rigorrun 0.1.0 → 0.2.0

package/dist/rigorrun.mjs

@@ -61,7 +61,7 @@ async function writeText(path, text2) {
 }
 
 // src/help.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 var HELP = `RigorRun ${VERSION} - acceptance testing for tool-using AI agents.
 
 Connect your system. Show RigorRun how one job is done. Connect your agent.
@@ -73,6 +73,15 @@ USAGE
                            where you connect a system, teach a job and watch a
                            run. Everything below is for scripts and CI.
 
+VERIFY A SERVER
+  verify <server-ref>      Run an MCP server's tools in a container RigorRun
+                           controls, and report what each one actually does
+                           against what the server says it does. Needs no
+                           project, no agent and no browser.
+
+                             rigorrun verify npm:<package>@<version>
+                             rigorrun verify dir:<path>
+
 PROJECTS
   projects                 List the projects on this machine.
   run --project <id>       Run the project's suite against its agent.
@@ -140,10 +149,19 @@ RUN / GATE OPTIONS
 COMPARE OPTIONS
       --baseline <runId>        Compare against this instead of the baseline.
 
+VERIFY OPTIONS
+      --max-undetermined <n>    Undetermined findings tolerated. Default 0.
+      --min-exercised <n>       Tools that must have been exercised. Default 1.
+      --strict                  Treat minor contradictions as failures too.
+  -o, --out <file>              Where to write the record.
+      --json                    Print the record and nothing else.
+
 EXIT CODES
   0  success, or the gate passed
-  1  the benchmark failed, or the gate was not met
+  1  the benchmark failed, the gate was not met, or a declaration was
+     contradicted by what the server was observed to do
   2  configuration or runtime error
+  3  verify only: it ran, but established too little to be worth much
 
 EXAMPLES
   rigorrun                                     start here
@@ -152,13 +170,48 @@ EXAMPLES
   rigorrun gate --project p_1a2b3c --min-success 0.95
   rigorrun compare-runs --project p_1a2b3c run_9f8e7d
 
+  rigorrun verify npm:@modelcontextprotocol/server-memory@2026.8.31
+
   rigorrun demo                                the bundled example
-  rigorrun gate examples/refund-workflow/benchmark.json --agent reference
+  rigorrun run examples/refund-workflow/benchmark.json --agent naive
 
 Your systems, your credentials and your recordings stay on this machine. There
 is no account, and nothing is uploaded unless you ask for it.
 `;
 var COMMAND_HELP = {
+  verify: `rigorrun verify <server-ref> - find out what a server's tools do
+
+Fetches the server, pins it to the exact bytes the registry published, runs it
+in a container with no network and no access to this machine, calls each tool
+with arguments derived from its own schema, and reads the container's
+filesystem before and after to see what actually changed.
+
+Then it compares that against what the server declared. A tool annotated
+readOnlyHint: true that writes is reported CONTRADICTED, because that
+annotation decides whether an agent may call it without asking.
+
+Nothing it could not establish is reported as a fact. A tool it could not
+exercise safely is listed, with the reason.
+
+REFERENCES
+  npm:<package>@<version>   A published server. Pinned by the registry's digest.
+  dir:<path>                A server on this machine.
+
+OPTIONS
+      --max-undetermined <n>  Undetermined findings tolerated. Default 0.
+      --min-exercised <n>     Tools that must have been exercised. Default 1.
+      --strict                Treat minor contradictions as failures too.
+  -o, --out <file>            Where to write the record.
+      --json                  Print the record to stdout and nothing else.
+
+EXIT CODES
+  0  nothing contradicted
+  1  a declaration was contradicted
+  2  the verification could not be run at all
+  3  it ran, but established too little to be worth much
+
+REQUIRES
+  A container runtime. Run \`rigorrun doctor\` to see whether you have one.`,
   demo: `rigorrun demo - run the complete offline demo
 
 Compiles the bundled recorded refund workflow into a contract, generates the
@@ -179,6 +232,9 @@ configuration error.
 
 OPTIONS
       --agent <id>                  Required. The agent to gate.
+      --allow-reference             Permit --agent reference. It is handed the
+                                    answer, so the gate passes by construction
+                                    and measures the suite, not an agent.
       --min-success <0..1>          Default 0.95
       --min-policy <0..1>           Default 1
       --max-policy-violations <n>   Default 0
@@ -192,6 +248,12 @@ Starts a loopback-only HTTP listener that accepts a single sanitised workflow
 trace from the RigorRun recorder extension and writes it to disk. Nothing is
 sent anywhere; the listener stops as soon as a trace arrives.
 
+The trace it writes is a record of what happened in a page. It is not a
+contract, and "rigorrun compile" cannot read it \u2014 compiling needs the state
+your system held before and after the job, and a browser recording of an
+uninstrumented application does not carry that. To build a suite, connect the
+system through the interface and do the job there.
+
 OPTIONS
       --port <n>     Port to listen on. Default 8787.
   -o, --out <path>   Where to write the trace. Default .rigorrun/traces/<id>.json
@@ -272,6 +334,7 @@ var CANONICAL_TRACE_SCHEMA_VERSION = 1;
 var ENVIRONMENT_CONTRACT_SCHEMA_VERSION = 1;
 var BENCHMARK_SCHEMA_VERSION = 1;
 var RUN_SCHEMA_VERSION = 1;
+var RECORD_SCHEMA_VERSION = 1;
 
 // ../core/src/hash.ts
 function canonicalJson(value) {
@@ -286,9 +349,9 @@ function canonicalise(value) {
   const source = value;
   const out = {};
   for (const key of Object.keys(source).sort()) {
-    const entry = source[key];
-    if (entry === void 0) continue;
-    out[key] = canonicalise(entry);
+    const entry2 = source[key];
+    if (entry2 === void 0) continue;
+    out[key] = canonicalise(entry2);
   }
   return out;
 }
@@ -300,6 +363,14 @@ async function sha256(input) {
   const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
   return toHex(digest);
 }
+async function sha512Base64(bytes) {
+  const buffer = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(buffer).set(bytes);
+  const digest = await globalThis.crypto.subtle.digest("SHA-512", buffer);
+  let binary = "";
+  for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
 async function hashValue(value) {
   return `sha256:${await sha256(canonicalJson(value))}`;
 }
@@ -340,7 +411,14 @@ var ASSERTION_KINDS = [
 var AssertionKindSchema = z.enum(ASSERTION_KINDS);
 var EvaluatorSchema = z.enum(["deterministic", "model_judged", "human_review"]);
 var AssertionSeveritySchema = z.enum(["success", "policy", "invariant"]);
-var VERIFICATION_SOURCES = ["STATE", "EVENT", "OUTPUT", "HUMAN", "MODEL"];
+var VERIFICATION_SOURCES = [
+  "STATE",
+  "EVENT",
+  "OUTPUT",
+  "HUMAN",
+  "MODEL",
+  "DECLARED"
+];
 var VerificationSourceSchema = z.enum(VERIFICATION_SOURCES);
 var FAILURE_SEVERITIES = ["INFO", "MINOR", "MAJOR", "CRITICAL"];
 var FailureSeveritySchema = z.enum(FAILURE_SEVERITIES);
@@ -656,13 +734,13 @@ function surfaceText(trace) {
 // ../core/src/traceNormalize.ts
 var DEFAULT_ACTOR = { id: "operator", kind: "human", label: "Operator" };
 function fromActionLog(entries, options) {
-  const steps = entries.map((entry, index) => ({
+  const steps = entries.map((entry2, index) => ({
     id: `step_${String(index + 1).padStart(3, "0")}`,
     ordinal: index,
-    at: entry.at,
+    at: entry2.at,
     kind: "action",
-    action: { name: entry.action, args: entry.args ?? {}, ok: entry.ok ?? true },
-    surfaceText: entry.surfaceText ?? []
+    action: { name: entry2.action, args: entry2.args ?? {}, ok: entry2.ok ?? true },
+    surfaceText: entry2.surfaceText ?? []
   }));
   const last = entries[entries.length - 1];
   return finalise(
@@ -1214,7 +1292,7 @@ var AgentScoreSchema = z7.object({
   failedThresholds: z7.array(z7.string()).default([])
 });
 var VERIFICATION_STRENGTHS = ["AUTHORITATIVE", "PARTIAL", "OBSERVATIONAL"];
-var ISOLATION_LEVELS = ["RESET", "NONE"];
+var ISOLATION_LEVELS = ["RESET", "PARTIAL", "DECLARED", "NONE"];
 var RunLimitSchema = z7.object({
   id: z7.string(),
   limit: z7.string(),
@@ -1258,6 +1336,179 @@ var RunResultSchema = z7.object({
   rigorrunVersion: z7.string().default("0.1.0")
 });
 
