chati-dev 4.5.28 → 4.5.29

package/node_modules/@chati/planning/src/browser-verification-plan.js

@@ -0,0 +1,71 @@
+import { isAbsolute, resolve } from 'node:path';
+import { ContractError } from '@chati/core';
+import { assertBrowserCapabilityForTask } from '@chati/browser-capability';
+
+export const BROWSER_OBSERVER_TOOL_ID = 'chati-playwright-api-v1';
+function fail(message, code = 'BROWSER_OBSERVATION_INVALID') { throw new ContractError(code, message); }
+function exact(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).length !== fields.length || Object.keys(value).some((key) => !fields.includes(key))) fail(`${label} has an invalid closed schema`);
+}
+function text(value, limit = 8192) { return typeof value === 'string' && value.length > 0 && !value.includes('\0') && Buffer.byteLength(value) <= limit; }
+function localPath(value) { return text(value) && value.startsWith('/') && !value.startsWith('//') && !value.includes('\\'); }
+function executable(value) {
+  exact(value, ['executable_path', 'executable_sha256'], 'executable binding');
+  if (!text(value.executable_path) || !isAbsolute(value.executable_path) || resolve(value.executable_path) !== value.executable_path
+    || !/^[a-f0-9]{64}$/.test(value.executable_sha256)) fail('browser tools require absolute paths and SHA-256 bindings');
+}
+
+/** Shared schema for the frozen plan and its resolved, observed execution. */
+export function validateBrowserObservationPlan(input, { frozen = false } = {}) {
+  exact(input, ['application', 'browser', 'hostname', 'ready_path', 'timeout_ms', 'steps'], 'browser observation plan');
+  exact(input.application, ['executable_binding', 'args', frozen ? 'stdin_ref' : 'stdin', 'port',
+    ...(Object.hasOwn(input.application ?? {}, 'listener_transport') ? ['listener_transport'] : [])], 'application');
+  executable(input.application.executable_binding);
+  const app = input.application;
+  if (Object.hasOwn(app, 'listener_transport') && app.listener_transport !== 'darwin_prebound_tcp_v1') fail('unsupported explicit application listener transport');
+  const scriptValid = frozen ? /^local-artifact:\/\/sha256\/[a-f0-9]{64}$/.test(app.stdin_ref || '') : text(app.stdin, 1024 * 1024);
+  if (!Array.isArray(app.args) || app.args.length > 64 || app.args.some((arg) => typeof arg !== 'string' || arg.includes('\0') || Buffer.byteLength(arg) > 8192)
+    || !scriptValid || !Number.isInteger(app.port) || app.port < 1024 || app.port > 65535) fail('application requires bounded literal arguments, frozen startup content and port');
+  exact(input.browser, ['executable_binding', 'playwright_version'], 'browser');
+  executable(input.browser.executable_binding);
+  if (!/^\d+\.\d+\.\d+$/.test(input.browser.playwright_version)) fail('browser driver version must be explicit');
+  if (!text(input.hostname, 253) || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(input.hostname)
+    || !localPath(input.ready_path) || !Number.isInteger(input.timeout_ms) || input.timeout_ms < 1 || input.timeout_ms > 1800000) fail('browser requires a DNS hostname, local readiness path and bounded timeout');
+  if (!Array.isArray(input.steps) || input.steps.length < 2 || input.steps.length > 64 || input.steps[0]?.action !== 'navigate') fail('browser requires navigation and a bounded nonempty scenario');
+  let assertions = 0;
+  for (const step of input.steps) {
+    const fields = { navigate: ['action', 'path'], click: ['action', 'selector'], fill: ['action', 'selector', 'text'],
+      assert_text: ['action', 'selector', 'text'], assert_visible: ['action', 'selector'] }[step?.action];
+    if (!fields) fail('unsupported browser action');
+    exact(step, fields, 'browser step');
+    if (step.action === 'navigate' ? !localPath(step.path) : !text(step.selector, 2048)) fail('browser step has an invalid path or selector');
+    if ('text' in step && (typeof step.text !== 'string' || step.text.includes('\0') || Buffer.byteLength(step.text) > 8192)) fail('browser input and assertion text must be bounded');
+    if (step.action.startsWith('assert_')) assertions += 1;
+  }
+  if (assertions === 0) fail('browser scenario must contain an actual assertion');
+  return input;
+}
+
+export function validateTaskBrowserVerificationPlan(task, { required = false } = {}) {
+  const plan = task?.browser_verification_plan;
+  if (plan === undefined) {
+    if (required) fail('browser verification requires a council-approved frozen plan', 'BROWSER_VERIFICATION_PLAN_REQUIRED');
+    return null;
+  }
+  try {
+    exact(plan, ['schema_version', 'tool_id', 'evidence_kind', 'criterion_refs', 'observation'], 'frozen browser verification plan');
+    const policy = assertBrowserCapabilityForTask(task);
+    if (task.requires_browser !== true || !policy || policy.mode !== 'unauthenticated'
+      || policy.tool !== 'approved-other' || policy.approved_tool_id !== BROWSER_OBSERVER_TOOL_ID
+      || plan.tool_id !== BROWSER_OBSERVER_TOOL_ID || plan.schema_version !== 1 || plan.evidence_kind !== 'dom-assertions') {
+      fail('the local observer requires an explicit unauthenticated Playwright API policy and DOM-assertion evidence, not visual-quality approval');
+    }
+    const known = new Set(task.acceptance_criteria_refs);
+    if (known.size === 0 || !Array.isArray(plan.criterion_refs) || plan.criterion_refs.length !== known.size
+      || new Set(plan.criterion_refs).size !== known.size || plan.criterion_refs.some((ref) => !known.has(ref))) fail('browser scenario must bind every task acceptance criterion exactly once');
+    validateBrowserObservationPlan(plan.observation, { frozen: true });
+    if (!policy.allowed_domains.some((domain) => plan.observation.hostname === domain || plan.observation.hostname.endsWith(`.${domain}`))) fail('browser scenario hostname is outside the task policy');
+  } catch (error) { fail(error.message, 'BROWSER_VERIFICATION_PLAN_INVALID'); }
+  return plan;
+}

