projscan 4.13.0 → 4.14.0

package/dist/core/intentRouterWorkflowKeywordWeights.js

@@ -93,6 +93,26 @@ const BUG_HUNT_WEIGHT_TWO_KEYWORDS = new Set([
     'win',
     'wins',
 ]);
+const PROVE_WEIGHT_TWO_KEYWORDS = new Set([
+    'agent',
+    'allowed',
+    'allow',
+    'permission',
+    'permissions',
+    'proof',
+    'contract',
+    'contracts',
+    'scope',
+    'scoped',
+    'forbidden',
+    'receipt',
+    'receipts',
+    'replay',
+    'ledger',
+    'stale',
+    'fresh',
+    'bounded',
+]);
 export function workflowKeywordWeight(tool, keyword) {
     if (tool === 'projscan_evidence_pack')
         return evidencePackKeywordWeight(keyword);
@@ -100,6 +120,8 @@ export function workflowKeywordWeight(tool, keyword) {
         return releaseTrainKeywordWeight(keyword);
     if (tool === 'projscan_bug_hunt')
         return bugHuntKeywordWeight(keyword);
+    if (tool === 'projscan_prove')
+        return proveKeywordWeight(keyword);
     return undefined;
 }
 function evidencePackKeywordWeight(keyword) {
@@ -121,4 +143,11 @@ function bugHuntKeywordWeight(keyword) {
         return 0.25;
     return undefined;
 }
+function proveKeywordWeight(keyword) {
+    if (PROVE_WEIGHT_TWO_KEYWORDS.has(keyword))
+        return 2;
+    if (['change', 'changed', 'edit', 'edits', 'prove'].includes(keyword))
+        return 0.5;
+    return undefined;
+}
 //# sourceMappingURL=intentRouterWorkflowKeywordWeights.js.map

package/dist/core/intentRouterWorkflowKeywordWeights.js.map

@@ -1 +1 @@
-{"version":3,"file":"intentRouterWorkflowKeywordWeights.js","sourceRoot":"","sources":["../../src/core/intentRouterWorkflowKeywordWeights.ts"],"names":[],"mappings":"AAAA,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhF,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IAChD,UAAU;IACV,OAAO;IACP,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW;IACX,SAAS;IACT,aAAa;IACb,OAAO;IACP,KAAK;IACL,WAAW;IACX,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,SAAS;IACT,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,OAAO;IACP,SAAS;IACT,WAAW;IACX,OAAO;IACP,SAAS;IACT,YAAY;IACZ,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IAChD,WAAW;IACX,QAAQ;IACR,WAAW;IACX,UAAU;IACV,YAAY;IACZ,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;IACX,MAAM;IACN,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,UAAU;IACV,OAAO;IACP,UAAU;IACV,OAAO;IACP,KAAK;IACL,QAAQ;IACR,SAAS;IACT,aAAa;IACb,QAAQ;IACR,MAAM;IACN,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAe;IACjE,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"intentRouterWorkflowKeywordWeights.js","sourceRoot":"","sources":["../../src/core/intentRouterWorkflowKeywordWeights.ts"],"names":[],"mappings":"AAAA,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhF,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IAChD,UAAU;IACV,OAAO;IACP,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW;IACX,SAAS;IACT,aAAa;IACb,OAAO;IACP,KAAK;IACL,WAAW;IACX,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,SAAS;IACT,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,OAAO;IACP,SAAS;IACT,WAAW;IACX,OAAO;IACP,SAAS;IACT,YAAY;IACZ,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IAChD,WAAW;IACX,QAAQ;IACR,WAAW;IACX,UAAU;IACV,YAAY;IACZ,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;IACX,MAAM;IACN,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,UAAU;IACV,OAAO;IACP,UAAU;IACV,OAAO;IACP,KAAK;IACL,QAAQ;IACR,SAAS;IACT,aAAa;IACb,QAAQ;IACR,MAAM;IACN,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO;IACP,SAAS;IACT,OAAO;IACP,YAAY;IACZ,aAAa;IACb,OAAO;IACP,UAAU;IACV,WAAW;IACX,OAAO;IACP,QAAQ;IACR,WAAW;IACX,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAe;IACjE,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/proofLedger.d.ts

