coding-artifact-evaluation-shell 0.0.0-stage → 0.1.0-eidolon.a1a6ca75ec65e

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "coding-artifact-evaluation-shell",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-eidolon.a1a6ca75ec65e",
+  "private": false,
+  "type": "module",
+  "description": "Code-development artifact evaluator and code-first Halfcode SkillApp",
+  "exports": {
+    ".": "./index.ts",
+    "./run": "./capsule.ts",
+    "./evidence": "./support/evidence-catalog.ts",
+    "./app": "./app/app.ts"
+  },
+  "files": [
+    "*.ts",
+    "*.md",
+    "*.xnl",
+    "bun.lock",
+    "app",
+    "support",
+    "resources",
+    "adapter"
+  ],
+  "dependencies": {
+    "halfcode-lite-skill-app-contract": "0.2.2"
+  },
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.com/"
+  }
+}

package/proposal.ts

@@ -0,0 +1,94 @@
+import { POLICY, type Diagnostic, type EvaluationInput, type Proposal } from './contract';
+import {referenceEvidence,resolveObservation} from './native-references';
+import {JudgeProtocolError} from './protocol-error';
+export {JudgeProtocolError} from './protocol-error';
+
+/** Transport decoding only. Native facts and official decisions are never imported. */
+export function decodeProposal(value: unknown, input: EvaluationInput): Proposal {
+  if (!value || typeof value !== 'object') throw new JudgeProtocolError('Judge output must be a JSON object');
+  const data = value as Record<string, unknown>;
+  if(data.format==='compact-v1'||data.format==='compact-v2')return expandCompact(data,input);
+  if (Array.isArray(data.obligations) && Array.isArray(data.claims)) return data as unknown as Proposal;
+  const nested = data.proposal as Proposal | undefined;
+  if (data.schemaVersion === 1 && data.policyVersion === POLICY && data.runId === input.runId &&
+      data.artifactDigest === input.artifactDigest && nested && data.judgment === nested.judgment &&
+      Array.isArray(nested.obligations) && Array.isArray(nested.claims)) return nested;
+  throw new JudgeProtocolError('Unexpected Proposal envelope or mismatched identity/verdict');
+}
+
+/** Transport expansion only: no new expectation, reasoning, verdict or evidence. */
+function expandCompact(data:Record<string,unknown>,input:EvaluationInput):Proposal {
+  const native=data.format==='compact-v2';
+  const noncertifying=native&&(data.judgment==='fail'||data.judgment==='indeterminate');
+  // This default records lack of a submitted review, never completeness or support.
+  if(noncertifying&&data.sourceReviews===undefined)data={...data,sourceReviews:[]};
+  if(Object.keys(data).some(key=>!['format','judgment','obligations','claims','findings','sourceReviews','needReviews'].includes(key))||!Array.isArray(data.obligations)||!Array.isArray(data.claims)||!Array.isArray(data.findings)||!Array.isArray(data.sourceReviews))throw new JudgeProtocolError('Malformed compact Proposal');
+  const obligations=(data.obligations as (Proposal['obligations'][number]&{needRef?:unknown})[]).map(o=>{
+    if(native&&o?.needRef!==undefined){
+      const need=input.needs?.find(n=>n.needId===o.needRef);
+      if(!need)throw new JudgeProtocolError('Unknown native needRef');
+      if(o.sourceId!==undefined&&o.sourceId!==need.sourceId||o.expectation!==undefined&&o.expectation!==need.expectation||o.quote!==undefined&&o.quote!==need.quote)throw new JudgeProtocolError('needRef cannot override the retained source/expectation/quote');
+      const {needRef:_needRef,...fields}=o;
+      return {...fields,sourceId:need.sourceId,expectation:need.expectation,quote:need.quote};
+    }
+    if(!native||o?.quote!==undefined)return o;
+    const source=input.sources.find(s=>s.id===o?.sourceId);
+    if(!source)throw new JudgeProtocolError('Unknown obligation sourceId');
+    return {...o,quote:source.content};
+  });
+  const claims=data.claims.map((value:unknown)=>{
+    if(!value||typeof value!=='object'||Array.isArray(value))throw new JudgeProtocolError('Malformed compact claim');
+    const c={...value as Record<string,any>};
+    if(native&&c.judgment==='indeterminate'&&c.evidence===undefined)c.evidence=[];
+    if(Object.keys(c).some(key=>!['obligationId','judgment','reasoning','limitations','evidence','preconditions'].includes(key))||!Array.isArray(c.evidence))throw new JudgeProtocolError('Compact claim must not override owner-derived fields');
+    const matches=obligations.filter(o=>o?.id===c.obligationId);
+    if(matches.length!==1)throw new JudgeProtocolError('Compact claim needs one unambiguous obligation');
+    const evidence=native?c.evidence.map((e:unknown)=>referenceEvidence(input,e)):c.evidence;
+    const facts=evidence.map((e:any)=>input.observations.find(o=>o.id===e?.observationId)).filter((o):o is EvaluationInput['observations'][number]=>!!o);
+    const preconditions=native&&c.preconditions?{...c.preconditions,evidenceIds:c.preconditions.evidenceIds?.map((ref:unknown)=>resolveObservation(input,ref).id)}:c.preconditions;
