dunstan 0.1.10 → 0.1.12

package/README.md

@@ -29,7 +29,7 @@ report a pull request's handback before it says done ([`plugins/dunstan/`](plugi
 /plugin install dunstan@barglabs
 ```
 
-The plugin runs the MCP server with `npx -y dunstan@0.1.10 mcp`, the `dunstan` npm package at that
+The plugin runs the MCP server with `npx -y dunstan@0.1.12 mcp`, the `dunstan` npm package at that
 exact version: one self-contained file, no dependencies.
 
 **The token.** When you enable the plugin, Claude Code asks for an optional GitHub token and keeps it
@@ -76,7 +76,9 @@ dist/dunstan.mjs verify record.json   # offline: recompute claims, verdict and d
 dist/dunstan.mjs rerun record.json    # online: re-read the sources, report evidence_changed
 ```
 
-Exit codes: 0 pass, 1 fail, 2 unverifiable, 3 usage or internal error (`verify`: 0 verified, 1 not).
+Exit codes: 0 pass, 1 fail, 2 unverifiable, 3 no record: a usage error, a pull request that cannot
+be read or that moved while it was checked and again when checked once more (`pull_request_moved`),
+or an internal error (`verify`: 0 verified, 1 not).
 `--sign-key <path> --signer <principal>` writes the record as its JCS bytes with a detached SSH
 signature; `verify --sig <file> --allowed-signers <file>` checks it.
 
@@ -87,6 +89,13 @@ agent calls with its block before it says done, beside `dunstan_suggest_declarat
 `checker.digest` in a record is the SHA-256 of `dist/dunstan.mjs`, the single-file bundle that ran:
 the checker code, its dependencies and both schemas from `spec/schema/`, inlined at build time.
 
+## What Dunstan does not check
+
+Dunstan checks the claims a handback declares against the record. It does not check that the
+handback covers what the issue asked for: an accurate report of the wrong work passes.
+
+What to declare: [`docs/agents.md`](docs/agents.md#the-instruction-block).
+
 ## Declare before done
 
 Checking a declared claim is exact. Finding the claims in prose is where readers fail: a hosted

package/dist/dunstan.mjs

@@ -8030,7 +8030,7 @@ import { readFileSync as readFileSync7 } from "node:fs";
 import { createHash } from "node:crypto";
 
 // src/spec/constants.ts
-var SPEC_VERSION = "0.1.6";
+var SPEC_VERSION = "0.1.8";
 var BLOCK_VERSION = "0.1";
 var SUPPORTED_BLOCK_VERSIONS = [BLOCK_VERSION];
 var BLOCK_INFO_STRING = "dunstan-handback";
@@ -8589,17 +8589,32 @@ function later(a, b) {
   if ((a.runAttempt ?? 0) !== (b.runAttempt ?? 0)) return (a.runAttempt ?? 0) > (b.runAttempt ?? 0);
   return a.id > b.id;
 }
+function identity(run) {
+  if (run.workflowPath !== void 0)
+    return JSON.stringify(["workflow", run.workflowPath, run.name]);
+  if (run.appSlug === "github-actions") return void 0;
+  if (run.appSlug !== void 0) return JSON.stringify(["app", run.appSlug, run.name]);
+  if (run.checkSuiteId === void 0) return JSON.stringify(["name", run.name]);
+  return void 0;
+}
 function countedCheckRuns(runs, excludedIds) {
   const excluded = new Set(excludedIds);
   const checker = /* @__PURE__ */ new Map();
   const latest = /* @__PURE__ */ new Map();
   for (const run of runs) {
-    if (excluded.has(run.id)) checker.set(run.name, Math.max(checker.get(run.name) ?? 0, run.id));
+    const id = identity(run);
+    if (excluded.has(run.id) && id !== void 0) {
+      checker.set(id, Math.max(checker.get(id) ?? 0, run.id));
+    }
     const key = checkKey(run);
     const seen = latest.get(key);
     if (seen === void 0 || later(run, seen)) latest.set(key, run);
   }
-  return [...latest.values()].filter((run) => !excluded.has(run.id) && run.id > (checker.get(run.name) ?? 0)).sort((a, b) => a.id - b.id);
+  const superseded = (run) => {
+    const id = identity(run);
+    return id !== void 0 && run.id < (checker.get(id) ?? 0);
+  };
+  return [...latest.values()].filter((run) => !excluded.has(run.id) && !superseded(run)).sort((a, b) => a.id - b.id);
 }
 var NOT_FAILED_CONCLUSIONS = ["success", "skipped", "neutral"];
 function booleanRow(field, declared, reason, runs, failed, mismatch, unsettled) {
@@ -8624,6 +8639,7 @@ function checkChecks(block, evidence) {
   let reason;
   if (section === void 0) reason = absentSection("checkRuns");
   else if (section.status !== "ok") reason = unreadReason(section);
+  else if (section.commit !== evidence.pullRequest.headSha) reason = "check_runs_not_at_head";
   const runs = section !== void 0 && section.status === "ok" ? countedCheckRuns(section.runs, section.excludedIds) : [];
   if (checks.total !== void 0) {
     const field = "/checks/total";
@@ -8865,7 +8881,7 @@ function findEndOfCentralDirectory(bytes) {
   }
   throw new ZipError("no end of central directory record");
 }
-function readZipEntry(bytes, path) {
+function readZipEntry(bytes, path, limit = MAX_ENTRY_BYTES) {
   if (bytes.length < 22) throw new ZipError("archive too short");
   const dv = view(bytes);
   const eocd = findEndOfCentralDirectory(bytes);
@@ -8890,7 +8906,7 @@ function readZipEntry(bytes, path) {
     if (compressedSize === 4294967295 || size === 4294967295 || localOffset === 4294967295) {
       throw new ZipError("ZIP64 is not supported");
     }
-    if (size > MAX_ENTRY_BYTES) throw new ZipError(`entry larger than ${MAX_ENTRY_BYTES} bytes`);
+    if (size > limit) throw new ZipError(`entry larger than ${limit} bytes`);
     if (localOffset + 30 > bytes.length || dv.getUint32(localOffset, true) !== LOCAL) {
       throw new ZipError("bad local file header");
     }
@@ -8901,7 +8917,8 @@ function readZipEntry(bytes, path) {
     if (method === 0) return data;
     if (method === 8) {
       try {
-        return new Uint8Array(inflateRawSync(data, { maxOutputLength: MAX_ENTRY_BYTES }));
+        const out = inflateRawSync(data, { maxOutputLength: limit });
+        return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
       } catch (e) {
         throw new ZipError(`cannot inflate ${path}: ${e.message}`);
       }
@@ -8921,6 +8938,14 @@ var PullRequestUnreadable = class extends Error {
     this.name = "PullRequestUnreadable";
   }
 };
+var PullRequestMoved = class extends Error {
+  constructor(repository, number4, moves) {
+    super(
+      `pull request ${repository}#${number4} moved while it was checked, and again when it was checked once more (${moves.join(", ")}); no record is written (pull_request_moved)`
+    );
+    this.name = "PullRequestMoved";
+  }
+};
 var ShapeError = class extends Error {
 };
 function obj(value) {
@@ -8956,11 +8981,18 @@ function timestamp(value) {
   }
   return text;
 }
+function timestampOrNull(value) {
+  return value === null || value === void 0 ? null : timestamp(value);
+}
 function second(t) {
   return t.slice(0, 19);
 }
-async function readPullRequest(client, repository, number4) {
-  const read = await client.read("pull_request", `/repos/${repository}/pulls/${number4}`);
+async function readPullRequest(client, repository, number4, options = {}) {
+  const read = await client.read(
+    "pull_request",
+    `/repos/${repository}/pulls/${number4}`,
+    options.record === false ? { record: false } : {}
+  );
   if (!read.ok) {
     throw new PullRequestUnreadable(
       `cannot read pull request ${repository}#${number4} (${read.error}); no record is written`
@@ -8972,6 +9004,7 @@ async function readPullRequest(client, repository, number4) {
     const state = str(pr.state);
     if (state !== "open" && state !== "closed") throw new ShapeError();
     const base = obj(obj(pr.base).repo);
+    const baseRef = str(obj(pr.base).ref);
     return {
       evidence: {
         status: "ok",
@@ -8985,6 +9018,7 @@ async function readPullRequest(client, repository, number4) {
         changedFiles: int(pr.changed_files)
       },
       repository: str(base.full_name),
+      baseRef,
       body: strOrNull(pr.body)
     };
   } catch (e) {
@@ -8996,6 +9030,20 @@ async function readPullRequest(client, repository, number4) {
     throw e;
   }
 }
+function pullRequestMoves(first, again) {
+  const state = (pr) => pr.evidence.merged ? "merged" : pr.evidence.state;
+  const pairs = [
+    ["head", first.evidence.headSha, again.evidence.headSha],
+    ["base", first.baseRef, again.baseRef],
+    ["state", state(first), state(again)],
+    ["repository", first.repository, again.repository],
+    ["mergedAt", first.evidence.mergedAt, again.evidence.mergedAt],
+    ["mergeSha", first.evidence.mergeSha, again.evidence.mergeSha],
+    ["changedFiles", first.evidence.changedFiles, again.evidence.changedFiles],
+    ["number", first.evidence.number, again.evidence.number]
+  ];
+  return pairs.filter(([, a, b]) => a !== b).map(([name, a, b]) => `${name} ${a} -> ${b}`);
+}
