cli-validator 7.0.33 → 7.0.34

package/README.md

@@ -24,3 +24,15 @@ Source: https://github.com/88208555/Validator-clitax.git
 Brain Client 服务端在同一次 runtime 请求的事务中绑定真实响应、生成并持久化权威评分与评语，再返回已提交回执。broker 只验证 `feedbackReceiptId`、`feedbackInvocationId` 和权威摘要，不发起第二次评价写入，也不生成分数或评语。`not-reported`、验证不完整、P0/P1 findings、`blocked` 或 `failed` 都不得生成好评；缺凭证、缺回执、摘要不匹配、响应非法或 HTTP 失败都会显式失败。
 
 本地 CLI 不提供手工评分或评语提交命令，人类不能选择技能分数或填写技能评价。日常聊天不属于评价协议。
+
+## 本地受限执行器
+
+先运行 `cli-validator local capabilities` 读取输入合同与限额，再以 JSON stdin 调用 `cli-validator local run-approved-plan`。输入必须完整包含 `repositoryRoot`（绝对目录）、`planPath`（工作区相对路径）、`approvalPath`（外部绝对路径）与 `signerConfigPath`（外部绝对路径或显式 null）。
+
+冻结计划采用 `validator.execution-plan/1.0`：frozen=true，planId/validationRunId/memberId/chainId，排序且唯一的 files[{path,sha256}] 与 artifactSha256，tests[{testId,path}]，GoldenBaseline 与 Aimlock 合同。policy 明确 executable（绝对真实文件）及 executableSha256、args、environment 字符串字典、timeoutMs、maxOutputBytes、requiredExitCode=0。每个测试文件必须列入 manifest 并作为真实命令参数传入；组合测试可使用受审计的入口脚本，不能把未执行文件假报为测试。执行前后校验产物、计划、可执行文件与外部授权。
+
+外部授权为 `validator.runner-approval/1.0`，包含 repositoryRoot、planSha256（冻结计划文件原始字节 SHA-256）、approvedBy、approvedAt、expiresAt，最长 24 小时。文件必须归执行账户所有、0600、非符号链接且位于被测工作区之外。它记录外部批准；智能体不得伪造批准或用测试 fixture 授权真实工作。
+
+未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
+
+本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。

package/cli.mjs

@@ -2,6 +2,7 @@
 import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
+import { runValidatorLocalCli } from './validator-local-cli.mjs'
 
 const INTAKE_QUESTIONS = [
   { id: 'goal', prompt: 'What is being validated? Describe the deliverable and expected behavior.', required: true, example: '电商运营仪表盘计算工具：输入访客数/订单数/GMV/广告费，输出转化率/客单价/ROAS。' },
@@ -10,8 +11,10 @@ const INTAKE_QUESTIONS = [
   { id: 'targetFiles', prompt: 'Files to validate (or "auto" to scan all).', required: false, example: 'auto' },
 ]
 
-await dispatchOfficialSkillCli({
+if (process.argv[2] === 'local') await runValidatorLocalCli(process.argv.slice(3))
+else await dispatchOfficialSkillCli({
   packageRoot: dirname(fileURLToPath(import.meta.url)),
+  extraUsageLines: ['  cli-validator local capabilities', '  cli-validator local run-approved-plan < runner-input.json'],
   runCommand: (context) => runIntakeHandshake(context, {
     questions: INTAKE_QUESTIONS,
     outputFile: 'VALIDATOR-REQUIREMENTS.json',

package/package.json

@@ -3,13 +3,23 @@
     "cli-validator": "./cli.mjs"
   },
   "description": "Validator skill installer for CLI.Tax: delivery quality gate with three defense lines and golden baseline testing.",
+  "exports": {
+    "./local-runner": "./validator-local-runner.mjs",
+    "./runner-plan": "./validator-runner-plan.mjs",
+    "./runtime": "./validator-runtime.mjs"
+  },
   "files": [
     "cli.mjs",
     "installer.mjs",
     "broker.mjs",
     "README.md",
     "skill/SKILL.md",
-    "skill/skill.json"
+    "skill/skill.json",
+    "validator-runner-plan.mjs",
+    "validator-local-runner.mjs",
+    "validator-local-cli.mjs",
+    "validator-runtime.mjs",
+    "validator-compliance.mjs"
   ],
   "license": "UNLICENSED",
   "name": "cli-validator",
@@ -18,5 +28,5 @@
     "url": "https://github.com/88208555/Validator-clitax.git"
   },
   "type": "module",
-  "version": "7.0.33"
+  "version": "7.0.34"
 }

package/skill/SKILL.md

@@ -5,7 +5,7 @@ description: '交付前质量门禁：三道防线（静态/动态/对抗）递
 
 # Validator
 
-Package version: v7.0.33
+Package version: v7.0.34
 
 Validator 是技能链最后一站，只消费冻结目标和真实执行证据；模型解释没有裁判权。
 
@@ -107,3 +107,15 @@ GoldenBaseline 只有 `frozen: true` 才有效。来源只允许 `repository-com
 - 本地 CLI 不提供手工评分或评语提交命令，人类不得选择技能分数或填写技能评价；日常聊天不属于评价协议。
 
 调用示例：`npx cli-validator@latest invoke <operation> '<JSON对象>'`。IDE 集成可向 `npx cli-validator@latest broker` 的 stdin 发送 `{"operation":"capabilities","input":{}}`。
+
+## 本地受限执行器
+
+先运行 `cli-validator local capabilities` 读取输入合同与限额，再以 JSON stdin 调用 `cli-validator local run-approved-plan`。输入必须完整包含 `repositoryRoot`（绝对目录）、`planPath`（工作区相对路径）、`approvalPath`（外部绝对路径）与 `signerConfigPath`（外部绝对路径或显式 null）。
+
+冻结计划采用 `validator.execution-plan/1.0`：frozen=true，planId/validationRunId/memberId/chainId，排序且唯一的 files[{path,sha256}] 与 artifactSha256，tests[{testId,path}]，GoldenBaseline 与 Aimlock 合同。policy 明确 executable（绝对真实文件）及 executableSha256、args、environment 字符串字典、timeoutMs、maxOutputBytes、requiredExitCode=0。每个测试文件必须列入 manifest 并作为真实命令参数传入；组合测试可使用受审计的入口脚本，不能把未执行文件假报为测试。执行前后校验产物、计划、可执行文件与外部授权。
+
+外部授权为 `validator.runner-approval/1.0`，包含 repositoryRoot、planSha256（冻结计划文件原始字节 SHA-256）、approvedBy、approvedAt、expiresAt，最长 24 小时。文件必须归执行账户所有、0600、非符号链接且位于被测工作区之外。它记录外部批准；智能体不得伪造批准或用测试 fixture 授权真实工作。
+
+未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
+
+本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。

package/skill/skill.json

@@ -5,6 +5,6 @@
   "method": "POST",
   "name": "validator",
   "type": "Skill",
-  "version": "v7.0.33",
+  "version": "v7.0.34",
   "schemaVersion": "validator.skill.request/1.0"
 }

package/validator-compliance.mjs

@@ -0,0 +1,158 @@
+const PUBLIC_BIND_ADDRESSES = new Set(['0.0.0.0', '::', '[::]', '0:0:0:0:0:0:0:0'])
+const BIND_OPTION = /^(?:host|hostname|bind|bindhost|bindaddress|listenhost|listenaddress)$/i
+const BIND_METHODS = new Set(['listen', 'bind'])
+const SCRIPT_EXTENSION = /\.(?:[cm]?[jt]sx?)$/i
+
+function decodeHostLiteral(value) {
+  return value.replace(/\\(?:u\{([0-9a-f]+)\}|u([0-9a-f]{4})|x([0-9a-f]{2})|(.))/gi,
+    (match, point, unicode, byte, character) => {
+      const digits = point ?? unicode ?? byte
+      if (digits === undefined) return character
+      const code = parseInt(digits, 16)
+      return code <= 0x10ffff ? String.fromCodePoint(code) : match
+    })
+}
+
+function quotedToken(source, start) {
+  const quote = source[start]
+  let end = start + 1
+  while (end < source.length) {
+    if (source[end] === '\\') { end += 2; continue }
+    if (source[end] === quote) {
+      return { kind: 'literal', value: decodeHostLiteral(source.slice(start + 1, end)), start, end: end + 1 }
+    }
+    end += 1
+  }
+  return { kind: 'invalid', value: source.slice(start), start, end: source.length }
+}
+
+function templateTokens(source, start) {
+  const tokens = []
+  let index = start + 1
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue }
+    if (source[index] === '`') {
+      if (tokens.length === 0) tokens.push(quotedToken(source, start))
+      return { tokens, end: index + 1 }
+    }
+    if (source[index] === '$' && source[index + 1] === '{') {
+      const expression = codeTokens(source, index + 2, true)
+      tokens.push(...expression.tokens)
+      index = expression.end
+      continue
+    }
+    index += 1
+  }
+  return { tokens, end: source.length }
+}
+
+function codeTokens(source, start = 0, templateExpression = false) {
+  const tokens = []
+  let depth = 0
+  for (let index = start; index < source.length;) {
+    const tail = source.slice(index)
+    const ignored = tail.match(/^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$))/)
+    if (ignored) { index += ignored[0].length; continue }
+    if (source[index] === '`') {
+      const template = templateTokens(source, index)
+      tokens.push(...template.tokens)
+      index = template.end
+      continue
+    }
+    if (['"', "'"].includes(source[index])) {
+      const token = quotedToken(source, index)
+      tokens.push(token)
+      index = token.end
+      continue
+    }
+    if (source[index] === '}' && templateExpression && depth === 0) return { tokens, end: index + 1 }
+    if (source[index] === '{') depth += 1
+    if (source[index] === '}') depth -= 1
+    const word = tail.match(/^[A-Za-z_$][\w$]*/)
+    const value = word === null ? source[index] : word[0]
+    tokens.push({ kind: word === null ? 'symbol' : 'word', value, start: index, end: index + value.length })
+    index += value.length
+  }
+  return { tokens, end: source.length }
+}
+
+function bindHost(token, aliases) {
+  if (token === undefined) return false
+  return token.kind === 'literal' ? PUBLIC_BIND_ADDRESSES.has(token.value)
+    : token.kind === 'word' && aliases.has(token.value)
+}
+
+function publicAliases(tokens) {
+  const aliases = new Set()
+  let changed = true
+  while (changed) {
+    changed = false
+    for (let index = 0; index < tokens.length - 2; index += 1) {
+      const token = tokens[index]
+      if (token.kind === 'word' && tokens[index + 1].value === '='
+        && bindHost(tokens[index + 2], aliases) && !aliases.has(token.value)) {
+        aliases.add(token.value)
+        changed = true
+      }
+    }
+  }
+  return aliases
+}
+
+function callArguments(tokens, opening) {
+  const args = [[]]
+  let depth = 0
+  for (let index = opening + 1; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token.value === ')' && depth === 0) return args
+    if (token.value === ',' && depth === 0) { args.push([]); continue }
+    args[args.length - 1].push(token)
+    if (['(', '[', '{'].includes(token.value)) depth += 1
+    if ([')', ']', '}'].includes(token.value)) depth -= 1
+  }
+  return []
+}
+
+function scriptBindSites(source) {
+  const { tokens } = codeTokens(source)
+  const aliases = publicAliases(tokens)
+  const sites = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    const normalized = token.value.replaceAll('_', '').replaceAll('-', '')
+    if (BIND_OPTION.test(normalized) && [':', '='].includes(tokens[index + 1]?.value)
+      && bindHost(tokens[index + 2], aliases)) {
+      sites.push({ offset: token.start, context: 'bind-option', address: tokens[index + 2].value })
+    }
+    if (!BIND_METHODS.has(token.value)) continue
+    let opening = index + 1
+    if (tokens[index - 1]?.value === '[' && tokens[opening]?.value === ']') opening += 1
+    if (tokens[opening]?.value === '?' && tokens[opening + 1]?.value === '.') opening += 2
+    if (tokens[opening]?.value !== '(') continue
+    const args = callArguments(tokens, opening)
+    const hosts = token.value === 'bind' ? args.slice(0, 2).flat() : args[1]
+    if (hosts === undefined) continue
+    const publicHost = hosts.find((candidate) => bindHost(candidate, aliases))
+    if (publicHost) sites.push({ offset: token.start, context: `${token.value}-argument`, address: publicHost.value })
+  }
+  return sites
+}
+
+function configurationBindSites(source) {
+  const sites = []
+  const pattern = /(?:\b(?:host|hostname|bind(?:[_-]?(?:host|address))?|listen(?:[_-]?(?:host|address))?)\b["']?\s*(?:[:=]\s*|\s+)|--(?:host|bind|listen)(?:=|\s+))["']?(0\.0\.0\.0|\[::\]|::)(?=["'\s:;,]|$)/gi
+  for (const match of source.matchAll(pattern)) {
+    const lineStart = source.lastIndexOf('\n', match.index) + 1
+    if (/^\s*(?:#|\/\/)/.test(source.slice(lineStart, match.index))) continue
+    sites.push({ offset: match.index, context: 'bind-configuration', address: match[1] })
+  }
+  return sites
+}
+
+/** Inspect bind sinks and host configuration; address lists and outbound targets are not listeners. */
+export function publicBindSites(path, source) {
+  const sites = SCRIPT_EXTENSION.test(path) ? scriptBindSites(source) : configurationBindSites(source)
+  return sites.map((site) => ({
+    ...site, line: source.slice(0, site.offset).split('\n').length,
+  }))
+}