+    // Explicit v2 default reuses only the model's own comparisons. It neither
+    // infers support from authentic bytes nor changes any selected judgment.
+    const reasoning=native&&c.reasoning===undefined?evidence.map((e:any)=>e.supports).join('; '):c.reasoning;
+    return {...c,evidence,reasoning,...(preconditions?{preconditions}:{}),semanticExpectation:matches[0]!.expectation,method:[...new Set(facts.map(o=>o.method))].join('; ')||'No native delivery evidence',conditions:[...new Set(facts.map(o=>o.conditions))].join('; ')||'No observed conditions',limitations:c.limitations??[]} as Proposal['claims'][number];
+  });
+  const sourceReviews=data.sourceReviews.map((value:unknown)=>{
+    if(!value||typeof value!=='object'||Array.isArray(value))throw new JudgeProtocolError('Malformed compact source review');
+    const review=value as Record<string,unknown>;
+    if(Object.keys(review).some(key=>!['sourceId','complete','omissions','ambiguities'].includes(key)))throw new JudgeProtocolError('Unexpected compact source review field');
+    return {...review,omissions:review.omissions??[],ambiguities:review.ambiguities??[]} as Proposal['sourceReviews'][number];
+  });
+  if(noncertifying)for(const source of input.sources){
+    if(source.authority!=='inferred'&&!sourceReviews.some(r=>r.sourceId===source.id))sourceReviews.push({sourceId:source.id,complete:false,omissions:['No complete source review submitted.'],ambiguities:[]});
+  }
+  let needReviews=data.needReviews as Proposal['needReviews'];
+  if(noncertifying&&(needReviews===undefined||Array.isArray(needReviews))){
+    needReviews=[...(needReviews??[])];
+    for(const need of input.needs??[])if(!needReviews.some(r=>r?.needId===need.needId))needReviews.push({needId:need.needId,disposition:'unresolved',obligationIds:[],reasoning:'No disposition submitted; retained as unresolved.'});
+  }
+  return {judgment:data.judgment as Proposal['judgment'],obligations,claims,findings:data.findings as Proposal['findings'],sourceReviews,...(needReviews!==undefined?{needReviews}: {})};
+}
+
+/** A restricted delta: the model cannot rewrite business semantics during repair. */
+export function decodeEvidenceRepair(value:unknown,repair:{proposal:Proposal;diagnostics:Diagnostic[]}):Proposal {
+  if(!value||typeof value!=='object'||Array.isArray(value))throw new JudgeProtocolError('Expected evidence-only repair patches');
+  const data=value as Record<string,unknown>;
+  if(Object.keys(data).length!==1||!Array.isArray(data.evidencePatches)||!data.evidencePatches.length)throw new JudgeProtocolError('Only evidencePatches are accepted');
+  const proposal=structuredClone(repair.proposal),seen=new Set<string>();
+  const locations=new Set(repair.diagnostics.filter(d=>d.repairable).map(d=>d.location));
+  for(const patch of data.evidencePatches) {
+    if(!patch||typeof patch!=='object'||Array.isArray(patch)||Object.keys(patch).some(k=>!['claimIndex','evidenceIndex','observationId','excerpt'].includes(k)))throw new JudgeProtocolError('Repair contains forbidden fields');
+    const {claimIndex,evidenceIndex,observationId,excerpt}=patch;
+    const location=`claims[${claimIndex}].evidence[${evidenceIndex}]`;
+    const evidence=proposal.claims[claimIndex]?.evidence[evidenceIndex];
+    if(!Number.isSafeInteger(claimIndex)||claimIndex<0||!Number.isSafeInteger(evidenceIndex)||evidenceIndex<0||!evidence||!locations.has(location)||seen.has(location))throw new JudgeProtocolError('Repair must target one diagnosed evidence slot');
+    if(observationId===undefined&&excerpt===undefined)throw new JudgeProtocolError('Empty evidence patch');
+    if(observationId!==undefined&&(typeof observationId!=='string'||!observationId.trim())||excerpt!==undefined&&(typeof excerpt!=='string'||!excerpt.trim()))throw new JudgeProtocolError('Evidence patch fields must be strings');
+    if(observationId!==undefined)evidence.observationId=observationId;
+    if(excerpt!==undefined)evidence.excerpt=excerpt;
+    seen.add(location);
+  }
+  return proposal;
+}
+
+export const EVIDENCE_REPAIR_GUIDANCE = `Repair only the diagnosed native evidence representation in the frozen Proposal. Do not implement, run business operations, delegate, or alter any judgment, obligation, source review, finding, expectation, reasoning, support explanation, or limitations. Read the supplied immutable input and diagnostics. Return ONLY {"evidencePatches":[{"claimIndex":0,"evidenceIndex":0,"observationId":"native-id","excerpt":"literal native content"}]} with real zero-based indices at diagnosed slots. observationId and excerpt are optional individually; at least one is required per patch. excerpt must be copied verbatim from that Observation.content, not JSON metadata. Do not repeat the full Proposal or include any other fields. The owner applies these patches while preserving all business fields, then independently re-admits them.`;
+