+// ../core/src/record.ts
+import { z as z8 } from "zod";
+var VERIFICATION_RECORD_SCHEMA = "rigorrun.record/1";
+var TARGET_SCHEMES = ["npm", "dir"];
+var TargetSchemeSchema = z8.enum(TARGET_SCHEMES);
+var TargetSchema = z8.object({
+  /** Exactly what the operator typed, kept verbatim. */
+  ref: z8.string().min(1),
+  scheme: TargetSchemeSchema,
+  /** The version actually used. Never a tag, never a range. */
+  resolvedVersion: z8.string(),
+  /** `sha512-<base64>` from the registry, or `dirhash:sha256:<hex>`. */
+  digest: z8.string().min(1),
+  /**
+   * The whole installed dependency closure, hashed.
+   *
+   * `digest` covers the package. This covers everything that got installed
+   * with it, which is what changes when a transitive dependency moves and the
+   * package version does not.
+   */
+  treeDigest: z8.string().default(""),
+  tarballUrl: z8.string().default(""),
+  fetchedAt: z8.string()
+});
+var IsolationProofSchema = z8.object({
+  resets: z8.number().int().nonnegative(),
+  /** The state digest after each independent reset. Recomputable by a reader. */
+  initialDigests: z8.array(z8.string()),
+  /** Paths that came back with different contents each time. */
+  unstablePaths: z8.array(z8.string()).default([])
+});
+var HarnessSchema = z8.object({
+  version: z8.string(),
+  /** e.g. `docker 28.5.2`. Which engine actually ran this. */
+  runtime: z8.string(),
+  /** Whether that engine's daemon runs as root, because it changes the boundary. */
+  rootless: z8.boolean(),
+  /** The base image, pinned by digest. A tag is not a baseline. */
+  baseImage: z8.string(),
+  imageId: z8.string().default(""),
+  isolation: z8.enum(ISOLATION_LEVELS).default("NONE"),
+  isolationProof: IsolationProofSchema,
+  /** False for every run this harness performs. Opt-in egress is recorded here. */
+  networkEgress: z8.boolean(),
+  /** Whether the read-only posture held: the container layer stayed empty. */
+  readonlyVerified: z8.boolean(),
+  /** Whether the target's own install scripts ever ran, and where. */
+  installScripts: z8.enum(["skipped", "ran-in-sandbox"]),
+  limits: z8.object({
+    pids: z8.number().int().positive(),
+    memoryMb: z8.number().int().positive(),
+    cpus: z8.number().positive()
+  }),
+  /** The literal argv, so a reader can check the posture rather than trust it. */
+  runArgv: z8.array(z8.string()).default([]),
+  seed: z8.string(),
+  /** What this run does not prove. Required, and required non-empty. */
+  caveats: z8.array(z8.string()).min(1)
+});
+var DeclaredSchema = z8.object({
+  readOnlyHint: z8.boolean().optional(),
+  destructiveHint: z8.boolean().optional(),
+  idempotentHint: z8.boolean().optional(),
+  openWorldHint: z8.boolean().optional()
+});
+var STATE_SURFACES = [
+  "container_fs",
+  "server_reads",
+  "process_table",
+  "container_diff"
+];
+var StateSurfaceSchema = z8.enum(STATE_SURFACES);
+var ObservedSchema = z8.object({
+  /** Undetermined is a third answer, and is never collapsed into `false`. */
+  mutatesState: z8.enum(["yes", "no", "undetermined"]),
+  surfacesTouched: z8.array(StateSurfaceSchema).default([]),
+  /** Paths created, modified or removed inside the container. */
+  wrote: z8.array(z8.string()).default([]),
+  sideEffects: z8.array(z8.string()).default([]),
+  idempotent: z8.enum(["yes", "no", "not-probed"]),
+  errorBehavior: z8.array(z8.string()).default([])
+});
+var CONFORMANCE_VERDICTS = ["CONFORMS", "CONTRADICTED", "UNDETERMINED"];
+var ConformanceVerdictSchema = z8.enum(CONFORMANCE_VERDICTS);
+var ConformanceSchema = z8.object({
+  /** The claim being checked, as the server phrased it: `readOnlyHint: true`. */
+  claim: z8.string(),
+  verdict: ConformanceVerdictSchema,
+  severity: z8.enum(FAILURE_SEVERITIES),
+  /**
+   * Whether contradicting this claim changes what an agent is allowed to do
+   * without asking. `readOnlyHint` and `destructiveHint` drive automatic
+   * permissioning in at least one major client, so a tool that declares itself
+   * read-only and writes is a permission bypass rather than a documentation
+   * defect, and the record says which it is.
+   */
+  permissionRelevant: z8.boolean().default(false),
+  /** One sentence a person can read without the rest of the record. */
+  because: z8.string(),
+  /** The surface that produced the observation behind this verdict. */
+  surface: StateSurfaceSchema.optional(),
+  /** The case that proves it. Every fact points at a run. */
+  evidenceRef: z8.string().default("")
+});
+var ToolRecordSchema = z8.object({
+  name: z8.string(),
+  description: z8.string().default(""),
+  declared: DeclaredSchema,
+  observed: ObservedSchema,
+  conformance: z8.array(ConformanceSchema).default([]),
+  verification: z8.enum(VERIFICATION_STRENGTHS)
+});
+var UNTESTED_REASONS = [
+  "NEEDS_FIXTURE",
+  "NEEDS_CREDENTIAL",
+  "UNSAFE_TO_EXERCISE",
+  "UNDETERMINED"
+];
+var UntestedReasonSchema = z8.enum(UNTESTED_REASONS);
+var UntestedSchema = z8.object({
+  tool: z8.string(),
+  reason: UntestedReasonSchema,
+  detail: z8.string()
+});
+var CaseRecordSchema = z8.object({
+  id: z8.string(),
+  tool: z8.string(),
+  args: z8.record(z8.string(), z8.unknown()).default({}),
+  /** How each argument was chosen, so a reader can reproduce the plan. */
+  derivation: z8.array(z8.string()).default([]),
+  ok: z8.boolean(),
+  isError: z8.boolean().default(false),
+  errorText: z8.string().default(""),
+  beforeDigest: z8.string().default(""),
+  afterDigest: z8.string().default(""),
+  changedPaths: z8.array(z8.string()).default([]),
+  durationMs: z8.number().nonnegative().default(0),
+  stderrExcerpt: z8.string().default("")
+});
+var VerificationRecordSchema = z8.object({
+  schema: z8.literal(VERIFICATION_RECORD_SCHEMA),
+  schemaVersion: z8.literal(RECORD_SCHEMA_VERSION),
+  recordId: z8.string(),
+  target: TargetSchema,
+  harness: HarnessSchema,
+  server: z8.object({
+    name: z8.string().default(""),
+    version: z8.string().default(""),
+    protocolVersion: z8.string().default("")
+  }),
+  tools: z8.array(ToolRecordSchema).default([]),
+  /** Required. Present and empty means "everything was tested", and is a claim. */
+  untested: z8.array(UntestedSchema),
+  cases: z8.array(CaseRecordSchema).default([]),
+  summary: z8.object({
+    toolsDiscovered: z8.number().int().nonnegative(),
+    toolsExercised: z8.number().int().nonnegative(),
+    conforms: z8.number().int().nonnegative(),
+    contradicted: z8.number().int().nonnegative(),
+    undetermined: z8.number().int().nonnegative(),
+    untested: z8.number().int().nonnegative()
+  }),
+  startedAt: z8.string(),
+  finishedAt: z8.string(),
+  /** Over the record with this field set to ''. Recomputable from the file. */
+  recordHash: z8.string().default("")
+});
+var ROOTFUL_DAEMON_CAVEAT = "The container runtime daemon runs as root. RigorRun reduces blast radius but does not claim to prevent a container escape; an escape reaches the host.";
+var SERVER_READS_CAVEAT = "Where a state reading came only from the server\u2019s own tools, it is corroboration and not proof: the server that may be misdeclaring a tool is the one answering the read.";
+
+// ../core/src/index.ts
+var RIGORRUN_VERSION = "0.2.0";
+
 // ../environment/src/schema.ts
 function validateSchema(schema6) {
   const problems = [];
@@ -1340,13 +1591,13 @@ function validateSchema(schema6) {
         });
       }
     } else {
-      const join13 = byName.get(relationship.via.entity);
-      if (!join13) {
+      const join15 = byName.get(relationship.via.entity);
+      if (!join15) {
         problems.push({ path, message: `unknown join entity ${relationship.via.entity}` });
       } else {
         for (const field of [relationship.via.fromField, relationship.via.toField]) {
-          if (!join13.fields.some((f) => f.name === field)) {
-            problems.push({ path, message: `join field "${field}" is not a field of ${join13.name}` });
+          if (!join15.fields.some((f) => f.name === field)) {
+            problems.push({ path, message: `join field "${field}" is not a field of ${join15.name}` });
           }
         }
       }
@@ -1457,8 +1708,11 @@ function verificationStrength(caps) {
   if (caps.stateRead === "designated-reads") return "PARTIAL";
   return "OBSERVATIONAL";
 }
-function isolationLevel(caps) {
-  return caps.reset === "none" ? "NONE" : "RESET";
+var RESET_WE_CONTROL = /* @__PURE__ */ new Set(["snapshot", "container"]);
+function isolationLevel(caps, observed) {
+  if (caps.reset === "none") return "NONE";
+  if (observed) return observed.stable ? "RESET" : observed.pathsStable ? "PARTIAL" : "NONE";
+  return RESET_WE_CONTROL.has(caps.reset) ? "RESET" : "DECLARED";
 }
 function mayRepeatMutatingCases(caps) {
   return caps.reset !== "none";
@@ -2074,7 +2328,7 @@ function countViaJoin(state, relationship, row, entity2) {
   if (relationship.via.kind !== "join") return 0;
   const { entity: joinEntity, fromField } = relationship.via;
   const id2 = String(row[entity2.idField]);
-  return rowsOf(state, joinEntity).filter((join13) => String(join13[fromField]) === id2).length;
+  return rowsOf(state, joinEntity).filter((join15) => String(join15[fromField]) === id2).length;
 }
 function bucketise(entity2, rows6) {
   const by = {};
@@ -2528,7 +2782,7 @@ function pathAgreement(context) {
 function thresholdGuard(context) {
   const rules = [];
   const allQuantities = quantityPaths(context);
-  const ownQuantities = allQuantities.filter((entry) => !entry.path.includes("__"));
+  const ownQuantities = allQuantities.filter((entry2) => !entry2.path.includes("__"));
   const quantities = ownQuantities.length > 0 ? ownQuantities : allQuantities;
   if (quantities.length === 0 || context.statedNumbers.length === 0) return rules;
   const relationGuards = guardCandidates(context);
@@ -3164,27 +3418,27 @@ function readStatedNumbers(trace, schema6) {
   const qualifier = /(approv|authoris|authoriz|sign.?off|review|escalat|permit|manager|supervisor)/i;
   const declared = schema6.entities.flatMap((entity2) => entity2.fields.flatMap((field) => field.enumValues ?? [])).filter((value) => value.length > 3);
   const found = [];
-  for (const entry of sentences(trace)) {
-    const relevant = qualifier.test(entry.text) || declared.some((value) => entry.text.toLowerCase().includes(value.toLowerCase()));
+  for (const entry2 of sentences(trace)) {
+    const relevant = qualifier.test(entry2.text) || declared.some((value) => entry2.text.toLowerCase().includes(value.toLowerCase()));
     if (!relevant) continue;
-    for (const match of entry.text.matchAll(pattern)) {
+    for (const match of entry2.text.matchAll(pattern)) {
       const raw = match[1];
       if (!raw) continue;
       const value = Number(raw.replace(/,/g, ""));
       if (!Number.isFinite(value)) continue;
-      found.push({ value, text: entry.text, stepId: entry.stepId });
+      found.push({ value, text: entry2.text, stepId: entry2.stepId });
     }
   }
   const seen = /* @__PURE__ */ new Set();
-  return found.filter((entry) => {
-    if (seen.has(entry.value)) return false;
-    seen.add(entry.value);
+  return found.filter((entry2) => {
+    if (seen.has(entry2.value)) return false;
+    seen.add(entry2.value);
     return true;
   });
 }
 function sentences(trace) {
   return surfaceText(trace).flatMap(
-    (entry) => entry.text.split(/(?<=[.!?])\s+/).map((text2) => text2.trim()).filter((text2) => text2.length > 0).map((text2) => ({ text: text2, stepId: entry.stepId }))
+    (entry2) => entry2.text.split(/(?<=[.!?])\s+/).map((text2) => text2.trim()).filter((text2) => text2.length > 0).map((text2) => ({ text: text2, stepId: entry2.stepId }))
   );
 }
 function unitMatchesText(unit, text2) {
@@ -4342,7 +4596,7 @@ function resolvePath(root, path) {
       continue;
     }
     if (!Array.isArray(current)) return NOT_FOUND;
-    current = current.filter((entry) => matchesAll(entry, segment.conditions));
+    current = current.filter((entry2) => matchesAll(entry2, segment.conditions));
     afterFilter = true;
   }
   return { found: current !== void 0, value: current };
@@ -4393,12 +4647,12 @@ function parseLiteral(raw) {
   if (raw !== "" && !Number.isNaN(Number(raw))) return Number(raw);
   return trimmed;
 }
-function matchesAll(entry, conditions) {
-  if (entry === null || typeof entry !== "object") return false;
-  return conditions.every((condition) => matches(entry, condition));
+function matchesAll(entry2, conditions) {
+  if (entry2 === null || typeof entry2 !== "object") return false;
+  return conditions.every((condition) => matches(entry2, condition));
 }
-function matches(entry, condition) {
-  const actual = resolvePath(entry, condition.field).value;
+function matches(entry2, condition) {
+  const actual = resolvePath(entry2, condition.field).value;
   switch (condition.op) {
     case "=":
       return looseEquals(actual, condition.value);
@@ -4575,7 +4829,7 @@ function containment(kind, target, expected, observation) {
   if (typeof value === "string" && typeof expected === "string") {
     contains = value.includes(expected);
   } else if (Array.isArray(value)) {
-    contains = value.some((entry) => deepEqual2(entry, expected));
+    contains = value.some((entry2) => deepEqual2(entry2, expected));
   } else if (value !== null && value !== void 0) {
     contains = JSON.stringify(value).includes(String(expected));
   }
@@ -4654,7 +4908,7 @@ function deepEqual2(a, b) {
   if (typeof a !== "object") return false;
   if (Array.isArray(a) !== Array.isArray(b)) return false;
   if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((entry, i) => deepEqual2(entry, b[i]));
+    return a.length === b.length && a.every((entry2, i) => deepEqual2(entry2, b[i]));
   }
   const aKeys = Object.keys(a).sort();
   const bKeys = Object.keys(b).sort();
@@ -4910,7 +5164,7 @@ async function findUntestableRules(adapter, contract, mutations, rules) {
 }
 function markUntestable(contract, untestable) {
   if (untestable.length === 0) return contract;
-  const byId = new Map(untestable.map((entry) => [entry.ruleId, entry.reason]));
+  const byId = new Map(untestable.map((entry2) => [entry2.ruleId, entry2.reason]));
   return {
     ...contract,
     rules: contract.rules.map((rule) => {
@@ -4975,9 +5229,9 @@ async function generateBenchmark(adapter, contract, fixtures, options = {}) {
   }
   const contractHash = await hashValue(contract);
   const createdAt = options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const cases = generated.map((entry) => entry.testCase);
+  const cases = generated.map((entry2) => entry2.testCase);
   const notTestable = [
-    ...untestable.map((entry) => ({ rule: entry.statement, reason: entry.reason })),
+    ...untestable.map((entry2) => ({ rule: entry2.statement, reason: entry2.reason })),
     ...[...uninstallable].map(([primitive, reason]) => ({ rule: primitive, reason })),
     ...capabilityGaps(adapter)
   ];
@@ -7434,23 +7688,23 @@ function createLlmAgent(config) {
 }
 
 // ../agents/src/http.ts
-import { z as z8 } from "zod";
-var ResponseSchema = z8.union([
-  z8.object({
-    action: z8.object({
-      tool: z8.string().min(1),
-      args: z8.record(z8.string(), z8.unknown()).default({})
+import { z as z9 } from "zod";
+var ResponseSchema = z9.union([
+  z9.object({
+    action: z9.object({
+      tool: z9.string().min(1),
+      args: z9.record(z9.string(), z9.unknown()).default({})
     }),
-    note: z8.string().max(2e3).optional()
+    note: z9.string().max(2e3).optional()
   }),
-  z8.object({
-    done: z8.literal(true),
-    report: z8.string().max(8e3),
-    usage: z8.object({
-      promptTokens: z8.number().int().nonnegative(),
-      completionTokens: z8.number().int().nonnegative()
+  z9.object({
+    done: z9.literal(true),
+    report: z9.string().max(8e3),
+    usage: z9.object({
+      promptTokens: z9.number().int().nonnegative(),
+      completionTokens: z9.number().int().nonnegative()
     }).optional(),
-    costUsd: z8.number().nullable().optional()
+    costUsd: z9.number().nullable().optional()
   })
 ]);
 var MAX_RESPONSE_BYTES = 256 * 1024;
@@ -7696,13 +7950,13 @@ function resolveAgent(id2, options = {}) {
 }
 
 // ../scoring/src/stats.ts
-function wilsonInterval(successes, n, z11 = 1.96) {
+function wilsonInterval(successes, n, z12 = 1.96) {
   if (n <= 0) return { point: 0, lower: 0, upper: 1, n: 0 };
   const p = successes / n;
-  const z22 = z11 * z11;
+  const z22 = z12 * z12;
   const denominator = 1 + z22 / n;
   const centre = (p + z22 / (2 * n)) / denominator;
-  const margin = z11 / denominator * Math.sqrt(p * (1 - p) / n + z22 / (4 * n * n));
+  const margin = z12 / denominator * Math.sqrt(p * (1 - p) / n + z22 / (4 * n * n));
   return {
     point: round4(p),
     lower: round4(Math.max(0, centre - margin)),
@@ -7760,10 +8014,10 @@ function scoreAgent(agent, results, thresholds) {
   const errorCount = results.filter((r) => r.errored).length;
   const byCase = /* @__PURE__ */ new Map();
   for (const result of results) {
-    const entry = byCase.get(result.caseId) ?? { total: 0, successes: 0 };
-    entry.total += 1;
-    if (result.taskSuccess) entry.successes += 1;
-    byCase.set(result.caseId, entry);
+    const entry2 = byCase.get(result.caseId) ?? { total: 0, successes: 0 };
+    entry2.total += 1;
+    if (result.taskSuccess) entry2.successes += 1;
+    byCase.set(result.caseId, entry2);
   }
   const attempts = [...byCase.values()];
   const passAt = {};
@@ -8313,8 +8567,8 @@ ${failures(data, mode)}
 ${contractSection(options.contract)}
 ${metadata(data, options, generatedAt, mode)}
 <footer>
-  RigorRun ${esc(data.rigorrunVersion)} \xB7 Acceptance testing for tool-using AI agents.<br>
-  ${esc(data.environment)} is a synthetic demo environment. Every record in it is fabricated.
+  RigorRun ${esc(data.rigorrunVersion)} \xB7 Acceptance testing for tool-using AI agents.${options.syntheticEnvironment ? `<br>
+  ${esc(data.environment)} is a synthetic demo environment. Every record in it is fabricated.` : ""}
 </footer>
 </div></body></html>`;
 }
@@ -8616,7 +8870,12 @@ async function cmdDemo(flags) {
   await writeJson(join(RUNS_DIR(), `${result.runId}.json`), result);
   await writeText(
     join(outDir, "report.html"),
-    renderReportHtml(result, { contract, benchmark, generatedAt: result.finishedAt })
+    renderReportHtml(result, {
+      contract,
+      benchmark,
+      generatedAt: result.finishedAt,
+      syntheticEnvironment: isBundledEnvironment(result.environment)
+    })
   );
   line();
   printComparison(result);
@@ -8757,10 +9016,10 @@ async function cmdGenerate(contractPath, flags) {
   );
   table(
     ["case", "category", "expected"],
-    generation.cases.map((entry) => [
-      entry.testCase.name,
-      entry.testCase.category,
-      entry.expected.shouldPerform ? "do the work" : `refuse \u2014 ${entry.expected.refusalReason}`
+    generation.cases.map((entry2) => [
+      entry2.testCase.name,
+      entry2.testCase.category,
+      entry2.expected.shouldPerform ? "do the work" : `refuse \u2014 ${entry2.expected.refusalReason}`
     ])
   );
   for (const conflict of generation.conflicts) {
@@ -8772,7 +9031,14 @@ async function cmdGenerate(contractPath, flags) {
 }
 async function cmdRun(benchmarkPath, flags) {
   const benchmark = await loadBenchmark(benchmarkPath);
-  const agents = agentsFor(benchmark, flags, [createReferenceAgent(benchmark)]);
+  if (flags.agent.length === 0) {
+    throw new CliError(
+      `run needs at least one --agent.
+  --agent naive --agent careful   the two bundled examples
+  --agent ${REFERENCE_AGENT_ID}              checks the suite is satisfiable, not that an agent is good`
+    );
+  }
+  const agents = agentsFor(benchmark, flags, []);
   const result = await executeRun(benchmark, agents, flags);
   await writeJson(join(".rigorrun", "runs", `${result.runId}.json`), result);
   if (flags.json) {
@@ -8783,7 +9049,13 @@ async function cmdRun(benchmarkPath, flags) {
     line(`${c.grey("run")}  .rigorrun/runs/${result.runId}.json`);
   }
   if (flags.report) {
-    const written = await writeText(flags.report, renderReportHtml(result, { benchmark }));
+    const written = await writeText(
+      flags.report,
+      renderReportHtml(result, {
+        benchmark,
+        syntheticEnvironment: isBundledEnvironment(result.environment)
+      })
+    );
     if (!flags.json) line(`${c.grey("report")}  ${written}`);
   }
   return result.scores.every((s) => s.thresholdsPassed) ? 0 : 1;
@@ -8793,6 +9065,16 @@ async function cmdGate(benchmarkPath, flags) {
   if (flags.agent.length !== 1) {
     throw new CliError("gate needs exactly one --agent.");
   }
+  if (flags.agent[0] === REFERENCE_AGENT_ID && !flags.allowReference) {
+    throw new CliError(
+      `gate refuses --agent ${REFERENCE_AGENT_ID}: it is handed the answer, so the gate passes by
+construction and tells you nothing about an agent.
+
+  rigorrun run <benchmark> --agent ${REFERENCE_AGENT_ID}     is the suite satisfiable?
+  rigorrun gate <benchmark> --agent ${REFERENCE_AGENT_ID} --allow-reference
+                                              same question, as a gate`
+    );
+  }
   const agent = agentsFor(benchmark, flags, [])[0];
   const gated = {
     ...benchmark,
@@ -8835,7 +9117,13 @@ async function cmdGate(benchmarkPath, flags) {
     for (const failure of score.failedThresholds) line(`  ${c.red("x")} ${failure}`);
   }
   if (flags.report) {
-    await writeText(flags.report, renderReportHtml(result, { benchmark: gated }));
+    await writeText(
+      flags.report,
+      renderReportHtml(result, {
+        benchmark: gated,
+        syntheticEnvironment: isBundledEnvironment(result.environment)
+      })
+    );
   }
   return score.thresholdsPassed ? 0 : 1;
 }
@@ -8844,7 +9132,8 @@ async function cmdReport(target, flags) {
   const path = target.endsWith(".json") ? target : join(".rigorrun", "runs", `${target}.json`);
   const run = await readJson(path);
   const html = renderReportHtml(flags.published ? sanitizeRunResult(run) : run, {
-    mode: flags.published ? "published" : "full"
+    mode: flags.published ? "published" : "full",
+    syntheticEnvironment: isBundledEnvironment(run.environment)
   });
   const out = flags.out ?? join(".rigorrun", `${run.runId}${flags.published ? ".published" : ""}.html`);
   const written = await writeText(out, html);
@@ -8950,6 +9239,9 @@ function agentsFor(benchmark, flags, fallback) {
     (id2) => id2 === REFERENCE_AGENT_ID ? createReferenceAgent(benchmark) : resolveAgentOrFail(id2)
   );
 }
+function isBundledEnvironment(environmentId) {
+  return WORKFLOWS.some((workflow) => workflow.registration.id === environmentId);
+}
 function resolveAgentOrFail(id2) {
   try {
     return resolveAgent(id2, { env: envFromProcess(process.env) });
@@ -9007,7 +9299,7 @@ async function cmdPrivacyInspect(action, target, json) {
   line(c.bold("Captured"));
   table(
     ["field", "times"],
-    report3.capturedFields.map((entry) => [entry.field, String(entry.count)])
+    report3.capturedFields.map((entry2) => [entry2.field, String(entry2.count)])
   );
   line();
   line(`${c.bold("Also captured")}  ${surfaceText2} text fragments the operator could see, ${uiFields} interface locators`);
@@ -9105,8 +9397,8 @@ function summarise2(events, project) {
   for (const event of mine) {
     if (event.attempt) attempts[event.attempt] = (attempts[event.attempt] ?? 0) + 1;
   }
-  const created = stages.find((entry) => entry.stage === "project_created");
-  const verdict2 = stages.find((entry) => entry.stage === "first_real_verdict");
+  const created = stages.find((entry2) => entry2.stage === "project_created");
+  const verdict2 = stages.find((entry2) => entry2.stage === "first_real_verdict");
   const furthest = [...stages].sort(
     (a, b) => ACTIVATION_STAGES.indexOf(b.stage) - ACTIVATION_STAGES.indexOf(a.stage)
   )[0];
@@ -9169,9 +9461,9 @@ async function sweepTemporaries(dir) {
     return 0;
   }
   let swept = 0;
-  for (const entry of entries) {
-    if (!/^\..*\.tmp-[0-9a-f]{12}$/.test(entry)) continue;
-    await rm(join3(dir, entry), { force: true });
+  for (const entry2 of entries) {
+    if (!/^\..*\.tmp-[0-9a-f]{12}$/.test(entry2)) continue;
+    await rm(join3(dir, entry2), { force: true });
     swept += 1;
   }
   return swept;
@@ -9223,7 +9515,7 @@ async function openWorkspace(root, version) {
     return { meta: meta2, created: true, applied: [] };
   }
   if (existing.version > WORKSPACE_VERSION) throw new WorkspaceTooNewError(existing.version);
-  const pending = MIGRATIONS.filter((entry) => entry.to > existing.version).sort(
+  const pending = MIGRATIONS.filter((entry2) => entry2.to > existing.version).sort(
     (a, b) => a.to - b.to
   );
   let backup = existing.lastBackup;
@@ -9494,17 +9786,17 @@ function describe(value) {
 }
 
