kiokuko-dsh 0.2.8 → 0.2.9

package/guardrail/manifest.json

@@ -0,0 +1,204 @@
+{
+  "schema": 1,
+  "package": "kiokuko-guardrail",
+  "version": "0.1.0",
+  "protocol": {
+    "path": "guardrail/protocols/coding-routine.lisp",
+    "bytes": 948,
+    "sha256": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49"
+  },
+  "targets": {
+    "x86_64-unknown-linux-musl": {
+      "platform": "linux",
+      "arch": "x64",
+      "binary": "guardrail/x86_64-unknown-linux-musl/kiokuko-guardrail",
+      "manifest": "guardrail/x86_64-unknown-linux-musl/manifest.json",
+      "manifestSha256": "00e2c0ebf29867ff87e5c6e47c25e4c65d8884f70a8ace85f63717932356197c",
+      "bytes": 516792,
+      "sha256": "d262a712893945a1525dc9c8f19c806a44a832747879c1af8f6e33634b15636b",
+      "verification": {
+        "independent_builds_equal": true,
+        "native_smoke": "passed",
+        "package_sha256": "27273d1914e0c406425722973dec110da019c37ca6dd43afdff8f8c86013b868",
+        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+        "static_no_pt_interp": true
+      }
+    },
+    "aarch64-unknown-linux-musl": {
+      "platform": "linux",
+      "arch": "arm64",
+      "binary": "guardrail/aarch64-unknown-linux-musl/kiokuko-guardrail",
+      "manifest": "guardrail/aarch64-unknown-linux-musl/manifest.json",
+      "manifestSha256": "2f1560bb9aa7b12ecba9000f0ae540598e433a06869138c861a68ecc26fd2787",
+      "bytes": 445888,
+      "sha256": "62b8f751d99e24c71d4223037221207ecd7877ddbf0ac3784e31df26c8af0beb",
+      "verification": {
+        "independent_builds_equal": true,
+        "native_smoke": "not run",
+        "package_sha256": "9db094881a6fb18c3457f46e1c285dffe223414c982b2b4f5071babe182c5c02",
+        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+        "static_no_pt_interp": true,
+        "status": "cross-built; not executed on ARM64 Linux"
+      }
+    },
+    "x86_64-apple-darwin": {
+      "platform": "darwin",
+      "arch": "x64",
+      "binary": "guardrail/x86_64-apple-darwin/kiokuko-guardrail",
+      "manifest": "guardrail/x86_64-apple-darwin/manifest.json",
+      "manifestSha256": "48e718f7c8d23cae7d11f11c722c85785f78ad53abff33eb7d25c6ddb01e9d66",
+      "bytes": 414856,
+      "sha256": "673e9b26eda59ba18e217034c6502daa65a2ab10f22403685c4aaf42181631f0",
+      "verification": {
+        "imports": [
+          "/usr/lib/libSystem.B.dylib"
+        ],
+        "independent_builds_equal": true,
+        "interpreter": "/usr/lib/dyld",
+        "linker_ad_hoc_signature": false,
+        "minimum_os": "13.0.0",
+        "native_smoke": "not run",
+        "package_sha256": "fb3a2c767f2a077dbe86af44814b93ae9ef81722359423882c029db0f5afdcb3",
+        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+        "status": "cross-built; not executed on macOS"
+      }
+    },
+    "aarch64-apple-darwin": {
+      "platform": "darwin",
+      "arch": "arm64",
+      "binary": "guardrail/aarch64-apple-darwin/kiokuko-guardrail",
+      "manifest": "guardrail/aarch64-apple-darwin/manifest.json",
+      "manifestSha256": "4e5e9e56dbfc3de7d70a703da3ec69c2ec4600cc9b5ae728606fe1ea47e85440",
+      "bytes": 384672,
+      "sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4",
+      "verification": {
+        "imports": [
+          "/usr/lib/libSystem.B.dylib"
+        ],
+        "independent_builds_equal": true,
+        "interpreter": "/usr/lib/dyld",
+        "linker_ad_hoc_signature": true,
+        "minimum_os": "13.0.0",
+        "native_smoke": "not run",
+        "package_sha256": "9ba9b967e8eae733972ce01d5841ddb432f1c863dd5f86792527266ddeb73530",
+        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+        "status": "cross-built; not executed on macOS"
+      }
+    }
+  },
+  "unavailableTargets": [],
+  "scope": "Bundled artifact identity and declared build provenance only. Cross-built targets are not native execution evidence. No OS sandbox, signatures, deterministic inference, or restored Common Lisp heap is claimed.",
+  "toolchainProvenance": {
+    "toolchain-inputs": {
+      "cc_binary_sha256": "a23ecab8ff08f09ad8c80602c2c5df7f49e09c25905cb8975902e101bf72635f",
+      "cc_version": "cc (Debian 14.2.0-19) 14.2.0",
+      "components": [
+        {
+          "sha256": "77171ba2a0345fdf2abc4fedda55d6de078dae7a68527c28be8c77dcc9604bd5",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/rustc-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
+        },
+        {
+          "sha256": "3e58dff2d0b72196b5ea4e90536e174d400de88564a52694686b81e091169933",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
+        },
+        {
+          "sha256": "d7674918d28093097614cd9728b6ca60db9ea3038f640f0bd1e9a4188c7568ce",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/cargo-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
