intentdna 1.7.0 → 1.7.4

package/dist/hooks/state.js

@@ -12,6 +12,7 @@
 import { readFile, writeFile, rename, mkdir, appendFile, unlink, readdir, stat } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { join, dirname } from "node:path";
+import { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION } from "../governance/index.js";
 // ── Constants ──────────────────────────────────────────────
 const WORKFLOW_FILE = "workflow.json";
 const DEFAULT_STALENESS_MS = 2 * 60 * 60 * 1000; // 2 hours
@@ -406,6 +407,7 @@ export async function appendVerifierResult(projectDir, result, sessionId) {
     await writeVerifierResults(projectDir, results, sessionId);
 }
 const TRACE_DIR = "trace";
+const RUNTIME_DECISION_DIR = "runtime-decisions";
 const MAX_TRACE_SIZE = 10 * 1024 * 1024; // 10MB
 const TRACE_RETENTION_DAYS = 7;
 /**
@@ -467,6 +469,151 @@ export async function appendTrace(projectDir, entry, sessionId) {
  *
  * Returns parsed entries sorted by timestamp.
  */
+function datedJsonlFileName(prefix, date) {
+    return `${prefix}-${date}.jsonl`;
+}
+function decisionFileName(date) {
+    return datedJsonlFileName("runtime-decision", date);
+}
+export async function appendRuntimeDecisionEvent(projectDir, event, sessionId) {
+    try {
+        const line = JSON.stringify(event) + "\n";
+        const date = new Date().toISOString().slice(0, 10);
+        const globalDir = join(projectDir, ".dna", "state", RUNTIME_DECISION_DIR);
+        await mkdir(globalDir, { recursive: true });
+        await appendFile(join(globalDir, decisionFileName(date)), line, "utf-8");
+        if (sessionId) {
+            const sessionDir = resolveStateDir(projectDir, sessionId);
+            await mkdir(sessionDir, { recursive: true });
+            await appendFile(join(sessionDir, "runtime-decisions.jsonl"), line, "utf-8");
+        }
+    }
+    catch {
+        // Fail-open: evidence write failure never affects hook execution
+    }
+}
+function normalizeRuntimeDecisionEvent(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    const hasDecision = record.decision === "allow" || record.decision === "warn" || record.decision === "block" || record.decision === "escalate" || record.decision === "validate";
+    const decision = hasDecision ? record.decision : "unknown";
+    const schemaVersion = record.schema_version === RUNTIME_DECISION_EVENT_SCHEMA_VERSION ? RUNTIME_DECISION_EVENT_SCHEMA_VERSION : "unknown";
+    const hasTimestamp = typeof record.timestamp === "string" && record.timestamp.trim().length > 0;
+    const cascadeLayers = Object.fromEntries(CASCADE_LAYER_NAMES.map((layer) => {
+        const entry = typeof record.cascade_layers === "object" && record.cascade_layers !== null && !Array.isArray(record.cascade_layers)
+            ? record.cascade_layers[layer]
+            : undefined;
+        const layerRecord = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry : {};
+        return [layer, {
+                layer,
+                source_id: typeof layerRecord.source_id === "string" ? layerRecord.source_id : "unknown",
+                source_ref: typeof layerRecord.source_ref === "string" ? layerRecord.source_ref : "unknown",
+                fingerprint: typeof layerRecord.fingerprint === "string" ? layerRecord.fingerprint : "unknown",
+                status: layerRecord.status === "active" || layerRecord.status === "unsupported" ? layerRecord.status : "unknown",
+            }];
+    }));
+    const winningConstraint = typeof record.winning_constraint === "object" && record.winning_constraint !== null && !Array.isArray(record.winning_constraint)
+        ? record.winning_constraint
+        : {};
+    const harnessRuntimeContext = typeof record.harness_runtime_context === "object" && record.harness_runtime_context !== null && !Array.isArray(record.harness_runtime_context)
+        ? record.harness_runtime_context
+        : {};
+    const evidenceRefs = Array.isArray(record.evidence_refs)
+        ? record.evidence_refs.filter((ref) => typeof ref === "object" && ref !== null && !Array.isArray(ref) && typeof ref.type === "string" && typeof ref.ref === "string")
+        : [];
+    return {
+        schema_version: schemaVersion,
+        event_id: typeof record.event_id === "string" && record.event_id ? record.event_id : "unknown",
+        timestamp: hasTimestamp ? record.timestamp : "unknown",
+        org_id: typeof record.org_id === "string" ? record.org_id : "unknown",
+        team_id: typeof record.team_id === "string" ? record.team_id : "unknown",
+        user_id: typeof record.user_id === "string" ? record.user_id : "unknown",
+        project_id: typeof record.project_id === "string" ? record.project_id : "unknown",
+        agent_id: typeof record.agent_id === "string" ? record.agent_id : "unknown",
+        agent_role: typeof record.agent_role === "string" ? record.agent_role : "unknown",
+        agent_type: typeof record.agent_type === "string" ? record.agent_type : "unknown",
+        session_agent: typeof record.session_agent === "string" ? record.session_agent : "unknown",
+        harness_adapter: typeof record.harness_adapter === "string" ? record.harness_adapter : "unknown",
+        runtime: typeof record.runtime === "string" ? record.runtime : "unknown",
