project-tiny-context-harness 0.8.16 → 0.11.0

package/dist/lib/long-task-external-confirmation-types.d.ts

@@ -0,0 +1,195 @@
+import type { EffectiveExternalObligationV1 } from "./long-task-acceptance-reachability-types.js";
+import type { CompiledExternalConfirmationIdentityAssuranceV2, ExternalConfirmationV2 } from "./long-task-contract-types.js";
+import type { KeyedStatementV2 } from "./long-task-semantic-contract-types.js";
+import type { DesignResourceLocatedDigestV1 } from "./design-resource-fact-manifest-types.js";
+import type { SemanticFactLocatedValueV1 } from "./semantic-fact-types.js";
+type ExternalConfirmationLocatedValueV1 = SemanticFactLocatedValueV1 | DesignResourceLocatedDigestV1 | {
+    kind: "compiled_assertion";
+    ref: string;
+    sha256: string;
+    value: unknown;
+} | {
+    kind: "compiled_assertion_comparison" | "design_strict_comparison";
+    ref: string;
+    sha256: string;
+};
+export interface ExternalConfirmationCandidateV1 {
+    git_head: string;
+    git_tree: string;
+    snapshot_sha256: string;
+}
+export interface ExternalConfirmationActorV1 {
+    id: string;
+    role: string;
+    authority_kind: "human" | "expert" | "external_system";
+}
+export interface ExternalConfirmationSessionV1 {
+    id: string;
+    target_ref: string;
+    environment_identity: string;
+    started_at: string;
+    completed_at: string;
+}
+export interface ExternalConfirmationResultV1 {
+    obligation_ref: string;
+    fact_ref: string | null;
+    claim_ref: string;
+    applicability_ref: string;
+    actual?: unknown;
+    verdict: "passed" | "failed" | "unable";
+    evidence_refs: string[];
+    rationale?: string;
+}
+export interface ExternalConfirmationRecordV1 {
+    schema_version: "long-task-external-confirmation-record-v1";
+    confirmation_ref: string;
+    compiled_identity: string;
+    authority_revision: number;
+    candidate: ExternalConfirmationCandidateV1;
+    actor: ExternalConfirmationActorV1;
+    session: ExternalConfirmationSessionV1;
+    results: ExternalConfirmationResultV1[];
+    artifact_hashes: Record<string, string>;
+    relevant_input_identity: string;
+    record_sha256: string;
+}
+export interface ExternalConfirmationResultV2 {
+    obligation_ref: string;
+    fact_ref: string | null;
+    claim_ref: string;
+    applicability_ref: string;
+    result_kind: "actual" | "judgment";
+    actual?: unknown;
+    verdict: "passed" | "failed" | "unable";
+    evidence_refs: string[];
+    rationale?: string;
+}
+export interface ExternalConfirmationArtifactSnapshotV2 {
+    sha256: string;
+    size_bytes: number;
+    media_type: string | null;
+    store_ref: string;
+}
+export interface ExternalConfirmationRecordV2 {
+    schema_version: "long-task-external-confirmation-record-v2";
+    confirmation_ref: string;
+    compiled_identity: string;
+    authority_revision: number;
+    candidate: ExternalConfirmationCandidateV1;
+    challenge: string;
+    actor: ExternalConfirmationActorV1;
+    session: ExternalConfirmationSessionV1;
+    results: ExternalConfirmationResultV2[];
+    artifact_snapshots: Record<string, ExternalConfirmationArtifactSnapshotV2>;
+    relevant_input_identity: string;
+    attestation: {
+        scheme: "ed25519";
+        key_id: string;
+        signature_base64: string;
+    };
+    record_sha256: string;
+}
+export type ExternalConfirmationRecord = ExternalConfirmationRecordV1 | ExternalConfirmationRecordV2;