 async function readAllPages(client, kind, pathFor, itemsOf, map2, options = {}) {
   const out = [];
   for (let page = 1; page <= MAX_PAGES; page++) {
@@ -9529,6 +9577,13 @@ async function readWorkflowRunsAt(client, repository, commit) {
   }
   return bySuite;
 }
+function withinLatestAttempt(jobs, run, createdAt) {
+  if (createdAt === null) return false;
+  const created = second(createdAt);
+  return jobs.some(
+    (job) => (job.attempt === null || job.attempt <= run.attempt) && job.startedAt !== null && job.completedAt !== null && second(job.startedAt) <= created && created <= second(job.completedAt)
+  );
+}
 async function readTestRecord(client, repository, record2, headCommit) {
   const workflowFile = record2.workflow.split("/").at(-1);
   const runsPath = (page) => `/repos/${repository}/actions/workflows/${encodeURIComponent(workflowFile)}/runs?head_sha=${headCommit}&per_page=${PER_PAGE}&page=${page}`;
@@ -9552,10 +9607,24 @@ async function readTestRecord(client, repository, record2, headCommit) {
       "workflow_runs",
       (page) => `/repos/${repository}/actions/runs/${run.id}/jobs?filter=latest&per_page=${PER_PAGE}&page=${page}`,
       (json2) => arr(obj(json2).jobs),
-      (item) => str(obj(item).name)
+      (item) => {
+        const j = obj(item);
+        let attempt = null;
+        if (j.run_attempt !== null && j.run_attempt !== void 0) {
+          attempt = int(j.run_attempt);
+          if (attempt < 1) throw new ShapeError();
+        }
+        return {
+          name: str(j.name),
+          attempt,
+          startedAt: timestampOrNull(j.started_at),
+          completedAt: timestampOrNull(j.completed_at)
+        };
+      }
     );
     if (jobs === null) return { record: record2, ...unreadable("workflow_runs") };
-    if (!jobs.includes(record2.job)) continue;
+    const named = jobs.filter((j) => j.name === record2.job);
+    if (named.length === 0) continue;
     const artifacts = await readAllPages(
       client,
       "workflow_runs",
@@ -9563,15 +9632,23 @@ async function readTestRecord(client, repository, record2, headCommit) {
       (json2) => arr(obj(json2).artifacts),
       (item) => {
         const a = obj(item);
-        return { id: int(a.id), name: str(a.name), expired: a.expired === true };
+        return {
+          id: int(a.id),
+          name: str(a.name),
+          expired: a.expired === true,
+          createdAt: timestampOrNull(a.created_at)
+        };
       }
     );
     if (artifacts === null) return { record: record2, ...unreadable("workflow_runs") };
-    const named = artifacts.filter((a) => a.name === record2.artifact).sort((a, b) => a.id - b.id);
-    if (named.length === 0) continue;
-    if (named.length > 1) return { record: record2, ...unreadable("artifact") };
-    const artifact = named[0];
+    const uploaded = artifacts.filter((a) => a.name === record2.artifact).sort((a, b) => a.id - b.id);
+    if (uploaded.length === 0) continue;
+    if (uploaded.length > 1) return { record: record2, ...unreadable("artifact") };
+    const artifact = uploaded[0];
     if (artifact.expired) return { record: record2, ...unreadable("artifact") };
+    if (!withinLatestAttempt(named, run, artifact.createdAt)) {
+      return { record: record2, ...unreadable("artifact") };
+    }
     const zipPath = `/repos/${repository}/actions/artifacts/${artifact.id}/zip`;
     const download = await client.read("artifact", zipPath, {
       json: false,
@@ -9579,7 +9656,7 @@ async function readTestRecord(client, repository, record2, headCommit) {
     });
     if (!download.ok) return { record: record2, ...unreadable("artifact") };
     try {
-      const file2 = readZipEntry(download.body, record2.path);
+      const file2 = readZipEntry(download.body, record2.path, client.maxEntryBytes);
       if (file2 === null) continue;
       const counts = countJunit(new TextDecoder("utf-8").decode(file2));
       runs.push({ runId: run.id, runAttempt: run.attempt, ...counts });
@@ -9775,7 +9852,7 @@ async function reportFromComment(client, repository, number4, login) {
 // src/record/checker.ts
 import { readFileSync } from "node:fs";
 var CHECKER_NAME = "dunstan";
-var CHECKER_VERSION = "0.1.10";
+var CHECKER_VERSION = "0.1.12";
 function checkerIdentity(artifact) {
   return {
     name: CHECKER_NAME,
@@ -9952,7 +10029,7 @@ var FILES = { "handback-block-0.1.schema.json": `{
     }
   }
 }
-`, "record-0.1.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.1.schema.json",\n  "title": "Dunstan record, v0.1",\n  "description": "An in-toto Statement v1 whose predicate records one check of a handback block against the record. See spec/claim-format.md.",\n  "type": "object",\n  "required": ["_type", "subject", "predicateType", "predicate"],\n  "additionalProperties": false,\n  "properties": {\n    "_type": { "const": "https://in-toto.io/Statement/v1" },\n    "subject": {\n      "type": "array",\n      "minItems": 1,\n      "maxItems": 2,\n      "prefixItems": [{ "$ref": "#/$defs/commitSubject" }, { "$ref": "#/$defs/blockSubject" }],\n      "items": false\n    },\n    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1" },\n    "predicate": { "$ref": "#/$defs/predicate" }\n  },\n  "allOf": [\n    {\n      "if": {\n        "properties": {\n          "predicate": {\n            "properties": { "block": { "properties": { "status": { "const": "found" } } } }\n          }\n        }\n      },\n      "then": { "properties": { "subject": { "minItems": 2 } } },\n      "else": { "properties": { "subject": { "maxItems": 1 } } }\n    }\n  ],\n  "$defs": {\n    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },\n    "commitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },\n    "repository": {\n      "description": "owner/repo",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$"\n    },\n    "issueRef": {\n      "description": "owner/repo#N, always fully qualified in evidence.",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,9}$"\n    },\n    "timestamp": {\n      "type": "string",\n      "format": "date-time",\n      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\\\.[0-9]+)?Z$"\n    },\n    "sourceKind": {\n      "enum": [\n        "pull_request",\n        "pull_request_files",\n        "pull_request_commits",\n        "closing_references",\n        "repository",\n        "issue",\n        "commit",\n        "compare",\n        "check_runs",\n        "workflow_runs",\n        "artifact",\n        "deployments"\n      ]\n    },\n    "commitSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": {\n          "type": "string",\n          "pattern": "^git\\\\+https://github\\\\.com/[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}@[0-9a-f]{40}$"\n        },\n        "digest": {\n          "type": "object",\n          "required": ["gitCommit"],\n          "additionalProperties": false,\n          "properties": { "gitCommit": { "$ref": "#/$defs/commitSha" } }\n        }\n      }\n    },\n    "blockSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": { "const": "handback-block" },\n        "digest": {\n          "type": "object",\n          "required": ["sha256"],\n          "additionalProperties": false,\n          "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n        }\n      }\n    },\n    "predicate": {\n      "type": "object",\n      "required": [\n        "spec",\n        "checker",\n        "report",\n        "block",\n        "subject",\n        "evidence",\n        "claims",\n        "verdict",\n        "digests",\n        "rerun",\n        "assurance"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "spec": {\n          "description": "The spec version the checker implements, semver.",\n          "type": "string",\n          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)$"\n        },\n        "checker": {\n          "type": "object",\n          "required": ["name", "version", "digest"],\n          "additionalProperties": false,\n          "properties": {\n            "name": { "type": "string", "minLength": 1, "maxLength": 214 },\n            "version": { "type": "string", "minLength": 1, "maxLength": 100 },\n            "digest": {\n              "type": "object",\n              "required": ["sha256"],\n              "additionalProperties": false,\n              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n            }\n          }\n        },\n        "report": {\n          "description": "The report\'s digest and where it was read. Never its text.",\n          "type": "object",\n          "required": ["sha256", "source"],\n          "additionalProperties": false,\n          "properties": {\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "source": {\n              "type": "object",\n              "required": ["kind", "locator"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "enum": ["pr-body", "pr-comment", "file", "stdin", "api"] },\n                "locator": { "type": "string", "minLength": 1, "maxLength": 2000 }\n              }\n            }\n          }\n        },\n        "block": { "$ref": "#/$defs/block" },\n        "subject": {\n          "type": "object",\n          "required": ["repository", "pullRequest", "headSha", "mergeSha"],\n          "additionalProperties": false,\n          "properties": {\n            "repository": { "$ref": "#/$defs/repository" },\n            "pullRequest": { "type": "integer", "minimum": 1 },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": {\n              "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }]\n            }\n          }\n        },\n        "evidence": { "$ref": "#/$defs/evidence" },\n        "claims": {\n          "type": "array",\n          "items": { "$ref": "#/$defs/claim" }\n        },\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "digests": {\n          "type": "object",\n          "required": ["claims", "evidence"],\n          "additionalProperties": false,\n          "properties": {\n            "claims": { "$ref": "#/$defs/sha256" },\n            "evidence": { "$ref": "#/$defs/sha256" }\n          }\n        },\n        "rerun": {\n          "type": "object",\n          "required": ["offline", "online"],\n          "additionalProperties": false,\n          "properties": {\n            "offline": { "type": "string", "minLength": 1, "maxLength": 2000 },\n            "online": { "type": "string", "minLength": 1, "maxLength": 2000 }\n          }\n        },\n        "assurance": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issuer"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "unsigned" },\n                "issuer": { "const": "self-generated" }\n              }\n            },\n            {\n              "type": "object",\n              "required": ["status", "issuer", "keyFingerprint"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "signed" },\n                "issuer": { "type": "string", "minLength": 1, "maxLength": 320 },\n                "keyFingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]{43}$" }\n              }\n            }\n          ]\n        }\n      }\n    },\n    "verdict": { "enum": ["pass", "fail", "unverifiable"] },\n    "blockError": {\n      "type": "object",\n      "required": ["code"],\n      "additionalProperties": false,\n      "properties": {\n        "code": {\n          "enum": [\n            "unterminated_fence",\n            "invalid_json",\n            "duplicate_member",\n            "unsupported_version",\n            "schema_violation"\n          ]\n        },\n        "pointer": { "type": "string", "pattern": "^(?:/.*)?$" },\n        "keyword": { "type": "string", "minLength": 1 }\n      }\n    },\n    "block": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "found" },\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "value": { "$ref": "handback-block-0.1.schema.json" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "missing" },\n            "reason": { "const": "block_missing" },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "count", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ambiguous" },\n            "reason": { "const": "block_ambiguous" },\n            "count": { "type": "integer", "minimum": 2 },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "errors", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "invalid" },\n            "reason": { "const": "block_invalid" },\n            "errors": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/blockError" } },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        }\n      ]\n    },\n    "claim": {\n      "type": "object",\n      "required": ["id", "check", "field", "declared", "observed", "verdict"],\n      "additionalProperties": false,\n      "properties": {\n        "id": { "type": "string", "minLength": 1 },\n        "check": { "enum": ["head", "scope", "reference", "count", "time"] },\n        "field": {\n          "description": "A JSON Pointer (RFC 6901) into the block.",\n          "type": "string",\n          "pattern": "^/.+$"\n        },\n        "declared": true,\n        "observed": true,\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "reason": { "$ref": "#/$defs/claimReason" }\n      },\n      "if": { "properties": { "verdict": { "const": "pass" } } },\n      "then": { "not": { "required": ["reason"] } },\n      "else": { "required": ["reason"] }\n    },\n    "claimReason": {\n      "type": "string",\n      "pattern": "^(?:head_mismatch|declared_not_changed|undeclared_file|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|none_failed_mismatch|checks_incomplete|no_check_runs|no_succeeded_check_runs|no_comparable_record_field|record_not_found|record_ambiguous|not_merged|premature|no_deployment|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs|workflow_runs|artifact|deployments))$"\n    },\n    "unread": {\n      "description": "A section the checker could not use: its source errored, or the source answered without the field.",\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "source"],\n          "properties": {\n            "status": { "const": "unreadable" },\n            "source": { "$ref": "#/$defs/sourceKind" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "field"],\n          "properties": {\n            "status": { "const": "unpopulated" },\n            "field": { "type": "string", "pattern": "^[A-Za-z0-9_.]+$" }\n          }\n        }\n      ]\n    },\n    "evidence": {\n      "type": "object",\n      "required": ["pullRequest", "sources"],\n      "additionalProperties": false,\n      "properties": {\n        "pullRequest": {\n          "description": "Always read: a checker that cannot read the pull request writes no record.",\n          "type": "object",\n          "required": [\n            "status",\n            "number",\n            "state",\n            "merged",\n            "mergedAt",\n            "headSha",\n            "mergeSha",\n            "changedFiles"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ok" },\n            "number": { "type": "integer", "minimum": 1 },\n            "state": { "enum": ["open", "closed"] },\n            "merged": { "type": "boolean" },\n            "mergedAt": { "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }] },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": { "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }] },\n            "changedFiles": { "type": "integer", "minimum": 0 }\n          }\n        },\n        "files": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "complete", "entries"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "complete": { "type": "boolean" },\n                "entries": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["path", "status"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "path": { "type": "string", "minLength": 1 },\n                      "status": {\n                        "enum": [\n                          "added",\n                          "removed",\n                          "modified",\n                          "renamed",\n                          "copied",\n                          "changed",\n                          "unchanged"\n                        ]\n                      },\n                      "previousPath": { "type": "string", "minLength": 1 }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "closingReferences": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issues"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "references": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "issue" },\n                  "ref": { "$ref": "#/$defs/issueRef" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "resolvedAs": {\n                    "description": "Spec 0.1.3: the owner/repo#N GitHub answered the read of ref with, when it is another issue (an issue transferred to another repository).",\n                    "$ref": "#/$defs/issueRef"\n                  }\n                },\n                "if": { "required": ["resolvedAs"] },\n                "then": { "properties": { "exists": { "const": true } } }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists", "reachableFromHead"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "commit" },\n                  "ref": { "$ref": "#/$defs/commitSha" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "reachableFromHead": { "type": "boolean" }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref"],\n                "properties": {\n                  "kind": { "enum": ["issue", "commit"] },\n                  "ref": { "type": "string", "minLength": 1 }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "closeEvents": {\n          "description": "Spec 0.1.4: who closed each closes target that exists and is not among the closing references, read under the identity it resolves to; and the pull request\'s base, its repository\'s default branch and its commit ids.",\n          "type": "object",\n          "required": ["pullRequest", "targets"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": {\n              "oneOf": [\n                {\n                  "type": "object",\n                  "required": ["status", "baseRef", "defaultBranch", "commits"],\n                  "additionalProperties": false,\n                  "properties": {\n                    "status": { "const": "ok" },\n                    "baseRef": { "type": "string", "minLength": 1 },\n                    "defaultBranch": {\n                      "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }]\n                    },\n                    "commits": {\n                      "type": "array",\n                      "uniqueItems": true,\n                      "items": { "$ref": "#/$defs/commitSha" }\n                    }\n                  }\n                },\n                { "$ref": "#/$defs/unreadOnly" }\n              ]\n            },\n            "targets": {\n              "type": "array",\n              "items": {\n                "oneOf": [\n                  {\n                    "type": "object",\n                    "required": ["ref", "status", "type", "state", "events"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "ref": { "$ref": "#/$defs/issueRef" },\n                      "status": { "const": "ok" },\n                      "type": { "enum": ["issue", "pull_request"] },\n                      "state": { "enum": ["open", "closed", "merged"] },\n                      "events": {\n                        "type": "array",\n                        "items": {\n                          "type": "object",\n                          "required": ["at", "closer"],\n                          "additionalProperties": false,\n                          "properties": {\n                            "at": { "$ref": "#/$defs/timestamp" },\n                            "closer": {\n                              "oneOf": [\n                                { "type": "null" },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "ref"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "pull_request" },\n                                    "ref": { "$ref": "#/$defs/issueRef" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "oid"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "commit" },\n                                    "oid": { "$ref": "#/$defs/commitSha" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind"],\n                                  "additionalProperties": false,\n                                  "properties": { "kind": { "const": "other" } }\n                                }\n                              ]\n                            }\n                          }\n                        }\n                      }\n                    },\n                    "if": { "properties": { "type": { "const": "issue" } } },\n                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }\n                  },\n                  {\n                    "type": "object",\n                    "required": ["ref"],\n                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },\n                    "allOf": [{ "$ref": "#/$defs/unread" }]\n                  }\n                ]\n              }\n            }\n          }\n        },\n        "checkRuns": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "commit", "excludedIds", "runs"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "commit": { "$ref": "#/$defs/commitSha" },\n                "excludedIds": {\n                  "description": "Check runs left out of the count: the run the checker itself executes in.",\n                  "type": "array",\n                  "items": { "type": "integer", "minimum": 1 }\n                },\n                "runs": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["id", "name", "status", "conclusion"],\n                    "additionalProperties": false,\n                    "dependentRequired": {\n                      "workflowPath": ["checkSuiteId", "workflowRunId", "runAttempt"],\n                      "workflowName": ["workflowPath"],\n                      "workflowRunId": ["workflowPath"],\n                      "runAttempt": ["workflowPath"]\n                    },\n                    "properties": {\n                      "id": { "type": "integer", "minimum": 1 },\n                      "name": { "type": "string" },\n                      "status": { "type": "string", "minLength": 1 },\n                      "conclusion": { "type": ["string", "null"] },\n                      "checkSuiteId": {\n                        "description": "The run\'s check suite (`check_suite.id`). A run without `workflowPath` is counted as the latest per check suite and name; a run without either is keyed by its name alone. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "appSlug": {\n                        "description": "The slug of the app that created the run (`app.slug`). Recorded, not read by any check. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowPath": {\n                        "description": "The `path` of the workflow run whose `check_suite_id` is the run\'s check suite, less any `@<ref>`, from the workflow runs at the head. Runs that have it are counted as the latest per workflow path and name. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowName": {\n                        "description": "The `name` of that workflow run, as the listing gives it; absent where the listing gives none, null or the empty string. No 0.1 check reads it. Added in spec 0.1.5.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowRunId": {\n                        "description": "The `id` of that workflow run. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "runAttempt": {\n                        "description": "That workflow run\'s `run_attempt` as the listing gives it, its latest attempt at the read. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "testRecords": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["record", "status", "runs"],\n                "additionalProperties": false,\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" },\n                  "status": { "const": "ok" },\n                  "runs": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["runId", "runAttempt", "executed", "failed"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "runId": { "type": "integer", "minimum": 1 },\n                        "runAttempt": { "type": "integer", "minimum": 1 },\n                        "executed": { "type": "integer", "minimum": 0 },\n                        "failed": { "type": "integer", "minimum": 0 }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["record"],\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "deployments": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["environment", "status", "deployments"],\n                "additionalProperties": false,\n                "properties": {\n                  "environment": { "type": "string", "minLength": 1 },\n                  "status": { "const": "ok" },\n                  "deployments": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["id", "sha", "relation", "successAt"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "id": { "type": "integer", "minimum": 1 },\n                        "sha": { "$ref": "#/$defs/commitSha" },\n                        "relation": {\n                          "enum": ["head", "merge", "descendant", "unrelated", "unknown"]\n                        },\n                        "successAt": {\n                          "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }]\n                        }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["environment"],\n                "properties": { "environment": { "type": "string", "minLength": 1 } },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "sources": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["kind", "locator", "sha256", "readAt"],\n            "additionalProperties": false,\n            "properties": {\n              "kind": { "$ref": "#/$defs/sourceKind" },\n              "locator": { "type": "string", "minLength": 1, "maxLength": 2000 },\n              "sha256": { "$ref": "#/$defs/sha256" },\n              "etag": { "type": "string", "minLength": 1 },\n              "readAt": { "$ref": "#/$defs/timestamp" },\n              "error": {\n                "description": "Present when the read failed: http_<status>, network, or parse.",\n                "type": "string",\n                "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$"\n              }\n            }\n          }\n        }\n      }\n    },\n    "unreadOnly": {\n      "allOf": [{ "$ref": "#/$defs/unread" }],\n      "unevaluatedProperties": false\n    }\n  }\n}\n', "record-0.2-draft.schema.json": `{
