kiokuko-dsh 0.2.21 → 0.2.23

package/docs/getting-started.md

@@ -5,7 +5,7 @@
 
 ## Install
 
-DeepSeek Harness `0.2.1-alpha.2` and Node.js 24.16.0 or newer are required.
+Use current official DeepSeek Harness and Node.js 24.16.0 or newer. Compatibility is checked against actual host APIs and the resolved upstream source revision, not a fixed DSH release label. See [verified scope](current-upstream-compatibility-report.md).
 
 From a DeepSeek Harness checkout:
 

package/docs/guardrail.md

@@ -8,7 +8,7 @@ Each owned write and test launch receives final transactional lease reauthorizat
 
 Completion status exposes separate capability metadata for bounded protocol validation, lease-checked owned effects, process-only Node tests, and protected-required Lisp effects; rollback and heap restoration are false. Selected Node tests are ordinary JavaScript: the runner is not an OS sandbox against undeclared filesystem or network effects.
 
-The bounded CL-like language is declarative, without arbitrary Common Lisp evaluation or heap restoration. Existing workflow metadata and task authority remain the only state authority. Enrolled Lisp effects require the protected owned-tool route; unrestricted development Lisp is unavailable while enrolled. The guardrail is not an OS sandbox or global permission system. Hashes identify inputs and ordinary integrity, not malicious same-user filesystem races. Non-enrolled work retains its existing behavior.
+The bounded CL-like language is declarative, without arbitrary Common Lisp evaluation or heap restoration. Existing workflow metadata and task authority remain the only state authority. Enrolled Lisp effects require the protected owned-tool route; unrestricted development Lisp is unavailable while enrolled. Enrollment does not prohibit protected Lisp RPC: protected calls retain their existing authorization and owned-effect gates. The guardrail is not an OS sandbox or global permission system. Hashes identify inputs and ordinary integrity, not malicious same-user filesystem races. Non-enrolled work retains its existing behavior.
 
 ## Installation and checks
 
@@ -17,17 +17,24 @@ The full package and core module include precompiled artifacts, protocol, Node r
 - `npm run verify:guardrail`: verify all bundled hashes, modes, ELF/Mach-O structure and recorded native-execution status without running cross-built binaries.
 - `npm run check:guardrail`: verify availability and integrity for the current host; missing or invalid assets fail closed.
 
-`package.json` pins `guardrail/manifest.json`, which binds protocol bytes, each executable and its original release manifest. Manifests include source/build inputs and compiler/linker provenance. Product and engine versions are independently metadata-derived. The resolver rejects symlinks, non-regular/non-executable files, malformed or truncated executables, wrong architectures and identity mismatches.
+`package.json` pins `guardrail/manifest.json`, which binds protocol bytes, each executable and its release manifest, frozen source identity and observed build-record digest. Manifests include source/build inputs and compiler/linker provenance. Product and engine versions are independently metadata-derived. The resolver rejects symlinks, non-regular/non-executable files, malformed or truncated executables, wrong architectures and identity mismatches.
 
 ## Target status
 
 - Linux x64: static musl ELF; native CLI smoke and reproducible-build checks passed on Linux x64.
 - Linux ARM64: static musl ELF, cloud cross-built; native execution not run.
-- macOS Apple Silicon (ARM64): cloud cross-built Mach-O, minimum macOS 13; native execution not run. ARM64 ad-hoc signature structure was checked.
+- macOS Apple Silicon (ARM64): cloud cross-built Mach-O, minimum macOS 13; native execution not run. No native execution or developer-signing claim is made.
 - Intel Mac and other hosts: unsupported; no substitute architecture is selected.
 
 Cross-build, format and hash checks do not establish native compatibility, arbitrary runtime behavior, notarization or developer signing. Package smoke execution applies only to its actual host. Linux musl binaries have no dynamic ELF interpreter.
 