package/node_modules/@chati/planning/src/index.js

@@ -1,6 +1,12 @@
 import { execFileSync } from 'node:child_process';
 import { ContractError, canonicalize, sha256 } from '@chati/core';
 import { assertBrowserCapabilityForTask } from '@chati/browser-capability';
+import { validatePlanningMaterial } from './planning-material.js';
+import { validateTaskVerificationPlan } from './verification-plan.js';
+import { validateTaskBrowserVerificationPlan } from './browser-verification-plan.js';
+export { validatePlanningMaterial, PLANNING_MATERIAL_MAX_BYTES } from './planning-material.js';
+export { validateTaskVerificationPlan } from './verification-plan.js';
+export { validateTaskBrowserVerificationPlan, validateBrowserObservationPlan, BROWSER_OBSERVER_TOOL_ID } from './browser-verification-plan.js';
 
 const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 const GIT_OBJECT_ID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
@@ -64,6 +70,21 @@ function validateTask(task, knownTaskIds) {
   for (const field of ['provider_id', 'harness_id', 'model_id', 'reasoning_configuration']) {
     assertString(task.execution_binding[field], 'TASK_EXECUTION_BINDING_REQUIRED', `task.execution_binding.${field}`);
   }
+  if (task.review_binding !== undefined) {
+    assertObject(task.review_binding, 'TASK_REVIEW_BINDING_REQUIRED', 'task.review_binding');
+    for (const field of ['provider_id', 'harness_id', 'model_id', 'reasoning_configuration']) {
+      assertString(task.review_binding[field], 'TASK_REVIEW_BINDING_REQUIRED', `task.review_binding.${field}`);
+    }
+    if (task.review_binding.attained_independence_level !== undefined && !['A', 'B', 'C'].includes(task.review_binding.attained_independence_level)) {
+      fail('INVALID_HANDOFF_TASK', 'task.review_binding.attained_independence_level must be A, B or C');
+    }
+  }
+  if (task.requirement_refs !== undefined) {
+    assertStringArray(task.requirement_refs, 'TASK_REQUIREMENT_TRACEABILITY_REQUIRED', 'task.requirement_refs', { allowEmpty: false });
+    if (new Set(task.requirement_refs).size !== task.requirement_refs.length) fail('TASK_REQUIREMENT_TRACEABILITY_REQUIRED', 'task.requirement_refs must be unique');
+  }
+  if (task.routing_profile !== undefined) assertObject(task.routing_profile, 'INVALID_HANDOFF_TASK', 'task.routing_profile');
+  if (task.effort_plan !== undefined) assertObject(task.effort_plan, 'INVALID_HANDOFF_TASK', 'task.effort_plan');
   if (task.clickup_ref !== undefined) assertImmutableRef(task.clickup_ref, 'INVALID_HANDOFF_TASK', 'task.clickup_ref');
   if (task.requires_browser !== undefined && typeof task.requires_browser !== 'boolean') fail('INVALID_HANDOFF_TASK', 'task.requires_browser must be boolean');
   if (task.requires_browser === true && (!task.browser_policy || typeof task.browser_policy !== 'object' || Array.isArray(task.browser_policy))) {
@@ -132,6 +153,11 @@ export function validateSealedHandoff(handoff) {
     taskIds.add(task.task_id);
   }
   for (const task of handoff.tasks) validateTask(task, taskIds);
+  for (const task of handoff.tasks) {
+    validateTaskVerificationPlan(task);
+    validateTaskBrowserVerificationPlan(task);
+  }
+  validatePlanningMaterial(handoff);
   validateLineage(handoff.lineage, handoff);
   assertObject(handoff.seal, 'INVALID_HANDOFF_SEAL', 'seal');
   assertString(handoff.seal.sealed_by, 'INVALID_HANDOFF_SEAL', 'seal.sealed_by');
@@ -198,6 +224,7 @@ export function assertDispatchable({ handoff, task_id, completed_task_ids = [],
     git_commit_ref: validated.seal.git_commit_ref,
     task_id: task.task_id,
     execution_binding: task.execution_binding,
+    ...(task.review_binding === undefined ? {} : { review_binding: task.review_binding }),
   }));
 }
 