package/validator-local-cli.mjs

@@ -0,0 +1,49 @@
+import { stdin, stdout } from 'node:process'
+import { runApprovedValidatorPlan } from './validator-local-runner.mjs'
+import { RUNNER_LIMITS, RUNNER_PLAN_SCHEMA, RUNNER_APPROVAL_SCHEMA, RUNNER_SIGNER_SCHEMA } from './validator-runner-plan.mjs'
+
+const CAPABILITIES = Object.freeze({
+  schemaVersion: 'validator.local-runner/1.0',
+  operations: ['capabilities', 'run-approved-plan'],
+  operationSchemas: {
+    capabilities: { type: 'object', additionalProperties: false, properties: {} },
+    'run-approved-plan': {
+      type: 'object', additionalProperties: false,
+      required: ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'],
+      properties: {
+        repositoryRoot: { type: 'string', minLength: 1 }, planPath: { type: 'string', minLength: 1 },
+        approvalPath: { type: 'string', minLength: 1 }, signerConfigPath: { type: ['string', 'null'] },
+      },
+    },
+  },
+  planSchema: RUNNER_PLAN_SCHEMA, approvalSchema: RUNNER_APPROVAL_SCHEMA, signerSchema: RUNNER_SIGNER_SCHEMA,
+  limits: RUNNER_LIMITS,
+  boundary: 'POSIX subprocess runner; external preapproval required. Signed receipts require separately configured trust and isolation.',
+})
+
+async function readInput() {
+  const chunks = []
+  let bytes = 0
+  for await (const chunk of stdin) {
+    bytes += Buffer.byteLength(chunk)
+    if (bytes > RUNNER_LIMITS.maxControlBytes) throw new Error('Validator runner input exceeds its limit')
+    chunks.push(Buffer.from(chunk))
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+}
+
+export async function runValidatorLocalCli(args) {
+  try {
+    if (args.length !== 1 || !CAPABILITIES.operations.includes(args[0])) {
+      throw new Error('Usage: cli-validator local capabilities | local run-approved-plan < runner-input.json')
+    }
+    const output = args[0] === 'capabilities' ? CAPABILITIES : await runApprovedValidatorPlan(await readInput())
+    stdout.write(JSON.stringify(output) + '\n')
+    if (output.status === 'failed') process.exitCode = 1
+  } catch (error) {
+    const failure = { status: 'failed', error: error instanceof Error ? error.message : String(error) }
+    if (error instanceof Error && error.execution) failure.execution = error.execution
+    stdout.write(JSON.stringify(failure) + '\n')
+    process.exitCode = 1
+  }
+}

package/validator-local-runner.mjs

@@ -0,0 +1,170 @@
+import { spawn } from 'node:child_process'
+import { createHash, randomUUID, sign } from 'node:crypto'
+import { performance } from 'node:perf_hooks'
+import {
+  bytesSha256, loadApprovedExecutionPlan, loadApprovedSigner, validationSubjectForPlan, verifyPlanFiles,
+} from './validator-runner-plan.mjs'
+import { validatorReceiptPayload, validatorReceiptSubject } from './validator-runtime.mjs'
+
+const TERMINATION_GRACE_MS = 250
+const REAP_DEADLINE_MS = 1_000
+const EXECUTION_SCHEMA = 'validator.runner-execution/1.0'
+const EVIDENCE_SCHEMA = 'cli.tax.test-evidence/1.0'
+const RECEIPT_SCHEMA = 'validator.execution-receipt/1.0'
+
+function signalProcessGroup(child, signal) {
+  if (!Number.isInteger(child.pid)) throw new Error('Runner child has no process identifier')
+  try {
+    process.kill(-child.pid, signal)
+    return { signal, status: 'delivered' }
+  } catch (error) {
+    if (!(error instanceof Error) || !('code' in error) || error.code !== 'ESRCH') throw error
+    return { signal, status: 'already-exited' }
+  }
+}
+
+function executeBoundedCommand(authority) {
+  const { policy } = authority.plan
+  return new Promise((resolve, reject) => {
+    const started = performance.now()
+    const child = spawn(policy.executable, policy.args, {
+      cwd: authority.root, env: { ...policy.environment },
+      shell: false, detached: true, stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    const termination = []
+    const stdout = []
+    const stderr = []
+    const stdoutHash = createHash('sha256')
+    const stderrHash = createHash('sha256')
+    let capturedBytes = 0
+    let droppedBytes = 0
+    let timedOut = false
+    let outputLimitExceeded = false
+    let terminating = false
+    let escalation = null
+    let failure = null
+    const terminate = () => {
+      if (terminating) return
+      terminating = true
+      try {
+        termination.push(signalProcessGroup(child, 'SIGTERM'))
+        escalation = setTimeout(() => {
+          try { termination.push(signalProcessGroup(child, 'SIGKILL')) } catch (error) { failure = error }
+        }, TERMINATION_GRACE_MS)
+      } catch (error) {
+        failure = error
+      }
+    }
+    const timer = setTimeout(() => { timedOut = true; terminate() }, policy.timeoutMs)
+    const hardLimit = setTimeout(() => {
+      clearTimeout(timer)
+      if (escalation !== null) clearTimeout(escalation)
+      try { if (Number.isInteger(child.pid)) termination.push(signalProcessGroup(child, 'SIGKILL')) } catch (error) { failure = error }
+      child.stdout.destroy()
+      child.stderr.destroy()
+      child.unref()
+      reject(new Error('Validator process could not be reaped within its hard deadline', { cause: failure }))
+    }, policy.timeoutMs + TERMINATION_GRACE_MS + REAP_DEADLINE_MS)
+    const consume = (target, hash, chunk) => {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      hash.update(bytes)
+      const remaining = policy.maxOutputBytes - capturedBytes
+      const retained = Math.min(bytes.length, remaining)
+      if (retained > 0) target.push(Buffer.from(bytes.subarray(0, retained)))
+      capturedBytes += retained
+      droppedBytes += bytes.length - retained
+      if (droppedBytes > 0) { outputLimitExceeded = true; terminate() }
+    }
+    child.stdout.on('data', (chunk) => consume(stdout, stdoutHash, chunk))
+    child.stderr.on('data', (chunk) => consume(stderr, stderrHash, chunk))
+    child.once('error', (error) => { failure = error })
+    child.once('close', (exitCode, signal) => {
+      clearTimeout(timer)
+      clearTimeout(hardLimit)
+      if (escalation !== null) clearTimeout(escalation)
+      try { if (Number.isInteger(child.pid)) termination.push(signalProcessGroup(child, 'SIGKILL')) } catch (error) { failure = error }
+      if (failure !== null) return reject(new Error('Validator subprocess lifecycle failed', { cause: failure }))
+      resolve({
+        exitCode, signal, timedOut, outputLimitExceeded,
+        durationMs: Math.max(0, Math.round(performance.now() - started)),
+        stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'),
+        stdoutSha256: stdoutHash.digest('hex'), stderrSha256: stderrHash.digest('hex'),
+        capturedBytes, droppedBytes, termination,
+      })
+    })
+  })
+}
+
+function executionSummary(result) {
+  if (result.timedOut) return 'Approved validation command exceeded its deadline'
+  if (result.outputLimitExceeded) return 'Approved validation command exceeded its output limit'
+  if (result.signal !== null) return `Approved validation command ended on signal ${result.signal}`
+  return `Approved validation command exited with code ${result.exitCode}`
+}
+
+export function validatorExecutionLogsDigest(result) {
+  return bytesSha256(JSON.stringify({
+    stdout: result.stdout, stderr: result.stderr, stdoutSha256: result.stdoutSha256, stderrSha256: result.stderrSha256,
+    capturedBytes: result.capturedBytes, droppedBytes: result.droppedBytes,
+  }))
+}
+
+function receiptSummary(result) {
+  return JSON.stringify({
+    message: executionSummary(result), logsSha256: validatorExecutionLogsDigest(result),
+    stdoutSha256: result.stdoutSha256, stderrSha256: result.stderrSha256,
+    capturedBytes: result.capturedBytes, droppedBytes: result.droppedBytes,
+  })
+}
+
+function localEvidence(subject, result, summary) {
+  if (!Number.isInteger(result.exitCode)) return null
+  return {
+    schemaVersion: EVIDENCE_SCHEMA, evidenceId: `${subject.validationRunId}:process`,
+    kind: 'test', runner: 'local', command: subject.policy.command,
+    exitCode: result.exitCode, durationMs: result.durationMs, summary,
+    artifactSha256: subject.artifactSha256, subject, subjectDigest: validatorReceiptSubject(subject),
+  }
+}
+
+function signedEvidence(subject, result, summary, signer, passed) {
+  const issuedAt = new Date()
+  const unsigned = {
+    schemaVersion: RECEIPT_SCHEMA, keyId: signer.keyId, nonce: `receipt-${randomUUID()}`,
+    subjectDigest: validatorReceiptSubject(subject), issuedAt: issuedAt.toISOString(),
+    expiresAt: new Date(issuedAt.getTime() + signer.receiptTtlMs).toISOString(),
+    result: { runner: 'trusted-runner', passed, exitCode: result.exitCode,
+      durationMs: result.durationMs, summary },
+  }
+  const receipt = { ...unsigned,
+    signature: sign(null, Buffer.from(validatorReceiptPayload(unsigned)), signer.key).toString('base64url') }
+  return { ...localEvidence(subject, result, summary), runner: 'trusted-runner', receipt }
+}
+
+export async function runApprovedValidatorPlan(input) {
+  const authority = await loadApprovedExecutionPlan(input)
+  const subject = validationSubjectForPlan(authority.plan, authority.planSha256, new Date().toISOString())
+  const result = await executeBoundedCommand(authority)
+  try {
+    await verifyPlanFiles(authority)
+  } catch (error) {
+    const failure = new Error('Validator integrity changed during execution', { cause: error })
+    failure.execution = { schemaVersion: EXECUTION_SCHEMA, status: 'failed', subject, process: result, evidence: [] }
+    throw failure
+  }
+  const passed = result.exitCode === authority.plan.policy.requiredExitCode
+    && result.signal === null && !result.timedOut && !result.outputLimitExceeded
+  const summary = receiptSummary(result)
+  const signer = Number.isInteger(result.exitCode) ? await loadApprovedSigner(authority) : null
+  const evidence = signer === null ? localEvidence(subject, result, summary)
+    : signedEvidence(subject, result, summary, signer, passed)
+  return {
+    schemaVersion: EXECUTION_SCHEMA, status: passed ? 'succeeded' : 'failed',
+    planSha256: authority.planSha256,
+    approvalSha256: authority.approval.sha256, approvedBy: authority.approval.approval.approvedBy,
+    subject, process: result, evidence: evidence === null ? [] : [evidence],
+    receipt: evidence !== null && signer !== null ? evidence.receipt : null,
+    signingBoundary: signer === null ? 'local-evidence-only'
+      : 'configured-signature-only; independent-uid-or-container-isolation-required-for-production-trust',
+  }
+}