 ## Repository source and maintenance
 
-The repository includes the actual dependency-free Rust library/CLI at [crates/guardrail](../crates/guardrail/README.md), including the restricted-language/evidence-wire specification, protocol, Cargo lockfile and tests. [Build and release instructions](../crates/guardrail-release/BUILDING.md) accompany the pinned official-source toolchain inputs and portable offline recipe. This source/build layer is excluded from npm runtime tarballs; runtime [third-party notices](guardrail-licenses/README.md) remain included. Original recorded repeat-build evidence does not mean an adapted wrapper has reproduced every target. Historical Intel Mac records remain in the frozen source and release provenance for identity verification; they do not describe current shipping support.
+The repository includes the actual dependency-free Rust library/CLI at [crates/guardrail](../crates/guardrail/README.md), including the restricted-language/evidence-wire specification, protocol, Cargo lockfile and tests. [Build and release instructions](../crates/guardrail-release/BUILDING.md) accompany the pinned official-source toolchain inputs and portable offline recipe. This source/build layer is excluded from npm runtime tarballs; runtime [third-party notices](guardrail-licenses/README.md) remain included. The current release recipe records actual build-process results for each target, separately from static manifest integrity and native execution. The unsigned local process records are not an independent or signed supply-chain attestation. Current source changes require real rebuilding; updating a source label on old binary bytes is not rebuilding.
+
+
+## Build and source integrity boundaries
+
+In a source checkout, `verify:guardrail` additionally hashes the complete current crate and rejects stale source manifests, target source maps and release provenance. In a runtime package, `resolveGuardrail` checks the source identity and build/output record against the package-pinned manifest. Both are static checks; neither proves a test was executed. The build wrapper captures source identity before and after two separate builds and binds their observed successful exits to the resulting binary and package hashes. Cross-built targets require separate native acceptance.
+
+No collection of unsigned hashes can resist an actor able to rewrite the whole package and its history. The records are local process evidence, not a cryptographic proof of trustworthy compilation or a signature.

package/docs/lisp-prototype-planning.md

@@ -7,7 +7,7 @@ small authorized target-runtime probes, choose controls/counterexamples before
 execution, retain observations and failures, and use that evidence in one plan.
 Existing permissions, read-only inputs, scratch, host approvals, generation and
 result ownership, recovery and verification contracts remain authoritative.
-Non-coding tasks do not acquire a coding-experiment requirement. Native coding preparation now enforces actual prototype execution and complete saved-result inspection before implementation, with a two-failure retry budget. Planning relevance remains model guidance; a successful probe does not prove task completion. The evaluation records below describe their original source snapshots.
+Non-coding tasks do not acquire a coding-experiment requirement. Ordinary native coding preparation recommends useful Lisp prototypes but does not enforce their execution order. Explicitly protected coding workflows retain actual prototype execution and complete saved-result inspection before implementation, with a two-failure retry budget. Existing permissions and recovery rules still apply; cancellation or uncertain side effects never trigger automatic fallback. Planning relevance remains model guidance; a successful probe does not prove task completion. The evaluation records below describe their original source snapshots.
 
 The full representation remains the default. Runtime compilation preserves the
 new block and the previous contract. The unchanged fixed size baseline still

package/docs/lisp.md

@@ -89,7 +89,7 @@ starts a worker. Variables, definitions and references are lost on restart; the
 agent receives the new generation and must rebuild helpers without replaying
 completed effects. Crashes and explicit cancellation still require human recovery.
 
-Enter a normal implementation or debugging request in DSH, including dsh-cli. Clear unowned native implementation requests now offer Lisp before model generation, including native Bash. A manually enabled session uses the selected route and requires a fresh `lisp_eval` prototype (`prototype: true`) followed by complete saved-result inspection through `lisp_inspect` before implementation. ON alone does not mark prototype verification successful. This routine is bounded to two failed attempts; repair the cause or explicitly disable Lisp. Native permissions, Stop and read-only conversation/research remain independent.
+Enter a normal implementation or debugging request in DSH, including dsh-cli. Clear unowned native implementation requests now offer Lisp before model generation, including native Bash. A manually enabled session uses the selected route. Ordinary development prefers Lisp for useful calculations and transformations but does not require a preliminary prototype or automatic Lisp-to-Bash fallback. An explicitly protected coding workflow still requires a fresh `lisp_eval` prototype (`prototype: true`) followed by complete saved-result inspection through `lisp_inspect` before implementation, with its two-failure retry budget. ON alone is not verification. Explicit cancellation, numeric cancel, submitted Skip and `ASK_CANCELLED` end the implementation attempt while preserving work; hiding a named card alone leaves its question pending. Cancellation never authorizes a different execution route. A new independent conversation/read does not inherit the ended question gate. Native permissions, Stop and read-only conversation/research remain independent.
 With `typedDecisions.mode: auto`, an accepted Jev/Laya `build` or `debug`
 classification reaches the existing Lisp question without repeating the task-category
 question. Laya receives complete requests up to 4096 UTF-8 bytes, including quoted