package/protocol-error.ts

@@ -0,0 +1 @@
+export class JudgeProtocolError extends Error {}

package/replay.ts

@@ -0,0 +1,39 @@
+#!/usr/bin/env bun
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { evaluate, defaultConfig } from './logic';
+import type { Decision, EvaluationInput, Judgment } from './contract';
+import { decodeProposal } from './proposal';
+import { loadCalibrationHistory } from './calibration-history';
+import { calibrationReport } from './calibration-report';
+import { createEvaluationRun, digest, fingerprint } from './support/isolation';
+
+const [source,output]=process.argv.slice(2);
+if(!source||!output)throw Error('Usage: bun evaluation/replay.ts <failed-calibration-root> <NEW-/tmp/depa-codument-eval-root>');
+const prior=loadCalibrationHistory(source);
+const samples=fs.readFileSync(path.join(source,'samples.jsonl'),'utf8').trim().split('\n').filter(Boolean).map(s=>JSON.parse(s) as {id:string;expected:Judgment;expectedLeaves?:{obligationId:string;judgment:Judgment}[];runId:string});
+const ownRuns=fs.readdirSync(path.join(source,'runs')).map(slot=>({slot,root:path.join(source,'runs',slot)})).filter(r=>fs.existsSync(path.join(r.root,'decision.json')));
+// Reuse the ownership/path guard; no observation or model capability is opened.
+const run=createEvaluationRun(output,path.join(source,'assets'));
+const results=[];
+for(const sample of samples) {
+  const original=ownRuns.find(r=>JSON.parse(fs.readFileSync(path.join(r.root,'decision.json'),'utf8')).runId===sample.runId);
+  if(!original)throw Error('Missing original sample');
+  const originalFile=path.join(original.root,'decision.json'),before=fs.readFileSync(originalFile,'utf8'),decision=JSON.parse(before) as Decision;
+  const invocation=decision.invocations.find(i=>i.phase==='judgment'&&i.completed);
+  if(!invocation)throw Error('Cannot replay without a completed native judgment');
+  const inputFile=path.join(original.root,'input',`${invocation.id}.json`),rawInput=fs.readFileSync(inputFile,'utf8'),input=JSON.parse(rawInput) as EvaluationInput;
+  const rawFile=path.join(original.root,'home','tmp',`${invocation.id}.json`),raw=fs.readFileSync(rawFile,'utf8');
+  if(input.runId!==decision.runId || input.artifactDigest!==decision.artifactDigest || JSON.stringify(input.observations)!==JSON.stringify(decision.observations))throw Error('Native input/decision drift');
+  if(fingerprint(path.join(source,'assets',original.slot))!==input.artifactDigest || input.sources.some(s=>digest(fs.readFileSync(s.path))!==s.digest))throw Error('Frozen source/artifact drift');
+  const decoded=decodeProposal(JSON.parse(raw.trim().replace(/^```(?:json)?\s*|\s*```$/g,'')),input);
+  const replayed=await evaluate({judge:{invocations:()=>decision.invocations,judge:async(_input,repair)=>{if(repair)throw Error('Replay cannot invoke a model or invent repaired evidence');return decoded;}},record:event=>fs.appendFileSync(path.join(run.root,'ledger.jsonl'),JSON.stringify(event)+'\n')},input,{...defaultConfig,includeCommitments:(input as EvaluationInput & {policy?:{includeCommitments:boolean}}).policy?.includeCommitments??false});
+  const evidence={sourceDecision:{path:originalFile,digest:digest(before)},sourceInput:{path:inputFile,digest:digest(rawInput)},nativeModelOutput:{path:rawFile,digest:digest(raw)},transportDecoder:'Proposal-envelope/v1',additionalModelCalls:0};
+  fs.appendFileSync(path.join(run.root,'ledger.jsonl'),JSON.stringify({replay:replayed,evidence})+'\n');
+  results.push({id:sample.id,expected:sample.expected,expectedLeaves:sample.expectedLeaves,decision:replayed});
+}
+for(const file of prior.files)if(digest(fs.readFileSync(file.path))!==file.digest)throw Error('Historical calibration changed');
+const replaced=new Set(results.map(r=>r.decision.runId)),history=prior.decisions.filter(d=>!replaced.has(d.runId));
+const report={schemaVersion:1,profile:'judge-calibration-replay',sourceCalibration:prior.files.at(-1),additionalModelCalls:0,...calibrationReport(results,history,prior.budget,false,Date.now()),limitations:['Read-only decoding of existing native model outputs; not a new model experiment','Semantic expectations/verdicts/evidence/gold are unchanged','Unknown original launch costs remain unknown']};
+fs.writeFileSync(path.join(run.root,'calibration.json'),JSON.stringify(report,null,2)+'\n',{flag:'wx'});
+console.log(JSON.stringify(report,null,2));process.exit(report.status==='passed'?0:1);

package/representation.ts

@@ -0,0 +1,24 @@
+/** A literal evidence excerpt, never a test of semantic adequacy. */
+export function excerptDiagnostic(content:string,excerpt:unknown,location:string) {
+  return typeof excerpt==='string'&&excerpt.trim()&&content.includes(excerpt)?null:{rule:'native-excerpt',location,message:'Evidence excerpt is not a literal part of the native observation',repairable:true};
+}
+
+/** Object key ordering is transport representation, not business semantics. */
+export function canonicalIdentity(value:unknown):string {
+  function normalize(item:unknown):unknown {
+    if(Array.isArray(item))return item.map(normalize);
+    if(item && typeof item==='object')return Object.fromEntries(Object.entries(item).sort(([a],[b])=>a.localeCompare(b)).map(([key,entry])=>[key,normalize(entry)]));
+    return item;
+  }
+  return JSON.stringify(normalize(value))??'undefined';
+}
+/** Common one-repair controller, with caller-owned semantic identity and error classification. */
+export async function repairOnce<T>(runtime:{admit(value:T):void;repair(value:T,diagnostic:string):Promise<T>;identity(value:T):string;repairable(error:unknown):boolean;record(event:unknown):void},input:T):Promise<T> {
+  try{runtime.admit(input);return input;}catch(error){
+    if(!runtime.repairable(error))throw error;
+    const identity=runtime.identity(input);runtime.record({phase:'protocol-repair',round:1,diagnostic:String(error)});
+    const repaired=await runtime.repair(input,String(error));
+    if(runtime.identity(repaired)!==identity)throw Error('Protocol repair changed business judgement, coverage or expectations');
+    runtime.admit(repaired);runtime.record({phase:'protocol-repair-completed',round:1});return repaired;
+  }
+}