package/validator-runner-plan.mjs

@@ -0,0 +1,284 @@
+import { constants } from 'node:fs'
+import { lstat, open, realpath } from 'node:fs/promises'
+import { createHash, createPrivateKey, createPublicKey } from 'node:crypto'
+import { isAbsolute, relative, resolve, sep } from 'node:path'
+import {
+  run as validateProtocol, validatorArtifactSubject,
+} from './validator-runtime.mjs'
+
+export const RUNNER_PLAN_SCHEMA = 'validator.execution-plan/1.0'
+export const RUNNER_APPROVAL_SCHEMA = 'validator.runner-approval/1.0'
+export const RUNNER_SIGNER_SCHEMA = 'validator.runner-signer/1.0'
+export const RUNNER_LIMITS = Object.freeze({
+  maxFiles: 512, maxFileBytes: 16 * 1024 * 1024, maxManifestBytes: 64 * 1024 * 1024,
+  maxControlBytes: 1024 * 1024, maxExecutableBytes: 256 * 1024 * 1024, maxTimeoutMs: 300_000, maxOutputBytes: 1024 * 1024,
+  maxApprovalLifetimeMs: 24 * 60 * 60 * 1000, maxReceiptLifetimeMs: 600_000,
+})
+const SHA = /^[0-9a-f]{64}$/
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
+const ENVIRONMENT_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+export function bytesSha256(value) {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+function exactObject(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('|') !== [...fields].sort().join('|')) {
+    throw new Error(`${label} has invalid fields`)
+  }
+  return value
+}
+
+function positiveInteger(value, maximum, label) {
+  if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) {
+    throw new Error(`${label} must be a positive bounded integer`)
+  }
+}
+
+function relativeFile(value) {
+  if (typeof value !== 'string' || !value || value !== value.normalize('NFC')
+    || isAbsolute(value) || /^[A-Za-z]:/.test(value) || value.includes('\\')
+    || /[\u0000-\u001f\u007f]/.test(value)
+    || value.split('/').some((part) => !part || part === '.' || part === '..')) {
+    throw new Error('Manifest paths must be normalized relative files')
+  }
+  return value
+}
+
+function inside(root, target) {
+  const path = relative(root, target)
+  return path === '' || (!isAbsolute(path) && path !== '..' && !path.startsWith(`..${sep}`))
+}
+
+export async function readRegularFile(path, maximum, privateFile) {
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)
+  try {
+    const before = await handle.stat()
+    if (!before.isFile() || before.size > maximum) throw new Error('File is not regular or exceeds its limit')
+    if (privateFile && (before.uid !== process.getuid() || (before.mode & 0o777) !== 0o600
+      || before.nlink !== 1)) throw new Error('Runner control files must be owned by the runner and mode 0600')
+    const bytes = await handle.readFile()
+    const after = await handle.stat()
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs
+      || bytes.length !== after.size) throw new Error('File changed while being read')
+    return { bytes, byteLength: bytes.length, sha256: bytesSha256(bytes), device: before.dev, inode: before.ino }
+  } finally {
+    await handle.close()
+  }
+}
+
+async function hashRegularFile(path, maximum) {
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)
+  try {
+    const before = await handle.stat()
+    if (!before.isFile() || before.size > maximum) throw new Error('Hash target is not a bounded regular file')
+    const hash = createHash('sha256')
+    const buffer = Buffer.alloc(64 * 1024)
+    let byteLength = 0
+    while (true) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, null)
+      if (bytesRead === 0) break
+      byteLength += bytesRead
+      if (byteLength > maximum) throw new Error('Hash target grew beyond its limit')
+      hash.update(buffer.subarray(0, bytesRead))
+    }
+    const after = await handle.stat()
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs
+      || byteLength !== after.size) throw new Error('Hash target changed while being read')
+    return { byteLength, sha256: hash.digest('hex'), device: before.dev, inode: before.ino }
+  } finally {
+    await handle.close()
+  }
+}
+
+async function externalFile(root, path, maximum) {
+  if (typeof path !== 'string' || !isAbsolute(path)) throw new Error('External runner control path must be absolute')
+  const status = await lstat(path)
+  if (status.isSymbolicLink()) throw new Error('External runner control cannot be a symlink')
+  const canonical = await realpath(path)
+  if (inside(root, canonical)) throw new Error('Runner controls and keys must be outside the tested workspace')
+  return { path: canonical, ...(await readRegularFile(canonical, maximum, true)) }
+}
+
+async function projectFile(root, path, contents) {
+  const name = relativeFile(path)
+  let target = root
+  for (const [index, part] of name.split('/').entries()) {
+    target = resolve(target, part)
+    const status = await lstat(target)
+    if (status.isSymbolicLink() || (index < name.split('/').length - 1 && !status.isDirectory())) {
+      throw new Error('Workspace files cannot traverse symlinks or non-directory parents')
+    }
+  }
+  if (!inside(root, await realpath(target))) throw new Error('Workspace file escapes its root')
+  const data = contents ? await readRegularFile(target, RUNNER_LIMITS.maxFileBytes, false)
+    : await hashRegularFile(target, RUNNER_LIMITS.maxFileBytes)
+  return { path: target, ...data }
+}
+
+function validateExecutionPolicy(policy, tests, files) {
+  exactObject(policy, ['executable', 'executableSha256', 'args', 'environment',
+    'timeoutMs', 'maxOutputBytes', 'requiredExitCode'], 'Execution policy')
+  if (typeof policy.executable !== 'string' || !isAbsolute(policy.executable)
+    || !SHA.test(policy.executableSha256)) throw new Error('Executable requires an absolute path and SHA-256')
+  if (!Array.isArray(policy.args) || policy.args.length > 128
+    || policy.args.some((value) => typeof value !== 'string' || value.includes('\0') || value.length > 4096)) {
+    throw new Error('Executable args must be a bounded string array')
+  }
+  if (!policy.environment || typeof policy.environment !== 'object' || Array.isArray(policy.environment)
+    || Object.keys(policy.environment).length > 64
+    || Object.entries(policy.environment).some(([key, value]) => !ENVIRONMENT_KEY.test(key)
+      || typeof value !== 'string' || value.includes('\0') || value.length > 16_384)) {
+    throw new Error('Child environment must be explicit and bounded')
+  }
+  positiveInteger(policy.timeoutMs, RUNNER_LIMITS.maxTimeoutMs, 'timeoutMs')
+  positiveInteger(policy.maxOutputBytes, RUNNER_LIMITS.maxOutputBytes, 'maxOutputBytes')
+  if (policy.requiredExitCode !== 0) throw new Error('Validation requires exit code zero')
+  if (!Array.isArray(tests) || !tests.length || tests.length > RUNNER_LIMITS.maxFiles) {
+    throw new Error('Frozen tests must be non-empty and bounded')
+  }
+  for (const item of tests) {
+    exactObject(item, ['testId', 'path'], 'Frozen test')
+    if (!IDENTIFIER.test(item.testId) || !files.some((file) => file.path === item.path)
+      || !policy.args.includes(relativeFile(item.path))) {
+      throw new Error('Each test must be in the manifest and passed explicitly as a command argument')
+    }
+  }
+}
+
+function validateFrozenPlan(plan) {
+  exactObject(plan, ['schemaVersion', 'frozen', 'planId', 'validationRunId', 'memberId', 'chainId',
+    'artifactSha256', 'files', 'tests', 'policy', 'goldenBaseline', 'contracts'], 'Frozen execution plan')
+  if (plan.schemaVersion !== RUNNER_PLAN_SCHEMA || plan.frozen !== true
+    || !SHA.test(plan.artifactSha256) || !Array.isArray(plan.files)
