oh-my-super-agent 0.1.0

package/dist/src/evidence/store.js

@@ -0,0 +1,1189 @@
+import { createHash } from "node:crypto";
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+import { assertOpaqueId, assertRecordId } from "../domain/records.js";
+import { buildGithubIssueListRequest, normalizeGithubIssueTarget, parseGithubIssueListResult, } from "../live-probes/gh-adapter.js";
+import { findPackageRoot } from "../package-root.js";
+import { runProcess } from "../providers/process.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { assertSchema, loadJsonSchema } from "../runtime/schema.js";
+import { assertTicketMaterializer, assertTicketMaterializerEvidenceStore, } from "../tickets/materializer.js";
+import { deriveGitHubTicketIdentity, } from "../tickets/store.js";
+import { assessTrust } from "../trust/assessment.js";
+import { errorMessage, isRecord, lstatIfExists } from "../utils/fs.js";
+import { parseVerificationPlan } from "../verification/plan.js";
+import { assertProtectedVerificationRun, } from "../verification/protected-runner.js";
+import { captureProtectedGradeSource, } from "../verification/grade-source.js";
+import { protectedAdvisorProvenanceIdentity, } from "../dispatch/advice-source.js";
+import { assertFileInside, openStableDirectory, readImmutableFile, writeImmutableFile, } from "./immutable-file.js";
+const MAX_EVIDENCE_BYTES = 4 * 1024 * 1024;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const TIMESTAMP_PATTERN = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})(?:\.([0-9]{1,3}))?Z$/;
+const EVIDENCE_CONTRACTS = {
+    "verification-plan": { producers: ["oms.conductor", "oms.system"], schemaFile: "verification-plan-evidence.schema.json" },
+    "executor-result": { producers: ["oms.ticket-executor"], schemaFile: "executor-result.schema.json" },
+    "goal-executor-result": { producers: ["oms.goal-long-executor"], schemaFile: "goal-executor-result.schema.json" },
+    "lease-expiry": { producers: ["oms.watchdog"], schemaFile: "lease-expiry.schema.json" },
+    "deterministic-check": { producers: ["oms.verifier"], schemaFile: "deterministic-check.schema.json" },
+    "advisor-output": { producers: ["oms.exec-advisor"], schemaFile: "advisor-evidence.schema.json" },
+    "grader-output": { producers: ["oms.grader.codex", "oms.grader.claude"], schemaFile: "grader-output.schema.json" },
+    "live-disclosure": { producers: ["oms.system"], schemaFile: "live-disclosure.schema.json" },
+    "live-outcome": { producers: ["oms.system"], schemaFile: "live-outcome.schema.json" },
+    "trust-run": { producers: ["oms.system"], schemaFile: "trust-run.schema.json" },
+    "reflection": { producers: ["oms.bounded-dreamer"], schemaFile: "reflection-evidence.schema.json" },
+    "trust-report": { producers: ["oms.system"], schemaFile: "trust-report.schema.json" },
+};
+const EVIDENCE_STORE_INSTANCES = new WeakSet();
+const PROTECTED_RESULT_GATE_WRITER = Symbol("OMS protected result-gate evidence writer");
+const PROTECTED_RESULT_GATE_WRITERS = new WeakSet();
+const PROTECTED_ADVISOR_WRITER = Symbol("OMS protected advisor evidence writer");
+const PROTECTED_ADVISOR_WRITERS = new WeakSet();
+const TICKET_BOUND_EVIDENCE_KINDS = new Set(["trust-run", "reflection"]);
+const GITHUB_PROBE_EVIDENCE_KINDS = new Set(["live-disclosure", "live-outcome"]);
+const EVIDENCE_STORE_INTERNALS = new WeakMap();
+export function assertEvidenceStore(value) {
+    if (typeof value !== "object" || value === null || !EVIDENCE_STORE_INSTANCES.has(value)) {
+        throw new Error("ticket lifecycle evidence requires a real OMS EvidenceStore");
+    }
+}
+export function registeredEvidenceKinds() {
+    return Object.keys(EVIDENCE_CONTRACTS);
+}
+export function createEvidenceStore(options) {
+    const root = openStableDirectory(options.evidenceRoot, "evidence root");
+    const packageRoot = options.packageRoot ?? findPackageRoot();
+    const envelopeSchema = loadJsonSchema(join(packageRoot, "schemas", "evidence-record.schema.json"));
+    const contracts = loadContracts(packageRoot);
+    function validate(value) {
+        return validateEvidenceRecord(value, envelopeSchema, contracts);
+    }
+    function readStored(ref) {
+        validateEvidenceReference(ref);
+        const path = join(root.path, ref.file_name);
+        assertFileInside(root, path);
+        const bytes = readImmutableFile(path, MAX_EVIDENCE_BYTES);
+        if (sha256(bytes) !== ref.sha256)
+            throw new Error(`evidence digest mismatch: ${ref.evidence_id}`);
+        const record = validate(parseJson(bytes));
+        if (record.evidence_id !== ref.evidence_id)
+            throw new Error("stored evidence has the wrong evidence id");
+        validateEvidenceLinks(record);
+        return record;
+    }
+    function listStoredReferences(kind) {
+        root.assertUnchanged();
+        const refs = [];
+        for (const entry of readdirSync(root.path, { withFileTypes: true }).sort((left, right) => compareText(left.name, right.name))) {
+            if (!entry.name.endsWith(".json"))
+                continue;
+            if (kind === "trust-run" && !/^trust-run-[a-f0-9]{48}\.json$/.test(entry.name))
+                continue;
+            if (!entry.isFile())
+                throw new Error(`evidence entry is not a regular file: ${entry.name}`);
+            const evidenceId = entry.name.slice(0, -".json".length);
+            assertOpaqueId(evidenceId, "evidence filename id");
+            const bytes = readImmutableFile(join(root.path, entry.name), MAX_EVIDENCE_BYTES);
+            const ref = { evidence_id: evidenceId, sha256: sha256(bytes), file_name: entry.name };
+            const record = readStored(ref);
+            if (kind === undefined || record.evidence_kind === kind)
+                refs.push(ref);
+        }
+        return refs;
+    }
+    function validateEvidenceLinks(record) {
+        if (record.evidence_kind === "live-outcome") {
+            const reference = record.payload.disclosure_evidence;
+            if (reference.evidence_id === record.evidence_id)
+                throw new Error("live outcome cannot reference itself");
+            const disclosure = readStored(reference);
+            if (disclosure.evidence_kind !== "live-disclosure") {
+                throw new Error("live outcome disclosure reference has the wrong evidence kind");
+            }
+            if (disclosure.payload.run_id !== record.payload.run_id) {
+                throw new Error("live outcome run id does not match its disclosure");
+            }
+            if (disclosure.payload.certification !== record.payload.certification) {
+                throw new Error("live outcome certification does not match its disclosure");
+            }
+        }
+        if (record.evidence_kind === "grader-output") {
+            const reference = record.payload.deterministic_evidence;
+            if (reference.evidence_id === record.evidence_id)
+                throw new Error("grader evidence cannot reference itself");
+            const deterministic = readStored(reference);
+            if (deterministic.evidence_kind !== "deterministic-check") {
