codex-workflow-v2 2.0.0-beta.13.8 → 2.0.0-beta.14

package/src/lifecycle/corrective-replan-credential-core.ts

@@ -0,0 +1,408 @@
+import { createHash } from 'node:crypto';
+import { types as utilTypes } from 'node:util';
+import { correctiveReplanBindingManifest } from './corrective-replan-binding-manifest.js';
+import { installedAuthoritySemanticBindings } from './corrective-replan-authority.js';
+import { correctiveReplanCredentialSchemaValidators } from './corrective-replan-credential-schema.js';
+import { hashCanonical } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+import { LIFECYCLE_EPOCH } from './types.js';
+type JsonRecord = Record<string, unknown>;
+type Reason = 'schema' | 'binding' | 'authority' | 'sod' | 'time' | 'integrity' | 'provenance';
+type Issue = Readonly<{ issueId: string; path: string; reasonClass: Reason }>;
+type Result<T> = Readonly<{ ok: true; value: Readonly<T>; issues: readonly [] }>
+  | Readonly<{ ok: false; value: null; issues: readonly Issue[]; reportHash: string }>;
+type Verification<T> = Readonly<{ valid: true; projection: Readonly<T>; issues: readonly []; reportHash: string }>
+  | Readonly<{ valid: false; projection: null; issues: readonly Issue[]; reportHash: string }>;
+declare const planBrand: unique symbol; declare const challengeBrand: unique symbol;
+declare const confirmationBrand: unique symbol; declare const receiptBrand: unique symbol; declare const eventBrand: unique symbol;
+export type PlanValidationHandle = Readonly<{ [planBrand]: never }>;
+export type HumanChallengeHandle = Readonly<{ [challengeBrand]: never }>;
+export type VerifiedConfirmationHandle = Readonly<{ [confirmationBrand]: never }>;
+export type ReceiptHandle = Readonly<{ [receiptBrand]: never }>;
+export type StoredPlanValidationEventHandle = Readonly<{ [eventBrand]: never }>;
+export interface CorrectiveReplanCredentialCorePorts {
+  readonly snapshotSource: { readCorrectiveReplanSnapshot(taskId: string): unknown };
+  readonly coreClock: { nowMs(): number };
+  readonly idSource: { nextId(kind: 'plan-validation-attestation' | 'human-challenge' | 'receipt' | 'plan-validation-event'): string };
+  readonly challengeCodeSource: { issueConfirmationCode(): string };
+  readonly validationEventTailSource: { readPlanValidationTail(taskId: string): unknown };
+}
+export interface CorrectiveReplanCredentialKernel {
+  issuePlanValidation(input: unknown): Result<JsonRecord>; issueHumanChallenge(input: unknown): Result<JsonRecord>; confirmHuman(input: unknown): Result<JsonRecord>; issueReceipt(input: unknown): Result<JsonRecord>;
+  verifyReceipt(input: unknown): Verification<JsonRecord>; materializeStoredEvent(input: unknown): Result<JsonRecord>; verifyStoredEvent(input: unknown): Verification<JsonRecord>;
+}
+export interface CredentialFunctionBinding { readonly id: string; readonly version: 1; readonly kind: 'materializer' | 'verifier';
+  readonly implementationId: `implementation.${string}`; readonly implementationVersion: 1; readonly wiring: 'invoked';
+  readonly callable: (issuer: unknown, input: unknown) => unknown }
+interface KernelRecord { readonly ports: CapturedPorts; readonly plans: WeakMap<object, PlanRecord>;
+  readonly challenges: WeakMap<object, ChallengeRecord>; readonly confirmations: WeakMap<object, ConfirmationRecord>;
+  readonly receipts: WeakMap<object, ReceiptRecord>; readonly events: WeakMap<object, EventRecord>;
+  readonly preparations: Map<string, PreparationRecord>; readonly preparationGeneration: { value: number };
+  readonly challenged: WeakSet<object>; readonly confirmed: WeakSet<object>;
+  readonly receipted: WeakSet<object>; readonly evented: WeakSet<object> }
+interface PreparationRecord { readonly generation: number; readonly status: 'reserved' | 'active'; readonly expiresAtMs: number }
+interface CapturedPorts { readSnapshot(taskId: string): unknown; now(): number; nextId(kind: Parameters<CorrectiveReplanCredentialCorePorts['idSource']['nextId']>[0]): string; issueCode(): string; readTail(taskId: string): unknown }
+interface PlanRecord { readonly preparationKey: string; readonly generation: number; readonly snapshot: JsonRecord; readonly snapshotBindingHash: string; readonly binding: JsonRecord; readonly attestation: JsonRecord }
+interface ChallengeRecord { readonly plan: PlanRecord; readonly challenge: JsonRecord }
+interface ConfirmationRecord { readonly challenge: ChallengeRecord; readonly projection: JsonRecord }
+interface ReceiptRecord { readonly plan: PlanRecord; readonly confirmation: ConfirmationRecord; readonly receipt: JsonRecord }
+interface EventRecord { readonly receipt: ReceiptRecord; readonly event: JsonRecord }
+const kernels = new WeakMap<object, KernelRecord>();
+const TTL = 900_000; const MAX_SAFE = Number.MAX_SAFE_INTEGER;
+const MALFORMED = Symbol('malformed'); const LIMIT = Symbol('limit');
+export function createCorrectiveReplanCredentialKernel(ports: CorrectiveReplanCredentialCorePorts): CorrectiveReplanCredentialKernel {
+  if (!exactKeys(ports, ['snapshotSource', 'coreClock', 'idSource', 'challengeCodeSource', 'validationEventTailSource']))
+    throw new TypeError('Invalid corrective replan Core ports.');
+  const captured: CapturedPorts = deepFreeze({
+    readSnapshot: ports.snapshotSource.readCorrectiveReplanSnapshot.bind(ports.snapshotSource),
+    now: ports.coreClock.nowMs.bind(ports.coreClock), nextId: ports.idSource.nextId.bind(ports.idSource),
+    issueCode: ports.challengeCodeSource.issueConfirmationCode.bind(ports.challengeCodeSource),
+    readTail: ports.validationEventTailSource.readPlanValidationTail.bind(ports.validationEventTailSource),
+  });
+  const issuer = Object.freeze(Object.create(null)) as object;
+  kernels.set(issuer, { ports: captured, plans: new WeakMap(), challenges: new WeakMap(), confirmations: new WeakMap(),
+    receipts: new WeakMap(), events: new WeakMap(), preparations: new Map(), preparationGeneration: { value: 0 },
+    challenged: new WeakSet(), confirmed: new WeakSet(), receipted: new WeakSet(), evented: new WeakSet() });
+  return deepFreeze({
+    issuePlanValidation: (input: unknown) => totalResult(() => issuePlanValidation(issuer, input)),
+    issueHumanChallenge: (input: unknown) => totalResult(() => issueHumanChallenge(issuer, input)),
+    confirmHuman: (input: unknown) => totalResult(() => confirmHuman(issuer, input)),
+    issueReceipt: (input: unknown) => totalResult(() => issueReceipt(issuer, input)),
+    verifyReceipt: (input: unknown) => totalVerification(() => verifyReceipt(issuer, input)),
+    materializeStoredEvent: (input: unknown) => totalResult(() => materializeStoredEvent(issuer, input)),
+    verifyStoredEvent: (input: unknown) => totalVerification(() => verifyStoredEvent(issuer, input)),
+  });
+}