+        },
+        {
+          "sha256": "b22c09ab9e258ec5571da170d88bd1624a4ea602e6d70d95720c5b47494cadce",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/rustfmt-1.99.0-x86_64-unknown-linux-gnu.tar.xz"
+        },
+        {
+          "sha256": "b106b0aa4565cc3525fd3161c69203a9e39044e6e6b4d618f261c3eeda14ad50",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-x86_64-unknown-linux-musl.tar.xz"
+        }
+      ],
+      "ld_binary_sha256": "d2766988b6a1b1d1518cdc09242e726d1f24e151e16410ada3092b11ffd9081b",
+      "ld_version": "GNU ld (GNU Binutils for Debian) 2.44",
+      "official_manifest_sha256": "ce6dddc886364f8d786514771212cebe9b731ba82d6b859951c6b0ccc516b6a2",
+      "scope": "Recorded cloud toolchain inputs. This is not a fully isolated Guix derivation or a cross-platform deterministic inference claim."
+    },
+    "macos-cross-verification": {
+      "components": [
+        {
+          "sha256": "1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026",
+          "url": "https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz"
+        },
+        {
+          "sha256": "a7c6de8aa21e7c31163a7656295b321bb85f5dce55ed8ea95ac9ac561202bb5b",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-aarch64-apple-darwin.tar.xz"
+        },
+        {
+          "sha256": "18ee81961a73c3ae966ecb1e8f6096438c90aeefece8856201a6ecc17f5bc850",
+          "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-x86_64-apple-darwin.tar.xz"
+        }
+      ],
+      "macos": [
+        {
+          "binary_bytes": 384672,
+          "binary_sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4",
+          "imports": [
+            "/usr/lib/libSystem.B.dylib"
+          ],
+          "independent_builds_equal": true,
+          "interpreter": "/usr/lib/dyld",
+          "linker_ad_hoc_signature": true,
+          "minimum_os": "13.0.0",
+          "native_smoke": "not run",
+          "package_sha256": "9ba9b967e8eae733972ce01d5841ddb432f1c863dd5f86792527266ddeb73530",
+          "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+          "status": "cross-built; not executed on macOS",
+          "target": "aarch64-apple-darwin"
+        },
+        {
+          "binary_bytes": 414856,
+          "binary_sha256": "673e9b26eda59ba18e217034c6502daa65a2ab10f22403685c4aaf42181631f0",
+          "imports": [
+            "/usr/lib/libSystem.B.dylib"
+          ],
+          "independent_builds_equal": true,
+          "interpreter": "/usr/lib/dyld",
+          "linker_ad_hoc_signature": false,
+          "minimum_os": "13.0.0",
+          "native_smoke": "not run",
+          "package_sha256": "fb3a2c767f2a077dbe86af44814b93ae9ef81722359423882c029db0f5afdcb3",
+          "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+          "status": "cross-built; not executed on macOS",
+          "target": "x86_64-apple-darwin"
+        }
+      ],
+      "scope": "Cloud cross-build and Mach-O structural/import/reproducibility checks only. No native macOS execution, notarization, or external-effect determinism claim.",
+      "zig_binary_sha256": "7c61539af19fa4082c94848f1c2b57b89e76dc6cfd5bd4c57764c3caf8f82272",
+      "zig_version": "0.17.0"
+    },
+    "arm-cross-verification": {
+      "component": {
+        "sha256": "ea8fd309578a09c9e12401621a470e6d6b1047f25933207fb8a39d66647d4561",
+        "url": "https://static.rust-lang.org/dist/2026-10-01/rust-std-1.99.0-aarch64-unknown-linux-musl.tar.xz"
+      },
+      "linker_binary_sha256": "4739514e3484915747c34b35007cd990235cc6b490b2d0525a61ac402ca16af9",
+      "linker_version": "LLD 23.1.1 (/checkout/src/llvm-project/llvm 1b9c0d5ff9bbe7634aead059efe6b11a7eeba145) (compatible with GNU linkers)",
+      "linux_arm64": {
+        "binary_bytes": 445888,
+        "binary_sha256": "62b8f751d99e24c71d4223037221207ecd7877ddbf0ac3784e31df26c8af0beb",
+        "independent_builds_equal": true,
+        "native_smoke": "not run",
+        "package_sha256": "9db094881a6fb18c3457f46e1c285dffe223414c982b2b4f5071babe182c5c02",
+        "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+        "static_no_pt_interp": true,
+        "status": "cross-built; not executed on ARM64 Linux",
+        "target": "aarch64-unknown-linux-musl"
+      },
+      "macos_ad_hoc_signature_checks": [
+        {
+          "native_execution": "not run",
+          "sha256": "c60cb16daa7a536d876017da01815fce3719bae16fc6cd42ea74df04f3e53af4",
+          "sha256_code_pages_verified": true,
+          "target": "aarch64-apple-darwin"
+        }
+      ],
+      "scope": "Cross-build and ELF/Mach-O structural/hash verification only; ARM64 Linux and macOS native execution not run."
