instar 1.3.1077 → 1.3.1079

package/dist/core/StandardsEnforcementAuditor.d.ts

@@ -238,12 +238,33 @@ export interface CoverageReport {
  * a confident zero.
  */
 export interface GuardTreeProvenance {
-    /** The directory refs were resolved against. */
+    /** The directory refs were resolved against, or the packed-index sentinel. */
     projectDir: string;
+    /** The configured directory, retained when a packed index supersedes a stale local tree. */
+    configuredProjectDir: string;
     /** Whether that directory actually contains an analyzable instar source tree. */
     analyzable: boolean;
     /** The markers probed, so a reader can see WHY it was judged (un)analyzable. */
     markersFound: string[];
+    /** The independently checkable basis used to select this guard evidence. */
+    basis: 'executing-source-tree' | 'source-tree-index-match' | 'packed-source-index-match' | 'configured-tree-unverified' | 'not-probed';
+    /** True only when the tree/index is tied to the code and constitution being read. */
+    freshnessVerified: boolean;
+    /** Plain-English explanation of what established (or failed to establish) freshness. */
+    freshnessReason: string;
+    /** sha256 of the packed source index, when that is the basis. */
+    sourceIndexSha256: string | null;
+    /** Registry sha the packed index was generated against. */
+    registrySha256: string | null;
+    /** Package version the packed index was generated for. */
+    packageVersion: string | null;
+}
+export interface GuardTreeIndex {
+    schemaVersion: 1;
+    generatedFrom: 'source-tree';
+    registrySha256: string;
+    packageVersion: string;
+    guards: VerifiedGuard[];
 }
 export interface AuditorOptions {
     /** Path to docs/STANDARDS-REGISTRY.md. */
@@ -342,6 +363,19 @@ export declare function stripComments(code: string): string;
  * non-resolving ref, which is the conservative direction.
  */
 export declare function containedRefPath(projectDir: string, ref: string): string | null;
+/**
+ * Build the deterministic evidence index shipped beside the packed constitution.
+ *
+ * This runs in the real source checkout during `npm run build`, where the source tree
+ * is unambiguous. Runtime installs need not guess which old checkout happens to sit in
+ * `projectDir`; they verify and consume this same-build index instead.
+ */
+export declare function buildGuardTreeIndex(projectDir: string, registryMarkdown: string, packageVersion: string): GuardTreeIndex;
+/**
+ * Select a real checkout only when its audit-relevant evidence exactly matches the
+ * same-build packed index. Landmark presence alone is deliberately insufficient.
+ */
+export declare function findMatchingGuardTree(candidates: string[], expected: GuardTreeIndex, registryMarkdown: string, packageVersion: string): string | null;
 export declare function computeInputHash(opts: AuditorOptions): string;
 /**
  * Derive how much the assessment has EARNED. Extracted as a function on purpose:

package/dist/core/StandardsEnforcementAuditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StandardsEnforcementAuditor.d.ts","sourceRoot":"","sources":["../../src/core/StandardsEnforcementAuditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAA2C,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE7G,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAE5F,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAClC,uEAAuE;IACvE;;;;;;;;;;;;;;;OAeG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uDAAuD;IACvD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,oBAAoB,EAAE,UAAU,GAAG,YAAY,GAAG,eAAe,CAAC;IAClE,0EAA0E;IAC1E,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,wEAAwE;IACxE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;;;;;;;;;;;;OAcG;IACH,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,UAAU,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAMD,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAmB1F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAgCvE;AAyBD;;;;GAIG;AACH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AA8CD,kEAAkE;AAClE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ/E;AA2GD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAuE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,kBAAkB;AAC5B;;;;;;;;;;GAUG;AACH,SAAS,CAAC,EAAE,iBAAiB;AAC7B;;;;GAIG;AACH,MAAM,CAAC,EAAE,mBAAmB;AAC5B;;;;;GAKG;AACH,cAAc,CAAC,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,UAAU,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuEzE;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAyBtE;AAiCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAI3C;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,GAC5B,cAAc,CAsGhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnH,cAAc,CAyChB;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAY1D"}
