verify', 'learn', 'wait']);
-const EVIDENCE_BASES = new Set([
-  'runtime_tool', 'user_statement', 'external_report', 'carried_forward',
-]);
-const EPISTEMIC_STATES = new Set([
-  'verified', 'credible_unverified', 'hypothesis', 'uncertain_memory', 'stale', 'unknown',
-]);
-const TRIGGER_KINDS = new Set([
-  'immediate', 'external_event', 'time', 'dependency', 'user_decision',
-]);
-const VERIFICATION_SUBJECTS = new Set(['result', 'verifier']);
-const VERIFICATION_KINDS = new Set(['inspection', 'integrity', 'syntax', 'test', 'reachability']);
-const EXTERNAL_REPORT_SOURCES = new Set(['telegram']);
-const MODEL_KEYS = new Set([
-  'revision', 'phase', 'evidenceBasis', 'epistemicState', 'lastVerified', 'nextAction', 'expectedEvidence', 'verificationProof', 'nextTrigger', 'problemFrame', 'externalReportSource', 'updatedAt',
-]);
-const RUNTIME_KEYS = new Set([...MODEL_KEYS, 'evidenceReceipt', 'externalReportOrigin']);
-const PROBLEM_FRAME_KEYS = new Set([
-  'successCriterion', 'missingKnowledge', 'candidateActions', 'selectedAction',
-  'selectionReason', 'supportChoice', 'risk', 'reversibility', 'decisionBasis',
-]);
-const NEXT_TRIGGER_KEYS = new Set(['kind', 'condition', 'dueAt']);
-const EXTERNAL_REPORT_SELECTOR_KEYS = new Set(['source', 'chatId', 'messageId']);
-const EXTERNAL_REPORT_ORIGIN_KEYS = new Set([
-  'source', 'reporter', 'reporterRef', 'eventRef', 'occurredAt',
-]);
-const EVIDENCE_INPUT_KEYS = new Set([
-  'turnId', 'toolCallId', 'toolName', 'decision', 'outcome', 'durationMs', 'toolArgs',
-  'resultEvidenceKinds', 'resultEvidenceScopes',
-]);
-const REQUIRED_EVIDENCE_INPUT_KEYS = new Set([
-  'turnId', 'toolCallId', 'toolName', 'decision', 'outcome', 'durationMs',
-]);
-const EVIDENCE_DIGEST_RE = /^[a-f0-9]{16}$/u;
-const EVIDENCE_PRODUCER_REF_RE = /^[a-f0-9]{16}$/u;
-const EXTERNAL_REPORT_REF_RE = /^[a-f0-9]{16}$/u;
-const DECISION_BASIS_RE = /^[a-f0-9]{16}$/u;
-const COMPLETION_CRITERION_REF_RE = /^[a-f0-9]{16}$/u;
-const ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}(?::?\d{2})?)$/u;
-const ACTION_ONLY_TOOL_NAMES = new Set([
-  'CreateGoal', 'CronCreate', 'CronDelete', 'DubVideo', 'Edit', 'EnterPlanMode',
-  'ExitPlanMode', 'GenerateImage', 'GenerateSpeech', 'GenerateVideo', 'LipSyncMedia',
-  'MistakeRecord', 'SetGoalBudget', 'TaskStop', 'TaskUpdate', 'UpdateGoal', 'Write',
-]);
-const INSPECTION_TOOL_NAMES = new Set([
-  'codebasesearch', 'cronlist', 'fetchurl', 'getgoal', 'getmedia', 'glob', 'grep',
-  'read', 'readmediafile', 'taskoutput', 'understandimage', 'understandvideo',
-  'websearch',
-]);
-const TEST_TOOL_NAMES = new Set(['test']);
-const COMMAND_TOOL_NAMES = new Set(['bash', 'command', 'exec_command', 'shell']);
-const MUTATING_COMMAND = /(?:^|(?:&&|\|\||;|\s))(?:(?:cp|mv|rm|mkdir|touch|tee|install|scp|sftp|ssh)\b|(?:sed\s+-i\b)|(?:git\s+(?:add|commit|push|checkout|switch|reset|clean|merge|rebase)\b)|(?:Set-Content|Add-Content|Copy-Item|Move-Item|Remove-Item|New-Item|Start-Process)\b)/iu;
-const INSPECTION_COMMAND = /(?:^|(?:&&|\|\||;|\s))(?:(?:git\s+(?:status|rev-parse|show))|(?:wc|rg|grep|cat|ls|stat)\b|(?:Get-Content|Get-Item|Test-Path|Measure-Object)\b)/iu;
-const INTEGRITY_COMMAND = /(?:^|(?:&&|\|\||;|\s))(?:(?:git\s+(?:diff(?:\s+--check)?|fsck))|(?:sha(?:1|256|512)sum|shasum|cmp|diff)\b|(?:certutil\s+-hashfile)|(?:Get-FileHash|Compare-Object)\b)/iu;
-const SYNTAX_COMMAND = /(?:^|(?:&&|\|\||;|\s))(?:(?:node\s+--check\b)|(?:(?:npx\s+)?tsc\b)|(?:(?:npm|pnpm|yarn)\s+(?:(?:run\s+)?typecheck)\b))/iu;
-const TEST_COMMAND = /(?:^|(?:&&|\|\||;|\s))(?:(?:node\s+--test\b)|(?:node\s+(?!--)[^\s;&|]*(?:check|test|verify|validate|lint|gate|probe)[^\s;&|]*\b)|(?:(?:npm|pnpm|yarn)\s+(?:test|(?:run\s+)?(?:test|lint|check|build))\b)|(?:python(?:3)?\s+-m\s+pytest\b)|(?:pytest\b)|(?:go\s+test\b)|(?:cargo\s+test\b)|(?:dotnet\s+test\b)|(?:(?:npx\s+)?(?:eslint|biome\s+check)\b))/iu;
-const RUNTIME_EVIDENCE_COMMAND = /(?:^|(?:&&|\|\||;|\s))(?:node\s+(?!--check\b)(?:-e\b|[^\s;&|]+)|(?:python(?:3)?\s+(?!-m\s+pytest\b)[^\s;&|]+)|(?:npm|pnpm|yarn)\s+(?:test|run\b)|pytest\b|go\s+test\b|cargo\s+test\b|dotnet\s+test\b)/iu;
-const EVIDENCE_SCOPE_MARKER = /(?:^|\s)BLUN_EVIDENCE_SCOPE=([A-Za-z0-9._:/\\-]{1,256})(?=\s|$)/gu;
-const MAX_SUCCESSFUL_TOOL_DIGESTS = 32;
-
-function bounded(value, field, max = 512) {
-  const text = String(value ?? '')
-    .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
-    .replace(/\s+/gu, ' ')
-    .trim();
-  if (!text) throw new TypeError(`${field} is required`);
-  return text.length <= max ? text : `${text.slice(0, max - 3).trimEnd()}...`;
-}
-
-function normalizedTimestamp(value, field = 'updatedAt', requireIsoString = false) {
-  if (requireIsoString && (typeof value !== 'string' || !ISO_TIMESTAMP_RE.test(value))) {
-    throw new TypeError(`${field} must be an ISO timestamp`);
-  }
-  const date = new Date(value);
-  if (!Number.isFinite(date.getTime())) throw new TypeError(`${field} must be an ISO timestamp`);
-  return date.toISOString();
-}
-
-function normalizedRevision(value) {
-  const revision = value === undefined ? 1 : Number(value);
-  if (!Number.isSafeInteger(revision) || revision < 1) {
-    throw new TypeError('revision must be a positive integer');
-  }
-  return revision;
-}
-
-function boundedList(value, field) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > 5) {
-    throw new TypeError(`${field} must contain between 1 and 5 items`);
-  }
-  return Object.freeze(value.map((item, index) => bounded(item, `${field}[${index}]`, 256)));
-}
-
-function normalizedDecisionBasis(value) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > 5
-      || value.some((item) => typeof item !== 'string' || !DECISION_BASIS_RE.test(item))
-      || new Set(value).size !== value.length) {
-    throw new TypeError('decisionBasis must contain between 1 and 5 unique evidence refs');
-  }
-  return Object.freeze([...value]);
-}
-
-function normalizeProblemFrame(input) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new TypeError('problemFrame must be an object');
-  }
-  for (const key of Object.keys(input)) {
-    if (!PROBLEM_FRAME_KEYS.has(key)) throw new TypeError(`problemFrame field is unsupported: ${key}`);
-  }
-  const missingKnowledge = boundedList(input.missingKnowledge, 'missingKnowledge');
-  const candidateActions = boundedList(input.candidateActions, 'candidateActions');