 // ../daemon/src/project.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var PROJECT_SCHEMA_VERSION = 1;
-var secretNames = z9.array(z9.string()).default([]);
-var McpConnectorSchema = z9.object({
-  kind: z9.literal("mcp"),
-  transport: z9.enum(["stdio", "http"]),
+var secretNames = z10.array(z10.string()).default([]);
+var McpConnectorSchema = z10.object({
+  kind: z10.literal("mcp"),
+  transport: z10.enum(["stdio", "http"]),
   /** For stdio. The binary, never a shell string. */
-  command: z9.string().default(""),
-  args: z9.array(z9.string()).default([]),
+  command: z10.string().default(""),
+  args: z10.array(z10.string()).default([]),
   /** For http. */
-  url: z9.string().default(""),
+  url: z10.string().default(""),
   /**
    * How an HTTP server is authenticated to.
    *
@@ -9514,19 +9806,19 @@ var McpConnectorSchema = z9.object({
    * approves in a browser, and the tokens live with the other credentials.
    * Ignored for stdio, which authenticates by environment.
    */
-  auth: z9.enum(["header", "oauth"]).default("header"),
+  auth: z10.enum(["header", "oauth"]).default("header"),
   secretNames
 });
-var OpenApiConnectorSchema = z9.object({
-  kind: z9.literal("openapi"),
+var OpenApiConnectorSchema = z10.object({
+  kind: z10.literal("openapi"),
   /** The document itself, kept whole so a run does not depend on a URL. */
-  spec: z9.string().max(8e6).default(""),
+  spec: z10.string().max(8e6).default(""),
   /** Where it was fetched from, for reconnecting and for saying so. */
-  specUrl: z9.string().default(""),
+  specUrl: z10.string().default(""),
   /** Where the API actually is. Whatever `servers` claims is a suggestion. */
-  baseUrl: z9.string().default(""),
+  baseUrl: z10.string().default(""),
   /** Header name to secret name, so a token is never in the project. */
-  headers: z9.record(z9.string(), z9.string()).default({}),
+  headers: z10.record(z10.string(), z10.string()).default({}),
   /**
    * A client id and secret to exchange for a token, when the API wants one.
    *
@@ -9538,20 +9830,20 @@ var OpenApiConnectorSchema = z9.object({
    * an API whose only flow is a browser is one RigorRun should say it cannot
    * sign in to rather than half-attempt.
    */
-  oauth: z9.object({
-    tokenUrl: z9.string(),
-    clientIdSecret: z9.string(),
-    clientSecretSecret: z9.string(),
-    scope: z9.string().default("")
+  oauth: z10.object({
+    tokenUrl: z10.string(),
+    clientIdSecret: z10.string(),
+    clientSecretSecret: z10.string(),
+    scope: z10.string().default("")
   }).nullable().default(null),
   secretNames
 });
-var BrowserConnectorSchema = z9.object({
-  kind: z9.literal("browser"),
+var BrowserConnectorSchema = z10.object({
+  kind: z10.literal("browser"),
   /** Where the job starts. Every navigation is checked against its origin. */
-  startUrl: z9.string(),
-  browser: z9.enum(["chromium", "firefox", "webkit"]).default("chromium"),
-  headless: z9.boolean().default(true),
+  startUrl: z10.string(),
+  browser: z10.enum(["chromium", "firefox", "webkit"]).default("chromium"),
+  headless: z10.boolean().default(true),
   /**
    * Something that can be read for records, or nothing.
    *
@@ -9561,10 +9853,10 @@ var BrowserConnectorSchema = z9.object({
    * project says OBSERVATIONAL — RigorRun watched what the agent did and did
    * not check what changed.
    */
-  verifier: z9.discriminatedUnion("kind", [McpConnectorSchema, OpenApiConnectorSchema]).nullable().default(null),
+  verifier: z10.discriminatedUnion("kind", [McpConnectorSchema, OpenApiConnectorSchema]).nullable().default(null),
   secretNames
 });
-var ConnectorSchema = z9.discriminatedUnion("kind", [
+var ConnectorSchema = z10.discriminatedUnion("kind", [
   McpConnectorSchema,
   OpenApiConnectorSchema,
   BrowserConnectorSchema
@@ -9599,30 +9891,30 @@ function describeConnectorAction(connector) {
   }
   return connector.auth === "oauth" ? `open ${connector.url}, and sign in to it in a browser if it asks` : `open ${connector.url}`;
 }
-var VerifierReadSchema = z9.object({
-  tool: z9.string(),
-  args: z9.record(z9.string(), z9.unknown()).default({})
+var VerifierReadSchema = z10.object({
+  tool: z10.string(),
+  args: z10.record(z10.string(), z10.unknown()).default({})
 });
 var agentCommon = {
-  id: z9.string(),
-  name: z9.string(),
+  id: z10.string(),
+  name: z10.string(),
   /** When the last successful handshake happened, and what it said. */
-  lastProbeAt: z9.string().nullable().default(null),
-  lastProbeOk: z9.boolean().default(false),
-  lastProbeProblem: z9.string().default("")
+  lastProbeAt: z10.string().nullable().default(null),
+  lastProbeOk: z10.boolean().default(false),
+  lastProbeProblem: z10.string().default("")
 };
-var HttpAgentSchema = z9.object({
+var HttpAgentSchema = z10.object({
   ...agentCommon,
-  kind: z9.literal("http"),
-  endpoint: z9.string()
+  kind: z10.literal("http"),
+  endpoint: z10.string()
 });
-var ProcessAgentSchema = z9.object({
+var ProcessAgentSchema = z10.object({
   ...agentCommon,
-  kind: z9.literal("process"),
+  kind: z10.literal("process"),
   /** The executable. Written here only by a person, at this machine. */
-  command: z9.string(),
-  args: z9.array(z9.string()).default([]),
-  cwd: z9.string().default(""),
+  command: z10.string(),
+  args: z10.array(z10.string()).default([]),
+  cwd: z10.string().default(""),
   /**
    * When somebody looked at that command and said yes.
    *
@@ -9630,11 +9922,11 @@ var ProcessAgentSchema = z9.object({
    * `connectorTrust`. A command that arrived in a file is not a command
    * anybody on this machine has agreed to run.
    */
-  confirmedByOperatorAt: z9.string().nullable().default(null)
+  confirmedByOperatorAt: z10.string().nullable().default(null)
 });
-var ExternalAgentSchema = z9.object({
+var ExternalAgentSchema = z10.object({
   ...agentCommon,
-  kind: z9.literal("external"),
+  kind: z10.literal("external"),
   /**
    * The name of the credential holding this agent's key.
    *
@@ -9643,9 +9935,9 @@ var ExternalAgentSchema = z9.object({
    * file that cannot be copied safely would undo the arrangement the rest of
    * this file is built on.
    */
-  keyName: z9.string()
+  keyName: z10.string()
 });
-var AgentConfigSchema = z9.discriminatedUnion("kind", [
+var AgentConfigSchema = z10.discriminatedUnion("kind", [
   HttpAgentSchema,
   ProcessAgentSchema,
   ExternalAgentSchema
@@ -9655,48 +9947,48 @@ function describeAgent(agent) {
   if (agent.kind === "external") return `driven by you (${agent.id})`;
   return `${agent.command} ${agent.args.join(" ")}`.trim();
 }
-var RunSummarySchema = z9.object({
-  runId: z9.string(),
-  agentId: z9.string(),
-  agentName: z9.string(),
-  finishedAt: z9.string(),
-  taskSuccessRate: z9.number(),
-  policyComplianceRate: z9.number(),
-  unsafeActions: z9.number(),
-  criticalFailures: z9.number(),
-  thresholdsPassed: z9.boolean(),
-  verification: z9.string(),
-  isolation: z9.string(),
-  caseCount: z9.number()
+var RunSummarySchema = z10.object({
+  runId: z10.string(),
+  agentId: z10.string(),
+  agentName: z10.string(),
+  finishedAt: z10.string(),
+  taskSuccessRate: z10.number(),
+  policyComplianceRate: z10.number(),
+  unsafeActions: z10.number(),
+  criticalFailures: z10.number(),
+  thresholdsPassed: z10.boolean(),
+  verification: z10.string(),
+  isolation: z10.string(),
+  caseCount: z10.number()
 });
-var TimingsSchema = z9.object({
-  createdAt: z9.string(),
-  environmentConnectedAt: z9.string().nullable().default(null),
-  workflowRecordedAt: z9.string().nullable().default(null),
-  benchmarkGeneratedAt: z9.string().nullable().default(null),
-  agentConnectedAt: z9.string().nullable().default(null),
-  firstVerdictAt: z9.string().nullable().default(null)
+var TimingsSchema = z10.object({
+  createdAt: z10.string(),
+  environmentConnectedAt: z10.string().nullable().default(null),
+  workflowRecordedAt: z10.string().nullable().default(null),
+  benchmarkGeneratedAt: z10.string().nullable().default(null),
+  agentConnectedAt: z10.string().nullable().default(null),
+  firstVerdictAt: z10.string().nullable().default(null)
 });
-var ProjectSchema = z9.object({
-  schemaVersion: z9.literal(PROJECT_SCHEMA_VERSION),
-  id: z9.string(),
-  name: z9.string(),
+var ProjectSchema = z10.object({
+  schemaVersion: z10.literal(PROJECT_SCHEMA_VERSION),
+  id: z10.string(),
+  name: z10.string(),
   /** What the person is trying to prove an agent can do. */
-  goal: z9.string().default(""),
+  goal: z10.string().default(""),
   connector: ConnectorSchema.nullable().default(null),
   /** production / staging / local / ephemeral. Decides what may be written. */
-  safety: z9.enum(["production", "staging", "local", "ephemeral"]).default("staging"),
+  safety: z10.enum(["production", "staging", "local", "ephemeral"]).default("staging"),
   /** Tools a person has confirmed only read. Never the server's own opinion. */
-  readOnlyTools: z9.array(z9.string()).default([]),
-  verifierReads: z9.array(VerifierReadSchema).default([]),
-  reset: z9.object({ kind: z9.enum(["tool", "none"]), tool: z9.string().default("") }).default({ kind: "none", tool: "" }),
+  readOnlyTools: z10.array(z10.string()).default([]),
+  verifierReads: z10.array(VerifierReadSchema).default([]),
+  reset: z10.object({ kind: z10.enum(["tool", "none"]), tool: z10.string().default("") }).default({ kind: "none", tool: "" }),
   /** Answers to the schema questions, so a review survives a restart. */
-  schemaAnswers: z9.array(z9.object({ questionId: z9.string(), value: z9.string() })).default([]),
-  agents: z9.array(AgentConfigSchema).default([]),
-  runs: z9.array(RunSummarySchema).default([]),
+  schemaAnswers: z10.array(z10.object({ questionId: z10.string(), value: z10.string() })).default([]),
+  agents: z10.array(AgentConfigSchema).default([]),
+  runs: z10.array(RunSummarySchema).default([]),
   timings: TimingsSchema,
   /** The run a later run is compared against, once somebody sets one. */
-  baselineRunId: z9.string().nullable().default(null),
+  baselineRunId: z10.string().nullable().default(null),
   /**
    * Where this project's connector came from, and whether anybody has looked.
    *
@@ -9710,9 +10002,9 @@ var ProjectSchema = z9.object({
    * typed by whoever owns the machine it is on, which is exactly what `typed`
    * means.
    */
-  connectorTrust: z9.object({
-    origin: z9.enum(["typed", "imported"]).default("typed"),
-    confirmedAt: z9.string().nullable().default(null)
+  connectorTrust: z10.object({
+    origin: z10.enum(["typed", "imported"]).default("typed"),
+    confirmedAt: z10.string().nullable().default(null)
   }).default({ origin: "typed", confirmedAt: null })
 });
 function parseProject(input) {
@@ -9777,7 +10069,7 @@ function nextSteps(project) {
 import { readFile as readFile4 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 
-// ../daemon/src/exec.ts
+// ../exec/src/exec.ts
 import { spawn } from "node:child_process";
 var MAX_OUTPUT_BYTES = 1024 * 1024;
 var GRACE_MS = 5e3;
@@ -10407,7 +10699,7 @@ function compareRuns(baseline, current) {
       continue;
     }
     const { movement, detail } = movementOf(before, after);
-    const entry = {
+    const entry2 = {
       caseId: after.caseId,
       caseName: after.caseName,
       movement,
@@ -10415,9 +10707,9 @@ function compareRuns(baseline, current) {
       before: outcome(before),
       after: outcome(after)
     };
-    if (movement === "regressed") regressed.push(entry);
-    else if (movement === "improved") improved.push(entry);
-    else unchanged.push(entry);
+    if (movement === "regressed") regressed.push(entry2);
+    else if (movement === "improved") improved.push(entry2);
+    else unchanged.push(entry2);
   }
   for (const before of baseline.caseResults) {
     if (seen.has(before.caseId)) continue;
@@ -10467,7 +10759,7 @@ function isObject(value) {
 function declaredTypes(node) {
   const raw = node.type;
   if (typeof raw === "string") return [raw];
-  if (Array.isArray(raw)) return raw.filter((entry) => typeof entry === "string");
+  if (Array.isArray(raw)) return raw.filter((entry2) => typeof entry2 === "string");
   return [];
 }
 function closedValues(node) {
@@ -10485,14 +10777,14 @@ function resolveType(node, depth, budget) {
   if (budget.nodes <= 0) return void 0;
   const values = closedValues(node);
   if (values) return { type: "enum", enumValues: values };
-  const branches = [node.anyOf, node.oneOf, node.allOf].find((entry) => Array.isArray(entry));
+  const branches = [node.anyOf, node.oneOf, node.allOf].find((entry2) => Array.isArray(entry2));
   if (Array.isArray(branches)) {
-    const resolved = branches.filter(isObject).filter((branch) => declaredTypes(branch)[0] !== "null").map((branch) => resolveType(branch, depth + 1, budget)).filter((entry) => entry !== void 0);
+    const resolved = branches.filter(isObject).filter((branch) => declaredTypes(branch)[0] !== "null").map((branch) => resolveType(branch, depth + 1, budget)).filter((entry2) => entry2 !== void 0);
     if (resolved.length === 0) return void 0;
     const first = resolved[0];
-    return resolved.every((entry) => entry.type === first.type) ? first : void 0;
+    return resolved.every((entry2) => entry2.type === first.type) ? first : void 0;
   }
-  const types = declaredTypes(node).filter((entry) => entry !== "null");
+  const types = declaredTypes(node).filter((entry2) => entry2 !== "null");
   if (types.length !== 1) return void 0;
   switch (types[0]) {
     case "string":
@@ -10520,7 +10812,7 @@ function paramsFromInputSchema(schema6) {
   if (!properties) {
     return { params, unsupported, truncated: false };
   }
-  const requiredList = Array.isArray(schema6["required"]) ? new Set(schema6["required"].filter((entry) => typeof entry === "string")) : /* @__PURE__ */ new Set();
+  const requiredList = Array.isArray(schema6["required"]) ? new Set(schema6["required"].filter((entry2) => typeof entry2 === "string")) : /* @__PURE__ */ new Set();
   const budget = { nodes: SCHEMA_LIMITS.maxNodes };
   const names = Object.keys(properties);
   if (names.length > SCHEMA_LIMITS.maxProperties) truncated = true;
@@ -10551,7 +10843,7 @@ function paramsFromInputSchema(schema6) {
   return { params, unsupported, truncated };
 }
 function unsupportedReason(node) {
-  const types = declaredTypes(node).filter((entry) => entry !== "null");
+  const types = declaredTypes(node).filter((entry2) => entry2 !== "null");
   if (types.length === 0) return "no type is declared, so RigorRun cannot assert on it";
   if (types.length > 1) return `it may be ${types.join(" or ")}, and RigorRun needs one type`;
   const type = types[0];
@@ -10669,7 +10961,7 @@ function rowsFromPayload(payload, entity2) {
   const walk = (value, depth) => {
     if (depth > MAX_DEPTH || value === null || typeof value !== "object") return;
     if (Array.isArray(value)) {
-      for (const entry of value) walk(entry, depth + 1);
+      for (const entry2 of value) walk(entry2, depth + 1);
       return;
     }
     if (looksLike(value, entity2)) {
@@ -10894,7 +11186,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-var CLIENT_INFO = { name: "rigorrun", version: "0.1.0" };
+var CLIENT_INFO = { name: "rigorrun", version: RIGORRUN_VERSION };
 var DEFAULT_TIMEOUT_MS = 2e4;
 function signInFor(config) {
   return config.transport === "http" ? config.auth : void 0;
@@ -11044,6 +11336,7 @@ async function discoverTools(client, timeout) {
       params: converted.params,
       unsupported: converted.unsupported,
       schemaTruncated: converted.truncated,
+      ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {},
       ...tool.outputSchema ? { outputSchema: tool.outputSchema } : {},
       hints,
       risk: assessFromHints(hints)
@@ -11061,7 +11354,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 var DEFAULT_TIMEOUT_MS2 = 5 * 6e4;
 var CLIENT_METADATA = {
   client_name: "RigorRun",
-  client_uri: "https://rigorrun.pages.dev",
+  client_uri: "https://rigorrun.xyz",
   redirect_uris: [],
   grant_types: ["authorization_code", "refresh_token"],
   response_types: ["code"],
@@ -11221,7 +11514,7 @@ var MAX_ENUM_VALUE_LENGTH = 64;
 function isRecordLike(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
   const scalars = Object.values(value).filter(
-    (entry) => entry === null || typeof entry !== "object"
+    (entry2) => entry2 === null || typeof entry2 !== "object"
   );
   return scalars.length >= MIN_FIELDS_FOR_RECORD;
 }
@@ -11253,16 +11546,16 @@ function collect(payload, containerName, depth, into) {
   if (depth > MAX_WALK_DEPTH) return;
   if (Array.isArray(payload)) {
     const group = /* @__PURE__ */ new Map();
-    for (const entry of payload) {
-      if (isRecordLike(entry)) {
-        const evidence = evidenceFor(entry, containerName, into);
-        evidence.rows.push(entry);
+    for (const entry2 of payload) {
+      if (isRecordLike(entry2)) {
+        const evidence = evidenceFor(entry2, containerName, into);
+        evidence.rows.push(entry2);
         const indices = group.get(evidence) ?? [];
         indices.push(evidence.rows.length - 1);
         group.set(evidence, indices);
       }
-      if (typeof entry === "object" && entry !== null) {
-        collect(entry, containerName, depth + 1, into);
+      if (typeof entry2 === "object" && entry2 !== null) {
+        collect(entry2, containerName, depth + 1, into);
       }
     }
     for (const [evidence, indices] of group) evidence.collections.push(indices);
@@ -11730,7 +12023,7 @@ function resolveSchema(document, node, depth = 0, budget = { nodes: MAX_NODES })
   const resolved = deref(document, node, 0);
   if (resolved === null || typeof resolved !== "object") return resolved;
   if (Array.isArray(resolved)) {
-    return resolved.map((entry) => resolveSchema(document, entry, depth + 1, budget));
+    return resolved.map((entry2) => resolveSchema(document, entry2, depth + 1, budget));
   }
   const out = {};
   for (const [key, value] of Object.entries(resolved)) {
@@ -11781,8 +12074,8 @@ function operationsFrom(document) {
         ...shared,
         ...Array.isArray(operation["parameters"]) ? operation["parameters"] : []
       ];
-      for (const entry of declared.slice(0, SCHEMA_LIMITS.maxProperties)) {
-        const parameter = resolveSchema(document, entry);
+      for (const entry2 of declared.slice(0, SCHEMA_LIMITS.maxProperties)) {
+        const parameter = resolveSchema(document, entry2);
         if (!isObject2(parameter) || typeof parameter["name"] !== "string") continue;
         const where = parameter["in"];
         if (where !== "path" && where !== "query" && where !== "header") {
@@ -11964,7 +12257,7 @@ var OpenApiConnection = class _OpenApiConnection {
   }
   async call(name, args) {
     const startedAt = Date.now();
-    const operation = this.operations.find((entry) => entry.name === name);
+    const operation = this.operations.find((entry2) => entry2.name === name);
     if (!operation) {
       return {
         ok: false,
@@ -12461,7 +12754,7 @@ var Workspace = class {
         // The project stores a header name against a *secret* name; the value
         // is substituted here and nowhere earlier.
         headers: Object.fromEntries(
-          Object.entries(connector.headers).map(([header, secret]) => [header, secrets[secret]]).filter((entry) => entry[1] !== void 0)
+          Object.entries(connector.headers).map(([header, secret]) => [header, secrets[secret]]).filter((entry2) => entry2[1] !== void 0)
         )
       });
     }
@@ -12618,7 +12911,7 @@ var Workspace = class {
   async demonstrate(project, tool, args) {
     const live = this.live.get(project.id);
     if (!live?.demonstration) throw new Error("Nothing is being recorded right now.");
-    const claimsReadOnly = live.connection.discovery.tools.find((entry) => entry.name === tool)?.hints.readOnly === true;
+    const claimsReadOnly = live.connection.discovery.tools.find((entry2) => entry2.name === tool)?.hints.readOnly === true;
     const before = claimsReadOnly ? await this.readPayloads(project) : void 0;
     const result = await live.connection.call(tool, args);
     if (result.structured !== void 0) {
@@ -12631,7 +12924,7 @@ var Workspace = class {
         { readOnly: true },
         JSON.stringify(after) !== JSON.stringify(before)
       );
-      if (mismatch && !live.mismatches.some((entry) => entry.tool === mismatch.tool)) {
+      if (mismatch && !live.mismatches.some((entry2) => entry2.tool === mismatch.tool)) {
         live.mismatches.push(mismatch);
       }
     }
@@ -12706,7 +12999,7 @@ function assertConnectorTrusted(project) {
 }
 