+        policy_bundle_id: typeof record.policy_bundle_id === "string" ? record.policy_bundle_id : "unknown",
+        policy_bundle_version: typeof record.policy_bundle_version === "string" ? record.policy_bundle_version : "unknown",
+        cascade_layers: cascadeLayers,
+        winning_constraint: {
+            constraint_id: typeof winningConstraint.constraint_id === "string" ? winningConstraint.constraint_id : "unknown",
+            source_layer: typeof winningConstraint.source_layer === "string" && CASCADE_LAYER_NAMES.some((layer) => layer === winningConstraint.source_layer) ? winningConstraint.source_layer : "unknown",
+            source_dna_id: typeof winningConstraint.source_dna_id === "string" ? winningConstraint.source_dna_id : "unknown",
+            gene_id: typeof winningConstraint.gene_id === "string" ? winningConstraint.gene_id : "unknown",
+            codon_type: typeof winningConstraint.codon_type === "string" ? winningConstraint.codon_type : "unknown",
+            action: decision,
+            provenance_reason: typeof winningConstraint.provenance_reason === "string" ? winningConstraint.provenance_reason : "unknown",
+        },
+        compiled_ir_hash: typeof record.compiled_ir_hash === "string" ? record.compiled_ir_hash : "unknown",
+        decision: decision,
+        decision_reason: typeof record.decision_reason === "string" ? record.decision_reason : "unknown",
+        enforcement_point: typeof record.enforcement_point === "string" ? record.enforcement_point : "unknown",
+        harness_runtime_context: {
+            agent_id: typeof harnessRuntimeContext.agent_id === "string" ? harnessRuntimeContext.agent_id : typeof record.agent_id === "string" ? record.agent_id : "unknown",
+            agent_role: typeof harnessRuntimeContext.agent_role === "string" ? harnessRuntimeContext.agent_role : typeof record.agent_role === "string" ? record.agent_role : "unknown",
+            agent_type: typeof harnessRuntimeContext.agent_type === "string" ? harnessRuntimeContext.agent_type : typeof record.agent_type === "string" ? record.agent_type : "unknown",
+            session_agent: typeof harnessRuntimeContext.session_agent === "string" ? harnessRuntimeContext.session_agent : typeof record.session_agent === "string" ? record.session_agent : "unknown",
+            harness_adapter: typeof harnessRuntimeContext.harness_adapter === "string" ? harnessRuntimeContext.harness_adapter : typeof record.harness_adapter === "string" ? record.harness_adapter : "unknown",
+            runtime: typeof harnessRuntimeContext.runtime === "string" ? harnessRuntimeContext.runtime : typeof record.runtime === "string" ? record.runtime : "unknown",
+        },
+        session_id: typeof record.session_id === "string" ? record.session_id : "unknown",
+        run_id: typeof record.run_id === "string" ? record.run_id : "unknown",
+        step_id: typeof record.step_id === "string" ? record.step_id : "unknown",
+        tool_name: typeof record.tool_name === "string" ? record.tool_name : "unknown",
+        action_kind: typeof record.action_kind === "string" ? record.action_kind : "unknown",
+        resource_ref: typeof record.resource_ref === "string" ? record.resource_ref : "unknown",
+        evidence_refs: evidenceRefs.length > 0 ? evidenceRefs : [{ type: "unknown", ref: "unknown" }],
+    };
+}
+export async function readRuntimeDecisionEvents(projectDir, days = 1, sessionId) {
+    const entries = [];
+    if (sessionId) {
+        entries.push(...await readRuntimeDecisionFile(join(resolveStateDir(projectDir, sessionId), "runtime-decisions.jsonl")));
+    }
+    else {
+        entries.push(...await readGlobalRuntimeDecisionEvents(projectDir, days));
+    }
+    return entries.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+}
+async function readRuntimeDecisionFile(filePath) {
+    const entries = [];
+    try {
+        const content = await readFile(filePath, "utf-8");
+        for (const line of content.trim().split("\n")) {
+            if (!line)
+                continue;
+            try {
+                const event = normalizeRuntimeDecisionEvent(JSON.parse(line));
+                if (event)
+                    entries.push(event);
+            }
+            catch { /* skip malformed JSON */ }
+        }
+    }
+    catch { /* file doesn't exist */ }
+    return entries;
+}
+async function readGlobalRuntimeDecisionEvents(projectDir, days) {
+    const dir = join(projectDir, ".dna", "state", RUNTIME_DECISION_DIR);
+    const entries = [];
+    const cutoff = new Date();
+    cutoff.setDate(cutoff.getDate() - days);
+    const cutoffDate = cutoff.toISOString().slice(0, 10);
+    try {
+        const files = (await readdir(dir))
+            .filter(f => f.startsWith("runtime-decision-") && f.endsWith(".jsonl"))
+            .filter(f => f.slice("runtime-decision-".length, "runtime-decision-".length + 10) >= cutoffDate)
+            .sort();
+        for (const file of files)
+            entries.push(...await readRuntimeDecisionFile(join(dir, file)));
+    }
+    catch { /* no decisions yet */ }
+    return entries;
+}
 export async function readTraces(projectDir, days = 1, sessionId) {
     const entries = [];
     if (sessionId) {