package/docs/managed-operation-journal.md

@@ -0,0 +1,21 @@
+# Managed operation journal coverage
+
+This is a host audit, not a sandbox or an OS-wide side-effect tracer.
+
+## Boundaries
+
+- LispManager wraps each worker request in a collection scope, including zero-operation evaluations. The bridge journals development-mode `run`/`start-job`, effectful `tool-call`, and `ci-verify` admission before existing authority checks and dispatch. Pure calculations and reads do not invent an external operation.
+- OwnedExecutionService journals direct `kioku_exec`, `kioku_write`, `kioku_edit`, and `kioku_remove` calls. Existing task/plan/approval/protocol checks remain responsible for authorization. Existing owned receipts remain the original effect records.
+- Protected LispWorker's supervised process launches use an audit callback installed by LispManager. Existing beforeJob authorization remains mandatory. Worker jobs enter the cancellation registry immediately after launch, including when subsequent journal persistence fails.
+- For an owned call nested inside Lisp, the bridge attempt and the owned original have explicit reference linkage: the child scope's parentId is the bridge operationId; only the child carries originalRef. These are not two subprocesses. Count canonical owned effects by unique originalRef, not by counting all journal rows. Child observations update the parent reference independently of Lisp's final value.
+- Each owned child collection seals before bounded protocol receipt issuance. The enclosing Lisp evaluation scope stays open until its worker request ends. Protocol binding uses actual captured task leases and separate worker, protocol and lease generations.
+
+## Out of scope
+
+Direct DSH-native tools not passing these plugin adapters, arbitrary SBCL file I/O/FFI, and external actions hidden inside unrelated tools are not intercepted. The journal does not prove sandbox isolation or semantic consumption of Lisp values. `delivery` concerns the host adapter return only, not model understanding or a transport-level acknowledgement from SBCL.
+
+## Failure behavior
+
+Journal preparation and dispatch claim must persist before the effect callback is invoked. An uncertain result does not trigger retry. Native unknown results block further managed effects for that session until host reconciliation; ordinary reads and pure Lisp evaluation remain available. An explicit denial before dispatch is distinct from an unknown outcome. Timeout alone does not prove process termination. Owned original IDs retain existing durable replay protection; replay does not issue another external operation.
+
+Snapshots are immutable projections. A late owned result reconciles its linked original and parent reference; it does not rewrite a prior snapshot. Existing protocol evidence requires its own structured Node test observation in addition to the journal, never just exit zero.

package/docs/memory-lifecycle-verification.md

@@ -8,14 +8,15 @@
 
 ## 再現手順
 
-Node.jsと固定版DSHを用意し、その実体を指定する。以下のパスは実際のインストール先へ置き換える。
+Node.js と公式 DSH の現在のソースを用意する。`node scripts/resolve-dsh-upstream.mjs` で一度解決した SHA を公式 checkout に適用し、その checkout の frozen install と `pnpm run build:artifacts` を完了させる。以下のパスはその実体へ置き換える。SHA は互換対象の固定値ではなく、この実行で検証するソースの識別子である。
 
 ```sh
-export DSH_BIN=/absolute/path/to/node_modules/.bin/dsh
-export KIOKUKO_DSH_PACKAGE_ROOT=/absolute/path/to/node_modules
+export KIOKUKO_EXPECTED_DSH_SHA=$(git -C /absolute/path/to/official-dsh rev-parse HEAD)
+node scripts/stage-dsh-upstream.mjs /absolute/path/to/official-dsh tests/fixtures/dsh-runtime "$KIOKUKO_EXPECTED_DSH_SHA" .
+export DSH_BIN="$PWD/tests/fixtures/dsh-runtime/node_modules/.bin/dsh"
+export KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules"
 export KIOKUKO_REQUIRE_DSH_NATIVE=1
 export KIOKUKO_REQUIRE_DSH_CLI=1
-export KIOKUKO_EXPECTED_DSH_VERSION=0.2.1-alpha.2
 export KIOKUKO_REPEATED_REPORT_DIR=/tmp/kiokuko-lifecycle-results
 export KIOKUKO_DSH_EVIDENCE_PATH=/tmp/kiokuko-package-lifecycle.json
 

package/docs/tool-exposure.md

@@ -1,5 +1,7 @@
 # Automatic native tool exposure
 
+On hosts where the executor supplies schemas after the prompt waterfall, Kiokuko preserves the provider's admitted tools and reports `unsupported_runtime` for presentation reduction. `phase`, `lean`, and `auto` do not claim tool or description savings on that API. Native permissions, task guards, and scoped protocol tools remain authoritative; no older runtime is selected.
+
 `toolExposure.mode` controls only which Kiokuko-owned definitions appear in native model requests. The default is `auto`. On all DSH native provider connections, normal chat, research, analysis, writing and review omit the nine Kiokuko model tools. Normal build, debug and devops use lean descriptions with the current phase and `nextAction` policy. An active Enno selection takes precedence over task type and uses that same policy. Native and external tools remain available. Configure explicitly with:
 