+{"version":3,"file":"StandardsEnforcementAuditor.d.ts","sourceRoot":"","sources":["../../src/core/StandardsEnforcementAuditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,OAAO,EAA2C,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE7G,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAE5F,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAClC,uEAAuE;IACvE;;;;;;;;;;;;;;;OAeG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uDAAuD;IACvD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,oBAAoB,EAAE,UAAU,GAAG,YAAY,GAAG,eAAe,CAAC;IAClE,0EAA0E;IAC1E,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,wEAAwE;IACxE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;;;;;;;;;;;;OAcG;IACH,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,UAAU,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4EAA4E;IAC5E,KAAK,EACD,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,4BAA4B,GAC5B,YAAY,CAAC;IACjB,qFAAqF;IACrF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wFAAwF;IACxF,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,CAAC,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAcD,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAMD,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAmB1F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAgCvE;AAyBD;;;;GAIG;AACH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AA8CD,kEAAkE;AAClE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ/E;AAwCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,EACxB,cAAc,EAAE,MAAM,GACrB,cAAc,CA0BhB;AA2BD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,cAAc,EACxB,gBAAgB,EAAE,MAAM,EACxB,cAAc,EAAE,MAAM,GACrB,MAAM,GAAG,IAAI,CA0Bf;AAiVD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,kBAAkB;AAC5B;;;;;;;;;;GAUG;AACH,SAAS,CAAC,EAAE,iBAAiB;AAC7B;;;;GAIG;AACH,MAAM,CAAC,EAAE,mBAAmB;AAC5B;;;;;GAKG;AACH,cAAc,CAAC,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,UAAU,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAkEzE;AAED;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAoCtE;AAiCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAI3C;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,GAC5B,cAAc,CAgIhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnH,cAAc,CAoDhB;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAY1D"}

package/dist/core/StandardsEnforcementAuditor.js

@@ -24,6 +24,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
 import { parseStandardsRegistryDetailed, runRegistryCanary } from './StandardsRegistryParser.js';
 import { extractEnforcementRefs, flattenRefs } from './StandardEnforcementExtractor.js';
 import { earnsVerified, readAuthoredConstitution } from './standardsRegistryPath.js';
@@ -290,6 +291,251 @@ function verifyRefs(refs, projectDir, routeTable, symbolIndex) {
         return g;
     });
 }
+function guardKey(guard) {
+    return `${guard.kind}\u0000${guard.ref}`;
+}
+/**
+ * Build the deterministic evidence index shipped beside the packed constitution.
+ *
+ * This runs in the real source checkout during `npm run build`, where the source tree
+ * is unambiguous. Runtime installs need not guess which old checkout happens to sit in
+ * `projectDir`; they verify and consume this same-build index instead.
+ */
+export function buildGuardTreeIndex(projectDir, registryMarkdown, packageVersion) {
+    const { articles } = parseStandardsRegistryDetailed(registryMarkdown);
+    const extracted = articles.map((article) => extractEnforcementRefs(article));
+    const refsByKey = new Map();
+    const wantedMarkers = new Set();
+    for (const refs of extracted) {
+        for (const ref of flattenRefs(refs)) {
+            refsByKey.set(`${ref.kind}\u0000${ref.ref}`, ref);
+            if (ref.kind === 'marker')
+                wantedMarkers.add(ref.ref);
+        }
+    }
+    const routeTable = loadRouteTable(projectDir);
+    const symbolIndex = buildSymbolIndex(projectDir, wantedMarkers);
+    const guards = verifyRefs([...refsByKey.values()].sort((a, b) => guardKey(a).localeCompare(guardKey(b))), projectDir, routeTable, symbolIndex);
+    return {
+        schemaVersion: 1,
+        generatedFrom: 'source-tree',
+        registrySha256: crypto.createHash('sha256').update(registryMarkdown).digest('hex'),
+        packageVersion,
+        guards,
+    };
+}
+function executingPackageRoot() {
+    try {
+        return fileURLToPath(new URL('../../', import.meta.url));
+    }
+    catch {
+        // @silent-fallback-ok: this is one candidate identity only. The packed-index
+        // resolver below remains authoritative for published installs and returns a
+        // surfaced, untrustworthy provenance when it cannot verify its own artifacts.
