intentdna 1.7.4 → 1.8.0

package/dist/compiler/cascade.js

@@ -109,15 +109,10 @@ function prefixRecordKeys(record, ns) {
 function prefixController(controller, ns) {
     return {
         ...controller,
-        diagnosis_workflow: `${ns}_${controller.diagnosis_workflow}`,
-        fix_workflow: `${ns}_${controller.fix_workflow}`,
-        roles: {
-            analyzer: `${ns}_${controller.roles.analyzer}`,
-            analysis_reviewer: `${ns}_${controller.roles.analysis_reviewer}`,
-            surgeon: `${ns}_${controller.roles.surgeon}`,
-            fix_reviewer: `${ns}_${controller.roles.fix_reviewer}`,
-            test_runner: `${ns}_${controller.roles.test_runner}`,
-        },
+        workflow: controller.workflow ? `${ns}_${controller.workflow}` : undefined,
+        diagnosis_workflow: controller.diagnosis_workflow ? `${ns}_${controller.diagnosis_workflow}` : undefined,
+        fix_workflow: controller.fix_workflow ? `${ns}_${controller.fix_workflow}` : undefined,
+        roles: Object.fromEntries(Object.entries(controller.roles).map(([roleKey, roleName]) => [roleKey, `${ns}_${roleName}`])),
     };
 }
 function prefixLegibilityAssets(map, ns) {

package/dist/compiler/compile.js

@@ -384,6 +384,7 @@ export function compileDNA(activated, cascaded) {
             workflowsIR.push({
                 workflow_name: wfKey,
                 namespace,
+                step_ids: (wf.steps ?? []).map((step) => step.id),
                 step_checkpoints: wfStepCheckpoints,
                 active_roles: activeRoles,
                 handoff_chain: handoffChain,

package/dist/governance/evidence-capture-attribution.d.ts

@@ -0,0 +1,12 @@
+import type { ConstraintIR } from "../schema/types.js";
+export interface EvidenceCaptureAttributionHint {
+    workflowAsset?: string;
+    workflowId?: string;
+    stepId?: string;
+}
+export interface TrustedEvidenceCaptureAttribution {
+    workflowAsset: string;
+    workflowId: string;
+    stepId: string;
+}
+export declare function trustedEvidenceCaptureAttribution(ir: ConstraintIR, hint: EvidenceCaptureAttributionHint): TrustedEvidenceCaptureAttribution;

package/dist/governance/evidence-capture-attribution.js

@@ -0,0 +1,46 @@
+const UNKNOWN_ATTRIBUTION = "unknown";
+function canonicalWorkflowAsset(ir) {
+    const sourceIds = [...new Set(ir.source_dna_ids)]
+        .filter((sourceId) => sourceId.length > 0)
+        .filter((sourceId) => !sourceId.startsWith("species:"))
+        .filter((sourceId) => !sourceId.startsWith("enterprise:"));
+    return sourceIds.length === 1 ? sourceIds[0] : undefined;
+}
+function attributedWorkflow(ir, workflowId) {
+    if (workflowId) {
+        return ir.workflows_ir?.find((workflow) => workflow.workflow_name === workflowId);
+    }
+    return ir.workflows_ir?.length === 1 ? ir.workflows_ir[0] : undefined;
+}
+function workflowStepIds(ir, workflow) {
+    return new Set([
+        ...(workflow.step_ids ?? []),
+        ...workflow.step_checkpoints.map((checkpoint) => checkpoint.step_id),
+        ...workflow.handoff_chain.map((handoff) => handoff.step_id),
+        ...(workflow.step_enforce_rules ?? []).map((rule) => rule.step_id),
+        ...(ir.verifier_specs ?? [])
+            .filter((spec) => spec.workflow_name === workflow.workflow_name)
+            .map((spec) => spec.step_id)
+            .filter((stepId) => typeof stepId === "string"),
+    ]);
+}
+export function trustedEvidenceCaptureAttribution(ir, hint) {
+    const workflow = attributedWorkflow(ir, hint.workflowId);
+    const invalidExplicitWorkflow = Boolean(hint.workflowId && !workflow);
+    if (invalidExplicitWorkflow) {
+        return {
+            workflowAsset: UNKNOWN_ATTRIBUTION,
+            workflowId: UNKNOWN_ATTRIBUTION,
+            stepId: UNKNOWN_ATTRIBUTION,
+        };
+    }
+    const canonicalAsset = canonicalWorkflowAsset(ir);
+    const workflowAsset = canonicalAsset
+        ? hint.workflowAsset === canonicalAsset ? hint.workflowAsset : canonicalAsset
+        : UNKNOWN_ATTRIBUTION;
+    const workflowId = workflow?.workflow_name ?? UNKNOWN_ATTRIBUTION;
+    const stepId = workflow && hint.stepId && workflowStepIds(ir, workflow).has(hint.stepId)
+        ? hint.stepId
+        : UNKNOWN_ATTRIBUTION;
+    return { workflowAsset, workflowId, stepId };
+}