+`, "record-0.1.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.1.schema.json",\n  "title": "Dunstan record, v0.1",\n  "description": "An in-toto Statement v1 whose predicate records one check of a handback block against the record. See spec/claim-format.md.",\n  "type": "object",\n  "required": ["_type", "subject", "predicateType", "predicate"],\n  "additionalProperties": false,\n  "properties": {\n    "_type": { "const": "https://in-toto.io/Statement/v1" },\n    "subject": {\n      "type": "array",\n      "minItems": 1,\n      "maxItems": 2,\n      "prefixItems": [{ "$ref": "#/$defs/commitSubject" }, { "$ref": "#/$defs/blockSubject" }],\n      "items": false\n    },\n    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1" },\n    "predicate": { "$ref": "#/$defs/predicate" }\n  },\n  "allOf": [\n    {\n      "if": {\n        "properties": {\n          "predicate": {\n            "properties": { "block": { "properties": { "status": { "const": "found" } } } }\n          }\n        }\n      },\n      "then": { "properties": { "subject": { "minItems": 2 } } },\n      "else": { "properties": { "subject": { "maxItems": 1 } } }\n    }\n  ],\n  "$defs": {\n    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },\n    "commitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },\n    "repository": {\n      "description": "owner/repo",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$"\n    },\n    "issueRef": {\n      "description": "owner/repo#N, always fully qualified in evidence.",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,9}$"\n    },\n    "timestamp": {\n      "type": "string",\n      "format": "date-time",\n      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\\\.[0-9]+)?Z$"\n    },\n    "sourceKind": {\n      "enum": [\n        "pull_request",\n        "pull_request_files",\n        "pull_request_commits",\n        "closing_references",\n        "repository",\n        "issue",\n        "commit",\n        "compare",\n        "check_runs",\n        "workflow_runs",\n        "artifact",\n        "deployments"\n      ]\n    },\n    "commitSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": {\n          "type": "string",\n          "pattern": "^git\\\\+https://github\\\\.com/[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}@[0-9a-f]{40}$"\n        },\n        "digest": {\n          "type": "object",\n          "required": ["gitCommit"],\n          "additionalProperties": false,\n          "properties": { "gitCommit": { "$ref": "#/$defs/commitSha" } }\n        }\n      }\n    },\n    "blockSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": { "const": "handback-block" },\n        "digest": {\n          "type": "object",\n          "required": ["sha256"],\n          "additionalProperties": false,\n          "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n        }\n      }\n    },\n    "predicate": {\n      "type": "object",\n      "required": [\n        "spec",\n        "checker",\n        "report",\n        "block",\n        "subject",\n        "evidence",\n        "claims",\n        "verdict",\n        "digests",\n        "rerun",\n        "assurance"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "spec": {\n          "description": "The spec version the checker implements, semver.",\n          "type": "string",\n          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)$"\n        },\n        "checker": {\n          "type": "object",\n          "required": ["name", "version", "digest"],\n          "additionalProperties": false,\n          "properties": {\n            "name": { "type": "string", "minLength": 1, "maxLength": 214 },\n            "version": { "type": "string", "minLength": 1, "maxLength": 100 },\n            "digest": {\n              "type": "object",\n              "required": ["sha256"],\n              "additionalProperties": false,\n              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n            }\n          }\n        },\n        "report": {\n          "description": "The report\'s digest and where it was read. Never its text.",\n          "type": "object",\n          "required": ["sha256", "source"],\n          "additionalProperties": false,\n          "properties": {\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "source": {\n              "type": "object",\n              "required": ["kind", "locator"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "enum": ["pr-body", "pr-comment", "file", "stdin", "api"] },\n                "locator": { "type": "string", "minLength": 1, "maxLength": 2000 }\n              }\n            }\n          }\n        },\n        "block": { "$ref": "#/$defs/block" },\n        "subject": {\n          "type": "object",\n          "required": ["repository", "pullRequest", "headSha", "mergeSha"],\n          "additionalProperties": false,\n          "properties": {\n            "repository": { "$ref": "#/$defs/repository" },\n            "pullRequest": { "type": "integer", "minimum": 1 },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": {\n              "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }]\n            }\n          }\n        },\n        "evidence": { "$ref": "#/$defs/evidence" },\n        "claims": {\n          "type": "array",\n          "items": { "$ref": "#/$defs/claim" }\n        },\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "digests": {\n          "type": "object",\n          "required": ["claims", "evidence"],\n          "additionalProperties": false,\n          "properties": {\n            "claims": { "$ref": "#/$defs/sha256" },\n            "evidence": { "$ref": "#/$defs/sha256" }\n          }\n        },\n        "rerun": {\n          "type": "object",\n          "required": ["offline", "online"],\n          "additionalProperties": false,\n          "properties": {\n            "offline": { "type": "string", "minLength": 1, "maxLength": 2000 },\n            "online": { "type": "string", "minLength": 1, "maxLength": 2000 }\n          }\n        },\n        "assurance": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issuer"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "unsigned" },\n                "issuer": { "const": "self-generated" }\n              }\n            },\n            {\n              "type": "object",\n              "required": ["status", "issuer", "keyFingerprint"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "signed" },\n                "issuer": { "type": "string", "minLength": 1, "maxLength": 320 },\n                "keyFingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]{43}$" }\n              }\n            }\n          ]\n        }\n      }\n    },\n    "verdict": { "enum": ["pass", "fail", "unverifiable"] },\n    "blockError": {\n      "type": "object",\n      "required": ["code"],\n      "additionalProperties": false,\n      "properties": {\n        "code": {\n          "enum": [\n            "unterminated_fence",\n            "invalid_json",\n            "duplicate_member",\n            "unsupported_version",\n            "schema_violation"\n          ]\n        },\n        "pointer": { "type": "string", "pattern": "^(?:/.*)?$" },\n        "keyword": { "type": "string", "minLength": 1 }\n      }\n    },\n    "block": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "found" },\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "value": { "$ref": "handback-block-0.1.schema.json" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "missing" },\n            "reason": { "const": "block_missing" },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "count", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ambiguous" },\n            "reason": { "const": "block_ambiguous" },\n            "count": { "type": "integer", "minimum": 2 },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "errors", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "invalid" },\n            "reason": { "const": "block_invalid" },\n            "errors": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/blockError" } },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        }\n      ]\n    },\n    "claim": {\n      "type": "object",\n      "required": ["id", "check", "field", "declared", "observed", "verdict"],\n      "additionalProperties": false,\n      "properties": {\n        "id": { "type": "string", "minLength": 1 },\n        "check": { "enum": ["head", "scope", "reference", "count", "time"] },\n        "field": {\n          "description": "A JSON Pointer (RFC 6901) into the block.",\n          "type": "string",\n          "pattern": "^/.