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./schema/index.js";
 export * from "./compiler/index.js";
 export * from "./runtime/index.js";
+export * from "./governance/index.js";

package/dist/index.js

@@ -1,3 +1,4 @@
 export * from "./schema/index.js";
 export * from "./compiler/index.js";
 export * from "./runtime/index.js";
+export * from "./governance/index.js";

package/dist/mcp/tools-observability.js

@@ -5,7 +5,7 @@ export function createObservabilityTools(projectDir) {
     return [
         {
             name: "dna_kernel_report",
-            description: "Observability-only local kernel report. Reads traces/verifier results and optional preview-only marker changes; does not execute verifiers or mutate state.",
+            description: "Observability-only local kernel report. Reads RuntimeDecisionEvent as primary enterprise evidence; legacy traces/verifier results are diagnostic-only. Does not execute verifiers or mutate state.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -28,12 +28,12 @@ export function createObservabilityTools(projectDir) {
                     return textResult(JSON.stringify(report, null, 2));
                 }
                 return textResult(formatKernelReport(report) +
-                    "\nMCP observability only: this tool does not execute verifiers, does not enforce hook parity, and does not mutate state or markers.\n");
+                    "\nMCP observability only: RuntimeDecisionEvent is primary enterprise evidence; legacy traces/verifiers are diagnostic-only. This tool does not execute verifiers, does not enforce hook parity, and does not mutate state or markers.\n");
             },
         },
         {
             name: "dna_report_package",
-            description: "Read-only local evidence package with traces, verifier results, handoffs, diagnostics, deferrals, and fact-backed critical decisions.",
+            description: "Read-only local evidence package with RuntimeDecisionEvent primary evidence, diagnostic legacy traces/verifier results/handoffs, deferrals, and fact-backed critical decisions.",
             inputSchema: {
                 type: "object",
                 properties: {