@@ -220,6 +247,12 @@ export function validateAttemptBinding({ attempt, handoff }) {
   const task = validated.tasks.find((candidate) => candidate.task_id === attempt.task_id);
   if (!task) fail('ATTEMPT_TASK_DRIFT', 'attempt task is not part of bound handoff');
   if (sha256(attempt.execution_binding) !== sha256(task.execution_binding)) fail('ATTEMPT_EXECUTION_BINDING_DRIFT', 'attempt execution binding differs from the sealed task');
+  if (task.review_binding !== undefined && sha256(attempt.review_binding) !== sha256(task.review_binding)) {
+    fail('ATTEMPT_REVIEW_BINDING_DRIFT', 'attempt review binding differs from the sealed task');
+  }
+  if (task.review_binding === undefined && attempt.review_binding !== undefined) {
+    fail('ATTEMPT_REVIEW_BINDING_DRIFT', 'attempt has an unexpected review binding');
+  }
   return deepFreeze(canonicalize(attempt));
 }
 

package/node_modules/@chati/planning/src/planning-material.js

@@ -0,0 +1,64 @@
+import { ContractError, canonicalSerialize, sha256 } from '@chati/core';
+
+export const PLANNING_MATERIAL_MAX_BYTES = 1_000_000;
+
+function invalid(message) {
+  throw new ContractError('PLANNING_MATERIAL_INVALID', message);
+}
+
+/** Validate the small inline bundle carried by the handoff, never live paths. */
+export function validatePlanningMaterial(handoff, { required = false } = {}) {
+  const material = handoff?.planning_material;
+  if (material === undefined) {
+    if (required) throw new ContractError('PLANNING_MATERIAL_REQUIRED', 'this handoff has no frozen Planning content; regenerate it through Tasks before execution');
+    return null;
+  }
+  if (!material || material.schema_version !== 1 || !Array.isArray(material.artifacts)
+    || material.artifacts.length === 0 || !Array.isArray(material.scope_bindings)) {
+    invalid('Planning material requires version 1, artifacts and scope bindings');
+  }
+  if (Buffer.byteLength(canonicalSerialize(material), 'utf8') > PLANNING_MATERIAL_MAX_BYTES) {
+    throw new ContractError('PLANNING_MATERIAL_SIZE_LIMIT', `frozen Planning content exceeds the ${PLANNING_MATERIAL_MAX_BYTES} byte budget`);
+  }
+  const byRef = new Map();
+  for (const artifact of material.artifacts) {
+    if (!artifact || typeof artifact.content !== 'string' || typeof artifact.ref !== 'string' || !artifact.ref.trim()
+      || artifact.sha256 !== sha256(artifact.content) || byRef.has(artifact.ref)
+      || (artifact.ref.startsWith('local-artifact://') && artifact.ref !== `local-artifact://sha256/${artifact.sha256}`)) {
+      invalid('each Planning artifact must have unique content matching its SHA-256 reference');
+    }
+    byRef.set(artifact.ref, artifact.content);
+  }
+  const requiredRefs = [
+    ...Object.values(handoff.source_artifacts ?? {}), handoff.task_graph_ref,
+    ...(handoff.tasks ?? []).flatMap((task) => task.acceptance_criteria_refs ?? []),
+    ...(handoff.tasks ?? []).flatMap((task) => task.verification_plan?.checks?.map((check) => check.stdin_ref) ?? []),
+    ...(handoff.tasks ?? []).flatMap((task) => task.browser_verification_plan ? [task.browser_verification_plan.observation.application.stdin_ref] : []),
+  ];
+  if (!handoff.source_artifacts?.task_details_ref || requiredRefs.some((ref) => !byRef.has(ref))) {
+    invalid('Planning material must resolve the task graph, every source, task details and every acceptance criterion');
+  }
+  if (!byRef.get(handoff.source_artifacts.task_details_ref).trim()) {
+    invalid('frozen task details must contain explicit task scopes');
+  }
+  for (const task of handoff.tasks ?? []) {
+    if (task.verification_plan?.checks?.some((check) => !byRef.get(check.stdin_ref)?.trim())) {
+      invalid('frozen verification scripts must contain explicit checks');
+    }
+    if (task.browser_verification_plan && !byRef.get(task.browser_verification_plan.observation.application.stdin_ref)?.trim()) {
+      invalid('frozen browser startup content must be present and nonempty');
+    }
+  }
+  const tasks = new Map((handoff.tasks ?? []).map((task) => [task.task_id, task]));
+  const boundTasks = new Set();
+  for (const binding of material.scope_bindings) {