+export type ExternalConfirmationFulfillmentStateV1 = "pending" | "fulfilled" | "failed" | "unable" | "invalid" | "stale" | "legacy_unattested";
+export interface ExternalConfirmationObligationResultV1 {
+    obligation_ref: string;
+    fact_ref: string | null;
+    claim_ref: string;
+    applicability_ref: string;
+    outcome_key: string | null;
+    verdict: "passed" | "failed" | "unable";
+    result_kind: "actual" | "judgment";
+    completion_role: "blocking" | "advisory";
+    acceptance_effect: "required" | "none";
+    comparator_recomputed: boolean;
+    evidence_refs: string[];
+}
+export interface ExternalConfirmationEvaluationV1 {
+    confirmation_ref: string;
+    owner: string;
+    blocks_target: boolean;
+    state: ExternalConfirmationFulfillmentStateV1;
+    record_sha256: string | null;
+    session_id: string | null;
+    relevant_input_identity: string;
+    carried_forward_from_candidate: boolean;
+    actor_identity_assurance: "ed25519_verified" | "declared_only" | "legacy_unattested" | "invalid";
+    identity_assurance: CompiledExternalConfirmationIdentityAssuranceV2 | null;
+    signature_verified: boolean;
+    challenge_current: boolean;
+    artifact_snapshot_integrity: boolean;
+    record_schema_version: ExternalConfirmationRecord["schema_version"] | null;
+    obligation_results: ExternalConfirmationObligationResultV1[];
+    effective_blocking_obligation_refs: string[];
+    effective_advisory_obligation_refs: string[];
+    blocking_issues: string[];
+    advisory_state: ExternalConfirmationFulfillmentStateV1 | null;
+    advisory_issues: string[];
+    issues: string[];
+}
+export interface ExternalConfirmationExpectedV1 {
+    authority_ref: string;
+    kind: "semantic_fact" | "design_fact" | "contract_claim" | "contract_claim_actual";
+    statement: string | null;
+    located_value: ExternalConfirmationLocatedValueV1 | null;
+    comparison: {
+        comparator: string;
+        mode: "exact" | "tolerance";
+        parameters: ExternalConfirmationLocatedValueV1;
+        tolerance: ExternalConfirmationLocatedValueV1 | null;
+        mask: ExternalConfirmationLocatedValueV1 | null;
+    } | null;
+}
+export interface ExternalConfirmationPreparationObligationV1 extends EffectiveExternalObligationV1 {
+    result_kind: "actual" | "judgment";
+    expected: ExternalConfirmationExpectedV1;
+}
+export interface ExternalConfirmationPreparationConfirmationV1 {
+    confirmation_ref: string;
+    description: string;
+    owner: string;
+    actor: ExternalConfirmationActorV1;
+    identity_assurance: CompiledExternalConfirmationIdentityAssuranceV2;
+    target_ref: string;
+    environment_identity: string;
+    scenario: NonNullable<ExternalConfirmationV2["scenario"]>;
+    evidence_requirements: KeyedStatementV2[];
+    session_group: string;
+    relevant_input_identity: string;
+    relevant_input_mode: "bounded_paths" | "whole_candidate";
+    relevant_input_paths: string[];
+    challenge: string;
+    signable_canonical_digest: string;
+    obligations: ExternalConfirmationPreparationObligationV1[];
+}
+export interface ExternalConfirmationPreparationSessionV1 {
+    session_group: string;
+    suggested_session_id: string;
+    actor: ExternalConfirmationActorV1;
+    identity_assurance: CompiledExternalConfirmationIdentityAssuranceV2;
+    target_ref: string;
+    environment_identity: string;
+    scenario: NonNullable<ExternalConfirmationV2["scenario"]>;
