chainlesschain 0.166.22 → 0.166.25

package/src/lib/evolution/evolution-workbench-runtime.js

@@ -0,0 +1,133 @@
+import { types } from "node:util";
+import { capturePruningData as capture } from "./governed-wiki-pruning-journal.js";
+import { createEvolutionWorkbenchRegistrySource } from "./evolution-workbench-registry-source.js";
+import { createEvolutionWorkbenchReviewRuntime } from "./evolution-workbench-review-ledger-adapter.js";
+import { createEvolutionWorkbenchRollbackRuntime } from "./evolution-workbench-rollback-ledger-adapter.js";
+import { createEvolutionWorkbenchCliHost } from "./evolution-workbench-cli-host.js";
+
+const REQUIRED = [
+  "descriptor",
+  "artifactPorts",
+  "ledger",
+  "ledgerArtifactResolver",
+  "releaseRegistry",
+  "transactionLedger",
+  "verifierLedger",
+  "verifierLedgerArtifactResolver",
+  "verifierReleaseRegistry",
+  "verifierTransactionLedger",
+  "rollbackProvider",
+  "authorizationProvider",
+  "identityProvider",
+  "decisionVerifier",
+  "humanDecisionProvider",
+  "humanDecisionVerifier",
+  "humanRollbackProvider",
+  "humanRollbackVerifier",
+];
+const OPTIONAL = ["invocationReceiptSource", "pilotSource", "now"];
+
+function optionsRecord(value) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    types.isProxy(value)
+  )
+    throw new TypeError("Workbench runtime requires explicit resource options");
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const allowed = new Set([...REQUIRED, ...OPTIONAL]);
+  if (
+    Reflect.ownKeys(descriptors).some((key) => !allowed.has(key)) ||
+    REQUIRED.some((key) => !Object.hasOwn(descriptors, key))
+  )
+    throw new TypeError("Workbench runtime resources are missing or replaced");
+  const output = {};
+  for (const [key, property] of Object.entries(descriptors)) {
+    if (!Object.hasOwn(property, "value"))
+      throw new TypeError(
+        "Workbench runtime resource accessors are not allowed",
+      );
+    output[key] = property.value;
+  }
+  return output;
+}
+
+function fixed(owner, name) {
+  if (!owner || types.isProxy(owner))
+    throw new TypeError(`Workbench ${name} fixed port is required`);
+  const fn = Object.getOwnPropertyDescriptor(owner, name)?.value;
+  if (typeof fn !== "function" || types.isProxy(fn))
+    throw new TypeError(`Workbench ${name} fixed own method is required`);
+  return Object.freeze({ [name]: fn.bind(owner) });
+}
+
+// Open/recover the actual Registry before calling this assembly. Nothing here
+// creates credentials or grants permissions. No host escapes before current
+// storage, all adapters and existing-effect reconciliation have been verified.
+export async function createEvolutionWorkbenchRuntime(input) {
+  const options = optionsRecord(input);
+  const descriptor = capture(options.descriptor);
+  const shared = {
+    descriptor,
+    artifactPorts: options.artifactPorts,
+    ledger: options.ledger,
+    ledgerArtifactResolver: options.ledgerArtifactResolver,
+    now: options.now ?? Date.now,
+  };
+  const identityProvider = fixed(options.identityProvider, "current");
+  const registrySource = createEvolutionWorkbenchRegistrySource({
+    ...shared,
+    releaseRegistry: options.releaseRegistry,
+    transactionLedger: options.transactionLedger,
+    verifierLedger: options.verifierLedger,
+    verifierLedgerArtifactResolver: options.verifierLedgerArtifactResolver,
+    verifierReleaseRegistry: options.verifierReleaseRegistry,
+    verifierTransactionLedger: options.verifierTransactionLedger,
+  });
+  const review = createEvolutionWorkbenchReviewRuntime({
+    ...shared,
+    registrySource,
+    decisionVerifier: fixed(options.decisionVerifier, "verify"),
+    humanDecisionProvider: fixed(options.humanDecisionProvider, "request"),
+    humanDecisionVerifier: fixed(options.humanDecisionVerifier, "verify"),
+    invocationReceiptSource: options.invocationReceiptSource ?? null,
+    pilotSource: options.pilotSource ?? null,
+  });
+  const rollback = createEvolutionWorkbenchRollbackRuntime({
+    ...shared,
+    projectionReader: review.projectionReader,
+    releaseRegistry: options.releaseRegistry,
+    transactionLedger: options.transactionLedger,
+    verifierReleaseRegistry: options.verifierReleaseRegistry,
+    verifierTransactionLedger: options.verifierTransactionLedger,
+    rollbackProvider: options.rollbackProvider,
+    authorizationProvider: fixed(
+      options.authorizationProvider,
+      "authorizeRollback",
+    ),
+    humanRollbackProvider: fixed(options.humanRollbackProvider, "authorize"),
+    humanRollbackVerifier: fixed(options.humanRollbackVerifier, "verify"),
+  });
+  const reviewRecovery = await review.reconcileCommitted();
+  const rollbackRecovery = await rollback.reconcileCommitted();
+  await review.projectionLoader.load();
+  const workbenchHost = createEvolutionWorkbenchCliHost({
+    tenantId: descriptor.tenantId,
+    projectionLoader: review.projectionLoader,
+    projectionAuthority: review.projectionAuthority,
+    identityProvider,
+    activeStateReader: rollback.activeStateReader,
+    batchExecutor: review.batchExecutor,
+    rollbackExecutor: rollback.rollbackExecutor,
+  });
+  return Object.freeze({
+    workbenchHost,
+    recovery: capture({
+      reviewsSettled: reviewRecovery.settledItems.length,
+      reviewPreparationsDeferred: reviewRecovery.deferredRequestDigests.length,
+      rollbacksSettled: rollbackRecovery.settledReceipts.length,
+      rollbackPlansDeferred: rollbackRecovery.deferredPlanDigests.length,
+    }),
+  });
+}