 // ../daemon/src/httpAgent.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 
 // ../proxy/src/session.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -12714,7 +13007,7 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-var PROXY_INFO = { name: "rigorrun-proxy", version: "0.1.0" };
+var PROXY_INFO = { name: "rigorrun-proxy", version: RIGORRUN_VERSION };
 function createProxySession(options) {
   const calls = [];
   const allowed = new Map(options.tools.map((tool) => [tool.name, tool]));
@@ -12869,19 +13162,19 @@ function hostIsLocal(host) {
 
 // ../daemon/src/httpAgent.ts
 var AGENT_PROTOCOL_V2 = "rigorrun/agent/2";
-var CompletionSchema = z10.object({
-  status: z10.enum(["completed", "failed"]),
+var CompletionSchema = z11.object({
+  status: z11.enum(["completed", "failed"]),
   /** The agent's account of what it did. Displayed, never scored. */
-  output: z10.string().max(8e3).default(""),
-  usage: z10.object({
-    promptTokens: z10.number().int().nonnegative(),
-    completionTokens: z10.number().int().nonnegative()
+  output: z11.string().max(8e3).default(""),
+  usage: z11.object({
+    promptTokens: z11.number().int().nonnegative(),
+    completionTokens: z11.number().int().nonnegative()
   }).optional(),
-  costUsd: z10.number().nullable().optional()
+  costUsd: z11.number().nullable().optional()
 });
-var ProbeSchema = z10.object({
-  ok: z10.literal(true),
-  agent: z10.object({ name: z10.string().default(""), version: z10.string().default("") }).optional()
+var ProbeSchema = z11.object({
+  ok: z11.literal(true),
+  agent: z11.object({ name: z11.string().default(""), version: z11.string().default("") }).optional()
 });
 var DEFAULT_TIMEOUT_MS5 = 12e4;
 var MAX_RESPONSE_BYTES3 = 256 * 1024;
@@ -13731,21 +14024,21 @@ function readAttributes(raw) {
   if (isObject3(raw)) return raw;
   if (!Array.isArray(raw)) return {};
   const out = {};
-  for (const entry of raw) {
-    if (!isObject3(entry) || typeof entry["key"] !== "string") continue;
-    const value = entry["value"];
+  for (const entry2 of raw) {
+    if (!isObject3(entry2) || typeof entry2["key"] !== "string") continue;
+    const value = entry2["value"];
     if (!isObject3(value)) {
-      out[entry["key"]] = value;
+      out[entry2["key"]] = value;
       continue;
     }
     for (const tag of ["stringValue", "intValue", "doubleValue", "boolValue"]) {
       if (value[tag] !== void 0) {
-        out[entry["key"]] = tag === "intValue" ? Number(value[tag]) : value[tag];
+        out[entry2["key"]] = tag === "intValue" ? Number(value[tag]) : value[tag];
         break;
       }
     }
-    if (out[entry["key"]] === void 0 && isObject3(value["kvlistValue"])) {
-      out[entry["key"]] = readAttributes(value["kvlistValue"].values);
+    if (out[entry2["key"]] === void 0 && isObject3(value["kvlistValue"])) {
+      out[entry2["key"]] = readAttributes(value["kvlistValue"].values);
     }
   }
   return out;
@@ -13758,7 +14051,7 @@ function collectSpans(document) {
     }
   };
   if (Array.isArray(document)) {
-    for (const entry of document) push(entry);
+    for (const entry2 of document) push(entry2);
     return spans;
   }
   if (!isObject3(document)) return spans;
@@ -14088,7 +14381,7 @@ var Service = class {
       return `These reads did not answer: ${failed.join(", ")}. RigorRun will not be able to verify what they cover.`;
     }
     if (induceSchema(observations).schema.entities.length !== 0) return "";
-    if (payloadsAreEmpty(observations.map((entry) => entry.payload))) {
+    if (payloadsAreEmpty(observations.map((entry2) => entry2.payload))) {
       return "These reads answered, and there is nothing in this system yet, so RigorRun cannot tell what its records look like. That is fine \u2014 it will work them out from what your demonstration produces. Nothing to do here.";
     }
     return "These reads answered, but none of them returned structured records \u2014 RigorRun got text back, and it reads structure rather than prose because guessing at the meaning of a sentence is how a verdict stops being trustworthy. Nominate a read that returns structured output if this system has one. If none do, RigorRun can watch your agent work here but cannot check the result.";
@@ -14134,7 +14427,7 @@ var Service = class {
     const saved = await this.store.readArtefact(projectId, "demonstration");
     return {
       inProgress: saved !== void 0,
-      steps: (saved?.entries ?? []).map((entry) => ({ tool: entry.action, ok: entry.ok !== false }))
+      steps: (saved?.entries ?? []).map((entry2) => ({ tool: entry2.action, ok: entry2.ok !== false }))
     };
   }
   /** Just the steps. Kept for callers that only want the log. */
@@ -14326,7 +14619,7 @@ var Service = class {
     const same = describeAgent(agent);
     const updated = {
       ...project,
-      agents: [...project.agents.filter((entry) => describeAgent(entry) !== same), agent],
+      agents: [...project.agents.filter((entry2) => describeAgent(entry2) !== same), agent],
       timings: {
         ...project.timings,
         agentConnectedAt: agent.lastProbeOk && !project.timings.agentConnectedAt ? this.now().toISOString() : project.timings.agentConnectedAt
@@ -14426,7 +14719,7 @@ var Service = class {
     const project = await this.store.read(projectId);
     const benchmark = await this.store.readArtefact(projectId, "benchmark");
     if (!benchmark) throw new Error("There is no benchmark to run yet.");
-    const config = project.agents.find((entry) => entry.id === agentId);
+    const config = project.agents.find((entry2) => entry2.id === agentId);
     if (!config) throw new Error(`No agent "${agentId}" on this project.`);
     if (!config.lastProbeOk) {
       throw new Error(
@@ -14464,7 +14757,7 @@ var Service = class {
           // Counted from the assertion results rather than a per-case tally,
           // which does not exist: severity lives on each failed check.
           criticalFailures: result.caseResults.reduce(
-            (total, entry) => total + entry.assertions.filter(
+            (total, entry2) => total + entry2.assertions.filter(
               (assertion) => assertion.status === "FAIL" && assertion.failureSeverity === "CRITICAL"
             ).length,
             0
@@ -14530,7 +14823,7 @@ var Service = class {
     if (!key) return null;
     const { projects } = await this.listAllProjects();
     for (const project of projects) {
-      const agent = project.agents.find((entry) => entry.id === agentId);
+      const agent = project.agents.find((entry2) => entry2.id === agentId);
       if (!agent || agent.kind !== "external") continue;
       const expected = await this.store.secret(agent.keyName);
       if (expected === void 0 || !keyMatches(key, expected)) return null;
@@ -14550,13 +14843,13 @@ var Service = class {
   async noteDriverCheckIn(projectId, agentId) {
     this.driver.noteCheckIn(agentId);
     const project = await this.store.read(projectId);
-    const agent = project.agents.find((entry) => entry.id === agentId);
+    const agent = project.agents.find((entry2) => entry2.id === agentId);
     if (!agent || agent.kind !== "external" || agent.lastProbeOk) return;
     const now3 = this.now().toISOString();
     await this.store.write({
       ...project,
       agents: project.agents.map(
-        (entry) => entry.id === agentId ? { ...entry, lastProbeAt: now3, lastProbeOk: true, lastProbeProblem: "" } : entry
+        (entry2) => entry2.id === agentId ? { ...entry2, lastProbeAt: now3, lastProbeOk: true, lastProbeProblem: "" } : entry2
       ),
       timings: {
         ...project.timings,
@@ -14656,13 +14949,13 @@ function payloadsAreEmpty(payloads) {
     if (Array.isArray(value)) {
       sawContainer = true;
       if (value.length > 0) sawContent = true;
-      for (const entry of value.slice(0, 50)) walk(entry, depth + 1);
+      for (const entry2 of value.slice(0, 50)) walk(entry2, depth + 1);
       return;
     }
     if (typeof value === "object") {
       sawContainer = true;
       const entries = Object.entries(value);
-      for (const [, entry] of entries.slice(0, 50)) walk(entry, depth + 1);
+      for (const [, entry2] of entries.slice(0, 50)) walk(entry2, depth + 1);
       return;
     }
     if (typeof value === "string" && value.trim().length > 0) sawContent = true;
@@ -14780,11 +15073,11 @@ var Runner = class {
     app.get("/", async (context) => {
       const code = context.req.query("code");
       if (code) {
-        const token = this.pairing.redeem(code);
-        if (!token) return htmlResponse(EXPIRED_PAGE, 403);
+        const token2 = this.pairing.redeem(code);
+        if (!token2) return htmlResponse(EXPIRED_PAGE, 403);
         context.header(
           "set-cookie",
-          `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`
+          `${SESSION_COOKIE}=${token2}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`
         );
         return context.redirect("/", 302);
       }
@@ -14840,6 +15133,21 @@ var Runner = class {
       );
     });
     app.use("/api/*", async (context, next) => {
+      const method = context.req.method.toUpperCase();
+      if (method !== "GET" && method !== "HEAD" && method !== "OPTIONS") {
+        const site = context.req.header("sec-fetch-site");
+        const origin = context.req.header("origin");
+        const crossOrigin = site ? site !== "same-origin" && site !== "none" : origin !== void 0 && !originMatchesHost(origin, context.req.header("host"));
+        if (crossOrigin) {
+          return context.json(
+            {
+              error: "cross-origin request refused",
+              detail: "A state-changing request must come from the runner\u2019s own page. This one looks cross-origin, so it was refused even though it carried a session."
+            },
+            403
+          );
+        }
+      }
       const bearer = context.req.header("authorization")?.replace(/^Bearer\s+/i, "");
       const cookie = cookieValue(context.req.header("cookie"), SESSION_COOKIE);
       if (!this.pairing.authorises(bearer ?? cookie)) {
@@ -14881,10 +15189,10 @@ var Runner = class {
         project: summarise3(project),
         contract: contract ?? null,
         benchmark: benchmark ? {
-          cases: benchmark.cases.map((entry) => ({
-            id: entry.id,
-            name: entry.name,
-            category: entry.category
+          cases: benchmark.cases.map((entry2) => ({
+            id: entry2.id,
+            name: entry2.name,
+            category: entry2.category
           })),
           notTestable: benchmark.notTestable
         } : null,
@@ -14989,10 +15297,10 @@ var Runner = class {
     app.post("/api/projects/:id/benchmark", async (context) => {
       const benchmark = await service.generate(context.req.param("id"));
       return context.json({
-        cases: benchmark.cases.map((entry) => ({
-          id: entry.id,
-          name: entry.name,
-          category: entry.category
+        cases: benchmark.cases.map((entry2) => ({
+          id: entry2.id,
+          name: entry2.name,
+          category: entry2.category
         })),
         notTestable: benchmark.notTestable
       });
@@ -15013,7 +15321,7 @@ var Runner = class {
         typeof body.command === "string" && body.command.length > 0 ? {
           name,
           command: body.command,
-          args: Array.isArray(body.args) ? body.args.filter((entry) => typeof entry === "string") : []
+          args: Array.isArray(body.args) ? body.args.filter((entry2) => typeof entry2 === "string") : []
         } : { name, endpoint: String(body.endpoint ?? "") }
       );
       return context.json({ project: summarise3(added.project), agent: added.agent });
@@ -15129,6 +15437,14 @@ function hostIsLocal2(host) {
   if (!host) return false;
   return ALLOWED_HOSTS2.has(host.replace(/:\d+$/, "").toLowerCase());
 }
+function originMatchesHost(origin, host) {
+  if (!host) return false;
+  try {
+    return new URL(origin).host.toLowerCase() === host.toLowerCase();
+  } catch {
+    return false;
+  }
+}
 function publicTool(tool) {
   return {
     name: tool.name,
@@ -15161,14 +15477,14 @@ function publicRun(run) {
     notTestable: run.notTestable,
     verdict: run.verdict,
     scores: run.scores,
-    caseResults: run.caseResults.map((entry) => ({
-      caseId: entry.caseId,
-      caseName: entry.caseName,
-      category: entry.category,
-      taskSuccess: entry.taskSuccess,
-      policyCompliant: entry.policyCompliant,
-      unsafeActions: entry.unsafeActions,
-      durationMs: entry.durationMs,
+    caseResults: run.caseResults.map((entry2) => ({
+      caseId: entry2.caseId,
+      caseName: entry2.caseName,
+      category: entry2.category,
+      taskSuccess: entry2.taskSuccess,
+      policyCompliant: entry2.policyCompliant,
+      unsafeActions: entry2.unsafeActions,
+      durationMs: entry2.durationMs,
       // Everything below is the evidence for the line above. It was all
       // recorded already and none of it reached the screen, so a failure was a
       // red mark with a category beside it and no way to find out what
@@ -15177,16 +15493,16 @@ function publicRun(run) {
       // What the agent did, in order, with what it passed. Truncated per step
       // rather than as a whole, so a long run stays readable and the shape of
       // what happened survives.
-      steps: entry.steps.slice(0, 60).map((step) => ({
+      steps: entry2.steps.slice(0, 60).map((step) => ({
         tool: step.tool,
         args: clip(step.args),
         ok: step.ok,
         error: step.error ?? ""
       })),
-      stepsOmitted: Math.max(0, entry.steps.length - 60),
+      stepsOmitted: Math.max(0, entry2.steps.length - 60),
       /** What the system said afterwards, which is what the verdict rests on. */
-      finalState: clip(entry.finalStateSummary),
-      checks: entry.assertions.map((assertion) => ({
+      finalState: clip(entry2.finalStateSummary),
+      checks: entry2.assertions.map((assertion) => ({
         description: assertion.description,
         status: assertion.status,
         message: assertion.message,
@@ -15205,14 +15521,14 @@ function publicRun(run) {
        * failure this product exists to catch, so its claim is evidence about
        * the agent rather than evidence about the system.
        */
-      agentReport: entry.agentReport.slice(0, 2e3),
-      error: entry.error ?? ""
+      agentReport: entry2.agentReport.slice(0, 2e3),
+      error: entry2.error ?? ""
     }))
   };
 }
 function clip(value) {
   const out = {};
-  for (const [key, entry] of Object.entries(value).slice(0, 24)) out[key] = clipValue(entry);
+  for (const [key, entry2] of Object.entries(value).slice(0, 24)) out[key] = clipValue(entry2);
   return out;
 }
 function clipValue(value) {
@@ -15522,7 +15838,12 @@ async function receiveTrace(port, outPath) {
           line(`${c.green("received")}  ${trace.events.length} events from ${trace.app.origin}`);
           line(`${c.grey("written")}   ${written}`);
           line();
-          line(c.grey(`Next: rigorrun compile ${target} -o contract.json`));
+          line(c.grey("This is a browser recording. It is not a contract, and `rigorrun compile`"));
+          line(c.grey("cannot read it: compiling needs the state your system held before and"));
+          line(c.grey("after the job, which a page cannot supply."));
+          line();
+          line(c.grey("To build a suite, connect the system through `rigorrun` and do the job"));
+          line(c.grey("there instead. See docs/V1_GAP_AUDIT.md for what this path does not do."));
           server.close(() => resolve5(0));
         })();
       });
@@ -15597,7 +15918,7 @@ async function cmdServe(options = {}) {
   if (reaped.length > 0) {
     line(
       c.grey(
-        `  Ended ${reaped.length} server(s) a previous run left behind: ${reaped.map((entry) => entry.fingerprint.split(" ")[0]).join(", ")}`
+        `  Ended ${reaped.length} server(s) a previous run left behind: ${reaped.map((entry2) => entry2.fingerprint.split(" ")[0]).join(", ")}`
       )
     );
   }
@@ -15640,6 +15961,1235 @@ async function cmdServe(options = {}) {
   return 0;
 }
 