+    evidence_requirements: KeyedStatementV2[];
+    confirmation_refs: string[];
+    obligations: ExternalConfirmationPreparationObligationV1[];
+}
+export interface ExternalConfirmationPreparationV1 {
+    schema_version: "long-task-external-confirmation-preparation-v2";
+    acceptance_effect: "none";
+    notice: "Preparation output does not establish acceptance.";
+    task_id: string;
+    compiled_identity: string;
+    authority_revision: number;
+    candidate: ExternalConfirmationCandidateV1;
+    actor_identity_boundary: "detached_ed25519_required_for_blocking_fulfillment";
+    confirmations: ExternalConfirmationPreparationConfirmationV1[];
+    sessions: ExternalConfirmationPreparationSessionV1[];
+    generated_at: string;
+}
+export interface RelevantExternalInputIdentityV1 {
+    mode: "bounded_paths" | "whole_candidate";
+    identity: string;
+    paths: string[];
+}
+export {};

package/dist/lib/long-task-external-confirmation-types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/long-task-final-integrity.d.ts

@@ -4,6 +4,8 @@ import { currentGitState } from "./long-task-workspace.js";
 export interface FinalGateProtectedInputIdentity {
     compiled_identity: string;
     raw_contract_sha256: string;
+    protected_authority_inputs_identity: string;
+    external_confirmation_records: Record<string, string>;
 }
 export declare function captureFinalGateProtectedInputIdentity(repository: string, compiled: CompiledDeliveryContractV2): Promise<FinalGateProtectedInputIdentity>;
 export declare function finalGateIntegrityFindings(input: {

package/dist/lib/long-task-final-integrity.js

@@ -1,29 +1,36 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { compileDeliveryContract } from "./long-task-delivery-compiler.js";
-import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
+import { captureStoredExternalConfirmationRecordIdentities } from "./long-task-external-confirmation-state.js";
+import { captureProtectedAuthorityInputsIdentity } from "./long-task-freshness.js";
 import { activeAuthorityIdentityMatches, assertMatchingActiveBinding, loadActiveLongTaskAuthority, } from "./long-task-state.js";
 import { captureWorkspaceFingerprint, currentGitState, } from "./long-task-workspace.js";
-import { sha256Hex } from "./strict-codec.js";
 export async function captureFinalGateProtectedInputIdentity(repository, compiled) {
-    const file = await assertProtectedRepositoryFile(repository, path.join(repository, ...compiled.contract_file.split("/")), "final_gate_delivery_contract");
+    const protectedAuthorityInputs = await captureProtectedAuthorityInputsIdentity(compiled);
     return {
         compiled_identity: compiled.compiled_identity,
-        raw_contract_sha256: sha256Hex(await readFile(file)),
+        raw_contract_sha256: protectedAuthorityInputs.snapshot.raw_contract_sha256,
+        protected_authority_inputs_identity: protectedAuthorityInputs.identity,
+        external_confirmation_records: await captureStoredExternalConfirmationRecordIdentities(repository, compiled.workdir, compiled.global.acceptance.external_confirmations.map((row) => row.key)),
     };
 }
 export async function finalGateIntegrityFindings(input) {
     const findings = [];
+    // Fingerprint capture runs git write-tree. Finish it before currentGitState
+    // may refresh the same repository index, and finish both before the protected
+    // recompile may capture another workspace manifest.
