dunstan 0.1.11 → 0.1.13

package/README.md

@@ -29,7 +29,7 @@ report a pull request's handback before it says done ([`plugins/dunstan/`](plugi
 /plugin install dunstan@barglabs
 ```
 
-The plugin runs the MCP server with `npx -y dunstan@0.1.11 mcp`, the `dunstan` npm package at that
+The plugin runs the MCP server with `npx -y dunstan@0.1.13 mcp`, the `dunstan` npm package at that
 exact version: one self-contained file, no dependencies.
 
 **The token.** When you enable the plugin, Claude Code asks for an optional GitHub token and keeps it

package/dist/dunstan.mjs

@@ -8030,7 +8030,7 @@ import { readFileSync as readFileSync7 } from "node:fs";
 import { createHash } from "node:crypto";
 
 // src/spec/constants.ts
-var SPEC_VERSION = "0.1.7";
+var SPEC_VERSION = "0.1.8";
 var BLOCK_VERSION = "0.1";
 var SUPPORTED_BLOCK_VERSIONS = [BLOCK_VERSION];
 var BLOCK_INFO_STRING = "dunstan-handback";
@@ -8639,6 +8639,7 @@ function checkChecks(block, evidence) {
   let reason;
   if (section === void 0) reason = absentSection("checkRuns");
   else if (section.status !== "ok") reason = unreadReason(section);
+  else if (section.commit !== evidence.pullRequest.headSha) reason = "check_runs_not_at_head";
   const runs = section !== void 0 && section.status === "ok" ? countedCheckRuns(section.runs, section.excludedIds) : [];
   if (checks.total !== void 0) {
     const field = "/checks/total";
@@ -8880,7 +8881,7 @@ function findEndOfCentralDirectory(bytes) {
   }
   throw new ZipError("no end of central directory record");
 }
-function readZipEntry(bytes, path) {
+function readZipEntry(bytes, path, limit = MAX_ENTRY_BYTES) {
   if (bytes.length < 22) throw new ZipError("archive too short");
   const dv = view(bytes);
   const eocd = findEndOfCentralDirectory(bytes);
@@ -8905,7 +8906,7 @@ function readZipEntry(bytes, path) {
     if (compressedSize === 4294967295 || size === 4294967295 || localOffset === 4294967295) {
       throw new ZipError("ZIP64 is not supported");
     }
-    if (size > MAX_ENTRY_BYTES) throw new ZipError(`entry larger than ${MAX_ENTRY_BYTES} bytes`);
+    if (size > limit) throw new ZipError(`entry larger than ${limit} bytes`);
     if (localOffset + 30 > bytes.length || dv.getUint32(localOffset, true) !== LOCAL) {
       throw new ZipError("bad local file header");
     }
@@ -8916,7 +8917,8 @@ function readZipEntry(bytes, path) {
     if (method === 0) return data;
     if (method === 8) {
       try {
-        return new Uint8Array(inflateRawSync(data, { maxOutputLength: MAX_ENTRY_BYTES }));
+        const out = inflateRawSync(data, { maxOutputLength: limit });
+        return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
       } catch (e) {
         throw new ZipError(`cannot inflate ${path}: ${e.message}`);
       }
@@ -8979,6 +8981,9 @@ function timestamp(value) {
   }
   return text;
 }
+function timestampOrNull(value) {
+  return value === null || value === void 0 ? null : timestamp(value);
+}
 function second(t) {
   return t.slice(0, 19);
 }
@@ -9572,6 +9577,13 @@ async function readWorkflowRunsAt(client, repository, commit) {
   }
   return bySuite;
 }
+function withinLatestAttempt(jobs, run, createdAt) {
+  if (createdAt === null) return false;
+  const created = second(createdAt);
+  return jobs.some(
+    (job) => (job.attempt === null || job.attempt <= run.attempt) && job.startedAt !== null && job.completedAt !== null && second(job.startedAt) <= created && created <= second(job.completedAt)
+  );
+}
 async function readTestRecord(client, repository, record2, headCommit) {
   const workflowFile = record2.workflow.split("/").at(-1);
   const runsPath = (page) => `/repos/${repository}/actions/workflows/${encodeURIComponent(workflowFile)}/runs?head_sha=${headCommit}&per_page=${PER_PAGE}&page=${page}`;
@@ -9595,10 +9607,24 @@ async function readTestRecord(client, repository, record2, headCommit) {
       "workflow_runs",
       (page) => `/repos/${repository}/actions/runs/${run.id}/jobs?filter=latest&per_page=${PER_PAGE}&page=${page}`,
       (json2) => arr(obj(json2).jobs),
-      (item) => str(obj(item).name)
+      (item) => {
+        const j = obj(item);
+        let attempt = null;
+        if (j.run_attempt !== null && j.run_attempt !== void 0) {
+          attempt = int(j.run_attempt);
+          if (attempt < 1) throw new ShapeError();
+        }
+        return {
+          name: str(j.name),
+          attempt,
+          startedAt: timestampOrNull(j.started_at),
+          completedAt: timestampOrNull(j.completed_at)
+        };
+      }
     );
     if (jobs === null) return { record: record2, ...unreadable("workflow_runs") };
-    if (!jobs.includes(record2.job)) continue;
+    const named = jobs.filter((j) => j.name === record2.job);
+    if (named.length === 0) continue;
     const artifacts = await readAllPages(
       client,
       "workflow_runs",
@@ -9606,15 +9632,23 @@ async function readTestRecord(client, repository, record2, headCommit) {
       (json2) => arr(obj(json2).artifacts),
       (item) => {
         const a = obj(item);
-        return { id: int(a.id), name: str(a.name), expired: a.expired === true };
+        return {
+          id: int(a.id),
+          name: str(a.name),
+          expired: a.expired === true,
+          createdAt: timestampOrNull(a.created_at)
+        };
       }
     );
     if (artifacts === null) return { record: record2, ...unreadable("workflow_runs") };
-    const named = artifacts.filter((a) => a.name === record2.artifact).sort((a, b) => a.id - b.id);
-    if (named.length === 0) continue;
-    if (named.length > 1) return { record: record2, ...unreadable("artifact") };
-    const artifact = named[0];
+    const uploaded = artifacts.filter((a) => a.name === record2.artifact).sort((a, b) => a.id - b.id);
+    if (uploaded.length === 0) continue;
+    if (uploaded.length > 1) return { record: record2, ...unreadable("artifact") };
+    const artifact = uploaded[0];
     if (artifact.expired) return { record: record2, ...unreadable("artifact") };
+    if (!withinLatestAttempt(named, run, artifact.createdAt)) {
+      return { record: record2, ...unreadable("artifact") };
+    }
     const zipPath = `/repos/${repository}/actions/artifacts/${artifact.id}/zip`;
     const download = await client.read("artifact", zipPath, {
       json: false,
@@ -9622,7 +9656,7 @@ async function readTestRecord(client, repository, record2, headCommit) {
     });
     if (!download.ok) return { record: record2, ...unreadable("artifact") };
     try {
-      const file2 = readZipEntry(download.body, record2.path);
+      const file2 = readZipEntry(download.body, record2.path, client.maxEntryBytes);
       if (file2 === null) continue;
       const counts = countJunit(new TextDecoder("utf-8").decode(file2));
       runs.push({ runId: run.id, runAttempt: run.attempt, ...counts });
@@ -9818,7 +9852,7 @@ async function reportFromComment(client, repository, number4, login) {
 // src/record/checker.ts
 import { readFileSync } from "node:fs";
 var CHECKER_NAME = "dunstan";
-var CHECKER_VERSION = "0.1.11";
+var CHECKER_VERSION = "0.1.13";
 function checkerIdentity(artifact) {
   return {
     name: CHECKER_NAME,
@@ -9995,7 +10029,7 @@ var FILES = { "handback-block-0.1.schema.json": `{
     }
   }
 }