+const issuePlanValidation = (issuer: unknown, input: unknown): Result<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return rejected('credential.provenance.invalid', '/', 'provenance');
+  const owned = copyOwnedJson(input); if (owned === LIMIT) return rejected('credential.operation.limit-exceeded', '/', 'schema');
+  if (owned === MALFORMED || !exactKeys(owned, ['taskId', 'draft'])) return rejected('credential.operation.malformed', '/', 'schema');
+  const envelope = owned;
+  if (!canonicalId(envelope.taskId) || !exactDraft(envelope.draft)) return rejected('credential.plan-validation.input-invalid', '/draft', 'schema');
+  const now = safeTime(kernel.ports.now()); if (now === null) return rejected('credential.time.invalid', '/coreClock', 'time');
+  const loaded = loadCanonicalSnapshot(kernel, envelope.taskId); if ('issueId' in loaded) return rejected(loaded.issueId, loaded.path, loaded.reasonClass);
+  const { snapshot, snapshotBindingHash } = loaded;
+  const base = record(snapshot.baseValues); const expected = record(snapshot.validationExpectation); const draft = record(envelope.draft);
+  for (const key of ['requirements', 'acceptance', 'architecture'] as const)
+    if (!same(draft[key], expected[key])) return rejected('credential.plan-validation.snapshot-mismatch', `/draft/${key}`, 'binding');
+  const validatorContext = record(draft.validatorContext); const plannerContextHash = get(expected, '/plannerContext/contextHash');
+  if (validatorContext.contextHash === plannerContextHash) return rejected('credential.plan-validation.context-invalid', '/draft/validatorContext', 'binding');
+  if (base.planAuthorIdentityHash === base.planValidatorIdentityHash)
+    return rejected('credential.plan-validation.sod-invalid', '/snapshot/baseValues/planValidatorIdentityHash', 'sod');
+  const findings = array(draft.findings); const dispositions = array(draft.dispositions);
+  if (!keyedBijection(findings, dispositions)) return rejected('credential.plan-validation.findings-invalid', '/draft/findings', 'binding');
+  const plannerCaptured = safeTime(get(expected, '/plannerContext/capturedAtMs'));
+  if (plannerCaptured === null || plannerCaptured > now) return rejected('credential.plan-validation.context-time-invalid', '/snapshot/validationExpectation/plannerContext/capturedAtMs', 'time');
+  const preparationKey = hashCanonical({ family: 'corrective-replan', snapshotBindingHash, transitionId: base.transitionId,
+    taskId: base.taskId, revision: base.revision, candidatePlanHash: base.candidatePlanHash, candidateStepSetHash: base.candidateStepSetHash });
+  const previous = kernel.preparations.get(preparationKey);
+  if (previous && now < previous.expiresAtMs) return rejected('credential.preparation.duplicate', '/taskId', 'provenance');
+  if (previous) kernel.preparations.delete(preparationKey);
+  const generation = ++kernel.preparationGeneration.value;
+  kernel.preparations.set(preparationKey, { generation, status: 'reserved', expiresAtMs: now + TTL }); let committed = false;
+  try {
+  const sortedFindings = sortRows(findings); const sortedDispositions = sortRows(dispositions);
+  const freshContext = { sourceSnapshotHash: snapshotBindingHash, plannerContextHash, validatorContextHash: validatorContext.contextHash, passed: true };
+  const validation = { domain: 'codex-workflow/plan-validation/v1', source: expected.source, candidate: expected.candidate,
+    requirements: draft.requirements, acceptance: draft.acceptance, architecture: draft.architecture,
+    planAuthor: expected.planAuthor, plannerContext: expected.plannerContext, validator: expected.validator,
+    validatorContext: { contextHash: validatorContext.contextHash, capturedAtMs: now }, freshContext,
+    passed: true, findings: sortedFindings, dispositions: sortedDispositions, validatedAtMs: now, expiresAtMs: now + TTL };
+  const planValidationHash = hashCanonical(validation); const values: JsonRecord = { ...clone(base), planValidationHash };
+  if (!canonicalManifestValues(values, true)) return rejected('credential.binding.values-invalid', '/binding/values', 'binding');
+  const capability = { id: 'capability.task.corrective-replan', version: 1,
+    issuer: { kind: 'human', identityHash: values.humanPrincipalIdentityHash }, source: 'human-confirmation',
+    scope: { transitionId: values.transitionId, taskId: values.taskId, candidatePlanHash: values.candidatePlanHash,
+      manifestSha256: correctiveReplanBindingManifest.manifestSha256 }, delegation: 'forbidden' };
+  const bindingBase = { schemaVersion: 1, manifestRef: { id: correctiveReplanBindingManifest.id, version: 1 },
+    manifestSha256: correctiveReplanBindingManifest.manifestSha256, values, capability };
+  const binding = { ...bindingBase, bindingSha256: hashCanonical(bindingBase) };
+  if (!schema('schema.corrective-replan-binding', binding)) return rejected('credential.binding.invalid', '/binding', 'schema');
+  const attestationBase = { schemaVersion: 1, attestationId: safeId(kernel.ports.nextId('plan-validation-attestation')),
+    bindingSha256: binding.bindingSha256, source: validation.source, candidate: validation.candidate,
+    requirements: validation.requirements, acceptance: validation.acceptance, architecture: validation.architecture,
+    planAuthor: validation.planAuthor, plannerContext: validation.plannerContext, validator: validation.validator,
+    validatorContext: validation.validatorContext, freshContext, passed: true,
+    findings: sortedFindings, dispositions: sortedDispositions, validatedAtMs: now, expiresAtMs: now + TTL };
+  if (!attestationBase.attestationId) return rejected('credential.id.invalid', '/idSource', 'integrity');
+  const attestation = { ...attestationBase, attestationHash: hashCanonical(attestationBase) };
+  if (!schema('schema.corrective-replan-plan-validation-attestation', attestation)) return rejected('credential.plan-validation.invalid', '/attestation', 'schema');
+  const handle = opaque(); const recordValue = deepFreeze({ preparationKey, generation, snapshot, snapshotBindingHash, binding, attestation });
+  kernel.plans.set(handle, recordValue); kernel.preparations.set(preparationKey, { generation, status: 'active', expiresAtMs: now + TTL }); committed = true;
+  return accepted({ handle: handle as PlanValidationHandle, binding, attestation });
+  } finally { if (!committed && kernel.preparations.get(preparationKey)?.generation === generation) kernel.preparations.delete(preparationKey); }
+};
+const issueHumanChallenge = (issuer: unknown, input: unknown): Result<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return rejected('credential.provenance.invalid', '/', 'provenance');
+  if (!exactKeys(input, ['planValidation'])) return rejected('credential.envelope.invalid', '/', 'schema');
+  const handle = object((input as JsonRecord).planValidation); const plan = kernel.plans.get(handle);