     const after = await captureWorkspaceFingerprint(input.repository);
     const gitAfter = await currentGitState(input.repository);
+    const [authorityChanged, protectedFindings] = await Promise.all([
+        activeAuthorityChanged(input),
+        protectedInputFindings(input),
+    ]);
     if (after.identity !== input.workspace_identity_before ||
         gitAfter.head !== input.candidate.head ||
         gitAfter.tree !== input.candidate.tree ||
         gitAfter.dirty.length)
         findings.push(workspaceChangedFinding());
-    if (await activeAuthorityChanged(input))
+    if (authorityChanged)
         findings.push(activeAuthorityChangedFinding());
-    findings.push(...(await protectedInputFindings(input)));
+    findings.push(...protectedFindings);
     return findings;
 }
 async function activeAuthorityChanged(input) {
@@ -50,7 +57,11 @@ async function protectedInputFindings(input) {
         return after.compiled_identity !==
             input.protected_inputs_before.compiled_identity ||
             after.raw_contract_sha256 !==
-                input.protected_inputs_before.raw_contract_sha256
+                input.protected_inputs_before.raw_contract_sha256 ||
+            after.protected_authority_inputs_identity !==
+                input.protected_inputs_before.protected_authority_inputs_identity ||
+            JSON.stringify(after.external_confirmation_records) !==
+                JSON.stringify(input.protected_inputs_before.external_confirmation_records)
             ? [
                 protectedInputsChangedFinding({
                     before: input.protected_inputs_before,
@@ -91,7 +102,7 @@ function protectedInputsChangedFinding(actual) {
         code: "protected_inputs_changed_during_final_gate",
         outcome_key: null,
         check_key: null,
-        message: "Protected Contract, Source, controlling Context, verifier/runner, verification-input or workdir input identity changed while Final Gate was running.",
+        message: "Protected Contract, Source, controlling Context, verifier/runner, verification-input, workdir input or External Confirmation record identity changed while Final Gate was running.",
         actual,
         next_action: "Stop concurrent protected-input mutation, review any required Authority Revision, and rerun the complete Final Gate.",
     };

package/dist/lib/long-task-final-v2.d.ts

@@ -1,2 +1,7 @@
-import type { FinalReceiptV2 } from "./long-task-delivery-types.js";
-export declare function runDeliveryFinalGate(workdirInput: string): Promise<FinalReceiptV2>;
+import { compileDeliveryContract } from "./long-task-delivery-compiler.js";
+import type { FinalReceiptV3, LongTaskFindingV2 } from "./long-task-delivery-types.js";
+import type { ExternalConfirmationEvaluationV1 } from "./long-task-external-confirmation-types.js";
+export declare function runDeliveryFinalGate(workdirInput: string, options?: {
+    close_on_accept?: boolean;
+}): Promise<FinalReceiptV3>;
+export declare function externalConfirmationFindings(compiled: Awaited<ReturnType<typeof compileDeliveryContract>>, evaluations: ExternalConfirmationEvaluationV1[]): LongTaskFindingV2[];

package/dist/lib/long-task-final-v2.js

@@ -1,11 +1,15 @@
 import { compileDeliveryContract } from "./long-task-delivery-compiler.js";
-import { outcomeResultExternallyBlocked } from "./long-task-claims.js";
+import { evaluateExternalConfirmations } from "./long-task-external-confirmation-plan.js";
+import { allEffectiveExternalRows, blockingExternalRows, } from "./long-task-external-confirmation-identity.js";
+import { enrichFinding } from "./long-task-finding-context.js";
 import { captureFinalGateProtectedInputIdentity, finalGateIntegrityFindings, } from "./long-task-final-integrity.js";
-import { assertMatchingActiveBinding, loadActiveLongTaskAuthority, writeFinalReceipt, } from "./long-task-state.js";
+import { captureFinalizationIdentity } from "./long-task-finalization-identity.js";
+import { assertMatchingActiveBinding, loadActiveLongTaskAuthority, } from "./long-task-state.js";
+import { finalizeDeliveryGateCas } from "./long-task-terminal-finalization.js";
 import { assertVerifierAuthorityCurrent, deliveryCompileFreshness, } from "./long-task-freshness.js";
 import { allCompiledChecks, runDeliveryChecks, } from "./long-task-verifier-v2.js";
 import { captureWorkspaceFingerprint, createWorkspaceSnapshot, currentGitState, repositoryRoot, } from "./long-task-workspace.js";
-export async function runDeliveryFinalGate(workdirInput) {
+export async function runDeliveryFinalGate(workdirInput, options = {}) {