package/dist/governance/index.d.ts

@@ -5,4 +5,6 @@
  */
 export type { AuditReport, RemoteDNAPolicy, PolicyContent, PolicyScope, PolicyUpdate, GovernanceConfig, GovernanceClient, GovernanceResponse, GovernanceSubscription, } from "./types.js";
 export { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION, validateRuntimeDecisionEvent, } from "./runtime-decision-event.js";
+export { trustedEvidenceCaptureAttribution } from "./evidence-capture-attribution.js";
+export type { EvidenceCaptureAttributionHint, TrustedEvidenceCaptureAttribution, } from "./evidence-capture-attribution.js";
 export type { CascadeDecisionTrace, CascadeLayerFingerprint, CascadeLayerName, CascadeLayers, EnforcementPoint, ExplicitPlaceholder, HarnessRuntimeContext, PolicyBundle, RuntimeDecision, RuntimeDecisionEvent, RuntimeDecisionEventValidationResult, RuntimeEvidenceRef, WinningConstraint, } from "./runtime-decision-event.js";

package/dist/governance/index.js

@@ -4,3 +4,4 @@
  * Exports the v1.7.1 enterprise evidence contract plus reserved remote governance interfaces.
  */
 export { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION, validateRuntimeDecisionEvent, } from "./runtime-decision-event.js";
+export { trustedEvidenceCaptureAttribution } from "./evidence-capture-attribution.js";

package/dist/hooks/cli.d.ts

@@ -47,7 +47,11 @@ export interface RunHookEventOptions {
     sessionId?: string;
     roles?: Record<string, RoleDef>;
 }
+export declare function normalizeHookOutputForEvent(output: HookOutput, event: HookEvent): HookOutput;
 export declare function runHookEvent(options: RunHookEventOptions): Promise<HookOutput>;
+export declare function codexHookEventForInput(rawInput: Record<string, unknown>, args: string[]): unknown;
+declare function inferWorkflowAssetFromIr(ir: ConstraintIR, workflowId?: string): string | undefined;
+declare function runCodexHookWithLoadedIr(rawInput: Record<string, unknown>, projectDir: string, args: string[], ir: ConstraintIR): Promise<import("../runtime/codex-adapter.js").CodexHookRunnerResult>;
 declare function recordProducedArtifacts(projectDir: string, ir: ConstraintIR, wfState: {
     workflow: string;
     current_step: string;
@@ -86,6 +90,8 @@ declare function finalizeAndResolveArtifactsForHook(projectDir: string, ir: Cons
 export declare const recordProducedArtifactsForTest: typeof recordProducedArtifacts;
 export declare const resolveWorkflowArtifactFactsForTest: typeof resolveWorkflowArtifactFacts;
 export declare const readWorkflowStateForHookTest: typeof readWorkflowStateForHook;
+export declare const runCodexHookWithLoadedIrForTest: typeof runCodexHookWithLoadedIr;
+export declare const inferWorkflowAssetFromIrForTest: typeof inferWorkflowAssetFromIr;
 export declare const resolveWorkflowArtifactFactsForHookTest: typeof resolveWorkflowArtifactFactsForHook;
 export declare const finalizeAndResolveArtifactsForHookTest: typeof finalizeAndResolveArtifactsForHook;
 export declare function appendStopVerifierWarnings(output: HookOutput, verifierResults: VerifierResultEntry[], currentStep?: string): HookOutput;