+  if (!plan) return rejected('credential.provenance.invalid', '/planValidation', 'provenance');
+  if (!activePreparation(kernel, plan)) return rejected('credential.preparation.superseded', '/planValidation', 'provenance');
+  if (kernel.challenged.has(handle)) return rejected('credential.provenance.invalid', '/planValidation', 'provenance');
+  const now = safeTime(kernel.ports.now()); if (now === null) return rejected('credential.time.invalid', '/coreClock', 'time');
+  if (now < number(plan.attestation.validatedAtMs)) return rejected('credential.challenge.time-invalid', '/coreClock', 'time');
+  const expiresAtMs = Math.min(now + TTL, number(plan.attestation.expiresAtMs));
+  if (now >= expiresAtMs) return rejected('credential.challenge.expired', '/planValidation', 'time');
+  const challengeId = safeId(kernel.ports.nextId('human-challenge'));
+  if (!challengeId) return rejected('credential.challenge.source-invalid', '/idSource', 'integrity');
+  const code = kernel.ports.issueCode(); if (typeof code !== 'string' || !/^[0-9]{6}$/.test(code)) return rejected('credential.challenge.source-invalid', '/challengeCodeSource', 'integrity');
+  const core = { schemaVersion: 1, challengeId, owner: 'workflow-core', bindingSha256: plan.binding.bindingSha256,
+    codeSha256: sha(code), issuedAtMs: now, expiresAtMs };
+  const challenge = deepFreeze({ ...core, challengeHash: hashCanonical(core) }); const challengeHandle = opaque();
+  kernel.challenges.set(challengeHandle, deepFreeze({ plan, challenge })); kernel.challenged.add(handle);
+  return accepted({ handle: challengeHandle as HumanChallengeHandle,
+    delivery: { kind: 'corrective-replan-human-challenge-delivery', version: 1, challengeId, confirmationCode: code, expiresAtMs } });
+};
+const confirmHuman = (issuer: unknown, input: unknown): Result<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return rejected('credential.provenance.invalid', '/', 'provenance');
+  if (!exactKeys(input, ['challenge', 'confirmation'])) return rejected('credential.envelope.invalid', '/', 'schema');
+  const confirmation = (input as JsonRecord).confirmation;
+  if (!schema('schema.corrective-replan-human-confirmation-input', confirmation)) return rejected('credential.confirmation.input-invalid', '/confirmation', 'schema');
+  const challengeHandle = object((input as JsonRecord).challenge); const challenge = kernel.challenges.get(challengeHandle);
+  if (!challenge) return rejected('credential.provenance.invalid', '/challenge', 'provenance');
+  if (!activePreparation(kernel, challenge.plan)) return rejected('credential.preparation.superseded', '/challenge', 'provenance');
+  if (kernel.confirmed.has(challengeHandle)) return rejected('credential.provenance.invalid', '/challenge', 'provenance');
+  const candidate = confirmation as JsonRecord; const now = safeTime(kernel.ports.now());
+  if (now === null) return rejected('credential.time.invalid', '/coreClock', 'time');
+  const validatedAt = number(challenge.plan.attestation.validatedAtMs); const issuedAt = number(challenge.challenge.issuedAtMs);
+  const expiresAt = number(challenge.challenge.expiresAtMs);
+  if (now >= expiresAt) return rejected('credential.confirmation.expired', '/coreClock', 'time');
+  if (now < validatedAt || now < issuedAt) return rejected('credential.confirmation.time-invalid', '/coreClock', 'time');
+  if (candidate.challengeId !== challenge.challenge.challengeId || sha(string(candidate.confirmationCode)) !== challenge.challenge.codeSha256)
+    return rejected('credential.confirmation.invalid', '/confirmation/confirmationCode', 'integrity');
+  const projection = { challengeId: challenge.challenge.challengeId, challengeHash: challenge.challenge.challengeHash,
+    bindingSha256: challenge.plan.binding.bindingSha256,
+    humanPrincipalIdentityHash: get(challenge.plan.binding, '/values/humanPrincipalIdentityHash'), confirmedAtMs: now };
+  const handle = opaque(); kernel.confirmations.set(handle, deepFreeze({ challenge, projection })); kernel.confirmed.add(challengeHandle);
+  return accepted({ handle: handle as VerifiedConfirmationHandle, projection });
+};
+const issueReceipt = (issuer: unknown, input: unknown): Result<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return rejected('credential.provenance.invalid', '/', 'provenance');
+  if (!exactKeys(input, ['planValidation', 'confirmation'])) return rejected('credential.envelope.invalid', '/', 'schema');
+  const plan = kernel.plans.get(object((input as JsonRecord).planValidation));
+  const confirmationHandle = object((input as JsonRecord).confirmation); const confirmation = kernel.confirmations.get(confirmationHandle);
+  if (!plan || !confirmation || confirmation.challenge.plan !== plan) return rejected('credential.provenance.invalid', '/', 'provenance');
+  if (!activePreparation(kernel, plan)) return rejected('credential.preparation.superseded', '/planValidation', 'provenance');
+  if (kernel.receipted.has(confirmationHandle)) return rejected('credential.provenance.invalid', '/', 'provenance');
+  const freshness = receiptFreshnessIssue(kernel, plan); if (freshness) return rejected(freshness.issueId, freshness.path, freshness.reasonClass);
+  const now = safeTime(kernel.ports.now()); if (now === null) return rejected('credential.time.invalid', '/coreClock', 'time');
+  const confirmedAt = number(confirmation.projection.confirmedAtMs); const validatedAt = number(plan.attestation.validatedAtMs);
+  const expiresAtMs = Math.min(number(plan.attestation.expiresAtMs), number(confirmation.challenge.challenge.expiresAtMs));
+  if (validatedAt > confirmedAt || confirmedAt > now || now >= expiresAtMs) return rejected('credential.receipt.time-invalid', '/coreClock', 'time');
+  const values = record(plan.binding.values); const author = values.planAuthorIdentityHash;
+  if (!authorityPassed('authority-role-evaluator.corrective-replan.eligible-role', {
+    actorIdentityHash: values.actorIdentityHash, actorRole: values.actorRole,
+    eligibleRoles: ['delivery-coordinator', 'technical-planner'],
+  })) return rejected('credential.receipt.role-invalid', '/binding/values/actorRole', 'authority');
+  if (!authorityPassed('identity-comparator.corrective-replan.author-validator', {
+    leftIdentityHash: author, rightIdentityHash: values.planValidatorIdentityHash,
+  }) || !authorityPassed('identity-comparator.corrective-replan.author-risk-auditor', {
+    leftIdentityHash: author, rightIdentityHash: values.riskAuditorIdentityHash,
+  }) || !authorityPassed('identity-comparator.corrective-replan.author-human-principal', {
+    leftIdentityHash: author, rightIdentityHash: values.humanPrincipalIdentityHash,
+  }))
+    return rejected('credential.receipt.sod-invalid', '/binding/values', 'sod');