+                throw new Error("grader deterministic reference has the wrong evidence kind");
+            }
+            if (deterministic.ticket_id !== record.ticket_id) {
+                throw new Error("grader deterministic reference belongs to a different ticket");
+            }
+        }
+        if (record.evidence_kind === "trust-run")
+            validateTrustRunLinks(record, readStored);
+        if (record.evidence_kind === "reflection")
+            validateReflectionLinks(record, readStored);
+        if (record.evidence_kind === "trust-report") {
+            validateTrustReportLinks(record, readStored, () => listStoredReferences("trust-run"));
+        }
+    }
+    function prepareWrite(record, authority) {
+        if (authority !== "result-gate"
+            && record.evidence_kind === "deterministic-check"
+            && isRecord(record.payload)
+            && record.payload.certification === "live") {
+            throw new Error("live deterministic evidence requires the protected result-gate writer");
+        }
+        const normalized = validate(record);
+        if (normalized.evidence_kind === "advisor-output" && authority !== "advisor") {
+            throw new Error("advisor-output evidence requires the protected advisor writer");
+        }
+        if (TICKET_BOUND_EVIDENCE_KINDS.has(normalized.evidence_kind) && authority !== "ticket-bound") {
+            throw new Error(`${normalized.evidence_kind} evidence requires the canonical ticket-bound writer`);
+        }
+        if (GITHUB_PROBE_EVIDENCE_KINDS.has(normalized.evidence_kind) && authority !== "github-probe") {
+            throw new Error(`${normalized.evidence_kind} evidence requires the canonical GitHub-probe writer`);
+        }
+        if (normalized.evidence_kind === "deterministic-check"
+            && normalized.payload.certification === "live"
+            && authority !== "result-gate") {
+            throw new Error("live deterministic evidence requires the protected result-gate writer");
+        }
+        if (normalized.evidence_kind === "deterministic-check"
+            && normalized.payload.certification !== "live"
+            && authority === "result-gate") {
+            throw new Error("protected result-gate writer accepts only live deterministic evidence");
+        }
+        if (normalized.evidence_kind === "grader-output") {
+            const deterministic = readStored(normalized.payload.deterministic_evidence);
+            const resultGateGrade = deterministic.payload.certification === "live";
+            if (resultGateGrade !== (authority === "result-gate")) {
+                throw new Error(resultGateGrade
+                    ? "grader evidence for a live check requires the protected result-gate writer"
+                    : "protected result-gate writer requires a live deterministic check");
+            }
+        }
+        validateEvidenceLinks(normalized);
+        const bytes = canonicalJson(normalized);
+        if (bytes.byteLength > MAX_EVIDENCE_BYTES)
+            throw new Error(`evidence record exceeds ${MAX_EVIDENCE_BYTES} bytes`);
+        const ref = {
+            evidence_id: normalized.evidence_id,
+            sha256: sha256(bytes),
+            file_name: `${normalized.evidence_id}.json`,
+        };
+        const path = join(root.path, ref.file_name);
+        assertFileInside(root, path);
+        return { normalized, bytes, ref, path };
+    }
+    function writeRecord(record, authority) {
+        const prepared = prepareWrite(record, authority);
+        const status = writeImmutableFile(prepared.path, prepared.bytes);
+        return { status, ref: prepared.ref, record: readStored(prepared.ref) };
+    }
+    const store = {
+        write(record) {
+            return writeRecord(record, "generic");
+        },
+        read(ref) {
+            return readStored(ref);
+        },
+        references(kind) {
+            return listStoredReferences(kind);
+        },
+        absolutePath(ref) {
+            readStored(ref);
+            return join(root.path, ref.file_name);
+        },
+    };
+    Object.freeze(store);
+    EVIDENCE_STORE_INSTANCES.add(store);
+    EVIDENCE_STORE_INTERNALS.set(store, {
+        writeTicketBound(record) {
+            return writeRecord(record, "ticket-bound");
+        },
+        replayTicketBound(record) {
+            const prepared = prepareWrite(record, "ticket-bound");
+            const entry = lstatIfExists(prepared.path);
+            if (!entry)
+                return undefined;
+            if (entry.isSymbolicLink() || !entry.isFile())
+                throw new Error("ticket-bound evidence path is unsafe");
+            return writeRecord(record, "ticket-bound");
+        },
+        validateGithubProbe(record) {
+            return prepareWrite(record, "github-probe").normalized;
+        },
+        writeGithubProbe(record) {
+            return writeRecord(record, "github-probe");
+        },
+        githubProbeEvidenceExists(evidenceId) {
+            const validatedId = assertOpaqueId(evidenceId, "GitHub-probe evidence id");
+            const path = join(root.path, `${validatedId}.json`);
+            assertFileInside(root, path);
+            const entry = lstatIfExists(path);
+            if (!entry)
+                return false;
+            if (entry.isSymbolicLink() || !entry.isFile())
+                throw new Error("GitHub-probe evidence path is unsafe");
+            return true;
+        },
+        writeResultGate(record) {
+            return writeRecord(record, "result-gate");
+        },
+        writeAdvisor(record) {
+            return writeRecord(record, "advisor");
+        },
+    });
+    return store;
+}
+/** Branded writer used only by the protected verification/result-gate authority. */
+export function createProtectedResultGateEvidenceWriter(evidenceStore) {
+    assertEvidenceStore(evidenceStore);
+    const internal = EVIDENCE_STORE_INTERNALS.get(evidenceStore);
+    if (!internal)
+        throw new Error("protected result-gate evidence authority is unavailable");
+    const writer = Object.freeze({
+        [PROTECTED_RESULT_GATE_WRITER]: true,
+        writeDeterministic(options) {
+            assertProtectedVerificationRun(options.run);
+            const run = options.run;
+            return internal.writeResultGate({
+                schema_version: 1,
+                evidence_id: assertOpaqueId(options.evidenceId, "deterministic evidence id"),
+                evidence_kind: "deterministic-check",
+                ticket_id: run.binding.ticket_id,
+                producer_role: "oms.verifier",
+                created_at: options.createdAt,
+                payload: {
+                    schema_version: 1,
+                    certification: "live",
+                    policy_version: run.policy_version,
+                    policy_digest: run.policy_digest,
+                    plan_digest: run.verification.plan_digest,
+                    attempt: run.binding.attempt,
+                    lease_token: run.binding.lease_token,