 ```yaml

package/guardrail/aarch64-apple-darwin/manifest.json

@@ -1,12 +1,12 @@
 {
   "artifacts": {
     "README.md": {
-      "bytes": 10748,
-      "sha256": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55"
+      "bytes": 12849,
+      "sha256": "485609fcb1a844bdc7b9098da622001a0c15430f835c33ba9e6ea5c1458b1cdb"
     },
     "bin/kiokuko-guardrail": {
-      "bytes": 384672,
-      "sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4"
+      "bytes": 417712,
+      "sha256": "5e08acf36e6648c34f1fe317ff9806a76cbddd37434b41db5395e95dee0571fc"
     },
     "protocols/coding-routine.lisp": {
       "bytes": 948,
@@ -14,15 +14,9 @@
     }
   },
   "build_inputs": {
-    "cargo_sha256": "e951141cc55a6cd7b9876d187bd30a3720e6086b99413af95e3b8de1cdd72f14",
-    "cargo_version": "cargo 1.99.0 (5f94df478 2026-08-27)",
+    "cargo_sha256": "a670e02cfa39ac2e53f77a2d911ca1fc9e2c479b0603ec956625be1daf24e3af",
+    "cargo_version": "cargo 1.99.1 (5f94df478 2026-08-27)",
     "command": [
-      "env",
-      "SOURCE_DATE_EPOCH=0",
-      "MACOSX_DEPLOYMENT_TARGET=13.0",
-      "LD_LIBRARY_PATH=RUST_TOOLCHAIN/lib",
-      "RUSTFLAGS=--remap-path-prefix=SOURCE=kiokuko-guardrail --remap-path-prefix=TEMP=build",
-      "LINKER=zig-0.17.0-cc-strip-target-aarch64-macos.13.0.0",
       "cargo",
       "build",
       "--manifest-path",
@@ -33,34 +27,36 @@
       "--target",
       "aarch64-apple-darwin"
     ],
-    "rustc_sha256": "f3834d26669b03f6855fa54bd2381443123e860167bc0c7a8dd137e5cf6e5e4f",
-    "rustc_version": "rustc 1.99.0 (b940084d7 2026-09-28)\nbinary: rustc\ncommit-hash: b940084d7eb6a299eb4bfeb8e34901bc051e7ac4\ncommit-date: 2026-09-28\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.0\nLLVM version: 23.1.1",
+    "rustc_sha256": "b53b780f77f952062f8ca8a3b70aef2390b1e45ad91939be94afdc9543026853",
+    "rustc_version": "rustc 1.99.1 (58cf8f9c3 2026-10-13)\nbinary: rustc\ncommit-hash: 58cf8f9c35b355199727627d07ae34a4e2846d67\ncommit-date: 2026-10-13\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.1\nLLVM version: 23.1.1",
     "source_date_epoch": 0,
     "target": "aarch64-apple-darwin"
   },
   "package": "kiokuko-guardrail",
   "schema": 1,
   "scope": "Declared source/compiler/build inputs and artifact identity. This is not a signature, sandbox, or a claim of deterministic model inference or identical binaries across target operating systems.",
-  "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+  "source_sha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
   "sources": {
     "BOOTSTRAP.md": "b9d0db4c38561d6173e2396bfca979743c66fe64dc15f8c10931d5ae02800a95",
     "Cargo.lock": "16f51b3ffc20349a69b4b580ea59d2354c9d496911c7e530509492d9b46ecb3a",
     "Cargo.toml": "1cc0b8df18413f925841e6acddfe14a49f7e8dd4236660eb9d822f1ccdcc9d4e",
-    "README.md": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55",
+    "README.md": "485609fcb1a844bdc7b9098da622001a0c15430f835c33ba9e6ea5c1458b1cdb",
     "examples/coding-routine.lisp": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49",
     "scripts/package.py": "159b8cdda58b422a60aee95554eb0febc3b520d7ef5d5a4bac1cdd046a514e16",
     "scripts/test.py": "d8ed547d0943f8b23838b146c6e1d31ad9004c525868d19a2fffafef67e6b6c9",
     "src/digest.rs": "a46aa8ac0ba3f8e29e268a495723b6d49a4741399bb595c34a3d021dc295c800",
     "src/eval.rs": "7742caeeac426783647363242d93845369c018b00528312573f1cdc668c22ec3",
-    "src/host.rs": "de9f34ad6ce8246e6f80cbf3d4f56bb07ed8043b17232135755a5e3ee5602cf5",
+    "src/host.rs": "a8a850ff7b41bd6169ed79bf745fe0b1d8854545ceb6a745cb96428472489eac",
     "src/lib.rs": "2f591de0e7520a313da9668491da106d904bb19ef2384c717e87cd06bac665a3",
     "src/main.rs": "16a3a42d8338ca20e66173648c0a407b24724eeb1a4b3710c8a3b90b5aade10f",
     "src/protocol.rs": "d9009f5977707141f3547902a07f2f2c5455e4b9516b01a9ba4eb22a82af2a39",
     "src/reader.rs": "7bc1ff7aece72fc44ac43d5a207a3c8f2fd009eae41cb4b4dadb4eb9436d15f3",
-    "tests/cli.rs": "22955ba315007b4a18409b31439345eb84ce0a62b88658cf440d513b10811357",
+    "tests/cli.rs": "d07df01919bdbcc78f6960ace69b3df38cb90bd4a28fb51de1d004382ac2cec9",
     "tests/digest.rs": "63a3a1b4963ef03260cae4ff9bfeed3596a445dc8df74ecc91b5750d3a6fa28d",
     "tests/edge_contract.rs": "4f9c7b068db44e9beceb811ceac4a5e8d6cf7cda51eee5a2449f29ab0fa6ade9",
     "tests/evaluator.rs": "a09c811494615b01e19ccef78491b8bbfee07fede8dcbee59f384fe59e145401",
+    "tests/evidence_schema.rs": "4f8e24d88c5148b6782edb06977d6ffa352fa27bd51a53589e92360ffa7013bc",
+    "tests/fixtures/schema2-green.lisp": "ce937e565ccb9c6c7d5e00afe516f222a226e2a2b8152e41e1d8776f89602745",
     "tests/packaging.rs": "61ae1bfed0d4f31748ce2af58953387045f4231370d46cb809f26e93aea1e033",
     "tests/protocol.rs": "8f6b7ad5842f5b596efe8da01bba84f39fcd8d6426fde6932cb2a5cbb44d589f",
     "tests/reader.rs": "249092f56768a6511dbb15825be55f4cf0105269cb9dba1d6f8169ff66d44ab5",