+    || !plan.files.length || plan.files.length > RUNNER_LIMITS.maxFiles) {
+    throw new Error('Frozen execution plan is invalid')
+  }
+  for (const [index, file] of plan.files.entries()) {
+    exactObject(file, ['path', 'sha256'], 'Manifest entry')
+    relativeFile(file.path)
+    if (!SHA.test(file.sha256) || (index > 0 && plan.files[index - 1].path >= file.path)) {
+      throw new Error('Manifest paths must be unique, sorted and SHA-bound')
+    }
+  }
+  if (validatorArtifactSubject(plan.files) !== plan.artifactSha256) throw new Error('Artifact manifest digest mismatch')
+  validateExecutionPolicy(plan.policy, plan.tests, plan.files)
+  if (plan.contracts?.archguard?.driftStatus === 'red') throw new Error('ArchGuard red blocks execution')
+  return plan
+}
+
+export function validationSubjectForPlan(plan, planSha256, executedAt) {
+  return {
+    schemaVersion: 'validator.validation-subject/1.0',
+    artifactSha256: plan.artifactSha256, memberId: plan.memberId, chainId: plan.chainId,
+    executedAt, files: plan.files, validationRunId: plan.validationRunId, planId: plan.planId,
+    tests: plan.tests,
+    policy: { command: [plan.policy.executable, ...plan.policy.args].map((value) => JSON.stringify(value)).join(' '),
+      requiredExitCode: plan.policy.requiredExitCode, executionPlanSha256: planSha256 },
+    goldenBaseline: plan.goldenBaseline, contracts: plan.contracts,
+  }
+}
+
+async function validateApproval(root, approvalPath, planSha256) {
+  const file = await externalFile(root, approvalPath, RUNNER_LIMITS.maxControlBytes)
+  const approval = exactObject(JSON.parse(file.bytes.toString('utf8')),
+    ['schemaVersion', 'repositoryRoot', 'planSha256', 'approvedBy', 'approvedAt', 'expiresAt'],
+    'Runner approval')
+  const approvedAt = Date.parse(approval.approvedAt)
+  const expiresAt = Date.parse(approval.expiresAt)
+  if (approval.schemaVersion !== RUNNER_APPROVAL_SCHEMA || approval.repositoryRoot !== root
+    || approval.planSha256 !== planSha256 || !IDENTIFIER.test(approval.approvedBy)
+    || !Number.isFinite(approvedAt) || !Number.isFinite(expiresAt)
+    || approvedAt > Date.now() || expiresAt <= Date.now() || expiresAt <= approvedAt
+    || expiresAt - approvedAt > RUNNER_LIMITS.maxApprovalLifetimeMs) {
+    throw new Error('External approval is expired or does not match the frozen plan')
+  }
+  return { ...file, approval }
+}
+
+async function signerAuthority(root, signerConfigPath, policy) {
+  if (signerConfigPath === null) return null
+  const file = await externalFile(root, signerConfigPath, RUNNER_LIMITS.maxControlBytes)
+  const config = exactObject(JSON.parse(file.bytes.toString('utf8')),
+    ['schemaVersion', 'privateKeyPath', 'keyId', 'receiptTtlMs'], 'Runner signer')
+  if (config.schemaVersion !== RUNNER_SIGNER_SCHEMA || !SHA.test(config.keyId)) {
+    throw new Error('External runner signer configuration is invalid')
+  }
+  positiveInteger(config.receiptTtlMs, RUNNER_LIMITS.maxReceiptLifetimeMs, 'receiptTtlMs')
+  const privatePath = await realpath(config.privateKeyPath)
+  if (!isAbsolute(config.privateKeyPath) || inside(root, privatePath)
+    || JSON.stringify([policy.args, policy.environment]).includes(config.privateKeyPath)
+    || JSON.stringify([policy.args, policy.environment]).includes(privatePath)
+    || JSON.stringify([policy.args, policy.environment]).includes(file.path)) {
+    throw new Error('Signer paths cannot be inside the workspace or passed to the child')
+  }
+  const keyStatus = await lstat(config.privateKeyPath)
+  if (keyStatus.isSymbolicLink() || !keyStatus.isFile() || keyStatus.uid !== process.getuid()
+    || (keyStatus.mode & 0o777) !== 0o600 || keyStatus.nlink !== 1) {
+    throw new Error('Runner private key must be a regular owned mode-0600 external file')
+  }
+  return { ...file, config: { ...config, privateKeyPath: privatePath } }
+}
+
+export async function verifyPlanFiles(authority) {
+  let bytes = 0
+  for (const file of authority.plan.files) {
+    const actual = await projectFile(authority.root, file.path, false)
+    bytes += actual.byteLength
+    if (bytes > RUNNER_LIMITS.maxManifestBytes || actual.sha256 !== file.sha256) {
+      throw new Error(`Artifact changed or exceeds its bound: ${file.path}`)
+    }
+  }
+  const executable = await hashRegularFile(authority.plan.policy.executable, RUNNER_LIMITS.maxExecutableBytes)
+  if (executable.sha256 !== authority.plan.policy.executableSha256) throw new Error('Executable SHA-256 mismatch')
+  const plan = await projectFile(authority.root, authority.planPath, true)
+  if (plan.sha256 !== authority.planSha256) throw new Error('Frozen plan changed')
+  const approval = await validateApproval(authority.root, authority.approval.path, authority.planSha256)
+  if (approval.sha256 !== authority.approval.sha256) throw new Error('External approval changed')
+  if (authority.signer !== null) {
+    const signer = await externalFile(authority.root, authority.signer.path, RUNNER_LIMITS.maxControlBytes)
+    if (signer.sha256 !== authority.signer.sha256) throw new Error('External signer configuration changed')
+  }
+}
+
+export async function loadApprovedExecutionPlan(input) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function') {
+    throw new Error('This bounded subprocess runner requires a POSIX host')
+  }
+  exactObject(input, ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'], 'Runner input')
+  if (typeof input.repositoryRoot !== 'string' || !isAbsolute(input.repositoryRoot)) {
+    throw new Error('repositoryRoot must be absolute')
+  }
+  const rootStatus = await lstat(input.repositoryRoot)
+  if (!rootStatus.isDirectory() || rootStatus.isSymbolicLink()) throw new Error('Workspace root must be a real directory')
+  const root = await realpath(input.repositoryRoot)
+  const planFile = await projectFile(root, input.planPath, true)
+  if (planFile.bytes.length > RUNNER_LIMITS.maxControlBytes) throw new Error('Frozen plan is too large')
+  const plan = validateFrozenPlan(JSON.parse(planFile.bytes.toString('utf8')))
+  const approval = await validateApproval(root, input.approvalPath, planFile.sha256)
+  const signer = await signerAuthority(root, input.signerConfigPath, plan.policy)
+  const authority = { root, plan, planPath: input.planPath, planSha256: planFile.sha256, approval, signer }
+  await verifyPlanFiles(authority)
+  const subject = validationSubjectForPlan(plan, planFile.sha256, new Date().toISOString())
+  const validation = await validateProtocol({ schemaVersion: 'validator.skill.request/1.0',
+    requestId: 'runner-subject-validation', operation: 'verdict',
+    input: { expectedSubject: subject, evidence: [], findings: [] } })
+  if (validation.status !== 'succeeded') throw new Error('Frozen validation subject fails the Validator protocol')
+  return authority
+}
+
+export async function loadApprovedSigner(authority) {
+  if (authority.signer === null) return null
+  const { config } = authority.signer
+  const file = await externalFile(authority.root, config.privateKeyPath, 16_384)
+  try {
+    const key = createPrivateKey(file.bytes)
+    if (key.asymmetricKeyType !== 'ed25519') throw new Error('Runner signer requires Ed25519')
+    const publicDer = createPublicKey(key).export({ format: 'der', type: 'spki' })
+    if (bytesSha256(publicDer) !== config.keyId) throw new Error('Runner signer public key fingerprint mismatch')
+    return { key, keyId: config.keyId, receiptTtlMs: config.receiptTtlMs }
+  } finally {
+    file.bytes.fill(0)
+  }
+}