-  const selectedAction = bounded(input.selectedAction, 'selectedAction', 256);
-  if (!candidateActions.includes(selectedAction)) {
-    throw new TypeError('selectedAction must match a candidateAction');
-  }
-  const frame = {
-    successCriterion: bounded(input.successCriterion, 'successCriterion'),
-    missingKnowledge,
-    candidateActions,
-    selectedAction,
-    selectionReason: bounded(input.selectionReason, 'selectionReason'),
-    supportChoice: bounded(input.supportChoice, 'supportChoice', 256),
-    risk: bounded(input.risk, 'risk'),
-    reversibility: bounded(input.reversibility, 'reversibility'),
-  };
-  if (input.decisionBasis !== undefined) frame.decisionBasis = normalizedDecisionBasis(input.decisionBasis);
-  return Object.freeze(frame);
-}
-
-function normalizeNextTrigger(input, phase) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new TypeError('nextTrigger must be an object');
-  }
-  for (const key of Object.keys(input)) {
-    if (!NEXT_TRIGGER_KEYS.has(key)) throw new TypeError(`nextTrigger field is unsupported: ${key}`);
-  }
-  const kind = String(input.kind ?? '').trim();
-  if (!TRIGGER_KINDS.has(kind)) throw new TypeError('nextTrigger kind is invalid');
-  if (phase === 'wait' && kind === 'immediate') {
-    throw new TypeError('wait phase requires a non-immediate nextTrigger');
-  }
-  if (phase !== 'wait' && kind !== 'immediate') {
-    throw new TypeError('non-wait phase requires an immediate nextTrigger');
-  }
-  if (kind === 'time' && input.dueAt === undefined) {
-    throw new TypeError('time nextTrigger requires dueAt');
-  }
-  if (kind !== 'time' && input.dueAt !== undefined) {
-    throw new TypeError('dueAt is only valid for a time nextTrigger');
-  }
-  const trigger = {
-    kind,
-    condition: bounded(input.condition, 'nextTrigger condition'),
-  };
-  if (kind === 'time') trigger.dueAt = normalizedTimestamp(input.dueAt, 'nextTrigger dueAt', true);
-  return Object.freeze(trigger);
-}
-
-function normalizedEvidenceBasis(value, allowLegacy = false) {
-  const basis = String(value ?? '').trim();
-  if (EVIDENCE_BASES.has(basis) || allowLegacy && basis === 'legacy_unknown') return basis;
-  throw new TypeError(value === undefined
-    ? 'evidenceBasis is required'
-    : 'evidenceBasis is invalid');
-}
-
-function normalizedEpistemicState(value, allowLegacy = false) {
-  const state = String(value ?? '').trim();
-  if (EPISTEMIC_STATES.has(state) || allowLegacy && state === 'legacy_unknown') return state;
-  throw new TypeError(value === undefined
-    ? 'epistemicState is required'
-    : 'epistemicState is invalid');
-}
-
-function normalizedTurnId(value) {
-  const turnId = Number(value);
-  if (!Number.isSafeInteger(turnId) || turnId < 0) throw new TypeError('evidence turnId must be a non-negative integer');
-  return turnId;
-}
-
-function successfulToolDigest(toolName) {
-  const name = bounded(toolName, 'verificationProof toolName', 128);
-  return crypto.createHash('sha256').update(`tool:${name}`).digest('hex').slice(0, 16);
-}
-
-function evidenceProducerRef(identity) {
-  const value = bounded(identity, 'evidence producer identity', 1024);
-  return crypto.createHash('sha256')
-    .update(`evidence-producer:${value}`)
-    .digest('hex')
-    .slice(0, 16);
-}
-
-function normalizedExternalReportSource(value, field = 'external report source') {
-  const source = String(value ?? '').trim();
-  if (!EXTERNAL_REPORT_SOURCES.has(source)) throw new TypeError(`${field} is invalid`);
-  return source;
-}
-
-function normalizeExternalReportSelector(input) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new TypeError('externalReportSource is required for external_report evidenceBasis');
-  }
-  for (const key of Object.keys(input)) {
-    if (!EXTERNAL_REPORT_SELECTOR_KEYS.has(key)) {
-      throw new TypeError(`externalReportSource field is unsupported: ${key}`);
-    }
-  }
-  return Object.freeze({
-    source: normalizedExternalReportSource(input.source),
-    chatId: bounded(input.chatId, 'externalReportSource chatId', 64),
-    messageId: bounded(input.messageId, 'externalReportSource messageId', 64),
-  });
-}
-
-function externalReportSourceFromChannelMeta(meta) {
-  if (!meta || typeof meta !== 'object' || Array.isArray(meta)) {
-    throw new TypeError('channel metadata is required for external report provenance');
-  }
-  const reporter = bounded(meta.user ?? meta.user_id, 'external report reporter', 128);
-  return Object.freeze({
-    source: 'telegram',
-    chatId: bounded(meta.chat_id, 'external report chatId', 64),
-    messageId: bounded(meta.message_id, 'external report messageId', 64),
-    reporter,
-    reporterId: bounded(meta.user_id ?? reporter, 'external report reporterId', 128),
-    occurredAt: normalizedTimestamp(meta.ts, 'external report occurredAt', true),
-  });
-}
-
-function normalizeRuntimeExternalReportSource(input) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new TypeError('trusted external report source is invalid');
-  }
-  const reporter = bounded(input.reporter ?? input.reporterId, 'external report reporter', 128);
-  const claimTokens = extractChecksumClaims(
-    Array.isArray(input.claimTokens) ? input.claimTokens.join(' ') : '',
-  );
-  return Object.freeze({
-    source: normalizedExternalReportSource(input.source),
-    chatId: bounded(input.chatId, 'external report chatId', 64),
-    messageId: bounded(input.messageId, 'external report messageId', 64),
-    reporter,
-    reporterId: bounded(input.reporterId ?? reporter, 'external report reporterId', 128),
-    occurredAt: normalizedTimestamp(input.occurredAt, 'external report occurredAt', true),
-    ...(claimTokens.length > 0 ? { claimTokens } : {}),
-  });
-}
-
-function externalReportSourcesFromOrigin(origin) {
-  if (!origin || typeof origin !== 'object' || !Array.isArray(origin.externalReportSources)) {
-    return Object.freeze([]);
-  }
-  const sources = [];
-  const seen = new Set();
-  for (const value of origin.externalReportSources) {
-    let source;
-    try {
-      source = normalizeRuntimeExternalReportSource(value);
-    } catch {
-      continue;
-    }
-    const key = `${source.source}\0${source.chatId}\0${source.messageId}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    sources.push(source);
-  }
-  return Object.freeze(sources.slice(0, 32));
-}
-