+// ../sandbox/src/reference.ts
+var NPM_SPEC = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?([a-z0-9-~][a-z0-9-._~]*)(?:@(.+))?$/;
+var ReferenceError = class extends Error {
+};
+function parseReference(input) {
+  const raw = input.trim();
+  if (raw.length === 0) throw new ReferenceError("No server reference given.");
+  const colon = raw.indexOf(":");
+  const scheme = colon === -1 ? "" : raw.slice(0, colon);
+  const rest = colon === -1 ? "" : raw.slice(colon + 1);
+  if (scheme === "npm") {
+    const match = NPM_SPEC.exec(rest);
+    if (!match) {
+      throw new ReferenceError(
+        `"${rest}" is not an npm package name. Expected npm:<package>@<version>, for example npm:@modelcontextprotocol/server-memory@2026.8.31.`
+      );
+    }
+    return {
+      scheme: "npm",
+      raw,
+      name: `${match[1] ?? ""}${match[2] ?? ""}`,
+      version: match[3] ?? ""
+    };
+  }
+  if (scheme === "dir") {
+    if (rest.length === 0) throw new ReferenceError("dir: needs a path.");
+    return { scheme: "dir", raw, name: rest, version: "" };
+  }
+  throw new ReferenceError(
+    `RigorRun does not know how to fetch "${raw}". Supported today: npm:<package>@<version> for a published server, and dir:<path> for one on this machine. A container image reference, a git ref and a remote endpoint are planned and deliberately not pretended to work yet.`
+  );
+}
+
+// ../sandbox/src/registry.ts
+var RegistryError = class extends Error {
+};
+var REGISTRY = "https://registry.npmjs.org";
+function encodeName(name) {
+  return name.replace("/", "%2f");
+}
+async function getJson(url) {
+  const response = await fetch(url, { headers: { accept: "application/json" } });
+  if (!response.ok) {
+    throw new RegistryError(
+      `The registry answered ${response.status} for ${url}. If the package name is right, it may not be published.`
+    );
+  }
+  return response.json();
+}
+async function resolvePackage(name, version) {
+  let exact = version;
+  if (exact === "" || exact === "latest") {
+    const doc2 = await getJson(`${REGISTRY}/${encodeName(name)}`);
+    const latest = doc2["dist-tags"]?.["latest"];
+    if (typeof latest !== "string") {
+      throw new RegistryError(`${name} publishes no "latest" version.`);
+    }
+    exact = latest;
+  }
+  const doc = await getJson(`${REGISTRY}/${encodeName(name)}/${exact}`);
+  const resolved = typeof doc.version === "string" ? doc.version : exact;
+  const integrity = doc.dist?.integrity;
+  const tarball = doc.dist?.tarball;
+  if (typeof integrity !== "string" || !integrity.startsWith("sha512-")) {
+    throw new RegistryError(
+      `${name}@${resolved} publishes no sha512 integrity. RigorRun will not verify a package it cannot pin, because the record would be about bytes it could not name.`
+    );
+  }
+  if (typeof tarball !== "string") {
+    throw new RegistryError(`${name}@${resolved} publishes no tarball URL.`);
+  }
+  return { name, version: resolved, integrity, tarballUrl: tarball };
+}
+async function fetchVerifiedTarball(pkg) {
+  const response = await fetch(pkg.tarballUrl);
+  if (!response.ok) {
+    throw new RegistryError(
+      `Downloading ${pkg.name}@${pkg.version} failed with ${response.status}.`
+    );
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  const actual = `sha512-${await sha512Base64(bytes)}`;
+  if (actual !== pkg.integrity) {
+    throw new RegistryError(
+      `The tarball for ${pkg.name}@${pkg.version} does not match the digest the registry published.
+  expected ${pkg.integrity}
+  received ${actual}
+RigorRun stops rather than run bytes it cannot account for.`
+    );
+  }
+  return bytes;
+}
+
+// ../sandbox/src/docker.ts
+var DockerError = class extends Error {
+};
+var SAFE_TOKEN = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
+var SAFE_IMAGE = /^[a-z0-9][a-z0-9._/-]{0,127}(@sha256:[0-9a-f]{64}|:[a-zA-Z0-9_.-]{1,64})$/;
+function assertSafeToken(value, what) {
+  if (!SAFE_TOKEN.test(value)) {
+    throw new DockerError(`${what} "${value}" is not a name RigorRun will pass to a container.`);
+  }
+  return value;
+}
+function assertSafeImage(value) {
+  if (!SAFE_IMAGE.test(value)) {
+    throw new DockerError(
+      `"${value}" is not an image reference RigorRun will run. An image must be pinned by digest or carry an ordinary tag.`
+    );
+  }
+  return value;
+}
+var FORBIDDEN_ARGS = [
+  "--privileged",
+  "--cap-add",
+  "--device",
+  "--pid=host",
+  "--net=host",
+  "--network=host",
+  "--userns=host",
+  "-v",
+  "--volume",
+  "--mount"
+];
+function assertPostureIntact(args) {
+  for (const arg of args) {
+    const head = arg.split("=")[0] ?? arg;
+    if (FORBIDDEN_ARGS.includes(head) || FORBIDDEN_ARGS.includes(arg)) {
+      throw new DockerError(`Refusing to run a container with ${arg}.`);
+    }
+    if (arg.includes("docker.sock")) {
+      throw new DockerError("Refusing to give a container access to the container runtime.");
+    }
+  }
+}
+async function docker(args, timeoutMs = 6e4) {
+  assertPostureIntact(args);
+  return runCommand({
+    command: "docker",
+    args,
+    timeoutMs,
+    provenance: "rigorrun-internal"
+  });
+}
+async function inspectRuntime() {
+  try {
+    const version = await docker(["version", "--format", "{{.Server.Version}}"], 2e4);
+    if (version.code !== 0) {
+      return {
+        available: false,
+        version: "",
+        rootless: false,
+        detail: version.stderr.trim() || "The docker command exists but the daemon did not answer. Is it running?"
+      };
+    }
+    const security = await docker(["info", "--format", "{{.SecurityOptions}}"], 2e4);
+    const rootless = security.stdout.includes("rootless");
+    return {
+      available: true,
+      version: version.stdout.trim(),
+      rootless,
+      detail: security.stdout.trim()
+    };
+  } catch (error) {
+    return {
+      available: false,
+      version: "",
+      rootless: false,
+      detail: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function imageDigest(image) {
+  const result = await docker(["image", "inspect", image, "--format", "{{index .RepoDigests 0}}"]);
+  if (result.code !== 0) return "";
+  return result.stdout.trim();
+}
+async function pullImage(image) {
+  const result = await docker(["pull", assertSafeImage(image)], 6e5);
+  if (result.code !== 0) {
+    throw new DockerError(`Could not pull ${image}: ${result.stderr.trim()}`);
+  }
+}
+async function buildImage(contextDir, tag) {
+  assertSafeToken(tag.replace(/^rigorrun-target:/, ""), "image tag");
+  const result = await docker(
+    // No RUN instruction exists in the generated Dockerfile, so nothing the
+    // target ships can execute during a build. `--network none` makes that
+    // checkable from the argv rather than only from the Dockerfile.
+    ["build", "--network", "none", "--pull=false", "-t", tag, contextDir],
+    6e5
+  );
+  if (result.code !== 0) {
+    throw new DockerError(`Building the target image failed:
+${result.stderr.trim()}`);
+  }
+}
+async function removeImage(tag) {
+  await docker(["image", "rm", "-f", tag], 6e4);
+}
+async function forceRemove(name) {
+  try {
+    await docker(["rm", "-f", assertSafeToken(name, "container name")], 3e4);
+  } catch {
+  }
+}
+async function reapOrphans2() {
+  const listed = await docker(["ps", "-aq", "--filter", "label=rigorrun.harness=1"], 3e4);
+  if (listed.code !== 0) return [];
+  const ids = listed.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+  for (const id2 of ids) await forceRemove(id2);
+  return ids;
+}
+async function execInContainer(name, argv, timeoutMs = 6e4) {
+  return docker(["exec", assertSafeToken(name, "container name"), ...argv], timeoutMs);
+}
+async function containerLayerChanges(name) {
+  const result = await docker(["diff", assertSafeToken(name, "container name")], 3e4);
+  if (result.code !== 0) return [];
+  return result.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+}
+
+// ../sandbox/src/stage.ts
+import { mkdir as mkdir6, mkdtemp, readdir as readdir5, rm as rm4, writeFile as writeFile3, cp as cp3, readFile as readFile9, chmod as chmod2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join13 } from "node:path";
+var StageError = class extends Error {
+};
+var BASE_IMAGE_TAG = "node:20-alpine";
+var ENTRYPOINT = `#!/bin/sh
+set -e
+mkdir -p /work/target
+cp -R /opt/rigorrun-target-src/. /work/target/
+cd /work/target
+exec node "$@"
+`;
+var STATEDUMP = `#!/bin/sh
+find /work /tmp -type f -exec sha256sum {} + 2>/dev/null | LC_ALL=C sort -k2
+`;
+var PSLIST = `#!/bin/sh
+for entry in /proc/[0-9]*; do
+  tr '\\0' ' ' < "$entry/cmdline" 2>/dev/null
+  echo
+done
+`;
+async function scratch() {
+  return mkdtemp(join13(tmpdir(), "rigorrun-stage-"));
+}
+async function entryPointOf(treeDir, packageName) {
+  const manifestPath = join13(treeDir, "node_modules", packageName, "package.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile9(manifestPath, "utf8"));
+  } catch {
+    throw new StageError(
+      `${packageName} did not install a package.json, so RigorRun cannot tell what to run.`
+    );
+  }
+  let relative2;
+  if (typeof manifest.bin === "string") relative2 = manifest.bin;
+  else if (manifest.bin && typeof manifest.bin === "object") {
+    const entries = Object.values(manifest.bin);
+    const first = entries.find((v) => typeof v === "string");
+    relative2 = first;
+  }
+  if (!relative2 && typeof manifest.main === "string") relative2 = manifest.main;
+  if (!relative2) {
+    throw new StageError(
+      `${packageName} declares neither a bin nor a main, so there is nothing to start.`
+    );
+  }
+  return `/work/target/node_modules/${packageName}/${relative2.replace(/^\.\//, "")}`;
+}
+async function writeContext(dir, entryModule) {
+  const entry2 = join13(dir, "rigorrun-entrypoint");
+  const dump = join13(dir, "rigorrun-statedump");
+  const ps = join13(dir, "rigorrun-pslist");
+  await writeFile3(entry2, ENTRYPOINT, "utf8");
+  await writeFile3(dump, STATEDUMP, "utf8");
+  await writeFile3(ps, PSLIST, "utf8");
+  await chmod2(entry2, 365);
+  await chmod2(dump, 365);
+  await chmod2(ps, 365);
+  await writeFile3(
+    join13(dir, "Dockerfile"),
+    [
+      `FROM ${BASE_IMAGE_TAG}`,
+      // Owned by the user the container runs as, so copying it onto the
+      // writable mount needs no privilege the container does not have.
+      "COPY --chown=65532:65532 tree/ /opt/rigorrun-target-src/",
+      "COPY rigorrun-entrypoint /rigorrun/entrypoint",
+      "COPY rigorrun-statedump /rigorrun/statedump",
+      "COPY rigorrun-pslist /rigorrun/pslist",
+      "USER 65532:65532",
+      'ENTRYPOINT ["/rigorrun/entrypoint"]',
+      `CMD ["${entryModule}"]`,
+      ""
+    ].join("\n"),
+    "utf8"
+  );
+}
+async function digestOfDirectory(sourceDir) {
+  const entries = [];
+  const walk = async (dir, prefix) => {
+    const listing = await readdir5(dir, { withFileTypes: true });
+    for (const item of listing.sort((a, b) => a.name.localeCompare(b.name))) {
+      if (item.name === "node_modules" || item.name === ".git") continue;
+      const relative2 = prefix ? `${prefix}/${item.name}` : item.name;
+      const full = join13(dir, item.name);
+      if (item.isDirectory()) await walk(full, relative2);
+      else if (item.isFile()) entries.push([relative2, await sha256(await readFile9(full, "utf8"))]);
+    }
+  };
+  await walk(sourceDir, "");
+  return hashValue(entries);
+}
+async function digestOfTree(treeDir) {
+  try {
+    const lock = JSON.parse(await readFile9(join13(treeDir, "package-lock.json"), "utf8"));
+    const entries = Object.entries(lock.packages ?? {}).map(([path, meta]) => [path, meta.integrity ?? meta.version ?? ""]).sort(([a], [b]) => a.localeCompare(b));
+    return hashValue(entries);
+  } catch {
+    return "";
+  }
+}
+async function stageNpmPackage(packageName, version) {
+  const dir = await scratch();
+  const treeDir = join13(dir, "tree");
+  await mkdir6(treeDir, { recursive: true });
+  await writeFile3(
+    join13(treeDir, "package.json"),
+    JSON.stringify({ name: "rigorrun-target", private: true, version: "0.0.0" }, null, 2),
+    "utf8"
+  );
+  const install = await runCommand({
+    command: "npm",
+    args: [
+      "install",
+      `${packageName}@${version}`,
+      "--ignore-scripts",
+      "--no-audit",
+      "--no-fund",
+      "--omit=dev",
+      "--prefix",
+      treeDir
+    ],
+    timeoutMs: 6e5,
+    provenance: "rigorrun-internal"
+  });
+  if (install.code !== 0) {
+    await rm4(dir, { recursive: true, force: true });
+    throw new StageError(
+      `Installing ${packageName}@${version} failed.
+${install.stderr.trim() || install.stdout.trim()}`
+    );
+  }
+  const entryModule = await entryPointOf(treeDir, packageName);
+  await writeContext(dir, entryModule);
+  return {
+    dir,
+    treeDigest: await digestOfTree(treeDir),
+    contentDigest: "",
+    entryModule,
+    cleanup: () => rm4(dir, { recursive: true, force: true })
+  };
+}
+async function stageDirectory(sourceDir) {
+  const dir = await scratch();
+  const treeDir = join13(dir, "tree");
+  await mkdir6(treeDir, { recursive: true });
+  const manifest = JSON.parse(
+    await readFile9(join13(sourceDir, "package.json"), "utf8")
+  );
+  const name = manifest.name;
+  if (!name) throw new StageError(`${sourceDir} has no package name.`);
+  const deps = Object.entries(manifest.dependencies ?? {});
+  await writeFile3(
+    join13(treeDir, "package.json"),
+    JSON.stringify(
+      {
+        name: "rigorrun-target",
+        private: true,
+        version: "0.0.0",
+        ...deps.length > 0 ? { dependencies: manifest.dependencies } : {}
+      },
+      null,
+      2
+    ),
+    "utf8"
+  );
+  if (deps.length > 0) {
+    const install = await runCommand({
+      command: "npm",
+      args: ["install", "--ignore-scripts", "--no-audit", "--no-fund", "--omit=dev", "--prefix", treeDir],
+      timeoutMs: 6e5,
+      provenance: "rigorrun-internal"
+    });
+    if (install.code !== 0) {
+      await rm4(dir, { recursive: true, force: true });
+      throw new StageError(
+        `Installing dependencies for ${sourceDir} failed.
+${install.stderr.trim()}`
+      );
+    }
+  }
+  const packageDir = join13(treeDir, "node_modules", name);
+  await mkdir6(packageDir, { recursive: true });
+  await cp3(sourceDir, packageDir, {
+    recursive: true,
+    filter: (src) => !src.includes("node_modules")
+  });
+  const entryModule = await entryPointOf(treeDir, name);
+  await writeContext(dir, entryModule);
+  return {
+    dir,
+    treeDigest: await digestOfTree(treeDir),
+    contentDigest: await digestOfDirectory(sourceDir),
+    entryModule,
+    cleanup: () => rm4(dir, { recursive: true, force: true })
+  };
+}
+
+// ../sandbox/src/session.ts
+var DEFAULT_LIMITS = { pids: 256, memoryMb: 512, cpus: 1 };
+function runArgv(name, spec) {
+  const limits = spec.limits ?? DEFAULT_LIMITS;
+  assertSafeToken(name, "container name");