package/validator-runtime.mjs

@@ -0,0 +1,498 @@
+import { publicBindSites } from "./validator-compliance.mjs";
+import { createHash, createPublicKey, verify as verifySignature } from "node:crypto";
+
+const REQ = "validator.skill.request/1.0";
+const RES = "validator.skill.response/1.0";
+const ERR = "validator.skill.error/1.0";
+const NAME = "validator";
+const COMPILER_VERSION = "v7.0.34";
+const CATALOG_SCHEMA = "cli.tax.skill-catalog/1.0";
+const RECEIPT_SCHEMA = "validator.execution-receipt/1.0";
+const VALIDATION_SUBJECT_SCHEMA = "validator.validation-subject/1.0";
+const GOLDEN_BASELINE_SCHEMA = "validator.golden-baseline/1.0";
+const TEST_EVIDENCE_SCHEMA = "cli.tax.test-evidence/1.0";
+const RECEIPT_PUBLIC_KEY_ENV = "CLITAX_VALIDATOR_RECEIPT_PUBLIC_KEY";
+const MAX_RECEIPT_LIFETIME_MS = 10 * 60 * 1000;
+const ID_PATTERN = "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$";
+const MEMBER_PATTERN = "^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$";
+const CHAIN_PATTERN = "^chn-[0-9a-f-]{36}$";
+const SHA_PATTERN = "^[0-9a-f]{64}$";
+const idRegex = new RegExp(ID_PATTERN);
+const memberRegex = new RegExp(MEMBER_PATTERN);
+const chainRegex = new RegExp(CHAIN_PATTERN);
+const shaRegex = new RegExp(SHA_PATTERN);
+
+const OPS = ["capabilities","help","intake","plan","validate-structure","security-scan","compliance-audit","functional-verify","sandbox-run","fuzz-input","perf-benchmark","intrusive-test","verdict"];
+const PURE = new Set(["capabilities","help","intake","plan","validate-structure","security-scan","compliance-audit","functional-verify","verdict"]);
+const LOCAL_ONLY = new Set(["sandbox-run","fuzz-input","perf-benchmark","intrusive-test"]);
+const CATALOG = OPS.map((operation) => ({ operation, summary: operation }));
+
+const stringSchema = (extra = {}) => ({ type: "string", ...extra });
+const arraySchema = (items, extra = {}) => ({ type: "array", items, ...extra });
+const objectSchema = (properties, required = [], extra = {}) => ({
+  type: "object", properties, required, additionalProperties: false, ...extra,
+});
+const anyObjectSchema = { type: "object" };
+const findingSchema = objectSchema({
+  severity: { enum: ["P0", "P1", "P2"] }, ruleId: stringSchema({ minLength: 1 }),
+  entityRef: stringSchema({ minLength: 1 }), message: stringSchema({ minLength: 1 }),
+  evidence: anyObjectSchema,
+}, ["severity", "ruleId", "entityRef", "message", "evidence"]);
+const receiptSchema = objectSchema({
+  schemaVersion: { const: RECEIPT_SCHEMA }, keyId: stringSchema({ pattern: SHA_PATTERN }),
+  nonce: stringSchema({ pattern: ID_PATTERN, minLength: 16, maxLength: 128 }), subjectDigest: stringSchema({ pattern: SHA_PATTERN }),
+  issuedAt: stringSchema({ format: "date-time" }), expiresAt: stringSchema({ format: "date-time" }),
+  result: objectSchema({ runner: { const: "trusted-runner" }, passed: { type: "boolean" },
+    exitCode: { type: "integer" }, durationMs: { type: "number", minimum: 0 },
+    summary: stringSchema({ minLength: 1 }) }, ["runner", "passed", "exitCode", "durationMs", "summary"]),
+  signature: stringSchema({ minLength: 1 }),
+}, ["schemaVersion", "keyId", "nonce", "subjectDigest", "issuedAt", "expiresAt", "result", "signature"]);
+const baselineSchema = objectSchema({
+  schemaVersion: { const: GOLDEN_BASELINE_SCHEMA }, baselineId: stringSchema({ pattern: ID_PATTERN }),
+  source: objectSchema({ kind: { enum: ["repository-commit", "artifact", "approved-record"] },
+    locator: stringSchema({ minLength: 1 }), digestSha256: stringSchema({ pattern: SHA_PATTERN }) },
+  ["kind", "locator", "digestSha256"]),
+  version: stringSchema({ pattern: ID_PATTERN }), frozen: { const: true },
+  frozenAt: stringSchema({ format: "date-time" }), frozenBy: stringSchema({ pattern: ID_PATTERN }),
+  testsSha256: stringSchema({ pattern: SHA_PATTERN }),
+}, ["schemaVersion", "baselineId", "source", "version", "frozen", "frozenAt", "frozenBy", "testsSha256"]);
+const contractsSchema = objectSchema({
+  aimlock: objectSchema({ goalId: stringSchema({ pattern: ID_PATTERN }),
+    scopeContractSha256: stringSchema({ pattern: SHA_PATTERN }), snapshotSha256: stringSchema({ pattern: SHA_PATTERN }) },
+  ["goalId", "scopeContractSha256", "snapshotSha256"]),
+  blueprint: objectSchema({ blueprintId: stringSchema({ pattern: ID_PATTERN }),
+    acceptanceReportSha256: stringSchema({ pattern: SHA_PATTERN }) }, ["blueprintId", "acceptanceReportSha256"]),
+  archguard: objectSchema({ contractSha256: stringSchema({ pattern: SHA_PATTERN }),
+    ledgerSha256: stringSchema({ pattern: SHA_PATTERN }),
+    driftStatus: { enum: ["green", "yellow", "red"] } },
+  ["contractSha256", "ledgerSha256", "driftStatus"]),
+});
+const validationFileSchema = objectSchema({
+  path: stringSchema({ minLength: 1, maxLength: 500 }),
+  sha256: stringSchema({ pattern: SHA_PATTERN }),
+}, ["path", "sha256"]);
+const subjectSchema = objectSchema({
+  schemaVersion: { const: VALIDATION_SUBJECT_SCHEMA }, artifactSha256: stringSchema({ pattern: SHA_PATTERN }),
+  memberId: stringSchema({ pattern: MEMBER_PATTERN }), chainId: stringSchema({ pattern: CHAIN_PATTERN }),
+  executedAt: stringSchema({ format: "date-time" }), files: arraySchema(validationFileSchema, { minItems: 1 }),
+  validationRunId: stringSchema({ pattern: ID_PATTERN }), planId: stringSchema({ pattern: ID_PATTERN }),
+  tests: arraySchema(anyObjectSchema, { minItems: 1 }), policy: anyObjectSchema,
+  goldenBaseline: baselineSchema, contracts: contractsSchema,
+}, ["schemaVersion", "artifactSha256", "validationRunId", "planId", "tests", "policy", "goldenBaseline"]);
+const testEvidenceProperties = {
+  schemaVersion: { const: TEST_EVIDENCE_SCHEMA }, evidenceId: stringSchema({ pattern: ID_PATTERN }),
+  kind: { enum: ["test", "build", "lint", "security", "benchmark"] }, command: stringSchema({ minLength: 1 }),
+  exitCode: { type: "integer" }, durationMs: { type: "number", minimum: 0 },
+  summary: stringSchema({ minLength: 1 }), artifactSha256: stringSchema({ pattern: SHA_PATTERN }),
+  subject: subjectSchema, subjectDigest: stringSchema({ pattern: SHA_PATTERN }), receipt: receiptSchema,
+};
+const testEvidenceRequired = ["schemaVersion", "evidenceId", "kind", "runner", "command", "exitCode", "durationMs", "summary"];
+const testEvidenceSchema = {
+  oneOf: [
+    objectSchema({ ...testEvidenceProperties, runner: { const: "local" } }, testEvidenceRequired),
+    objectSchema({ ...testEvidenceProperties, runner: { const: "trusted-runner" } },
+      [...testEvidenceRequired, "artifactSha256", "subject", "subjectDigest", "receipt"]),
+  ],
+};
+const riskEntrySchema = objectSchema({
+  riskId: stringSchema({ pattern: ID_PATTERN }), findingRuleId: stringSchema({ minLength: 1 }),
+  findingEntityRef: stringSchema({ minLength: 1 }), owner: stringSchema({ pattern: ID_PATTERN }),
+  mitigation: stringSchema({ minLength: 1 }), acceptedBy: stringSchema({ pattern: ID_PATTERN }),
+  acceptedAt: stringSchema({ format: "date-time" }),
+}, ["riskId", "findingRuleId", "findingEntityRef", "owner", "mitigation", "acceptedBy", "acceptedAt"]);
+const repairCategorySchema = {
+  enum: ["structure-schema", "formula-calculation", "scope-drift", "execution-dispatch", "validator-self"],
+};
+const fileSchema = objectSchema({ path: stringSchema({ minLength: 1 }), content: stringSchema(), schema: anyObjectSchema }, ["path", "content"]);
+const nextSchema = objectSchema({ operation: { type: ["string", "null"] }, instruction: stringSchema() }, ["operation", "instruction"]);
+const responseSchema = (properties, required) => objectSchema({
+  schemaVersion: { const: RES }, requestId: stringSchema({ minLength: 1 }), status: { enum: ["succeeded", "blocked", "failed"] }, ...properties,
+}, ["schemaVersion", "requestId", "status", ...required]);
+const operationSchema = (input, inputRequired, output, outputRequired) => ({
+  input: objectSchema(input, inputRequired), output: responseSchema(output, outputRequired),
+});
+const SCHEMAS = Object.freeze({
+  capabilities: operationSchema({}, [], { capabilities: anyObjectSchema, skill: anyObjectSchema, operationSchemas: anyObjectSchema, nextStep: nextSchema }, ["capabilities", "skill", "operationSchemas", "nextStep"]),
+  help: operationSchema({}, [], { help: anyObjectSchema, operationSchemas: anyObjectSchema, nextStep: nextSchema }, ["help", "operationSchemas", "nextStep"]),
+  intake: operationSchema({ goal: stringSchema({ minLength: 1 }), riskLevel: { enum: ["low", "medium", "high"] }, complianceReqs: arraySchema(stringSchema()), targetFiles: arraySchema(stringSchema()) }, ["goal", "riskLevel"], { intake: anyObjectSchema, nextStep: nextSchema }, ["intake", "nextStep"]),
+  plan: operationSchema({ findings: arraySchema(findingSchema), findingCategories: arraySchema(repairCategorySchema), intakeResult: anyObjectSchema, availableSkills: arraySchema(stringSchema()) }, ["intakeResult"], { plan: anyObjectSchema, nextStep: nextSchema }, ["plan", "nextStep"]),
+  "validate-structure": operationSchema({ files: arraySchema(fileSchema, { minItems: 1 }), rules: arraySchema(anyObjectSchema) }, ["files"], { findings: arraySchema(findingSchema), summary: anyObjectSchema, nextStep: nextSchema }, ["findings", "summary", "nextStep"]),
+  "security-scan": operationSchema({ files: arraySchema(fileSchema, { minItems: 1 }), rules: arraySchema(anyObjectSchema) }, ["files"], { findings: arraySchema(findingSchema), summary: anyObjectSchema, nextStep: nextSchema }, ["findings", "summary", "nextStep"]),
+  "compliance-audit": operationSchema({ files: arraySchema(fileSchema, { minItems: 1 }), template: stringSchema({ minLength: 1 }), requirements: arraySchema(stringSchema()) }, ["files", "template"], { findings: arraySchema(findingSchema), template: stringSchema(), nextStep: nextSchema }, ["findings", "template", "nextStep"]),
+  "functional-verify": operationSchema({ validationContext: subjectSchema, receipts: arraySchema(receiptSchema, { minItems: 1 }) }, ["validationContext", "receipts"], { subject: subjectSchema, subjectDigest: stringSchema({ pattern: SHA_PATTERN }), results: arraySchema(anyObjectSchema), summary: anyObjectSchema, findings: arraySchema(findingSchema), evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["subject", "subjectDigest", "results", "summary", "findings", "evidence", "nextStep"]),