+        return null;
+    }
+}
+function sameDirectory(a, b) {
+    try {
+        return fs.realpathSync(a) === fs.realpathSync(b);
+    }
+    catch {
+        // @silent-fallback-ok: inability to prove path identity is a negative result,
+        // never permission to label a configured tree as current.
+        return false;
+    }
+}
+function sameGuardIndex(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+/**
+ * Select a real checkout only when its audit-relevant evidence exactly matches the
+ * same-build packed index. Landmark presence alone is deliberately insufficient.
+ */
+export function findMatchingGuardTree(candidates, expected, registryMarkdown, packageVersion) {
+    const seen = new Set();
+    for (const candidate of candidates) {
+        let canonical;
+        try {
+            canonical = fs.realpathSync(candidate);
+        }
+        catch {
+            // @silent-fallback-ok: a missing candidate is not a degraded audit result; it
+            // simply cannot prove identity and the next bounded candidate is evaluated.
+            continue;
+        }
+        if (seen.has(canonical))
+            continue;
+        seen.add(canonical);
+        if (!probeGuardTree(canonical).analyzable)
+            continue;
+        let observed;
+        try {
+            observed = buildGuardTreeIndex(canonical, registryMarkdown, packageVersion);
+        }
+        catch {
+            // @silent-fallback-ok: one optional candidate that cannot be fully indexed
+            // has not established identity. Continue to the next bounded candidate; the
+            // packed fallback retains analysis and exposes its own basis.
+            continue;
+        }
+        if (sameGuardIndex(observed, expected))
+            return canonical;
+    }
+    return null;
+}
+function guardTreeCandidates(configuredProjectDir) {
+    const candidates = [
+        configuredProjectDir,
+        path.join(configuredProjectDir, 'repo'),
+        process.cwd(),
+    ];
+    const packageRoot = executingPackageRoot();
+    if (packageRoot)
+        candidates.push(packageRoot);
+    // Agent deployments keep a bounded fleet at `<agents>/<name>` and development
+    // agents keep their checkout at `<agent>/repo`. Search only that one known level:
+    // no home-directory crawl, no arbitrary project discovery.
+    const agentsDir = path.dirname(configuredProjectDir);
+    if (path.basename(agentsDir) === 'agents') {
+        try {
+            for (const entry of fs.readdirSync(agentsDir, { withFileTypes: true }).slice(0, 100)) {
+                if (entry.isDirectory())
+                    candidates.push(path.join(agentsDir, entry.name, 'repo'));
+            }
+        }
+        catch {
+            // @silent-fallback-ok: fleet-layout discovery is an optional bounded candidate
+            // source. Package-local evidence below retains the capability and reports its basis.
+        }
+    }
+    return candidates;
+}
+function readPackedGuardIndex(registrySha256, runningPackageVersion, configuredProjectDir) {
+    let indexPath;
+    let metaPath;
+    try {
+        indexPath = fileURLToPath(new URL('../data/standards-guard-index.json', import.meta.url));
+        metaPath = fileURLToPath(new URL('../data/standards-guard-index.meta.json', import.meta.url));
+    }
+    catch {
+        // @silent-fallback-ok: malformed module URL means this candidate is unavailable;
+        // the caller returns configured-tree-unverified with the failed freshness claim
+        // visible in the report.
+        return null;
+    }
+    let bytes;
+    let parsed;
+    let meta;
+    try {
+        bytes = fs.readFileSync(indexPath);
+        parsed = JSON.parse(bytes.toString('utf-8'));
+        meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
+    }
+    catch {
+        // @silent-fallback-ok: a missing/unreadable index is not substituted or trusted.
+        // The caller exposes the absence as an unverified guard-tree basis.