package/resources/counter-review.md

@@ -0,0 +1,16 @@
+---
+envelopeVersion: halfcode.resource-envelope/v1
+specVersion: 1
+kind: SOP
+metadata:
+  fqn: ArtifactEvaluation.SOP.CounterReview
+spec:
+  profile: freeform
+  description: Experimental independent counter-review within the original evaluation budget
+---
+
+Independently challenge the candidate. For PASS, inspect original material conditions left unsupported or contradicted. For FAIL, check whether its witness contradicts an applicable original requirement under actual conditions, not an added assumption. Do not manufacture disagreement. WholeSource/wholeObject in the candidate replace only exact duplicate full bodies: follow sourceId/observationRef to the complete native object. All other candidate choices are verbatim. Read the candidate object once; no prior sessions or scores.
+
+Capabilities are closed. No collection, business actions or delegation. Return one concise JSON object: {"disposition":"uphold"|"challenge"|"unresolved","reason":"source/fact-grounded explanation","sourceIds":["original-source-id"],"observationRefs":["obs:N"]}. Uphold preserves the candidate; challenge/unresolved without a replacement yields indeterminate, NEVER automatic opposite judgment. For an upheld PASS include all authoritative sources. Missing facts are not failed behavior.
+
+Only if you find a concrete applicable business contradiction, you MAY add replacement containing an existing compact-v2 FAIL Proposal. Its minimal witness must pass the SAME admission, preserving caller obligations/needs and full-source review limits; do not fabricate a PASS or rewrite the candidate. Read {{replacementGuide}} only if needed for this optional replacement. No checker or duplicated scorecard is needed for the ordinary four-field review. Leave time to return within the original deadline.