+  "sandbox-run": operationSchema({ command: stringSchema({ minLength: 1 }), files: arraySchema(fileSchema), timeout: { type: "number", minimum: 0 }, networkPolicy: { enum: ["block", "allow"] } }, ["command", "networkPolicy"], { sandbox: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["sandbox", "runner", "evidence", "nextStep"]),
+  "fuzz-input": operationSchema({ targetFile: stringSchema({ minLength: 1 }), cases: arraySchema(anyObjectSchema), maxCases: { type: "integer", minimum: 1 } }, ["targetFile", "maxCases"], { fuzz: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["fuzz", "runner", "evidence", "nextStep"]),
+  "perf-benchmark": operationSchema({ command: stringSchema({ minLength: 1 }), baseline: baselineSchema, threshold: { type: "number", minimum: 0 } }, ["command", "baseline", "threshold"], { benchmark: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["benchmark", "runner", "evidence", "nextStep"]),
+  "intrusive-test": operationSchema({ authorization: { type: "boolean" }, tests: arraySchema(anyObjectSchema, { minItems: 1 }), sandbox: { const: true } }, ["authorization", "tests", "sandbox"], { intrusive: anyObjectSchema, runner: { const: "local-only" }, evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["intrusive", "runner", "evidence", "nextStep"]),
+  verdict: operationSchema({ expectedSubject: subjectSchema, validationContext: subjectSchema, findings: arraySchema(findingSchema), evidence: arraySchema(testEvidenceSchema), riskLedger: arraySchema(riskEntrySchema) }, [], { report: anyObjectSchema, findings: arraySchema(findingSchema), evidence: arraySchema(testEvidenceSchema), nextStep: nextSchema }, ["report", "findings", "evidence", "nextStep"]),
+});
+
+function text(value) { return String(value ?? ""); }
+function isObj(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
+function finding(severity, ruleId, entityRef, message, evidence) {
+  return { severity, ruleId, entityRef, message, evidence: evidence === undefined ? {} : { example: evidence } };
+}
+function ok(requestId, payload) { return { schemaVersion: RES, requestId, status: "succeeded", ...payload }; }
+function blocked(requestId, findings) { return { schemaVersion: RES, requestId, status: "blocked", validation: { valid: false, guarantee: "blocked", findings } }; }
+function failed(requestId, code, message) { return { schemaVersion: RES, requestId, status: "failed", errorSchema: ERR, error: { code, message } }; }
+function requiredText(input, key) {
+  const value = text(input[key]).trim();
+  return value ? { value } : { error: finding("P0", "REQUIRED", `input.${key}`, `${key} is required`) };
+}
+function requiredArray(input, key, minimum = 0) {
+  if (!Array.isArray(input[key]) || input[key].length < minimum) return { error: finding("P0", "REQUIRED", `input.${key}`, `${key} must contain at least ${minimum} item(s)`) };
+  return { value: input[key] };
+}
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("Evidence must contain finite numbers");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (!isObj(value)) throw new TypeError("Evidence must be JSON serializable");
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+export function validatorReceiptSubject(value) { return createHash("sha256").update(canonicalJson(value)).digest("hex"); }
+export function validatorArtifactSubject(files) {
+  const manifest = files.map((file) => `${file.path}\0${file.sha256}`).join("\n");
+  return createHash("sha256").update(`validator.file-manifest/1.0\n${manifest}`).digest("hex");
+}
+export function validatorReceiptPayload(receipt) {
+  if (!isObj(receipt)) throw new TypeError("Execution receipt must be an object");
+  const { signature: _signature, ...payload } = receipt;
+  return canonicalJson(payload);
+}
+
+function validateGoldenBaseline(value, entityRef, tests) {
+  const findings = [];
+  if (!isObj(value)) return [finding("P0", "GOLDEN-BASELINE-REQUIRED", entityRef, "A frozen golden baseline is required")];
+  if (value.schemaVersion !== GOLDEN_BASELINE_SCHEMA) findings.push(finding("P0", "GOLDEN-BASELINE-SCHEMA", `${entityRef}.schemaVersion`, `Expected ${GOLDEN_BASELINE_SCHEMA}`));
+  if (!idRegex.test(text(value.baselineId)) || !idRegex.test(text(value.version)) || !idRegex.test(text(value.frozenBy))) findings.push(finding("P0", "GOLDEN-BASELINE-ID", entityRef, "baselineId, version, and frozenBy must be stable identifiers"));
+  if (value.frozen !== true || !Number.isFinite(Date.parse(text(value.frozenAt)))) findings.push(finding("P0", "GOLDEN-BASELINE-FROZEN", entityRef, "Baseline must be frozen with a valid timestamp"));
+  if (!isObj(value.source) || !["repository-commit", "artifact", "approved-record"].includes(value.source.kind)
+    || !text(value.source.locator).trim() || !shaRegex.test(text(value.source.digestSha256))) findings.push(finding("P0", "GOLDEN-BASELINE-SOURCE", `${entityRef}.source`, "Baseline requires traceable source, locator, and SHA-256"));
+  if (!shaRegex.test(text(value.testsSha256)) || value.testsSha256 !== validatorReceiptSubject(tests)) findings.push(finding("P0", "GOLDEN-BASELINE-TESTS", `${entityRef}.testsSha256`, "Frozen tests digest does not match subject tests"));
+  return findings;
+}
+function readValidationSubject(value, entityRef) {
+  if (!isObj(value)) return { findings: [finding("P0", "VALIDATION-SUBJECT-REQUIRED", entityRef, "A validation subject is required")] };
+  const findings = [];
+  const allowed = new Set(["schemaVersion", "memberId", "chainId", "executedAt", "files", "artifactSha256", "validationRunId", "planId", "tests", "policy", "goldenBaseline", "contracts"]);
+  const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+  if (unknown.length) findings.push(finding("P0", "VALIDATION-SUBJECT-FIELDS", entityRef, `Unknown fields: ${unknown.join(", ")}`));
+  if (value.schemaVersion !== VALIDATION_SUBJECT_SCHEMA) findings.push(finding("P0", "VALIDATION-SUBJECT-SCHEMA", `${entityRef}.schemaVersion`, `Expected ${VALIDATION_SUBJECT_SCHEMA}`));
+  if (!shaRegex.test(text(value.artifactSha256))) findings.push(finding("P0", "VALIDATION-SUBJECT-ARTIFACT", `${entityRef}.artifactSha256`, "artifactSha256 must be lowercase SHA-256"));
+  for (const key of ["validationRunId", "planId"]) if (!idRegex.test(text(value[key]))) findings.push(finding("P0", "VALIDATION-SUBJECT-ID", `${entityRef}.${key}`, `${key} must be stable`));
+  if (!Array.isArray(value.tests) || value.tests.length === 0) findings.push(finding("P0", "VALIDATION-SUBJECT-TESTS", `${entityRef}.tests`, "tests must be non-empty"));
+  if (!isObj(value.policy) || !text(value.policy.command).trim() || !Number.isInteger(value.policy.requiredExitCode)) findings.push(finding("P0", "VALIDATION-SUBJECT-POLICY", `${entityRef}.policy`, "policy requires command and requiredExitCode"));
+  const hardenedFields = ["memberId", "chainId", "executedAt", "files"];
+  const hardened = hardenedFields.some((key) => value[key] !== undefined);
+  if (hardened) {
+    if (!memberRegex.test(text(value.memberId))) findings.push(finding("P0", "VALIDATION-SUBJECT-MEMBER", `${entityRef}.memberId`, "memberId must be a stable member identifier"));
+    if (!chainRegex.test(text(value.chainId))) findings.push(finding("P0", "VALIDATION-SUBJECT-CHAIN", `${entityRef}.chainId`, "chainId must be a valid member chain identifier"));
+    if (!Number.isFinite(Date.parse(text(value.executedAt)))) findings.push(finding("P0", "VALIDATION-SUBJECT-EXECUTED-AT", `${entityRef}.executedAt`, "executedAt must be a valid timestamp"));
+    if (!Array.isArray(value.files) || value.files.length === 0) findings.push(finding("P0", "VALIDATION-SUBJECT-FILES", `${entityRef}.files`, "files must be a non-empty normalized manifest"));
+    else {
+      for (const [index, file] of value.files.entries()) {
+        const path = text(file?.path);
+        const normalized = path === path.normalize("NFC") && !/[\u0000-\u001f\u007f]/.test(path)
+          && !path.startsWith("/") && !path.includes("\\")
+          && path.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+        if (!isObj(file) || !normalized || !shaRegex.test(text(file.sha256))) findings.push(finding("P0", "VALIDATION-SUBJECT-FILE", `${entityRef}.files[${index}]`, "Each file needs a normalized relative path and SHA-256"));
+        if (index > 0 && text(value.files[index - 1]?.path) >= path) findings.push(finding("P0", "VALIDATION-SUBJECT-FILE-ORDER", `${entityRef}.files[${index}].path`, "File paths must be unique and sorted"));
+      }
+      if (!findings.some((item) => item.ruleId.startsWith("VALIDATION-SUBJECT-FILE"))
+        && value.artifactSha256 !== validatorArtifactSubject(value.files)) findings.push(finding("P0", "VALIDATION-SUBJECT-ARTIFACT-MANIFEST", `${entityRef}.artifactSha256`, "Artifact digest does not match the file manifest"));
+    }
+  }
+  if (hardened && (!isObj(value.contracts) || !isObj(value.contracts.aimlock))) findings.push(finding("P0", "VALIDATION-SUBJECT-SNAPSHOT", `${entityRef}.contracts.aimlock`, "Hardened validation requires an Aimlock snapshot binding"));
+  if (value.contracts !== undefined && (!isObj(value.contracts)
+    || (value.contracts.aimlock !== undefined && (!isObj(value.contracts.aimlock)
+      || !idRegex.test(text(value.contracts.aimlock.goalId))
+      || !shaRegex.test(text(value.contracts.aimlock.scopeContractSha256))
+      || !shaRegex.test(text(value.contracts.aimlock.snapshotSha256))))
+    || (value.contracts.blueprint !== undefined && (!isObj(value.contracts.blueprint)
+      || !idRegex.test(text(value.contracts.blueprint.blueprintId))
+      || !shaRegex.test(text(value.contracts.blueprint.acceptanceReportSha256))))
+    || (value.contracts.archguard !== undefined && (!isObj(value.contracts.archguard)
+      || !shaRegex.test(text(value.contracts.archguard.contractSha256))
+      || !shaRegex.test(text(value.contracts.archguard.ledgerSha256))
+      || !["green", "yellow", "red"].includes(value.contracts.archguard.driftStatus))))) findings.push(finding("P0", "VALIDATION-SUBJECT-CONTRACTS", `${entityRef}.contracts`, "Aimlock, Blueprint, and ArchGuard bridge contracts require stable ids, SHA-256 digests, and a valid drift status"));