package/dist/hooks/cli.js

@@ -23,10 +23,11 @@ import { fileURLToPath } from "node:url";
 import { readStdin, writeOutput, silentOutput, allowOutput, blockOutput, stopOutput } from "./protocol.js";
 import { validateHookInput } from "./schema.js";
 import { enforcePreToolUse, enforcePostToolUse, enforceUserPromptSubmit, enforceSubagentStop, enforcePreCompact, enforceNotification, enforceSessionStart, enforceStop, extractBashWritePaths, checkReflectionLimit, checkContextReadiness, checkWorkflowBoundary, } from "./enforce.js";
-import { appendAudit, readWorkflowState, appendTrace, appendRuntimeDecisionEvent, rotateTraces, readTraces, cleanStaleState, readSurgeonAttempts, writeSurgeonAttempts, appendSessionRead, readSessionReads, appendVerifierResult, appendCompletedArtifact, artifactIdentity, buildArtifactKey, readArtifactManifest, resolveArtifactTemplate, safePathComponent, writeArtifactManifest } from "./state.js";
+import { appendAudit, readWorkflowState, appendTrace, appendRuntimeDecisionEvent, appendEvidenceCaptureEvent, rotateTraces, readTraces, cleanStaleState, readSurgeonAttempts, writeSurgeonAttempts, appendSessionRead, readSessionReads, appendVerifierResult, appendCompletedArtifact, artifactIdentity, buildArtifactKey, readArtifactManifest, resolveArtifactTemplate, safePathComponent, writeArtifactManifest, EVIDENCE_CAPTURE_SCHEMA_VERSION } from "./state.js";
 import { hookEventsForSurface } from "./event-registry.js";
 import { writeAuditEvent } from "../audit/index.js";
-import { RUNTIME_DECISION_EVENT_SCHEMA_VERSION } from "../governance/index.js";
+import { RUNTIME_DECISION_EVENT_SCHEMA_VERSION, trustedEvidenceCaptureAttribution } from "../governance/index.js";
+import { runCodexHook } from "../runtime/codex-adapter.js";
 // ── Constants ──────────────────────────────────────────────
 const DEFAULT_IR_PATH = ".dna/compiled/ir.json";
 const VALID_EVENTS = new Set(hookEventsForSurface("cli"));
@@ -150,6 +151,74 @@ function buildRuntimeDecisionEvent(params) {
         evidence_refs: [{ type: "trace", ref: params.traceId }],
     };
 }
+function captureResultForHook(rawInput, decision) {
+    if (decision === "block")
+        return "blocked";
+    if (typeof rawInput.result === "string" && ["success", "failure", "blocked", "skipped", "unknown", "unsupported"].includes(rawInput.result)) {
+        return rawInput.result;
+    }
+    if (typeof rawInput.exit_code === "number")
+        return rawInput.exit_code === 0 ? "success" : "failure";
+    return "unknown";
+}
+function captureFactForHook(rawInput, decision, event) {
+    if (decision === "block")
+        return "blocker";
+    if (event === "PostToolUse" || event === "Stop" || rawInput.result || rawInput.exit_code !== undefined)
+        return "result";
+    const toolInput = typeof rawInput.tool_input === "object" && rawInput.tool_input !== null
+        ? rawInput.tool_input
+        : {};
+    if (typeof rawInput.command === "string" || typeof toolInput.command === "string")
+        return "command";
+    return "result";
+}
+function commandForHook(rawInput) {
+    const toolInput = typeof rawInput.tool_input === "object" && rawInput.tool_input !== null
+        ? rawInput.tool_input
+        : {};
+    const command = rawInput.command ?? toolInput.command;
+    return typeof command === "string" && command.trim().length > 0 ? command : undefined;
+}
+function buildClaudeEvidenceCaptureEvent(params) {
+    const fact = captureFactForHook(params.rawInput, params.decision, params.event);
+    const result = captureResultForHook(params.rawInput, params.decision);
+    const command = commandForHook(params.rawInput);
+    const toolName = typeof params.rawInput.tool_name === "string" ? params.rawInput.tool_name : "unknown tool";
+    const subject = command ?? `${toolName} ${params.event}`;