     const startedAt = new Date().toISOString();
     const repository = await repositoryRoot(process.cwd());
     const active = (await loadActiveLongTaskAuthority(repository, { migrate_legacy: true })).authority;
@@ -20,12 +24,14 @@ export async function runDeliveryFinalGate(workdirInput) {
         compiled_identity: active.active_authority_identity,
         worktree_identity: active.worktree_identity,
     };
-    const candidate = await currentGitState(repository);
+    const acceptedCompiled = active.authority_snapshot;
+    const [candidate, , staleAuthorityInputs] = await Promise.all([
+        currentGitState(repository),
+        assertMatchingActiveBinding(acceptedCompiled),
+        deliveryCompileFreshness(acceptedCompiled),
+    ]);
     if (candidate.dirty.length)
         throw new Error(`final_gate_requires_clean_candidate_commit:${candidate.dirty.join(",")}`);
-    const acceptedCompiled = active.authority_snapshot;
-    await assertMatchingActiveBinding(acceptedCompiled);
-    const staleAuthorityInputs = await deliveryCompileFreshness(acceptedCompiled);
     if (staleAuthorityInputs.length)
         throw new Error(`final_gate_protected_input_stale:${staleAuthorityInputs.join(",")}`);
     const compiled = await compileDeliveryContract(active.workdir, repository, {
@@ -34,12 +40,30 @@ export async function runDeliveryFinalGate(workdirInput) {
         authority_revision: active.authority_revision,
         require_completion_gate: true,
     });
-    await assertMatchingActiveBinding(compiled);
-    const protectedInputsBefore = await captureFinalGateProtectedInputIdentity(repository, compiled);
-    const before = await captureWorkspaceFingerprint(repository);
+    const [, protectedInputsBefore, before] = await Promise.all([
+        assertMatchingActiveBinding(compiled),
+        captureFinalGateProtectedInputIdentity(repository, compiled),
+        captureWorkspaceFingerprint(repository),
+    ]);
     const snapshot = await createWorkspaceSnapshot(repository, active.workdir, `final-${compiled.task.id}`);
     try {
+        const expectedFinalizationIdentity = await captureFinalizationIdentity({
+            repository,
+            active,
+            compiled,
+            candidate: {
+                git_head: candidate.head,
+                git_tree: candidate.tree,
+                snapshot_sha256: snapshot.manifest.snapshot_sha256,
+            },
+            workspace_fingerprint: snapshot.manifest.fingerprint,
+        });
         const run = await runDeliveryChecks(compiled, snapshot, allCompiledChecks(compiled), true, true);
+        const externalResults = await evaluateExternalConfirmations(compiled, repository, active.workdir, snapshot.manifest, {
+            git_head: candidate.head,
+            git_tree: candidate.tree,
+            snapshot_sha256: snapshot.manifest.snapshot_sha256,
+        });
         run.findings.push(...(await finalGateIntegrityFindings({
             repository,
             active,
@@ -48,53 +72,60 @@ export async function runDeliveryFinalGate(workdirInput) {
             workspace_identity_before: before.identity,
             protected_inputs_before: protectedInputsBefore,
         })));
-        const outcomeResults = projectOutcomes(compiled, run.check_results, run.findings);
-        const globalChecks = run.check_results.filter((check) => check.outcome_key === null);
-        const globalHardFailure = globalChecks.some((check) => check.status !== "passed" && check.status !== "blocked_external");
-        const globalBlocked = globalChecks.some((check) => check.status === "blocked_external");
-        const failed = globalHardFailure ||
-            Object.values(outcomeResults).includes("failed") ||
-            run.findings.some((finding) => finding.code !== "blocked_external");
-        const blocked = globalBlocked ||
-            Object.values(outcomeResults).includes("blocked_external") ||
-            run.findings.some((finding) => finding.code === "blocked_external");
-        const targetBlocked = compiled.global.acceptance.external_confirmations.some((confirmation) => confirmation.blocks_target);
-        const workflowStatus = failed
+        const outcomeResults = projectOutcomes(compiled, run.check_results, run.findings, externalResults);
+        const checks = allCompiledChecks(compiled);
+        const machineFailed = run.check_results.some((result) => semanticCheckFailed(checks, result)) ||
+            run.findings.some((finding) => completionFindingBlocks(checks, finding));