@@ -3,6 +3,7 @@ export declare const DEFAULT_PROOF_LEDGER_PATH = ".projscan/proof-ledger.jsonl";
 export declare function normalizeProofCommand(command: string): string;
 export declare function changedFileFingerprint(files: string[]): string;
 export declare function redactProofSummary(value: string | undefined): string;
+export declare function redactProofOutput(value: string): string;
 export declare function appendProofLedgerRecord(rootPath: string, ledgerPath: string | undefined, input: ProofLedgerWriteInput): Promise<ProofLedgerRecord>;
 export declare function readProofLedger(rootPath: string, ledgerPath: string | undefined): Promise<ProofLedgerRecord[]>;
 export declare function latestProofRecordFor(records: ProofLedgerRecord[], command: string): ProofLedgerRecord | undefined;

package/dist/core/proofLedger.js

@@ -7,6 +7,7 @@ const REDACTION_PATTERNS = [
     /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi,
     /\b(?:sk|pk|whsec|ghp|gho|github_pat)_[A-Za-z0-9_=-]{8,}/gi,
     /\b(password|passwd|pwd|token|secret|api[_-]?key)\s*[:=]\s*["']?[^"'\s,;]+/gi,
+    /\b(--?(?:password|passwd|pwd|token|secret|api[_-]?key))\s+[^"'\s,;]+/gi,
     /\b[A-Za-z_][A-Za-z0-9_]*\.env\s*[:=]\s*[^"'\s,;]+/gi,
 ];
 export function normalizeProofCommand(command) {
@@ -17,17 +18,21 @@ export function changedFileFingerprint(files) {
     return crypto.createHash('sha256').update(normalized.join('\n')).digest('hex');
 }
 export function redactProofSummary(value) {
-    let summary = (value ?? '').replace(/\s+/g, ' ').trim();
+    let summary = redactProofOutput(value ?? '').replace(/\s+/g, ' ').trim();
     if (summary.length === 0)
         summary = 'No proof output summary supplied.';
-    for (const pattern of REDACTION_PATTERNS) {
-        summary = summary.replace(pattern, (match, label) => label ? `${label}=[redacted]` : '[redacted]');
-    }
     if (summary.length > MAX_SUMMARY_LENGTH) {
         return `${summary.slice(0, MAX_SUMMARY_LENGTH - 1)}...`;
     }
     return summary;
 }
+export function redactProofOutput(value) {
+    let output = value;
+    for (const pattern of REDACTION_PATTERNS) {
+        output = output.replace(pattern, redactionReplacement);
+    }
+    return output;
+}
 export async function appendProofLedgerRecord(rootPath, ledgerPath, input) {
     const completedAt = input.completedAt ?? new Date().toISOString();
     const durationMs = Math.max(0, Math.round(input.durationMs));
@@ -125,6 +130,11 @@ function isProofLedgerRecord(value) {
 function normalizePath(value) {
     return value.split(path.sep).join('/').replace(/^\.\//, '');
 }
+function redactionReplacement(_match, ...args) {
+    const captures = args.slice(0, -2);
+    const label = captures.find((value) => typeof value === 'string' && value.length > 0);
+    return label ? `${label}=[redacted]` : '[redacted]';
+}
 function isNodeErrorCode(error, code) {
     return (typeof error === 'object' &&
         error !== null &&