+        return null;
+    }
+    const index = parsed;
+    const stamp = meta;
+    const observedSha256 = crypto.createHash('sha256').update(bytes).digest('hex');
+    const structurallyValid = index.schemaVersion === 1
+        && index.generatedFrom === 'source-tree'
+        && typeof index.registrySha256 === 'string'
+        && typeof index.packageVersion === 'string'
+        && Array.isArray(index.guards)
+        && index.guards.every((guard) => guard !== null
+            && typeof guard === 'object'
+            && typeof guard.ref === 'string'
+            && ['file', 'route', 'marker'].includes(guard.kind)
+            && typeof guard.refResolves === 'boolean');
+    const stampMatches = stamp.sha256 === observedSha256
+        && stamp.registrySha256 === registrySha256
+        && stamp.packageVersion === runningPackageVersion
+        && index.registrySha256 === registrySha256
+        && index.packageVersion === runningPackageVersion;
+    if (!structurallyValid || !stampMatches)
+        return null;
+    const indexedGuards = new Map();
+    for (const guard of index.guards) {
+        indexedGuards.set(guardKey(guard), { ...guard });
+    }
+    return {
+        provenance: {
+            projectDir: '(packed same-build source index)',
+            configuredProjectDir,
+            analyzable: true,
+            markersFound: ['packed guard evidence'],
+            basis: 'packed-source-index-match',
+            freshnessVerified: true,
+            freshnessReason: `the source evidence index sha256 ${observedSha256} matches its build meta, registry ` +
+                `sha256 ${registrySha256}, and running package version ${runningPackageVersion}`,
+            sourceIndexSha256: observedSha256,
+            registrySha256,
+            packageVersion: runningPackageVersion,
+        },
+        indexedGuards,
+        packedIndex: index,
+    };
+}
+function resolveGuardEvidence(opts, registryMarkdown) {
+    const registrySha256 = crypto.createHash('sha256').update(registryMarkdown).digest('hex');
+    const configuredProbe = probeGuardTree(opts.projectDir);
+    if (opts.integrity?.basis === 'packed-meta-match') {
+        const packed = readPackedGuardIndex(registrySha256, opts.integrity.runningPackageVersion, opts.projectDir);
+        if (packed && packed.packedIndex && opts.integrity.runningPackageVersion) {
+            const matched = findMatchingGuardTree(guardTreeCandidates(opts.projectDir), packed.packedIndex, registryMarkdown, opts.integrity.runningPackageVersion);
+            if (matched) {
+                const probe = probeGuardTree(matched);
+                const packageRoot = executingPackageRoot();
+                const executing = packageRoot !== null && sameDirectory(packageRoot, matched);
+                return {
+                    provenance: {
+                        ...probe,
+                        configuredProjectDir: opts.projectDir,
+                        basis: executing ? 'executing-source-tree' : 'source-tree-index-match',
+                        freshnessVerified: true,
+                        freshnessReason: `the live tree's complete audit-evidence index exactly matches packed source index ` +
+                            `${packed.provenance.sourceIndexSha256}; landmark-only candidates were rejected`,
+                        sourceIndexSha256: packed.provenance.sourceIndexSha256,
+                        registrySha256,
+                        packageVersion: opts.integrity.runningPackageVersion,
+                    },
+                    indexedGuards: null,
+                };
+            }
+        }
+        if (packed)
+            return packed;
+    }
+    return {
+        provenance: {
+            ...configuredProbe,
+            configuredProjectDir: opts.projectDir,
+            basis: 'configured-tree-unverified',
+            freshnessVerified: false,
+            freshnessReason: configuredProbe.analyzable
+                ? 'the configured tree has the audit landmarks, but no same-build identity ties it to the packed constitution; a coherent stale tree passes landmark probes by construction'
+                : 'the configured tree lacks the complete source landmarks and no valid same-build source index was available',
+            sourceIndexSha256: null,
+            registrySha256,
+            packageVersion: opts.integrity?.basis === 'packed-meta-match'
+                ? opts.integrity.runningPackageVersion
+                : null,
+        },
+        indexedGuards: null,
+    };
+}
+function verifyRefsFromResolution(refs, resolution, projectDir, routeTable, symbolIndex) {
+    if (resolution.indexedGuards === null) {
+        return verifyRefs(refs, projectDir, routeTable, symbolIndex);
+    }
+    return refs.map((ref) => {
+        const indexed = resolution.indexedGuards.get(`${ref.kind}\u0000${ref.ref}`);
+        return indexed ? { ...indexed } : { ref: ref.ref, kind: ref.kind, refResolves: false };
+    });
+}
 /** Classify a standard by its strongest VERIFIED guard. */
 function classifyStandard(guards) {
     let best = null;
@@ -371,7 +617,7 @@ function guardStateSignal(projectDir, prior) {
     }
     return h.digest('hex').slice(0, 16);
 }
-export function computeInputHash(opts) {
+function computeInputHashForResolution(opts, guardResolution) {
     // An UNREADABLE registry must not hash identically to an empty-but-present one:
     // that conflation is the honest-denominators shape at the cache layer, where a
     // missing constitution would share a cache slot with a genuinely blank one.