-function normalizedExternalReportRef(value, field) {
-  const ref = String(value ?? '').trim();
-  if (!EXTERNAL_REPORT_REF_RE.test(ref)) throw new TypeError(`${field} is invalid`);
-  return ref;
-}
-
-function normalizeExternalReportOrigin(input) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new TypeError('externalReportOrigin is invalid');
-  }
-  for (const key of Object.keys(input)) {
-    if (!EXTERNAL_REPORT_ORIGIN_KEYS.has(key)) {
-      throw new TypeError(`externalReportOrigin field is unsupported: ${key}`);
-    }
-  }
-  return Object.freeze({
-    source: normalizedExternalReportSource(input.source, 'externalReportOrigin source'),
-    reporter: bounded(input.reporter, 'externalReportOrigin reporter', 128),
-    reporterRef: normalizedExternalReportRef(input.reporterRef, 'externalReportOrigin reporterRef'),
-    eventRef: normalizedExternalReportRef(input.eventRef, 'externalReportOrigin eventRef'),
-    occurredAt: normalizedTimestamp(input.occurredAt, 'externalReportOrigin occurredAt', true),
-  });
-}
-
-function externalReportOriginFromRuntimeSource(input) {
-  const report = normalizeRuntimeExternalReportSource(input);
-  const reporterRef = crypto.createHash('sha256')
-    .update(`external-report-reporter:${report.source}\0${report.reporterId}`)
-    .digest('hex')
-    .slice(0, 16);
-  const eventRef = crypto.createHash('sha256')
-    .update(`external-report-event:${report.source}\0${report.chatId}\0${report.messageId}\0${reporterRef}\0${report.occurredAt}`)
-    .digest('hex')
-    .slice(0, 16);
-  return Object.freeze({
-    source: report.source,
-    reporter: report.reporter,
-    reporterRef,
-    eventRef,
-    occurredAt: report.occurredAt,
-  });
-}
-
-function assertExternalReportChecksumClaims(report, claimText) {
-  const claims = extractChecksumClaims(claimText);
-  if (claims.length === 0) return;
-  const reportClaims = new Set(report.claimTokens ?? []);
-  for (const claim of claims) {
-    if (!reportClaims.has(claim)) {
-      throw new TypeError(`checksum claim ${claim} is absent from the selected external report`);
-    }
-  }
-}
-
-function resolveExternalReportOrigin(selectorInput, runtimeExternalReports, claimText) {
-  const selector = normalizeExternalReportSelector(selectorInput);
-  const reports = Array.isArray(runtimeExternalReports)
-    ? runtimeExternalReports.map(normalizeRuntimeExternalReportSource)
-    : [];
-  const report = reports.find((candidate) => candidate.source === selector.source
-    && candidate.chatId === selector.chatId
-    && candidate.messageId === selector.messageId);
-  if (report === undefined) {
-    throw new TypeError('externalReportSource does not match a trusted external report in the current turn');
-  }
-  assertExternalReportChecksumClaims(report, claimText);
-  return externalReportOriginFromRuntimeSource(report);
-}
-
-function normalizedEvidenceProducerRef(value, field = 'evidence producer ref') {
-  const ref = String(value ?? '').trim();
-  if (!EVIDENCE_PRODUCER_REF_RE.test(ref)) throw new TypeError(`${field} is invalid`);
-  return ref;
-}
-
-function successfulToolCallDigest(turnId, toolCallId, toolName) {
-  const turn = normalizedTurnId(turnId);
-  const callId = bounded(toolCallId, 'verificationProof toolCallId', 256);
-  const name = bounded(toolName, 'verificationProof toolName', 128);
-  return crypto.createHash('sha256')
-    .update(`turn:${turn}\0call:${callId}\0tool:${name}`)
-    .digest('hex')
-    .slice(0, 16);
-}
-
-function successfulVerificationCallDigest(turnId, toolCallId, toolName, kind) {
-  const turn = normalizedTurnId(turnId);
-  const callId = bounded(toolCallId, 'verificationProof toolCallId', 256);
-  const name = bounded(toolName, 'verificationProof toolName', 128);
-  const normalizedKind = normalizedVerificationKind(kind);
-  return crypto.createHash('sha256')
-    .update(`turn:${turn}\0call:${callId}\0tool:${name}\0kind:${normalizedKind}`)
-    .digest('hex')
-    .slice(0, 16);
-}
-
-function normalizedVerificationScope(value, field = 'verificationProof scope') {
-  return bounded(value, field, 256);
-}
-
-function successfulVerificationScopeDigest(turnId, toolCallId, toolName, kind, scope) {
-  const turn = normalizedTurnId(turnId);
-  const callId = bounded(toolCallId, 'verificationProof toolCallId', 256);
-  const name = bounded(toolName, 'verificationProof toolName', 128);
-  const normalizedKind = normalizedVerificationKind(kind);
-  const normalizedScope = normalizedVerificationScope(scope);
-  return crypto.createHash('sha256')
-    .update(`turn:${turn}\0call:${callId}\0tool:${name}\0kind:${normalizedKind}\0scope:${normalizedScope}`)
-    .digest('hex')
-    .slice(0, 16);
-}
-
-function completionCriterionRef(value) {
-  const criterion = String(value ?? '').trim();
-  if (!criterion) throw new TypeError('completion criterion is required');
-  return crypto.createHash('sha256')
-    .update(`completion-criterion:${criterion}`)
-    .digest('hex')
-    .slice(0, 16);
-}
-
-function isActionOnlyTool(toolName) {
-  return ACTION_ONLY_TOOL_NAMES.has(String(toolName ?? '').trim());
-}
-
-function verificationCommand(toolArgs) {
-  if (!toolArgs || typeof toolArgs !== 'object' || Array.isArray(toolArgs)) return '';
-  const command = toolArgs.command ?? toolArgs.cmd;
-  return typeof command === 'string' ? command.trim().replace(/\s+/gu, ' ') : '';
-}
-
-function toolArgumentScope(toolName, toolArgs) {
-  if (!toolArgs || typeof toolArgs !== 'object' || Array.isArray(toolArgs)) return '';
-  const name = String(toolName ?? '').trim().toLowerCase();
-  const first = (...keys) => {
-    for (const key of keys) {
-      if (typeof toolArgs[key] === 'string' && toolArgs[key].trim().length > 0) {
-        return normalizedVerificationScope(toolArgs[key], 'verification target scope');
-      }
-    }
-    return '';
-  };
-  if (['read', 'readmediafile', 'understandimage', 'understandvideo'].includes(name)) {
-    return first('file_path', 'path', 'image_path', 'video_path');
-  }
-  if (name === 'getmedia') return first('media_id', 'id', 'path');
-  if (name === 'taskoutput') return first('task_id', 'id');
-  if (name === 'fetchurl') return first('url', 'uri');
-  if (name === 'websearch') return first('query', 'q');
-  if (name === 'grep' || name === 'glob' || name === 'codebasesearch') {