package/dist/mcp/tools-state.d.ts

@@ -5,7 +5,7 @@
  *   - dna_status: Overview of DNA state
  *   - dna_workflow_read: Read current workflow state
  *   - dna_workflow_write: Update workflow state
- *   - dna_trace_query: Query trace data with filters
+ *   - dna_trace_query: Query legacy diagnostic trace data with filters
  */
 import type { ToolDef } from "./server.js";
 export declare function createStateTools(projectDir: string): ToolDef[];

package/dist/mcp/tools-state.js

@@ -5,10 +5,11 @@
  *   - dna_status: Overview of DNA state
  *   - dna_workflow_read: Read current workflow state
  *   - dna_workflow_write: Update workflow state
- *   - dna_trace_query: Query trace data with filters
+ *   - dna_trace_query: Query legacy diagnostic trace data with filters
  */
 import { resolve } from "node:path";
-import { readWorkflowState, writeWorkflowState, readTraces, listSessions } from "../hooks/state.js";
+import { readWorkflowState, writeWorkflowState, readRuntimeDecisionEvents, readTraces, listSessions } from "../hooks/state.js";
+import { validateRuntimeDecisionEvent } from "../governance/index.js";
 import { loadCompiledIR } from "../runtime/plugin-adapter.js";
 import { textResult } from "./server.js";
 function isStringRecord(value) {
@@ -20,7 +21,7 @@ export function createStateTools(projectDir) {
         // ── dna_status ────────────────────────────────────────
         {
             name: "dna_status",
-            description: "Overview of DNA governance state: compiled IR info, active workflow, session list, and recent enforcement stats",
+            description: "Overview of DNA governance state: compiled IR info, active workflow, sessions, RuntimeDecisionEvent evidence, and legacy diagnostic trace stats",
             inputSchema: { type: "object", properties: {} },
             handler: async () => {
                 const lines = [];
@@ -58,12 +59,21 @@ export function createStateTools(projectDir) {
                     const preview = sessions.slice(0, 5).join(", ");
                     lines.push(`\nSessions: ${sessions.length} (${preview}${sessions.length > 5 ? "..." : ""})`);
                 }
+                // Recent RuntimeDecisionEvent stats
+                const runtimeDecisions = await readRuntimeDecisionEvents(projectDir, 1);
+                if (runtimeDecisions.length > 0) {
+                    const enterprise = runtimeDecisions.filter(e => validateRuntimeDecisionEvent(e).classification === "enterprise_evidence");
+                    const blocks = enterprise.filter(e => e.decision === "block").length;
+                    const warns = enterprise.filter(e => e.decision === "warn").length;
+                    const escalates = enterprise.filter(e => e.decision === "escalate").length;
+                    lines.push(`\nRuntimeDecisionEvent (24h): ${runtimeDecisions.length} events, ${enterprise.length} enterprise evidence, ${blocks} blocks, ${warns} warns, ${escalates} escalates`);
+                }
                 // Recent trace stats
                 const traces = await readTraces(projectDir, 1);
                 if (traces.length > 0) {
                     const blocks = traces.filter(t => t.decision === "block").length;
                     const warns = traces.filter(t => t.decision === "warn").length;
-                    lines.push(`\nTrace (24h): ${traces.length} events, ${blocks} blocks, ${warns} warns`);
+                    lines.push(`\nLegacy trace diagnostics (24h): ${traces.length} events, ${blocks} blocks, ${warns} warns`);
                 }
                 return textResult(lines.join("\n"));
             },
@@ -71,7 +81,7 @@ export function createStateTools(projectDir) {
         // ── dna_workflow_read ─────────────────────────────────
         {
             name: "dna_workflow_read",
-            description: "Read current workflow state (step, role, iteration, artifacts)",
+            description: "Read current workflow runtime state (diagnostic/cache only; not enterprise evidence)",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -126,7 +136,7 @@ export function createStateTools(projectDir) {
         // ── dna_trace_query ──────────────────────────────────
         {
             name: "dna_trace_query",
-            description: "Query enforcement trace data with filters (blocks, warns, by tool, by path)",
+            description: "Query legacy diagnostic enforcement trace data with filters. Trace records are not enterprise evidence unless referenced by RuntimeDecisionEvent.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -150,7 +160,7 @@ export function createStateTools(projectDir) {
                     traces = traces.filter(t => t.tool_name === toolName);
                 const total = traces.length;
                 traces = traces.slice(-limit);
-                const lines = [`Trace: ${total} matching entries (showing last ${traces.length})`];
+                const lines = [`Legacy diagnostic trace: ${total} matching entries (showing last ${traces.length}); not enterprise evidence unless referenced by RuntimeDecisionEvent`];
                 for (const t of traces) {
                     const parts = [t.timestamp.slice(11, 19), t.event, t.decision];
                     if (t.tool_name)