+$"\n        },\n        "declared": true,\n        "observed": true,\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "reason": { "$ref": "#/$defs/claimReason" }\n      },\n      "if": { "properties": { "verdict": { "const": "pass" } } },\n      "then": { "not": { "required": ["reason"] } },\n      "else": { "required": ["reason"] }\n    },\n    "claimReason": {\n      "type": "string",\n      "pattern": "^(?:head_mismatch|declared_not_changed|undeclared_file|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|none_failed_mismatch|checks_incomplete|no_check_runs|no_succeeded_check_runs|check_runs_not_at_head|no_comparable_record_field|record_not_found|record_ambiguous|not_merged|premature|no_deployment|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs|workflow_runs|artifact|deployments))$"\n    },\n    "unread": {\n      "description": "A section the checker could not use: its source errored, or the source answered without the field.",\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "source"],\n          "properties": {\n            "status": { "const": "unreadable" },\n            "source": { "$ref": "#/$defs/sourceKind" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "field"],\n          "properties": {\n            "status": { "const": "unpopulated" },\n            "field": { "type": "string", "pattern": "^[A-Za-z0-9_.]+$" }\n          }\n        }\n      ]\n    },\n    "evidence": {\n      "type": "object",\n      "required": ["pullRequest", "sources"],\n      "additionalProperties": false,\n      "properties": {\n        "pullRequest": {\n          "description": "Always read: a checker that cannot read the pull request writes no record.",\n          "type": "object",\n          "required": [\n            "status",\n            "number",\n            "state",\n            "merged",\n            "mergedAt",\n            "headSha",\n            "mergeSha",\n            "changedFiles"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ok" },\n            "number": { "type": "integer", "minimum": 1 },\n            "state": { "enum": ["open", "closed"] },\n            "merged": { "type": "boolean" },\n            "mergedAt": { "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }] },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": { "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }] },\n            "changedFiles": { "type": "integer", "minimum": 0 }\n          }\n        },\n        "files": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "complete", "entries"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "complete": { "type": "boolean" },\n                "entries": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["path", "status"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "path": { "type": "string", "minLength": 1 },\n                      "status": {\n                        "enum": [\n                          "added",\n                          "removed",\n                          "modified",\n                          "renamed",\n                          "copied",\n                          "changed",\n                          "unchanged"\n                        ]\n                      },\n                      "previousPath": { "type": "string", "minLength": 1 }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "closingReferences": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issues"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "references": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "issue" },\n                  "ref": { "$ref": "#/$defs/issueRef" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "resolvedAs": {\n                    "description": "Spec 0.1.3: the owner/repo#N GitHub answered the read of ref with, when it is another issue (an issue transferred to another repository).",\n                    "$ref": "#/$defs/issueRef"\n                  }\n                },\n                "if": { "required": ["resolvedAs"] },\n                "then": { "properties": { "exists": { "const": true } } }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists", "reachableFromHead"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "commit" },\n                  "ref": { "$ref": "#/$defs/commitSha" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "reachableFromHead": { "type": "boolean" }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref"],\n                "properties": {\n                  "kind": { "enum": ["issue", "commit"] },\n                  "ref": { "type": "string", "minLength": 1 }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "closeEvents": {\n          "description": "Spec 0.1.4: who closed each closes target that exists and is not among the closing references, read under the identity it resolves to; and the pull request\'s base, its repository\'s default branch and its commit ids.",\n          "type": "object",\n          "required": ["pullRequest", "targets"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": {\n              "oneOf": [\n                {\n                  "type": "object",\n                  "required": ["status", "baseRef", "defaultBranch", "commits"],\n                  "additionalProperties": false,\n                  "properties": {\n                    "status": { "const": "ok" },\n                    "baseRef": { "type": "string", "minLength": 1 },\n                    "defaultBranch": {\n                      "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }]\n                    },\n                    "commits": {\n                      "type": "array",\n                      "uniqueItems": true,\n                      "items": { "$ref": "#/$defs/commitSha" }\n                    }\n                  }\n                },\n                { "$ref": "#/$defs/unreadOnly" }\n              ]\n            },\n            "targets": {\n              "type": "array",\n              "items": {\n                "oneOf": [\n                  {\n                    "type": "object",\n                    "required": ["ref", "status", "type", "state", "events"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "ref": { "$ref": "#/$defs/issueRef" },\n                      "status": { "const": "ok" },\n                      "type": { "enum": ["issue", "pull_request"] },\n                      "state": { "enum": ["open", "closed", "merged"] },\n                      "events": {\n                        "type": "array",\n                        "items": {\n                          "type": "object",\n                          "required": ["at", "closer"],\n                          "additionalProperties": false,\n                          "properties": {\n                            "at": { "$ref": "#/$defs/timestamp" },\n                            "closer": {\n                              "oneOf": [\n                                { "type": "null" },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "ref"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "pull_request" },\n                                    "ref": { "$ref": "#/$defs/issueRef" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "oid"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "commit" },\n                                    "oid": { "$ref": "#/$defs/commitSha" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind"],\n                                  "additionalProperties": false,\n                                  "properties": { "kind": { "const": "other" } }\n                                }\n                              ]\n                            }\n                          }\n                        }\n                      }\n                    },\n                    "if": { "properties": { "type": { "const": "issue" } } },\n                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }\n                  },\n                  {\n                    "type": "object",\n                    "required": ["ref"],\n                