package/src/lib/evolution/evolution-workbench-version-control.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { types } from "node:util";
+import { capturePruningData } from "./governed-wiki-pruning-journal.js";
 
 import { filterEvolutionWorkbenchProjection } from "./evolution-workbench-projection.js";
 
@@ -156,7 +158,8 @@ export function buildEvolutionWorkbenchRollbackPlan(
   });
 }
 
-function verifyPlan(plan, tenantId) {
+export function verifyEvolutionWorkbenchRollbackPlan(input, tenantId) {
+  const plan = capturePruningData(input);
   if (
     plan?.schema !== EVOLUTION_WORKBENCH_ROLLBACK_PLAN_SCHEMA ||
     plan.tenantId !== tenantId ||
@@ -170,9 +173,57 @@ function verifyPlan(plan, tenantId) {
   return freeze(clone(plan));
 }
 
+export function buildEvolutionWorkbenchRollbackRequest(
+  plan,
+  authorizationReceiptDigest,
+) {
+  const core = {
+    planDigest: plan.planDigest,
+    expectedActiveStateDigest: plan.expectedActiveStateDigest,
+    fromContentDigest: plan.fromContentDigest,
+    toContentDigest: plan.toContentDigest,
+    authorizationReceiptDigest: digest(
+      authorizationReceiptDigest,
+      "authorization receipt",
+    ),
+  };
+  return freeze({
+    ...core,
+    requestDigest: hash(
+      "chainlesschain.evolution-workbench-rollback-request/v1",
+      core,
+    ),
+  });
+}
+
+export function buildEvolutionWorkbenchRollbackReceipt(
+  plan,
+  request,
+  transitionReceiptDigest,
+  active,
+) {
+  const core = {
+    schema: EVOLUTION_WORKBENCH_ROLLBACK_RECEIPT_SCHEMA,
+    tenantId: plan.tenantId,
+    skillName: plan.skillName,
+    planDigest: plan.planDigest,
+    requestDigest: request.requestDigest,
+    authorizationReceiptDigest: request.authorizationReceiptDigest,
+    transitionReceiptDigest,
+    activeStateDigest: active.stateDigest,
+    activeContentDigest: active.contentDigest,
+  };
+  return freeze({
+    ...core,
+    receiptDigest: hash(EVOLUTION_WORKBENCH_ROLLBACK_RECEIPT_SCHEMA, core),
+  });
+}
+
 export class EvolutionWorkbenchRollbackExecutor {
   constructor({ tenantId, ports } = {}) {
     this.tenantId = string(tenantId, "tenantId");
+    if (!ports || types.isProxy(ports))
+      throw new TypeError("fixed rollback ports are required");
     for (const name of [
       "loadProjection",
       "authorizeHumanRollback",
@@ -180,14 +231,16 @@ export class EvolutionWorkbenchRollbackExecutor {
       "readActiveState",
       "commitRollback",
     ]) {
-      if (typeof ports?.[name] !== "function")
+      const method = Object.getOwnPropertyDescriptor(ports, name)?.value;
+      if (typeof method !== "function" || types.isProxy(method))
         throw new TypeError(`Workbench rollback port ${name} is required`);