package/resources/evaluate.md

@@ -0,0 +1,34 @@
+---
+envelopeVersion: halfcode.resource-envelope/v1
+specVersion: 1
+kind: SOP
+metadata:
+  fqn: ArtifactEvaluation.SOP.Evaluate
+spec:
+  profile: freeform
+  description: Assess frozen code-development artifacts using owned native observations and independent judgment
+---
+
+# Evaluate a frozen coding delivery
+
+Read the runner procedure in [SOP.md](../SOP.md), including isolation and capability preparation. Read [AGENTS.md](../AGENTS.md) as evaluator policy, not as application instructions.
+
+Inputs are complete original coding requirements, unchanged delivered code, trusted capability declarations and a new output root. The current public entry is `runCodingEvaluation` from `coding-artifact-evaluation-shell/run`, with an explicit codingScope and new retainTo directory. The CLI uses `bun cli.ts evaluate /absolute/manifest.json /absolute/new-output --scope-file=/absolute/coding-scope.json --retain-to=/absolute/new-archive`. Use `--no-model` only for infrastructure smoke; it cannot certify code correctness. The lower-level runEvaluation and historical artifact-evaluation/v1 / ArtifactEvaluation.* identities remain compatible; never rewrite old records. This evaluator does not assess arbitrary non-code business or research tasks.
+
+For an explicitly selected model/runtime experiment, the same package entry exports `createCodexRuntime` and `EvaluationOptions`. Trusted callers may pass pinned `agentRuntime`/`judgeRuntime` dependencies; never derive them from application files. Pin the same actual CLI when comparing models, retain its version/digest and native per-turn identities, and keep the original finite budget. Defaults are unchanged. Different model settings are not additional evaluator roles. A current run cannot prove a missing historical event; missing collection is not an observed business failure.
+
+Collect facts through the runner's owned process/HTTP/browser/file capabilities. Review them against the originals, request material missing evidence while the leases remain open, then submit independent judgments. Keep actual deadlines, model usage, failures and indeterminate outcomes. Do not edit historical applications, infer process execution from source declarations, or turn infrastructure failures into business defects.
+
+The dynamic Evidence, Check and Groups LocalFunctions are read-only tools over explicit input paths. They do not grant execution rights, write verdicts or approve model budgets. Automated isolated model turns use the same implementation compiled into their owned scratch, not a generic host with broader permissions.
+
+For grouped results, the caller explicitly supplies `{id,label,rootIds}` entries selecting actual root obligation IDs from the admitted decision. Use `projectTargetGroups(input, decision, groups)` from the package, or discover the Groups LocalFunction and invoke it with absolute native `inputPath`, `decisionPath`, and `groups`. It reuses the original graph, shows ungrouped/shared roots, and preserves the overall result. Non-root/unknown selections are rejected for admitted decisions; unfinished or rejected drafts never yield partial PASS. There are no built-in domains or automatic categories. Labels do not certify unlisted requirements: a group of selected calculations is not proof of an entire product. Missing historical process evidence remains missing; a group view cannot supply it or repair a mistaken original judgment.
+
+For current coding runs, explicit nonempty `codingScope.groups` also asks the same judge to compare every applicable caller-owned leaf, including after an overall FAIL. It does not add a role, scoring protocol, evidence or new requirements. An absent claim is unreviewed, distinct from an explicit indeterminate claim. Historical and ungrouped minimal FAIL decisions retain their original meaning; completeness and semantic correctness still require actual evidence.