package/guardrail/aarch64-unknown-linux-musl/manifest.json

@@ -1,12 +1,12 @@
 {
   "artifacts": {
     "README.md": {
-      "bytes": 10748,
-      "sha256": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55"
+      "bytes": 12849,
+      "sha256": "485609fcb1a844bdc7b9098da622001a0c15430f835c33ba9e6ea5c1458b1cdb"
     },
     "bin/kiokuko-guardrail": {
-      "bytes": 445888,
-      "sha256": "62b8f751d99e24c71d4223037221207ecd7877ddbf0ac3784e31df26c8af0beb"
+      "bytes": 468824,
+      "sha256": "9b2fa78a3f13fbb4efd2dd5cf3f80892bf70ad30ee26c9b995ab2d2ebb203cf3"
     },
     "protocols/coding-routine.lisp": {
       "bytes": 948,
@@ -14,13 +14,9 @@
     }
   },
   "build_inputs": {
-    "cargo_sha256": "e951141cc55a6cd7b9876d187bd30a3720e6086b99413af95e3b8de1cdd72f14",
-    "cargo_version": "cargo 1.99.0 (5f94df478 2026-08-27)",
+    "cargo_sha256": "a670e02cfa39ac2e53f77a2d911ca1fc9e2c479b0603ec956625be1daf24e3af",
+    "cargo_version": "cargo 1.99.1 (5f94df478 2026-08-27)",
     "command": [
-      "env",
-      "SOURCE_DATE_EPOCH=0",
-      "RUSTFLAGS=--remap-path-prefix=SOURCE=kiokuko-guardrail --remap-path-prefix=TEMP=build -C linker-flavor=ld.lld -C link-self-contained=yes",
-      "LINKER=rust-lld-LLD 23.1.1 (/checkout/src/llvm-project/llvm 1b9c0d5ff9bbe7634aead059efe6b11a7eeba145) (compatible with GNU linkers)",
       "cargo",
       "build",
       "--manifest-path",
@@ -31,34 +27,36 @@
       "--target",
       "aarch64-unknown-linux-musl"
     ],
-    "rustc_sha256": "f3834d26669b03f6855fa54bd2381443123e860167bc0c7a8dd137e5cf6e5e4f",
-    "rustc_version": "rustc 1.99.0 (b940084d7 2026-09-28)\nbinary: rustc\ncommit-hash: b940084d7eb6a299eb4bfeb8e34901bc051e7ac4\ncommit-date: 2026-09-28\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.0\nLLVM version: 23.1.1",
+    "rustc_sha256": "b53b780f77f952062f8ca8a3b70aef2390b1e45ad91939be94afdc9543026853",
+    "rustc_version": "rustc 1.99.1 (58cf8f9c3 2026-10-13)\nbinary: rustc\ncommit-hash: 58cf8f9c35b355199727627d07ae34a4e2846d67\ncommit-date: 2026-10-13\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.1\nLLVM version: 23.1.1",
     "source_date_epoch": 0,
     "target": "aarch64-unknown-linux-musl"
   },
   "package": "kiokuko-guardrail",
   "schema": 1,
   "scope": "Declared source/compiler/build inputs and artifact identity. This is not a signature, sandbox, or a claim of deterministic model inference or identical binaries across target operating systems.",