@@ -442,7 +688,15 @@ export function computeInputHash(opts) {
     const authoredSignal = authored === null
         ? 'no-authored-source'
         : crypto.createHash('sha256').update(authored).digest('hex').slice(0, 16);
-    return `${regHash}.${auxHash}.${authoredSignal}.${repoStructureSignal(opts.projectDir)}`;
+    const guardBasisSignal = guardResolution
+        ? `${guardResolution.provenance.basis}:${guardResolution.provenance.sourceIndexSha256 ?? 'live'}:` +
+            `${guardResolution.provenance.projectDir}`
+        : 'guard-basis-not-resolved';
+    return `${regHash}.${auxHash}.${authoredSignal}.${repoStructureSignal(opts.projectDir)}.` +
+        crypto.createHash('sha256').update(guardBasisSignal).digest('hex').slice(0, 16);
+}
+export function computeInputHash(opts) {
+    return computeInputHashForResolution(opts);
 }
 /**
  * Derive how much the assessment has EARNED. Extracted as a function on purpose:
@@ -518,34 +772,28 @@ authoredSource) {
         };
     }
     const verdict = earnsVerified(integrity);
-    if (verdict.verified) {
+    if (!verdict.verified) {
+        return {
+            confidence: 'unverified',
+            reason: `internal checks passed over ${total} standards parsed from ${registry.path} ` +
+                `(${registry.bytes} bytes), but ${verdict.reason} — so nothing establishes this is the CURRENT ` +
+                `constitution rather than a coherent older copy; a stale registry passes every internal check ` +
+                `by construction`,
+        };
+    }
+    if (guards && !guards.freshnessVerified) {
         return {
-            confidence: 'verified',
-            reason: `${total} standards parsed from ${registry.path}, and ${verdict.reason}. ` +
-                // The honest scope limit, stated IN the verdict rather than left to be inferred.
-                //
-                // The REGISTRY half now carries three currency operands. The GUARD half carries
-                // none: refs resolve against whatever src/ sits in projectDir, and on a deployed
-                // agent that is a copy which can be months older than the constitution being
-                // graded (measured: an agent home's routes.ts dated May 28 against a current
-                // registry). So `verified` speaks for the constitution's currency, NOT for the
-                // currency of the tree its guards were looked up in.
-                //
-                // Naming the limit rather than silently widening the word is the same repair this
-                // change already made twice. Establishing guard-tree currency is a separate job
-                // and is recorded as one, not quietly folded in here.