package/dist/core/proofLedger.js.map

@@ -1 +1 @@
-{"version":3,"file":"proofLedger.js","sourceRoot":"","sources":["../../src/core/proofLedger.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,kBAAkB,GAAG;IACzB,kCAAkC;IAClC,2DAA2D;IAC3D,6EAA6E;IAC7E,qDAAqD;CACtD,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAe;IACpD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,mCAAmC,CAAC;IACxE,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAyB,EAAE,EAAE,CACtE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,UAA8B,EAC9B,KAA4B;IAE5B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;QAClD,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAClD,SAAS;QACT,WAAW;QACX,UAAU;QACV,sBAAsB,EAAE,sBAAsB,CAAC,YAAY,CAAC;QAC5D,YAAY;QACZ,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACtD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;QACtC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,UAA8B;IAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,mBAAmB,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAA+B,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAA4B,EAC5B,OAAe;IAEf,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,MAAqC,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS;QACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,WAAmB,EAAE,QAAgB;IAC3E,MAAM,MAAM,GAAG,MAAM;SAClB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,WAAW,KAAK,QAAQ,EAAE,CAAC;SACxE,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,gBAAgB,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,UAA8B;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA+B,CAAC;QACjE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiC;IAC5D,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;QAC3C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAA4B,CAAC,IAAI,KAAK,IAAI,CAC5C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"proofLedger.js","sourceRoot":"","sources":["../../src/core/proofLedger.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,kBAAkB,GAAG;IACzB,kCAAkC;IAClC,2DAA2D;IAC3D,6EAA6E;IAC7E,wEAAwE;IACxE,qDAAqD;CACtD,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAe;IACpD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,OAAO,GAAG,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,mCAAmC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,UAA8B,EAC9B,KAA4B;IAE5B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;QAClD,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAClD,SAAS;QACT,WAAW;QACX,UAAU;QACV,sBAAsB,EAAE,sBAAsB,CAAC,YAAY,CAAC;QAC5D,YAAY;QACZ,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACtD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;QACtC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,UAA8B;IAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,mBAAmB,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAA+B,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAA4B,EAC5B,OAAe;IAEf,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,MAAqC,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS;QACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,WAAmB,EAAE,QAAgB;IAC3E,MAAM,MAAM,GAAG,MAAM;SAClB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,WAAW,KAAK,QAAQ,EAAE,CAAC;SACxE,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,gBAAgB,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,UAA8B;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA+B,CAAC;QACjE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiC;IAC5D,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;QAC3C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,GAAG,IAAe;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvG,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAA4B,CAAC,IAAI,KAAK,IAAI,CAC5C,CAAC;AACJ,CAAC"}

package/dist/core/prove.d.ts

@@ -14,5 +14,7 @@ export interface ComputeProveOptions {
     durationMs?: number;
     summary?: string;
     logPath?: string;
+    runCommand?: string[];
+    runTimeoutMs?: number;
 }
 export declare function computeProve(rootPath: string, options?: ComputeProveOptions): Promise<ProveReport>;