+                    binding: structuredClone(run.binding),
+                    preflight: structuredClone(run.preflight),
+                    postflight: structuredClone(run.postflight),
+                    passed: run.verification.passed,
+                    failed_step: run.verification.failed_step,
+                    steps: run.verification.steps.map((step) => ({ ...step })),
+                },
+            });
+        },
+        writeGrade(record, source) {
+            if (record.evidence_kind !== "grader-output") {
+                throw new Error("protected result-gate grade writer accepts only grader-output evidence");
+            }
+            const identity = captureProtectedGradeSource(source);
+            if (record.producer_role !== identity.role_id
+                || record.payload.provider_request_id !== identity.request_id
+                || record.payload.grader_engine !== identity.engine
+                || record.payload.fresh_session_id !== identity.fresh_session_id
+                || !canonicalJson(stripProtectedGradeMetadata(record.payload)).equals(canonicalJson(identity.output)))
+                throw new Error("protected grade evidence does not match its fresh provider result");
+            return internal.writeResultGate(structuredClone(record));
+        },
+    });
+    PROTECTED_RESULT_GATE_WRITERS.add(writer);
+    return writer;
+}
+function stripProtectedGradeMetadata(payload) {
+    const result = structuredClone(payload);
+    delete result.provider_request_id;
+    delete result.grader_engine;
+    delete result.fresh_session_id;
+    return result;
+}
+export function assertProtectedResultGateEvidenceWriter(value) {
+    if (typeof value !== "object" || value === null || !PROTECTED_RESULT_GATE_WRITERS.has(value)) {
+        throw new Error("result-gate evidence requires a real OMS protected writer");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("protected result-gate writer lost its frozen boundary");
+}
+/** Branded writer used only by the protected pre-dispatch advisor authority. */
+export function createProtectedAdvisorEvidenceWriter(evidenceStore) {
+    assertEvidenceStore(evidenceStore);
+    const internal = EVIDENCE_STORE_INTERNALS.get(evidenceStore);
+    if (!internal)
+        throw new Error("protected advisor evidence authority is unavailable");
+    const writer = Object.freeze({
+        [PROTECTED_ADVISOR_WRITER]: true,
+        writeAdvice(options, provenance) {
+            const identity = protectedAdvisorProvenanceIdentity(provenance);
+            return internal.writeAdvisor({
+                schema_version: 1,
+                evidence_id: identity.evidence_id,
+                evidence_kind: "advisor-output",
+                ticket_id: identity.ticket_id,
+                producer_role: identity.role_id,
+                created_at: options.createdAt,
+                payload: {
+                    ...structuredClone(identity.output),
+                    provider_request_id: identity.request_id,
+                    fresh_session_id: identity.fresh_session_id,
+                    contact_reference: structuredClone(identity.contact_reference),
+                    advice_authorization_id: identity.advice_authorization_id,
+                },
+            });
+        },
+    });
+    PROTECTED_ADVISOR_WRITERS.add(writer);
+    return writer;
+}
+export function assertProtectedAdvisorEvidenceWriter(value) {
+    if (typeof value !== "object" || value === null || !PROTECTED_ADVISOR_WRITERS.has(value)) {
+        throw new Error("advisor evidence requires a real OMS protected writer");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("protected advisor writer lost its frozen boundary");
+}
+export function writeTicketBoundEvidence(options) {
+    const evidenceStore = options.evidenceStore;
+    const ticketMaterializer = options.ticketMaterializer;
+    const record = structuredClone(options.record);
+    assertEvidenceStore(evidenceStore);
+    assertTicketMaterializer(ticketMaterializer);
+    const internal = EVIDENCE_STORE_INTERNALS.get(evidenceStore);
+    if (!internal)
+        throw new Error("ticket-bound evidence store authority is unavailable");
+    if (!TICKET_BOUND_EVIDENCE_KINDS.has(record.evidence_kind)) {
+        throw new Error("ticket-bound writer accepts only trust-run or reflection evidence");
+    }
+    const replay = internal.replayTicketBound(record);
+    if (replay)
+        return replay;
+    try {
+        validateCanonicalTicketEvidence(evidenceStore, ticketMaterializer, record);
+    }
+    catch (error) {
+        const concurrentReplay = internal.replayTicketBound(record);
+        if (concurrentReplay)
+            return concurrentReplay;
+        throw error;
+    }
+    return internal.writeTicketBound(record);
+}
+export class GithubQueueProbeError extends Error {
+    phase;
+    contacted;
+    outcomeEvidence;
+    constructor(options) {
+        super(`GitHub queue probe failed during ${options.phase}`, { cause: options.cause });
+        this.name = "GithubQueueProbeError";
+        this.phase = options.phase;
+        this.contacted = options.contacted;
+        this.outcomeEvidence = options.outcomeEvidence;
+    }
+}
+/** Certifying path: owns the canonical process, clock, materializer, and evidence writes. */
+export function runGithubQueueProbe(options) {
+    return executeGithubQueueProbe(captureGithubQueueProbeOptions(options), "live", { ...process.env });
+}
+/** Offline fixture path: still uses runProcess, but every record is permanently non-certifying. */
+export function runNonCertifyingGithubQueueProbeFixture(options) {
+    const env = { ...options.env };
+    return executeGithubQueueProbe(captureGithubQueueProbeOptions(options), "non-certifying", env);
+}
+function captureGithubQueueProbeOptions(options) {
+    return {
+        runId: options.runId,
+        repository: options.repository,
+        readyLabel: options.readyLabel,
+        limit: options.limit,
+        confirmLive: options.confirmLive,
+        cwd: options.cwd,
+        evidenceStore: options.evidenceStore,
+        materializer: options.materializer,
+        emitDisclosure: options.emitDisclosure,
+    };
+}
+function executeGithubQueueProbe(options, certification, env) {
+    const runId = assertOpaqueId(options.runId, "GitHub probe run id");
+    const target = normalizeGithubIssueTarget({
+        repository: options.repository,
+        ...(options.readyLabel === undefined ? {} : { readyLabel: options.readyLabel }),
+        ...(options.limit === undefined ? {} : { limit: options.limit }),
+    });
+    const evidenceStore = options.evidenceStore;
+    const ticketMaterializer = options.materializer;
+    const emitDisclosure = options.emitDisclosure;
+    const cwd = options.cwd;
+    const effectiveCertification = options.confirmLive
+        ? certification
+        : "non-certifying";
+    const disclosure = Object.freeze({
+        schema_version: 1,
+        certification: effectiveCertification,
+        run_id: runId,
+        contact_surface: "github-api-via-gh",
+        expected_spend: "none",
+        operation: "read-ready-issues",