-                `SCOPE NOTE: this verdict covers the CONSTITUTION's currency only. The enforcement ` +
-                `refs were resolved against ${guards?.projectDir ?? 'the configured project dir'}, ` +
-                `whose currency is not established by anything here — on a deployed agent that tree ` +
-                `can be older than the constitution being graded`,
+            confidence: 'untrustworthy',
+            reason: `the constitution is package-stamped, but guard-tree freshness was not established: ` +
+                `${guards.freshnessReason}. The coverage counts remain observable for diagnosis, but a stale ` +
+                `tree passes capability landmarks by construction and cannot support a trustworthy ratio`,
         };
     }
     return {
-        confidence: 'unverified',
-        reason: `internal checks passed over ${total} standards parsed from ${registry.path} ` +
-            `(${registry.bytes} bytes), but ${verdict.reason} — so nothing establishes this is the CURRENT ` +
-            `constitution rather than a coherent older copy; a stale registry passes every internal check ` +
-            `by construction`,
+        confidence: 'verified',
+        reason: `${total} standards parsed from ${registry.path}, and ${verdict.reason}. ` +
+            `The guard evidence is also current: ${guards?.freshnessReason ?? 'the caller supplied no guard provenance'}. ` +
+            `This is package/build currency, not a runtime execution check and not tamper-resistant`,
     };
 }
 /**
@@ -590,7 +838,18 @@ export function probeGuardTree(projectDir) {
     // `analyzable` permanently false the moment anyone adds a third `check()` — which is
     // exactly the failure this probe was just repaired from, encoded so it can recur.
     const analyzable = markersFound.includes('src/server/routes.ts') && markersFound.includes('src/core');
-    return { projectDir, analyzable, markersFound };
+    return {
+        projectDir,
+        configuredProjectDir: projectDir,
+        analyzable,
+        markersFound,
+        basis: 'configured-tree-unverified',
+        freshnessVerified: false,
+        freshnessReason: 'landmark presence proves analyzability, not source-tree identity or freshness',
+        sourceIndexSha256: null,
+        registrySha256: null,
+        packageVersion: null,
+    };
 }
 /**
  * Refuse a basis that does not belong to these bytes.
@@ -648,7 +907,15 @@ export function compareAgainstAuthoredSource(projectDir, gradedMarkdown) {
     return { answerable: true, matches: authored === gradedMarkdown };
 }
 export function computeCoverage(opts, prior) {
-    const inputHash = computeInputHash(opts);
+    // Read once before source resolution: the guard index is tied to these exact
+    // registry bytes, and candidate checkouts are selected by reproducing that index.
+    const registryMarkdown = opts.registryMarkdown ?? fs.readFileSync(opts.registryPath, 'utf-8');
+    assertResolutionCoherent(opts, registryMarkdown);
+    const guardResolution = resolveGuardEvidence(opts, registryMarkdown);
+    const inputHash = computeInputHashForResolution(opts, guardResolution);
+    const currentGuardSignal = guardResolution.provenance.sourceIndexSha256 !== null
+        ? `source-index:${guardResolution.provenance.sourceIndexSha256}`
+        : guardStateSignal(guardResolution.provenance.projectDir, prior);
     // TWO conditions, not one.
     //
     // `inputHash` covers the registry bytes, the basis, the paths and a coarse repo
@@ -664,14 +931,13 @@ export function computeCoverage(opts, prior) {
     // prior-derived value into the key makes the first computation (no prior) and the
     // second (with prior) disagree by construction, so the short-circuit would never fire
     // — which is how the first attempt at this failed, caught by an existing test.
-    if (prior && prior.inputHash === inputHash && prior.guardSignal === guardStateSignal(opts.projectDir, prior)) {
+    if (prior && prior.inputHash === inputHash && prior.guardSignal === currentGuardSignal) {
         // Inputs unchanged → the deterministic report is byte-identical to the prior;
         // return it (only its timestamp would differ on recompute). The short-circuit.
         return prior;
     }
     // Read ONCE and keep what the parse saw: the audit must be able to state the
     // denominator it computed over (honest-denominators instance 4).