+    const task = tasks.get(binding?.task_id);
+    if (!task || boundTasks.has(task.task_id) || binding.ref !== task.execution_scope_ref
+      || binding.artifact_ref !== handoff.source_artifacts.task_details_ref) {
+      invalid('each task scope must resolve to the frozen task-details document exactly once');
+    }
+    boundTasks.add(task.task_id);
+  }
+  if (boundTasks.size !== tasks.size) invalid('Planning material is missing a task scope binding');
+  return material;
+}

package/node_modules/@chati/planning/src/verification-plan.js

@@ -0,0 +1,57 @@
+import { isAbsolute, resolve } from 'node:path';
+import { ContractError } from '@chati/core';
+
+function invalid(message) { throw new ContractError('VERIFICATION_PLAN_INVALID', message); }
+function exact(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).length !== fields.length || Object.keys(value).some((key) => !fields.includes(key))) {
+    invalid(`${label} has an invalid closed schema`);
+  }
+}
+
+/** Frozen verification policy. Approval is supplied by the handoff council. */
+export function validateTaskVerificationPlan(task, { required = false } = {}) {
+  const plan = task?.verification_plan;
+  if (plan === undefined) {
+    if (required) throw new ContractError('VERIFICATION_PLAN_REQUIRED', 'this task requires an approved frozen verification plan before local evidence can be issued');
+    return null;
+  }
+  exact(plan, ['schema_version', 'checks'], 'verification plan');
+  if (plan.schema_version !== 1 || !Array.isArray(plan.checks) || plan.checks.length < 2 || plan.checks.length > 32) {
+    invalid('verification plan requires version 1 and 2 to 32 mandatory checks');
+  }
+  const knownCriteria = new Set(task.acceptance_criteria_refs);
+  const covered = new Set();
+  const ids = new Set();
+  let ciCount = 0;
+  for (const check of plan.checks) {
+    exact(check, ['check_id', 'kind', 'criterion_refs', 'executable_binding', 'args', 'stdin_ref', 'timeout_ms'], 'verification check');
+    if (typeof check.check_id !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(check.check_id) || ids.has(check.check_id)) {
+      invalid('check IDs must be unique, bounded and path-inert');
+    }
+    ids.add(check.check_id);
+    if (!['ci', 'acceptance'].includes(check.kind) || !Array.isArray(check.criterion_refs)
+      || new Set(check.criterion_refs).size !== check.criterion_refs.length
+      || check.criterion_refs.some((ref) => !knownCriteria.has(ref))) invalid('check criterion references must belong to this task');
+    if (check.kind === 'ci') {
+      ciCount += 1;
+      if (check.criterion_refs.length !== 0) invalid('CI checks cannot stand in for criterion-specific acceptance checks');
+    } else {
+      if (check.criterion_refs.length === 0) invalid('acceptance checks must bind one or more criteria');
+      check.criterion_refs.forEach((ref) => covered.add(ref));
+    }
+    exact(check.executable_binding, ['executable_path', 'executable_sha256'], 'check executable binding');
+    const binding = check.executable_binding;
+    if (typeof binding.executable_path !== 'string' || !isAbsolute(binding.executable_path)
+      || resolve(binding.executable_path) !== binding.executable_path
+      || !/^[a-f0-9]{64}$/.test(binding.executable_sha256 || '')) invalid('check executable must have a canonical absolute path and SHA-256');
+    if (!Array.isArray(check.args) || check.args.length > 64
+      || check.args.some((arg) => typeof arg !== 'string' || arg.includes('\0') || Buffer.byteLength(arg) > 8192)) invalid('check arguments must be bounded literal strings');
+    if (typeof check.stdin_ref !== 'string' || !/^local-artifact:\/\/sha256\/[a-f0-9]{64}$/.test(check.stdin_ref)) invalid('check script must be frozen by content reference');
+    if (!Number.isInteger(check.timeout_ms) || check.timeout_ms < 1 || check.timeout_ms > 1800000) invalid('check timeout must be 1 to 1800000 milliseconds');
+  }
+  if (ciCount === 0 || knownCriteria.size === 0 || covered.size !== knownCriteria.size) {
+    invalid('verification plan must include CI and acceptance checks covering every task criterion');
+  }
+  return plan;
+}