+        repository: target.repository,
+        ready_label: target.readyLabel,
+        issue_limit: target.limit,
+    });
+    if (!options.confirmLive)
+        return { contacted: false, disclosure, syncResults: [] };
+    assertEvidenceStore(evidenceStore);
+    assertTicketMaterializer(ticketMaterializer);
+    assertTicketMaterializerEvidenceStore(ticketMaterializer, evidenceStore);
+    const internal = EVIDENCE_STORE_INTERNALS.get(evidenceStore);
+    if (!internal)
+        throw new Error("GitHub-probe evidence store authority is unavailable");
+    const request = buildGithubIssueListRequest({ target, cwd, env });
+    const disclosureId = createStableId("gh-disclosure", runId);
+    if (internal.githubProbeEvidenceExists(disclosureId)) {
+        throw new GithubQueueProbeError({
+            phase: "evidence",
+            contacted: false,
+            cause: new Error(`GitHub probe run id was already used: ${runId}`),
+        });
+    }
+    let disclosureWrite;
+    try {
+        disclosureWrite = internal.writeGithubProbe({
+            schema_version: 1,
+            evidence_id: disclosureId,
+            evidence_kind: "live-disclosure",
+            ticket_id: null,
+            producer_role: "oms.system",
+            created_at: new Date().toISOString(),
+            payload: { ...disclosure },
+        });
+    }
+    catch (error) {
+        if (internal.githubProbeEvidenceExists(disclosureId)) {
+            throw new GithubQueueProbeError({
+                phase: "evidence",
+                contacted: false,
+                cause: new Error(`GitHub probe run id was already used: ${runId}`),
+            });
+        }
+        throw error;
+    }
+    if (disclosureWrite.status !== "created") {
+        throw new GithubQueueProbeError({
+            phase: "evidence",
+            contacted: false,
+            cause: new Error(`GitHub probe run id was already used: ${runId}`),
+        });
+    }
+    const session = {
+        certification: effectiveCertification,
+        runId,
+        target,
+        disclosure,
+        disclosureEvidence: disclosureWrite.ref,
+        issues: [],
+        receipts: new Map(),
+        outcomeAttempted: false,
+    };
+    try {
+        emitDisclosure(deepFreeze(structuredClone(disclosure)), deepFreeze(structuredClone(session.disclosureEvidence)));
+    }
+    catch (error) {
+        const outcomeEvidence = writeGithubProbeFailure({
+            internal,
+            evidenceStore,
+            ticketMaterializer,
+            session,
+            phase: "evidence",
+            error,
+        });
+        throw new GithubQueueProbeError({ phase: "evidence", contacted: false, outcomeEvidence, cause: error });
+    }
+    try {
+        session.issues.push(...parseGithubIssueListResult(runProcess(request), target));
+    }
+    catch (error) {
+        const outcomeEvidence = writeGithubProbeFailure({
+            internal,
+            evidenceStore,
+            ticketMaterializer,
+            session,
+            phase: "contact",
+            error,
+        });
+        throw new GithubQueueProbeError({ phase: "contact", contacted: true, outcomeEvidence, cause: error });
+    }
+    const syncResults = [];
+    for (const issue of session.issues) {
+        try {
+            const input = deepFreeze(toGithubTicketInput(target.repository, issue));
+            const result = ticketMaterializer.syncGitHub(input);
+            const readBack = ticketMaterializer.read(deriveGitHubTicketIdentity(input).ticket_id);
+            const receipt = validateGithubSyncResult(input, result, readBack);
+            session.receipts.set(receipt.ticket_id, receipt);
+            syncResults.push(deepFreeze(structuredClone(result)));
+        }
+        catch (error) {
+            const outcomeEvidence = writeGithubProbeFailure({
+                internal,
+                evidenceStore,
+                ticketMaterializer,
+                session,
+                phase: "sync",
+                error,
+            });
+            throw new GithubQueueProbeError({ phase: "sync", contacted: true, outcomeEvidence, cause: error });
+        }
+    }
+    let outcomeEvidence;
+    try {
+        outcomeEvidence = writeGithubProbeOutcome({
+            internal,
+            evidenceStore,
+            ticketMaterializer,
+            session,
+            status: "success",
+            failedPhase: null,
+            error: null,
+        });
+    }
+    catch (error) {
+        throw new GithubQueueProbeError({ phase: "evidence", contacted: true, cause: error });
+    }
+    return {
+        contacted: true,
+        disclosure,
+        disclosureEvidence: session.disclosureEvidence,
+        outcomeEvidence,
+        syncResults: Object.freeze(syncResults),
+    };
+}
+function writeGithubProbeFailure(options) {
+    try {
+        return writeGithubProbeOutcome({
+            internal: options.internal,
+            evidenceStore: options.evidenceStore,
+            ticketMaterializer: options.ticketMaterializer,
+            session: options.session,
+            status: "failure",
+            failedPhase: options.phase,
+            error: sanitizeLiveOutcomeError(errorMessage(options.error)),
+        });
+    }
+    catch (outcomeError) {
+        throw new GithubQueueProbeError({
+            phase: "evidence",
+            contacted: options.phase !== "evidence",
+            cause: outcomeError,
+        });
+    }
+}
+function writeGithubProbeOutcome(options) {
+    if (options.session.outcomeAttempted)
+        throw new Error("GitHub probe already attempted its terminal outcome");
+    options.session.outcomeAttempted = true;
+    const receipts = sortedGithubReceipts([...options.session.receipts.values()]);
+    const record = {
+        schema_version: 1,
+        evidence_id: createStableId("gh-outcome", options.session.runId),
+        evidence_kind: "live-outcome",
+        ticket_id: null,
+        producer_role: "oms.system",
+        created_at: new Date().toISOString(),
+        payload: {
+            schema_version: 1,
+            certification: options.session.certification,
+            run_id: options.session.runId,
+            disclosure_evidence: options.session.disclosureEvidence,
+            status: options.status,
+            failed_phase: options.failedPhase,
+            error: options.error,
+            issue_count: options.session.issues.length,
+            synced_count: receipts.length,
+            synced_tickets: receipts,
+        },
+    };
+    const normalized = options.internal.validateGithubProbe(record);
+    validateCanonicalGithubProbeOutcome(options.evidenceStore, options.ticketMaterializer, options.session, normalized);
+    const written = options.internal.writeGithubProbe(normalized);
+    if (written.status !== "created")
+        throw new Error("GitHub probe outcome already exists");
+    return written.ref;
+}
+function validateGithubSyncResult(input, result, readBack) {
+    const identity = deriveGitHubTicketIdentity(input);