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },\n                    "allOf": [{ "$ref": "#/$defs/unread" }]\n                  }\n                ]\n              }\n            }\n          }\n        },\n        "checkRuns": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "commit", "excludedIds", "runs"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "commit": { "$ref": "#/$defs/commitSha" },\n                "excludedIds": {\n                  "description": "Check runs left out of the count: the run the checker itself executes in.",\n                  "type": "array",\n                  "items": { "type": "integer", "minimum": 1 }\n                },\n                "runs": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["id", "name", "status", "conclusion"],\n                    "additionalProperties": false,\n                    "dependentRequired": {\n                      "workflowPath": ["checkSuiteId", "workflowRunId", "runAttempt"],\n                      "workflowName": ["workflowPath"],\n                      "workflowRunId": ["workflowPath"],\n                      "runAttempt": ["workflowPath"]\n                    },\n                    "properties": {\n                      "id": { "type": "integer", "minimum": 1 },\n                      "name": { "type": "string" },\n                      "status": { "type": "string", "minLength": 1 },\n                      "conclusion": { "type": ["string", "null"] },\n                      "checkSuiteId": {\n                        "description": "The run\'s check suite (`check_suite.id`). A run without `workflowPath` is counted as the latest per check suite and name; a run without either is keyed by its name alone. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "appSlug": {\n                        "description": "The slug of the app that created the run (`app.slug`). Recorded, not read by any check. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowPath": {\n                        "description": "The `path` of the workflow run whose `check_suite_id` is the run\'s check suite, less any `@<ref>`, from the workflow runs at the head. Runs that have it are counted as the latest per workflow path and name. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowName": {\n                        "description": "The `name` of that workflow run, as the listing gives it; absent where the listing gives none, null or the empty string. No 0.1 check reads it. Added in spec 0.1.5.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowRunId": {\n                        "description": "The `id` of that workflow run. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "runAttempt": {\n                        "description": "That workflow run\'s `run_attempt` as the listing gives it, its latest attempt at the read. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "testRecords": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["record", "status", "runs"],\n                "additionalProperties": false,\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" },\n                  "status": { "const": "ok" },\n                  "runs": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["runId", "runAttempt", "executed", "failed"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "runId": { "type": "integer", "minimum": 1 },\n                        "runAttempt": { "type": "integer", "minimum": 1 },\n                        "executed": { "type": "integer", "minimum": 0 },\n                        "failed": { "type": "integer", "minimum": 0 }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["record"],\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "deployments": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["environment", "status", "deployments"],\n                "additionalProperties": false,\n                "properties": {\n                  "environment": { "type": "string", "minLength": 1 },\n                  "status": { "const": "ok" },\n                  "deployments": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["id", "sha", "relation", "successAt"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "id": { "type": "integer", "minimum": 1 },\n                        "sha": { "$ref": "#/$defs/commitSha" },\n                        "relation": {\n                          "enum": ["head", "merge", "descendant", "unrelated", "unknown"]\n                        },\n                        "successAt": {\n                          "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }]\n                        }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["environment"],\n                "properties": { "environment": { "type": "string", "minLength": 1 } },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "sources": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["kind", "locator", "sha256", "readAt"],\n            "additionalProperties": false,\n            "properties": {\n              "kind": { "$ref": "#/$defs/sourceKind" },\n              "locator": { "type": "string", "minLength": 1, "maxLength": 2000 },\n              "sha256": { "$ref": "#/$defs/sha256" },\n              "etag": { "type": "string", "minLength": 1 },\n              "readAt": { "$ref": "#/$defs/timestamp" },\n              "error": {\n                "description": "Present when the read failed: http_<status>, network, or parse.",\n                "type": "string",\n                "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$"\n              }\n            }\n          }\n        }\n      }\n    },\n    "unreadOnly": {\n      "allOf": [{ "$ref": "#/$defs/unread" }],\n      "unevaluatedProperties": false\n    }\n  }\n}\n', "record-0.2-draft.schema.json": `{
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.2-draft.schema.json",
   "title": "Dunstan record, DRAFT 0.2.0",
@@ -10434,7 +10511,7 @@ var FILES = { "handback-block-0.1.schema.json": `{
     "advisoryNote": {
       "description": "agrees when the gate check would pass; differs:<reason> when it would fail; unanswered:<reason> when it would be unverifiable. The reasons are the 0.1 claim reasons. A file claim matched by name only is agrees_by_name, or unanswered:ambiguous_path when more than one changed path has that name. A file claim not among the changed files is unanswered:no_such_path when nothing is at its path at the head, unanswered:directory when a directory is, and unanswered:source_unreadable:path when the answer was not read (D.11.4). Never a verdict.",
       "type": "string",
-      "pattern": "^(?:agrees|agrees_by_name|unanswered:(?:ambiguous_path|no_such_path|directory|source_unreadable:path)|(?:differs|unanswered):(?:head_mismatch|declared_not_changed|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|checks_incomplete|no_check_runs|no_comparable_record_field|not_merged|premature|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs)))$"
+      "pattern": "^(?:agrees|agrees_by_name|unanswered:(?:ambiguous_path|no_such_path|directory|source_unreadable:path|check_runs_not_at_head)|(?:differs|unanswered):(?:head_mismatch|declared_not_changed|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|checks_incomplete|no_check_runs|no_comparable_record_field|not_merged|premature|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs)))$"
     },
     "readerReason": {
       "type": "string",
@@ -10748,9 +10825,14 @@ import { parseArgs } from "node:util";
 
 // src/evidence/http.ts
 var DEFAULT_API = "https://api.github.com";
+var MAX_ARCHIVE_BYTES = MAX_ENTRY_BYTES + 8 * 1024 * 1024;
+var MAX_BODY_BYTES = 48 * 1024 * 1024;
 var EMPTY = new Uint8Array();
 var GitHubClient = class {
   sources = /* @__PURE__ */ new Map();
+  maxArchiveBytes;
+  maxEntryBytes;
+  #allocate;
   #token;
   #baseUrl;
   #fetch;
@@ -10769,6 +10851,9 @@ var GitHubClient = class {
 `));
     this.#maxAttempts = options.maxAttempts ?? 4;
     this.#maxWaitMs = options.maxWaitMs ?? 6e4;
+    this.maxArchiveBytes = options.maxArchiveBytes ?? MAX_ARCHIVE_BYTES;
+    this.maxEntryBytes = options.maxEntryBytes ?? MAX_ENTRY_BYTES;
+    this.#allocate = options.allocate ?? ((size) => new Uint8Array(size));
   }
   get hasToken() {
     return this.#token !== void 0 && this.#token !== "";
@@ -10784,10 +10869,19 @@ var GitHubClient = class {
   async read(kind, path, options = {}) {
     const method = options.method ?? "GET";
     const locator = options.locator ?? `${method} ${path}${options.locatorSuffix ?? ""}`;
-    const result = await this.#fetchWithRetry(method, path, options.requestBody, locator);
+    const budget = kind === "artifact" ? this.maxArchiveBytes : MAX_BODY_BYTES;