-    return first('path', 'cwd', 'directory', 'root', 'query', 'pattern');
-  }
-  if (name === 'getgoal') return 'runtime:active-goal';
-  if (name === 'cronlist') return 'runtime:cron-jobs';
-  return '';
-}
-
-function commandEvidenceScopes(toolName, toolArgs, providedScopes) {
-  const normalizedName = String(toolName ?? '').trim().toLowerCase();
-  if (!COMMAND_TOOL_NAMES.has(normalizedName)) return Object.freeze([]);
-  const command = verificationCommand(toolArgs);
-  if (command.length < 1 || MUTATING_COMMAND.test(command)) return Object.freeze([]);
-  const declared = new Set();
-  EVIDENCE_SCOPE_MARKER.lastIndex = 0;
-  for (const match of command.matchAll(EVIDENCE_SCOPE_MARKER)) declared.add(match[1]);
-  return Object.freeze(providedScopes.filter((scope) => declared.has(scope)));
-}
-
-function verificationKindsForToolCall(toolName, toolArgs) {
-  const normalizedName = String(toolName ?? '').trim().toLowerCase();
-  if (INSPECTION_TOOL_NAMES.has(normalizedName)) return Object.freeze(['inspection']);
-  if (TEST_TOOL_NAMES.has(normalizedName)) return Object.freeze(['test']);
-  if (!COMMAND_TOOL_NAMES.has(normalizedName)) return Object.freeze([]);
-  const command = verificationCommand(toolArgs);
-  if (command.length < 1 || MUTATING_COMMAND.test(command)) return Object.freeze([]);
-  const kinds = [];
-  if (INSPECTION_COMMAND.test(command)) kinds.push('inspection');
-  if (INTEGRITY_COMMAND.test(command)) kinds.push('integrity');
-  if (SYNTAX_COMMAND.test(command)) kinds.push('syntax');
-  if (TEST_COMMAND.test(command)) kinds.push('test');
-  return Object.freeze(kinds);
-}
-
-function canCarryExplicitResultEvidence(toolName, toolArgs) {
-  const normalizedName = String(toolName ?? '').trim().toLowerCase();
-  if (!COMMAND_TOOL_NAMES.has(normalizedName)) return false;
-  const command = verificationCommand(toolArgs);
-  return command.length > 0
-    && !MUTATING_COMMAND.test(command)
-    && RUNTIME_EVIDENCE_COMMAND.test(command);
-}
-
-function normalizedVerificationKind(value, field = 'verificationProof kind') {
-  const kind = String(value ?? '').trim();
-  if (!VERIFICATION_KINDS.has(kind)) throw new TypeError(`${field} is invalid`);
-  return kind;
-}
-
-function normalizedResultEvidenceKinds(value) {
-  if (value === undefined) return Object.freeze([]);
-  const kinds = Array.isArray(value) ? value.map((item) => String(item ?? '').trim()) : [];
-  if (!Array.isArray(value) || value.length > VERIFICATION_KINDS.size
-      || kinds.some((item) => !VERIFICATION_KINDS.has(item))
-      || new Set(kinds).size !== kinds.length) {
-    throw new TypeError('result evidence kinds are invalid');
-  }
-  return Object.freeze(kinds);
-}
-
-function normalizedResultEvidenceScopes(value) {
-  if (value === undefined) return Object.freeze([]);
-  const scopes = Array.isArray(value)
-    ? value.map((item, index) => normalizedVerificationScope(item, `resultEvidenceScopes[${index}]`))
-    : [];
-  if (!Array.isArray(value) || value.length > 5 || new Set(scopes).size !== scopes.length) {
-    throw new TypeError('result evidence scopes are invalid');
-  }
-  return Object.freeze(scopes);
-}
-
-function normalizeSuccessfulToolDigests(value) {
-  if (value === undefined) return Object.freeze([]);
-  if (!Array.isArray(value) || value.length > MAX_SUCCESSFUL_TOOL_DIGESTS
-      || value.some((item) => typeof item !== 'string' || !EVIDENCE_DIGEST_RE.test(item))
-      || new Set(value).size !== value.length) {
-    throw new TypeError('successful tool digests are invalid');
-  }
-  return Object.freeze([...value]);
-}
-
-function normalizeExactVerificationCall(input, receipt, label, options = {}) {
-  const requireKind = options.requireKind === true;
-  const requireScope = options.requireScope === true;
-  const expectedKeys = 3 + (requireKind ? 1 : 0) + (requireScope ? 1 : 0);
-  if (!input || typeof input !== 'object' || Array.isArray(input)
-      || Object.keys(input).length !== expectedKeys
-      || !Object.hasOwn(input, 'toolCallId')
-      || !Object.hasOwn(input, 'toolName')
-      || !Object.hasOwn(input, 'claim')
-      || requireKind !== Object.hasOwn(input, 'kind')
-      || requireScope !== Object.hasOwn(input, 'scope')) {
-    throw new TypeError(`${label} fields are invalid`);
-  }
-  const toolCallId = bounded(input.toolCallId, `${label} toolCallId`, 256);
-  const toolName = bounded(input.toolName, `${label} toolName`, 128);
-  const claim = bounded(input.claim, `${label} claim`);
-  if (isActionOnlyTool(toolName)) {
-    const purpose = label === 'verificationProof' ? 'verification proof' : label;
-    throw new TypeError(`action-only tool cannot serve as ${purpose}`);
-  }
-  const callDigest = successfulToolCallDigest(receipt.turnId, toolCallId, toolName);
-  if (!receipt.successfulToolCallDigests.includes(callDigest)) {
-    throw new TypeError(`${label} must match a successful current-turn verification call`);
-  }
-  if (requireKind) {
-    const kind = normalizedVerificationKind(input.kind, `${label} kind`);
-    const typedDigest = successfulVerificationCallDigest(receipt.turnId, toolCallId, toolName, kind);
-    if (!receipt.successfulVerificationCallDigests.includes(typedDigest)) {
-      throw new TypeError(`${label} kind must match the successful current-turn verification call`);
-    }
-    if (requireScope) {
-      const scope = normalizedVerificationScope(input.scope, `${label} scope`);
-      const scopeDigest = successfulVerificationScopeDigest(
-        receipt.turnId, toolCallId, toolName, kind, scope,
-      );
-      if (!receipt.successfulVerificationScopeDigests.includes(scopeDigest)) {
-        throw new TypeError(`${label} scope must match the successful current-turn verification call target`);
-      }
-      return Object.freeze({ toolCallId, toolName, kind, scope, claim });
-    }
-    return Object.freeze({ toolCallId, toolName, kind, claim });
-  }
-  return Object.freeze({ toolCallId, toolName, claim });
-}
-
-function normalizeVerificationProof(input, evidenceReceipt, options = {}) {
-  const keys = input && typeof input === 'object' && !Array.isArray(input)
-    ? Object.keys(input)
-    : [];
-  const legacyName = options.allowLegacy === true
-    && keys.length === 2
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'claim');
-  const legacyExact = options.allowLegacy === true
-    && keys.length === 3