+    if (!isRecord(result) || !["created", "refreshed", "unchanged"].includes(String(result.status))) {
+        throw new Error("GitHub ticket sync returned an invalid status");
+    }
+    if (!isRecord(result.ref) || !isRecord(result.record) || !isRecord(result.record.payload)) {
+        throw new Error("GitHub ticket sync returned an invalid materialization receipt");
+    }
+    if (result.ref.ticket_id !== identity.ticket_id || result.record.record_id !== identity.ticket_id) {
+        throw new Error("GitHub ticket sync receipt belongs to a different ticket");
+    }
+    if (result.record.payload.source_ref_sha256 !== identity.source_ref_sha256
+        || result.record.payload.content_sha256 !== result.ref.sha256
+        || result.record.payload.content_file !== result.ref.file_name
+        || result.ref.file_name !== `${identity.ticket_id}.${result.ref.sha256}.json`) {
+        throw new Error("GitHub ticket sync receipt does not match canonical content evidence");
+    }
+    if (!Number.isSafeInteger(result.record.version) || result.record.version < 0) {
+        throw new Error("GitHub ticket sync receipt has invalid queue state");
+    }
+    if (JSON.stringify(result.record) !== JSON.stringify(readBack)) {
+        throw new Error("GitHub ticket sync receipt does not match authoritative read-back");
+    }
+    return Object.freeze({
+        ticket_id: identity.ticket_id,
+        content_sha256: result.ref.sha256,
+        content_file: result.ref.file_name,
+        record_version: result.record.version,
+        sync_status: result.status,
+    });
+}
+function sortedGithubReceipts(receipts) {
+    return receipts
+        .map((receipt) => ({ ...receipt }))
+        .sort((left, right) => left.ticket_id.localeCompare(right.ticket_id));
+}
+function toGithubTicketInput(repository, issue) {
+    return {
+        repository,
+        issue_node_id: issue.id,
+        title: issue.title,
+        body: issue.body,
+        labels: [...issue.labels],
+        url: issue.url,
+        updated_at: issue.updatedAt,
+    };
+}
+function deepFreeze(value, seen = new Set()) {
+    if (typeof value !== "object" || value === null || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const child of Object.values(value))
+        deepFreeze(child, seen);
+    return Object.freeze(value);
+}
+function loadContracts(packageRoot) {
+    const contracts = new Map();
+    for (const kind of registeredEvidenceKinds()) {
+        const definition = EVIDENCE_CONTRACTS[kind];
+        contracts.set(kind, {
+            ...definition,
+            schema: loadJsonSchema(join(packageRoot, "schemas", definition.schemaFile)),
+        });
+    }
+    return contracts;
+}
+function validateEvidenceRecord(value, envelopeSchema, contracts) {
+    assertJsonValue(value, "evidence record");
+    assertSchema(value, envelopeSchema, "evidence record");
+    const record = value;
+    assertOpaqueId(record.evidence_id, "evidence id");
+    if (record.ticket_id !== null)
+        assertRecordId(record.ticket_id, "evidence ticket id");
+    timestampEpoch(record.created_at, "evidence created_at");
+    const contract = contracts.get(record.evidence_kind);
+    if (!contract)
+        throw new Error(`unregistered evidence kind: ${String(record.evidence_kind)}`);
+    if (!contract.producers.includes(record.producer_role)) {
+        throw new Error(`producer ${record.producer_role} is not allowed for ${record.evidence_kind}`);
+    }
+    assertSchema(record.payload, contract.schema, `${record.evidence_kind} payload`);
+    if ([
+        "verification-plan",
+        "executor-result",
+        "goal-executor-result",
+        "lease-expiry",
+        "deterministic-check",
+        "advisor-output",
+        "grader-output",
+        "trust-run",
+        "reflection",
+    ].includes(record.evidence_kind) && record.ticket_id === null) {
+        throw new Error(`${record.evidence_kind} requires a ticket id`);
+    }
+    if (record.evidence_kind === "verification-plan")
+        validateVerificationPlan(record.payload);
+    if (record.evidence_kind === "deterministic-check")
+        validateDeterministicCheck(record.payload);
+    if (record.evidence_kind === "deterministic-check"
+        && record.payload.certification === "live"
+        && record.payload.binding.ticket_id !== record.ticket_id) {
+        throw new Error("live deterministic check ticket binding does not match its evidence envelope");
+    }
+    if (record.evidence_kind === "executor-result") {
+        if (record.payload.ticket_id !== record.ticket_id)
+            throw new Error("executor evidence ticket id mismatch");
+    }
+    if (record.evidence_kind === "lease-expiry") {
+        if (record.payload.ticket_id !== record.ticket_id)
+            throw new Error("lease expiry evidence ticket id mismatch");
+        if (record.evidence_id !== createStableId("lease-expiry", record.ticket_id, String(record.payload.attempt), record.payload.lease_token))
+            throw new Error("lease expiry evidence id does not match its ticket lease");
+    }
+    if (["live-disclosure", "live-outcome", "trust-report"].includes(record.evidence_kind) && record.ticket_id !== null) {
+        throw new Error(`${record.evidence_kind} must not claim a ticket id`);
+    }
+    if (record.evidence_kind === "live-disclosure") {
+        if (record.evidence_id !== createStableId("gh-disclosure", record.payload.run_id)) {
+            throw new Error("live disclosure evidence id does not match its run id");
+        }
+    }
+    if (record.evidence_kind === "live-outcome")
+        validateLiveOutcome(record.payload);
+    if (record.evidence_kind === "live-outcome") {
+        if (record.evidence_id !== createStableId("gh-outcome", record.payload.run_id)) {
+            throw new Error("live outcome evidence id does not match its run id");
+        }
+    }
+    return record;
+}
+function validateVerificationPlan(payload) {
+    let shippedPlan;
+    try {
+        shippedPlan = parseVerificationPlan(payload.plan, "verification plan evidence");
+    }
+    catch (error) {
+        throw new Error("verification plan does not match the exact shipped plan", { cause: error });
+    }
+    const digest = sha256(Buffer.from(JSON.stringify(shippedPlan), "utf8"));
+    if (payload.digest !== digest)
+        throw new Error("verification plan digest does not match its canonical plan");
+}
+function validateDeterministicCheck(payload) {
+    const expectedOrder = ["typecheck", "test", "build", "offline-verify"];
+    const steps = payload.steps;
+    if (steps.length < 1 || steps.length > expectedOrder.length)
+        throw new Error("deterministic check has invalid step count");
+    for (let index = 0; index < steps.length; index += 1) {
+        const step = steps[index];
+        if (!step || step.id !== expectedOrder[index])
+            throw new Error("deterministic check steps are out of order");
+        const expectedPassed = step.status === 0 && step.signal === null && step.error === null;
+        if (step.passed !== expectedPassed)
+            throw new Error(`deterministic check step ${String(step.id)} is inconsistent`);
