create-agent-rig 0.8.0 → 0.9.1

package/packages/cli/dist/policy/core/decision-record.js

@@ -16,12 +16,86 @@
  * - every evidence kind the policy requires must be present;
  * - a policy that redacts must not be recorded with unredacted diagnostics;
  * - the timestamp is supplied by the caller and must be an ISO-8601 date-time
- *   with seconds and an explicit zone (`ISO_8601` below; a bare date is
+ *   with seconds and an explicit zone (`ISO_8601` in `./validation.ts`, which
+ *   every shape recording an observation time reads; a bare date is
  *   refused) — no clock here.
  *
  * Each rule is one test in `packages/cli/test/policy-declaration.test.ts`
  * under "validating a decision record".
  *
+ * 🔴 EVERY field of the input is read through `carriesField`/`ownField`
+ * (`./validation.ts`) — own and enumerable, the set `Object.keys` walks — and
+ * never off the record directly. Presence and value travel through the same
+ * predicate: `'qualifier' in value` was the load-bearing half of this defect,
+ * because `unknownKeys` judges the same record by `Object.keys` while the reads
+ * walked the prototype chain, so the closed-shape check and the field reads
+ * disagreed about what the record contained — with the reads being the wider of
+ * the two, which is the direction that passes. A decision record is the
+ * artifact a later reader audits, and the shape that made this worth fixing
+ * before it had a caller is a record whose verdict qualifier is only inherited:
+ * it validates as qualified, and what it then writes out is `{"outcome":
+ * "allow","reason":…}` — the reason survives, the QUALIFIER is what is lost,
+ * which is exactly the silent pass an `UNSUPPORTED` capability state exists to
+ * prevent. Held over every reading site in this module, in both shapes —
+ * inherited, and own but not enumerable — in
+ * `packages/cli/test/policy-declaration.test.ts` › "refuses an UNSUPPORTED
+ * record whose verdict qualifier is %s, because what it writes out is a silent
+ * pass", with the other direction held by › "still accepts a record whose every
+ * field is defined through Object.defineProperty as own and enumerable". The
+ * `%s` is the name as the `it.each` case DECLARES it; quoting one expanded case
+ * gives a pointer no grep lands on.
+ *
+ * 🔴 And an unnarrowed outside value reaches a MESSAGE only through `quote`
+ * (`./validation.ts`), never through bare `String` or `JSON.stringify`.
+ * Two qualifications, because an earlier version of this sentence claimed more
+ * than the file delivers. First, `operation` and `capabilityState` are still
+ * interpolated bare into messages, safely: `member` has narrowed each to its
+ * closed vocabulary before the message is built. Second — and this is the part
+ * the sentence used to hide — a `Problem`'s **`field`** is not a message and is
+ * not escaped: `unknownKeys` (`./validation.ts`) puts the outside key name
+ * there verbatim, and `./declaration.ts` › `definePolicy` renders a report as
+ * `${field}: ${message}`, so an unknown key whose NAME carries a newline still
+ * forges a line. Escaping a `field` would break it as the machine-readable
+ * pointer it is, so the fix belongs in the rendering; it is RP-160.
+ * Both unsafe spellings inside messages were here: a qualifier
+ * carrying a newline forged two `field:
+ * message` lines of its own in the rendered problem list — the exact shape
+ * `./declaration.ts` › `definePolicy` throws — while the neighbouring line
+ * escaped the same value; and a circular value crashed the validator with a
+ * `TypeError` where `quote` degrades. Held by ›
+ * "escapes a verdict qualifier carrying a newline, so it cannot forge a line of
+ * the refusal report" and › "refuses a record whose %s is a circular value,
+ * rather than throwing while it renders the refusal".