+  const snapshotGrant = record(plan.snapshot.priorPlanAuthorization); const receiptId = safeId(kernel.ports.nextId('receipt'));
+  if (!receiptId || snapshotGrant.requiredDisposition !== 'superseded') return rejected('credential.receipt.source-invalid', '/snapshot/priorPlanAuthorization', 'authority');
+  const validation = { attestationId: plan.attestation.attestationId, attestationHash: plan.attestation.attestationHash,
+    planValidationHash: values.planValidationHash, snapshotBindingHash: plan.snapshotBindingHash, planAuthorIdentityHash: values.planAuthorIdentityHash,
+    planValidatorIdentityHash: values.planValidatorIdentityHash, findingsHash: hashCanonical(plan.attestation.findings),
+    dispositionsHash: hashCanonical(plan.attestation.dispositions), validatedAtMs: plan.attestation.validatedAtMs,
+    expiresAtMs: plan.attestation.expiresAtMs };
+  const base = { schemaVersion: 1, receiptId, domain: 'codex-workflow/corrective-replan-receipt/v1',
+    binding: plan.binding, validation, audit: { riskAuditHash: values.riskAuditHash, riskAuditorIdentityHash: values.riskAuditorIdentityHash },
+    human: { challengeId: confirmation.projection.challengeId, challengeHash: confirmation.projection.challengeHash,
+      humanPrincipalIdentityHash: confirmation.projection.humanPrincipalIdentityHash, confirmedAtMs: confirmation.projection.confirmedAtMs },
+    supersession: { priorGrantHash: snapshotGrant.grantHash, disposition: 'superseded' },
+    issuedAtMs: now, expiresAtMs };
+  const withDomain = { ...base, domainHash: hashCanonical(base) }; const receipt = deepFreeze({ ...withDomain, receiptHash: hashCanonical(withDomain) });
+  if (!schema('schema.corrective-replan-receipt', receipt)) return rejected('credential.receipt.invalid', '/receipt', 'schema');
+  const handle = opaque(); kernel.receipts.set(handle, deepFreeze({ plan, confirmation, receipt })); kernel.receipted.add(confirmationHandle);
+  return accepted({ handle: handle as ReceiptHandle, receipt });
+};
+const verifyReceipt = (issuer: unknown, input: unknown): Verification<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return verificationRejected('credential.provenance.invalid', '/', 'provenance');
+  if (!exactKeys(input, ['receipt', 'candidate'])) return verificationRejected('credential.envelope.invalid', '/', 'schema');
+  const recordValue = kernel.receipts.get(object((input as JsonRecord).receipt)); if (!recordValue) return verificationRejected('credential.provenance.invalid', '/receipt', 'provenance');
+  const candidate = (input as JsonRecord).candidate;
+  if (!schema('schema.corrective-replan-receipt', candidate)) return verificationRejected('credential.receipt.invalid', '/candidate', 'schema');
+  if (!same(candidate, recordValue.receipt)) return verificationRejected('credential.receipt.mismatch', '/candidate', 'integrity');
+  const freshness = receiptFreshnessIssue(kernel, recordValue.plan); if (freshness) return verificationRejected(freshness.issueId, freshness.path, freshness.reasonClass);
+  const now = safeTime(kernel.ports.now()); if (now === null) return verificationRejected('credential.time.invalid', '/coreClock', 'time');
+  if (now < number(recordValue.receipt.issuedAtMs)) return verificationRejected('credential.receipt.time-invalid', '/coreClock', 'time');
+  if (now >= number(recordValue.receipt.expiresAtMs)) return verificationRejected('credential.receipt.expired', '/coreClock', 'time');
+  return verified(recordValue.receipt);
+};
+const materializeStoredEvent = (issuer: unknown, input: unknown): Result<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return rejected('credential.provenance.invalid', '/', 'provenance');
+  if (!exactKeys(input, ['receipt'])) return rejected('credential.envelope.invalid', '/', 'schema');
+  const handle = object((input as JsonRecord).receipt); const receipt = kernel.receipts.get(handle);
+  if (!receipt || kernel.evented.has(handle)) return rejected('credential.provenance.invalid', '/receipt', 'provenance');
+  const now = safeTime(kernel.ports.now()); if (now === null) return rejected('credential.time.invalid', '/coreClock', 'time');
+  if (now < number(receipt.receipt.issuedAtMs)) return rejected('credential.event.time-invalid', '/coreClock', 'time');
+  const freshness = receiptFreshnessIssue(kernel, receipt.plan); if (freshness) return rejected(freshness.issueId, freshness.path, freshness.reasonClass);
+  if (now >= number(receipt.receipt.expiresAtMs)) return rejected('credential.receipt.expired', '/coreClock', 'time');
+  const tail = kernel.ports.readTail(string(get(receipt.receipt, '/binding/values/taskId')));
+  const previousEventHash = tail === null ? null : exactKeys(tail, ['eventHash']) ? tail.eventHash : undefined;
+  const eventId = safeId(kernel.ports.nextId('plan-validation-event'));
+  if (!(previousEventHash === null || hex(previousEventHash)) || !eventId) return rejected('credential.event.source-invalid', '/validationEventTailSource', 'integrity');
+  const base = { schemaVersion: 1, eventId, previousEventHash, taskId: get(receipt.receipt, '/binding/values/taskId'),
+    candidatePlanHash: get(receipt.receipt, '/binding/values/candidatePlanHash'), attestationId: get(receipt.receipt, '/validation/attestationId'),
+    attestationHash: get(receipt.receipt, '/validation/attestationHash'), receiptId: receipt.receipt.receiptId,
+    receiptHash: receipt.receipt.receiptHash, receiptDomainHash: receipt.receipt.domainHash,
+    challengeId: receipt.confirmation.projection.challengeId, challengeHash: receipt.confirmation.projection.challengeHash,
+    recordedAt: new Date(now).toISOString(), recordedAtMs: now };
+  const event = deepFreeze({ ...base, eventHash: hashCanonical(base) });
+  if (!schema('schema.corrective-replan-stored-plan-validation-event', event)) return rejected('credential.event.invalid', '/event', 'schema');
+  const eventHandle = opaque(); kernel.events.set(eventHandle, deepFreeze({ receipt, event })); kernel.evented.add(handle);
+  return accepted({ handle: eventHandle as StoredPlanValidationEventHandle, event });
+};
+const verifyStoredEvent = (issuer: unknown, input: unknown): Verification<JsonRecord> => {
+  const kernel = kernels.get(object(issuer)); if (!kernel) return verificationRejected('credential.provenance.invalid', '/', 'provenance');
+  if (!exactKeys(input, ['event', 'candidate'])) return verificationRejected('credential.envelope.invalid', '/', 'schema');
+  const recordValue = kernel.events.get(object((input as JsonRecord).event)); if (!recordValue) return verificationRejected('credential.provenance.invalid', '/event', 'provenance');
+  const candidate = (input as JsonRecord).candidate;
+  if (!schema('schema.corrective-replan-stored-plan-validation-event', candidate)) return verificationRejected('credential.event.invalid', '/candidate', 'schema');