-`, "record-0.1.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.1.schema.json",\n  "title": "Dunstan record, v0.1",\n  "description": "An in-toto Statement v1 whose predicate records one check of a handback block against the record. See spec/claim-format.md.",\n  "type": "object",\n  "required": ["_type", "subject", "predicateType", "predicate"],\n  "additionalProperties": false,\n  "properties": {\n    "_type": { "const": "https://in-toto.io/Statement/v1" },\n    "subject": {\n      "type": "array",\n      "minItems": 1,\n      "maxItems": 2,\n      "prefixItems": [{ "$ref": "#/$defs/commitSubject" }, { "$ref": "#/$defs/blockSubject" }],\n      "items": false\n    },\n    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1" },\n    "predicate": { "$ref": "#/$defs/predicate" }\n  },\n  "allOf": [\n    {\n      "if": {\n        "properties": {\n          "predicate": {\n            "properties": { "block": { "properties": { "status": { "const": "found" } } } }\n          }\n        }\n      },\n      "then": { "properties": { "subject": { "minItems": 2 } } },\n      "else": { "properties": { "subject": { "maxItems": 1 } } }\n    }\n  ],\n  "$defs": {\n    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },\n    "commitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },\n    "repository": {\n      "description": "owner/repo",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$"\n    },\n    "issueRef": {\n      "description": "owner/repo#N, always fully qualified in evidence.",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,9}$"\n    },\n    "timestamp": {\n      "type": "string",\n      "format": "date-time",\n      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\\\.[0-9]+)?Z$"\n    },\n    "sourceKind": {\n      "enum": [\n        "pull_request",\n        "pull_request_files",\n        "pull_request_commits",\n        "closing_references",\n        "repository",\n        "issue",\n        "commit",\n        "compare",\n        "check_runs",\n        "workflow_runs",\n        "artifact",\n        "deployments"\n      ]\n    },\n    "commitSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": {\n          "type": "string",\n          "pattern": "^git\\\\+https://github\\\\.com/[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}@[0-9a-f]{40}$"\n        },\n        "digest": {\n          "type": "object",\n          "required": ["gitCommit"],\n          "additionalProperties": false,\n          "properties": { "gitCommit": { "$ref": "#/$defs/commitSha" } }\n        }\n      }\n    },\n    "blockSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": { "const": "handback-block" },\n        "digest": {\n          "type": "object",\n          "required": ["sha256"],\n          "additionalProperties": false,\n          "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n        }\n      }\n    },\n    "predicate": {\n      "type": "object",\n      "required": [\n        "spec",\n        "checker",\n        "report",\n        "block",\n        "subject",\n        "evidence",\n        "claims",\n        "verdict",\n        "digests",\n        "rerun",\n        "assurance"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "spec": {\n          "description": "The spec version the checker implements, semver.",\n          "type": "string",\n          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)$"\n        },\n        "checker": {\n          "type": "object",\n          "required": ["name", "version", "digest"],\n          "additionalProperties": false,\n          "properties": {\n            "name": { "type": "string", "minLength": 1, "maxLength": 214 },\n            "version": { "type": "string", "minLength": 1, "maxLength": 100 },\n            "digest": {\n              "type": "object",\n              "required": ["sha256"],\n              "additionalProperties": false,\n              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n            }\n          }\n        },\n        "report": {\n          "description": "The report\'s digest and where it was read. Never its text.",\n          "type": "object",\n          "required": ["sha256", "source"],\n          "additionalProperties": false,\n          "properties": {\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "source": {\n              "type": "object",\n              "required": ["kind", "locator"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "enum": ["pr-body", "pr-comment", "file", "stdin", "api"] },\n                "locator": { "type": "string", "minLength": 1, "maxLength": 2000 }\n              }\n            }\n          }\n        },\n        "block": { "$ref": "#/$defs/block" },\n        "subject": {\n          "type": "object",\n          "required": ["repository", "pullRequest", "headSha", "mergeSha"],\n          "additionalProperties": false,\n          "properties": {\n            "repository": { "$ref": "#/$defs/repository" },\n            "pullRequest": { "type": "integer", "minimum": 1 },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": {\n              "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }]\n            }\n          }\n        },\n        "evidence": { "$ref": "#/$defs/evidence" },\n        "claims": {\n          "type": "array",\n          "items": { "$ref": "#/$defs/claim" }\n        },\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "digests": {\n          "type": "object",\n          "required": ["claims", "evidence"],\n          "additionalProperties": false,\n          "properties": {\n            "claims": { "$ref": "#/$defs/sha256" },\n            "evidence": { "$ref": "#/$defs/sha256" }\n          }\n        },\n        "rerun": {\n          "type": "object",\n          "required": ["offline", "online"],\n          "additionalProperties": false,\n          "properties": {\n            "offline": { "type": "string", "minLength": 1, "maxLength": 2000 },\n            "online": { "type": "string", "minLength": 1, "maxLength": 2000 }\n          }\n        },\n        "assurance": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issuer"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "unsigned" },\n                "issuer": { "const": "self-generated" }\n              }\n            },\n            {\n              "type": "object",\n              "required": ["status", "issuer", "keyFingerprint"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "signed" },\n                "issuer": { "type": "string", "minLength": 1, "maxLength": 320 },\n                "keyFingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]{43}$" }\n              }\n            }\n          ]\n        }\n      }\n    },\n    "verdict": { "enum": ["pass", "fail", "unverifiable"] },\n    "blockError": {\n      "type": "object",\n      "required": ["code"],\n      "additionalProperties": false,\n      "properties": {\n        "code": {\n          "enum": [\n            "unterminated_fence",\n            "invalid_json",\n            "duplicate_member",\n            "unsupported_version",\n            "schema_violation"\n          ]\n        },\n        "pointer": { "type": "string", "pattern": "^(?:/.*)?$" },\n        "keyword": { "type": "string", "minLength": 1 }\n      }\n    },\n    "block": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "found" },\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "value": { "$ref": "handback-block-0.1.schema.json" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "missing" },\n            "reason": { "const": "block_missing" },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "count", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ambiguous" },\n            "reason": { "const": "block_ambiguous" },\n            "count": { "type": "integer", "minimum": 2 },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "errors", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "invalid" },\n            "reason": { "const": "block_invalid" },\n            "errors": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/blockError" } },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        }\n      ]\n    },\n    "claim": {\n      "type": "object",\n      "required": ["id", "check", "field", "declared", "observed", "verdict"],\n      "additionalProperties": false,\n      "properties": {\n        "id": { "type": "string", "minLength": 1 },\n        "check": { "enum": ["head", "scope", "reference", "count", "time"] },\n        "field": {\n          "description": "A JSON Pointer (RFC 6901) into the block.",\n          "type": "string",\n          "pattern": "^/.