+        if (index < steps.length - 1 && step.passed !== true) {
+            throw new Error("deterministic check continued after a failed step");
+        }
+    }
+    const last = steps.at(-1);
+    if (!last)
+        throw new Error("deterministic check has no steps");
+    const allPassed = steps.length === expectedOrder.length && steps.every((step) => step.passed === true);
+    if (payload.passed !== allPassed)
+        throw new Error("deterministic check overall result is inconsistent");
+    if (allPassed) {
+        if (payload.failed_step !== null)
+            throw new Error("passing deterministic check must not name a failed step");
+    }
+    else if (last.passed !== false || payload.failed_step !== last.id) {
+        throw new Error("failed deterministic check must identify its terminal failed step");
+    }
+    if (payload.certification === "live")
+        validateLiveDeterministicBinding(payload);
+}
+function validateLiveDeterministicBinding(payload) {
+    if (!isRecord(payload.binding) || !isRecord(payload.preflight) || !isRecord(payload.postflight)) {
+        throw new Error("live deterministic check requires exact binding and pre/post worktree proof");
+    }
+    const binding = payload.binding;
+    const expectedExecutorEngine = binding.executor_role === "oms.ticket-executor" ? "claude" : "codex";
+    if (binding.attempt !== payload.attempt
+        || binding.lease_token !== payload.lease_token
+        || binding.worktree_root !== payload.preflight.worktree_root
+        || binding.worktree_root !== payload.postflight.worktree_root
+        || binding.worktree_branch !== payload.preflight.worktree_branch
+        || binding.worktree_branch !== payload.postflight.worktree_branch
+        || binding.expected_commit !== payload.preflight.head_commit
+        || binding.expected_commit !== payload.postflight.head_commit
+        || payload.preflight.clean !== true
+        || payload.postflight.clean !== true
+        || binding.executor_engine !== expectedExecutorEngine) {
+        throw new Error("live deterministic check binding does not match its worktree proof");
+    }
+}
+function validateLiveOutcome(payload) {
+    const issueCount = payload.issue_count;
+    const syncedCount = payload.synced_count;
+    const syncedTickets = payload.synced_tickets;
+    if (syncedCount > issueCount)
+        throw new Error("live outcome synced_count exceeds issue_count");
+    if (syncedTickets.length !== syncedCount)
+        throw new Error("live outcome synced ticket receipts do not match synced_count");
+    const ticketIds = syncedTickets.map((ticket) => ticket.ticket_id);
+    if (new Set(ticketIds).size !== ticketIds.length)
+        throw new Error("live outcome contains duplicate ticket receipts");
+    if (JSON.stringify(ticketIds) !== JSON.stringify([...ticketIds].sort())) {
+        throw new Error("live outcome ticket receipts must be sorted by ticket id");
+    }
+    for (const ticket of syncedTickets) {
+        const ticketId = ticket.ticket_id;
+        if (ticket.content_file !== `${ticketId}.${String(ticket.content_sha256)}.json`) {
+            throw new Error("live outcome ticket receipt content filename is inconsistent");
+        }
+    }
+    if (payload.status === "success") {
+        if (payload.failed_phase !== null || payload.error !== null || syncedCount !== issueCount) {
+            throw new Error("successful live outcome is inconsistent");
+        }
+        return;
+    }
+    if (typeof payload.failed_phase !== "string" || typeof payload.error !== "string" || payload.error.length === 0) {
+        throw new Error("failed live outcome requires failed_phase and error");
+    }
+    if (sanitizeLiveOutcomeError(payload.error) !== payload.error) {
+        throw new Error("live outcome error contains unsanitized secret material");
+    }
+}
+function validateTrustRunLinks(record, readStored) {
+    const deterministicReference = record.payload.deterministic_evidence;
+    if (deterministicReference.evidence_id === record.evidence_id) {
+        throw new Error("trust run cannot reference itself");
+    }
+    const deterministic = readStored(deterministicReference);
+    if (deterministic.evidence_kind !== "deterministic-check") {
+        throw new Error("trust run deterministic reference has the wrong evidence kind");
+    }
+    if (deterministic.payload.certification !== "live") {
+        throw new Error("trust run requires protected live deterministic evidence");
+    }
+    if (deterministic.ticket_id !== record.ticket_id) {
+        throw new Error("trust run deterministic reference belongs to a different ticket");
+    }
+    if (record.payload.ticket_id !== record.ticket_id)
+        throw new Error("trust run ticket id mismatch");
+    if (record.payload.run_id !== record.evidence_id)
+        throw new Error("trust run id does not match its evidence id");
+    if (record.payload.attempt !== deterministic.payload.attempt) {
+        throw new Error("trust run attempt does not match its deterministic check");
+    }
+    if (record.payload.deterministic_passed !== deterministic.payload.passed) {
+        throw new Error("trust run verdict does not match its deterministic check");
+    }
+    if (record.payload.gate_digest !== deterministic.payload.plan_digest) {
+        throw new Error("trust run gate digest does not match its deterministic check");
+    }
+    if (record.payload.policy_version !== deterministic.payload.policy_version) {
+        throw new Error("trust run policy version does not match its deterministic check");
+    }
+    if (record.payload.policy_digest !== deterministic.payload.policy_digest) {
+        throw new Error("trust run policy digest does not match its deterministic check");
+    }
+    if (record.created_at !== deterministic.created_at) {
+        throw new Error("trust run timestamp does not match its deterministic check");
+    }
+    const expectedId = createStableId("trust-run", deterministicReference.evidence_id, deterministicReference.sha256);
+    if (record.evidence_id !== expectedId)
+        throw new Error("trust run id does not match its deterministic check");
+}
+function validateCanonicalTicketEvidence(evidenceStore, ticketMaterializer, record) {
+    const deterministicReference = record.payload.deterministic_evidence;
+    const deterministic = evidenceStore.read(deterministicReference);
+    if (deterministic.evidence_kind !== "deterministic-check" || deterministic.ticket_id === null) {
+        throw new Error("ticket-bound evidence requires a deterministic ticket check");
+    }
+    if (record.evidence_kind === "trust-run" && deterministic.payload.certification !== "live") {
+        throw new Error("trust run requires protected live deterministic evidence");
+    }
+    const ticket = ticketMaterializer.read(deterministic.ticket_id);
+    const passed = deterministic.payload.passed === true;
+    const validState = record.evidence_kind === "trust-run" && passed
+        ? ticket.state === "completed"
+        : ticket.state === "retryable" || ticket.state === "blocked";
+    if (!validState) {