-      this[`_${name}`] = ports[name].bind(ports);
+      this[`_${name}`] = method.bind(ports);
     }
+    Object.freeze(this);
   }
 
   async execute(input) {
-    const plan = verifyPlan(input, this.tenantId);
+    const plan = verifyEvolutionWorkbenchRollbackPlan(input, this.tenantId);
     const projection = await this._loadProjection({
       tenantId: this.tenantId,
       projectionDigest: plan.sourceProjectionDigest,
@@ -210,20 +263,10 @@ export class EvolutionWorkbenchRollbackExecutor {
       !DIGEST.test(authorization.receiptDigest ?? "")
     )
       throw new Error("Workbench rollback lacks exact human authorization");
-    const requestCore = {
-      planDigest: plan.planDigest,
-      expectedActiveStateDigest: plan.expectedActiveStateDigest,
-      fromContentDigest: plan.fromContentDigest,
-      toContentDigest: plan.toContentDigest,
-      authorizationReceiptDigest: authorization.receiptDigest,
-    };
-    const request = freeze({
-      ...requestCore,
-      requestDigest: hash(
-        "chainlesschain.evolution-workbench-rollback-request/v1",
-        requestCore,
-      ),
-    });
+    const request = buildEvolutionWorkbenchRollbackRequest(
+      plan,
+      authorization.receiptDigest,
+    );
     const applied = await this._applyRollback(request);
     if (
       applied?.authenticated !== true ||
@@ -238,28 +281,19 @@ export class EvolutionWorkbenchRollbackExecutor {
     });
     if (
       active?.authenticated !== true ||
+      active.durable !== true ||
+      active.tenantId !== this.tenantId ||
+      active.skillName !== plan.skillName ||
       active.contentDigest !== plan.toContentDigest ||
       !DIGEST.test(active.stateDigest ?? "")
     )
       throw new Error("Workbench rollback active readback differs from target");
-    const receiptCore = {
-      schema: EVOLUTION_WORKBENCH_ROLLBACK_RECEIPT_SCHEMA,
-      tenantId: this.tenantId,
-      skillName: plan.skillName,
-      planDigest: plan.planDigest,
-      requestDigest: request.requestDigest,
-      authorizationReceiptDigest: authorization.receiptDigest,
-      transitionReceiptDigest: applied.receiptDigest,
-      activeStateDigest: active.stateDigest,
-      activeContentDigest: active.contentDigest,
-    };
-    const receipt = freeze({
-      ...receiptCore,
-      receiptDigest: hash(
-        EVOLUTION_WORKBENCH_ROLLBACK_RECEIPT_SCHEMA,
-        receiptCore,
-      ),
-    });
+    const receipt = buildEvolutionWorkbenchRollbackReceipt(
+      plan,
+      request,
+      applied.receiptDigest,
+      active,
+    );
     const committed = await this._commitRollback({ receipt });
     if (
       committed?.authenticated !== true ||