+  if (!same(candidate, recordValue.event)) return verificationRejected('credential.event.mismatch', '/candidate', 'integrity');
+  return verified(recordValue.event);
+};
+const functions = [issuePlanValidation, issueHumanChallenge, confirmHuman, issueReceipt, verifyReceipt, materializeStoredEvent, verifyStoredEvent];
+const ids = ['credential-materializer.corrective-replan.plan-validation-attestation', 'credential-materializer.corrective-replan.expected-human-challenge',
+  'credential-verifier.corrective-replan.human-confirmation', 'credential-materializer.corrective-replan.receipt',
+  'credential-verifier.corrective-replan.receipt', 'credential-materializer.corrective-replan.stored-plan-validation-event',
+  'credential-verifier.corrective-replan.stored-plan-validation-event'] as const;
+export const correctiveReplanCredentialFunctionBindings: readonly CredentialFunctionBinding[] = deepFreeze(ids.map((id, index) => ({ id, version: 1,
+  kind: id.includes('materializer') ? 'materializer' as const : 'verifier' as const, implementationId: `implementation.${id}` as const,
+  implementationVersion: 1, wiring: 'invoked', callable: functions[index]! })));
+function loadCanonicalSnapshot(kernel: KernelRecord, taskId: string): { snapshot: JsonRecord; snapshotBindingHash: string } | Issue {
+  const source = kernel.ports.readSnapshot(taskId); if (!isRecord(source)) return issue('credential.snapshot.missing', '/taskId', 'binding');
+  if (source.bindingManifest !== correctiveReplanBindingManifest) return issue('credential.snapshot.manifest-invalid', '/snapshot/bindingManifest', 'binding');
+  const invalid = snapshotIssue(source, taskId); if (invalid) return invalid;
+  const snapshot = deepFreeze({ ...clone(source), bindingManifest: correctiveReplanBindingManifest });
+  return { snapshot, snapshotBindingHash: hashCanonical(snapshot) };
+}
+function receiptFreshnessIssue(kernel: KernelRecord, plan: PlanRecord): Issue | null {
+  const loaded = loadCanonicalSnapshot(kernel, string(get(plan.binding, '/values/taskId')));
+  if ('issueId' in loaded) return issue('credential.receipt.snapshot-stale', '/snapshotBindingHash', 'binding');
+  if (!same(loaded.snapshot.priorPlanAuthorization, plan.snapshot.priorPlanAuthorization))
+    return issue('credential.receipt.grant-stale', '/snapshot/priorPlanAuthorization/grantHash', 'authority');
+  return loaded.snapshotBindingHash === plan.snapshotBindingHash ? null : issue('credential.receipt.snapshot-stale', '/snapshotBindingHash', 'binding');
+}
+function snapshotIssue(snapshot: JsonRecord, taskId: unknown): Issue | null {
+  if (!exactKeys(snapshot, ['snapshotVersion', 'bindingManifest', 'worktree', 'baseValues', 'validationExpectation', 'priorPlanAuthorization']) || snapshot.snapshotVersion !== 2)
+    return issue('credential.snapshot.invalid', '/snapshot', 'schema');
+  const base = record(snapshot.baseValues); const expected = record(snapshot.validationExpectation);
+  if (base.taskId !== taskId || base.transitionId !== 'task.plan.corrective-replan' || base.capabilityId !== 'capability.task.corrective-replan'
+    || base.capabilityVersion !== 1 || base.lifecycleEpoch !== LIFECYCLE_EPOCH || !canonicalManifestValues(base, false))
+    return issue('credential.snapshot.values-invalid', '/snapshot/baseValues', 'binding');
+  if (!validWorktree(snapshot.worktree, base.gitHead) || !validExpectation(expected) || !exactKeys(snapshot.priorPlanAuthorization, ['grantHash', 'requiredDisposition'])
+    || !hex(record(snapshot.priorPlanAuthorization).grantHash) || record(snapshot.priorPlanAuthorization).requiredDisposition !== 'superseded')
+    return issue('credential.snapshot.invalid', '/snapshot/validationExpectation', 'schema');
+  const pairs: Array<readonly [string, string]> = [['taskId', 'taskId'], ['revision', 'revision'], ['currentPlanHash', 'currentPlanHash'],
+    ['briefHash', 'briefHash'], ['knowledgeRevision', 'knowledgeRevision'], ['knowledgeHash', 'knowledgeHash'], ['gitHead', 'gitHead'],
+    ['guardedStepId', 'guardedStepId'], ['correctiveDecisionHash', 'correctiveDecisionHash'], ['remediationTailHash', 'remediationTailHash']];
+  if (pairs.some(([sourceKey, baseKey]) => get(expected, `/source/${sourceKey}`) !== base[baseKey])
+    || get(expected, '/candidate/planHash') !== base.candidatePlanHash || get(expected, '/candidate/stepSetHash') !== base.candidateStepSetHash
+    || get(expected, '/planAuthor/identityHash') !== base.planAuthorIdentityHash || get(expected, '/validator/identityHash') !== base.planValidatorIdentityHash)
+    return issue('credential.snapshot.cross-link-invalid', '/snapshot/validationExpectation', 'binding');
+  return null;
+}
+function validWorktree(value: unknown, gitHead: unknown): boolean {
+  if (!exactKeys(value, ['kind', 'version', 'gitHead', 'changeSha256', 'entries'])
+    || value.kind !== 'guarded-step-worktree' || value.version !== 1 || value.gitHead !== gitHead
+    || !hex(value.changeSha256) || !Array.isArray(value.entries)) return false;
+  const entries = value.entries as unknown[];
+  if (entries.length > 256) return false;
+  const paths = new Set<string>();
+  for (const candidate of entries) {
+    if (!isRecord(candidate) || typeof candidate.path !== 'string' || paths.has(candidate.path)) return false;
+    paths.add(candidate.path);
+    if (candidate.disposition === 'deleted') {
+      if (!exactKeys(candidate, ['path', 'disposition'])) return false;
+    } else if (candidate.disposition === 'present') {
+      if (!exactKeys(candidate, ['path', 'disposition', 'executable', 'contentSha256'])
+        || typeof candidate.executable !== 'boolean' || !hex(candidate.contentSha256)) return false;
+    } else return false;
+  }
+  return entries.every((entry, index) => index === 0
+    || String((entries[index - 1] as JsonRecord).path).localeCompare(String((entry as JsonRecord).path)) < 0)
+    && value.changeSha256 === hashCanonical({ domain: 'codex-workflow/corrective-replan-worktree/v1', entries });
+}
+function canonicalManifestValues(values: JsonRecord, includePlanValidationHash: boolean): boolean {
+  const rows = (correctiveReplanBindingManifest.rows as readonly JsonRecord[])
+    .filter((row) => includePlanValidationHash || row.bindingId !== 'planValidationHash');
+  if (Object.keys(values).sort().join('\0') !== rows.map((row) => string(row.bindingId)).sort().join('\0')) return false;
+  return rows.every((row) => {
+    const id = string(row.bindingId); const value = values[id];
+    switch (row.canonicalization) {
+      case 'lowercase-hex': return hex(value);
+      case 'safe-nonnegative-integer': return safeTime(value) !== null;
+      case 'nfc-trim': return canonicalId(value);
+      case 'lowercase-git-oid': return typeof value === 'string' && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value);