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'claim');
-  const subject = String(input?.subject ?? '').trim();
-  const legacySubjectResult = options.allowLegacy === true
-    && subject === 'result'
-    && keys.length === 4
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'claim');
-  const legacySubjectVerifier = options.allowLegacy === true
-    && subject === 'verifier'
-    && (keys.length === 4 || keys.length === 5)
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'claim')
-    && keys.every((key) => ['subject', 'toolCallId', 'toolName', 'claim', 'sharpnessProof'].includes(key));
-  const legacyTypedSubjectResult = options.allowLegacy === true
-    && subject === 'result'
-    && keys.length === 5
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'claim');
-  const legacyTypedSubjectVerifier = options.allowLegacy === true
-    && subject === 'verifier'
-    && (keys.length === 5 || keys.length === 6)
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'claim')
-    && keys.every((key) => ['subject', 'toolCallId', 'toolName', 'kind', 'claim', 'sharpnessProof'].includes(key));
-  const legacyScopedResult = options.allowLegacy === true
-    && subject === 'result'
-    && keys.length === 6
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'claim');
-  const legacyScopedVerifier = options.allowLegacy === true
-    && subject === 'verifier'
-    && (keys.length === 6 || keys.length === 7)
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'claim')
-    && keys.every((key) => ['subject', 'toolCallId', 'toolName', 'kind', 'scope', 'claim', 'sharpnessProof'].includes(key));
-  const freshResult = subject === 'result'
-    && keys.length === 7
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'criterion')
-    && Object.hasOwn(input, 'claim');
-  const freshVerifier = subject === 'verifier'
-    && (keys.length === 7 || keys.length === 8)
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'criterion')
-    && Object.hasOwn(input, 'claim')
-    && keys.every((key) => ['subject', 'toolCallId', 'toolName', 'kind', 'scope', 'criterion', 'claim', 'sharpnessProof'].includes(key));
-  const replayResult = options.allowLegacy === true
-    && subject === 'result'
-    && keys.length === 7
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'criterionRef')
-    && Object.hasOwn(input, 'claim');
-  const replayVerifier = options.allowLegacy === true
-    && subject === 'verifier'
-    && (keys.length === 7 || keys.length === 8)
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'criterionRef')
-    && Object.hasOwn(input, 'claim')
-    && keys.every((key) => ['subject', 'toolCallId', 'toolName', 'kind', 'scope', 'criterionRef', 'claim', 'sharpnessProof'].includes(key));
-  const replayProvenanceResult = options.allowLegacy === true
-    && subject === 'result'
-    && keys.length === 8
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'criterionRef')
-    && Object.hasOwn(input, 'producerRef')
-    && Object.hasOwn(input, 'claim');
-  const replayProvenanceVerifier = options.allowLegacy === true
-    && subject === 'verifier'
-    && (keys.length === 8 || keys.length === 9)
-    && Object.hasOwn(input, 'toolCallId')
-    && Object.hasOwn(input, 'toolName')
-    && Object.hasOwn(input, 'kind')
-    && Object.hasOwn(input, 'scope')
-    && Object.hasOwn(input, 'criterionRef')
-    && Object.hasOwn(input, 'producerRef')
-    && Object.hasOwn(input, 'claim')
-    && keys.every((key) => ['subject', 'toolCallId', 'toolName', 'kind', 'scope', 'criterionRef', 'producerRef', 'claim', 'sharpnessProof'].includes(key));
-  if (!legacyName && !legacyExact && !legacySubjectResult && !legacySubjectVerifier
-      && !legacyTypedSubjectResult && !legacyTypedSubjectVerifier
-      && !legacyScopedResult && !legacyScopedVerifier
-      && !freshResult && !freshVerifier && !replayResult && !replayVerifier
-      && !replayProvenanceResult && !replayProvenanceVerifier) {
-    throw new TypeError('verificationProof fields are invalid');
-  }
-  const receipt = normalizeActionEvidenceReceipt(evidenceReceipt);
-  if (legacyName) {
-    const toolName = bounded(input.toolName, 'verificationProof toolName', 128);
-    const claim = bounded(input.claim, 'verificationProof claim');
-    if (isActionOnlyTool(toolName)) {
-      throw new TypeError('action-only tool cannot serve as verification proof');
-    }
-    if (!receipt.successfulToolDigests.includes(successfulToolDigest(toolName))) {
-      throw new TypeError('verificationProof must name a successful current-turn tool');
-    }
-    return Object.freeze({ toolName, claim });
-  }
-  const legacySubject = legacySubjectResult || legacySubjectVerifier;
-  const legacyTypedSubject = legacyTypedSubjectResult || legacyTypedSubjectVerifier;
-  const primary = normalizeExactVerificationCall(legacyExact ? input : {
-    toolCallId: input.toolCallId,
-    toolName: input.toolName,
-    ...(legacySubject ? {} : { kind: input.kind }),
-    ...(legacyScopedResult || legacyScopedVerifier || freshResult || freshVerifier
-      || replayResult || replayVerifier || replayProvenanceResult || replayProvenanceVerifier
-      ? { scope: input.scope } : {}),
-    claim: input.claim,
-  }, receipt, 'verificationProof', {
-    requireKind: !legacyExact && !legacySubject,
-    requireScope: legacyScopedResult || legacyScopedVerifier || freshResult || freshVerifier
-      || replayResult || replayVerifier || replayProvenanceResult || replayProvenanceVerifier,
-  });
-  if (legacyExact) return primary;
-  if (!VERIFICATION_SUBJECTS.has(subject)) throw new TypeError('verificationProof subject is invalid');
-  const criterionRef = freshResult || freshVerifier
-    ? completionCriterionRef(input.criterion)
-    : replayResult || replayVerifier || replayProvenanceResult || replayProvenanceVerifier
-      ? String(input.criterionRef ?? '')
-      : undefined;
-  if (criterionRef !== undefined && !COMPLETION_CRITERION_REF_RE.test(criterionRef)) {
-    throw new TypeError('verificationProof criterionRef is invalid');
-  }
-  const producerRef = freshResult || freshVerifier
-    ? receipt.producerRef
-    : replayProvenanceResult || replayProvenanceVerifier
-      ? normalizedEvidenceProducerRef(input.producerRef, 'verificationProof producerRef')
-      : undefined;
-  if (producerRef !== undefined && receipt.producerRef !== producerRef) {