+    }
+  }
+}

package/guardrail/node-runner.mjs

@@ -0,0 +1,37 @@
+// Host-owned reporter. Test stdout is diagnostic data and cannot issue receipts.
+import { run } from 'node:test'
+import { tap } from 'node:test/reporters'
+import { writeSync } from 'node:fs'
+import path from 'node:path'
+const input = JSON.parse(process.argv[2])
+if (!Array.isArray(input.files) || !input.files.length || input.files.length > 32 || input.files.some(file => typeof file !== 'string' || !path.isAbsolute(file))) throw Error('Invalid selected test files')
+const observation = { schema: 1, operationId: input.operationId, runtimeDigest: input.runtimeDigest, environmentDigest: input.environmentDigest, complete: false, tests: 0, passed: 0, failed: 0, assertionFailures: 0, otherFailures: 0, skipped: 0, todo: 0, cancelled: 0, explicit: 0 }
+const files = new Set(input.files.map(file => path.resolve(file)))
+let summaries = 0, finalSummary
+const stream = run({ files: input.files, isolation: 'process', concurrency: false, timeout: input.timeoutMs })
+stream.on('data', event => {
+  const d = event.data
+  if (event.type === 'test:summary' && d.file === undefined) { summaries++; finalSummary = d }
+  if (!['test:pass', 'test:fail'].includes(event.type) || d.details?.type === 'suite') return
+  if (!files.has(path.resolve(d.file ?? ''))) { observation.otherFailures++; return }
+  observation.tests++
+  const fileOnly = d.line === 1 && d.column === 1 && [d.file, path.relative(process.cwd(), d.file), path.basename(d.file)].includes(d.name)
+  if (!fileOnly) observation.explicit++
+  if (d.skip) observation.skipped++
+  else if (d.todo) observation.todo++
+  else if (event.type === 'test:pass') observation.passed++
+  else {
+    observation.failed++
+    const error = d.details?.error, cause = error?.cause ?? error
+    // Node serializes errors across the isolated test process. These fields reject renamed ordinary
+    // Errors, but model-written tests can fabricate assertion semantics; this is not attestation.
+    if (!fileOnly && cause?.code === 'ERR_ASSERTION' && cause?.name === 'AssertionError' && typeof cause.operator === 'string' && cause.operator.length > 0 && typeof cause.generatedMessage === 'boolean' && Object.hasOwn(cause,'actual') && Object.hasOwn(cause,'expected')) observation.assertionFailures++
+    else { observation.otherFailures++; if (error?.failureType === 'cancelledByParent' || error?.failureType === 'testTimeoutFailure') observation.cancelled++ }
+  }
+})
+stream.compose(tap).pipe(process.stdout)
+stream.on('end', () => {
+  observation.complete = summaries === 1 && finalSummary?.counts?.tests === observation.tests && observation.tests > 0
+  writeSync(3, JSON.stringify(observation) + '\n')
+  process.exitCode = observation.failed || observation.otherFailures || observation.cancelled ? 1 : 0
+})

package/guardrail/protocols/coding-routine.lisp

@@ -0,0 +1,33 @@
+; A bounded CL-like protocol. No CL runtime, user functions, mutation, or I/O.