package/dist/core/prove.js

@@ -1,11 +1,18 @@
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { readFeedbackFile } from './feedback.js';
-import { appendProofLedgerRecord, changedFileFingerprint, latestProofRecordFor, readProofLedger, } from './proofLedger.js';
+import { appendProofLedgerRecord, changedFileFingerprint, latestProofRecordFor, readProofLedger, redactProofOutput, } from './proofLedger.js';
 import { quoteShellArg } from './startShellArgs.js';
 import { computeSimulation } from './simulate.js';
 import { getChangedFiles } from '../utils/changedFiles.js';
 const DEFAULT_CONTRACT_PATH = '.projscan/proof-contract.json';
+const DEFAULT_RUN_TIMEOUT_MS = 10 * 60 * 1000;
+const PROOF_RUN_TIMEOUT_EXIT_CODE = 124;
+const COMMAND_NOT_FOUND_EXIT_CODE = 127;
+const MAX_PROOF_RUN_OUTPUT_CHARS = 256 * 1024;
+const MAX_PROOF_RUN_LOG_CHARS = 512 * 1024;
 const GENERATED_FORBIDDEN_PATTERNS = [
     '.agentflight/**',
     '.agentloop/**',
@@ -85,16 +92,48 @@ const CONFIG_BASENAMES = new Set([
 ]);
 const CONFIG_SUFFIXES = ['.config.js', '.config.cjs', '.config.mjs', '.config.ts'];
 export async function computeProve(rootPath, options = {}) {
-    const modeCount = [Boolean(options.intent?.trim()), Boolean(options.changed), Boolean(options.recordCommand?.trim())].filter(Boolean).length;
+    const modeCount = [
+        Boolean(options.intent?.trim()),
+        Boolean(options.changed),
+        Boolean(options.recordCommand?.trim()),
+        options.runCommand !== undefined,
+    ].filter(Boolean).length;
     if (modeCount > 1) {
-        throw new Error('prove accepts only one of --intent, --changed, or --record-command');
+        throw new Error('prove accepts only one of --intent, --changed, --record-command, or --run');
     }
+    if (options.runCommand !== undefined)
+        return computeRunProof(rootPath, options);
     if (options.recordCommand?.trim())
         return computeRecordProof(rootPath, options);
     if (options.changed)
         return computeChangedProof(rootPath, options);
     return computeIntentProof(rootPath, options);
 }
+async function computeRunProof(rootPath, options) {
+    const run = await executeProofCommand(rootPath, options.runCommand ?? [], options.runTimeoutMs);
+    const changedFiles = await getChangedFiles(rootPath, options.baseRef);
+    const record = await appendProofLedgerRecord(rootPath, options.ledgerPath, {
+        command: run.command,
+        exitCode: run.exitCode,
+        durationMs: run.durationMs,
+        changedFiles: proofRelevantChangedFiles(changedFiles.files),
+        outputSummary: run.outputSummary,
+        logPath: run.logPath,
+        source: 'prove-run',
+    });
+    const verdict = record.status === 'passed' ? 'ready' : 'blocked';
+    const verifiedWorkflow = verifiedWorkflowForRecord(verdict, record.status);
+    return {
+        schemaVersion: 1,
+        mode: 'run',
+        verdict,
+        summary: `${verdict}: executed ${record.status} proof for ${record.command}`,
+        commands: [record.command],
+        warnings: changedFiles.available ? [] : [changedFiles.reason ?? 'Changed-file evidence is unavailable.'],
+        verifiedWorkflow,
+        ledgerRecord: record,
+    };
+}
 async function computeRecordProof(rootPath, options) {
     const proof = recordProofInput(options);
     const changedFiles = await getChangedFiles(rootPath, options.baseRef);
@@ -108,6 +147,7 @@ async function computeRecordProof(rootPath, options) {
         source: 'prove-record',
     });
     const verdict = record.status === 'passed' ? 'ready' : 'blocked';
+    const verifiedWorkflow = verifiedWorkflowForRecord(verdict, record.status);
     return {
         schemaVersion: 1,
         mode: 'record',
@@ -115,6 +155,7 @@ async function computeRecordProof(rootPath, options) {
         summary: `${verdict}: recorded ${record.status} proof for ${record.command}`,
         commands: [record.command],
         warnings: changedFiles.available ? [] : [changedFiles.reason ?? 'Changed-file evidence is unavailable.'],
+        verifiedWorkflow,
         ledgerRecord: record,
     };
 }
@@ -136,6 +177,167 @@ function recordProofInput(options) {
         logPath: options.logPath,
     };
 }
+async function executeProofCommand(rootPath, command, timeoutMs) {