package/dist/report/kernel-report.d.ts

@@ -18,6 +18,9 @@ export interface KernelReport {
         period_days: number;
     };
     summary: {
+        runtime_decisions: number;
+        enterprise_evidence: number;
+        legacy_diagnostics: number;
         traces: number;
         verifier_results: number;
         signals: number;
@@ -32,9 +35,33 @@ export interface KernelReport {
         blocks: number;
         warns: number;
         allows: number;
+        escalates: number;
+        validates: number;
         policy_denied_verifiers: number;
     };
     signals: ClassifiedSignal[];
+    runtime_decision_summary: {
+        total: number;
+        enterprise_evidence: number;
+        diagnostics: number;
+        blocks: number;
+        warns: number;
+        allows: number;
+        escalates: number;
+        validates: number;
+        top_policy_bundles: Array<{
+            policy_bundle_id: string;
+            count: number;
+        }>;
+        top_constraints: Array<{
+            constraint_id: string;
+            count: number;
+        }>;
+        top_decision_reasons: Array<{
+            reason: string;
+            count: number;
+        }>;
+    };
     verifier_summary: {
         total: number;
         passes: number;

package/dist/report/kernel-report.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { readTraces, readVerifierResults, safePathComponent } from "../hooks/state.js";
+import { readRuntimeDecisionEvents, readTraces, readVerifierResults, safePathComponent } from "../hooks/state.js";
+import { validateRuntimeDecisionEvent } from "../governance/index.js";
 import { describeMarkerChanges } from "../evolution/marker-gen.js";
 import { classifiedSignalsToOutcomes, classifyKernelSignals, } from "./kernel-signals.js";
 const CLASSIFICATIONS = [
@@ -50,6 +51,30 @@ function buildVerifierSummary(results) {
         failures: results.filter((result) => result.status === "fail").length,
     };
 }
+function buildRuntimeDecisionSummary(events) {
+    const enterpriseEvidence = events.filter((event) => validateRuntimeDecisionEvent(event).classification === "enterprise_evidence");
+    const blocks = enterpriseEvidence.filter((event) => event.decision === "block");
+    const warns = enterpriseEvidence.filter((event) => event.decision === "warn").length;
+    const allows = enterpriseEvidence.filter((event) => event.decision === "allow").length;
+    const escalates = enterpriseEvidence.filter((event) => event.decision === "escalate").length;
+    const validates = enterpriseEvidence.filter((event) => event.decision === "validate").length;
+    const reasons = blocks
+        .map((event) => event.decision_reason.split("\n")[0].replace(/^\[Intent DNA\]\s*/, "").slice(0, 100))
+        .filter((reason) => Boolean(reason));
+    return {
+        total: events.length,
+        enterprise_evidence: enterpriseEvidence.length,
+        diagnostics: events.length - enterpriseEvidence.length,
+        blocks: blocks.length,
+        warns,
+        allows,
+        escalates,
+        validates,
+        top_policy_bundles: sortedCounts(enterpriseEvidence.map((event) => event.policy_bundle_id), 5, "policy_bundle_id"),
+        top_constraints: sortedCounts(enterpriseEvidence.map((event) => event.winning_constraint.constraint_id), 5, "constraint_id"),
+        top_decision_reasons: sortedCounts(reasons, 5, "reason"),
+    };
+}
 async function readCompiledSourceIds(projectDir) {
     try {
         const raw = await readFile(join(projectDir, ".dna", "compiled", "ir.json"), "utf-8");
@@ -136,13 +161,15 @@ async function buildMarkerPreview(projectDir, explicitDnaId, signals) {
 }
 export async function buildKernelReport(options) {
     const days = options.days ?? 7;
+    const runtimeDecisions = await readRuntimeDecisionEvents(options.projectDir, days, options.sessionId);
     const traces = await readTraces(options.projectDir, days, options.sessionId);
     const verifierResults = (await readVerifierResults(options.projectDir, options.sessionId))
         .filter((result) => withinDays(result.timestamp, days));
-    const signals = classifyKernelSignals({ traces, verifierResults });
+    const signals = classifyKernelSignals({ runtimeDecisions, traces, verifierResults });
     const classifications = Object.fromEntries(CLASSIFICATIONS.map((classification) => [classification, 0]));
     for (const signal of signals)
         classifications[signal.classification]++;
+    const runtimeDecisionSummary = buildRuntimeDecisionSummary(runtimeDecisions);
     const traceSummary = buildTraceSummary(traces);
     const verifierSummary = buildVerifierSummary(verifierResults);
     const markerPreview = options.includeMarkerPreview
@@ -159,6 +186,9 @@ export async function buildKernelReport(options) {
             period_days: days,
         },
         summary: {