+(defprotocol coding-routine
+  (:phase receive-request
+   :produces request-context
+   :next determine-changes)
+  (:phase determine-changes
+   :requires request-context
+   :produces change-plan
+   :next write-tests)
+  (:phase write-tests
+   :requires change-plan
+   :produces test-spec
+   :next verify-red)
+  (:phase verify-red
+   :requires test-spec
+   :guard (and (fails-p test-spec)
+               (not (syntax-error-p test-spec))
+               (not (timeout-p test-spec)))
+   :next implement
+   :on-violation write-tests)
+  (:phase implement
+   :requires test-spec change-plan
+   :produces patch
+   :next verify-green)
+  (:phase verify-green
+   :requires patch test-spec
+   :guard (and (passes-p test-spec patch)
+               (eq (status patch) :applied))
+   :next report
+   :on-violation implement)
+  (:phase report
+   :requires patch test-spec
+   :next :done))

package/guardrail/x86_64-apple-darwin/manifest.json

@@ -0,0 +1,71 @@
+{
+  "artifacts": {
+    "README.md": {
+      "bytes": 10748,
+      "sha256": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55"
+    },
+    "bin/kiokuko-guardrail": {
+      "bytes": 414856,
+      "sha256": "673e9b26eda59ba18e217034c6502daa65a2ab10f22403685c4aaf42181631f0"
+    },
+    "protocols/coding-routine.lisp": {
+      "bytes": 948,
+      "sha256": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49"
+    }
+  },
+  "build_inputs": {
+    "cargo_sha256": "e951141cc55a6cd7b9876d187bd30a3720e6086b99413af95e3b8de1cdd72f14",
+    "cargo_version": "cargo 1.99.0 (5f94df478 2026-08-27)",
+    "command": [
+      "env",
+      "SOURCE_DATE_EPOCH=0",
+      "MACOSX_DEPLOYMENT_TARGET=13.0",
+      "LD_LIBRARY_PATH=RUST_TOOLCHAIN/lib",
+      "RUSTFLAGS=--remap-path-prefix=SOURCE=kiokuko-guardrail --remap-path-prefix=TEMP=build",
+      "LINKER=zig-0.17.0-cc-strip-target-x86_64-macos.13.0.0",
+      "cargo",
+      "build",
+      "--manifest-path",
+      "Cargo.toml",
+      "--locked",
+      "--offline",
+      "--release",
+      "--target",
+      "x86_64-apple-darwin"
+    ],
+    "rustc_sha256": "f3834d26669b03f6855fa54bd2381443123e860167bc0c7a8dd137e5cf6e5e4f",
+    "rustc_version": "rustc 1.99.0 (b940084d7 2026-09-28)\nbinary: rustc\ncommit-hash: b940084d7eb6a299eb4bfeb8e34901bc051e7ac4\ncommit-date: 2026-09-28\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.0\nLLVM version: 23.1.1",
+    "source_date_epoch": 0,
+    "target": "x86_64-apple-darwin"
+  },
+  "package": "kiokuko-guardrail",
+  "schema": 1,
+  "scope": "Declared source/compiler/build inputs and artifact identity. This is not a signature, sandbox, or a claim of deterministic model inference or identical binaries across target operating systems.",
+  "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+  "sources": {
+    "BOOTSTRAP.md": "b9d0db4c38561d6173e2396bfca979743c66fe64dc15f8c10931d5ae02800a95",
+    "Cargo.lock": "16f51b3ffc20349a69b4b580ea59d2354c9d496911c7e530509492d9b46ecb3a",
+    "Cargo.toml": "1cc0b8df18413f925841e6acddfe14a49f7e8dd4236660eb9d822f1ccdcc9d4e",
+    "README.md": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55",
+    "examples/coding-routine.lisp": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49",
+    "scripts/package.py": "159b8cdda58b422a60aee95554eb0febc3b520d7ef5d5a4bac1cdd046a514e16",
+    "scripts/test.py": "d8ed547d0943f8b23838b146c6e1d31ad9004c525868d19a2fffafef67e6b6c9",
+    "src/digest.rs": "a46aa8ac0ba3f8e29e268a495723b6d49a4741399bb595c34a3d021dc295c800",
+    "src/eval.rs": "7742caeeac426783647363242d93845369c018b00528312573f1cdc668c22ec3",