package/src/lib/evolution/evolvable-artifact-ledger-adapter.js

@@ -14,6 +14,7 @@ import {
 const {
   EVOLVABLE_ARTIFACT_PERSISTENCE_RECEIPT_SCHEMA,
   EVOLVABLE_ARTIFACT_ACTIVE_RELEASE_SCHEMA,
+  EVOLVABLE_ARTIFACT_CANDIDATE_READ_SCHEMA,
   EVOLVABLE_ARTIFACT_TRANSITION_REQUEST_SCHEMA,
   EVOLVABLE_ARTIFACT_TRANSITION_RECEIPT_SCHEMA,
   createEvolvableArtifactActiveReleaseReader,
@@ -510,6 +511,53 @@ export class EvolvableArtifactLedgerAdapter {
     return reader;
   }
 
+  candidateProvider() {
+    const adapter = this;
+    return Object.freeze({
+      readerScope: this.readerScope,
+      async readCandidate({ type, artifactId, candidateId } = {}) {
+        if (!ARTIFACT_TYPES.has(type))
+          throw new TypeError("candidate artifact type is invalid");
+        const normalizedArtifactId = text(artifactId, "artifactId");
+        const normalizedCandidateId = text(candidateId, "candidateId");
+        const matches = adapter
+          ._events(EVOLVABLE_ARTIFACT_CANDIDATE_EVENT)
+          .map((event) =>
+            adapter._resolve(
+              event,
+              "evolvable-artifact-candidate",
+              "candidate",
+            ),
+          )
+          .filter(
+            (record) =>
+              record.artifact.type === type &&
+              record.artifact.artifactId === normalizedArtifactId &&
+              record.artifact.candidate.candidateId === normalizedCandidateId,
+          );
+        if (matches.length > 1)
+          throw new Error("candidate artifact read is ambiguous");
+        if (matches.length === 0) return null;
+        const record = matches[0];
+        return freeze({
+          schema: EVOLVABLE_ARTIFACT_CANDIDATE_READ_SCHEMA,
+          authenticated: true,
+          durable: true,
+          tenantId: record.artifact.tenantId,
+          type: record.artifact.type,
+          artifactId: record.artifact.artifactId,
+          candidateId: record.artifact.candidate.candidateId,
+          contentDigest: record.artifact.contentDigest,
+          artifactDigest: record.artifact.artifactDigest,
+          artifact: record.artifact,
+          persistenceReceipt: record.receipt,
+          contentAvailable: record.contentAvailable,
+          content: record.content,
+        });
+      },
+    });
+  }
+
   _activeArtifacts() {
     const histories = new Map();
     for (const event of this._events(EVOLVABLE_ARTIFACT_TRANSITION_EVENT)) {