+        const blockingExternal = externalResults.filter((evaluation) => evaluation.blocks_target);
+        const externalNeedsWork = blockingExternal.some((evaluation) => evaluation.state !== "fulfilled" && evaluation.state !== "pending");
+        const externalPending = blockingExternal.some((evaluation) => evaluation.state === "pending");
+        const workflowStatus = machineFailed || externalNeedsWork
             ? "needs_work"
-            : blocked || targetBlocked
+            : externalPending
                 ? "blocked_external"
-                : compiled.global.acceptance.external_confirmations.length
-                    ? "machine_accepted_external_pending"
+                : blockingExternal.length
+                    ? "delivery_accepted"
                     : "machine_accepted";
         const targetState = workflowStatus === "machine_accepted" ||
-            workflowStatus === "machine_accepted_external_pending"
+            workflowStatus === "delivery_accepted"
             ? compiled.task.target_profile.required_state
             : workflowStatus === "blocked_external"
                 ? "blocked_external"
                 : "not_accepted";
-        return writeFinalReceipt(repository, active.workdir, {
-            schema_version: "long-task-final-receipt-v2",
-            authority_scope: "audit_only",
-            reusable_for_acceptance: false,
-            workflow_status: workflowStatus,
-            target_profile: compiled.task.target_profile,
-            target_state: targetState,
-            stage_results: projectStages(compiled, outcomeResults),
-            compiled_identity: compiled.compiled_identity,
-            contract_sha256: compiled.contract_sha256,
-            snapshot_sha256: snapshot.manifest.snapshot_sha256,
-            git_head: candidate.head,
-            git_tree: candidate.tree,
-            source_hashes: compiled.source_hashes,
-            context_hashes: compiled.context_snapshot.sha256,
-            verifier_identity: compiled.verifier_identity,
-            check_results: run.check_results,
-            outcome_results: outcomeResults,
-            external_confirmations: compiled.global.acceptance.external_confirmations,
-            findings: run.findings,
-            snapshot_preparation_ms: snapshot.preparation_ms,
-            started_at: startedAt,
-            completed_at: new Date().toISOString(),
+        const externalFindings = externalConfirmationFindings(compiled, externalResults);
+        const receiptFindings = [...run.findings, ...externalFindings].map((finding) => enrichFinding(compiled, finding));
+        return finalizeDeliveryGateCas({
+            repository,
+            workdir: active.workdir,
+            provisional_manifest: snapshot.manifest,
+            expected_authority: acceptedAuthority,
+            expected_finalization_identity: expectedFinalizationIdentity,
+            close_on_accept: options.close_on_accept ?? false,
+            provisional_result: {
+                schema_version: "long-task-final-receipt-v3",
+                authority_scope: "audit_only",
+                reusable_for_acceptance: false,
+                workflow_status: workflowStatus,
+                target_profile: compiled.task.target_profile,
+                target_state: targetState,
+                stage_results: projectStages(compiled, outcomeResults),
+                compiled_identity: compiled.compiled_identity,
+                contract_sha256: compiled.contract_sha256,
+                snapshot_sha256: snapshot.manifest.snapshot_sha256,
+                git_head: candidate.head,
+                git_tree: candidate.tree,
+                source_hashes: compiled.source_hashes,
+                context_hashes: compiled.context_snapshot.sha256,
+                verifier_identity: compiled.verifier_identity,
+                check_results: run.check_results,
+                outcome_results: outcomeResults,
+                external_confirmations: compiled.global.acceptance.external_confirmations,
+                external_confirmation_results: externalResults,
+                findings: receiptFindings,
+                snapshot_preparation_ms: snapshot.preparation_ms,
+                started_at: startedAt,
+                completed_at: new Date().toISOString(),
+            },
         });
     }
     finally {
@@ -132,20 +163,113 @@ function projectStages(compiled, outcomes) {
     }
     return result;
 }
-function projectOutcomes(compiled, checks, findings) {
+function projectOutcomes(compiled, checks, findings, externalResults) {