package/node_modules/@chati/rail/package.json

@@ -8,6 +8,7 @@
   "dependencies": {
     "@chati/core": "0.1.0",
     "@chati/planning": "0.1.0",
+    "@chati/provider-registry": "0.1.0",
     "@chati/review-council": "0.1.0"
   },
   "scripts": {

package/node_modules/@chati/rail/src/execution-restoration.js

@@ -0,0 +1,92 @@
+import { ContractError, sha256, assertDarwinTerminalLaunch, compareDarwinHostBootIdentity } from '@chati/core';
+
+const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+const TERMINATION_ATTESTATION_KEYS = ['operator_id', 'attested_at', 'statement'];
+const TERMINATION_ATTESTATION_STATEMENT = 'no-launch-processes-remain';
+
+/** Shape only. Never authenticates the operator identity or the machine; the
+ * caller binds those separately (claim operator_id, captured host identity). */
+export function isWellFormedTerminationAttestation(attestation) {
+  return Boolean(attestation) && typeof attestation === 'object' && !Array.isArray(attestation)
+    && Object.keys(attestation).length === 3
+    && TERMINATION_ATTESTATION_KEYS.every((key) => Object.hasOwn(attestation, key))
+    && typeof attestation.operator_id === 'string' && attestation.operator_id.trim() !== ''
+    && typeof attestation.attested_at === 'string' && RFC3339.test(attestation.attested_at)
+    && attestation.statement === TERMINATION_ATTESTATION_STATEMENT;
+}
+
+export function assertExecutionInterruptionLifetime(dispatch, interruption) {
+  const launch = dispatch.payload.launch_receipt;
+  if (launch.process_containment_kind !== 'darwin_scoped_process_group_v1') return true;
+  const observed = interruption.payload.process;
+  try {
+    assertDarwinTerminalLaunch(launch);
+    if (!observed || Object.hasOwn(interruption.payload, 'process_namespace_identity_digest')
+      || interruption.payload.darwin_host_boot_identity_digest !== sha256(launch.darwin_launch_binding.host_boot_identity)
+      || observed.status !== 'exited' || observed.signal_sent !== false) {
+      throw new Error('interruption requires a native new-boot observation on the same machine');
+    }
+    // Same machine either way; a reboot (previous-boot) remains the strongest
+    // proof, but a same-boot crash may instead carry a human attestation.
+    const relation = compareDarwinHostBootIdentity(launch.darwin_launch_binding.host_boot_identity, observed.host_boot_identity);
+    if (observed.reason === 'human-attested') {
+      if (Object.keys(observed).length !== 5 || !['same-boot', 'previous-boot'].includes(relation)
+        || !isWellFormedTerminationAttestation(observed.attestation)) {
+        throw new Error('human-attested interruption requires a well formed attestation on the same machine');
+      }
+    } else if (Object.keys(observed).length !== 4 || observed.reason !== 'previous-boot' || relation !== 'previous-boot') {
+      throw new Error('interruption requires a native new-boot observation on the same machine');
+    }
+  } catch (cause) {
+    throw new ContractError('RECOVERY_RESTORATION_PROOF_INVALID', 'Darwin interruption cannot substitute group absence or another host/boot binding', { cause_code: cause.code });
+  }
+  return true;
+}
+
+export function executionCheckpointBinding(dispatch, interruption) {
+  const { attempt_id, invocation, claim_id, launch_receipt: launch } = dispatch.payload;
+  return { attempt_id, dispatch_event_id: dispatch.event_id, interruption_event_id: interruption.event_id,
+    launch_nonce: invocation.launch_nonce, claim_id, launch_receipt_digest: sha256(launch),