package/src/lib/evolution/governed-knowledge-candidate-rejection.js

@@ -0,0 +1,343 @@
+import { captureSkillCandidateRegistryReader } from "./skill-candidate-registry.js";
+import { captureSkillReleaseRegistryReader } from "./skill-release-registry.js";
+import { captureSkillReleaseOperationReader } from "./evolution-ledger-ports.js";
+import { captureWikiRevisionReader } from "./wiki-maintainer-ledger-adapter.js";
+import { governedKnowledgeSourceRef } from "./governed-knowledge-skill-rollback.js";
+import {
+  createGovernedKnowledgeDependencyAuthority,
+  GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
+  digestGovernedKnowledgeDependencyResult,
+} from "./governed-knowledge-dependency-authority.js";
+import {
+  capturePruningData as captureData,
+  pruningDigest as digest,
+  pruningCanonical as canonical,
+} from "./governed-wiki-pruning-journal.js";
+
+const VERIFICATION_SCHEMA =
+  "chainlesschain.knowledge-candidate-rejection-verification/v1";
+const QUARANTINE_VERIFICATION_SCHEMA =
+  "chainlesschain.knowledge-candidate-quarantine-verification/v1";
+function fail(message) {
+  throw new Error(`knowledge candidate disposition: ${message}`);
+}
+
+function bindReader(
+  candidateRegistry,
+  releaseRegistry,
+  transactionLedger,
+  tenantId,
+  wikiAdapter,
+) {
+  const candidates = captureSkillCandidateRegistryReader(candidateRegistry);
+  const releases = captureSkillReleaseRegistryReader(releaseRegistry);
+  if (
+    candidates.tenantId !== tenantId ||
+    releases.tenantId !== tenantId ||
+    !releases.matchesTransactionLedger(transactionLedger)
+  ) {
+    throw new TypeError(
+      "candidate rejection registry/ledger tenant binding differs",
+    );
+  }
+  const operations = captureSkillReleaseOperationReader(transactionLedger);
+  const wiki =
+    wikiAdapter == null ? null : captureWikiRevisionReader(wikiAdapter);
+  if (
+    wiki &&
+    (wiki.descriptor.tenantId !== tenantId ||
+      !operations.matchesWikiAdapter(wikiAdapter))
+  )
+    throw new TypeError("candidate Wiki tenant differs");
+  return Object.freeze({ candidates, releases, operations, wiki });
+}
+
+function sourceProof(reader, candidate, request, admission) {
+  const ref = governedKnowledgeSourceRef(request);
+  const direct = candidate.sourceEvidenceRefs.some(
+    (entry) => entry.ref === ref && entry.digest === request.contentDigest,
+  );
+  let wiki = null;
+  if (candidate.derivationMode === "wiki") {
+    if (!reader.wiki)
+      fail("Wiki-derived candidate requires an authenticated Wiki reader");
+    const revision = reader.wiki.readKnowledgeProvenance({
+      tenantId: request.tenantId,
+      revisionId: candidate.wikiRevision,
+      knowledgeId: request.knowledgeId,
+      contentDigest: request.contentDigest,
+    });
+    if (
+      ["epoch", "ledgerId", "identityDigest"].some(
+        (key) => revision.checkpoint[key] !== admission.checkpoint[key],
+      ) ||
+      revision.checkpoint.sequence >= admission.fence.sequence ||
+      admission.history.some(
+        (entry) => revision.checkpoint.sequence >= entry.preparationSequence,
+      )
+    ) {
+      fail(
+        "Wiki provenance must precede revocation and every original promotion",
+      );
+    }
+    wiki = {
+      revisionId: revision.revisionId,
+      stateDigest: revision.stateDigest,
+      checkpoint: revision.checkpoint,
+      affectedPatternIds: revision.affectedPatternIds,
+    };
+  }
+  if (!direct && !wiki?.affectedPatternIds.length)
+    fail("candidate source lineage does not identify the revoked Knowledge");
+  return captureData({ direct, wiki });
+}
+
+function prove(reader, request, context, disposition) {
+  if (
+    request.dependency.kind !== "candidate" ||
+    request.dependency.disposition !== disposition
+  ) {
+    fail(`this provider requires a candidate / ${disposition} dependency`);
+  }
+  const candidate = reader.candidates.read(request.dependency.digest);
+  if (
+    candidate.tenantId !== request.tenantId ||
+    candidate.candidateId !== request.dependency.digest
+  )
+    fail("candidate identity differs");
+  const resolve =
+    disposition === "quarantine"
+      ? reader.operations.resolveCandidateQuarantine