+ *
+ * ⚠ What this does NOT do, and the limits are stated rather than implied:
+ *
+ * - the `ok: true` value is the input object itself, not a snapshot of the
+ *   fields that were certified. Those are the same thing for a value whose
+ *   fields are plain data, which is every record `JSON.parse` can produce; they
+ *   are not the same for one carrying a live accessor, which validates on one
+ *   read and serialises from another. RP-157 owns that, for this module and
+ *   `./declaration.ts` together;
+ * - nothing here caps the cost, and the amplifier is the PROBLEM LIST rather
+ *   than the input: one `Problem` is pushed per bad entry of `observedFacts` or
+ *   `evidence`, so a parsed record carrying a million bad entries produces a
+ *   million objects. That is reachable from ordinary `JSON.parse` input. The
+ *   first version of this bullet was wrong in every clause — it said
+ *   `Array.prototype.forEach` VISITS a sparse array's holes, that
+ *   `new Array(1e7)` cost seconds and gigabytes "before the refusal", and that
+ *   the cost was unreachable from a parsed record. `forEach` SKIPS holes, a
+ *   sparse `observedFacts` is not refused at all, and the dense case is the
+ *   reachable one. Corrected rather than softened, because a stale limit sells
+ *   cover that is not there (`rules/invariants.md`, "State the limits — and
+ *   test them");
+ * - an array HOLE is consequently read by nothing, while `JSON.stringify`
+ *   writes it out as `null`: `observedFacts: [{…}, , ,]` serialises as
+ *   `[{…},null,null]` and validates. That is this module's own rule — read what
+ *   the serialisation carries — failing one level BELOW the field, which is
+ *   where this change did not look. RP-161;
+ * - `quote` itself re-throws for a value whose `JSON.stringify` and `String`
+ *   both throw. The direction is a crash, never an `ok: true`, so nothing
+ *   malformed is certified through it — RP-160.
+ *
  * ⚠ `diagnostics.redacted` is the emitter's claim, and this validator enforces
  * the claim's presence, not the property: a record marked redacted whose
  * `diagnostics.text`, `observedFacts[].value` or `evidence[].value` still
@@ -31,8 +105,8 @@
  * before it persists a record.
  */
 import { compatibilityOf, findPolicy } from './registry.js';
-import { CAPABILITY_STATES, DECISION_OUTCOMES, EVIDENCE_KINDS, OPERATIONS, VERDICT_QUALIFIERS, } from './vocabulary.js';
-import { isRecord, member, nonEmptyString, unknownKeys } from './validation.js';
+import { CAPABILITY_STATES, UNENFORCEABLE_STATES, DECISION_OUTCOMES, EVIDENCE_KINDS, OPERATIONS, VERDICT_QUALIFIERS, } from './vocabulary.js';
+import { ISO_8601, carriesField, isRecord, member, nonEmptyString, ownField, quote, unknownKeys, } from './validation.js';
 export const DECISION_RECORD_SCHEMA_VERSION = 1;
 const KEYS = [
     'schemaVersion',
@@ -48,9 +122,12 @@ const KEYS = [
     'diagnostics',
     'recordedAt',
 ];
-const NEVER_SILENT_PASS = ['UNSUPPORTED', 'INTEGRATION-FAILED'];
-/** Date, `T`, time to the second (fractions allowed), and an explicit zone. */
-const ISO_8601 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+/**
+ * Read from `./vocabulary.ts` rather than restated here: `./coverage.ts` ›
+ * `qualifierFor` answers from the same list, and a second copy is how the two
+ * come to disagree about which verdicts may pass unqualified.