+      case 'registered-enum': return value === 'delivery-coordinator' || value === 'technical-planner';
+      case 'exact': return value === (id === 'transitionId' ? 'task.plan.corrective-replan' : 'capability.task.corrective-replan');
+      default: return false;
+    }
+  });
+}
+function validExpectation(value: JsonRecord): boolean { return exactKeys(value, ['source', 'candidate', 'requirements', 'acceptance', 'architecture', 'planAuthor', 'plannerContext', 'validator'])
+  && exactKeys(value.source, ['taskId', 'revision', 'currentPlanHash', 'briefHash', 'knowledgeRevision', 'knowledgeHash', 'gitHead', 'guardedStepId', 'correctiveDecisionHash', 'remediationTailHash'])
+  && exactKeys(value.candidate, ['planHash', 'stepSetHash']) && validCoverage(value.requirements) && validCoverage(value.acceptance)
+  && validArchitecture(value.architecture) && validIdentity(value.planAuthor) && validIdentity(value.validator)
+  && validContext(value.plannerContext, true); }
+function exactDraft(value: unknown): boolean { if (!exactKeys(value, ['schemaVersion', 'requirements', 'acceptance', 'architecture', 'validatorContext', 'passed', 'findings', 'dispositions'])) return false;
+  const draft = value as JsonRecord; const findings = array(draft.findings); const dispositions = array(draft.dispositions);
+  return draft.schemaVersion === 1 && draft.passed === true && validCoverage(draft.requirements) && validCoverage(draft.acceptance)
+    && validArchitecture(draft.architecture) && validContext(draft.validatorContext, false) && findings.length <= 128 && dispositions.length <= 128
+    && findings.every(validFinding) && dispositions.every(validDisposition); }
+function validCoverage(value: unknown): boolean { return exactKeys(value, ['sourceHash', 'coverageHash', 'passed']) && hex(value.sourceHash) && hex(value.coverageHash) && value.passed === true; }
+function validArchitecture(value: unknown): boolean { return exactKeys(value, ['sourceHash', 'compatibilityHash', 'passed']) && hex(value.sourceHash) && hex(value.compatibilityHash) && value.passed === true; }
+function validIdentity(value: unknown): boolean { return exactKeys(value, ['identityHash']) && hex(value.identityHash); }
+function validContext(value: unknown, captured: boolean): boolean { return exactKeys(value, captured ? ['contextHash', 'capturedAtMs'] : ['contextHash']) && hex(value.contextHash) && (!captured || safeTime(value.capturedAtMs) !== null); }
+function validFinding(value: unknown): boolean { return exactKeys(value, ['findingId', 'severity', 'requirementRef', 'evidenceHash']) && canonicalId(value.findingId) && canonicalId(value.requirementRef) && ['low', 'medium', 'high'].includes(string(value.severity)) && hex(value.evidenceHash); }
+function validDisposition(value: unknown): boolean { return exactKeys(value, ['findingId', 'decision', 'evidenceHash']) && canonicalId(value.findingId) && ['resolved', 'accepted-documented-limitation'].includes(string(value.decision)) && hex(value.evidenceHash); }
+function keyedBijection(findings: unknown[], dispositions: unknown[]): boolean { const findingIds = findings.map((entry) => string(record(entry).findingId));
+  const dispositionIds = dispositions.map((entry) => string(record(entry).findingId)); return findingIds.length === dispositions.length
+    && findingIds.every(Boolean) && new Set(findingIds).size === findingIds.length && new Set(dispositionIds).size === dispositionIds.length
+    && [...findingIds].sort().join('\0') === [...dispositionIds].sort().join('\0'); }
+function sortRows(rows: unknown[]) { return rows.map(clone).sort((a, b) => { const left = string(record(a).findingId); const right = string(record(b).findingId); return left < right ? -1 : left > right ? 1 : 0; }); }
+function schema(id: string, value: unknown): boolean { return correctiveReplanCredentialSchemaValidators.find((entry) => entry.id === id)?.callable(value) === true; }
+function accepted<T extends JsonRecord>(value: T): Result<T> { return deepFreeze({ ok: true, value: deepFreeze(value), issues: [] }); }
+function rejected(issueId: string, path: string, reasonClass: Reason): Result<never> { const issues = [issue(issueId, path, reasonClass)]; return deepFreeze({ ok: false, value: null, issues, reportHash: hashCanonical(issues) }); }
+function verified<T extends JsonRecord>(projection: T): Verification<T> { const content = { valid: true as const, projection: deepFreeze(projection), issues: [] as const }; return deepFreeze({ ...content, reportHash: hashCanonical(content) }); }
+function verificationRejected(issueId: string, path: string, reasonClass: Reason): Verification<never> { const issues = [issue(issueId, path, reasonClass)]; return deepFreeze({ valid: false, projection: null, issues, reportHash: hashCanonical(issues) }); }
+function issue(issueId: string, path: string, reasonClass: Reason): Issue { return { issueId, path, reasonClass }; }
+function totalResult(invoke: () => Result<JsonRecord>): Result<JsonRecord> { try { return invoke(); } catch { return rejected('credential.operation.malformed', '/', 'schema'); } }
+function totalVerification(invoke: () => Verification<JsonRecord>): Verification<JsonRecord> { try { return invoke(); } catch { return verificationRejected('credential.operation.malformed', '/', 'schema'); } }
+function activePreparation(kernel: KernelRecord, plan: PlanRecord): boolean { const current = kernel.preparations.get(plan.preparationKey); return current?.status === 'active' && current.generation === plan.generation; }
+function exactKeys(value: unknown, keys: readonly string[]): value is JsonRecord { return isRecord(value) && Object.keys(value).sort().join('\0') === [...keys].sort().join('\0'); }
+function isRecord(value: unknown): value is JsonRecord { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function copyOwnedJson(value: unknown, budget = { nodes: 0, bytes: 0, active: new Set<object>() }, depth = 0): unknown {
+  if (++budget.nodes > 4096 || (budget.bytes += 8) > 262_144 || depth > 32) return LIMIT;
+  if (typeof value === 'string') { budget.bytes += Buffer.byteLength(value, 'utf8'); return budget.bytes > 262_144 ? LIMIT : value; } if (value === null || typeof value === 'boolean') return value;
+  if (typeof value === 'number') return Number.isSafeInteger(value) ? value : MALFORMED; if (typeof value !== 'object' || utilTypes.isProxy(value) || budget.active.has(value)) return MALFORMED;
+  const arrayValue = Array.isArray(value); const prototype = Object.getPrototypeOf(value); if (prototype !== (arrayValue ? Array.prototype : Object.prototype) && prototype !== null) return MALFORMED;