+$"\n        },\n        "declared": true,\n        "observed": true,\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "reason": { "$ref": "#/$defs/claimReason" }\n      },\n      "if": { "properties": { "verdict": { "const": "pass" } } },\n      "then": { "not": { "required": ["reason"] } },\n      "else": { "required": ["reason"] }\n    },\n    "claimReason": {\n      "type": "string",\n      "pattern": "^(?:head_mismatch|declared_not_changed|undeclared_file|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|none_failed_mismatch|checks_incomplete|no_check_runs|no_succeeded_check_runs|no_comparable_record_field|record_not_found|record_ambiguous|not_merged|premature|no_deployment|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs|workflow_runs|artifact|deployments))$"\n    },\n    "unread": {\n      "description": "A section the checker could not use: its source errored, or the source answered without the field.",\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "source"],\n          "properties": {\n            "status": { "const": "unreadable" },\n            "source": { "$ref": "#/$defs/sourceKind" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "field"],\n          "properties": {\n            "status": { "const": "unpopulated" },\n            "field": { "type": "string", "pattern": "^[A-Za-z0-9_.]+$" }\n          }\n        }\n      ]\n    },\n    "evidence": {\n      "type": "object",\n      "required": ["pullRequest", "sources"],\n      "additionalProperties": false,\n      "properties": {\n        "pullRequest": {\n          "description": "Always read: a checker that cannot read the pull request writes no record.",\n          "type": "object",\n          "required": [\n            "status",\n            "number",\n            "state",\n            "merged",\n            "mergedAt",\n            "headSha",\n            "mergeSha",\n            "changedFiles"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ok" },\n            "number": { "type": "integer", "minimum": 1 },\n            "state": { "enum": ["open", "closed"] },\n            "merged": { "type": "boolean" },\n            "mergedAt": { "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }] },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": { "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }] },\n            "changedFiles": { "type": "integer", "minimum": 0 }\n          }\n        },\n        "files": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "complete", "entries"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "complete": { "type": "boolean" },\n                "entries": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["path", "status"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "path": { "type": "string", "minLength": 1 },\n                      "status": {\n                        "enum": [\n                          "added",\n                          "removed",\n                          "modified",\n                          "renamed",\n                          "copied",\n                          "changed",\n                          "unchanged"\n                        ]\n                      },\n                      "previousPath": { "type": "string", "minLength": 1 }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "closingReferences": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issues"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "references": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "issue" },\n                  "ref": { "$ref": "#/$defs/issueRef" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "resolvedAs": {\n                    "description": "Spec 0.1.3: the owner/repo#N GitHub answered the read of ref with, when it is another issue (an issue transferred to another repository).",\n                    "$ref": "#/$defs/issueRef"\n                  }\n                },\n                "if": { "required": ["resolvedAs"] },\n                "then": { "properties": { "exists": { "const": true } } }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists", "reachableFromHead"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "commit" },\n                  "ref": { "$ref": "#/$defs/commitSha" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "reachableFromHead": { "type": "boolean" }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref"],\n                "properties": {\n                  "kind": { "enum": ["issue", "commit"] },\n                  "ref": { "type": "string", "minLength": 1 }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "closeEvents": {\n          "description": "Spec 0.1.4: who closed each closes target that exists and is not among the closing references, read under the identity it resolves to; and the pull request\'s base, its repository\'s default branch and its commit ids.",\n          "type": "object",\n          "required": ["pullRequest", "targets"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": {\n              "oneOf": [\n                {\n                  "type": "object",\n                  "required": ["status", "baseRef", "defaultBranch", "commits"],\n                  "additionalProperties": false,\n                  "properties": {\n                    "status": { "const": "ok" },\n                    "baseRef": { "type": "string", "minLength": 1 },\n                    "defaultBranch": {\n                      "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }]\n                    },\n                    "commits": {\n                      "type": "array",\n                      "uniqueItems": true,\n                      "items": { "$ref": "#/$defs/commitSha" }\n                    }\n                  }\n                },\n                { "$ref": "#/$defs/unreadOnly" }\n              ]\n            },\n            "targets": {\n              "type": "array",\n              "items": {\n                "oneOf": [\n                  {\n                    "type": "object",\n                    "required": ["ref", "status", "type", "state", "events"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "ref": { "$ref": "#/$defs/issueRef" },\n                      "status": { "const": "ok" },\n                      "type": { "enum": ["issue", "pull_request"] },\n                      "state": { "enum": ["open", "closed", "merged"] },\n                      "events": {\n                        "type": "array",\n                        "items": {\n                          "type": "object",\n                          "required": ["at", "closer"],\n                          "additionalProperties": false,\n                          "properties": {\n                            "at": { "$ref": "#/$defs/timestamp" },\n                            "closer": {\n                              "oneOf": [\n                                { "type": "null" },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "ref"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "pull_request" },\n                                    "ref": { "$ref": "#/$defs/issueRef" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "oid"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "commit" },\n                                    "oid": { "$ref": "#/$defs/commitSha" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind"],\n                                  "additionalProperties": false,\n                                  "properties": { "kind": { "const": "other" } }\n                                }\n                              ]\n                            }\n                          }\n                        }\n                      }\n                    },\n                    "if": { "properties": { "type": { "const": "issue" } } },\n                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }\n                  },\n                  {\n                    "type": "object",\n                    "required": ["ref"],\n                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },\n                    "allOf": [{ "$ref": "#/$defs/unread" }]\n                  }\n                ]\n              }\n            }\n          }\n        },\n        "checkRuns": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "commit", "excludedIds", "runs"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "commit": { "$ref": "#/$defs/commitSha" },\n                "excludedIds": {\n                  "description": "Check runs left out of the count: the run the checker itself executes in.",\n                  "type": "array",\n                  "items": { "type": "integer", "minimum": 1 }\n                },\n                "runs": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["id", "name", "status", "conclusion"],\n                    "additionalProperties": false,\n                    "dependentRequired": {\n                      "workflowPath": ["checkSuiteId", "workflowRunId", "runAttempt"],\n                      "workflowName": ["workflowPath"],\n                      "workflowRunId": ["workflowPath"],\n                      "runAttempt": ["workflowPath"]\n                    },\n                    "properties": {\n                      "id": { "type": "integer", "minimum": 1 },\n                      "name": { "type": "string" },\n                      "status": { "type": "string", "minLength": 1 },\n                      "conclusion": { "type": ["string", "null"] },\n                      "checkSuiteId": {\n                        "description": "The run\'s check suite (`check_suite.id`). A run without `workflowPath` is counted as the latest per check suite and name; a run without either is keyed by its name alone. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "appSlug": {\n                        "description": "The slug of the app that created the run (`app.slug`). Recorded, not read by any check. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowPath": {\n                        "description": "The `path` of the workflow run whose `check_suite_id` is the run\'s check suite, less any `@<ref>`, from the workflow runs at the head. Runs that have it are counted as the latest per workflow path and name. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowName": {\n                        "description": "The `name` of that workflow run, as the listing gives it; absent where the listing gives none, null or the empty string. No 0.1 check reads it. Added in spec 0.1.5.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowRunId": {\n                        "description": "The `id` of that workflow run. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "runAttempt": {\n                        "description": "That workflow run\'s `run_attempt` as the listing gives it, its latest attempt at the read. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "testRecords": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["record", "status", "runs"],\n                "additionalProperties": false,\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" },\n                  "status": { "const": "ok" },\n                  "runs": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["runId", "runAttempt", "executed", "failed"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "runId": { "type": "integer", "minimum": 1 },\n                        "runAttempt": { "type": "integer", "minimum": 1 },\n                        "executed": { "type": "integer", "minimum": 0 },\n                        "failed": { "type": "integer", "minimum": 0 }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["record"],\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "deployments": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["environment", "status", "deployments"],\n                "additionalProperties": false,\n                "properties": {\n                  "environment": { "type": "string", "minLength": 1 },\n                  "status": { "const": "ok" },\n                  "deployments": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["id", "sha", "relation", "successAt"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "id": { "type": "integer", "minimum": 1 },\n                        "sha": { "$ref": "#/$defs/commitSha" },\n                        "relation": {\n                          "enum": ["head", "merge", "descendant", "unrelated", "unknown"]\n                        },\n                        "successAt": {\n                          "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }]\n                        }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["environment"],\n                "properties": { "environment": { "type": "string", "minLength": 1 } },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "sources": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["kind", "locator", "sha256", "readAt"],\n            "additionalProperties": false,\n            "properties": {\n              "kind": { "$ref": "#/$defs/sourceKind" },\n              "locator": { "type": "string", "minLength": 1, "maxLength": 2000 },\n              "sha256": { "$ref": "#/$defs/sha256" },\n              "etag": { "type": "string", "minLength": 1 },\n              "readAt": { "$ref": "#/$defs/timestamp" },\n              "error": {\n                "description": "Present when the read failed: http_<status>, network, or parse.",\n                "type": "string",\n                "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$"\n              }\n            }\n          }\n        }\n      }\n    },\n    "unreadOnly": {\n      "allOf": [{ "$ref": "#/$defs/unread" }],\n      "unevaluatedProperties": false\n    }\n  }\n}\n', "record-0.2-draft.schema.json": `{
+`, "record-0.1.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.1.schema.json",\n  "title": "Dunstan record, v0.1",\n  "description": "An in-toto Statement v1 whose predicate records one check of a handback block against the record. See spec/claim-format.md.",\n  "type": "object",\n  "required": ["_type", "subject", "predicateType", "predicate"],\n  "additionalProperties": false,\n  "properties": {\n    "_type": { "const": "https://in-toto.io/Statement/v1" },\n    "subject": {\n      "type": "array",\n      "minItems": 1,\n      "maxItems": 2,\n      "prefixItems": [{ "$ref": "#/$defs/commitSubject" }, { "$ref": "#/$defs/blockSubject" }],\n      "items": false\n    },\n    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1" },\n    "predicate": { "$ref": "#/$defs/predicate" }\n  },\n  "allOf": [\n    {\n      "if": {\n        "properties": {\n          "predicate": {\n            "properties": { "block": { "properties": { "status": { "const": "found" } } } }\n          }\n        }\n      },\n      "then": { "properties": { "subject": { "minItems": 2 } } },\n      "else": { "properties": { "subject": { "maxItems": 1 } } }\n    }\n  ],\n  "$defs": {\n    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },\n    "commitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },\n    "repository": {\n      "description": "owner/repo",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$"\n    },\n    "issueRef": {\n      "description": "owner/repo#N, always fully qualified in evidence.",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,9}$"\n    },\n    "timestamp": {\n      "type": "string",\n      "format": "date-time",\n      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\\\.