+ */
+const NEVER_SILENT_PASS = UNENFORCEABLE_STATES;
 const namedPairs = (problems, field, value, keys) => {
     if (!Array.isArray(value)) {
         problems.push({ field, message: 'must be a list' });
@@ -63,7 +140,7 @@ const namedPairs = (problems, field, value, keys) => {
         }
         unknownKeys(problems, entry, keys, `${field}[${index}]`);
         for (const key of keys)
-            nonEmptyString(problems, `${field}[${index}].${key}`, entry[key]);
+            nonEmptyString(problems, `${field}[${index}].${key}`, ownField(entry, key));
     });
 };
 const checkVerdict = (problems, value, capabilityState) => {
@@ -72,22 +149,23 @@ const checkVerdict = (problems, value, capabilityState) => {
         return;
     }
     unknownKeys(problems, value, ['outcome', 'qualifier', 'reason'], 'verdict');
-    member(problems, 'verdict.outcome', value.outcome, DECISION_OUTCOMES);
-    const qualified = 'qualifier' in value;
-    if (qualified) {
-        member(problems, 'verdict.qualifier', value.qualifier, VERDICT_QUALIFIERS);
-        if (typeof value.reason !== 'string' || value.reason.trim() === '') {
+    member(problems, 'verdict.outcome', ownField(value, 'outcome'), DECISION_OUTCOMES);
+    const qualifier = ownField(value, 'qualifier');
+    const reason = ownField(value, 'reason');
+    if (carriesField(value, 'qualifier')) {
+        member(problems, 'verdict.qualifier', qualifier, VERDICT_QUALIFIERS);
+        if (typeof reason !== 'string' || reason.trim() === '') {
             problems.push({
                 field: 'verdict.reason',
-                message: `a ${String(value.qualifier)} verdict must say why`,
+                message: `a ${quote(qualifier)} verdict must say why`,
             });
         }
     }
-    else if ('reason' in value && typeof value.reason !== 'string') {
+    else if (carriesField(value, 'reason') && typeof reason !== 'string') {
         problems.push({ field: 'verdict.reason', message: 'must be a string when present' });
     }
     if (capabilityState !== null && NEVER_SILENT_PASS.includes(capabilityState)) {
-        if (value.qualifier !== 'UNVERIFIABLE') {
+        if (qualifier !== 'UNVERIFIABLE') {
             problems.push({
                 field: 'verdict.qualifier',
                 message: `capabilityState ${capabilityState} never yields a silent pass: ` +
@@ -108,10 +186,11 @@ const checkEvidence = (problems, value, required) => {
             return;
         }
         unknownKeys(problems, entry, ['kind', 'value'], `evidence[${index}]`);
-        if (member(problems, `evidence[${index}].kind`, entry.kind, EVIDENCE_KINDS)) {
-            present.add(entry.kind);
+        const kind = ownField(entry, 'kind');
+        if (member(problems, `evidence[${index}].kind`, kind, EVIDENCE_KINDS)) {
+            present.add(kind);
         }
-        nonEmptyString(problems, `evidence[${index}].value`, entry.value);
+        nonEmptyString(problems, `evidence[${index}].value`, ownField(entry, 'value'));
     });
     for (const kind of required) {
         if (!present.has(kind)) {
@@ -125,16 +204,17 @@ const checkDiagnostics = (problems, value, mustRedact) => {
         return;
     }
     unknownKeys(problems, value, ['redacted', 'text'], 'diagnostics');
-    if (typeof value.redacted !== 'boolean') {
+    const redacted = ownField(value, 'redacted');
+    if (typeof redacted !== 'boolean') {
         problems.push({ field: 'diagnostics.redacted', message: 'must be a boolean' });
     }
-    else if (mustRedact && !value.redacted) {
+    else if (mustRedact && !redacted) {
         problems.push({
             field: 'diagnostics.redacted',
             message: 'the policy redacts matched values, so its diagnostics must be recorded redacted',
         });
     }
-    if (typeof value.text !== 'string') {
+    if (typeof ownField(value, 'text') !== 'string') {
         problems.push({ field: 'diagnostics.text', message: 'must be a string' });
     }
 };
@@ -145,54 +225,60 @@ export function validateDecisionRecord(input) {
     }
     const problems = [];
     unknownKeys(problems, input, KEYS);
-    if (input.schemaVersion !== DECISION_RECORD_SCHEMA_VERSION) {
+    const schemaVersion = ownField(input, 'schemaVersion');
+    if (schemaVersion !== DECISION_RECORD_SCHEMA_VERSION) {
         problems.push({
             field: 'schemaVersion',
-            message: `must be ${DECISION_RECORD_SCHEMA_VERSION}, got ${String(input.schemaVersion)}`,