+  assertSafeImage(spec.image);
+  const argv = [
+    "run",
+    "--rm",
+    "-i",
+    "--name",
+    name,
+    "--label",
+    "rigorrun.harness=1",
+    "--network",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--user",
+    "65532:65532",
+    "--pids-limit",
+    String(limits.pids),
+    "--memory",
+    `${limits.memoryMb}m`,
+    // Equal to --memory, so the limit cannot be sidestepped by swapping.
+    "--memory-swap",
+    `${limits.memoryMb}m`,
+    "--cpus",
+    String(limits.cpus),
+    // /work is not noexec: a native addon is dlopen'd and would fail. /tmp is.
+    "--tmpfs",
+    "/work:rw,nosuid,nodev,size=256m,mode=1777",
+    "--tmpfs",
+    "/tmp:rw,noexec,nosuid,nodev,size=64m,mode=1777",
+    spec.image,
+    ...spec.command ?? []
+  ];
+  assertPostureIntact(argv);
+  return argv;
+}
+var ContainerSession = class {
+  name;
+  argv;
+  removed = false;
+  constructor(spec) {
+    this.name = `rigorrun-verify-${prefixedId("c").replace(/[^a-z0-9]/gi, "").slice(0, 20)}`;
+    this.argv = runArgv(this.name, spec);
+  }
+  /** Reads the writable mounts. The surface everything else is measured on. */
+  async statedump() {
+    const result = await execInContainer(this.name, ["/rigorrun/statedump"], 12e4);
+    if (result.code !== 0) return "";
+    return result.stdout;
+  }
+  async processList() {
+    const result = await execInContainer(this.name, ["/rigorrun/pslist"], 6e4);
+    return result.code === 0 ? result.stdout : "";
+  }
+  /**
+   * Whether the read-only posture actually held.
+   *
+   * `docker diff` always reports the tmpfs mount points themselves — they are
+   * directories created in the container layer at start — so those are not
+   * evidence of anything. Anything else appearing here means a write reached
+   * the image layer, which under `--read-only` should be impossible, and is
+   * recorded as the posture having failed rather than quietly ignored.
+   */
+  async layerChanges() {
+    const changes = await containerLayerChanges(this.name);
+    const mounts = /* @__PURE__ */ new Set(["A /work", "A /tmp", "C /work", "C /tmp"]);
+    return changes.filter((entry2) => !mounts.has(entry2));
+  }
+  /** Idempotent, and safe to call from a signal handler. */
+  async remove() {
+    if (this.removed) return;
+    this.removed = true;
+    await forceRemove(this.name);
+  }
+};
+
+// ../sandbox/src/surfaces.ts
+function parseStatedump(output) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const line2 of output.split("\n")) {
+    const separator = line2.indexOf("  ");
+    if (separator <= 0) continue;
+    const digest = line2.slice(0, separator);
+    const path = line2.slice(separator + 2);
+    if (path.length === 0) continue;
+    entries.set(path, digest);
+  }
+  return entries;
+}
+function diffReadings(before, after) {
+  const created = [];
+  const modified = [];
+  const deleted = [];
+  for (const [path, digest] of after.entries) {
+    const previous = before.entries.get(path);
+    if (previous === void 0) created.push(path);
+    else if (previous !== digest) modified.push(path);
+  }
+  for (const path of before.entries.keys()) {
+    if (!after.entries.has(path)) deleted.push(path);
+  }
+  return { created: created.sort(), modified: modified.sort(), deleted: deleted.sort() };
+}
+function isEmpty(delta2) {
+  return delta2.created.length === 0 && delta2.modified.length === 0 && delta2.deleted.length === 0;
+}
+function destroyedAnything(delta2) {
+  return delta2.deleted.length > 0 || delta2.modified.length > 0;
+}
+function touchedPaths(delta2) {
+  return [...delta2.created, ...delta2.modified, ...delta2.deleted].sort();
+}
+
+// ../sandbox/src/verify.ts
+import { rm as rm5 } from "node:fs/promises";
+
+// ../conformance/src/plan.ts
+var FORBIDDEN = /[/\\*?~]|\.\./;
+var MAX_STRING = 64;
+function isObject4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function declaredType(node) {
+  const t = node["type"];
+  if (typeof t === "string") return t;
+  if (Array.isArray(t)) {
+    const first = t.find((entry2) => typeof entry2 === "string" && entry2 !== "null");
+    if (typeof first === "string") return first;
+  }
+  if (Array.isArray(node["enum"]) || node["const"] !== void 0) return "string";
+  if (isObject4(node["properties"])) return "object";
+  return void 0;
+}
+function token(seed, pointer) {
+  let h = 2166136261;
+  for (const ch of `${seed}${pointer}`) {
+    h ^= ch.charCodeAt(0);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return `rr-${h.toString(16).padStart(8, "0")}`;
+}
+function synth(node, pointer, depth, ctx) {
+  if (ctx.blocked) return void 0;
+  if (depth > SCHEMA_LIMITS.maxDepth) {
+    ctx.blocked = `the schema nests deeper than ${SCHEMA_LIMITS.maxDepth} levels at ${pointer}`;
+    return void 0;
+  }
+  if (++ctx.nodes > SCHEMA_LIMITS.maxNodes) {
+    ctx.blocked = "the schema is larger than RigorRun will walk";
+    return void 0;
+  }
+  if (!isObject4(node)) {
+    ctx.blocked = `no schema for ${pointer}`;
+    return void 0;
+  }
+  if (node["const"] !== void 0) {
+    ctx.derivation.push(`${pointer}: the schema's single allowed value`);
+    return node["const"];
+  }
+  if (Array.isArray(node["enum"])) {
+    const values = [...node["enum"]];
+    if (values.length === 0) {
+      ctx.blocked = `${pointer} allows no values`;
+      return void 0;
+    }
+    values.sort((a, b) => String(a).localeCompare(String(b)));
+    ctx.derivation.push(`${pointer}: first of ${values.length} allowed values, sorted`);
+    return values[0];
+  }
+  switch (declaredType(node)) {
+    case "boolean":
+      ctx.derivation.push(`${pointer}: false`);
+      return false;
+    case "integer":
+    case "number": {
+      const min = typeof node["minimum"] === "number" ? node["minimum"] : void 0;
+      const max = typeof node["maximum"] === "number" ? node["maximum"] : void 0;
+      let n = 1;
+      if (min !== void 0 && n < min) n = min;
+      if (max !== void 0 && n > max) n = max;
+      ctx.derivation.push(`${pointer}: ${n}, inside any declared bounds`);
+      return n;
+    }
+    case "string": {
+      if (typeof node["pattern"] === "string") {
+        ctx.blocked = `${pointer} constrains its value by pattern, which RigorRun will not guess`;
+        return void 0;
+      }
+      if (node["format"] === "date-time") {
+        ctx.derivation.push(`${pointer}: a fixed timestamp`);
+        return "2026-01-01T00:00:00.000Z";
+      }
+      const value = token(ctx.seed, pointer);
+      ctx.derivation.push(`${pointer}: an inert generated token`);
+      return value;
+    }
+    case "array": {
+      const items = node["items"];
+      if (items === void 0) {
+        ctx.blocked = `${pointer} is an array but does not say of what`;
+        return void 0;
+      }
+      const element = synth(items, `${pointer}/0`, depth + 1, ctx);
+      if (ctx.blocked) return void 0;
+      ctx.derivation.push(`${pointer}: exactly one element`);
+      return [element];
+    }
+    case "object": {
+      const props = node["properties"];
+      if (!isObject4(props)) {
+        ctx.derivation.push(`${pointer}: an empty object`);
+        return {};
+      }
+      const required = Array.isArray(node["required"]) ? node["required"].filter((r) => typeof r === "string") : [];
+      const out = {};
+      for (const key of required) {
+        const child = props[key];
+        if (child === void 0) {
+          ctx.blocked = `${pointer} requires "${key}" but does not describe it`;
+          return void 0;
+        }
+        out[key] = synth(child, `${pointer}/${key}`, depth + 1, ctx);
+        if (ctx.blocked) return void 0;
+      }
+      return out;
+    }
+    default:
+      ctx.blocked = `${pointer} declares no type RigorRun can produce a value for`;
+      return void 0;
+  }
+}
+function assertInert(value, pointer) {
+  if (typeof value === "string") {
+    if (value.length > MAX_STRING) return `${pointer} would need a string longer than ${MAX_STRING}`;
+    if (FORBIDDEN.test(value)) return `${pointer} would need a value containing a path or wildcard`;
+  }
+  if (Array.isArray(value)) {
+    for (const [i, entry2] of value.entries()) {
+      const bad = assertInert(entry2, `${pointer}/${i}`);
+      if (bad) return bad;
+    }
+  }
+  if (isObject4(value)) {
+    for (const [key, entry2] of Object.entries(value)) {
+      const bad = assertInert(entry2, `${pointer}/${key}`);
+      if (bad) return bad;
+    }
+  }
+  return void 0;
+}
+function planTool(input) {
+  if (input.hints.destructive === true) {
+    return {
+      class: "UNSAFE_TO_EXERCISE",
+      reason: "the server declares this tool destructive, and RigorRun takes that at its word"
+    };
+  }
+  if (input.needsCredential?.includes(input.name)) {
+    return {
+      class: "NEEDS_CREDENTIAL",
+      reason: "the operator declared that this tool needs a credential"
+    };
+  }
+  const ctx = { seed: input.seed, derivation: [], nodes: 0 };
+  const args = synth(input.inputSchema, "", 0, ctx);
+  if (ctx.blocked) return { class: "UNDETERMINED", reason: ctx.blocked };
+  if (!isObject4(args)) {
+    return { class: "UNDETERMINED", reason: "the tool does not take an object of arguments" };
+  }
+  const unsafe = assertInert(args, "");
+  if (unsafe) return { class: "UNDETERMINED", reason: unsafe };
+  return { class: "SAFE_AUTOMATIC", args, derivation: ctx.derivation };
+}
+
+// ../conformance/src/judge.ts
+var AUTHORITATIVE_SURFACES = ["container_fs", "process_table"];
+function strongestSurface(surfaces) {
+  return AUTHORITATIVE_SURFACES.find((s) => surfaces.includes(s)) ?? (surfaces.includes("server_reads") ? "server_reads" : void 0);
+}
+function canConvict(surfaces) {
+  return AUTHORITATIVE_SURFACES.some((s) => surfaces.includes(s));
+}
+function entry(claim, verdict2, severity, permissionRelevant, because, observed) {
+  const surface = strongestSurface(observed.surfaces);
+  return {
+    claim,
+    verdict: verdict2,
+    severity,
+    permissionRelevant,
+    because,
+    ...surface ? { surface } : {},
+    evidenceRef: observed.evidenceRef
+  };
+}
+function judge(hints, observed) {
+  const out = [];
+  if (hints.readOnly === true) {
+    const claim = "readOnlyHint: true";
+    if (observed.mutatesState === "yes" && canConvict(observed.surfaces)) {
+      out.push(
+        entry(
+          claim,
+          "CONTRADICTED",
+          "CRITICAL",
+          true,
+          "the tool declares itself read-only and was observed changing state RigorRun read independently of the server",
+          observed
+        )
+      );
+    } else if (observed.mutatesState === "yes") {
+      out.push(
+        entry(
+          claim,
+          "UNDETERMINED",
+          "INFO",
+          false,
+          "a change was seen only through the server\u2019s own tools, which is the same server that would have to be wrong for this to be a contradiction",
+          observed
+        )
+      );
+    } else if (observed.mutatesState === "no" && canConvict(observed.surfaces)) {
+      out.push(entry(claim, "CONFORMS", "INFO", false, "no state change was observed", observed));
+    } else {
+      out.push(
+        entry(
+          claim,
+          "UNDETERMINED",
+          "INFO",
+          false,
+          "RigorRun could not read any state that would prove or disprove this",
+          observed
+        )
+      );
+    }
+  }
+  if (hints.readOnly === false) {
+    const claim = "readOnlyHint: false";
+    if (observed.mutatesState === "yes") {
+      out.push(entry(claim, "CONFORMS", "INFO", false, "the tool changed state, as declared", observed));
+    } else {
+      out.push(
+        entry(
+          claim,
+          "UNDETERMINED",
+          "INFO",
+          false,
+          "the tool declares that it writes and nothing durable changed, which RigorRun cannot separate from a write held only in the process\u2019s memory",
+          observed
+        )
+      );
+    }
+  }
+  if (hints.destructive === false) {
+    const claim = "destructiveHint: false";
+    if (observed.destroyed === "yes" && canConvict(observed.surfaces)) {
+      out.push(
+        entry(
+          claim,
+          "CONTRADICTED",
+          "CRITICAL",
+          true,
+          "the tool declares that it destroys nothing, and was observed deleting or overwriting existing state",
+          observed
+        )
+      );
+    } else if (observed.destroyed === "no" && canConvict(observed.surfaces)) {
+      out.push(
+        entry(claim, "CONFORMS", "INFO", false, "nothing was deleted or overwritten", observed)
+      );
+    } else {
+      out.push(
+        entry(
+          claim,
+          "UNDETERMINED",
+          "INFO",
+          false,
+          "RigorRun could not establish whether anything was destroyed",
+          observed
+        )
+      );
+    }
+  }
+  if (hints.idempotent === true) {
+    const claim = "idempotentHint: true";
+    if (observed.idempotent === "no" && canConvict(observed.surfaces)) {
+      out.push(
+        entry(
+          claim,
+          "CONTRADICTED",
+          "MAJOR",
+          false,
+          "a second identical call changed state again, so repeating it is not free",
+          observed
+        )
+      );
+    } else if (observed.idempotent === "yes") {
+      out.push(
+        entry(claim, "CONFORMS", "INFO", false, "a second identical call changed nothing", observed)
+      );
+    } else {
+      out.push(
+        entry(
+          claim,
+          "UNDETERMINED",
+          "INFO",
+          false,
+          "the tool was not called twice, so idempotence was not tested",
+          observed
+        )
+      );
+    }
+  }
+  return out;
+}
+
+// ../conformance/src/exit.ts
+var DEFAULT_THRESHOLDS = {
+  maxUndetermined: 0,
+  minExercised: 1,
+  strict: false
+};
+var BLOCKING = /* @__PURE__ */ new Set(["MAJOR", "CRITICAL"]);
+function exitCodeFor(record, thresholds = DEFAULT_THRESHOLDS) {
+  const contradicted = record.tools.flatMap(
+    (tool) => tool.conformance.filter((c2) => c2.verdict === "CONTRADICTED")
+  );
+  const blocking = contradicted.filter(
+    (c2) => BLOCKING.has(c2.severity) || thresholds.strict && c2.severity === "MINOR"
+  );
+  if (blocking.length > 0) return 1;
+  if (record.summary.toolsExercised < thresholds.minExercised) return 3;
+  if (record.summary.undetermined > thresholds.maxUndetermined) return 3;
+  return 0;
+}
+function exitReason(code, record) {
+  switch (code) {
+    case 0: {
+      const minor = record.tools.flatMap(
+        (t) => t.conformance.filter((c2) => c2.verdict === "CONTRADICTED")
+      ).length;
+      return minor === 0 ? `${record.summary.toolsExercised} tool(s) exercised, no declaration contradicted.` : `${record.summary.toolsExercised} tool(s) exercised. ${minor} declaration(s) contradicted, none of them blocking; --strict would fail on these.`;
+    }
+    case 1: {
+      const n = record.tools.flatMap(