+    const commandVector = normalizeRunCommand(command);
+    const displayCommand = redactProofOutput(commandVector.map(quoteShellArg).join(' '));
+    const startedAtMs = Date.now();
+    const effectiveTimeoutMs = resolveRunTimeoutMs(timeoutMs);
+    const result = await spawnProofCommand(rootPath, commandVector, effectiveTimeoutMs);
+    const durationMs = Date.now() - startedAtMs;
+    const outputSummary = proofRunOutputSummary(result, effectiveTimeoutMs);
+    const logPath = await writeProofRunLog(rootPath, {
+        command: displayCommand,
+        exitCode: result.exitCode,
+        durationMs,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        errorMessage: result.errorMessage,
+        timedOut: result.timedOut,
+        truncated: result.truncated,
+    });
+    return {
+        command: displayCommand,
+        exitCode: result.exitCode,
+        durationMs,
+        outputSummary,
+        logPath,
+    };
+}
+function normalizeRunCommand(command) {
+    const normalized = command.map((part) => String(part));
+    if (normalized.length === 0 || normalized[0]?.trim().length === 0) {
+        throw new Error('prove --run requires a command after --, for example: projscan prove --run -- npm test');
+    }
+    return normalized;
+}
+function resolveRunTimeoutMs(value) {
+    if (value === undefined)
+        return DEFAULT_RUN_TIMEOUT_MS;
+    if (!Number.isFinite(value) || value <= 0) {
+        throw new Error('prove --run-timeout-ms requires a positive number');
+    }
+    return Math.round(value);
+}
+function spawnProofCommand(rootPath, command, timeoutMs) {
+    return new Promise((resolve) => {
+        const [executable, ...args] = command;
+        let stdout = '';
+        let stderr = '';
+        let truncated = false;
+        let timedOut = false;
+        let finished = false;
+        let killTimer;
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+            killTimer = setTimeout(() => child.kill('SIGKILL'), 1_000);
+            killTimer.unref();
+        }, timeoutMs);
+        timeout.unref();
+        const child = spawn(executable, args, {
+            cwd: rootPath,
+            env: process.env,
+            shell: false,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const finish = (exitCode, errorMessage) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timeout);
+            if (killTimer)
+                clearTimeout(killTimer);
+            resolve({
+                exitCode: timedOut ? PROOF_RUN_TIMEOUT_EXIT_CODE : exitCode,
+                stdout,
+                stderr,
+                ...(errorMessage ? { errorMessage } : {}),
+                timedOut,
+                truncated,
+            });
+        };
+        child.stdout?.on('data', (chunk) => {
+            const next = appendBoundedOutput(stdout, chunk);
+            stdout = next.value;
+            truncated ||= next.truncated;
+        });
+        child.stderr?.on('data', (chunk) => {
+            const next = appendBoundedOutput(stderr, chunk);
+            stderr = next.value;
+            truncated ||= next.truncated;
+        });
+        child.on('error', (error) => {
+            finish(COMMAND_NOT_FOUND_EXIT_CODE, error instanceof Error ? error.message : String(error));
+        });
+        child.on('close', (code, signal) => {
+            if (code === null) {
+                finish(signal ? 1 : 0);
+                return;
+            }
+            finish(code);
+        });
+    });
+}
+function appendBoundedOutput(current, chunk) {
+    const text = chunk.toString('utf-8');
+    const remaining = MAX_PROOF_RUN_OUTPUT_CHARS - current.length;
+    if (remaining <= 0)
+        return { value: current, truncated: text.length > 0 };
+    if (text.length > remaining) {
+        return { value: current + text.slice(0, remaining), truncated: true };
+    }
+    return { value: current + text, truncated: false };
+}
+function proofRunOutputSummary(result, timeoutMs) {
+    const parts = [
+        result.timedOut ? `timed out after ${timeoutMs}ms` : undefined,
+        result.errorMessage ? `start error: ${result.errorMessage}` : undefined,
+        result.stdout.trim() ? `stdout: ${result.stdout.trim()}` : undefined,