+            message: `must be ${DECISION_RECORD_SCHEMA_VERSION}, got ${quote(schemaVersion)}`,
         });
     }
-    const policy = typeof input.policyId === 'string' ? findPolicy(input.policyId) : null;
+    const policyId = ownField(input, 'policyId');
+    const policyVersion = ownField(input, 'policyVersion');
+    const policy = typeof policyId === 'string' ? findPolicy(policyId) : null;
     if (policy === null) {
         problems.push({
             field: 'policyId',
-            message: `${JSON.stringify(input.policyId)} is not a registered policy`,
+            message: `${quote(policyId)} is not a registered policy`,
         });
     }
-    else if (typeof input.policyVersion === 'string') {
-        const compatibility = compatibilityOf(policy.policyId, input.policyVersion);
+    else if (typeof policyVersion === 'string') {
+        const compatibility = compatibilityOf(policy.policyId, policyVersion);
         if (compatibility !== 'compatible') {
             problems.push({
                 field: 'policyVersion',
-                message: `${JSON.stringify(input.policyVersion)} is ${compatibility} with ${policy.policyId} ${policy.policyVersion}`,
+                message: `${quote(policyVersion)} is ${compatibility} with ${policy.policyId} ${policy.policyVersion}`,
             });
         }
     }
     else {
-        nonEmptyString(problems, 'policyVersion', input.policyVersion);
+        nonEmptyString(problems, 'policyVersion', policyVersion);
     }
-    nonEmptyString(problems, 'harness', input.harness);
-    if (member(problems, 'operation', input.operation, OPERATIONS) && policy !== null) {
-        if (!policy.operations.includes(input.operation)) {
+    nonEmptyString(problems, 'harness', ownField(input, 'harness'));
+    const operation = ownField(input, 'operation');
+    if (member(problems, 'operation', operation, OPERATIONS) && policy !== null) {
+        if (!policy.operations.includes(operation)) {
             problems.push({
                 field: 'operation',
-                message: `${policy.policyId} does not apply to ${input.operation}`,
+                message: `${policy.policyId} does not apply to ${operation}`,
             });
         }
     }
-    const capabilityState = member(problems, 'capabilityState', input.capabilityState, CAPABILITY_STATES)
-        ? input.capabilityState
+    const state = ownField(input, 'capabilityState');
+    const capabilityState = member(problems, 'capabilityState', state, CAPABILITY_STATES)
+        ? state
         : null;
-    namedPairs(problems, 'observedFacts', input.observedFacts, ['name', 'value']);
-    checkVerdict(problems, input.verdict, capabilityState);
-    checkEvidence(problems, input.evidence, policy?.requiredEvidence ?? []);
-    nonEmptyString(problems, 'artifactVersion', input.artifactVersion);
-    checkDiagnostics(problems, input.diagnostics, policy !== null && policy.redaction !== 'none');
-    if (typeof input.recordedAt !== 'string' ||
-        !ISO_8601.test(input.recordedAt) ||
-        Number.isNaN(Date.parse(input.recordedAt))) {
+    namedPairs(problems, 'observedFacts', ownField(input, 'observedFacts'), ['name', 'value']);
+    checkVerdict(problems, ownField(input, 'verdict'), capabilityState);
+    checkEvidence(problems, ownField(input, 'evidence'), policy?.requiredEvidence ?? []);
+    nonEmptyString(problems, 'artifactVersion', ownField(input, 'artifactVersion'));
+    checkDiagnostics(problems, ownField(input, 'diagnostics'), policy !== null && policy.redaction !== 'none');
+    const recordedAt = ownField(input, 'recordedAt');
+    if (typeof recordedAt !== 'string' ||
+        !ISO_8601.test(recordedAt) ||
+        Number.isNaN(Date.parse(recordedAt))) {
         problems.push({
             field: 'recordedAt',
-            message: `must be an ISO-8601 date-time with seconds and an explicit zone, got ${JSON.stringify(input.recordedAt)}`,
+            message: `must be an ISO-8601 date-time with seconds and an explicit zone, got ${quote(recordedAt)}`,
         });
     }
     if (problems.length > 0)

package/packages/cli/dist/policy/core/declaration.js

@@ -12,10 +12,51 @@
  * The shape is closed: a field this interface does not name is refused, so a
  * field added by mistake cannot travel unnoticed into a record somebody later
  * audits. Every enumerated field draws from `./vocabulary.ts`.