-  "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+  "source_sha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
   "sources": {
     "BOOTSTRAP.md": "b9d0db4c38561d6173e2396bfca979743c66fe64dc15f8c10931d5ae02800a95",
     "Cargo.lock": "16f51b3ffc20349a69b4b580ea59d2354c9d496911c7e530509492d9b46ecb3a",
     "Cargo.toml": "1cc0b8df18413f925841e6acddfe14a49f7e8dd4236660eb9d822f1ccdcc9d4e",
-    "README.md": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55",
+    "README.md": "485609fcb1a844bdc7b9098da622001a0c15430f835c33ba9e6ea5c1458b1cdb",
     "examples/coding-routine.lisp": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49",
     "scripts/package.py": "159b8cdda58b422a60aee95554eb0febc3b520d7ef5d5a4bac1cdd046a514e16",
     "scripts/test.py": "d8ed547d0943f8b23838b146c6e1d31ad9004c525868d19a2fffafef67e6b6c9",
     "src/digest.rs": "a46aa8ac0ba3f8e29e268a495723b6d49a4741399bb595c34a3d021dc295c800",
     "src/eval.rs": "7742caeeac426783647363242d93845369c018b00528312573f1cdc668c22ec3",
-    "src/host.rs": "de9f34ad6ce8246e6f80cbf3d4f56bb07ed8043b17232135755a5e3ee5602cf5",
+    "src/host.rs": "a8a850ff7b41bd6169ed79bf745fe0b1d8854545ceb6a745cb96428472489eac",
     "src/lib.rs": "2f591de0e7520a313da9668491da106d904bb19ef2384c717e87cd06bac665a3",
     "src/main.rs": "16a3a42d8338ca20e66173648c0a407b24724eeb1a4b3710c8a3b90b5aade10f",
     "src/protocol.rs": "d9009f5977707141f3547902a07f2f2c5455e4b9516b01a9ba4eb22a82af2a39",
     "src/reader.rs": "7bc1ff7aece72fc44ac43d5a207a3c8f2fd009eae41cb4b4dadb4eb9436d15f3",
-    "tests/cli.rs": "22955ba315007b4a18409b31439345eb84ce0a62b88658cf440d513b10811357",
+    "tests/cli.rs": "d07df01919bdbcc78f6960ace69b3df38cb90bd4a28fb51de1d004382ac2cec9",
     "tests/digest.rs": "63a3a1b4963ef03260cae4ff9bfeed3596a445dc8df74ecc91b5750d3a6fa28d",
     "tests/edge_contract.rs": "4f9c7b068db44e9beceb811ceac4a5e8d6cf7cda51eee5a2449f29ab0fa6ade9",
     "tests/evaluator.rs": "a09c811494615b01e19ccef78491b8bbfee07fede8dcbee59f384fe59e145401",
+    "tests/evidence_schema.rs": "4f8e24d88c5148b6782edb06977d6ffa352fa27bd51a53589e92360ffa7013bc",
+    "tests/fixtures/schema2-green.lisp": "ce937e565ccb9c6c7d5e00afe516f222a226e2a2b8152e41e1d8776f89602745",
     "tests/packaging.rs": "61ae1bfed0d4f31748ce2af58953387045f4231370d46cb809f26e93aea1e033",
     "tests/protocol.rs": "8f6b7ad5842f5b596efe8da01bba84f39fcd8d6426fde6932cb2a5cbb44d589f",
     "tests/reader.rs": "249092f56768a6511dbb15825be55f4cf0105269cb9dba1d6f8169ff66d44ab5",