+            runtime_decisions: runtimeDecisions.length,
+            enterprise_evidence: runtimeDecisionSummary.enterprise_evidence,
+            legacy_diagnostics: traces.length + verifierResults.length + runtimeDecisionSummary.diagnostics,
             traces: traces.length,
             verifier_results: verifierResults.length,
             signals: signals.length,
@@ -166,16 +196,19 @@ export async function buildKernelReport(options) {
         },
         classifications,
         quality: {
-            quality_positive: signals.filter((signal) => signal.semantic === "quality-positive").length,
-            quality_negative: signals.filter((signal) => signal.semantic === "quality-negative").length,
+            quality_positive: 0,
+            quality_negative: 0,
         },
         enforcement: {
-            blocks: signals.filter((signal) => signal.semantic === "enforcement-block").length,
-            warns: signals.filter((signal) => signal.semantic === "enforcement-warn").length,
-            allows: signals.filter((signal) => signal.semantic === "enforcement-allow").length,
-            policy_denied_verifiers: signals.filter((signal) => signal.semantic === "policy-denied-verifier").length,
+            blocks: runtimeDecisionSummary.blocks,
+            warns: runtimeDecisionSummary.warns,
+            allows: runtimeDecisionSummary.allows,
+            escalates: runtimeDecisionSummary.escalates,
+            validates: runtimeDecisionSummary.validates,
+            policy_denied_verifiers: 0,
         },
         signals,
+        runtime_decision_summary: runtimeDecisionSummary,
         verifier_summary: verifierSummary,
         trace_summary: traceSummary,
         marker_preview: markerPreview,
@@ -194,15 +227,23 @@ export function formatKernelReport(report) {
     lines.push("=".repeat(50));
     lines.push("");
     lines.push(`Schema: ${report.schema_version}`);
-    lines.push(`Total events: ${report.trace_summary.total}`);
-    lines.push(`  Allowed: ${report.trace_summary.allows}`);
-    lines.push(`  Blocked: ${report.trace_summary.blocks}`);
-    lines.push(`  Warned:  ${report.trace_summary.warns}`);
+    lines.push(`RuntimeDecisionEvents: ${report.runtime_decision_summary.total}`);
+    lines.push(`  Enterprise evidence: ${report.runtime_decision_summary.enterprise_evidence}`);
+    lines.push(`  Diagnostic-only events: ${report.runtime_decision_summary.diagnostics}`);
+    lines.push(`  Allowed: ${report.runtime_decision_summary.allows}`);
+    lines.push(`  Blocked: ${report.runtime_decision_summary.blocks}`);
+    lines.push(`  Warned:  ${report.runtime_decision_summary.warns}`);
+    lines.push(`  Escalated: ${report.runtime_decision_summary.escalates}`);
+    lines.push(`  Validated: ${report.runtime_decision_summary.validates}`);
     lines.push("");
-    if (report.verifier_summary.total > 0) {
-        lines.push(`Verifier results: ${report.verifier_summary.total}`);
-        lines.push(`  Passed: ${report.verifier_summary.passes}`);
-        lines.push(`  Failed: ${report.verifier_summary.failures}`);
+    if (report.trace_summary.total > 0 || report.verifier_summary.total > 0) {
+        lines.push("Legacy diagnostics (not enterprise evidence without RuntimeDecisionEvent provenance):");
+        lines.push(`  Traces: ${report.trace_summary.total}`);
+        lines.push(`  Verifier results: ${report.verifier_summary.total}`);
+        if (report.verifier_summary.total > 0) {
+            lines.push(`    Passed: ${report.verifier_summary.passes}`);
+            lines.push(`    Failed: ${report.verifier_summary.failures}`);
+        }
         lines.push("");
     }
     lines.push(`Classified signals: ${report.summary.signals}`);
@@ -214,19 +255,19 @@ export function formatKernelReport(report) {
     lines.push(`  Unknown: ${report.classifications.unknown}`);
     lines.push("");
     if (report.trace_summary.top_blocked_tools.length > 0) {
-        lines.push("Top blocked tools:");
+        lines.push("Legacy diagnostic top blocked tools:");
         for (const item of report.trace_summary.top_blocked_tools)
             lines.push(`  ${item.tool}: ${item.count}`);
         lines.push("");
     }
     if (report.trace_summary.top_blocked_paths.length > 0) {
-        lines.push("Top blocked paths:");
+        lines.push("Legacy diagnostic top blocked paths:");
         for (const item of report.trace_summary.top_blocked_paths)
             lines.push(`  ${item.path}: ${item.count}`);
         lines.push("");
     }
     if (report.trace_summary.top_block_reasons.length > 0) {
-        lines.push("Top block reasons:");
+        lines.push("Legacy diagnostic top block reasons:");
         for (const item of report.trace_summary.top_block_reasons)
             lines.push(`  \"${item.reason}\": ${item.count}`);
         lines.push("");