+        result.stderr.trim() ? `stderr: ${result.stderr.trim()}` : undefined,
+        result.truncated ? 'output truncated' : undefined,
+    ].filter((part) => Boolean(part));
+    return parts.join(' | ');
+}
+async function writeProofRunLog(rootPath, input) {
+    const relativePath = proofRunLogPath(input.command);
+    const fullPath = path.resolve(rootPath, relativePath);
+    const root = path.resolve(rootPath);
+    const relativeToRoot = path.relative(root, fullPath);
+    if (!relativeToRoot || relativeToRoot.startsWith('..') || path.isAbsolute(relativeToRoot)) {
+        throw new Error('Proof log path must stay inside the project root.');
+    }
+    await fs.mkdir(path.dirname(fullPath), { recursive: true });
+    await fs.writeFile(fullPath, redactedProofRunLog(input), 'utf-8');
+    return relativePath;
+}
+function proofRunLogPath(command) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const digest = crypto.createHash('sha256').update(command).digest('hex').slice(0, 10);
+    return `.projscan/proof-logs/prove-run-${stamp}-${digest}.log`;
+}
+function redactedProofRunLog(input) {
+    const raw = [
+        `command: ${input.command}`,
+        `exitCode: ${input.exitCode}`,
+        `durationMs: ${input.durationMs}`,
+        `timedOut: ${input.timedOut ? 'yes' : 'no'}`,
+        `truncated: ${input.truncated ? 'yes' : 'no'}`,
+        input.errorMessage ? `error: ${input.errorMessage}` : undefined,
+        '--- stdout ---',
+        input.stdout || '(empty)',
+        '--- stderr ---',
+        input.stderr || '(empty)',
+    ]
+        .filter((line) => typeof line === 'string')
+        .join('\n');
+    const redacted = redactProofOutput(raw);
+    return `${truncateText(redacted, MAX_PROOF_RUN_LOG_CHARS)}\n`;
+}
+function truncateText(value, maxLength) {
+    if (value.length <= maxLength)
+        return value;
+    return `${value.slice(0, maxLength - 24)}\n[projscan log truncated]\n`;
+}
 function isNonNegativeFiniteNumber(value) {
     return typeof value === 'number' && Number.isFinite(value) && value >= 0;
 }
@@ -163,6 +365,7 @@ async function computeIntentProof(rootPath, options) {
         contract,
         commands: contract.proofCommands,
         warnings: simulation.warnings,
+        verifiedWorkflow: contract.verifiedWorkflow,
         ...(savedContractPath ? { savedContractPath } : {}),
     };
 }
@@ -193,6 +396,7 @@ async function computeChangedProof(rootPath, options) {
         receipt,
         commands: receipt.proofStatus.commandsRequired,
         warnings: receipt.evidenceGaps,
+        verifiedWorkflow: receipt.verifiedWorkflow,
     };
 }
 function quickProofPreflight(changedFiles) {
@@ -225,7 +429,7 @@ function buildContract(input) {
         ...(input.trustMemory?.gaps ?? []),
     ]);
     const confidence = confidenceForTrustMemory(input.simulation.confidence, input.trustMemory);
-    return {
+    const contract = {
         schemaVersion: 1,
         id: `proof-contract-${slug(input.intent)}`,
         intent: input.intent,
@@ -255,6 +459,10 @@ function buildContract(input) {
         receiptCommand: `projscan prove --changed --contract ${quoteShellArg(DEFAULT_CONTRACT_PATH)} --format markdown`,
         riskDelta: input.simulation.riskDelta,
     };
+    return {
+        ...contract,
+        verifiedWorkflow: verifiedWorkflowForContract(contract),
+    };
 }
 function contractProofCommands(simulationCommands) {
     return unique([
@@ -286,7 +494,7 @@ function buildReceipt(input) {
         scope,
         preflightVerdict: input.preflightVerdict,
     });
-    return {
+    const receipt = {
         summary: summaryForReceipt(commitReadiness, scope),
         commitReadiness,
         scope,
@@ -298,6 +506,95 @@ function buildReceipt(input) {
         evidenceGaps,
         reviewerGuidance: reviewerGuidanceFor(commitReadiness, scope, reviewerDecision, proofStatus.status),
     };
+    return {
+        ...receipt,
+        verifiedWorkflow: verifiedWorkflowForReceipt(receipt),
+    };
+}
+function verifiedWorkflowForContract(contract) {
+    return {
+        phase: 'contract',
+        status: intentVerdict(contract),
+        nextAction: 'save the Proof Contract, make the bounded edit, then record proof commands',
+        nextCommand: contract.receiptCommand,