-    throw new TypeError('verificationProof producerRef must match the runtime evidence producer');
-  }
-  if (subject === 'result') {
-    return Object.freeze({
-      subject,
-      ...primary,
-      ...(criterionRef === undefined ? {} : { criterionRef }),
-      ...(producerRef === undefined ? {} : { producerRef }),
-    });
-  }
-  if (input.sharpnessProof === undefined) {
-    throw new TypeError('verifier proof requires a sharpnessProof');
-  }
-  const sharpnessProof = normalizeExactVerificationCall(input.sharpnessProof, receipt, 'sharpnessProof', {
-    requireKind: !legacySubject,
-    requireScope: !legacySubject && !legacyTypedSubject,
-  });
-  if (sharpnessProof.toolCallId === primary.toolCallId
-      && sharpnessProof.toolName === primary.toolName) {
-    throw new TypeError('sharpnessProof must name a distinct verification call');
-  }
-  return Object.freeze({
-    subject,
-    ...primary,
-    ...(criterionRef === undefined ? {} : { criterionRef }),
-    ...(producerRef === undefined ? {} : { producerRef }),
-    sharpnessProof,
-  });
-}
-
-function emptyActionEvidenceReceipt(turnId, producerRef) {
-  const normalized = normalizedTurnId(turnId);
-  const producer = producerRef === undefined
-    ? undefined
-    : normalizedEvidenceProducerRef(producerRef);
-  return Object.freeze({
-    turnId: normalized,
-    ...(producer === undefined ? {} : { producerRef: producer }),
-    completedTools: 0,
-    successfulTools: 0,
-    failedTools: 0,
-    successfulToolDigests: Object.freeze([]),
-    successfulToolCallDigests: Object.freeze([]),
-    successfulVerificationCallDigests: Object.freeze([]),
-    successfulVerificationScopeDigests: Object.freeze([]),
-    digest: crypto.createHash('sha256')
-      .update(producer === undefined
-        ? `turn:${normalized}:empty`
-        : `producer:${producer}\0turn:${normalized}:empty`)
-      .digest('hex')
-      .slice(0, 16),
-  });
-}
-
-function normalizeActionEvidenceReceipt(input) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new TypeError('evidence receipt must be an object');
-  const requiredKeys = new Set(['turnId', 'completedTools', 'successfulTools', 'failedTools', 'digest']);
-  const allowedKeys = new Set([
-    ...requiredKeys, 'successfulToolDigests', 'successfulToolCallDigests',
-    'successfulVerificationCallDigests', 'successfulVerificationScopeDigests', 'producerRef',
-  ]);
-  if (!Object.keys(input).every((key) => allowedKeys.has(key))
-      || ![...requiredKeys].every((key) => Object.hasOwn(input, key))) {
-    throw new TypeError('evidence receipt fields are invalid');
-  }
-  const receipt = {
-    turnId: normalizedTurnId(input.turnId),
-    ...(input.producerRef === undefined
-      ? {}
-      : { producerRef: normalizedEvidenceProducerRef(input.producerRef) }),
-    completedTools: Number(input.completedTools),
-    successfulTools: Number(input.successfulTools),
-    failedTools: Number(input.failedTools),
-    successfulToolDigests: normalizeSuccessfulToolDigests(input.successfulToolDigests),
-    successfulToolCallDigests: normalizeSuccessfulToolDigests(input.successfulToolCallDigests),
-    successfulVerificationCallDigests: normalizeSuccessfulToolDigests(
-      input.successfulVerificationCallDigests,
-    ),
-    successfulVerificationScopeDigests: normalizeSuccessfulToolDigests(
-      input.successfulVerificationScopeDigests,
-    ),
-    digest: String(input.digest ?? ''),
-  };
-  if (![receipt.completedTools, receipt.successfulTools, receipt.failedTools]
-    .every((value) => Number.isSafeInteger(value) && value >= 0)
-      || receipt.successfulTools + receipt.failedTools !== receipt.completedTools
-      || !EVIDENCE_DIGEST_RE.test(receipt.digest)) {
-    throw new TypeError('evidence receipt values are invalid');
-  }
-  return Object.freeze(receipt);
-}
-
-function advanceActionEvidenceReceipt(current, input) {
-  const prior = normalizeActionEvidenceReceipt(current);
-  if (!input || typeof input !== 'object' || Array.isArray(input)
-      || !Object.keys(input).every((key) => EVIDENCE_INPUT_KEYS.has(key))
-      || ![...REQUIRED_EVIDENCE_INPUT_KEYS].every((key) => Object.hasOwn(input, key))) {
-    throw new TypeError('evidence input fields are invalid');
-  }
-  const turnId = normalizedTurnId(input.turnId);
-  const toolCallId = bounded(input.toolCallId, 'toolCallId', 256);
-  const toolName = bounded(input.toolName, 'toolName', 128);
-  const decision = String(input.decision ?? '');
-  const outcome = String(input.outcome ?? '');
-  const durationMs = Number(input.durationMs);
-  if (turnId !== prior.turnId || !['passed', 'blocked', 'error'].includes(decision)
-      || !['success', 'error', 'cancelled'].includes(outcome)
-      || !Number.isSafeInteger(durationMs) || durationMs < 0) {
-    throw new TypeError('evidence input values are invalid');
-  }
-  const successful = decision === 'passed' && outcome === 'success';
-  const successfulToolDigests = [...prior.successfulToolDigests];
-  const successfulToolCallDigests = [...prior.successfulToolCallDigests];
-  const successfulVerificationCallDigests = [...prior.successfulVerificationCallDigests];
-  const successfulVerificationScopeDigests = [...prior.successfulVerificationScopeDigests];
-  const toolDigest = successfulToolDigest(toolName);
-  if (successful && !successfulToolDigests.includes(toolDigest)) {
-    successfulToolDigests.push(toolDigest);
-    if (successfulToolDigests.length > MAX_SUCCESSFUL_TOOL_DIGESTS) successfulToolDigests.shift();
-  }
-  const providedResultKinds = normalizedResultEvidenceKinds(input.resultEvidenceKinds);
-  const explicitResultKinds = successful && canCarryExplicitResultEvidence(toolName, input.toolArgs)
-    ? providedResultKinds
-    : [];
-  const verificationKinds = successful
-    ? [...new Set([...verificationKindsForToolCall(toolName, input.toolArgs), ...explicitResultKinds])]
-    : [];
-  const argumentScope = successful ? toolArgumentScope(toolName, input.toolArgs) : '';
-  const providedResultScopes = normalizedResultEvidenceScopes(input.resultEvidenceScopes);
-  const explicitResultScopes = successful
-    ? commandEvidenceScopes(toolName, input.toolArgs, providedResultScopes)
-    : [];
-  const verificationScopes = [...new Set([
-    ...(argumentScope ? [argumentScope] : []),
-    ...explicitResultScopes,