+
+Record the caller's intended scope and method/depth in its trusted codingScope description and capability declarations; report the work actually completed. The current description is retained caller metadata, not an automatic model-input field, execution profile or target filter: authoritative acceptance boundaries belong in the complete original targets, and actual grants/conditions in trusted capability inputs. See [Review](review.md) for the shared evidence-depth guidance used by both collection and judgment. The existing claim method/conditions/reasoning/limitations support scope, actual investigation, coverage and gaps; there is no new wire field or depth score. A code-review-only selection cannot certify an original full-delivery requirement left unobserved. Index/search tools are optional, explicitly supplied locators whose version, resolution and coverage must be checked against frozen source; they do not substitute for execution or unavailable historical facts.
+
+## Optional code navigation evidence
+
+Trusted callers of `runCodingEvaluation` may supply `codeEvidence:{path,sourceRoot}` in options. Both paths are relative to their owned frozen artifact; the evidence JSON must be outside the selected source subtree. This selects the existing file observation channel, not a new judge or execution permission. The runner validates the complete raw-byte snapshot and coverage before a model call, reads the bounded navigation file, and back-reads its bounded UTF-8 candidate source files. With the option omitted, existing behavior is unchanged.
+
+The evidence can be produced by depa-knowledge-base.cs `tools/Depa.CodeEvidence`. It includes unsupported/excluded/oversize files, actual parser/resolvers, unresolved calls and omitted graph counts. Inspect these conditions when reasoning; source locations are candidates, missing hits do not prove absence, and paths establish no runtime or historical event. The adapter authenticates source binding and structure, not semantic correctness of a parser or all requirements. Keep the original complete targets and ordinary source/process/browser observations.

package/resources/iterate.md

@@ -0,0 +1,20 @@
+---
+envelopeVersion: halfcode.resource-envelope/v1
+specVersion: 1
+kind: SOP
+metadata:
+  fqn: ArtifactEvaluation.SOP.Iterate
+spec:
+  profile: freeform
+  description: Improve the reusable evaluator from observed failures without case-specific scoring
+---
+
+# Iterate the evaluator
+
+Reconstruct the goal and unresolved failures from immutable reports and actual observations before editing. Separate protocol rejection, environment/tool failure, evidence insufficiency and semantic misjudgment. Faster rejection is not improved usefulness; passing transport tests is not a credible verdict.
+
+Change the smallest shared implementation or single text authority that explains the failure. Do not add case names, selectors, expected business outputs or gold into the evaluator. Keep historical artifacts, original requirements and prior reports unchanged.
+
+Run `bun run check`, Halfcode `Resource validate --json`, and the relevant generic negative checks. Then freeze a new evaluator identity and use gpt-5.6-terra / medium on fixed inputs with finite per-run controls. Compare like phases: collection+review versus collection+review, sealed review versus sealed review. Report credible verdicts, incorrect PASS/FAIL, protocol failures, elapsed time and actual input/cache/output/unknown usage, including all unsuccessful runs. A historical cohort is not unseen validation.
+
+Repeat Halfcode discovery/invoke after editing; the next call loads the changed generation. Do not mutate a running frozen generation or restart a terminal assessment to reset its costs. Package with `bun pm pack`; consume the complete package including its lock and text resources, not copied fragments.