+      : reader.operations.resolveCandidateRevocation;
+  const admission = resolve({
+    tenantId: request.tenantId,
+    skillName: candidate.skillName,
+    candidateId: candidate.candidateId,
+    operationDigest: request.operationDigest,
+    context,
+  });
+  if (!admission.fence || admission.fence.record.deviceId !== request.deviceId)
+    fail("no exact durable candidate admission fence");
+  const knowledge = admission.fence.record.knowledge;
+  for (const key of [
+    "tenantId",
+    "knowledgeId",
+    "action",
+    "contentDigest",
+    "revocationReceiptDigest",
+  ]) {
+    if (knowledge[key] !== request[key])
+      fail("prepared revocation differs from request");
+  }
+  if (admission.pendingTransactions.length)
+    fail(
+      "in-flight release transition requires recovery before candidate disposition can settle",
+    );
+  const active = reader.releases.readActive(candidate.skillName);
+  if (
+    Boolean(active) !== Boolean(admission.current) ||
+    (active &&
+      (active.release.releaseDigest !== admission.current.releaseDigest ||
+        active.state.stateDigest !== admission.current.stateDigest ||
+        active.state.revision !== admission.current.revision ||
+        admission.current.projection.current !== true))
+  )
+    fail("actual active state differs from authenticated release history");
+  let lastKnownGood = null;
+  if (active) {
+    lastKnownGood = reader.releases.readRelease(
+      active.state.lastKnownGoodReleaseDigest,
+    );
+    if (
+      active.release.candidate.candidateId === candidate.candidateId ||
+      lastKnownGood.candidate.candidateId === candidate.candidateId
+    ) {
+      fail(
+        "active or rollback-eligible candidate requires real release rollback first",
+      );
+    }
+  }
+  const source = sourceProof(reader, candidate, request, admission);
+  if (canonical(reader.operations.currentContext()) !== canonical(context))
+    fail("ledger changed during candidate verification");
+  return captureData({
+    candidateId: candidate.candidateId,
+    skillName: candidate.skillName,
+    source,
+    admission,
+    active: active
+      ? {
+          releaseDigest: active.release.releaseDigest,
+          stateDigest: active.state.stateDigest,
+          lastKnownGoodReleaseDigest: lastKnownGood.releaseDigest,
+        }
+      : null,
+  });
+}
+
+export function createGovernedKnowledgeCandidateRejectionAuthority(
+  options = {},
+) {
+  return createCandidateDispositionAuthority(options, "reject-candidate");
+}
+
+// Quarantine is a distinct, persistent admission disposition, not rejection or
+// a draft-label rewrite. Neither factory may certify an active/LKG candidate.
+export function createGovernedKnowledgeCandidateQuarantineAuthority(
+  options = {},
+) {
+  return createCandidateDispositionAuthority(options, "quarantine");
+}
+
+function createCandidateDispositionAuthority(
+  {
+    tenantId,
+    deviceId,
+    candidateRegistry,
+    releaseRegistry,
+    transactionLedger,
+    verifierCandidateRegistry,
+    verifierReleaseRegistry,
+    verifierTransactionLedger,
+    wikiLedgerAdapter = null,
+    verifierWikiLedgerAdapter = null,
+    providerDescriptor,
+    verifierDescriptor,
+  },
+  disposition,
+) {
+  if (
+    candidateRegistry === verifierCandidateRegistry ||
+    releaseRegistry === verifierReleaseRegistry ||
+    transactionLedger === verifierTransactionLedger ||
+    (wikiLedgerAdapter !== null &&
+      wikiLedgerAdapter === verifierWikiLedgerAdapter) ||
+    Boolean(wikiLedgerAdapter) !== Boolean(verifierWikiLedgerAdapter)
+  ) {
+    throw new TypeError(
+      "candidate rejection requires independent fixed readers",
+    );
+  }
+  const provider = bindReader(
+    candidateRegistry,
+    releaseRegistry,
+    transactionLedger,
+    tenantId,
+    wikiLedgerAdapter,
+  );
+  const verifier = bindReader(
+    verifierCandidateRegistry,
+    verifierReleaseRegistry,
+    verifierTransactionLedger,
+    tenantId,
+    verifierWikiLedgerAdapter,
+  );
+  const providerHead = provider.operations.currentContext().checkpoint;
+  const verifierHead = verifier.operations.currentContext().checkpoint;
+  if (