+  if (Array.isArray(value.tests)) findings.push(...validateGoldenBaseline(value.goldenBaseline, `${entityRef}.goldenBaseline`, value.tests));
+  try { canonicalJson(value); } catch (error) { findings.push(finding("P0", "VALIDATION-SUBJECT-JSON", entityRef, error instanceof Error ? error.message : "Invalid JSON")); }
+  return findings.length ? { findings } : { value };
+}
+function expectedValidationSubject(input) {
+  if (input.expectedSubject === undefined && input.validationContext === undefined) return readValidationSubject(undefined, "input.expectedSubject");
+  const expected = input.expectedSubject === undefined ? null : readValidationSubject(input.expectedSubject, "input.expectedSubject");
+  const context = input.validationContext === undefined ? null : readValidationSubject(input.validationContext, "input.validationContext");
+  const findings = [...(expected?.findings ?? []), ...(context?.findings ?? [])];
+  if (findings.length) return { findings };
+  const value = expected?.value ?? context.value;
+  const digest = validatorReceiptSubject(value);
+  if (expected?.value && context?.value && digest !== validatorReceiptSubject(context.value)) return { findings: [finding("P0", "VALIDATION-SUBJECT-CONFLICT", "input.validationContext", "Targets differ")] };
+  return { value, digest };
+}
+
+function configuredReceiptKey() {
+  const encoded = text(process.env[RECEIPT_PUBLIC_KEY_ENV]).trim();
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) return null;
+  try {
+    const der = Buffer.from(encoded, "base64");
+    const key = createPublicKey({ key: der, format: "der", type: "spki" });
+    return key.asymmetricKeyType === "ed25519" ? { key, keyId: createHash("sha256").update(der).digest("hex") } : null;
+  } catch { return null; }
+}
+function verifiedReceipt(receipt, subjectDigest, subject) {
+  const configured = configuredReceiptKey();
+  if (!configured || !isObj(receipt) || receipt.schemaVersion !== RECEIPT_SCHEMA) return null;
+  const result = receipt.result;
+  const issuedAt = Date.parse(text(receipt.issuedAt));
+  const expiresAt = Date.parse(text(receipt.expiresAt));
+  const executedAt = subject.executedAt === undefined ? null : Date.parse(text(subject.executedAt));
+  const now = Date.now();
+  if (receipt.keyId !== configured.keyId || receipt.subjectDigest !== subjectDigest || !idRegex.test(text(receipt.nonce))
+    || !Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || issuedAt > now + 60_000 || expiresAt <= now
+    || (executedAt !== null && (!Number.isFinite(executedAt) || executedAt > issuedAt
+      || issuedAt - executedAt > MAX_RECEIPT_LIFETIME_MS))
+    || expiresAt <= issuedAt || expiresAt - issuedAt > MAX_RECEIPT_LIFETIME_MS || !isObj(result)
+    || result.runner !== "trusted-runner" || typeof result.passed !== "boolean" || !Number.isInteger(result.exitCode)
+    || typeof result.durationMs !== "number" || result.durationMs < 0 || !text(result.summary).trim()) return null;
+  try {
+    const signature = Buffer.from(text(receipt.signature), "base64url");
+    return verifySignature(null, Buffer.from(validatorReceiptPayload(receipt)), configured.key, signature) ? receipt : null;
+  } catch { return null; }
+}
+function createTestEvidence(receipt, subject, subjectDigest, index) {
+  return { schemaVersion: TEST_EVIDENCE_SCHEMA, evidenceId: `${subject.validationRunId}:${index}`, kind: "test",
+    runner: "trusted-runner", command: subject.policy.command, exitCode: receipt.result.exitCode,
+    durationMs: receipt.result.durationMs, summary: receipt.result.summary, artifactSha256: subject.artifactSha256,
+    subject, subjectDigest, receipt };
+}
+function evidenceState(evidence, subject, subjectDigest) {
+  if (!isObj(evidence) || evidence.schemaVersion !== TEST_EVIDENCE_SCHEMA || evidence.runner === "local") return "unverifiable";
+  let evidenceDigest;
+  try { evidenceDigest = validatorReceiptSubject(evidence.subject); } catch { return "unverifiable"; }
+  if (!idRegex.test(text(evidence.evidenceId)) || !["test", "build", "lint", "security", "benchmark"].includes(evidence.kind)
+    || evidence.runner !== "trusted-runner" || evidence.command !== subject.policy.command
+    || evidence.artifactSha256 !== subject.artifactSha256 || evidence.subjectDigest !== subjectDigest
+    || !isObj(evidence.subject) || evidenceDigest !== subjectDigest) return "unverifiable";
+  const receipt = verifiedReceipt(evidence.receipt, subjectDigest, subject);
+  if (!receipt || evidence.exitCode !== receipt.result.exitCode || evidence.durationMs !== receipt.result.durationMs
+    || evidence.summary !== receipt.result.summary) return "unverifiable";
+  return receipt.result.passed && receipt.result.exitCode === subject.policy.requiredExitCode ? "valid" : "failed";
+}
+
+const DEFAULT_SECURITY_RULES = [
+  { id: "SEC-EVAL", pattern: /\beval\s*\(|new\s+Function\b|\bFunction\s*\(/g, severity: "P0", fix: "Use controlled AST evaluation", executableOnly: true },
+  { id: "SEC-SECRETS", pattern: /(?:api[_-]?key|token|password|secret)\s*[:=]\s*['"][A-Za-z0-9_\-]{8,}/gi, severity: "P0", fix: "Remove hardcoded credentials" },
+  { id: "SEC-SQLI", pattern: /(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\+\s*(?:req\.|input\.|params\.)/gi, severity: "P0", fix: "Use parameterized queries" },
+  { id: "SEC-XSS", pattern: /innerHTML\s*=\s*(?!\s*['"`]\s*['"`])/g, severity: "P1", fix: "Use sanitized output" },
+];
+const DEFAULT_STRUCTURE_RULES = ["references-closed", "required-fields", "type-correct", "no-cycle"];
+function executableJavaScript(path) { return /\.(?:[cm]?[jt]sx?)$/i.test(path); }
+function stripJavaScriptInertText(source) {
+  let output = "";
+  let state = "code";
+  let quote = "";
+  for (let index = 0; index < source.length; index += 1) {
+    const character = source[index];
+    const next = source[index + 1];
+    if (state === "line") {
+      if (character === "\n") { state = "code"; output += "\n"; }
+      continue;
+    }
+    if (state === "block") {
+      if (character === "*" && next === "/") { state = "code"; index += 1; }
+      else if (character === "\n") output += "\n";
+      continue;
+    }
+    if (state === "string") {
+      if (character === "\\") { index += 1; continue; }
+      if (character === quote) { state = "code"; quote = ""; }
+      else if (character === "\n") output += "\n";
+      continue;
+    }
+    if (character === "/" && next === "/") { state = "line"; index += 1; continue; }
+    if (character === "/" && next === "*") { state = "block"; index += 1; continue; }
+    if (["'", '"', "`"].includes(character)) { state = "string"; quote = character; continue; }
+    output += character;
+  }
+  return output;
+}
+function runSecurityScan(files, rules = DEFAULT_SECURITY_RULES) {
+  const findings = [];
+  for (const file of files) for (const rule of rules) {
+    const path = text(file.path);
+    const content = rule.executableOnly
+      ? executableJavaScript(path) ? stripJavaScriptInertText(text(file.content)) : ""
+      : text(file.content);
+    const matches = content.match(rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, "g"));
+    if (matches) findings.push(finding(rule.severity, rule.id, text(file.path), `${matches.length} match(es): ${rule.fix}`, { sample: matches[0] }));
+  }
+  return findings;
+}
+function runStructureValidation(files) {
+  const findings = [];
+  for (const file of files) {
+    const path = text(file.path);
+    if (path.endsWith(".json")) try { JSON.parse(text(file.content)); } catch (error) { findings.push(finding("P0", "STR-JSON", path, error.message)); }
+    if (file.schema && path.endsWith(".json")) try {
+      const data = JSON.parse(text(file.content));
+      for (const field of file.schema.required ?? []) if (data[field] === undefined) findings.push(finding("P0", "STR-REQ", `${path}.${field}`, "Required field is missing"));
+    } catch { /* invalid JSON is reported above */ }
+  }
+  return findings;
+}
+function validateReq(request) {
+  const findings = [];
+  if (!isObj(request)) return [finding("P0", "REQ_OBJECT", "request", "request must be an object")];
+  if (request.schemaVersion !== REQ) findings.push(finding("P0", "REQ_SCHEMA", "request.schemaVersion", `Expected ${REQ}`));
+  if (!text(request.requestId).trim()) findings.push(finding("P0", "REQ_FIELD", "request.requestId", "requestId is required"));
+  if (!OPS.includes(request.operation)) findings.push(finding("P0", "REQ_OPERATION", "request.operation", "operation is unsupported"));
+  if (!isObj(request.input)) findings.push(finding("P0", "REQ_INPUT", "request.input", "input must be an object"));
+  return findings;
+}
+function severitySummary(findings) {
+  return { total: findings.length, p0: findings.filter((item) => item.severity === "P0").length,
+    p1: findings.filter((item) => item.severity === "P1").length,
+    p2: findings.filter((item) => item.severity === "P2").length };
+}
+const REPAIR_ROUTES = Object.freeze([
+  { category: "structure-schema", skill: "blueprint", action: "recompile-contract", trigger: "structure or schema mismatch", requiresHumanConfirmation: false },
+  { category: "formula-calculation", skill: "calctool", action: "repair-formula-engine", trigger: "formula or calculation mismatch", requiresHumanConfirmation: false },
+  { category: "scope-drift", skill: "aimlock", action: "relock-scope", trigger: "scope contract violation", requiresHumanConfirmation: false },
+  { category: "execution-dispatch", skill: "swarm", action: "repair-dispatch", trigger: "execution or dispatch failure", requiresHumanConfirmation: false },
+  { category: "validator-self", skill: "validator", action: "propose-validator-patch", trigger: "Validator rule or engine defect", requiresHumanConfirmation: true },
+]);
+
+function runMeta(requestId, operation) {
+  const operationStatus = { implementedPure: [...PURE], localRunnerRequired: [...LOCAL_ONLY], planned: ["mutation-testing"] };
+  const goldenPathExample = { operation: "functional-verify", input: { validationContext: "frozen ValidationSubject", receipts: "signed trusted-runner receipt[]" }, next: "verdict with cli.tax.test-evidence/1.0" };