+  const keys = Reflect.ownKeys(value); if (keys.some((key) => typeof key !== 'string')) return MALFORMED; const names = (keys as string[]).filter((key) => !arrayValue || key !== 'length'); const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (arrayValue && (names.length !== value.length || names.some((key, index) => key !== String(index)))) return MALFORMED; const result: JsonRecord | unknown[] = arrayValue ? [] : Object.create(null); budget.active.add(value);
+  for (const key of names) { const descriptor = descriptors[key]; budget.bytes += Buffer.byteLength(key, 'utf8'); if (budget.bytes > 262_144) return LIMIT; if (!descriptor?.enumerable || !('value' in descriptor)) return MALFORMED;
+    const child = copyOwnedJson(descriptor.value, budget, depth + 1); if (child === LIMIT || child === MALFORMED) return child; (result as JsonRecord)[key] = child; }
+  budget.active.delete(value); return result;
+}
+function record(value: unknown): JsonRecord { return isRecord(value) ? value : {}; }
+function object(value: unknown): object { return value !== null && typeof value === 'object' ? value : Object.freeze(Object.create(null)) as object; }
+function opaque(): object { return Object.freeze(Object.create(null)) as object; }
+function array(value: unknown): unknown[] { return Array.isArray(value) ? value : []; }
+function string(value: unknown): string { return typeof value === 'string' ? value : ''; }
+function number(value: unknown): number { return typeof value === 'number' ? value : Number.NaN; }
+function safeTime(value: unknown): number | null { return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= MAX_SAFE ? value : null; }
+function safeId(value: unknown): string { return canonicalId(value) ? value : ''; }
+function canonicalId(value: unknown): value is string { return typeof value === 'string' && value.length > 0 && value.length <= 256 && value === value.trim() && value === value.normalize('NFC'); }
+function hex(value: unknown): value is string { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
+function get(value: unknown, path: string): unknown { return path.split('/').filter(Boolean).reduce((cursor: unknown, key) => isRecord(cursor) ? cursor[key] : undefined, value); }
+function same(left: unknown, right: unknown): boolean { try { return hashCanonical(left) === hashCanonical(right); } catch { return false; } }
+function authorityPassed(id: string, input: unknown): boolean {
+  const binding = installedAuthoritySemanticBindings.find((entry) => entry.id === id);
+  return binding !== undefined && record(binding.callable(input)).passed === true;
+}
+function clone<T>(value: T): T { return structuredClone(value); }
+function sha(value: string): string { return createHash('sha256').update(value).digest('hex'); }

package/src/lifecycle/corrective-replan-credential-schema.ts

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { hashCanonical } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+
+export const credentialSchemaIds = [
+  'schema.corrective-replan-binding', 'schema.corrective-replan-plan-validation-attestation',
+  'schema.corrective-replan-human-confirmation-input', 'schema.corrective-replan-receipt',
+  'schema.corrective-replan-stored-plan-validation-event',
+] as const;
+const names = ['correctiveReplanBindingV1', 'planValidationAttestationV1', 'humanConfirmationInputV1',
+  'correctiveReplanReceiptV1', 'storedPlanValidationEventV1'] as const;
+const bytes = readFileSync(new URL('../../../schemas/corrective-replan-credentials.private.schema.json', import.meta.url));
+const document = JSON.parse(bytes.toString('utf8')) as { $id: string; $defs: Record<string, unknown> };
+const ajv = new Ajv2020({
+  allErrors: true,
+  strict: true,
+  formats: {
+    'date-time': {
+      type: 'string',
+      validate(value: string) {
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+      },
+    },
+  },
+});
+if (!ajv.validateSchema(document)) throw new TypeError(`Invalid private credential schema: ${ajv.errorsText(ajv.errors)}`);
+ajv.addSchema(document, document.$id);
+const documentSha256 = createHash('sha256').update(bytes).digest('hex');
+
+export interface CredentialSchemaArtifact {
+  readonly id: typeof credentialSchemaIds[number]; readonly version: 1;
+  readonly implementationId: `implementation.${string}`; readonly implementationVersion: 1;
+  readonly documentBytesSha256: string; readonly schemaPointer: string; readonly subschemaCanonicalSha256: string;
+  readonly document: unknown;
+}
+export interface CredentialSchemaValidator extends Omit<CredentialSchemaArtifact, 'document' | 'documentBytesSha256' | 'schemaPointer'> {
+  readonly artifactDocumentBytesSha256: string; readonly callable: (payload: unknown) => boolean;
+}
+
+const artifacts = credentialSchemaIds.map((id, index) => ({ id, version: 1 as const,
+  implementationId: `implementation.schema-artifact.${names[index]}` as const, implementationVersion: 1 as const,
+  documentBytesSha256: documentSha256, schemaPointer: `#/$defs/${names[index]}`, subschemaCanonicalSha256: hashCanonical(document.$defs[names[index]!]), document }));
+const validators = artifacts.map((artifact, index) => {
+  const validate = ajv.compile({ $ref: `${document.$id}#/$defs/${names[index]}` });
+  return { id: artifact.id, version: 1 as const,
+    implementationId: `implementation.schema-validator.ajv-draft-2020-12.${names[index]}` as const,
+    implementationVersion: 1 as const, artifactDocumentBytesSha256: documentSha256,
+    subschemaCanonicalSha256: artifact.subschemaCanonicalSha256, callable: (payload: unknown) => validate(payload) === true };
+});
+export const correctiveReplanCredentialSchemaArtifacts: readonly CredentialSchemaArtifact[] = deepFreeze(artifacts);
+export const correctiveReplanCredentialSchemaValidators: readonly CredentialSchemaValidator[] = deepFreeze(validators);

package/src/lifecycle/corrective-replan-credentials.ts

@@ -0,0 +1,48 @@
+import { types as utilTypes } from 'node:util';
+import { correctiveReplanBindingManifest } from './corrective-replan-binding-manifest.js';
+import { correctiveReplanCredentialFunctionBindings } from './corrective-replan-credential-core.js';
+import { correctiveReplanCredentialSchemaArtifacts, correctiveReplanCredentialSchemaValidators } from './corrective-replan-credential-schema.js';
+import { hashCanonical } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+
+const executionLinkage = deepFreeze({ status: 'active' as const, transitionId: 'task.plan.corrective-replan' as const }); const kernelDescriptor = deepFreeze({ id: 'credential-kernel.corrective-replan', version: 1 as const, wiring: 'invoked' as const,
+  buildSha256: hashCanonical({ family: 'corrective-replan', kernelVersion: 1, manifestSha256: correctiveReplanBindingManifest.manifestSha256,
+    functions: correctiveReplanCredentialFunctionBindings.map(({ id, version, implementationId, implementationVersion }) => ({ id, version, implementationId, implementationVersion })) }) });
+type ClosureIssue = { issueId: string; path: string; ref?: string; message: string };