+        throw new Error(`${record.evidence_kind} is not attached to the required canonical ticket state`);
+    }
+    if (!sameEvidenceReference(deterministicReference, ticket.payload.verification_evidence)) {
+        throw new Error(`${record.evidence_kind} deterministic evidence is not the ticket's authoritative verification evidence`);
+    }
+    if (ticket.attempt !== deterministic.payload.attempt
+        || ticket.payload.policy_version !== deterministic.payload.policy_version
+        || ticket.payload.policy_digest !== deterministic.payload.policy_digest
+        || ticket.payload.gate_digest !== deterministic.payload.plan_digest) {
+        throw new Error(`${record.evidence_kind} identity does not match the canonical ticket policy, gate, or attempt`);
+    }
+}
+function validateCanonicalGithubProbeOutcome(evidenceStore, ticketMaterializer, session, record) {
+    const disclosure = evidenceStore.read(session.disclosureEvidence);
+    if (disclosure.evidence_kind !== "live-disclosure"
+        || JSON.stringify(disclosure.payload) !== JSON.stringify(session.disclosure)
+        || disclosure.payload.repository !== session.target.repository
+        || disclosure.payload.ready_label !== session.target.readyLabel
+        || disclosure.payload.issue_limit !== session.target.limit
+        || disclosure.payload.certification !== session.certification) {
+        throw new Error("GitHub-probe disclosure does not match the captured run target");
+    }
+    if (record.payload.run_id !== session.runId
+        || record.payload.certification !== session.certification
+        || record.payload.issue_count !== session.issues.length
+        || !sameEvidenceReference(session.disclosureEvidence, record.payload.disclosure_evidence)) {
+        throw new Error("GitHub-probe outcome does not match the captured run identity");
+    }
+    const receipts = record.payload.synced_tickets;
+    const expectedReceipts = sortedGithubReceipts([...session.receipts.values()]);
+    if (JSON.stringify(receipts) !== JSON.stringify(expectedReceipts)) {
+        throw new Error("GitHub-probe outcome receipts do not match the captured run session");
+    }
+    const contactedTicketIds = new Set(session.issues.map((issue) => deriveGitHubTicketIdentity({ issue_node_id: issue.id }).ticket_id));
+    for (const receipt of receipts) {
+        const ticketId = receipt.ticket_id;
+        if (!contactedTicketIds.has(ticketId)) {
+            throw new Error("GitHub-probe outcome contains an old or unrelated canonical receipt");
+        }
+        const contentSha256 = receipt.content_sha256;
+        const contentFile = receipt.content_file;
+        const ticket = ticketMaterializer.read(ticketId);
+        if (ticket.version !== receipt.record_version
+            || ticket.payload.ticket_id !== ticketId
+            || ticket.payload.source !== "github"
+            || ticket.payload.content_sha256 !== contentSha256
+            || ticket.payload.content_file !== contentFile) {
+            throw new Error("GitHub-probe receipt does not match the authoritative ticket record");
+        }
+        const hasSyncOutcome = ticket.payload.sync_outcomes.some((outcome) => outcome.status === receipt.sync_status
+            && outcome.content_sha256 === contentSha256
+            && outcome.content_file === contentFile);
+        if (!hasSyncOutcome) {
+            throw new Error("GitHub-probe receipt does not match authoritative sync history");
+        }
+        const content = ticketMaterializer.readContent({
+            ticket_id: ticketId,
+            sha256: contentSha256,
+            file_name: contentFile,
+        });
+        if (content.ticket_id !== ticketId || content.source !== "github") {
+            throw new Error("GitHub-probe receipt does not resolve to canonical GitHub ticket content");
+        }
+    }
+}
+function validateReflectionLinks(record, readStored) {
+    const deterministicReference = record.payload.deterministic_evidence;
+    const failureReference = record.payload.failure_evidence;
+    if (deterministicReference.evidence_id === record.evidence_id || failureReference.evidence_id === record.evidence_id) {
+        throw new Error("reflection cannot reference itself");
+    }
+    const deterministic = readStored(deterministicReference);
+    const failure = readStored(failureReference);
+    if (deterministic.evidence_kind !== "deterministic-check") {
+        throw new Error("reflection deterministic reference has the wrong evidence kind");
+    }
+    if (deterministic.ticket_id !== record.ticket_id) {
+        throw new Error("reflection deterministic reference belongs to a different ticket");
+    }
+    if (record.payload.ticket_id !== record.ticket_id)
+        throw new Error("reflection ticket id mismatch");
+    if (failure.ticket_id !== record.ticket_id) {
+        throw new Error("reflection failure reference belongs to a different ticket");
+    }
+    const deterministicFailure = failure.evidence_kind === "deterministic-check"
+        && sameEvidenceReference(failureReference, deterministicReference)
+        && deterministic.payload.passed === false;
+    const gradeFailure = failure.evidence_kind === "grader-output"
+        && failure.payload.verdict === "fail"
+        && sameEvidenceReference(failure.payload.deterministic_evidence, deterministicReference);
+    if (!deterministicFailure && !gradeFailure) {
+        throw new Error("reflection requires a failed deterministic check or failed grade");
+    }
+    if (record.payload.attempt !== deterministic.payload.attempt) {
+        throw new Error("reflection attempt does not match its failed deterministic check");
+    }
+    if (record.created_at !== failure.created_at) {
+        throw new Error("reflection timestamp does not match its failure evidence");
+    }
+    const expectedId = createStableId("reflection", failureReference.evidence_id, failureReference.sha256);
+    if (record.evidence_id !== expectedId)
+        throw new Error("reflection id does not match its failure evidence");
+}
+function validateTrustReportLinks(record, readStored, allTrustRunReferences) {
+    const utcDate = record.payload.utc_date;
+    const closedAt = closedAtForUtcDate(utcDate);
+    if (record.payload.closed_at !== closedAt || record.created_at !== closedAt) {
+        throw new Error("trust report timestamp does not match its closed UTC date");
+    }
+    if (record.evidence_id !== createStableId("trust-report", utcDate, record.payload.policy_digest, record.payload.gate_digest)) {
+        throw new Error("trust report id does not match its date, policy, and gate identity");
+    }
+    const references = record.payload.trust_run_evidence;
+    const sorted = [...references].sort(compareEvidenceReferences);
+    if (references.some((reference, index) => !sameEvidenceReference(reference, sorted[index]))) {
+        throw new Error("trust report references are not sorted");
+    }
+    const seen = new Set();
+    const runs = [];
+    const startEpoch = timestampEpoch(`${utcDate}T00:00:00.000Z`, "trust report opened_at");