+    ["epoch", "ledgerId", "identityDigest"].some(
+      (key) => providerHead[key] !== verifierHead[key],
+    )
+  ) {
+    throw new TypeError(
+      "candidate rejection readers belong to different ledgers",
+    );
+  }
+  if (
+    provider.wiki &&
+    canonical(provider.wiki.descriptor) !== canonical(verifier.wiki.descriptor)
+  )
+    throw new TypeError("candidate Wiki reader scopes differ");
+  const providerIdentity = captureData(providerDescriptor);
+  const verifierIdentity = captureData(verifierDescriptor);
+  function proofPair(request) {
+    const context = provider.operations.currentContext();
+    const other = verifier.operations.currentContext();
+    if (canonical(context) !== canonical(other))
+      fail("independent readers do not authenticate the same current ledger");
+    const left = prove(provider, request, context, disposition);
+    const right = prove(verifier, request, context, disposition);
+    if (canonical(left) !== canonical(right))
+      fail("independent candidate rejection proof differs");
+    return left;
+  }
+  return createGovernedKnowledgeDependencyAuthority({
+    tenantId,
+    deviceId,
+    providerDescriptor: providerIdentity,
+    verifierDescriptor: verifierIdentity,
+    provider: Object.freeze({
+      async apply(request) {
+        // Preparation already activated the mandatory admission fence. This
+        // authority certifies its real effect; it never changes a draft label
+        // or reports success while an active/in-flight version can survive.
+        const proof = proofPair(request);
+        const evidence = proof.admission.fence.evidence;
+        const core = {
+          schema: GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
+          tenantId,
+          deviceId,
+          operationId: request.operationId,
+          requestDigest: request.requestDigest,
+          knowledgeId: request.knowledgeId,
+          revocationReceiptDigest: request.revocationReceiptDigest,
+          dependencyKind: request.dependency.kind,
+          dependencyDigest: request.dependency.digest,
+          dependencyDisposition: request.dependency.disposition,
+          authorityId: providerIdentity.authorityId,
+          authorityRevision: providerIdentity.revision,
+          handlerArtifactDigest: providerIdentity.handlerArtifactDigest,
+          applied: true,
+          durable: true,
+          idempotent: true,
+          appliedAt: evidence.timestamp,
+        };
+        const { algorithm, keyId, value } = evidence.signature;
+        return captureData({
+          ...core,
+          resultDigest: digestGovernedKnowledgeDependencyResult(core),
+          attestation: { algorithm, keyId, value },
+        });
+      },
+    }),
+    verifier: Object.freeze({
+      async verify({ request, result }) {
+        const proof = proofPair(request);
+        const evidence = proof.admission.fence.evidence;
+        const { algorithm, keyId, value } = evidence.signature;
+        if (
+          result.appliedAt !== evidence.timestamp ||
+          canonical(result.attestation) !==
+            canonical({ algorithm, keyId, value })
+        )
+          fail("result differs from authenticated admission fence");
+        return captureData({
+          authenticated: true,
+          durable: true,
+          tenantId,
+          deviceId,
+          operationId: request.operationId,
+          requestDigest: request.requestDigest,
+          resultDigest: result.resultDigest,
+          providerAuthorityId: providerIdentity.authorityId,
+          providerRevision: providerIdentity.revision,
+          verifierAuthorityId: verifierIdentity.authorityId,
+          verifierRevision: verifierIdentity.revision,
+          verificationReceiptDigest: digest(
+            disposition === "quarantine"
+              ? QUARANTINE_VERIFICATION_SCHEMA
+              : VERIFICATION_SCHEMA,
+            {
+              tenantId,
+              deviceId,
+              requestDigest: request.requestDigest,
+              resultDigest: result.resultDigest,
+              proof,
+              verifierIdentity,
+            },
+          ),
+        });
+      },
+    }),
+  });
+}