[0-9]+)?Z$"\n    },\n    "sourceKind": {\n      "enum": [\n        "pull_request",\n        "pull_request_files",\n        "pull_request_commits",\n        "closing_references",\n        "repository",\n        "issue",\n        "commit",\n        "compare",\n        "check_runs",\n        "workflow_runs",\n        "artifact",\n        "deployments"\n      ]\n    },\n    "commitSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": {\n          "type": "string",\n          "pattern": "^git\\\\+https://github\\\\.com/[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}@[0-9a-f]{40}$"\n        },\n        "digest": {\n          "type": "object",\n          "required": ["gitCommit"],\n          "additionalProperties": false,\n          "properties": { "gitCommit": { "$ref": "#/$defs/commitSha" } }\n        }\n      }\n    },\n    "blockSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": { "const": "handback-block" },\n        "digest": {\n          "type": "object",\n          "required": ["sha256"],\n          "additionalProperties": false,\n          "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n        }\n      }\n    },\n    "predicate": {\n      "type": "object",\n      "required": [\n        "spec",\n        "checker",\n        "report",\n        "block",\n        "subject",\n        "evidence",\n        "claims",\n        "verdict",\n        "digests",\n        "rerun",\n        "assurance"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "spec": {\n          "description": "The spec version the checker implements, semver.",\n          "type": "string",\n          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)$"\n        },\n        "checker": {\n          "type": "object",\n          "required": ["name", "version", "digest"],\n          "additionalProperties": false,\n          "properties": {\n            "name": { "type": "string", "minLength": 1, "maxLength": 214 },\n            "version": { "type": "string", "minLength": 1, "maxLength": 100 },\n            "digest": {\n              "type": "object",\n              "required": ["sha256"],\n              "additionalProperties": false,\n              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n            }\n          }\n        },\n        "report": {\n          "description": "The report\'s digest and where it was read. Never its text.",\n          "type": "object",\n          "required": ["sha256", "source"],\n          "additionalProperties": false,\n          "properties": {\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "source": {\n              "type": "object",\n              "required": ["kind", "locator"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "enum": ["pr-body", "pr-comment", "file", "stdin", "api"] },\n                "locator": { "type": "string", "minLength": 1, "maxLength": 2000 }\n              }\n            }\n          }\n        },\n        "block": { "$ref": "#/$defs/block" },\n        "subject": {\n          "type": "object",\n          "required": ["repository", "pullRequest", "headSha", "mergeSha"],\n          "additionalProperties": false,\n          "properties": {\n            "repository": { "$ref": "#/$defs/repository" },\n            "pullRequest": { "type": "integer", "minimum": 1 },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": {\n              "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }]\n            }\n          }\n        },\n        "evidence": { "$ref": "#/$defs/evidence" },\n        "claims": {\n          "type": "array",\n          "items": { "$ref": "#/$defs/claim" }\n        },\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "digests": {\n          "type": "object",\n          "required": ["claims", "evidence"],\n          "additionalProperties": false,\n          "properties": {\n            "claims": { "$ref": "#/$defs/sha256" },\n            "evidence": { "$ref": "#/$defs/sha256" }\n          }\n        },\n        "rerun": {\n          "type": "object",\n          "required": ["offline", "online"],\n          "additionalProperties": false,\n          "properties": {\n            "offline": { "type": "string", "minLength": 1, "maxLength": 2000 },\n            "online": { "type": "string", "minLength": 1, "maxLength": 2000 }\n          }\n        },\n        "assurance": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issuer"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "unsigned" },\n                "issuer": { "const": "self-generated" }\n              }\n            },\n            {\n              "type": "object",\n              "required": ["status", "issuer", "keyFingerprint"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "signed" },\n                "issuer": { "type": "string", "minLength": 1, "maxLength": 320 },\n                "keyFingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]{43}$" }\n              }\n            }\n          ]\n        }\n      }\n    },\n    "verdict": { "enum": ["pass", "fail", "unverifiable"] },\n    "blockError": {\n      "type": "object",\n      "required": ["code"],\n      "additionalProperties": false,\n      "properties": {\n        "code": {\n          "enum": [\n            "unterminated_fence",\n            "invalid_json",\n            "duplicate_member",\n            "unsupported_version",\n            "schema_violation"\n          ]\n        },\n        "pointer": { "type": "string", "pattern": "^(?:/.*)?$" },\n        "keyword": { "type": "string", "minLength": 1 }\n      }\n    },\n    "block": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "found" },\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "value": { "$ref": "handback-block-0.1.schema.json" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "missing" },\n            "reason": { "const": "block_missing" },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "count", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ambiguous" },\n            "reason": { "const": "block_ambiguous" },\n            "count": { "type": "integer", "minimum": 2 },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "errors", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "invalid" },\n            "reason": { "const": "block_invalid" },\n            "errors": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/blockError" } },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        }\n      ]\n    },\n    "claim": {\n      "type": "object",\n      "required": ["id", "check", "field", "declared", "observed", "verdict"],\n      "additionalProperties": false,\n      "properties": {\n        "id": { "type": "string", "minLength": 1 },\n        "check": { "enum": ["head", "scope", "reference", "count", "time"] },\n        "field": {\n          "description": "A JSON Pointer (RFC 6901) into the block.",\n          "type": "string",\n          "pattern": "^/.