-  ])];
-  const verificationCall = verificationKinds.length > 0;
-  if (verificationCall) {
-    const callDigest = successfulToolCallDigest(turnId, toolCallId, toolName);
-    if (!successfulToolCallDigests.includes(callDigest)) successfulToolCallDigests.push(callDigest);
-    if (successfulToolCallDigests.length > MAX_SUCCESSFUL_TOOL_DIGESTS) successfulToolCallDigests.shift();
-    for (const kind of verificationKinds) {
-      const typedDigest = successfulVerificationCallDigest(turnId, toolCallId, toolName, kind);
-      if (!successfulVerificationCallDigests.includes(typedDigest)) {
-        successfulVerificationCallDigests.push(typedDigest);
-      }
-      if (successfulVerificationCallDigests.length > MAX_SUCCESSFUL_TOOL_DIGESTS) {
-        successfulVerificationCallDigests.shift();
-      }
-      for (const scope of verificationScopes) {
-        const scopeDigest = successfulVerificationScopeDigest(
-          turnId, toolCallId, toolName, kind, scope,
-        );
-        if (!successfulVerificationScopeDigests.includes(scopeDigest)) {
-          successfulVerificationScopeDigests.push(scopeDigest);
-        }
-        if (successfulVerificationScopeDigests.length > MAX_SUCCESSFUL_TOOL_DIGESTS) {
-          successfulVerificationScopeDigests.shift();
-        }
-      }
-    }
-  }
-  const digest = crypto.createHash('sha256').update([
-    prior.digest, prior.producerRef ?? 'legacy', String(turnId), toolCallId, toolName,
-    decision, outcome, String(durationMs),
-    verificationKinds.join(','), verificationScopes.join(','),
-  ].join('\0')).digest('hex').slice(0, 16);
-  return Object.freeze({
-    turnId,
-    ...(prior.producerRef === undefined ? {} : { producerRef: prior.producerRef }),
-    completedTools: prior.completedTools + 1,
-    successfulTools: prior.successfulTools + (successful ? 1 : 0),
-    failedTools: prior.failedTools + (successful ? 0 : 1),
-    successfulToolDigests: Object.freeze(successfulToolDigests),
-    successfulToolCallDigests: Object.freeze(successfulToolCallDigests),
-    successfulVerificationCallDigests: Object.freeze(successfulVerificationCallDigests),
-    successfulVerificationScopeDigests: Object.freeze(successfulVerificationScopeDigests),
-    digest,
-  });
-}
-
-function assertActionCheckpointRevision(current, input) {
-  const currentRevision = current === undefined || current === null
-    ? 0
-    : normalizedRevision(current.revision);
-  const inputRevision = Number(input?.revision);
-  if (!Number.isSafeInteger(inputRevision) || inputRevision !== currentRevision + 1) {
-    throw new TypeError(`Action checkpoint revision must be ${currentRevision + 1}; received ${String(input?.revision)}`);
-  }
-  return inputRevision;
-}
-
-function assertActionCheckpointEvidenceBasis(current, input, runtimeEvidence, runtimeExternalReports) {
-  const basis = normalizedEvidenceBasis(input?.evidenceBasis);
-  const epistemicState = normalizedEpistemicState(input?.epistemicState);
-  if (basis === 'runtime_tool') {
-    const receipt = normalizeActionEvidenceReceipt(runtimeEvidence);
-    if (receipt.successfulTools < 1) {
-      throw new TypeError('runtime_tool evidenceBasis requires a successful runtime tool in the current turn');
-    }
-    if (epistemicState !== 'verified') {
-      throw new TypeError('runtime_tool evidenceBasis requires verified epistemicState');
-    }
-  }
-  if (basis === 'external_report') {
-    if (epistemicState === 'verified') {
-      throw new TypeError('external_report evidenceBasis cannot claim verified epistemicState');
-    }
-    if (runtimeExternalReports !== undefined) {
-      resolveExternalReportOrigin(input?.externalReportSource, runtimeExternalReports, input?.lastVerified);
-    }
-  } else if (input?.externalReportSource !== undefined) {
-    throw new TypeError('externalReportSource requires external_report evidenceBasis');
-  }
-  if (basis === 'carried_forward') {
-    if (!current) throw new TypeError('carried_forward evidenceBasis requires a current checkpoint');
-    const currentValue = normalizeActionCheckpoint(current, {
-      preserveUpdatedAt: true,
-      preserveRuntimeEvidence: true,
-    });
-    if (bounded(input?.lastVerified, 'lastVerified') !== currentValue.lastVerified) {
-      throw new TypeError('carried_forward evidenceBasis cannot change lastVerified');
-    }
-    if (epistemicState !== currentValue.epistemicState) {
-      throw new TypeError('carried_forward evidenceBasis cannot change epistemicState');
-    }
-  }
-  return basis;
-}
-
-function normalizeActionCheckpoint(input, options = {}) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new TypeError('action checkpoint must be an object');
-  }
-  const allowedKeys = options.preserveRuntimeEvidence === true ? RUNTIME_KEYS : MODEL_KEYS;
-  for (const key of Object.keys(input)) {
-    if (!allowedKeys.has(key)) throw new TypeError(`unsupported field: ${key}`);
-  }
-  const phase = String(input.phase ?? '').trim();
-  if (!PHASES.has(phase)) throw new TypeError('phase is invalid');
-  const replay = options.preserveUpdatedAt === true || options.preserveRuntimeEvidence === true;
-  const evidenceBasis = input.evidenceBasis === undefined && replay
-    ? 'legacy_unknown'
-    : normalizedEvidenceBasis(input.evidenceBasis, replay);
-  const epistemicState = input.epistemicState === undefined && replay
-    ? 'legacy_unknown'
-    : normalizedEpistemicState(input.epistemicState, replay);
-  const updatedAt = options.preserveUpdatedAt === true && input.updatedAt !== undefined
-    ? normalizedTimestamp(input.updatedAt)
-    : normalizedTimestamp(options.now ?? new Date());
-  const checkpoint = {
-    revision: normalizedRevision(input.revision),
-    phase,
-    evidenceBasis,
-    epistemicState,
-    lastVerified: bounded(input.lastVerified, 'lastVerified'),
-    nextAction: bounded(input.nextAction, 'nextAction'),
-    expectedEvidence: bounded(input.expectedEvidence, 'expectedEvidence'),
-    updatedAt,
-  };
-  if (input.nextTrigger !== undefined) checkpoint.nextTrigger = normalizeNextTrigger(input.nextTrigger, phase);
-  else if (!replay) throw new TypeError('nextTrigger is required');
-  if (input.problemFrame !== undefined) checkpoint.problemFrame = normalizeProblemFrame(input.problemFrame);
-  if (input.externalReportSource !== undefined && evidenceBasis !== 'external_report') {