+    const result = await this.#fetchWithRetry(method, path, options.requestBody, locator, budget);
     let read;
     if (result.kind === "network") {
       read = { ok: false, status: null, error: "network", body: EMPTY };
+    } else if (result.body === null) {
+      const failed = result.status < 200 || result.status > 299;
+      read = {
+        ok: false,
+        status: result.status,
+        error: failed ? `http_${result.status}` : "parse",
+        body: EMPTY
+      };
     } else if (result.status < 200 || result.status > 299) {
       read = {
         ok: false,
@@ -10824,7 +10918,7 @@ var GitHubClient = class {
     const source = this.sources.get(locator);
     if (source !== void 0) source.error = "parse";
   }
-  async #fetchWithRetry(method, path, body, locator) {
+  async #fetchWithRetry(method, path, body, locator, budget) {
     const headers = {
       accept: "application/vnd.github+json",
       "x-github-api-version": "2022-11-28",
@@ -10849,10 +10943,10 @@ var GitHubClient = class {
         this.#warn(`${locator}: network error after ${attempt} attempts (${e.message})`);
         return { kind: "network" };
       }
-      const bytes = new Uint8Array(await response.arrayBuffer());
       const status = response.status;
       const wait = retryWaitMs(response, status, this.#now(), attempt);
       if (wait !== void 0 && attempt < this.#maxAttempts && wait <= this.#maxWaitMs) {
+        await cancel(response.body);
         await this.#sleep(wait);
         continue;
       }
@@ -10860,10 +10954,52 @@ var GitHubClient = class {
         const why = wait > this.#maxWaitMs ? `rate limited for ${Math.ceil(wait / 1e3)}s` : `${attempt} attempts`;
         this.#warn(`${locator}: giving up with HTTP ${status} (${why}); recorded as unreadable`);
       }
+      const bytes = await readWithin(response, budget, this.#allocate);
+      if (bytes === null) {
+        this.#warn(
+          `${locator}: answer over ${budget} bytes, not read in full; recorded as unreadable`
+        );
+      }
       return { kind: "response", status, body: bytes, etag: response.headers.get("etag") };
     }
   }
 };
+async function cancel(body) {
+  await body?.cancel().catch(() => {
+  });
+}
+var FIRST_CAPACITY = 64 * 1024;
+async function readWithin(response, budget, allocate) {
+  const length = response.headers.get("content-length");
+  const declared = length !== null && /^[0-9]+$/.test(length) ? Number(length) : null;
+  if (declared !== null && declared > budget) {
+    await cancel(response.body);
+    return null;
+  }
+  if (response.body === null) return EMPTY;
+  const reader = response.body.getReader();
+  let bytes = EMPTY;
+  let size = 0;
+  for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read()) {
+    const needed = size + chunk.value.length;
+    if (needed > budget) {
+      await reader.cancel().catch(() => {
+      });
+      return null;
+    }
+    if (needed > bytes.length) {
+      let capacity = Math.max(needed, 2 * bytes.length, FIRST_CAPACITY);
+      if (2 * capacity > budget) capacity = budget;
+      if (bytes === EMPTY && declared !== null && declared >= needed) capacity = declared;
+      const grown = allocate(capacity);
+      grown.set(bytes.subarray(0, size));
+      bytes = grown;
+    }
+    bytes.set(chunk.value, size);
+    size = needed;
+  }
+  return size === bytes.length ? bytes : bytes.subarray(0, size);
+}
 function backoffMs(attempt) {
   return Math.min(1e3 * 2 ** (attempt - 1), 8e3);
 }
@@ -13094,13 +13230,34 @@ function serializeRecord(record2) {
 // src/pipeline/check-pull-request.ts
 function githubReaders(client) {
   return {
-    pullRequest: (repository, number4) => readPullRequest(client, repository, number4),
+    pullRequest: (repository, number4, options) => readPullRequest(client, repository, number4, options),
     evidence: (input2) => readEvidence(client, input2),
-    pathObjects: (input2) => readPathObjects(client, input2)
+    pathObjects: (input2) => readPathObjects(client, input2),
+    restart: () => client.sources.clear()
   };
 }
+async function atOnePullRequest(readers, repository, number4, first, collect) {
+  let pr = first ?? await readers.pullRequest(repository, number4);
+  for (let run = 1; ; run++) {
+    const collected = await collect(pr);
+    const again = await readers.pullRequest(repository, number4, { record: false });
+    const moves = pullRequestMoves(pr, again);
+    if (moves.length === 0) return collected;
+    if (run === 2) throw new PullRequestMoved(repository, number4, moves);
+    readers.restart?.();
+    pr = await readers.pullRequest(repository, number4);
+  }
+}
 async function checkPullRequest(input2) {
-  const pr = input2.pullRequest ?? await input2.readers.pullRequest(input2.repository, input2.number);
+  return atOnePullRequest(
+    input2.readers,
+    input2.repository,
+    input2.number,
+    input2.pullRequest,
+    (pr) => checkAt(input2, pr)
+  );
+}
+async function checkAt(input2, pr) {
   const repository = pr.repository;
   const ownRuns = await input2.afterPullRequest?.(pr) ?? [];
   const report = await input2.report(pr);
@@ -40734,7 +40891,7 @@ var Protocol = class {
           }
         };
       }
-      const cancel = (reason) => {
+      const cancel2 = (reason) => {
         this._responseHandlers.delete(messageId);
         this._progressHandlers.delete(messageId);
         this._cleanupTimeout(messageId);
@@ -40768,10 +40925,10 @@ var Protocol = class {
         }
       });
       options?.signal?.addEventListener("abort", () => {
-        cancel(options?.signal?.reason);
+        cancel2(options?.signal?.reason);
       });
       const timeout = options?.timeout ?? DEFAULT_REQUEST_TIMEOUT_MSEC;
-      const timeoutHandler = () => cancel(McpError.fromError(ErrorCode.RequestTimeout, "Request timed out", { timeout }));
+      const timeoutHandler = () => cancel2(McpError.fromError(ErrorCode.RequestTimeout, "Request timed out", { timeout }));
       this._setupTimeout(messageId, timeout, options?.maxTotalTimeout, timeoutHandler, options?.resetTimeoutOnProgress ?? false);
       const relatedTaskId = relatedTask?.taskId;
       if (relatedTaskId) {
@@ -42966,7 +43123,7 @@ function handbackResult(record2, outPath, notes) {
   };
 }
 function toolError(error62) {
-  const known = error62 instanceof InputError || error62 instanceof PullRequestUnreadable || error62 instanceof CanonicalizationError || typeof error62.code === "string";
+  const known = error62 instanceof InputError || error62 instanceof PullRequestUnreadable || error62 instanceof PullRequestMoved || error62 instanceof CanonicalizationError || typeof error62.code === "string";
   const message = error62.message ?? String(error62);
   return {
     isError: true,
@@ -43105,14 +43262,20 @@ async function rerun(args, io) {
     warn: (message) => io.err(`dunstan: ${message}
 `)
   });
-  const pr = await readPullRequest(client, old.subject.repository, old.subject.pullRequest);
   const oldExcluded = old.evidence.checkRuns?.status === "ok" ? old.evidence.checkRuns.excludedIds : [];
-  const evidence = await readEvidence(client, {
-    repository: old.subject.repository,
-    pullRequest: pr,
-    block: old.block.status === "found" ? old.block.value : null,
-    excludedCheckRunIds: [...oldExcluded, ...parseCheckRunIds(values["exclude-check-run"])]
-  });
+  const excluded = [...oldExcluded, ...parseCheckRunIds(values["exclude-check-run"])];
+  const evidence = await atOnePullRequest(
+    githubReaders(client),
+    old.subject.repository,
+    old.subject.pullRequest,
+    void 0,
+    (pr) => readEvidence(client, {
+      repository: old.subject.repository,
+      pullRequest: pr,
+      block: old.block.status === "found" ? old.block.value : null,
+      excludedCheckRunIds: excluded
+    })
+  );
   const record2 = buildRecord({
     checker: checkerIdentity(io.artifact),
     report: old.report,
@@ -43473,7 +43636,7 @@ async function main(argv, io) {
       io.err(`dunstan: ${e.message}
 
 ${USAGE}`);
-    } else if (e instanceof PullRequestUnreadable || e instanceof ReportUnavailable || e instanceof TemplateError) {
+    } else if (e instanceof PullRequestUnreadable || e instanceof PullRequestMoved || e instanceof ReportUnavailable || e instanceof TemplateError) {
       io.err(`dunstan: ${e.message}
 `);
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dunstan",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "mcpName": "io.github.BargLabs/dunstan",
   "description": "Holds a coding agent's completion report to the record: deterministic checks of a declared handback block against the repository's own metadata.",
   "license": "AGPL-3.0-only",