+    const compiledChecks = allCompiledChecks(compiled);
     return Object.fromEntries(compiled.outcomes.map((outcome) => {
         const outcomeKey = outcome.key;
-        const owned = checks.filter((check) => check.outcome_key === outcomeKey);
-        const ownFindings = findings.filter((finding) => finding.outcome_key === outcomeKey || finding.outcome_key === null);
-        const status = owned.some((check) => check.status !== "passed" && check.status !== "blocked_external") || ownFindings.some((finding) => finding.code !== "blocked_external")
+        const owned = checks.filter((check) => check.outcome_key === outcomeKey &&
+            compiledChecks.find((candidate) => candidate.outcome_key === check.outcome_key &&
+                candidate.key === check.check_key)?.completion_role === "semantic");
+        const ownFindings = findings.filter((finding) => (finding.outcome_key === outcomeKey ||
+            (finding.outcome_key === null && finding.check_key === null)) &&
+            completionFindingBlocks(compiledChecks, finding));
+        const external = externalResults.filter((evaluation) => evaluation.blocks_target &&
+            externalConfirmationImpactsOutcome(compiled, evaluation, outcomeKey));
+        const status = owned.some((check) => check.status !== "passed") ||
+            ownFindings.length ||
+            external.some((evaluation) => evaluation.state !== "fulfilled" && evaluation.state !== "pending")
             ? "failed"
-            : outcomeResultExternallyBlocked(compiled, outcomeKey) ||
-                owned.some((check) => check.status === "blocked_external")
+            : external.some((evaluation) => evaluation.state === "pending")
                 ? "blocked_external"
                 : "passed";
         return [outcomeKey, status];
     }));
 }
+function semanticCheckFailed(checks, result) {
+    const check = checks.find((candidate) => candidate.outcome_key === result.outcome_key &&
+        candidate.key === result.check_key);
+    return check?.completion_role === "semantic" && result.status !== "passed";
+}
+function completionFindingBlocks(checks, finding) {
+    if (!finding.check_key)
+        return true;
+    const check = checks.find((candidate) => candidate.outcome_key === finding.outcome_key &&
+        candidate.key === finding.check_key);
+    return check?.completion_role !== "diagnostic";
+}
+function externalConfirmationImpactsOutcome(compiled, evaluation, outcomeKey) {
+    return blockingExternalRows(compiled, evaluation.confirmation_ref).some((row) => row.outcome_key === outcomeKey ||
+        row.claim_ref === outcomeKey ||
+        row.claim_ref.startsWith(`${outcomeKey}.`) ||
+        row.local_claim_ref === outcomeKey ||
+        row.local_claim_ref.startsWith(`${outcomeKey}.`));
+}
+export function externalConfirmationFindings(compiled, evaluations) {
+    return evaluations.flatMap((evaluation) => {
+        const roles = [];
+        if (evaluation.blocks_target && evaluation.state !== "fulfilled")
+            roles.push({
+                role: "blocking",
+                state: evaluation.state,
+                issues: evaluation.blocking_issues,
+            });
+        if (evaluation.advisory_state &&
+            evaluation.advisory_state !== "fulfilled" &&
+            evaluation.advisory_state !== "pending")
+            roles.push({
+                role: "advisory",
+                state: evaluation.advisory_state,
+                issues: evaluation.advisory_issues,
+            });
+        return roles.map(({ role, state, issues }) => {
+            const declaration = compiled.global.acceptance.external_confirmations.find((confirmation) => confirmation.key === evaluation.confirmation_ref);
+            const obligations = allEffectiveExternalRows(compiled, evaluation.confirmation_ref).filter((obligation) => obligation.completion_role === role);
+            const obligationRefs = new Set(obligations.map((obligation) => obligation.obligation_ref));
+            const results = evaluation.obligation_results.filter((result) => result.completion_role === role);
+            const declaredObligations = (declaration?.obligations ?? []).filter((obligation) => obligationRefs.has(obligation.key));
+            return {
+                code: role === "blocking"
+                    ? `external_confirmation_${state}`
+                    : `external_confirmation_advisory_${state}`,
+                outcome_key: results.find((result) => result.outcome_key !== null)?.outcome_key ??