+  if (operation === "capabilities") return ok(requestId, { capabilities: { pure: false, stateless: true, operationStatus,
+    verdictLevels: ["pass", "pass-with-risk", "blocked", "incomplete"], testEvidenceSchema: TEST_EVIDENCE_SCHEMA,
+    goldenBaselineSchema: GOLDEN_BASELINE_SCHEMA, catalogSchema: CATALOG_SCHEMA }, operationSchemas: SCHEMAS,
+    goldenPathExample, skill: { name: NAME, version: COMPILER_VERSION }, nextStep: { operation: "intake", instruction: "Collect validation requirements." } });
+  return ok(requestId, { help: { name: NAME, version: COMPILER_VERSION, operations: CATALOG, operationStatus, goldenPathExample },
+    operationSchemas: SCHEMAS, nextStep: { operation: "intake", instruction: "Collect validation requirements." } });
+}
+function runPlanning(requestId, operation, input) {
+  if (operation === "intake") {
+    const goal = requiredText(input, "goal");
+    const risk = requiredText(input, "riskLevel");
+    if (goal.error || risk.error) return blocked(requestId, [goal.error, risk.error].filter(Boolean));
+    if (!["low", "medium", "high"].includes(risk.value)) return blocked(requestId, [finding("P0", "RISK-LEVEL", "input.riskLevel", "riskLevel must be low, medium, or high")]);
+    return ok(requestId, { intake: { goal: goal.value, riskLevel: risk.value, complianceReqs: input.complianceReqs, targetFiles: input.targetFiles }, nextStep: { operation: "plan", instruction: "Generate validation plan." } });
+  }
+  const risk = text(input.intakeResult?.riskLevel);
+  if (!["low", "medium", "high"].includes(risk)) return blocked(requestId, [finding("P0", "INTAKE-RESULT", "input.intakeResult", "A valid intakeResult is required")]);
+  const modules = ["validate-structure", "security-scan", "functional-verify"];
+  if (risk === "high") modules.push("compliance-audit", "sandbox-run", "intrusive-test");
+  else modules.push("fuzz-input");
+  modules.push("perf-benchmark", "verdict");
+  const available = Array.isArray(input.availableSkills) ? input.availableSkills : [];
+  const requestedCategories = Array.isArray(input.findingCategories) ? input.findingCategories : [];
+  const invalidCategory = requestedCategories.find((category) => !REPAIR_ROUTES.some((route) => route.category === category));
+  if (invalidCategory) return blocked(requestId, [finding("P0", "REPAIR-CATEGORY", "input.findingCategories", `Unsupported repair category: ${invalidCategory}`)]);
+  const selectedRoutes = requestedCategories.length
+    ? REPAIR_ROUTES.filter((route) => requestedCategories.includes(route.category)) : REPAIR_ROUTES;
+  const routing = selectedRoutes.map((route) => ({
+    ...route,
+    available: route.skill === "validator" || available.includes(route.skill),
+    invoke: route.skill !== "validator" && available.includes(route.skill),
+  }));
+  return ok(requestId, { plan: { modules, routing, routingPolicy: "deterministic-category-map",
+    riskLevel: risk, totalSteps: modules.length }, nextStep: { operation: modules[0], instruction: `Execute ${modules[0]}.` } });
+}
+function runStatic(requestId, operation, input) {
+  const files = requiredArray(input, "files", 1);
+  if (files.error) return blocked(requestId, [files.error]);
+  if (operation === "validate-structure") {
+    const findings = runStructureValidation(files.value);
+    return ok(requestId, { findings, summary: severitySummary(findings), line: "static", nextStep: { operation: "security-scan", instruction: "Run security scan." } });
+  }
+  if (operation === "security-scan") {
+    const findings = runSecurityScan(files.value, input.rules);
+    return ok(requestId, { findings, summary: severitySummary(findings), line: "static", nextStep: { operation: "functional-verify", instruction: "Run frozen golden baseline." } });
+  }
+  const template = requiredText(input, "template");
+  if (template.error) return blocked(requestId, [template.error]);
+  const findings = files.value.flatMap((file) => publicBindSites(text(file.path), text(file.content)).map((site) => finding("P1", "COMP-PORT", text(file.path), "Public bind requires review", site)));
+  return ok(requestId, { findings, template: template.value, nextStep: { operation: "functional-verify", instruction: "Run frozen golden baseline." } });
+}
+function runFunctional(requestId, input) {
+  const subject = readValidationSubject(input.validationContext, "input.validationContext");
+  if (subject.findings) return blocked(requestId, subject.findings);
+  const receipts = requiredArray(input, "receipts", 1);
+  if (receipts.error) return blocked(requestId, [finding("P0", "TRUSTED-RECEIPT-REQUIRED", "input.receipts", "Signed trusted-runner receipts are required")]);
+  const subjectDigest = validatorReceiptSubject(subject.value);
+  const verified = receipts.value.map((receipt) => verifiedReceipt(receipt, subjectDigest, subject.value));
+  if (verified.some((receipt) => receipt === null)) return blocked(requestId, [finding("P0", "INVALID-EXECUTION-RECEIPT", "input.receipts", "Receipt signature, lifetime, result, or subject is invalid")]);
+  const results = verified.map((receipt) => receipt.result);
+  const findings = results.flatMap((result, index) => result.passed && result.exitCode === subject.value.policy.requiredExitCode ? [] : [finding("P1", "GOLDEN-FAIL", `receipt:${index}`, "Frozen golden baseline failed", result)]);
+  const evidence = verified.map((receipt, index) => createTestEvidence(receipt, subject.value, subjectDigest, index));
+  return ok(requestId, { subject: subject.value, subjectDigest, results,
+    summary: { total: results.length, passed: results.length - findings.length, failed: findings.length },
+    runner: "trusted-runner", findings, evidence, nextStep: { operation: "verdict", instruction: "Render verdict from TestEvidence." } });
+}
+
+function runLocalProtocol(requestId, operation, input) {
+  if (operation === "intrusive-test" && input.authorization !== true) return blocked(requestId, [finding("P0", "INTRUSIVE-NO-AUTH", "input.authorization", "Explicit authorization is required")]);
+  const descriptor = operation === "fuzz-input" ? requiredText(input, "targetFile") : requiredText(input, "command");
+  if (descriptor.error && operation !== "intrusive-test") return blocked(requestId, [descriptor.error]);
+  const pending = { operation, status: "pending-execution", requestedTarget: descriptor.value };
+  const key = operation === "sandbox-run" ? "sandbox" : operation === "fuzz-input" ? "fuzz"
+    : operation === "perf-benchmark" ? "benchmark" : "intrusive";
+  return ok(requestId, { [key]: pending, runner: "local-only", evidence: [],
+    pendingEvidenceRequirements: { schemaVersion: TEST_EVIDENCE_SCHEMA, trustedReceiptRequiredForFinalPass: true },
+    nextStep: { operation: "verdict", instruction: "Local runner must return signed TestEvidence; pending is incomplete." } });
+}
+function validRiskLedger(findings, ledger) {
+  if (!Array.isArray(ledger)) return false;
+  return findings.filter((item) => item.severity === "P1").every((item) => ledger.some((entry) => isObj(entry)
+    && idRegex.test(text(entry.riskId)) && entry.findingRuleId === item.ruleId
+    && entry.findingEntityRef === item.entityRef
+    && idRegex.test(text(entry.owner)) && text(entry.mitigation).trim()
+    && idRegex.test(text(entry.acceptedBy)) && Number.isFinite(Date.parse(text(entry.acceptedAt)))));
+}
+function runVerdict(requestId, input) {
+  const expected = expectedValidationSubject(input);
+  if (expected.findings) return blocked(requestId, expected.findings);
+  const findings = Array.isArray(input.findings) ? input.findings : [];
+  const evidence = Array.isArray(input.evidence) ? input.evidence : [];
+  const states = evidence.map((item) => evidenceState(item, expected.value, expected.digest));
+  const failedCount = states.filter((state) => state === "failed").length;
+  const p0 = findings.filter((item) => item.severity === "P0").length;
+  const p1 = findings.filter((item) => item.severity === "P1").length;
+  const allValid = states.length > 0 && states.every((state) => state === "valid");
+  const riskLedgerValid = p1 === 0 || validRiskLedger(findings, input.riskLedger);
+  const level = p0 > 0 || failedCount > 0 ? "blocked"
+    : !allValid || !riskLedgerValid ? "incomplete" : p1 > 0 ? "pass-with-risk" : "pass";
+  const report = { verdict: level, subjectDigest: expected.digest, findings: severitySummary(findings),
+    evidenceCount: evidence.length, evidenceValid: allValid,
+    evidenceSummary: { valid: states.filter((state) => state === "valid").length, failed: failedCount,
+      pending: 0, unverifiable: states.filter((state) => state === "unverifiable").length },
+    riskLedgerValid, riskLedger: input.riskLedger };
+  return ok(requestId, { report, findings, evidence,
+    nextStep: level === "blocked" ? { operation: "plan", instruction: "Repair blocking failures." }
+      : level === "incomplete" ? { operation: "verdict", instruction: "Provide trusted evidence and complete P1 risk ledger." }
+        : { operation: null, instruction: `Verdict: ${level}.` } });
+}
+
+export async function run(request) {
+  const validationFindings = validateReq(request);
+  if (validationFindings.length) return { ...blocked(request?.requestId ?? "unknown", validationFindings), errorSchema: ERR };
+  const { requestId, operation, input } = request;
+  if (operation === "capabilities" || operation === "help") return runMeta(requestId, operation);
+  if (operation === "intake" || operation === "plan") return runPlanning(requestId, operation, input);
+  if (["validate-structure", "security-scan", "compliance-audit"].includes(operation)) return runStatic(requestId, operation, input);
+  if (operation === "functional-verify") return runFunctional(requestId, input);
+  if (LOCAL_ONLY.has(operation)) return runLocalProtocol(requestId, operation, input);
+  if (operation === "verdict") return runVerdict(requestId, input);
+  return failed(requestId, "UNSUPPORTED_OPERATION", `Unsupported operation: ${operation}`);
+}
+
+export { COMPILER_VERSION, NAME, OPS, PURE, CATALOG, SCHEMAS, GOLDEN_BASELINE_SCHEMA,
+  TEST_EVIDENCE_SCHEMA, DEFAULT_SECURITY_RULES, DEFAULT_STRUCTURE_RULES,
+  runSecurityScan, runStructureValidation };