package/dist/report/kernel-signals.d.ts

@@ -1,11 +1,12 @@
 import type { TraceEntry, VerifierResultEntry } from "../hooks/state.js";
 import type { ExecutionOutcome } from "../evolution/types.js";
+import { type RuntimeDecisionEvent } from "../governance/index.js";
 export type KernelSignalClassification = "protective" | "friction" | "positive" | "negative" | "neutral" | "unknown";
 export type KernelEvolutionEffect = "helped" | "hindered" | "neutral";
-export type KernelSignalSemantic = "quality-positive" | "quality-negative" | "enforcement-block" | "enforcement-warn" | "enforcement-allow" | "policy-denied-verifier" | "external";
+export type KernelSignalSemantic = "quality-positive" | "quality-negative" | "enforcement-block" | "enforcement-warn" | "enforcement-allow" | "enforcement-escalate" | "enforcement-validate" | "policy-denied-verifier" | "external";
 export interface ClassifiedSignal {
     id: string;
-    source_type: "trace" | "verifier" | "external";
+    source_type: "runtime_decision" | "trace" | "verifier" | "external";
     source_ref: string;
     timestamp: string;
     gene?: string;
@@ -22,11 +23,13 @@ export interface KernelSignalContext {
     friction_verifier_ids?: string[];
 }
 export interface ClassifyKernelSignalsInput {
+    runtimeDecisions?: RuntimeDecisionEvent[];
     traces?: TraceEntry[];
     verifierResults?: VerifierResultEntry[];
     context?: KernelSignalContext;
 }
 export declare function classifyVerifierResult(result: VerifierResultEntry, context?: KernelSignalContext): ClassifiedSignal[];
+export declare function classifyRuntimeDecisionEvent(event: RuntimeDecisionEvent): ClassifiedSignal;
 export declare function classifyTraceEntry(trace: TraceEntry, context?: KernelSignalContext): ClassifiedSignal;
 export declare function classifyKernelSignals(input: ClassifyKernelSignalsInput): ClassifiedSignal[];
 export declare function classifiedSignalsToOutcomes(signals: ClassifiedSignal[], dnaId: string): {