+ *
+ * 🔴 `validateDeclaration` reads every field of its input through `ownField`
+ * (`./validation.ts`) — own and enumerable, the set `Object.keys` walks — and
+ * never off the record directly. `unknownKeys` on the line above already judges
+ * the record by `Object.keys`, so a wider read made the closed-shape check and
+ * the field reads disagree about what the record contains, with the reads being
+ * the wider of the two — the direction that passes. The consequence here is one
+ * step worse than in `./decision-record.ts`, because this validator's answer is
+ * kept: `definePolicy` copies the validated declaration by spread, and a spread
+ * copies own-enumerable keys only. So a declaration whose `tier` and `redaction`
+ * were only inherited used to be accepted and then FROZEN into the registry
+ * with no `tier` key and no `redaction` key at all — reading either yields
+ * `undefined` — a malformed entry produced by the function whose whole job is to
+ * refuse malformed ones. Held over all fifteen fields, in both shapes (inherited,
+ * and own but not enumerable), in `packages/cli/test/policy-declaration.test.ts`
+ * › "refuses a declaration whose %s is %s, because the declaration it writes out
+ * carries no such field" and, for the frozen-entry consequence, › "refuses a
+ * declaration whose tier is %s, rather than freezing an entry with no tier at
+ * all". The `%s` are the names as the `it.each` cases DECLARE them — quoting an
+ * expanded case instead is a pointer no grep lands on, which is what
+ * `test/template/evidence-pointers.test.ts` treats as a wildcard and what
+ * `rules/invariants.md` means by "the test's whole name".
+ *
+ * ⚠ What this does NOT do: `validateDeclaration` returns the input object
+ * itself (`input as unknown as PolicyDeclaration`), so what a caller gets back
+ * is the record it passed in, not a snapshot of the fields that were certified.
+ * Those are the same thing for a value whose fields are plain DATA, which is
+ * every declaration `JSON.parse` can produce; they are not the same for one
+ * carrying a live accessor. **An object literal is not the line** — a literal
+ * can carry a getter, and an earlier version of this sentence put literals on
+ * the safe side, which named the one shape that reaches the gap as the shape
+ * that avoids it. Here the consequence is kept rather than merely returned:
+ * `definePolicy` spreads the validated value, so a getter validated on read 1
+ * is FROZEN into the registry from read 2. That gap is RP-157, and
+ * `./decision-record.ts` states the identical limit at its own return.
  */
 import { AUTONOMY_TIERS, DECISION_OUTCOMES, ENFORCEMENT_TIMINGS, EVIDENCE_KINDS, FAILURE_SEMANTICS, HARNESS_CAPABILITIES, LIFECYCLE_STATES, OPERATIONS, REDACTION_RULES, } from './vocabulary.js';
-import { isRecord, matching, member, members, nonEmptyString, unknownKeys } from './validation.js';
-const KEYS = [
+import { isRecord, matching, member, members, nonEmptyString, ownField, unknownKeys, } from './validation.js';
+/**
+ * The closed set of fields a declaration may carry — exported so a test can
+ * check the fixture against THIS list by name rather than by counting it.
+ * A count agrees with a set that has drifted; `rules/invariants.md`, "One
+ * mechanism, one implementation".