+    base_commit_ref: launch.execution_base_commit_ref,
+    repository_identity_digest: launch.execution_repository_identity_digest };
+}
+
+/** Only journal-linked restoration is evidence, never a caller's status flag. */
+export function restoredExecutionProof(records, dispatch, { verifyAuthority, current = false, requireRecovered = false } = {}) {
+  const restored = records.find((record) => record.type === 'execution_worktree_restored'
+    && record.payload.dispatch_event_id === dispatch.event_id);
+  if (!restored) return null;
+  const fail = () => { throw new ContractError('RECOVERY_RESTORATION_PROOF_INVALID', 'restoration must bind the exact ordered canonical interruption, checkpoint and dispatch'); };
+  const { attempt_id, invocation, launch_receipt: launch } = dispatch.payload;
+  const interruption = records.find((record) => record.type === 'execution_interruption_observed'
+    && record.payload.dispatch_event_id === dispatch.event_id);
+  const checkpoint = records.find((record) => record.type === 'execution_checkpoint_preserved'
+    && record.payload.dispatch_event_id === dispatch.event_id);
+  if (dispatch.type !== 'execution_dispatched' || !interruption || !checkpoint
+    || ![interruption, checkpoint, restored].every((record) => record.payload.attempt_id === attempt_id
+      && record.payload.launch_nonce === invocation.launch_nonce)
+    || !(records.indexOf(dispatch) < records.indexOf(interruption)
+      && records.indexOf(interruption) < records.indexOf(checkpoint) && records.indexOf(checkpoint) < records.indexOf(restored))
+    || interruption.payload.status !== 'interrupted' || interruption.payload.process?.status !== 'exited'
+    || interruption.payload.launch_receipt_digest !== sha256(launch)
+    || interruption.payload.exit_status !== null || interruption.payload.process_elapsed_ms !== null
+    || interruption.payload.result_commit_ref !== null || interruption.payload.output_status !== 'unavailable'
+    || restored.payload.checkpoint_event_id !== checkpoint.event_id) fail();
+  const binding = executionCheckpointBinding(dispatch, interruption);
+  assertExecutionInterruptionLifetime(dispatch, interruption);
+  verifyAuthority('execution_checkpoint', checkpoint.payload.checkpoint_receipt, {
+    schema_version: 1, purpose: 'rail_execution_checkpoint', project_dir: launch.working_dir, binding });
+  verifyAuthority('execution_restoration', restored.payload.restoration_receipt, {
+    schema_version: 1, purpose: 'rail_execution_restoration', project_dir: launch.working_dir, binding,
+    checkpoint_receipt_digest: sha256(checkpoint.payload.checkpoint_receipt), restored_base_commit_ref: binding.base_commit_ref,
+  }, { checkpoint_receipt: checkpoint.payload.checkpoint_receipt, current });
+  const proof = { status: 'interrupted_restored', launch_nonce: invocation.launch_nonce,
+    dispatch_event_id: dispatch.event_id, interruption_event_id: interruption.event_id,
+    checkpoint_event_id: checkpoint.event_id, restoration_event_id: restored.event_id,
+    restoration_receipt_digest: sha256(restored.payload.restoration_receipt) };
+  if (!requireRecovered) return proof;
+  const recovered = records.find((record) => record.type === 'attempt_recovered'
+    && record.payload.attempt_id === attempt_id && records.indexOf(record) > records.indexOf(restored)
+    && record.payload.reconciliation?.execution_dispatches?.some((entry) => sha256(entry) === sha256(proof)));
+  return recovered ? { ...proof, recovery_event_id: recovered.event_id } : null;
+}