+    "src/host.rs": "de9f34ad6ce8246e6f80cbf3d4f56bb07ed8043b17232135755a5e3ee5602cf5",
+    "src/lib.rs": "2f591de0e7520a313da9668491da106d904bb19ef2384c717e87cd06bac665a3",
+    "src/main.rs": "16a3a42d8338ca20e66173648c0a407b24724eeb1a4b3710c8a3b90b5aade10f",
+    "src/protocol.rs": "d9009f5977707141f3547902a07f2f2c5455e4b9516b01a9ba4eb22a82af2a39",
+    "src/reader.rs": "7bc1ff7aece72fc44ac43d5a207a3c8f2fd009eae41cb4b4dadb4eb9436d15f3",
+    "tests/cli.rs": "22955ba315007b4a18409b31439345eb84ce0a62b88658cf440d513b10811357",
+    "tests/digest.rs": "63a3a1b4963ef03260cae4ff9bfeed3596a445dc8df74ecc91b5750d3a6fa28d",
+    "tests/edge_contract.rs": "4f9c7b068db44e9beceb811ceac4a5e8d6cf7cda51eee5a2449f29ab0fa6ade9",
+    "tests/evaluator.rs": "a09c811494615b01e19ccef78491b8bbfee07fede8dcbee59f384fe59e145401",
+    "tests/packaging.rs": "61ae1bfed0d4f31748ce2af58953387045f4231370d46cb809f26e93aea1e033",
+    "tests/protocol.rs": "8f6b7ad5842f5b596efe8da01bba84f39fcd8d6426fde6932cb2a5cbb44d589f",
+    "tests/reader.rs": "249092f56768a6511dbb15825be55f4cf0105269cb9dba1d6f8169ff66d44ab5",
+    "tests/robustness.rs": "464c26addcf5188128d2e6eedd97cccccdb82ada0bc94a0648b77c8043118ba9"
+  },
+  "target": "x86_64-apple-darwin",
+  "version": "0.1.0"
+}

package/guardrail/x86_64-unknown-linux-musl/manifest.json

@@ -0,0 +1,68 @@
+{
+  "artifacts": {
+    "README.md": {
+      "bytes": 10748,
+      "sha256": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55"
+    },
+    "bin/kiokuko-guardrail": {
+      "bytes": 516792,
+      "sha256": "d262a712893945a1525dc9c8f19c806a44a832747879c1af8f6e33634b15636b"
+    },
+    "protocols/coding-routine.lisp": {
+      "bytes": 948,
+      "sha256": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49"
+    }
+  },
+  "build_inputs": {
+    "cargo_sha256": "e951141cc55a6cd7b9876d187bd30a3720e6086b99413af95e3b8de1cdd72f14",
+    "cargo_version": "cargo 1.99.0 (5f94df478 2026-08-27)",
+    "command": [
+      "env",
+      "SOURCE_DATE_EPOCH=0",
+      "RUSTFLAGS=--remap-path-prefix=SOURCE=kiokuko-guardrail --remap-path-prefix=TEMP=build",
+      "cargo",
+      "build",
+      "--manifest-path",
+      "Cargo.toml",
+      "--locked",
+      "--offline",
+      "--release",
+      "--target",
+      "x86_64-unknown-linux-musl"
+    ],
+    "rustc_sha256": "f3834d26669b03f6855fa54bd2381443123e860167bc0c7a8dd137e5cf6e5e4f",
+    "rustc_version": "rustc 1.99.0 (b940084d7 2026-09-28)\nbinary: rustc\ncommit-hash: b940084d7eb6a299eb4bfeb8e34901bc051e7ac4\ncommit-date: 2026-09-28\nhost: x86_64-unknown-linux-gnu\nrelease: 1.99.0\nLLVM version: 23.1.1",
+    "source_date_epoch": 0,
+    "target": "x86_64-unknown-linux-musl"
+  },
+  "package": "kiokuko-guardrail",
+  "schema": 1,
+  "scope": "Declared source/compiler/build inputs and artifact identity. This is not a signature, sandbox, or a claim of deterministic model inference or identical binaries across target operating systems.",
+  "source_sha256": "c835782d88444f03f9bce01106b75b9c071fa18543d51e7fcb754f403ba6deab",
+  "sources": {
+    "BOOTSTRAP.md": "b9d0db4c38561d6173e2396bfca979743c66fe64dc15f8c10931d5ae02800a95",
+    "Cargo.lock": "16f51b3ffc20349a69b4b580ea59d2354c9d496911c7e530509492d9b46ecb3a",
+    "Cargo.toml": "1cc0b8df18413f925841e6acddfe14a49f7e8dd4236660eb9d822f1ccdcc9d4e",
+    "README.md": "4b5d7c785121c865945f6379de31565c6aa9218f9d4333519ce3d450e85d0c55",
+    "examples/coding-routine.lisp": "82b56af81d12a8cab8352b0825c913f00f73708b2339a9b567cc6f4d4e52da49",