+    const attribution = trustedEvidenceCaptureAttribution(params.ir, {
+        workflowAsset: params.wfState?.workflow_asset,
+        workflowId: params.wfState?.workflow,
+        stepId: params.wfState?.current_step ?? params.runtimeEvent.step_id,
+    });
+    return {
+        schema_version: EVIDENCE_CAPTURE_SCHEMA_VERSION,
+        event_id: `c5:${params.runtimeEvent.event_id}`,
+        captured_at: params.runtimeEvent.timestamp,
+        project_root: params.projectDir,
+        source: "claude_code",
+        workflow_asset: attribution.workflowAsset,
+        workflow_id: attribution.workflowId,
+        run_id: params.runtimeEvent.run_id || params.runtimeEvent.session_id || "unknown",
+        step_id: attribution.stepId === "unknown" && !params.wfState
+            ? `${params.event}:direct`
+            : attribution.stepId,
+        fact,
+        summary: `Claude hook observed ${fact} for ${subject}: ${result}`,
+        command,
+        result,
+        exit_code: typeof params.rawInput.exit_code === "number" ? params.rawInput.exit_code : undefined,
+        duration_ms: typeof params.rawInput.duration_ms === "number" ? params.rawInput.duration_ms : undefined,
+        manual_intervention: fact === "manual_intervention"
+            ? { required: true, reason: params.reason, actor: "human" }
+            : undefined,
+        evidence_refs: [
+            { type: "runtime_decision_event", ref: params.runtimeEvent.event_id },
+            ...params.runtimeEvent.evidence_refs.map((ref) => ({ type: ref.type, ref: ref.ref })),
+        ],
+        redaction: "intentdna.c5.claude_hook_secret_redaction.v1",
+    };
+}
 export function computeSummary(traces) {
     let blocks = 0, warns = 0;
     const toolCounts = new Map();
@@ -193,7 +262,12 @@ export function formatSummary(s) {
 async function main() {
     // Parse args
     const args = process.argv.slice(2);
-    const event = args[0];
+    const eventArg = args[0];
+    if (eventArg === "CodexHook") {
+        await runCodexHookCli(args);
+        return;
+    }
+    const event = eventArg;
     if (!event || !VALID_EVENTS.has(event)) {
         writeOutput(silentOutput());
         return;
@@ -227,13 +301,25 @@ async function main() {
     const output = await runHookEvent({ event, ir, rawInput, projectDir, sessionId });
     writeOutput(output);
 }
+export function normalizeHookOutputForEvent(output, event) {
+    if (!output.hookSpecificOutput)
+        return output;
+    return {
+        ...output,
+        hookSpecificOutput: {
+            ...output.hookSpecificOutput,
+            hookEventName: output.hookSpecificOutput.hookEventName ?? event,
+        },
+    };
+}
 export async function runHookEvent(options) {
     const { event, ir, rawInput, projectDir, sessionId, roles } = options;
+    const finish = (output) => normalizeHookOutputForEvent(output, event);
     const state = {};
     const writeRuntimeDecision = async (output, result, wfState, traceId = randomUUID()) => {
         const decision = normalizeDecision(output);
         const reason = decision !== "allow" ? (output.reason ?? output.hookSpecificOutput?.additionalContext ?? "unknown") : "allowed by active policy";
-        await appendRuntimeDecisionEvent(projectDir, buildRuntimeDecisionEvent({
+        const runtimeEvent = buildRuntimeDecisionEvent({
             ir,
             rawInput,
             output,
@@ -245,7 +331,18 @@ export async function runHookEvent(options) {
             decision,
             reason,
             wfState,
-        }), sessionId);
+        });
+        await appendRuntimeDecisionEvent(projectDir, runtimeEvent, sessionId);
+        await appendEvidenceCaptureEvent(projectDir, buildClaudeEvidenceCaptureEvent({
+            ir,
+            rawInput,
+            event,
+            projectDir,