+$"\n        },\n        "declared": true,\n        "observed": true,\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "reason": { "$ref": "#/$defs/claimReason" }\n      },\n      "if": { "properties": { "verdict": { "const": "pass" } } },\n      "then": { "not": { "required": ["reason"] } },\n      "else": { "required": ["reason"] }\n    },\n    "claimReason": {\n      "type": "string",\n      "pattern": "^(?:head_mismatch|declared_not_changed|undeclared_file|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|none_failed_mismatch|checks_incomplete|no_check_runs|no_succeeded_check_runs|check_runs_not_at_head|no_comparable_record_field|record_not_found|record_ambiguous|not_merged|premature|no_deployment|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs|workflow_runs|artifact|deployments))$"\n    },\n    "unread": {\n      "description": "A section the checker could not use: its source errored, or the source answered without the field.",\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "source"],\n          "properties": {\n            "status": { "const": "unreadable" },\n            "source": { "$ref": "#/$defs/sourceKind" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "field"],\n          "properties": {\n            "status": { "const": "unpopulated" },\n            "field": { "type": "string", "pattern": "^[A-Za-z0-9_.]+$" }\n          }\n        }\n      ]\n    },\n    "evidence": {\n      "type": "object",\n      "required": ["pullRequest", "sources"],\n      "additionalProperties": false,\n      "properties": {\n        "pullRequest": {\n          "description": "Always read: a checker that cannot read the pull request writes no record.",\n          "type": "object",\n          "required": [\n            "status",\n            "number",\n            "state",\n            "merged",\n            "mergedAt",\n            "headSha",\n            "mergeSha",\n            "changedFiles"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ok" },\n            "number": { "type": "integer", "minimum": 1 },\n            "state": { "enum": ["open", "closed"] },\n            "merged": { "type": "boolean" },\n            "mergedAt": { "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }] },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": { "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }] },\n            "changedFiles": { "type": "integer", "minimum": 0 }\n          }\n        },\n        "files": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "complete", "entries"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "complete": { "type": "boolean" },\n                "entries": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["path", "status"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "path": { "type": "string", "minLength": 1 },\n                      "status": {\n                        "enum": [\n                          "added",\n                          "removed",\n                          "modified",\n                          "renamed",\n                          "copied",\n                          "changed",\n                          "unchanged"\n                        ]\n                      },\n                      "previousPath": { "type": "string", "minLength": 1 }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "closingReferences": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issues"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "references": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "issue" },\n                  "ref": { "$ref": "#/$defs/issueRef" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "resolvedAs": {\n                    "description": "Spec 0.1.3: the owner/repo#N GitHub answered the read of ref with, when it is another issue (an issue transferred to another repository).",\n                    "$ref": "#/$defs/issueRef"\n                  }\n                },\n                "if": { "required": ["resolvedAs"] },\n                "then": { "properties": { "exists": { "const": true } } }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists", "reachableFromHead"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "commit" },\n                  "ref": { "$ref": "#/$defs/commitSha" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "reachableFromHead": { "type": "boolean" }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref"],\n                "properties": {\n                  "kind": { "enum": ["issue", "commit"] },\n                  "ref": { "type": "string", "minLength": 1 }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "closeEvents": {\n          "description": "Spec 0.1.4: who closed each closes target that exists and is not among the closing references, read under the identity it resolves to; and the pull request\'s base, its repository\'s default branch and its commit ids.",\n          "type": "object",\n          "required": ["pullRequest", "targets"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": {\n              "oneOf": [\n                {\n                  "type": "object",\n                  "required": ["status", "baseRef", "defaultBranch", "commits"],\n                  "additionalProperties": false,\n                  "properties": {\n                    "status": { "const": "ok" },\n                    "baseRef": { "type": "string", "minLength": 1 },\n                    "defaultBranch": {\n                      "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }]\n                    },\n                    "commits": {\n                      "type": "array",\n                      "uniqueItems": true,\n                      "items": { "$ref": "#/$defs/commitSha" }\n                    }\n                  }\n                },\n                { "$ref": "#/$defs/unreadOnly" }\n              ]\n            },\n            "targets": {\n              "type": "array",\n              "items": {\n                "oneOf": [\n                  {\n                    "type": "object",\n                    "required": ["ref", "status", "type", "state", "events"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "ref": { "$ref": "#/$defs/issueRef" },\n                      "status": { "const": "ok" },\n                      "type": { "enum": ["issue", "pull_request"] },\n                      "state": { "enum": ["open", "closed", "merged"] },\n                      "events": {\n                        "type": "array",\n                        "items": {\n                          "type": "object",\n                          "required": ["at", "closer"],\n                          "additionalProperties": false,\n                          "properties": {\n                            "at": { "$ref": "#/$defs/timestamp" },\n                            "closer": {\n                              "oneOf": [\n                                { "type": "null" },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "ref"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "pull_request" },\n                                    "ref": { "$ref": "#/$defs/issueRef" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "oid"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "commit" },\n                                    "oid": { "$ref": "#/$defs/commitSha" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind"],\n                                  "additionalProperties": false,\n                                  "properties": { "kind": { "const": "other" } }\n                                }\n                              ]\n                            }\n                          }\n                        }\n                      }\n                    },\n                    "if": { "properties": { "type": { "const": "issue" } } },\n                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }\n                  },\n                  {\n                    "type": "object",\n                    "required": ["ref"],\n                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },\n                    "allOf": [{ "$ref": "#/$defs/unread" }]\n                  }\n                ]\n              }\n            }\n          }\n        },\n        "checkRuns": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "commit", "excludedIds", "runs"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "commit": { "$ref": "#/$defs/commitSha" },\n                "excludedIds": {\n                  "description": "Check runs left out of the count: the run the checker itself executes in.",\n                  "type": "array",\n                  "items": { "type": "integer", "minimum": 1 }\n                },\n                "runs": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["id", "name", "status", "conclusion"],\n                    "additionalProperties": false,\n                    "dependentRequired": {\n                      "workflowPath": ["checkSuiteId", "workflowRunId", "runAttempt"],\n                      "workflowName": ["workflowPath"],\n                      "workflowRunId": ["workflowPath"],\n                      "runAttempt": ["workflowPath"]\n                    },\n                    "properties": {\n                      "id": { "type": "integer", "minimum": 1 },\n                      "name": { "type": "string" },\n                      "status": { "type": "string", "minLength": 1 },\n                      "conclusion": { "type": ["string", "null"] },\n                      "checkSuiteId": {\n                        "description": "The run\'s check suite (`check_suite.id`). A run without `workflowPath` is counted as the latest per check suite and name; a run without either is keyed by its name alone. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "appSlug": {\n                        "description": "The slug of the app that created the run (`app.slug`). Recorded, not read by any check. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowPath": {\n                        "description": "The `path` of the workflow run whose `check_suite_id` is the run\'s check suite, less any `@<ref>`, from the workflow runs at the head. Runs that have it are counted as the latest per workflow path and name. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowName": {\n                        "description": "The `name` of that workflow run, as the listing gives it; absent where the listing gives none, null or the empty string. No 0.1 check reads it. Added in spec 0.1.5.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowRunId": {\n                        "description": "The `id` of that workflow run. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "runAttempt": {\n                        "description": "That workflow run\'s `run_attempt` as the listing gives it, its latest attempt at the read. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "testRecords": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["record", "status", "runs"],\n                "additionalProperties": false,\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" },\n                  "status": { "const": "ok" },\n                  "runs": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["runId", "runAttempt", "executed", "failed"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "runId": { "type": "integer", "minimum": 1 },\n                        "runAttempt": { "type": "integer", "minimum": 1 },\n                        "executed": { "type": "integer", "minimum": 0 },\n                        "failed": { "type": "integer", "minimum": 0 }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["record"],\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "deployments": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["environment", "status", "deployments"],\n                "additionalProperties": false,\n                "properties": {\n                  "environment": { "type": "string", "minLength": 1 },\n                  "status": { "const": "ok" },\n                  "deployments": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["id", "sha", "relation", "successAt"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "id": { "type": "integer", "minimum": 1 },\n                        "sha": { "$ref": "#/$defs/commitSha" },\n                        "relation": {\n                          "enum": ["head", "merge", "descendant", "unrelated", "unknown"]\n                        },\n                        "successAt": {\n                          "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }]\n                        }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["environment"],\n                "properties": { "environment": { "type": "string", "minLength": 1 } },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "sources": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["kind", "locator", "sha256", "readAt"],\n            "additionalProperties": false,\n            "properties": {\n              "kind": { "$ref": "#/$defs/sourceKind" },\n              "locator": { "type": "string", "minLength": 1, "maxLength": 2000 },\n              "sha256": { "$ref": "#/$defs/sha256" },\n              "etag": { "type": "string", "minLength": 1 },\n              "readAt": { "$ref": "#/$defs/timestamp" },\n              "error": {\n                "description": "Present when the read failed: http_<status>, network, or parse.",\n                "type": "string",\n                "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$"\n              }\n            }\n          }\n        }\n      }\n    },\n    "unreadOnly": {\n      "allOf": [{ "$ref": "#/$defs/unread" }],\n      "unevaluatedProperties": false\n    }\n  }\n}\n', "record-0.2-draft.schema.json": `{
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.2-draft.schema.json",
   "title": "Dunstan record, DRAFT 0.2.0",
@@ -10477,11 +10511,11 @@ var FILES = { "handback-block-0.1.schema.json": `{
     "advisoryNote": {
       "description": "agrees when the gate check would pass; differs:<reason> when it would fail; unanswered:<reason> when it would be unverifiable. The reasons are the 0.1 claim reasons. A file claim matched by name only is agrees_by_name, or unanswered:ambiguous_path when more than one changed path has that name. A file claim not among the changed files is unanswered:no_such_path when nothing is at its path at the head, unanswered:directory when a directory is, and unanswered:source_unreadable:path when the answer was not read (D.11.4). Never a verdict.",
       "type": "string",
-      "pattern": "^(?:agrees|agrees_by_name|unanswered:(?:ambiguous_path|no_such_path|directory|source_unreadable:path)|(?:differs|unanswered):(?:head_mismatch|declared_not_changed|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|checks_incomplete|no_check_runs|no_comparable_record_field|not_merged|premature|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs)))$"
+      "pattern": "^(?:agrees|agrees_by_name|unanswered:(?:ambiguous_path|no_such_path|directory|source_unreadable:path|check_runs_not_at_head)|(?:differs|unanswered):(?:head_mismatch|declared_not_changed|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|checks_incomplete|no_check_runs|no_comparable_record_field|not_merged|premature|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs)))$"
     },
     "readerReason": {
       "type": "string",
-      "pattern": "^(?:no_matching_record_item|declared_item_not_among_candidates|candidate_not_in_evidence|ambiguous_candidates|workflow_not_in_record|workflow_name_ambiguous|no_comparable_record_field|file_list_truncated|checks_incomplete|all_succeeded_mismatch|test_not_executed|test_outcome_mismatch|not_closing|not_found|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request_files|check_runs|workflow_runs|pull_request_commits|closing_references|repository|issue|timeline|artifact))$"