+    "scripts/package.py": "159b8cdda58b422a60aee95554eb0febc3b520d7ef5d5a4bac1cdd046a514e16",
+    "scripts/test.py": "d8ed547d0943f8b23838b146c6e1d31ad9004c525868d19a2fffafef67e6b6c9",
+    "src/digest.rs": "a46aa8ac0ba3f8e29e268a495723b6d49a4741399bb595c34a3d021dc295c800",
+    "src/eval.rs": "7742caeeac426783647363242d93845369c018b00528312573f1cdc668c22ec3",
+    "src/host.rs": "de9f34ad6ce8246e6f80cbf3d4f56bb07ed8043b17232135755a5e3ee5602cf5",
+    "src/lib.rs": "2f591de0e7520a313da9668491da106d904bb19ef2384c717e87cd06bac665a3",
+    "src/main.rs": "16a3a42d8338ca20e66173648c0a407b24724eeb1a4b3710c8a3b90b5aade10f",
+    "src/protocol.rs": "d9009f5977707141f3547902a07f2f2c5455e4b9516b01a9ba4eb22a82af2a39",
+    "src/reader.rs": "7bc1ff7aece72fc44ac43d5a207a3c8f2fd009eae41cb4b4dadb4eb9436d15f3",
+    "tests/cli.rs": "22955ba315007b4a18409b31439345eb84ce0a62b88658cf440d513b10811357",
+    "tests/digest.rs": "63a3a1b4963ef03260cae4ff9bfeed3596a445dc8df74ecc91b5750d3a6fa28d",
+    "tests/edge_contract.rs": "4f9c7b068db44e9beceb811ceac4a5e8d6cf7cda51eee5a2449f29ab0fa6ade9",
+    "tests/evaluator.rs": "a09c811494615b01e19ccef78491b8bbfee07fede8dcbee59f384fe59e145401",
+    "tests/packaging.rs": "61ae1bfed0d4f31748ce2af58953387045f4231370d46cb809f26e93aea1e033",
+    "tests/protocol.rs": "8f6b7ad5842f5b596efe8da01bba84f39fcd8d6426fde6932cb2a5cbb44d589f",
+    "tests/reader.rs": "249092f56768a6511dbb15825be55f4cf0105269cb9dba1d6f8169ff66d44ab5",
+    "tests/robustness.rs": "464c26addcf5188128d2e6eedd97cccccdb82ada0bc94a0648b77c8043118ba9"
+  },
+  "target": "x86_64-unknown-linux-musl",
+  "version": "0.1.0"
+}

package/migrations/040_task_state.sql

@@ -0,0 +1,45 @@
+-- The ledger run is the task. These columns do not replace execution outcomes.
+ALTER TABLE ledger_runs ADD COLUMN task_state TEXT NOT NULL DEFAULT 'ToDo'
+  CHECK(task_state IN ('ToDo','Working','Pending','Done','Ignore'));
+ALTER TABLE ledger_runs ADD COLUMN task_revision INTEGER NOT NULL DEFAULT 1 CHECK(task_revision > 0);
+ALTER TABLE ledger_runs ADD COLUMN task_generation INTEGER NOT NULL DEFAULT 1 CHECK(task_generation > 0);
+ALTER TABLE ledger_runs ADD COLUMN task_repository_root TEXT;
+ALTER TABLE ledger_runs ADD COLUMN task_owner_session_id TEXT;
+ALTER TABLE ledger_runs ADD COLUMN task_reason TEXT NOT NULL DEFAULT '';
+ALTER TABLE ledger_runs ADD COLUMN task_evidence_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(task_evidence_json));
+ALTER TABLE ledger_runs ADD COLUMN task_resumed INTEGER NOT NULL DEFAULT 0 CHECK(task_resumed IN (0,1));
+ALTER TABLE ledger_runs ADD COLUMN task_managed INTEGER NOT NULL DEFAULT 0 CHECK(task_managed IN (0,1));
+ALTER TABLE ledger_runs ADD COLUMN task_pending_stop_json TEXT CHECK(task_pending_stop_json IS NULL OR json_valid(task_pending_stop_json));
+ALTER TABLE ledger_runs ADD COLUMN task_unresolved_json TEXT CHECK(task_unresolved_json IS NULL OR json_valid(task_unresolved_json));
+ALTER TABLE ledger_runs ADD COLUMN task_previous_outcome_json TEXT CHECK(task_previous_outcome_json IS NULL OR json_valid(task_previous_outcome_json));
+UPDATE ledger_runs SET task_state=CASE status WHEN 'active' THEN 'Working' WHEN 'completed' THEN 'Done'
+  WHEN 'failed' THEN 'Pending' WHEN 'cancelled' THEN 'Pending' WHEN 'interrupted' THEN 'Pending' ELSE 'ToDo' END,
+  task_repository_root=COALESCE((SELECT repository_root FROM dsh_coding_workflows WHERE run_id=ledger_runs.run_id),
+    (SELECT repository_root FROM enno_contracts WHERE run_id=ledger_runs.run_id));
+
+-- Evidence is host-observed provenance, never a second task-state store.