+            decision,
+            reason,
+            runtimeEvent,
+            wfState,
+        }));
     };
     let wfStateRaw = null;
     // Load workflow state for events that need it (handoff context + PreCompact preservation)
@@ -253,13 +350,14 @@ export async function runHookEvent(options) {
         const workflowState = await readWorkflowStateForHook(projectDir, event, sessionId);
         if ("output" in workflowState) {
             await writeRuntimeDecision(workflowState.output, { output: workflowState.output, trace: { matched_rule: "workflow_boundary" } }, null);
-            return workflowState.output;
+            return finish(workflowState.output);
         }
         wfStateRaw = workflowState.state;
         if (wfStateRaw && wfStateRaw.active) {
             state.workflowState = {
                 current_step: wfStateRaw.current_step,
                 workflow: wfStateRaw.workflow,
+                workflow_asset: wfStateRaw.workflow_asset,
                 current_role: wfStateRaw.current_role,
                 completed_artifacts: wfStateRaw.completed_artifacts,
                 iteration: wfStateRaw.iteration, // G4: pass iteration for state-driven rules
@@ -268,7 +366,7 @@ export async function runHookEvent(options) {
             if ("output" in artifactFacts) {
                 appendArtifactResolverTrace(projectDir, event, wfStateRaw, artifactFacts.output, sessionId);
                 await writeRuntimeDecision(artifactFacts.output, { output: artifactFacts.output, trace: { matched_rule: "handoff", step_id: wfStateRaw.current_step } }, wfStateRaw);
-                return artifactFacts.output;
+                return finish(artifactFacts.output);
             }
             state.artifactFacts = artifactFacts.facts;
         }
@@ -298,7 +396,7 @@ export async function runHookEvent(options) {
                 timestamp: new Date().toISOString(),
             }, sessionId).catch(() => { });
             await writeRuntimeDecision(gateResult.output, { output: gateResult.output, trace: { matched_rule: gateResult.matched_rule, step_id: wfStateRaw?.current_step } }, wfStateRaw, traceId);
-            return gateResult.output;
+            return finish(gateResult.output);
         }
     }
     // Special handling for Stop — needs async workflow state read + session summary
@@ -306,7 +404,7 @@ export async function runHookEvent(options) {
         const workflowState = await readWorkflowStateForHook(projectDir, event, sessionId);
         if ("output" in workflowState) {
             await writeRuntimeDecision(workflowState.output, { output: workflowState.output, trace: { matched_rule: "workflow_boundary" } }, null);
-            return workflowState.output;
+            return finish(workflowState.output);
         }
         const wfState = workflowState.state;
         let stopArtifactFacts = [];
@@ -315,7 +413,7 @@ export async function runHookEvent(options) {
             if ("output" in artifactFacts) {
                 appendArtifactResolverTrace(projectDir, event, wfState, artifactFacts.output, sessionId);
                 await writeRuntimeDecision(artifactFacts.output, { output: artifactFacts.output, trace: { matched_rule: "handoff", step_id: wfState.current_step } }, wfState);
-                return artifactFacts.output;
+                return finish(artifactFacts.output);
             }
             stopArtifactFacts = artifactFacts.facts;
         }
@@ -375,7 +473,7 @@ export async function runHookEvent(options) {
             timestamp: new Date().toISOString(),
         }, sessionId).catch(() => { });
         await writeRuntimeDecision(stopOutput, { output: stopOutput, trace: { matched_rule: "validator", step_id: wfState?.current_step } }, wfState, traceId);
-        return stopOutput;
+        return finish(stopOutput);
     }