package/guardrail/build-records.json

@@ -0,0 +1,198 @@
+{
+  "schema": 1,
+  "sourceSha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+  "scope": "Observed unsigned local build records; not an independent or signed attestation.",
+  "targets": {
+    "x86_64-unknown-linux-musl": {
+      "builderSha256": "08d11e39c450c0515fe68d9a23901ff18ab2f0421ae92c32cd4a9720b80c94a9",
+      "target": "x86_64-unknown-linux-musl",
+      "sourceSha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+      "binarySha256": "828126da26891c8afa4cab9a8446fb6ff4a1883fd45a4556626942f0535b1f5d",
+      "packageSha256": "ec5f9b19deb93b4ce6530081efba7db209296965633feae6942482ab808dacc9",
+      "independentBuildsEqual": true,
+      "nativeSmoke": "passed",
+      "cargoSha256": "a670e02cfa39ac2e53f77a2d911ca1fc9e2c479b0603ec956625be1daf24e3af",
+      "rustcSha256": "b53b780f77f952062f8ca8a3b70aef2390b1e45ad91939be94afdc9543026853",
+      "linkerSha256": "a23ecab8ff08f09ad8c80602c2c5df7f49e09c25905cb8975902e101bf72635f",
+      "builds": [
+        {
+          "startedAt": "2026-10-23T00:35:51.485383+00:00",
+          "finishedAt": "2026-10-23T00:35:59.459126+00:00",
+          "exitCode": 0,
+          "binarySha256": "828126da26891c8afa4cab9a8446fb6ff4a1883fd45a4556626942f0535b1f5d",
+          "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "stderrSha256": "7045c86392225cf581d03a890ef12657603e871c0b79605027dc63ca52100a21",
+          "command": [
+            "CARGO",
+            "build",
+            "--manifest-path",
+            "SOURCE/Cargo.toml",
+            "--locked",
+            "--offline",
+            "--release",
+            "--target",
+            "x86_64-unknown-linux-musl"
+          ],
+          "compilerArguments": [
+            "--remap-path-prefix=SOURCE=kiokuko-guardrail",
+            "--remap-path-prefix=TEMP=build"
+          ]
+        },
+        {
+          "startedAt": "2026-10-23T00:35:59.462570+00:00",
+          "finishedAt": "2026-10-23T00:36:06.773213+00:00",
+          "exitCode": 0,
+          "binarySha256": "828126da26891c8afa4cab9a8446fb6ff4a1883fd45a4556626942f0535b1f5d",
+          "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "stderrSha256": "7aa8fe01514f9c3db6d2916eb61cf730b6f6d120db9d6bffa73e5b1717bad9b7",
+          "command": [
+            "CARGO",
+            "build",
+            "--manifest-path",
+            "SOURCE/Cargo.toml",
+            "--locked",
+            "--offline",
+            "--release",
+            "--target",
+            "x86_64-unknown-linux-musl"
+          ],
+          "compilerArguments": [
+            "--remap-path-prefix=SOURCE=kiokuko-guardrail",
+            "--remap-path-prefix=TEMP=build"
+          ]
+        }
+      ],
+      "scope": "Observed local build process and output hashes; unsigned, not an independent attestation. Cross-built outputs are not native-tested."
+    },
+    "aarch64-unknown-linux-musl": {
+      "builderSha256": "08d11e39c450c0515fe68d9a23901ff18ab2f0421ae92c32cd4a9720b80c94a9",
+      "target": "aarch64-unknown-linux-musl",
+      "sourceSha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+      "binarySha256": "9b2fa78a3f13fbb4efd2dd5cf3f80892bf70ad30ee26c9b995ab2d2ebb203cf3",
+      "packageSha256": "bba8060d03dc3759acbdff31f480b031a63c0596a66df6c435b9211eaebda9bf",
+      "independentBuildsEqual": true,
+      "nativeSmoke": "not run",
+      "cargoSha256": "a670e02cfa39ac2e53f77a2d911ca1fc9e2c479b0603ec956625be1daf24e3af",
+      "rustcSha256": "b53b780f77f952062f8ca8a3b70aef2390b1e45ad91939be94afdc9543026853",
+      "linkerSha256": "9b6f51f983a8184f5d47d224e336cdb35171ad5b138981bc62a22e6d65e7b214",
+      "builds": [
+        {
+          "startedAt": "2026-10-23T00:35:51.510883+00:00",
+          "finishedAt": "2026-10-23T00:35:58.903705+00:00",
+          "exitCode": 0,
+          "binarySha256": "9b2fa78a3f13fbb4efd2dd5cf3f80892bf70ad30ee26c9b995ab2d2ebb203cf3",
+          "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "stderrSha256": "6a13e5ec1693ea9a1d3b4765bae1aaed1d9d8b74eeef1ed70b45a9d54347eb3b",
+          "command": [
+            "CARGO",
+            "build",
+            "--manifest-path",
+            "SOURCE/Cargo.toml",