+CREATE TABLE ledger_task_evidence (
+  run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+  evidence_ref TEXT NOT NULL,
+  generation INTEGER NOT NULL CHECK(generation > 0),
+  kind TEXT NOT NULL CHECK(kind IN ('verification','stopped')),
+  verified INTEGER NOT NULL CHECK(verified IN (0,1)),
+  details_json TEXT NOT NULL CHECK(json_valid(details_json)),
+  PRIMARY KEY(run_id,evidence_ref)
+);
+CREATE TRIGGER ledger_task_execution_outcome AFTER UPDATE OF status ON ledger_runs
+WHEN NEW.status <> OLD.status AND NEW.task_revision=OLD.task_revision
+BEGIN
+  UPDATE ledger_runs SET task_state=CASE
+    WHEN task_pending_stop_json IS NOT NULL THEN task_state
+    WHEN task_state IN ('Done','Ignore') THEN task_state
+    WHEN NEW.status IN ('completed','failed','cancelled','interrupted') THEN 'Pending'
+    WHEN NEW.status='active' AND task_managed=0 AND COALESCE(json_extract(metadata_json,'$.taskStateExplicit'),0)<>1 THEN 'Working'
+    ELSE task_state END,
+    task_revision=task_revision+1,task_generation=task_generation+1,task_resumed=0
+    WHERE run_id=NEW.run_id;
+END;
+CREATE TRIGGER ledger_task_terminal_owner_release AFTER UPDATE OF task_state ON ledger_runs
+WHEN NEW.task_state IN ('Done','Ignore')
+BEGIN DELETE FROM dsh_execution_owners WHERE run_id=NEW.run_id; END;
+CREATE INDEX idx_ledger_task_session_state ON ledger_runs(dsh_session_id,task_state,updated_at);

package/migrations/041_task_source_history.sql

@@ -0,0 +1,88 @@
+-- Source history is provenance, not another task authority. Current jobs remain run-keyed.
+ALTER TABLE dsh_memory_finalizations ADD COLUMN source_epoch INTEGER NOT NULL DEFAULT 1 CHECK(source_epoch>0);
+ALTER TABLE dsh_memory_finalizations ADD COLUMN source_outcome TEXT CHECK(source_outcome IN ('completed','failed','cancelled','interrupted'));
+CREATE TABLE dsh_task_source_history (
+ run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+ source_epoch INTEGER NOT NULL CHECK(source_epoch>0),
+ source_session_id TEXT NOT NULL,
+ original_session_id TEXT NOT NULL,
+ task_generation INTEGER NOT NULL,
+ next_owner_session_id TEXT NOT NULL,
+ operation_id TEXT NOT NULL,
+ reason TEXT NOT NULL,
+ boundary_json TEXT CHECK(boundary_json IS NULL OR json_valid(boundary_json)),
+ finalization_json TEXT CHECK(finalization_json IS NULL OR json_valid(finalization_json)),
+ review_state_json TEXT CHECK(review_state_json IS NULL OR json_valid(review_state_json)),
+ archived_at TEXT NOT NULL,
+ PRIMARY KEY(run_id,source_epoch)
+);
+CREATE TABLE dsh_task_source_entries (
+ run_id TEXT NOT NULL, source_epoch INTEGER NOT NULL,
+ entry_id TEXT NOT NULL REFERENCES entries(id), ordinal INTEGER NOT NULL, created_at TEXT NOT NULL,
+ PRIMARY KEY(run_id,source_epoch,ordinal), UNIQUE(run_id,source_epoch,entry_id),
+ FOREIGN KEY(run_id,source_epoch) REFERENCES dsh_task_source_history(run_id,source_epoch) ON DELETE CASCADE
+);
+CREATE TRIGGER dsh_task_source_history_immutable BEFORE UPDATE ON dsh_task_source_history
+WHEN NOT (
+ NEW.run_id=OLD.run_id AND NEW.source_epoch=OLD.source_epoch AND NEW.source_session_id=OLD.source_session_id
+ AND NEW.original_session_id=OLD.original_session_id AND NEW.task_generation=OLD.task_generation
+ AND NEW.next_owner_session_id=OLD.next_owner_session_id AND NEW.operation_id=OLD.operation_id AND NEW.reason=OLD.reason
+ AND NEW.boundary_json IS OLD.boundary_json AND NEW.review_state_json IS OLD.review_state_json AND NEW.archived_at=OLD.archived_at
+ AND json_remove(NEW.finalization_json,'$.staged_capsule_json','$.staged_binding_hash') IS json_remove(OLD.finalization_json,'$.staged_capsule_json','$.staged_binding_hash')
+ AND json_extract(NEW.finalization_json,'$.staged_capsule_json') IS NULL
+ AND json_extract(NEW.finalization_json,'$.staged_binding_hash') IS NULL
+ AND EXISTS(SELECT 1 FROM dsh_task_source_entries e JOIN memory_forget_tombstones t ON t.entry_id=e.entry_id WHERE e.run_id=OLD.run_id AND e.source_epoch=OLD.source_epoch)
+)
+BEGIN SELECT RAISE(ABORT,'task source history is immutable'); END;