     // Dispatch to enforcement engine with timing
     const start = Date.now();
@@ -488,7 +586,7 @@ export async function runHookEvent(options) {
             session_id: sessionId,
         }).catch(() => { }); // Fail-open
     }
-    return output;
+    return finish(output);
 }
 // ── Dispatch ───────────────────────────────────────────────
 function dispatch(event, ir, input, state, roles) {
@@ -542,6 +640,62 @@ function dispatch(event, ir, input, state, roles) {
             return null;
     }
 }
+// ── Codex Hook Entry ───────────────────────────────────────
+function argValue(args, flag) {
+    const index = args.indexOf(flag);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function codexInstallMode(value) {
+    return value === "plugin_scoped" || value === "managed" || value === "none" ? value : "project_fallback";
+}
+export function codexHookEventForInput(rawInput, args) {
+    return argValue(args, "--codex-event") ?? rawInput.event;
+}
+function inferWorkflowAssetFromIr(ir, workflowId) {
+    const attribution = trustedEvidenceCaptureAttribution(ir, { workflowId });
+    return attribution.workflowAsset === "unknown" ? undefined : attribution.workflowAsset;
+}
+async function runCodexHookWithLoadedIr(rawInput, projectDir, args, ir) {
+    const sessionId = typeof rawInput.session_id === "string"
+        ? rawInput.session_id
+        : typeof rawInput.sessionId === "string"
+            ? rawInput.sessionId
+            : undefined;
+    const sessionWorkflowState = sessionId
+        ? await readWorkflowState(projectDir, sessionId)
+        : null;
+    const workflowState = sessionWorkflowState ?? await readWorkflowState(projectDir);
+    const workflowAsset = inferWorkflowAssetFromIr(ir, workflowState?.workflow);
+    return runCodexHook({ ...rawInput, event: codexHookEventForInput(rawInput, args) }, {
+        ir,
+        projectDir,
+        hookInstallMode: codexInstallMode(argValue(args, "--codex-install-mode")),
+        hookTrusted: true,
+        codexVersion: process.env.CODEX_VERSION,
+        workflowAsset,
+        workflowId: workflowState?.workflow,
+        stepId: workflowState?.current_step,
+        appendEvent: true,
+    });
+}
+async function runCodexHookCli(args) {
+    try {
+        const rawInput = await readStdin(5000);
+        const projectDir = typeof rawInput.cwd === "string" ? rawInput.cwd : process.cwd();
+        const irPath = argValue(args, "--ir") ?? DEFAULT_IR_PATH;
+        const ir = await loadIR(resolve(projectDir, irPath));
+        if (!ir) {
+            writeOutput(silentOutput());
+            return;
+        }
+        const result = await runCodexHookWithLoadedIr(rawInput, projectDir, args, ir);
+        writeOutput(result.output);
+    }
+    catch (err) {
+        process.stderr.write(`\n  Intent DNA: CodexHook failed open — ${err instanceof Error ? err.message : String(err)}\n`);
+        writeOutput(silentOutput());
+    }
+}
 // ── IR Loading ─────────────────────────────────────────────
 /** Expected IR schema version — must match plugin-adapter.ts */
 const EXPECTED_IR_VERSION = 1;
@@ -765,6 +919,8 @@ function appendArtifactResolverTrace(projectDir, event, wfState, output, session
 export const recordProducedArtifactsForTest = recordProducedArtifacts;
 export const resolveWorkflowArtifactFactsForTest = resolveWorkflowArtifactFacts;
 export const readWorkflowStateForHookTest = readWorkflowStateForHook;
+export const runCodexHookWithLoadedIrForTest = runCodexHookWithLoadedIr;
+export const inferWorkflowAssetFromIrForTest = inferWorkflowAssetFromIr;
 export const resolveWorkflowArtifactFactsForHookTest = resolveWorkflowArtifactFactsForHook;
 export const finalizeAndResolveArtifactsForHookTest = finalizeAndResolveArtifactsForHook;
 function clearBlockingVerifierCheckpoints(ir, workflowState) {