+            "--locked",
+            "--offline",
+            "--release",
+            "--target",
+            "aarch64-unknown-linux-musl"
+          ],
+          "compilerArguments": [
+            "--remap-path-prefix=SOURCE=kiokuko-guardrail",
+            "--remap-path-prefix=TEMP=build",
+            "-C",
+            "linker-flavor=ld.lld",
+            "-C",
+            "link-self-contained=yes"
+          ]
+        },
+        {
+          "startedAt": "2026-10-23T00:35:58.910429+00:00",
+          "finishedAt": "2026-10-23T00:36:06.485552+00:00",
+          "exitCode": 0,
+          "binarySha256": "9b2fa78a3f13fbb4efd2dd5cf3f80892bf70ad30ee26c9b995ab2d2ebb203cf3",
+          "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "stderrSha256": "8585afc7adbaa104b28541d2aa8954fd42b6e074d49a06405aa33866ca399e47",
+          "command": [
+            "CARGO",
+            "build",
+            "--manifest-path",
+            "SOURCE/Cargo.toml",
+            "--locked",
+            "--offline",
+            "--release",
+            "--target",
+            "aarch64-unknown-linux-musl"
+          ],
+          "compilerArguments": [
+            "--remap-path-prefix=SOURCE=kiokuko-guardrail",
+            "--remap-path-prefix=TEMP=build",
+            "-C",
+            "linker-flavor=ld.lld",
+            "-C",
+            "link-self-contained=yes"
+          ]
+        }
+      ],
+      "scope": "Observed local build process and output hashes; unsigned, not an independent attestation. Cross-built outputs are not native-tested."
+    },
+    "aarch64-apple-darwin": {
+      "builderSha256": "08d11e39c450c0515fe68d9a23901ff18ab2f0421ae92c32cd4a9720b80c94a9",
+      "target": "aarch64-apple-darwin",
+      "sourceSha256": "969f1ba962a89ae5131c3a0dcf51311785536b13add3b4bec26b13b03b4008d6",
+      "binarySha256": "5e08acf36e6648c34f1fe317ff9806a76cbddd37434b41db5395e95dee0571fc",
+      "packageSha256": "267f330c690afc47b023fcd0fdbd68618e4c4fd77b8fdfccf68b13348888f551",
+      "independentBuildsEqual": true,
+      "nativeSmoke": "not run",
+      "cargoSha256": "a670e02cfa39ac2e53f77a2d911ca1fc9e2c479b0603ec956625be1daf24e3af",
+      "rustcSha256": "b53b780f77f952062f8ca8a3b70aef2390b1e45ad91939be94afdc9543026853",
+      "linkerSha256": "7c61539af19fa4082c94848f1c2b57b89e76dc6cfd5bd4c57764c3caf8f82272",
+      "builds": [
+        {
+          "startedAt": "2026-10-23T00:35:51.682721+00:00",
+          "finishedAt": "2026-10-23T00:36:03.586468+00:00",
+          "exitCode": 0,
+          "binarySha256": "5e08acf36e6648c34f1fe317ff9806a76cbddd37434b41db5395e95dee0571fc",
+          "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "stderrSha256": "564dc867aee91f90930d27c9a0678a511f7d69dd7ffbe855037378f5e7287741",
+          "command": [
+            "CARGO",
+            "build",
+            "--manifest-path",
+            "SOURCE/Cargo.toml",
+            "--locked",
+            "--offline",
+            "--release",
+            "--target",
+            "aarch64-apple-darwin"
+          ],
+          "compilerArguments": [
+            "--remap-path-prefix=SOURCE=kiokuko-guardrail",
+            "--remap-path-prefix=TEMP=build"
+          ]
+        },
+        {
+          "startedAt": "2026-10-23T00:36:03.607150+00:00",
+          "finishedAt": "2026-10-23T00:36:14.341218+00:00",
+          "exitCode": 0,
+          "binarySha256": "5e08acf36e6648c34f1fe317ff9806a76cbddd37434b41db5395e95dee0571fc",
+          "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "stderrSha256": "2e5c362a940ae334d3655e64dbf56d99da75266159942111261e2e4620eadcba",
+          "command": [
+            "CARGO",
+            "build",
+            "--manifest-path",
+            "SOURCE/Cargo.toml",
+            "--locked",
+            "--offline",
+            "--release",
+            "--target",
+            "aarch64-apple-darwin"
+          ],
+          "compilerArguments": [
+            "--remap-path-prefix=SOURCE=kiokuko-guardrail",
+            "--remap-path-prefix=TEMP=build"
+          ]
+        }
+      ],
+      "scope": "Observed local build process and output hashes; unsigned, not an independent attestation. Cross-built outputs are not native-tested."
+    }
+  }
+}