+                    obligations.find((obligation) => obligation.outcome_key !== null)
+                        ?.outcome_key ??
+                    null,
+                check_key: null,
+                claim_keys: [
+                    ...new Set([
+                        ...obligations.map((obligation) => obligation.claim_ref),
+                        ...results.map((result) => result.claim_ref),
+                    ]),
+                ].sort(),
+                fact_refs: obligations.flatMap((obligation) => obligation.fact_ref ? [obligation.fact_ref] : []),
+                proof_obligation_refs: obligations.flatMap((obligation) => obligation.proof_ref ? [obligation.proof_ref] : []),
+                expected_authority_refs: declaredObligations.map((obligation) => obligation.expected_authority_ref),
+                actual_evidence_refs: [
+                    ...(evaluation.record_sha256
+                        ? [`external-record:${evaluation.record_sha256}`]
+                        : []),
+                    ...results.flatMap((result) => result.evidence_refs.map((reference) => `external-artifact:${reference}`)),
+                ],
+                verification_owner: {
+                    kind: "external_confirmation",
+                    confirmation_ref: evaluation.confirmation_ref,
+                    owner: evaluation.owner,
+                    target_ref: declaration?.target_ref ?? "undeclared",
+                },
+                invalidation_reasons: [state, ...issues],
+                rerun_obligation_refs: obligations.map((obligation) => obligation.obligation_ref),
+                actual: evaluation,
+                message: role === "blocking"
+                    ? `Blocking External Confirmation ${evaluation.confirmation_ref} is ${state}.`
+                    : `Advisory External Confirmation ${evaluation.confirmation_ref} is ${state}.`,
+                next_action: state === "pending"
+                    ? `Run ty-context long-task external prepare <workdir> --confirmation ${evaluation.confirmation_ref}, collect exact per-obligation evidence, then submit the record.`
+                    : `Repair or revoke External Confirmation ${evaluation.confirmation_ref}, prepare it again on the current candidate, and submit a fresh exact record.`,
+            };
+        });
+    });
+}
 async function resolved(workdir) {
     return (await import("node:path")).default.resolve(workdir);
 }

package/dist/lib/long-task-finalization-identity.d.ts

@@ -0,0 +1,27 @@
+import type { CompiledDeliveryContractV2, WorkspaceFingerprintV2 } from "./long-task-delivery-types.js";
+import type { ExternalConfirmationCandidateV1 } from "./long-task-external-confirmation-types.js";
+import type { ActiveLongTaskAuthorityV3 } from "./long-task-state.js";
+export interface FinalizationIdentityV1 {
+    active_authority_identity: string;
+    authority_revision: number;
+    verifier_identity_sha256: string;
+    candidate: {
+        git_head: string;
+        git_tree: string;
+        workspace_fingerprint: string;
+    };
+    compiled_identity: string;
+    raw_contract_sha256: string;
+    protected_authority_inputs_identity: string;
+    external_records: Record<string, string>;
+    external_challenges: Record<string, string>;
+    external_artifacts: Record<string, string>;
+}
+export declare function captureFinalizationIdentity(input: {
+    repository: string;
+    active: ActiveLongTaskAuthorityV3;
+    compiled: CompiledDeliveryContractV2;
+    candidate: ExternalConfirmationCandidateV1;
+    workspace_fingerprint: string | Pick<WorkspaceFingerprintV2, "identity">;
+}): Promise<FinalizationIdentityV1>;
+export declare function finalizationIdentityDigest(identity: FinalizationIdentityV1): string;