package/resources/review.md

@@ -0,0 +1,25 @@
+---
+envelopeVersion: halfcode.resource-envelope/v1
+specVersion: 1
+kind: SOP
+metadata:
+  fqn: ArtifactEvaluation.SOP.Review
+spec:
+  profile: freeform
+  description: Compare complete original requirements with authenticated facts
+---
+
+Goal → fact → comparison:
+Read COMPLETE originals first; preserve each independent qualifier, modality and quantifier. Exclusion is not all-member selection; do not transfer a qualifier between objects without a source relation. A neighboring attribute cannot satisfy another property. Split independent conditions under all/any instead of partially certifying a broad leaf. Compare the ACTUAL CONTENT of static deliverables, not their titles/existence. Challenge PASS: could cited facts remain unchanged if the required property were absent? Challenge absence FAIL: inspect the bounded candidate set and relevant alternative implementations/call sites; unread/uncited supplied facts are not unavailable; ambiguous wording cannot become a stronger mechanism requirement. No extra planning file is required.
+Evidence must distinguish the promised consumer PURPOSE, not just setup/access/empty state. Genuine tests count for what their real seams/assertions exercise: cite BOTH their definition and native execution; a replaced entrance is not proven even when other dependencies are real. Ask which required failure a test detects. Temporal/causal/lifecycle requirements need observations distinguishing those conditions, not final values alone. Free-text probe conditions describe intent; neither a word such as "settled" nor tool completion proves business completion. For absence require established prerequisites and an observed completion/deadline, not immediate silence: unknown completion means indeterminate; an unavailable environment prerequisite is not a business capability failure. Representative acceptance is finite sampling; disclose limits without waiving material conditions. No exhaustive branch checklist is required; equivalent observable semantics count unless originals mandate the form.
+Derive expected outcomes before comparison; artifact output, exit 0, coverage labels and self-assertions never define the goal. PASS needs all required conditions; FAIL needs an applicable original contradiction surviving valid alternative readings/implementations; missing or ambiguous evidence is indeterminate. Keep judgments consistent with comparisons and findings. Actual facts and finite sampling are not universal proofs.
+
+Fix the relevant acceptance boundary from the originals before judging a discovered implementation. Additional routes, controls or graph hits do not silently expand that boundary: a contradiction on an optional surface needs an original constraint whose quantifier actually covers it; preserve genuinely global constraints as global. If plausible original-scope readings would change the outcome and the supplied sources do not resolve them, record that specific ambiguity and remain indeterminate instead of selecting whichever reading makes this attempt PASS or FAIL. A limitation cannot disclaim a required condition while certifying that same condition. Likewise, missing execution alone does not invalidate a source-provable static requirement; distinguish those objects rather than applying a blanket UI/E2E rule.
+
+Describe evidence depth per comparison, using existing fields: `method` names what actually happened (source inspection, symbol/call tracing, executed tests, integration or consumer observation); `conditions` identifies the assessed boundary, artifact/version and actual execution or historical conditions; `reasoning` states which required distinctions the evidence covers; `limitations` identifies material uncovered distinctions and why. This supports a scope | actual method/depth | coverage | judgment | gap view without extra output keys, a second score, or mandatory repeated checklists. A requested depth label is an operational plan, never evidence that the work happened. Keep explanations concise and reuse evidence references.
+
+Scope, method, depth and coverage are independent: scope selects the authorized object/requirements; methods obtain facts; depth describes how far the actual investigation followed relevant dependencies, transitions, error paths or counterexamples; coverage states inspected versus unassessed conditions. Choose the least costly sufficient evidence for each original requirement, deepening only for a material unresolved distinction within available capabilities and the same budget. Static architecture/deliverable requirements can be established by adequate source inspection without executing E2E; passing tests or a successful consumer journey do not establish unrelated architecture or all branches. Neither add generic testing/E2E/process obligations nor silently waive frozen original conditions. A deliberately unperformed method is not itself a failed requirement; an original behavioral condition still lacking support remains unresolved.
+
+Symbol indexes, call graphs and search results locate candidate evidence. When supplied, check their binding to the frozen artifact, source/file hashes or matching revision, supported languages, parser/resolver confidence, exclusions, unresolved edges and truncation; follow relevant locators back to actual source before making a code claim. Do not infer freshness from HEAD alone for dirty/non-git artifacts. A missing hit/path is not proof of absence when resolution, scope or traversal is incomplete, and a static graph is not an executed trace. Use only explicitly available capabilities; do not discover/install an indexer or invent a tool.
+
+Separate actual counterevidence from unperformed observations, unavailable/lost inputs, unresolved interpretation and exhausted investigation. State the specific missing fact in `limitations`; do not label already supplied unread evidence unavailable. Current source or a new execution cannot recreate a missing historical development/review event. Localize ambiguities and gaps to their actual requirement; preserve supported subcomparisons instead of describing successful test execution as unperformed. Original aggregate judgments and source-review admission rules still apply; do not turn a selected positive view into full-delivery PASS.