+      "pattern": "^(?:no_matching_record_item|declared_item_not_among_candidates|candidate_not_in_evidence|duplicate_record_item|ambiguous_candidates|workflow_not_in_record|workflow_name_ambiguous|no_comparable_record_field|file_list_truncated|checks_incomplete|all_succeeded_mismatch|test_not_executed|test_outcome_mismatch|not_closing|not_found|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request_files|check_runs|workflow_runs|pull_request_commits|closing_references|repository|issue|timeline|artifact))$"
     }
   }
 }
@@ -10796,6 +10830,9 @@ var MAX_BODY_BYTES = 48 * 1024 * 1024;
 var EMPTY = new Uint8Array();
 var GitHubClient = class {
   sources = /* @__PURE__ */ new Map();
+  maxArchiveBytes;
+  maxEntryBytes;
+  #allocate;
   #token;
   #baseUrl;
   #fetch;
@@ -10814,6 +10851,9 @@ var GitHubClient = class {
 `));
     this.#maxAttempts = options.maxAttempts ?? 4;
     this.#maxWaitMs = options.maxWaitMs ?? 6e4;
+    this.maxArchiveBytes = options.maxArchiveBytes ?? MAX_ARCHIVE_BYTES;
+    this.maxEntryBytes = options.maxEntryBytes ?? MAX_ENTRY_BYTES;
+    this.#allocate = options.allocate ?? ((size) => new Uint8Array(size));
   }
   get hasToken() {
     return this.#token !== void 0 && this.#token !== "";
@@ -10829,7 +10869,7 @@ var GitHubClient = class {
   async read(kind, path, options = {}) {
     const method = options.method ?? "GET";
     const locator = options.locator ?? `${method} ${path}${options.locatorSuffix ?? ""}`;
-    const budget = kind === "artifact" ? MAX_ARCHIVE_BYTES : MAX_BODY_BYTES;
+    const budget = kind === "artifact" ? this.maxArchiveBytes : MAX_BODY_BYTES;
     const result = await this.#fetchWithRetry(method, path, options.requestBody, locator, budget);
     let read;
     if (result.kind === "network") {
@@ -10914,7 +10954,7 @@ var GitHubClient = class {
         const why = wait > this.#maxWaitMs ? `rate limited for ${Math.ceil(wait / 1e3)}s` : `${attempt} attempts`;
         this.#warn(`${locator}: giving up with HTTP ${status} (${why}); recorded as unreadable`);
       }
-      const bytes = await readWithin(response, budget);
+      const bytes = await readWithin(response, budget, this.#allocate);
       if (bytes === null) {
         this.#warn(
           `${locator}: answer over ${budget} bytes, not read in full; recorded as unreadable`
@@ -10928,33 +10968,37 @@ async function cancel(body) {
   await body?.cancel().catch(() => {
   });
 }
-async function readWithin(response, budget) {
+var FIRST_CAPACITY = 64 * 1024;
+async function readWithin(response, budget, allocate) {
   const length = response.headers.get("content-length");
-  if (length !== null && /^[0-9]+$/.test(length) && Number(length) > budget) {
+  const declared = length !== null && /^[0-9]+$/.test(length) ? Number(length) : null;
+  if (declared !== null && declared > budget) {
     await cancel(response.body);
     return null;
   }
   if (response.body === null) return EMPTY;
   const reader = response.body.getReader();
-  const chunks = [];
+  let bytes = EMPTY;
   let size = 0;
   for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read()) {
-    size += chunk.value.length;
-    if (size > budget) {
+    const needed = size + chunk.value.length;
+    if (needed > budget) {
       await reader.cancel().catch(() => {
       });
       return null;
     }
-    chunks.push(chunk.value);
-  }
-  if (chunks.length === 1) return chunks[0];
-  const bytes = new Uint8Array(size);
-  let at = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, at);
-    at += chunk.length;
+    if (needed > bytes.length) {
+      let capacity = Math.max(needed, 2 * bytes.length, FIRST_CAPACITY);
+      if (2 * capacity > budget) capacity = budget;
+      if (bytes === EMPTY && declared !== null && declared >= needed) capacity = declared;
+      const grown = allocate(capacity);
+      grown.set(bytes.subarray(0, size));
+      bytes = grown;
+    }
+    bytes.set(chunk.value, size);
+    size = needed;
   }
-  return bytes;
+  return size === bytes.length ? bytes : bytes.subarray(0, size);
 }
 function backoffMs(attempt) {
   return Math.min(1e3 * 2 ** (attempt - 1), 8e3);
@@ -12582,11 +12626,14 @@ function identifierMatches(claim2, items, repository) {
   const shas = shaTokens(texts);
   const issues = issueRefs(texts, repository);
   const named = (value, inside) => texts.some((t) => t === value || occursBounded(t, value, inside));
-  const qualified = (item) => item.type === "test" && item.id !== item.fields[0]?.[1] && named(item.id, WORD);
+  const classnameOf = (item) => item.fields.find(([f]) => f === "classname")?.[1];
+  const qualified = (item) => {
+    const classname = classnameOf(item);
+    return item.type === "test" && classname !== void 0 && named(`${classname}.${item.fields[0]?.[1]}`, WORD);
+  };
   const qualifiedNames = new Set(
     items.filter(qualified).map((item) => item.fields[0]?.[1])
   );
-  const classnameOf = (item) => item.fields.find(([f]) => f === "classname")?.[1];
   const classnames = [
     ...new Set(items.filter((item) => item.type === "test").map(classnameOf))
   ].filter((c) => c !== void 0);
@@ -12647,7 +12694,7 @@ function identifierMatches(claim2, items, repository) {
 
 // src/retrieval/items.ts
 function testId(test) {
-  return test.classname === void 0 ? test.name : `${test.classname}.${test.name}`;
+  return JSON.stringify([test.classname ?? null, test.name]);
 }
 function recordItems(evidence) {
   const items = [];
@@ -12895,7 +12942,11 @@ function sectionReason(type, evidence) {
 }
 function lookup(type, evidence) {
   const entries = /* @__PURE__ */ new Map();
-  const put = (id, value) => entries.set(id, value);
+  const duplicates = /* @__PURE__ */ new Set();
+  const put = (id, value) => {
+    if (entries.has(id)) duplicates.add(id);
+    else entries.set(id, value);
+  };
   const items = evidence.items;
   if (type === "file" && evidence.files?.status === "ok") {
     for (const f of evidence.files.entries) put(f.path, f);
@@ -12909,7 +12960,7 @@ function lookup(type, evidence) {
   } else if (type === "test" && items?.tests.status === "ok") {
     for (const t of items.tests.entries) put(testId(t), t);
   }
-  return entries;
+  return { entries, duplicates };
 }
 var ISSUE_REF2 = /^(?:[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100})?#[1-9][0-9]{0,9}$/;
 function combinedCandidates(typed, floor) {
@@ -12993,7 +13044,7 @@ function checkReaderClaim(claim2, evidence, repository) {
   }
   const missing = sectionReason(type, evidence);
   if (missing !== void 0) return unverifiable2(missing);
-  const entries = lookup(type, evidence);
+  const { entries, duplicates } = lookup(type, evidence);
   const typed = claim2.candidates.filter((c) => c.type === type);
   if (typed.some((c) => entries.get(c.id) === void 0)) {
     return unverifiable2("candidate_not_in_evidence");
@@ -13003,6 +13054,7 @@ function checkReaderClaim(claim2, evidence, repository) {
   if (relevant.length === 0) {
     return unverifiable2(truncated ? "file_list_truncated" : "no_matching_record_item");
   }
+  if (relevant.some((c) => duplicates.has(c.id))) return unverifiable2("duplicate_record_item");
   if (type === "check_run") {
     const scoped = namedWorkflowRuns(claim2.text, relevant, evidence);
     if (!Array.isArray(scoped)) return unverifiable2(scoped.reason);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dunstan",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "mcpName": "io.github.BargLabs/dunstan",
   "description": "Holds a coding agent's completion report to the record: deterministic checks of a declared handback block against the repository's own metadata.",
   "license": "AGPL-3.0-only",