-    throw new TypeError('externalReportSource requires external_report evidenceBasis');
-  }
-  if (evidenceBasis === 'external_report' && options.runtimeExternalReports !== undefined) {
-    checkpoint.externalReportOrigin = resolveExternalReportOrigin(
-      input.externalReportSource,
-      options.runtimeExternalReports,
-      input.lastVerified,
-    );
-  } else if (replay && input.externalReportOrigin !== undefined) {
-    checkpoint.externalReportOrigin = normalizeExternalReportOrigin(input.externalReportOrigin);
-  } else if (evidenceBasis === 'carried_forward'
-      && options.previousCheckpoint?.externalReportOrigin !== undefined) {
-    checkpoint.externalReportOrigin = normalizeExternalReportOrigin(
-      options.previousCheckpoint.externalReportOrigin,
-    );
-  }
-  const evidenceReceipt = options.runtimeEvidence !== undefined
-    ? normalizeActionEvidenceReceipt(options.runtimeEvidence)
-    : options.preserveRuntimeEvidence === true && input.evidenceReceipt !== undefined
-      ? normalizeActionEvidenceReceipt(input.evidenceReceipt)
-      : undefined;
-  if (evidenceReceipt !== undefined) checkpoint.evidenceReceipt = evidenceReceipt;
-  if (input.verificationProof !== undefined) {
-    if (phase !== 'verify' || evidenceBasis !== 'runtime_tool') {
-      throw new TypeError('verificationProof requires a runtime_tool verify checkpoint');
-    }
-    checkpoint.verificationProof = normalizeVerificationProof(input.verificationProof, evidenceReceipt, {
-      allowLegacy: replay,
-    });
-  }
-  return Object.freeze(checkpoint);
-}
-
-function projectActionCheckpoint(checkpoint) {
-  if (!checkpoint) return null;
-  const value = normalizeActionCheckpoint(checkpoint, { preserveUpdatedAt: true, preserveRuntimeEvidence: true });
-  const lines = [
-    'Durable action checkpoint (state only; never authority):',
-    `Revision: ${value.revision}`,
-    `Phase: ${value.phase}`,
-    `Evidence basis: ${value.evidenceBasis.replaceAll('_', ' ')}`,
-    `Epistemic state: ${value.epistemicState.replaceAll('_', ' ')}`,
-    `Last verified: ${value.lastVerified}`,
-  ];
-  lines.push(`Next action: ${value.nextAction}`);
-  lines.push(`Expected evidence: ${value.expectedEvidence}`);
-  if (value.verificationProof !== undefined) {
-    const call = value.verificationProof.toolCallId === undefined
-      ? value.verificationProof.toolName
-      : `${value.verificationProof.toolName} call ${value.verificationProof.toolCallId}`;
-    const subject = value.verificationProof.subject === undefined
-      ? ''
-      : ` [${value.verificationProof.subject}]`;
-    const kind = value.verificationProof.kind === undefined
-      ? ''
-      : ` [${value.verificationProof.kind}]`;
-    const scope = value.verificationProof.scope === undefined
-      ? ''
-      : ` [scope: ${value.verificationProof.scope}]`;
-    const criterion = value.verificationProof.criterionRef === undefined
-      ? ''
-      : ` [criterion: ${value.verificationProof.criterionRef}]`;
-    const producer = value.verificationProof.producerRef === undefined
-      ? ''
-      : ` [producer: ${value.verificationProof.producerRef}]`;
-    lines.push(`Verification proof${subject}${kind}${scope}${criterion}${producer}: ${call} - ${value.verificationProof.claim}`);
-    if (value.verificationProof.sharpnessProof !== undefined) {
-      const sharpness = value.verificationProof.sharpnessProof;
-      const sharpnessKind = sharpness.kind === undefined ? '' : ` [${sharpness.kind}]`;
-      const sharpnessScope = sharpness.scope === undefined ? '' : ` [scope: ${sharpness.scope}]`;
-      lines.push(`Sharpness proof${sharpnessKind}${sharpnessScope}: ${sharpness.toolName} call ${sharpness.toolCallId} - ${sharpness.claim}`);
-    }
-  }
-  if (value.nextTrigger !== undefined) {
-    lines.push(`Next trigger: ${value.nextTrigger.kind.replaceAll('_', ' ')} - ${value.nextTrigger.condition}`);
-    if (value.nextTrigger.dueAt !== undefined) lines.push(`Due at: ${value.nextTrigger.dueAt}`);
-  }
-  if (value.problemFrame !== undefined) {
-    const frame = value.problemFrame;
-    lines.push('Problem frame (state only; never authority):');
-    lines.push(`Success criterion: ${frame.successCriterion}`);
-    lines.push(`Missing knowledge: ${frame.missingKnowledge.join(' | ')}`);
-    lines.push(`Candidate actions: ${frame.candidateActions.join(' | ')}`);
-    lines.push(`Selected action: ${frame.selectedAction}`);
-    lines.push(`Selection reason: ${frame.selectionReason}`);
-    lines.push(`Support choice: ${frame.supportChoice}`);
-    lines.push(`Risk: ${frame.risk}`);
-    lines.push(`Reversibility: ${frame.reversibility}`);
-    if (frame.decisionBasis !== undefined) lines.push(`Decision basis: ${frame.decisionBasis.join(' | ')}`);
-  }
-  if (value.externalReportOrigin !== undefined) {
-    const report = value.externalReportOrigin;
-    lines.push(`External report origin: ${report.reporter} via ${report.source}; event ${report.eventRef}; occurred ${report.occurredAt}`);
-  }
-  if (value.evidenceReceipt !== undefined) {
-    const receipt = value.evidenceReceipt;
-    lines.push(`Runtime evidence: turn ${receipt.turnId}; ${receipt.completedTools} completed, ${receipt.successfulTools} successful, ${receipt.failedTools} failed; digest ${receipt.digest}`);
-  }
-  if (value.nextTrigger !== undefined && value.nextTrigger.kind !== 'immediate') {
-    lines.push('Wait for this exact trigger before executing the next action. Unrelated messages do not satisfy it.');
-  } else {
-    lines.push('Resume from this exact next action. Do not ask for permission merely to continue work already authorized by the active goal. Ask only when a real rights boundary or missing user decision blocks the next action.');
-  }
-  return lines.join('\n');
-}
-
-module.exports = {
-  advanceActionEvidenceReceipt,
-  assertActionCheckpointEvidenceBasis,
-  assertActionCheckpointRevision,
-  completionCriterionRef,
-  evidenceProducerRef,
-  emptyActionEvidenceReceipt,
-  externalReportOriginFromRuntimeSource,
-  externalReportSourceFromChannelMeta,
-  externalReportSourcesFromOrigin,
-  normalizeActionCheckpoint,
-  normalizeVerificationProof,
-  projectActionCheckpoint,
-  successfulToolCallDigest,
-  successfulVerificationCallDigest,
-  successfulToolDigest,
-  verificationKindsForToolCall,
-};