+CREATE TRIGGER finalizer_source_epoch_immutable BEFORE UPDATE OF source_epoch ON dsh_memory_finalizations
+BEGIN SELECT RAISE(ABORT,'finalizer source epoch is immutable'); END;
+DROP TRIGGER dsh_run_log_boundaries_run_guard;
+CREATE TRIGGER dsh_run_log_boundaries_run_guard BEFORE INSERT ON dsh_run_log_boundaries
+BEGIN
+ SELECT CASE WHEN NOT EXISTS (SELECT 1 FROM ledger_runs r WHERE r.run_id=NEW.run_id AND r.workspace=NEW.workspace
+ AND COALESCE(r.task_owner_session_id,r.dsh_session_id)=NEW.dsh_session_id AND r.status IN ('intake','active'))
+ THEN RAISE(ABORT,'log boundary requires its active DSH run owner') END;
+END;
+DROP TRIGGER dsh_memory_finalizations_run_guard;
+CREATE TRIGGER dsh_memory_finalizations_run_guard BEFORE INSERT ON dsh_memory_finalizations
+BEGIN
+ SELECT CASE WHEN NOT EXISTS (SELECT 1 FROM ledger_runs r WHERE r.run_id=NEW.run_id AND r.workspace=NEW.workspace
+ AND COALESCE(r.task_owner_session_id,r.dsh_session_id)=NEW.dsh_session_id
+ AND (r.status='completed' OR r.status='failed' AND NEW.extraction_version=2
+ OR r.task_state IN ('Pending','Ignore') AND NEW.source_outcome IN ('failed','cancelled','interrupted') AND EXISTS(
+ SELECT 1 FROM ledger_task_evidence e JOIN json_each(r.task_evidence_json) proof ON proof.value=e.evidence_ref
+ WHERE e.run_id=r.run_id AND e.generation=r.task_generation-1 AND e.kind='stopped' AND e.verified=1)
+ OR r.task_state='Done' AND NEW.source_outcome='completed' AND EXISTS(
+ SELECT 1 FROM ledger_task_evidence e JOIN json_each(r.task_evidence_json) proof ON proof.value=e.evidence_ref
+ WHERE e.run_id=r.run_id AND e.generation=r.task_generation-1 AND e.kind='verification' AND e.verified=1)))
+ THEN RAISE(ABORT,'memory finalization requires its terminal DSH run owner') END;
+ SELECT CASE WHEN NOT EXISTS (SELECT 1 FROM dsh_run_log_boundaries b WHERE b.run_id=NEW.run_id AND b.workspace=NEW.workspace
+ AND b.dsh_session_id=NEW.dsh_session_id AND b.source_start_seq=NEW.source_start_seq)
+ THEN RAISE(ABORT,'memory finalization requires its bound DSH log start') END;
+ SELECT CASE WHEN NEW.source_epoch<>(SELECT COALESCE(MAX(source_epoch),0)+1 FROM dsh_task_source_history WHERE run_id=NEW.run_id)
+ THEN RAISE(ABORT,'memory finalization requires its current source epoch') END;
+END;
+
+-- Mutable delivery state for a fixed archived source range; the archival snapshot above stays immutable.
+CREATE TABLE dsh_task_source_finalizations (
+ run_id TEXT NOT NULL, source_epoch INTEGER NOT NULL,
+ job_json TEXT NOT NULL CHECK(json_valid(job_json)),
+ PRIMARY KEY(run_id,source_epoch),
+ FOREIGN KEY(run_id,source_epoch) REFERENCES dsh_task_source_history(run_id,source_epoch) ON DELETE CASCADE,
+ CHECK(json_extract(job_json,'$.run_id')=run_id AND json_extract(job_json,'$.source_epoch')=source_epoch)
+);
+
+CREATE TRIGGER dsh_task_source_job_identity BEFORE UPDATE ON dsh_task_source_finalizations
+WHEN NEW.run_id<>OLD.run_id OR NEW.source_epoch<>OLD.source_epoch
+ OR json_extract(NEW.job_json,'$.run_id') IS NOT json_extract(OLD.job_json,'$.run_id')
+ OR json_extract(NEW.job_json,'$.source_epoch') IS NOT json_extract(OLD.job_json,'$.source_epoch')
+ OR json_extract(NEW.job_json,'$.workspace') IS NOT json_extract(OLD.job_json,'$.workspace')
+ OR json_extract(NEW.job_json,'$.dsh_session_id') IS NOT json_extract(OLD.job_json,'$.dsh_session_id')
+ OR json_extract(NEW.job_json,'$.source_start_seq') IS NOT json_extract(OLD.job_json,'$.source_start_seq')
+ OR json_extract(NEW.job_json,'$.source_end_seq') IS NOT json_extract(OLD.job_json,'$.source_end_seq')
+ OR json_extract(NEW.job_json,'$.outcome') IS NOT json_extract(OLD.job_json,'$.outcome')
+ OR json_extract(NEW.job_json,'$.source_generation') IS NOT json_extract(OLD.job_json,'$.source_generation')
+BEGIN SELECT RAISE(ABORT,'archived finalization source identity is immutable'); END;
+
+CREATE TRIGGER finalizer_source_outcome_immutable BEFORE UPDATE OF source_outcome ON dsh_memory_finalizations
+BEGIN SELECT RAISE(ABORT,'finalizer source outcome is immutable'); END;