+ */
+export const KEYS = [
     'policyId',
     'policyVersion',
     'lifecycle',
@@ -41,23 +82,23 @@ export function validateDeclaration(input) {
     }
     const problems = [];
     unknownKeys(problems, input, KEYS);
-    matching(problems, 'policyId', input.policyId, KEBAB_CASE, 'kebab-case');
-    matching(problems, 'policyVersion', input.policyVersion, POLICY_VERSION, 'MAJOR.MINOR');
-    member(problems, 'lifecycle', input.lifecycle, LIFECYCLE_STATES);
-    nonEmptyString(problems, 'invariant', input.invariant);
-    member(problems, 'tier', input.tier, AUTONOMY_TIERS);
-    members(problems, 'operations', input.operations, OPERATIONS, { nonEmpty: true });
-    member(problems, 'timing', input.timing, ENFORCEMENT_TIMINGS);
-    member(problems, 'requiredCapability', input.requiredCapability, HARNESS_CAPABILITIES);
-    matching(problems, 'mechanism', input.mechanism, KEBAB_CASE, 'kebab-case');
-    members(problems, 'outcomes', input.outcomes, DECISION_OUTCOMES, { nonEmpty: true });
-    member(problems, 'onInternalError', input.onInternalError, FAILURE_SEMANTICS);
-    member(problems, 'onUnreadableInput', input.onUnreadableInput, FAILURE_SEMANTICS);
-    members(problems, 'requiredEvidence', input.requiredEvidence, EVIDENCE_KINDS, {
+    matching(problems, 'policyId', ownField(input, 'policyId'), KEBAB_CASE, 'kebab-case');
+    matching(problems, 'policyVersion', ownField(input, 'policyVersion'), POLICY_VERSION, 'MAJOR.MINOR');
+    member(problems, 'lifecycle', ownField(input, 'lifecycle'), LIFECYCLE_STATES);
+    nonEmptyString(problems, 'invariant', ownField(input, 'invariant'));
+    member(problems, 'tier', ownField(input, 'tier'), AUTONOMY_TIERS);
+    members(problems, 'operations', ownField(input, 'operations'), OPERATIONS, { nonEmpty: true });
+    member(problems, 'timing', ownField(input, 'timing'), ENFORCEMENT_TIMINGS);
+    member(problems, 'requiredCapability', ownField(input, 'requiredCapability'), HARNESS_CAPABILITIES);
+    matching(problems, 'mechanism', ownField(input, 'mechanism'), KEBAB_CASE, 'kebab-case');
+    members(problems, 'outcomes', ownField(input, 'outcomes'), DECISION_OUTCOMES, { nonEmpty: true });
+    member(problems, 'onInternalError', ownField(input, 'onInternalError'), FAILURE_SEMANTICS);
+    member(problems, 'onUnreadableInput', ownField(input, 'onUnreadableInput'), FAILURE_SEMANTICS);
+    members(problems, 'requiredEvidence', ownField(input, 'requiredEvidence'), EVIDENCE_KINDS, {
         nonEmpty: false,
     });
-    member(problems, 'redaction', input.redaction, REDACTION_RULES);
-    nonEmptyString(problems, 'statedIn', input.statedIn);
+    member(problems, 'redaction', ownField(input, 'redaction'), REDACTION_RULES);
+    nonEmptyString(problems, 'statedIn', ownField(input, 'statedIn'));
     if (problems.length > 0)
         return { ok: false, problems };
     // Every field above was checked against the shape, so the narrowing is earned

package/packages/cli/dist/policy/core/evidence-matrix.js

@@ -0,0 +1,94 @@
+/**
+ * The capability evidence matrix (RP-36, absorbing the discovery component of
+ * the item it supersedes): one row per concrete harness surface, saying what
+ * was observed, on exactly which version, when, and where the proof is.
+ *
+ * The rule that gives the matrix its value is that its validator refuses an
+ * incomplete row: a row without an exact version or an observed
+ * date-time reads like evidence and is not one, because neither "which build
+ * was this" nor "was this before or after the change" can be answered from it.