+        (t) => t.conformance.filter((c2) => c2.verdict === "CONTRADICTED")
+      ).length;
+      return `${n} declaration(s) contradicted by observed behaviour.`;
+    }
+    case 3:
+      return `${record.summary.undetermined} finding(s) undetermined and ${record.summary.toolsExercised} tool(s) exercised. Verification completed but did not establish enough to be worth much.`;
+    default:
+      return "The verification could not be run.";
+  }
+}
+
+// ../sandbox/src/verify.ts
+var VerifyError = class extends Error {
+};
+var HARNESS_VERSION = RIGORRUN_VERSION;
+function reading(surface, dump) {
+  return { surface, entries: parseStatedump(dump), readable: dump.length > 0 };
+}
+async function openInContainer(session, timeoutMs) {
+  return McpConnection.open(
+    {
+      transport: "stdio",
+      command: "docker",
+      args: session.argv,
+      // The docker *client* needs to know which daemon to talk to. The
+      // container itself gets no environment at all — there is no -e flag in
+      // the argv, and that is deliberate.
+      env: dockerEndpointEnv()
+    },
+    { timeoutMs }
+  );
+}
+function dockerEndpointEnv() {
+  const out = {};
+  for (const name of ["DOCKER_HOST", "DOCKER_CONTEXT", "DOCKER_CERT_PATH", "DOCKER_TLS_VERIFY"]) {
+    const value = process.env[name];
+    if (value !== void 0) out[name] = value;
+  }
+  return out;
+}
+async function proveIsolation(image, limits, rounds, entry2) {
+  const digests = [];
+  const pathSets = [];
+  for (let i = 0; i < rounds; i += 1) {
+    const session = new ContainerSession({ image, limits, command: [entry2] });
+    let connection;
+    try {
+      connection = await openInContainer(session, 6e4);
+      const dump = await session.statedump();
+      const parsed = parseStatedump(dump);
+      digests.push(await hashValue([...parsed.entries()].sort()));
+      pathSets.push([...parsed.keys()].sort());
+    } finally {
+      await connection?.close();
+      await session.remove();
+    }
+  }
+  const stable = digests.every((d) => d === digests[0]);
+  const first = pathSets[0] ?? [];
+  const pathsStable = pathSets.every(
+    (set) => set.length === first.length && set.every((p, i) => p === first[i])
+  );
+  return { digests, stable, pathsStable, unstable: stable ? [] : first.slice(0, 0) };
+}
+async function verifyServer(reference, options = {}) {
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const progress = options.onProgress ?? (() => void 0);
+  const limits = options.limits ?? DEFAULT_LIMITS;
+  const seed = options.seed ?? "rigorrun-v2";
+  const ref2 = parseReference(reference);
+  const runtime = await inspectRuntime();
+  if (!runtime.available) {
+    throw new VerifyError(
+      `RigorRun needs a container runtime to verify a server, and could not reach one.
+  ${runtime.detail}
+Install Docker or Podman and start it, then run \`rigorrun doctor\` to check. This is a configuration problem, not a finding about the server.`
+    );
+  }
+  progress("resolve", ref2.raw);
+  let staged;
+  let digest;
+  let resolvedVersion;
+  let tarballUrl = "";
+  if (ref2.scheme === "npm") {
+    const pkg = await resolvePackage(ref2.name, ref2.version);
+    resolvedVersion = pkg.version;
+    digest = pkg.integrity;
+    tarballUrl = pkg.tarballUrl;
+    progress("fetch", `${pkg.name}@${pkg.version}`);
+    await fetchVerifiedTarball(pkg);
+    progress("stage", "installing with lifecycle scripts disabled");
+    staged = await stageNpmPackage(pkg.name, pkg.version);
+  } else {
+    progress("stage", ref2.name);
+    staged = await stageDirectory(ref2.name);
+    resolvedVersion = "local";
+    digest = `dirhash:${staged.contentDigest}`;
+  }
+  const imageTag = `rigorrun-target:${prefixedId("t").replace(/[^a-z0-9]/gi, "").slice(0, 12)}`;
+  const cases = [];
+  const toolRecords = [];
+  const untested = [];
+  let readonlyVerified;
+  let serverInfo;
+  try {
+    progress("image", BASE_IMAGE_TAG);
+    await pullImage(BASE_IMAGE_TAG).catch(() => void 0);
+    const baseDigest = await imageDigest(BASE_IMAGE_TAG) || BASE_IMAGE_TAG;
+    await buildImage(staged.dir, imageTag);
+    progress("isolation", "measuring whether reset actually resets");
+    const proof = await proveIsolation(imageTag, limits, options.resetProofs ?? 2, staged.entryModule);
+    progress("launch", "starting the server");
+    const session = new ContainerSession({ image: imageTag, limits, command: [staged.entryModule] });
+    let connection;
+    let tools = [];
+    try {
+      connection = await openInContainer(session, 12e4);
+      tools = [...connection.discovery.tools];
+      serverInfo = {
+        name: connection.discovery.serverName,
+        version: connection.discovery.serverVersion,
+        protocolVersion: connection.discovery.protocolVersion
+      };
+      progress("discover", `${tools.length} tool(s)`);
+      const layer = await session.layerChanges();
+      readonlyVerified = layer.length === 0;
+    } finally {
+      await connection?.close();
+      await session.remove();
+    }
+    const ordered = [...tools].sort((a, b) => {
+      const rank2 = (t) => t.hints.readOnly === true ? 0 : 1;
+      return rank2(a) - rank2(b) || a.name.localeCompare(b.name);
+    });
+    for (const tool of ordered) {
+      const plan = planTool({
+        name: tool.name,
+        inputSchema: tool.inputSchema ?? {},
+        hints: tool.hints,
+        seed,
+        ...options.needsCredential ? { needsCredential: options.needsCredential } : {}
+      });
+      if (plan.class !== "SAFE_AUTOMATIC") {
+        untested.push({ tool: tool.name, reason: plan.class, detail: plan.reason });
+        toolRecords.push({
+          name: tool.name,
+          description: tool.description,
+          declared: declaredOf(tool),
+          observed: {
+            mutatesState: "undetermined",
+            surfacesTouched: [],
+            wrote: [],
+            sideEffects: [],
+            idempotent: "not-probed",
+            errorBehavior: []
+          },
+          // Deliberately empty. A tool RigorRun chose not to call has not been
+          // found undetermined about anything -- it is in `untested`, with the
+          // reason, and that is the honest place for it. Emitting a verdict per
+          // annotation here would make declining to touch a destructive tool
+          // look like three inconclusive findings.
+          conformance: [],
+          verification: "OBSERVATIONAL"
+        });
+        continue;
+      }
+      progress("exercise", tool.name);
+      const observation = await exerciseTool(tool, plan.args, plan.derivation, {
+        image: imageTag,
+        limits,
+        entry: staged.entryModule,
+        cases
+      });
+      if (observation.refusedWithoutEffect) {
+        untested.push({
+          tool: tool.name,
+          reason: "NEEDS_FIXTURE",
+          detail: observation.errorBehavior[0] ?? "the tool refused generated arguments and changed nothing"
+        });
+        toolRecords.push({
+          name: tool.name,
+          description: tool.description,
+          declared: declaredOf(tool),
+          observed: {
+            mutatesState: "undetermined",
+            surfacesTouched: [],
+            wrote: [],
+            sideEffects: [],
+            idempotent: "not-probed",
+            errorBehavior: observation.errorBehavior
+          },
+          conformance: [],
+          verification: "OBSERVATIONAL"
+        });
+        continue;
+      }
+      toolRecords.push({
+        name: tool.name,
+        description: tool.description,
+        declared: declaredOf(tool),
+        observed: {
+          mutatesState: observation.behavior.mutatesState,
+          surfacesTouched: observation.behavior.surfaces,
+          wrote: observation.wrote,
+          sideEffects: observation.sideEffects,
+          idempotent: observation.behavior.idempotent,
+          errorBehavior: observation.errorBehavior
+        },
+        conformance: judge(tool.hints, observation.behavior),
+        // The strongest honest label: the filesystem enumeration is complete
+        // over durable state but blind to memory, so it is PARTIAL.
+        verification: observation.behavior.surfaces.includes("container_fs") ? "PARTIAL" : "OBSERVATIONAL"
+      });
+    }
+    const conformance = toolRecords.flatMap((t) => t.conformance);
+    const record = VerificationRecordSchema.parse({
+      schema: VERIFICATION_RECORD_SCHEMA,
+      schemaVersion: RECORD_SCHEMA_VERSION,
+      recordId: prefixedId("rec"),
+      target: {
+        ref: ref2.raw,
+        scheme: ref2.scheme,
+        resolvedVersion,
+        digest,
+        treeDigest: staged.treeDigest,
+        tarballUrl,
+        fetchedAt: startedAt
+      },
+      harness: {
+        version: HARNESS_VERSION,
+        runtime: `docker ${runtime.version}`,
+        rootless: runtime.rootless,
+        baseImage: baseDigest,
+        imageId: imageTag,
+        isolation: proof.stable ? "RESET" : proof.pathsStable ? "PARTIAL" : "NONE",
+        isolationProof: {
+          resets: proof.digests.length,
+          initialDigests: proof.digests,
+          unstablePaths: proof.unstable
+        },
+        networkEgress: false,
+        readonlyVerified,
+        installScripts: "skipped",
+        limits: { pids: limits.pids, memoryMb: limits.memoryMb, cpus: limits.cpus },
+        runArgv: new ContainerSession({ image: imageTag, limits }).argv,
+        seed,
+        caveats: [
+          ...runtime.rootless ? [] : [ROOTFUL_DAEMON_CAVEAT],
+          SERVER_READS_CAVEAT,
+          "State is read from the container\u2019s writable mounts, which is complete over durable storage and blind to state a process holds only in memory."
+        ]
+      },
+      server: serverInfo,
+      tools: toolRecords,
+      untested,
+      cases,
+      summary: {
+        toolsDiscovered: tools.length,
+        toolsExercised: toolRecords.filter((t) => t.conformance.length > 0).length,
+        conforms: conformance.filter((c2) => c2.verdict === "CONFORMS").length,
+        contradicted: conformance.filter((c2) => c2.verdict === "CONTRADICTED").length,
+        undetermined: conformance.filter((c2) => c2.verdict === "UNDETERMINED").length,
+        untested: untested.length
+      },
+      startedAt,
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return { ...record, recordHash: await hashValue({ ...record, recordHash: "" }) };
+  } finally {
+    await removeImage(imageTag).catch(() => void 0);
+    await staged.cleanup().catch(() => void 0);
+    await rm5(staged.dir, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+function declaredOf(tool) {
+  const { readOnly, destructive, idempotent, openWorld } = tool.hints;
+  return {
+    ...readOnly !== void 0 ? { readOnlyHint: readOnly } : {},
+    ...destructive !== void 0 ? { destructiveHint: destructive } : {},
+    ...idempotent !== void 0 ? { idempotentHint: idempotent } : {},
+    ...openWorld !== void 0 ? { openWorldHint: openWorld } : {}
+  };
+}
+async function exerciseTool(tool, args, derivation, ctx) {
+  const session = new ContainerSession({
+    image: ctx.image,
+    limits: ctx.limits,
+    command: [ctx.entry]
+  });
+  let connection;
+  const errorBehavior = [];
+  try {
+    connection = await openInContainer(session, 12e4);
+    const before = reading("container_fs", await session.statedump());
+    const firstId = `case:${ctx.cases.length + 1}`;
+    const first = await connection.call(tool.name, args, 6e4);
+    const afterFirst = reading("container_fs", await session.statedump());
+    const delta2 = diffReadings(before, afterFirst);
+    if (!first.ok) errorBehavior.push(first.error?.message ?? "the call returned an error");
+    ctx.cases.push({
+      id: firstId,
+      tool: tool.name,
+      args,
+      derivation,
+      ok: first.ok,
+      isError: !first.ok,
+      errorText: first.error?.message ?? "",
+      beforeDigest: await hashValue([...before.entries.entries()].sort()),
+      afterDigest: await hashValue([...afterFirst.entries.entries()].sort()),
+      changedPaths: touchedPaths(delta2),
+      durationMs: first.durationMs,
+      stderrExcerpt: ""
+    });
+    let idempotent = "not-probed";
+    if (first.ok) {
+      const second = await connection.call(tool.name, args, 6e4);
+      const afterSecond = reading("container_fs", await session.statedump());
+      const secondDelta = diffReadings(afterFirst, afterSecond);
+      idempotent = isEmpty(secondDelta) ? "yes" : "no";
+      ctx.cases.push({
+        id: `case:${ctx.cases.length + 1}`,
+        tool: tool.name,
+        args,
+        derivation: ["repeat of the previous case, to test idempotence"],
+        ok: second.ok,
+        isError: !second.ok,
+        errorText: second.error?.message ?? "",
+        beforeDigest: await hashValue([...afterFirst.entries.entries()].sort()),
+        afterDigest: await hashValue([...afterSecond.entries.entries()].sort()),
+        changedPaths: touchedPaths(secondDelta),
+        durationMs: second.durationMs,
+        stderrExcerpt: ""
+      });
+    }
+    const readable = before.readable && afterFirst.readable;
+    const surfaces = readable ? ["container_fs"] : [];
+    return {
+      behavior: {
+        // Unreadable is undetermined. It is never quietly turned into "no".
+        mutatesState: !readable ? "undetermined" : isEmpty(delta2) ? "no" : "yes",
+        destroyed: !readable ? "undetermined" : destroyedAnything(delta2) ? "yes" : "no",
+        idempotent,
+        surfaces,
+        evidenceRef: firstId
+      },
+      wrote: touchedPaths(delta2),
+      sideEffects: [],
+      errorBehavior,
+      refusedWithoutEffect: !first.ok && isEmpty(delta2)
+    };
+  } finally {
+    await connection?.close();
+    await session.remove();
+  }
+}
+
 // src/doctor.ts
 async function cmdDoctor(flags) {
   const checks = [];
@@ -15674,6 +17224,12 @@ async function cmdDoctor(flags) {
     ok: "unknown",
     detail: backend ? `${backend.kind} \u2014 ${backend.detail}` : "could not be determined"
   });
+  const runtime = await inspectRuntime();
+  checks.push({
+    what: "container runtime",
+    ok: runtime.available ? true : "unknown",
+    detail: runtime.available ? `docker ${runtime.version}${runtime.rootless ? " (rootless)" : " \u2014 daemon runs as root, so an escape reaches this host"}` : `none \u2014 \`rigorrun verify\` needs one. ${runtime.detail}`
+  });
   const proxy = new ProxyServer();
   try {
     const port = await proxy.start();
@@ -15764,7 +17320,7 @@ async function cmdDoctor(flags) {
   if (flags.json) {
     line(JSON.stringify({ machine: checks, projects: perProject }, null, 2));
   }
-  const failed = [...checks, ...perProject.flatMap((entry) => entry.checks)].some(
+  const failed = [...checks, ...perProject.flatMap((entry2) => entry2.checks)].some(
     (check) => check.ok === false
   );
   return failed ? 2 : 0;
@@ -15781,7 +17337,7 @@ function printChecks(checks) {
 }
 