+    const closeEpoch = timestampEpoch(closedAt, "trust report closed_at");
+    if (Date.now() < closeEpoch)
+        throw new Error("trust report requires a closed UTC date");
+    for (const reference of references) {
+        if (seen.has(reference.evidence_id))
+            throw new Error(`duplicate trust run reference: ${reference.evidence_id}`);
+        seen.add(reference.evidence_id);
+        const trustRun = readStored(reference);
+        if (trustRun.evidence_kind !== "trust-run") {
+            throw new Error("trust report reference has the wrong evidence kind");
+        }
+        const runEpoch = timestampEpoch(trustRun.created_at, "trust run created_at");
+        if (runEpoch < startEpoch || runEpoch >= closeEpoch) {
+            throw new Error("trust report includes evidence outside its explicit UTC day");
+        }
+        runs.push({
+            run_id: trustRun.payload.run_id,
+            policy_version: trustRun.payload.policy_version,
+            policy_digest: trustRun.payload.policy_digest,
+            gate_digest: trustRun.payload.gate_digest,
+            deterministic_passed: trustRun.payload.deterministic_passed,
+        });
+    }
+    const expectedReferences = allTrustRunReferences()
+        .filter((reference) => {
+        const createdEpoch = timestampEpoch(readStored(reference).created_at, "trust run created_at");
+        return createdEpoch >= startEpoch && createdEpoch < closeEpoch;
+    })
+        .sort(compareEvidenceReferences);
+    if (references.length !== expectedReferences.length
+        || references.some((reference, index) => !sameEvidenceReference(reference, expectedReferences[index]))) {
+        throw new Error("trust report does not contain the complete explicit UTC day evidence set");
+    }
+    const expected = assessTrust({
+        policy_version: record.payload.policy_version,
+        policy_digest: record.payload.policy_digest,
+        gate_digest: record.payload.gate_digest,
+        runs,
+    });
+    const actual = record.payload.assessment;
+    for (const key of [
+        "status",
+        "matching_runs",
+        "passed_runs",
+        "pass_rate_basis_points",
+        "minimum_matching_runs",
+        "required_pass_rate_basis_points",
+    ]) {
+        if (actual[key] !== expected[key])
+            throw new Error(`trust report assessment ${key} is inconsistent`);
+    }
+}
+function compareEvidenceReferences(left, right) {
+    return compareText(left.evidence_id, right.evidence_id)
+        || compareText(left.sha256, right.sha256)
+        || compareText(left.file_name, right.file_name);
+}
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function sameEvidenceReference(left, right) {
+    return right !== undefined && right !== null
+        && left.evidence_id === right.evidence_id
+        && left.sha256 === right.sha256
+        && left.file_name === right.file_name;
+}
+function closedAtForUtcDate(value) {
+    const match = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(value);
+    if (!match)
+        throw new Error("invalid trust report UTC date");
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const start = new Date(Date.UTC(year, month - 1, day));
+    if (start.getUTCFullYear() !== year || start.getUTCMonth() !== month - 1 || start.getUTCDate() !== day) {
+        throw new Error("invalid trust report UTC date");
+    }
+    return new Date(start.getTime() + 24 * 60 * 60 * 1_000).toISOString();
+}
+const LIVE_ERROR_SECRET_PATTERNS = [
+    /\bAuthorization\s*:\s*(?:Bearer|token)\s+\S+/giu,
+    /\bBearer\s+[A-Za-z0-9._~+/-]+=*/giu,
+    /\bgithub_pat_[A-Za-z0-9_]{8,}\b/giu,
+    /\bgh[opusr]_[A-Za-z0-9_]{8,}\b/giu,
+    /\b(?:GH_TOKEN|GITHUB_TOKEN)=\S+/giu,
+    /\b(?:sk|key|token)-[A-Za-z0-9_-]{8,}\b/gu,
+    /\b[A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)=\S+/gu,
+];
+export function sanitizeLiveOutcomeError(value) {
+    let sanitized = value;
+    for (const pattern of LIVE_ERROR_SECRET_PATTERNS)
+        sanitized = sanitized.replace(pattern, "[REDACTED]");
+    const bytes = Buffer.from(sanitized, "utf8");
+    if (bytes.byteLength <= 4096)
+        return sanitized;
+    return new StringDecoder("utf8").write(bytes.subarray(0, 4096));
+}
+function validateEvidenceReference(ref) {
+    const evidenceId = assertOpaqueId(ref.evidence_id, "evidence id");
+    if (!SHA256_PATTERN.test(ref.sha256))
+        throw new Error("invalid evidence digest");
+    if (ref.file_name !== `${evidenceId}.json`)
+        throw new Error("evidence filename does not match its id");
+}
+function assertJsonValue(value, path, ancestors = new Set()) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error(`${path} contains a non-finite number`);
+        return;
+    }
+    if (typeof value !== "object")
+        throw new Error(`${path} contains a non-JSON value`);
+    if (ancestors.has(value))
+        throw new Error(`${path} contains a cycle`);
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            for (let index = 0; index < value.length; index += 1) {
+                if (!(index in value))
+                    throw new Error(`${path}[${index}] contains a non-JSON array hole`);
+                assertJsonValue(value[index], `${path}[${index}]`, ancestors);
+            }
+            return;
+        }
+        if (!isRecord(value) || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)) {
+            throw new Error(`${path} contains a non-JSON object`);
+        }
+        if (Object.getOwnPropertySymbols(value).length > 0)
+            throw new Error(`${path} contains a symbol key`);
+        for (const [key, entry] of Object.entries(value))
+            assertJsonValue(entry, `${path}.${key}`, ancestors);
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+function timestampEpoch(value, label) {
+    if (typeof value !== "string")
+        throw new Error(`invalid ${label}`);
+    const match = TIMESTAMP_PATTERN.exec(value);
+    if (!match)
+        throw new Error(`invalid ${label}`);
+    const [, yearRaw, monthRaw, dayRaw, hourRaw, minuteRaw, secondRaw, fractionRaw = ""] = match;
+    const year = Number(yearRaw);
+    const month = Number(monthRaw);
+    const day = Number(dayRaw);
+    const hour = Number(hourRaw);
+    const minute = Number(minuteRaw);
+    const second = Number(secondRaw);
+    const millisecond = Number(fractionRaw.padEnd(3, "0").slice(0, 3));
+    const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millisecond));
+    if (date.getUTCFullYear() !== year
+        || date.getUTCMonth() !== month - 1
+        || date.getUTCDate() !== day
+        || date.getUTCHours() !== hour
+        || date.getUTCMinutes() !== minute
+        || date.getUTCSeconds() !== second) {
+        throw new Error(`invalid ${label}`);
+    }
+    return date.getTime();
+}
+function canonicalJson(value) {
+    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+function parseJson(bytes) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch (error) {
+        throw new Error(`invalid JSON in evidence record: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+//# sourceMappingURL=store.js.map