+        staleProof: false,
+        missingProof: contract.proofCommands.length > 0,
+        failedProof: false,
+    };
+}
+function verifiedWorkflowForRecord(verdict, recordStatus) {
+    const failedProof = recordStatus === 'failed';
+    return {
+        phase: 'record',
+        status: verdict,
+        nextAction: failedProof
+            ? 'fix the failed proof command, record it again, then replay changed proof'
+            : 'run projscan prove --changed to replay the ledger against the current diff',
+        nextCommand: 'projscan prove --changed --format markdown',
+        staleProof: false,
+        missingProof: false,
+        failedProof,
+    };
+}
+function verifiedWorkflowForReceipt(receipt) {
+    const proofStatus = receipt.proofStatus.status;
+    const staleProof = proofStatus === 'stale' || receipt.proofStatus.staleCommands.length > 0;
+    const missingProof = proofStatus === 'missing' ||
+        proofStatus === 'partial' ||
+        receipt.proofStatus.missingCommands.length > 0;
+    const failedProof = proofStatus === 'failed' || receipt.proofStatus.failedCommands.length > 0;
+    return {
+        phase: 'receipt',
+        status: receipt.commitReadiness,
+        nextAction: nextActionForReceipt({
+            receipt,
+            staleProof,
+            missingProof,
+            failedProof,
+        }),
+        nextCommand: nextCommandForReceipt({
+            receipt,
+            staleProof,
+            missingProof,
+            failedProof,
+        }),
+        reviewerDecision: receipt.reviewerDecision,
+        scopeStatus: receipt.scope.status,
+        proofStatus,
+        riskDeltaDirection: receipt.riskDeltaDirection,
+        staleProof,
+        missingProof,
+        failedProof,
+    };
+}
+function nextActionForReceipt(input) {
+    if (input.failedProof)
+        return 'fix failed proof commands before review';
+    if (input.staleProof)
+        return 'rerun stale proof commands before review';
+    if (input.missingProof)
+        return 'record missing proof commands before review';
+    if (input.receipt.scope.status === 'drifted') {
+        return 'resolve scope drift or update the Proof Contract before review';
+    }
+    if (input.receipt.reviewerDecision === 'safe-to-review') {
+        return 'share the Proof Receipt with the reviewer';
+    }
+    return 'review focused scope and proof gaps before approval';
+}
+function nextCommandForReceipt(input) {
+    if (input.failedProof) {
+        return `projscan prove --record-command ${quoteShellArg(input.receipt.proofStatus.failedCommands[0] ?? '<command>')} --exit-code 0 --duration-ms <ms>`;
+    }
+    if (input.staleProof) {
+        return `projscan prove --record-command ${quoteShellArg(input.receipt.proofStatus.staleCommands[0] ?? '<command>')} --exit-code 0 --duration-ms <ms>`;
+    }
+    if (input.missingProof) {
+        return 'projscan prove --record-command "<command>" --exit-code 0 --duration-ms <ms>';
+    }
+    if (input.receipt.scope.status === 'drifted')
+        return 'projscan prove --changed --format markdown';
+    return 'projscan evidence-pack --pr-comment';
 }
 function proofStatusFor(proofCommands, ledger, changedFiles) {
     const relevantChangedFiles = proofRelevantChangedFiles(changedFiles);
@@ -401,7 +698,7 @@ function scopeFor(contract, contractPath, changedFiles) {
     ]);
     const forbiddenTouched = changedFiles.filter((file) => contract.forbiddenFiles.some((pattern) => pathMatches(file, pattern)));
     const allowedTouched = changedFiles.filter((file) => allowed.has(file));
-    const outsideAllowed = changedFiles.filter((file) => !allowed.has(file));
+    const outsideAllowed = changedFiles.filter((file) => !allowed.has(file) && !isLocalProofArtifactPath(file));
     const classifications = changedFiles.map((file) => classifyChangedFile({
         file,
         forbidden: forbiddenTouched.includes(file),
@@ -772,6 +1069,9 @@ function isGeneratedPath(file) {
         file.startsWith('coverage/') ||
         file.startsWith('dist/'));
 }
+function isLocalProofArtifactPath(file) {
+    return file.startsWith('.projscan/');
+}
 function isSecuritySensitivePath(file) {
     return (file === '.env' ||
         file.startsWith('.env.') ||