package/resources/submit.md

@@ -0,0 +1,18 @@
+---
+envelopeVersion: halfcode.resource-envelope/v1
+specVersion: 1
+kind: SOP
+metadata:
+  fqn: ArtifactEvaluation.SOP.Submit
+spec:
+  profile: freeform
+  description: Represent an independent judgment with native references
+---
+
+Return compact-v2, never a Decision envelope:
+{"format":"compact-v2","judgment":"pass|fail|indeterminate","obligations":[],"claims":[],"findings":[],"sourceReviews":[]}.
+Obligation: {id:string,sourceId:string,quote?:string,expectation:string,rationale:string,relation:"leaf|all|any|conditional",children:string[],condition:"applicable|not-applicable|unresolved"}. Omitted quote binds COMPLETE original bytes. Preserve caller-owned obligations unchanged. A leaf has children:[]; all/any MUST reference actual child obligation IDs, not leave children empty or hide them in a sentence. Compare leaves; parents fold their children without a duplicate claim.
+Claim: {obligationId:string,judgment:"pass|fail|indeterminate",reasoning?:string,limitations?:string[],evidence?:[{observationRef:"obs:N",supports:string}],preconditions?:{status:"established|unresolved|incompatible",reasoning:string,evidenceIds:["obs:N"]}}.
+Use CURRENT obs:N refs after reading those complete objects; input/setup-only or failed facts cannot support delivery claims. Evidence.supports is a nonempty expected-vs-actual comparison STRING, NEVER a boolean. Normally omit reasoning: the owner reuses supports. Only indeterminate may omit evidence; empty evidence requires explicit reasoning. The owner expands exact IDs/content and expectation/method/conditions; do not transcribe them, logs or digests. Optional excerpt must be literal contiguous native text. Authentication is not semantic proof. Record actual limits, not repeated boilerplate.
+Finding: {id:string,obligationIds:string[],description:string}. SourceReview: {sourceId:string,complete:boolean,omissions?:string[],ambiguities?:string[]}; omitted arrays mean [].
+Findings reference failed leaves only. Review EVERY authoritative source. Omissions describe unassessed material scope; ambiguities are goal interpretations changing acceptance, not ordinary sampling. For FAIL/indeterminate, unsubmitted sourceReviews are conservatively recorded as incomplete, and unsubmitted needReviews as unresolved; omit repeated unknown boilerplate, never invent positive claims to fill it. Explicit dispositions remain unchanged and validated. PASS requires explicit complete source reviews and every need disposition; these defaults cannot certify anything. All other fields required. Owner-only execution/observations/diagnostics/usage/identities never belong in this object.