package/dist/hooks/enforce.d.ts

@@ -26,6 +26,7 @@ export interface EnforceState {
     workflowState?: {
         current_step: string;
         workflow: string;
+        workflow_asset?: string;
         current_role?: string;
         completed_artifacts?: CompletedArtifactEntry[];
         /** G4: current workflow iteration (for relax_after_iteration rules) */

package/dist/hooks/protocol.d.ts

@@ -4,7 +4,7 @@
  * TypeScript types for Claude Code hook I/O and stdin/stdout utilities.
  * All hooks read JSON from stdin and write JSON to stdout.
  *
- * Protocol reference: docs/references/cc-source-analysis.md §2
+ * Protocol reference: docs/archive/2026H1/references/cc-source-analysis.md §2
  */
 export type { HookEvent } from "./event-registry.js";
 /** Base fields present in all hook inputs */

package/dist/hooks/protocol.js

@@ -4,7 +4,7 @@
  * TypeScript types for Claude Code hook I/O and stdin/stdout utilities.
  * All hooks read JSON from stdin and write JSON to stdout.
  *
- * Protocol reference: docs/references/cc-source-analysis.md §2
+ * Protocol reference: docs/archive/2026H1/references/cc-source-analysis.md §2
  */
 // ── Output Helpers ─────────────────────────────────────────
 /** Create an allow output, optionally injecting text into the conversation. */

package/dist/hooks/state.d.ts

@@ -11,9 +11,11 @@
  */
 import type { ArtifactFact, ArtifactKey, ArtifactManifest, CompletedArtifactEntry, HandoffArtifact, HandoffType, VerifierKind, VerifierSeverity, VerifierWhen } from "../schema/types.js";
 import { type RuntimeDecisionEvent } from "../governance/index.js";
+export declare const EVIDENCE_CAPTURE_SCHEMA_VERSION = "intentdna.evidence_capture.v1";
 /** Workflow state written by runtime and read by hooks */
 export interface DNAWorkflowState {
     active: boolean;
+    workflow_asset?: string;
     workflow: string;
     current_step: string;
     current_role: string;
@@ -51,6 +53,44 @@ export interface SurgeonAttemptState {
         lesson: string;
     }>;
 }
+export type EvidenceCaptureSource = "dna_hook" | "codex_cli" | "claude_code" | "dna_cli" | "manual";
+export type EvidenceCaptureFact = "command" | "result" | "retry" | "manual_intervention" | "blocker" | "handoff";
+export type EvidenceCaptureResult = "success" | "failure" | "blocked" | "skipped" | "unknown" | "unsupported";
+export interface EvidenceCaptureRetry {
+    attempt: number;
+    max_attempts: number;
+    reason: string;
+}
+export interface EvidenceCaptureManualIntervention {
+    required: boolean;
+    reason: string;
+    actor: string;
+}
+export interface EvidenceCaptureRef {
+    type: string;
+    ref: string;
+}
+export interface EvidenceCaptureEvent {
+    schema_version: typeof EVIDENCE_CAPTURE_SCHEMA_VERSION;
+    event_id: string;
+    captured_at: string;
+    project_root: string;
+    source: EvidenceCaptureSource;
+    workflow_asset: string;
+    workflow_id: string;
+    run_id: string;
+    step_id: string;
+    fact: EvidenceCaptureFact;
+    summary: string;
+    command?: string;
+    result?: EvidenceCaptureResult;
+    exit_code?: number;
+    duration_ms?: number;
+    retry?: EvidenceCaptureRetry;
+    manual_intervention?: EvidenceCaptureManualIntervention;
+    evidence_refs?: EvidenceCaptureRef[];
+    redaction?: string;
+}
 export declare function safePathComponent(value: string, label: string): string;
 /**
  * Resolve state directory path.
@@ -181,6 +221,7 @@ export interface TraceEntry {
  * Fail-open: never throws.
  */
 export declare function appendTrace(projectDir: string, entry: TraceEntry, sessionId?: string): Promise<void>;
+export declare function appendEvidenceCaptureEvent(projectDir: string, event: EvidenceCaptureEvent): Promise<void>;
 export declare function appendRuntimeDecisionEvent(projectDir: string, event: RuntimeDecisionEvent, sessionId?: string): Promise<void>;
 export declare function readRuntimeDecisionEvents(projectDir: string, days?: number, sessionId?: string): Promise<RuntimeDecisionEvent[]>;
 export declare function readTraces(projectDir: string, days?: number, sessionId?: string): Promise<TraceEntry[]>;