-    const registryMarkdown = opts.registryMarkdown ?? fs.readFileSync(opts.registryPath, 'utf-8');
     const { articles, diagnostics } = parseStandardsRegistryDetailed(registryMarkdown);
     const canary = runRegistryCanary(articles, diagnostics);
     const registry = {
@@ -685,20 +951,24 @@ export function computeCoverage(opts, prior) {
         canaryOk: canary.ok,
         canaryFailures: canary.failures,
     };
-    assertResolutionCoherent(opts, registryMarkdown);
-    const guards = probeGuardTree(opts.projectDir);
-    const routeTable = loadRouteTable(opts.projectDir);
+    const guards = guardResolution.provenance;
+    const liveProjectDir = guards.projectDir;
+    const routeTable = guardResolution.indexedGuards === null
+        ? loadRouteTable(liveProjectDir)
+        : new Set();
     // Collect every wanted marker across all articles → ONE bounded src walk.
     const extracted = articles.map((a) => ({ a, refs: extractEnforcementRefs(a) }));
     const wantedMarkers = new Set();
     for (const { refs } of extracted)
         for (const m of refs.markers)
             wantedMarkers.add(m);
-    const symbolIndex = buildSymbolIndex(opts.projectDir, wantedMarkers);
+    const symbolIndex = guardResolution.indexedGuards === null
+        ? buildSymbolIndex(liveProjectDir, wantedMarkers)
+        : new Set();
     const classifiedAt = new Date().toISOString();
     const standards = extracted.map(({ a, refs }) => {
         const flat = flattenRefs(refs);
-        const guards = verifyRefs(flat, opts.projectDir, routeTable, symbolIndex);
+        const guards = verifyRefsFromResolution(flat, guardResolution, liveProjectDir, routeTable, symbolIndex);
         const enforcementKind = classifyStandard(guards);
         const danglingRefs = guards.filter((g) => !g.refResolves).map((g) => g.ref).sort();
         return { standard: a.name, family: a.family, enforcementKind, guards, danglingRefs, classifiedAt };
@@ -716,7 +986,9 @@ export function computeCoverage(opts, prior) {
     const enforcedRatio = total === 0 ? null : Number((enforced / total).toFixed(4));
     const gaps = standards.filter((s) => s.enforcementKind === 'documented-only').map((s) => s.standard);
     const danglingCount = standards.reduce((n, s) => n + s.danglingRefs.length, 0);
-    const { confidence: assessmentConfidence, reason: confidenceReason } = deriveAssessmentConfidence(total, registry, opts.integrity, guards, compareAgainstAuthoredSource(opts.projectDir, registryMarkdown));
+    const { confidence: assessmentConfidence, reason: confidenceReason } = deriveAssessmentConfidence(total, registry, opts.integrity, guards, guards.basis === 'executing-source-tree' || guards.basis === 'source-tree-index-match'
+        ? compareAgainstAuthoredSource(liveProjectDir, registryMarkdown)
+        : { answerable: false, matches: false });
     const report = {
         generatedAt: classifiedAt,
         inputHash,
@@ -741,7 +1013,9 @@ export function computeCoverage(opts, prior) {
         },
     };
     // Computed AFTER the standards exist, because it digests the refs this pass resolved.
-    report.guardSignal = guardStateSignal(opts.projectDir, report);
+    report.guardSignal = guardResolution.provenance.sourceIndexSha256 !== null
+        ? `source-index:${guardResolution.provenance.sourceIndexSha256}`
+        : guardStateSignal(liveProjectDir, report);
     return report;
 }
 /**
@@ -792,7 +1066,18 @@ export function unusableCoverageReport(resolution) {
             registry,
             // No pass ran, so the guard tree was never probed. Reporting `analyzable:
             // false` here would assert a fact about the repo that this path never checked.
-            guards: { projectDir: '(not probed — the registry was unusable)', analyzable: false, markersFound: [] },
+            guards: {
+                projectDir: '(not probed — the registry was unusable)',
+                configuredProjectDir: '(unknown)',
+                analyzable: false,
+                markersFound: [],
+                basis: 'not-probed',
+                freshnessVerified: false,
+                freshnessReason: 'the registry was unusable, so no guard source was selected',
+                sourceIndexSha256: null,
+                registrySha256: registry.sha256,
+                packageVersion: null,
+            },
         },
     };
 }