+type Candidate = { original: object; index: number; id: string; version: number; callable?: unknown };
+
+export function diagnoseCorrectiveReplanCredentialClosure(input: unknown = undefined) { try {
+  const issues: ClosureIssue[] = []; const allowed = ['authorityBindingManifest', 'schemaArtifacts', 'schemaValidators', 'functionBindings'];
+  let source = top(input); if (!source || Object.keys(source).some((key) => !allowed.includes(key))) { issues.push(problem('credential.closure.input-invalid', '/', 'closure-input')); source = {}; }
+  const artifacts = collection(source.schemaArtifacts, correctiveReplanCredentialSchemaArtifacts); if (!artifacts) issues.push(problem('credential.closure.collection-invalid', '/schemaArtifacts', 'schemaArtifacts'));
+  const validators = collection(source.schemaValidators, correctiveReplanCredentialSchemaValidators); if (!validators) issues.push(problem('credential.closure.collection-invalid', '/schemaValidators', 'schemaValidators'));
+  const functions = collection(source.functionBindings, correctiveReplanCredentialFunctionBindings); if (!functions) issues.push(problem('credential.closure.collection-invalid', '/functionBindings', 'functionBindings'));
+  if ((source.authorityBindingManifest ?? correctiveReplanBindingManifest) !== correctiveReplanBindingManifest) issues.push(problem('credential.manifest.substituted', '/authorityBindingManifest', correctiveReplanBindingManifest.id));
+  exact(correctiveReplanCredentialSchemaArtifacts, artifacts ?? [], 'schemaArtifacts', 'credential.schema-artifact', false, issues);
+  exact(correctiveReplanCredentialSchemaValidators, validators ?? [], 'schemaValidators', 'credential.schema-validator', true, issues);
+  exact(correctiveReplanCredentialFunctionBindings, functions ?? [], 'functionBindings', 'credential.function', true, issues); return finish(issues);
+  } catch { return finish([problem('credential.closure.input-invalid', '/', 'closure-input')]); } }
+
+function finish(issues: ClosureIssue[]) { const ordered = issues.sort((a, b) => { const left = `${a.path}\0${a.issueId}`; const right = `${b.path}\0${b.issueId}`; return left < right ? -1 : left > right ? 1 : 0; });
+  const projection = { manifestSha256: correctiveReplanBindingManifest.manifestSha256, artifacts: correctiveReplanCredentialSchemaArtifacts.map(project), validators: correctiveReplanCredentialSchemaValidators.map(project), functions: correctiveReplanCredentialFunctionBindings.map(project), pendingBlockers: [] };
+  return deepFreeze({ closed: ordered.length === 0, issues: ordered, manifestSha256: correctiveReplanBindingManifest.manifestSha256, closureSha256: hashCanonical(projection), pendingBlockers: [] }); }
+function top(input: unknown): Record<string, unknown> | null { if (input === undefined) return {}; if (!plain(input)) return null;
+  const keys = Reflect.ownKeys(input); if (keys.some((key) => typeof key !== 'string')) return null; const descriptors = Object.getOwnPropertyDescriptors(input); const result: Record<string, unknown> = Object.create(null);
+  for (const key of keys as string[]) { const descriptor = descriptors[key]; if (!descriptor?.enumerable || !('value' in descriptor)) return null; result[key] = descriptor.value; } return result; }
+function collection(value: unknown, installed: readonly { id: string; version: number; callable?: unknown }[]): Candidate[] | null { if (value === undefined) return installed.map(view);
+  if (utilTypes.isProxy(value) || !Array.isArray(value) || value.length > 16) return null; const keys = Reflect.ownKeys(value); const descriptors = Object.getOwnPropertyDescriptors(value);
+  const names = keys.filter((key) => key !== 'length'); if (names.some((key, index) => typeof key !== 'string' || key !== String(index)) || names.length !== value.length) return null; const result: Candidate[] = [];
+  for (const key of names as string[]) { const cell = descriptors[key]; if (!cell?.enumerable || !('value' in cell) || !plain(cell.value)) return null; const row = Object.getOwnPropertyDescriptors(cell.value);
+    if (Reflect.ownKeys(cell.value).some((name) => typeof name !== 'string' || !row[name]?.enumerable || !('value' in row[name]!)) || typeof row.id?.value !== 'string' || !row.id.value.includes('.') || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/.test(row.id.value) || typeof row.version?.value !== 'number') return null;
+    result.push({ original: cell.value, index: Number(key), id: row.id.value, version: row.version.value, callable: row.callable?.value }); } return result; }
+function exact<T extends { id: string; version: number; callable?: unknown }>(installed: readonly T[], candidate: Candidate[], collectionName: string, prefix: string, callable: boolean, issues: ClosureIssue[]) { for (const expected of installed) { const matches = candidate.filter((entry) => entry.id === expected.id && entry.version === expected.version);
+  if (matches.length !== 1) issues.push(problem(`${prefix}.${matches.length ? 'duplicate' : 'missing'}`, `/${prefix}/${expected.id}`, expected.id)); else if (matches[0]!.original !== expected || (callable && matches[0]!.callable !== expected.callable)) issues.push(problem(`${prefix}.${callable ? 'callable-substituted' : 'substituted'}`, `/${prefix}/${expected.id}`, expected.id)); }
+  candidate.filter((entry) => !installed.some((expected) => expected.id === entry.id && expected.version === entry.version)).forEach((entry) => issues.push({ issueId: `${prefix}.extra`, path: `/${collectionName}/${entry.index}`, ref: 'closure-extra-row', message: 'Candidate row is not installed.' })); }
+function view(entry: { id: string; version: number; callable?: unknown }, index: number): Candidate { return { original: entry, index, id: entry.id, version: entry.version, callable: entry.callable }; }
+function problem(issueId: string, path: string, ref: string): ClosureIssue { return { issueId, path, ref, message: `${ref} is not the installed exact identity.` }; }
+function project(entry: object) { const { callable: _callable, document: _document, ...value } = entry as Record<string, unknown>; return value; }
+function plain(value: unknown): value is object { if (value === null || typeof value !== 'object' || Array.isArray(value) || utilTypes.isProxy(value)) return false; const prototype = Object.getPrototypeOf(value); return prototype === Object.prototype || prototype === null; }
+
+export const correctiveReplanCredentialInspection = deepFreeze({ authorityBindingManifest: correctiveReplanBindingManifest, executionLinkage, kernelDescriptor,
+  schemaArtifacts: correctiveReplanCredentialSchemaArtifacts, schemaValidators: correctiveReplanCredentialSchemaValidators,
+  functionBindings: correctiveReplanCredentialFunctionBindings, diagnoseClosure: diagnoseCorrectiveReplanCredentialClosure });