package/dist/report/kernel-signals.js

@@ -1,3 +1,4 @@
+import { validateRuntimeDecisionEvent } from "../governance/index.js";
 function extractGeneFromReason(reason) {
     if (!reason)
         return undefined;
@@ -61,6 +62,55 @@ function traceEvidencePayload(trace) {
     }
     return Object.keys(payload).length > 0 ? payload : undefined;
 }
+function runtimeDecisionEvidencePayload(event) {
+    return {
+        event_id: event.event_id,
+        decision: event.decision,
+        decision_reason: event.decision_reason,
+        policy_bundle_id: event.policy_bundle_id,
+        policy_bundle_version: event.policy_bundle_version,
+        compiled_ir_hash: event.compiled_ir_hash,
+        winning_constraint: event.winning_constraint,
+        evidence_refs: event.evidence_refs,
+        classification: validateRuntimeDecisionEvent(event).classification,
+    };
+}
+function semanticForRuntimeDecision(event) {
+    if (event.decision === "block")
+        return "enforcement-block";
+    if (event.decision === "warn")
+        return "enforcement-warn";
+    if (event.decision === "escalate")
+        return "enforcement-escalate";
+    if (event.decision === "validate")
+        return "enforcement-validate";
+    return "enforcement-allow";
+}
+function classificationForRuntimeDecision(event) {
+    const validation = validateRuntimeDecisionEvent(event);
+    if (validation.classification !== "enterprise_evidence") {
+        return {
+            classification: "unknown",
+            classification_reason: "RuntimeDecisionEvent is diagnostic-only because enterprise provenance is incomplete",
+            evolution_effect: "neutral",
+            eligible_for_marker_preview: false,
+        };
+    }
+    if (event.decision === "block") {
+        return {
+            classification: "protective",
+            classification_reason: "enterprise RuntimeDecisionEvent block is protective evidence",
+            evolution_effect: "neutral",
+            eligible_for_marker_preview: false,
+        };
+    }
+    return {
+        classification: "neutral",
+        classification_reason: "enterprise RuntimeDecisionEvent is primary evidence but not marker-preview feedback by default",
+        evolution_effect: "neutral",
+        eligible_for_marker_preview: false,
+    };
+}
 function isPolicyDeniedVerifier(result) {
     return result.evidence === "policy_denied" || result.exit_code === 126;
 }
@@ -121,6 +171,21 @@ export function classifyVerifierResult(result, context = {}) {
         };
     });
 }
+export function classifyRuntimeDecisionEvent(event) {
+    const sourceRef = `runtime_decision:${event.event_id}`;
+    const gene = event.winning_constraint.gene_id === "unknown" ? undefined : event.winning_constraint.gene_id;
+    return {
+        id: sourceRef,
+        source_type: "runtime_decision",
+        source_ref: sourceRef,
+        timestamp: event.timestamp,
+        gene,
+        semantic: semanticForRuntimeDecision(event),
+        ...classificationForRuntimeDecision(event),
+        evidence_ref: sourceRef,
+        evidence_payload: runtimeDecisionEvidencePayload(event),
+    };
+}
 export function classifyTraceEntry(trace, context = {}) {
     const gene = extractGeneFromReason(trace.reason);
     const sourceRef = `trace:${trace.trace_id}`;
@@ -175,11 +240,28 @@ export function classifyTraceEntry(trace, context = {}) {
     };
 }
 export function classifyKernelSignals(input) {
+    const runtimeDecisions = input.runtimeDecisions ?? [];
     const traces = input.traces ?? [];
     const verifierResults = input.verifierResults ?? [];
     return [
-        ...traces.map((trace) => classifyTraceEntry(trace, input.context)),
-        ...verifierResults.flatMap((result) => classifyVerifierResult(result, input.context)),
+        ...runtimeDecisions.map((event) => classifyRuntimeDecisionEvent(event)),
+        ...traces.map((trace) => {
+            const signal = classifyTraceEntry(trace, input.context);
+            return {
+                ...signal,
+                classification: "unknown",
+                classification_reason: `legacy diagnostic trace only: ${signal.classification_reason}`,
+                evolution_effect: "neutral",
+                eligible_for_marker_preview: false,
+            };
+        }),
+        ...verifierResults.flatMap((result) => classifyVerifierResult(result, input.context).map((signal) => ({
+            ...signal,
+            classification: "unknown",
+            classification_reason: `legacy diagnostic verifier only: ${signal.classification_reason}`,
+            evolution_effect: "neutral",
+            eligible_for_marker_preview: false,
+        }))),
     ].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
 }
 export function classifiedSignalsToOutcomes(signals, dnaId) {