+ * This module owns validation only; a caller that persists rows owns storage.
+ * Both halves are checked — `packages/cli/test/policy-coverage.test.ts` ›
+ * "refuses the harness version %j, because it names a range or a moving target
+ * rather than a build" and › "refuses an observedAt that is not an ISO-8601
+ * date-time with a zone (%j)". Documentation claims are not rows; a row records
+ * live behaviour that was seen.
+ *
+ * A row whose status is anything but `SUPPORTED` must say why, and a
+ * `SUPPORTED` row must not — the shape is closed in both directions, per ›
+ * "refuses a %s row that does not say why it is not supported".
+ *
+ * Every field of the shape is checked and every problem is reported at once,
+ * the way `./declaration.ts` does it, so a caller fixes a row in one pass: ›
+ * "reports every problem at once rather than stopping at the first".
+ *
+ * Why the row is shaped this way, and what it deliberately does not check, is
+ * `docs/decisions/capability-coverage.md`.
+ */
+import { CAPABILITY_STATES } from './vocabulary.js';
+import { carriesField, exactVersion, ISO_8601, isRecord, matching, member, nonBlankString, ownField, unknownKeys, } from './validation.js';
+const KEYS = [
+    'harness',
+    'surface',
+    'harnessVersion',
+    'os',
+    'observedAt',
+    'mechanism',
+    'observableSignal',
+    'status',
+    'downgradeReason',
+    'evidencePointer',
+];
+const REQUIRED_TEXT = [
+    'harness',
+    'surface',
+    'harnessVersion',
+    'os',
+    'mechanism',
+    'observableSignal',
+    'evidencePointer',
+];
+/** Validate an unknown value as one matrix row, reporting every problem at once. */
+export function validateEvidenceRow(input) {
+    if (!isRecord(input)) {
+        return { ok: false, problems: [{ field: '', message: 'an evidence row is an object' }] };
+    }
+    const problems = [];
+    unknownKeys(problems, input, KEYS);
+    // EVERY field is read through `ownField`, not off the record directly. A row
+    // is evidence only insofar as it CARRIES what it was validated on: a value
+    // reached through the prototype chain, or held in a non-enumerable own
+    // property, validates and then serialises to nothing — "a row that reads like
+    // evidence and is not one", which is the shape this module exists to refuse.
+    // `unknownKeys` already judges the row by `Object.keys`, and `ownField` is
+    // that same notion, so the closed-shape check and the field reads cannot
+    // disagree about what the row contains.
+    for (const field of REQUIRED_TEXT)
+        nonBlankString(problems, field, ownField(input, field));
+    exactVersion(problems, 'harnessVersion', ownField(input, 'harnessVersion'));
+    matching(problems, 'observedAt', ownField(input, 'observedAt'), ISO_8601, 'an ISO-8601 date-time with a zone');
+    const status = ownField(input, 'status');
+    const known = member(problems, 'status', status, CAPABILITY_STATES);
+    const carriesReason = carriesField(input, 'downgradeReason');
+    if (known && status !== 'SUPPORTED') {
+        if (carriesReason)
+            nonBlankString(problems, 'downgradeReason', ownField(input, 'downgradeReason'));
+        else
+            problems.push({ field: 'downgradeReason', message: 'must be a non-blank string' });
+    }
+    // The shape is closed in both directions: a supported row has no reason to
+    // give, so a `downgradeReason` on one is refused rather than ignored. Left
+    // unchecked, the field went unvalidated on that branch and the narrowing
+    // below handed back a value typed `string` that was not one.
+    if (known && status === 'SUPPORTED' && carriesReason) {
+        problems.push({
+            field: 'downgradeReason',
+            message: 'a SUPPORTED row has nothing to explain, so it carries no downgrade reason',
+        });
+    }
+    if (problems.length > 0)
+        return { ok: false, problems };
+    // Every field above was checked against the shape, so the narrowing is the
+    // type the checks just established rather than an assertion over them.
+    return { ok: true, value: input };
+}