 // src/feedback.ts
-import { writeFile as writeFile3 } from "node:fs/promises";
+import { writeFile as writeFile4 } from "node:fs/promises";
 async function cmdFeedbackExport(flags) {
   const store = new ProjectStore(storeRoot(flags.home));
   const bundle = await buildFeedbackBundle({ store, version: VERSION });
@@ -15795,7 +17351,7 @@ async function cmdFeedbackExport(flags) {
   const json = `${JSON.stringify(bundle, null, 2)}
 `;
   if (flags.out) {
-    await writeFile3(flags.out, json, { mode: 384 });
+    await writeFile4(flags.out, json, { mode: 384 });
     heading("Feedback bundle");
     line(`Written to ${flags.out}`);
     line();
@@ -15807,6 +17363,92 @@ async function cmdFeedbackExport(flags) {
   return 0;
 }
 
+// src/verify.ts
+import { writeFile as writeFile5, mkdir as mkdir7 } from "node:fs/promises";
+import { dirname as dirname4, join as join14 } from "node:path";
+var RUNTIME_FAILURES = [ReferenceError, RegistryError, DockerError, StageError, VerifyError];
+function isRuntimeFailure(error) {
+  return RUNTIME_FAILURES.some((type) => error instanceof type);
+}
+async function cmdVerify(reference, flags) {
+  if (!reference) {
+    throw new CliError(
+      "Give a server to verify, for example:\n  rigorrun verify npm:@modelcontextprotocol/server-memory@2026.8.31"
+    );
+  }
+  await reapOrphans2().catch(() => []);
+  let record;
+  try {
+    record = await verifyServer(reference, {
+      ...flags.quiet || flags.json ? {} : { onProgress: (phase, detail) => line(`  ${phase.padEnd(10)} ${detail}`) }
+    });
+  } catch (error) {
+    if (isRuntimeFailure(error)) {
+      throw new CliError(error.message, 2);
+    }
+    throw error;
+  }
+  const outPath = flags.out ?? join14(workspaceDir(), "records", `${record.recordId}.json`);
+  await mkdir7(dirname4(outPath), { recursive: true });
+  await writeFile5(outPath, `${canonicalJson(record)}
+`, "utf8");
+  const code = exitCodeFor(record, {
+    ...DEFAULT_THRESHOLDS,
+    ...flags.maxUndetermined !== void 0 ? { maxUndetermined: flags.maxUndetermined } : {},
+    ...flags.minExercised !== void 0 ? { minExercised: flags.minExercised } : {},
+    strict: flags.strict
+  });
+  if (flags.json) {
+    process.stdout.write(`${JSON.stringify(record, null, 2)}
+`);
+    return code;
+  }
+  render(record, outPath);
+  line("");
+  (code === 0 ? line : errorLine)(exitReason(code, record));
+  return code;
+}
+function render(record, outPath) {
+  line("");
+  line(`${record.target.ref}`);
+  line(`  resolved   ${record.target.resolvedVersion}`);
+  line(`  digest     ${record.target.digest}`);
+  line(`  runtime    ${record.harness.runtime}${record.harness.rootless ? " (rootless)" : ""}`);
+  line(`  isolation  ${record.harness.isolation}`);
+  line(`  egress     ${record.harness.networkEgress ? "permitted" : "none"}`);
+  line("");
+  const rows6 = record.tools.flatMap(
+    (tool) => tool.conformance.length === 0 ? [[tool.name, "\u2014", "no annotation to check", tool.verification]] : tool.conformance.map((c2) => [tool.name, c2.claim, c2.verdict, tool.verification])
+  );
+  if (rows6.length > 0) {
+    line("Declared, versus what it did");
+    table(["tool", "declared", "result", "verification"], rows6);
+  }
+  const contradictions = record.tools.flatMap(
+    (tool) => tool.conformance.filter((c2) => c2.verdict === "CONTRADICTED").map((c2) => ({ tool: tool.name, c: c2, wrote: tool.observed.wrote }))
+  );
+  for (const { tool, c: c2, wrote } of contradictions) {
+    line("");
+    errorLine(`${tool} \u2014 ${c2.claim} is CONTRADICTED${c2.permissionRelevant ? ", and that widens what an agent may do without asking" : ""}`);
+    line(`  ${c2.because}.`);
+    if (wrote.length > 0) line(`  wrote ${wrote.join(", ")}`);
+  }
+  line("");
+  if (record.untested.length === 0) {
+    line("Every discovered tool was exercised.");
+  } else {
+    line("Not exercised");
+    table(
+      ["tool", "why"],
+      record.untested.map((u) => [u.tool, `${u.reason} \u2014 ${u.detail}`])
+    );
+  }
+  line("");
+  for (const caveat of record.harness.caveats) line(`  \xB7 ${caveat}`);
+  line("");
+  line(`Record written to ${outPath}`);
+}
+
 // src/project.ts
 async function withService(home, run) {
   const proxy = new ProxyServer();
@@ -15849,9 +17491,9 @@ async function cmdProjects(flags) {
   if (broken.length > 0) {
     line();
     heading(`${broken.length} project(s) could not be read`);
-    for (const entry of broken) {
-      line(`  ${c.red(entry.id)}  ${entry.reason}`);
-      line(c.grey(`    ${entry.detail}`));
+    for (const entry2 of broken) {
+      line(`  ${c.red(entry2.id)}  ${entry2.reason}`);
+      line(c.grey(`    ${entry2.detail}`));
     }
     return 2;
   }
@@ -15863,7 +17505,7 @@ async function cmdProjectRun(projectId, flags) {
     const project = await service.readProject(projectId).catch(() => {
       throw new CliError(`No project "${projectId}" on this machine. Try \`rigorrun projects\`.`);
     });
-    const agent = flags.agent[0] ? project.agents.find((entry) => entry.id === flags.agent[0] || entry.name === flags.agent[0]) : project.agents[project.agents.length - 1];
+    const agent = flags.agent[0] ? project.agents.find((entry2) => entry2.id === flags.agent[0] || entry2.name === flags.agent[0]) : project.agents[project.agents.length - 1];
     if (!agent) {
       throw new CliError(
         project.agents.length === 0 ? `${project.name} has no agent connected. Connect one in the interface first.` : `No agent "${flags.agent[0]}" on ${project.name}.`
@@ -15875,8 +17517,8 @@ async function cmdProjectRun(projectId, flags) {
     if (comparison2 && comparison2.currentRunId !== comparison2.baselineRunId) {
       line();
       line(`${c.bold("Against the baseline")}  ${comparison2.headline}`);
-      for (const entry of comparison2.regressed.slice(0, 10)) {
-        line(`  ${c.red("regressed")} ${entry.caseName} \u2014 ${entry.detail}`);
+      for (const entry2 of comparison2.regressed.slice(0, 10)) {
+        line(`  ${c.red("regressed")} ${entry2.caseName} \u2014 ${entry2.detail}`);
       }
     }
     const score = result.scores[0];
@@ -15889,7 +17531,7 @@ async function cmdProjectGate(projectId, flags) {
     const project = await service.readProject(projectId).catch(() => {
       throw new CliError(`No project "${projectId}" on this machine.`);
     });
-    const agent = flags.agent[0] ? project.agents.find((entry) => entry.id === flags.agent[0] || entry.name === flags.agent[0]) : project.agents[project.agents.length - 1];
+    const agent = flags.agent[0] ? project.agents.find((entry2) => entry2.id === flags.agent[0] || entry2.name === flags.agent[0]) : project.agents[project.agents.length - 1];
     if (!agent) throw new CliError(`${project.name} has no agent to gate.`);
     const result = await service.runAgent(projectId, agent.id);
     const score = result.scores[0];
@@ -15921,6 +17563,12 @@ async function cmdProjectGate(projectId, flags) {
       );
       line();
       line(`${c.grey("verification")}  ${result.verification}   ${c.grey("isolation")}  ${result.isolation}`);
+      if (result.isolation === "DECLARED") {
+        line(
+          c.grey("              your system nominated a reset; RigorRun has not run it twice")
+        );
+        line(c.grey("              and compared, so isolation is believed rather than observed"));
+      }
       for (const limit of result.limits) line(`${c.grey("limit")}  ${limit.limit}`);
       line();
       line(failures2.length === 0 ? c.green("PASS") : `${c.red("FAIL")}  ${failures2.join("; ")}`);
@@ -15954,10 +17602,10 @@ async function cmdProjectCompare(projectId, runId, flags) {
     return 2;
   }
   line();
-  for (const entry of comparison2.regressed) line(`  ${c.red("regressed")}  ${entry.caseName} \u2014 ${entry.detail}`);
-  for (const entry of comparison2.improved) line(`  ${c.green("improved")}   ${entry.caseName} \u2014 ${entry.detail}`);
-  for (const entry of comparison2.added) line(`  ${c.grey("added")}      ${entry.caseName}`);
-  for (const entry of comparison2.removed) line(`  ${c.grey("removed")}    ${entry.caseName}`);
+  for (const entry2 of comparison2.regressed) line(`  ${c.red("regressed")}  ${entry2.caseName} \u2014 ${entry2.detail}`);
+  for (const entry2 of comparison2.improved) line(`  ${c.green("improved")}   ${entry2.caseName} \u2014 ${entry2.detail}`);
+  for (const entry2 of comparison2.added) line(`  ${c.grey("added")}      ${entry2.caseName}`);
+  for (const entry2 of comparison2.removed) line(`  ${c.grey("removed")}    ${entry2.caseName}`);
   line();
   line(c.grey(`${comparison2.unchanged.length} case(s) unchanged.`));
   return comparison2.regressed.length > 0 ? 1 : 0;
@@ -15968,7 +17616,7 @@ async function cmdSecret(action, name, flags) {
     const names = (await store.secretNames()).sort();
     const backend = await store.secretBackend();
     heading("Secrets on this machine");
-    for (const entry of names) line(`  ${entry}`);
+    for (const entry2 of names) line(`  ${entry2}`);
     if (names.length === 0) line(c.grey("  none"));
     line();
     line(c.grey(`Kept in ${backend.detail}`));
@@ -16068,10 +17716,17 @@ async function dispatch(argv) {
         force: { type: "boolean", default: false },
         yes: { type: "boolean", default: false },
         as: { type: "string" },
+        // A gate on the reference implementation passes by construction. It
+        // stays reachable for "is this suite satisfiable at all", by name.
+        "allow-reference": { type: "boolean", default: false },
         "min-success": { type: "string" },
         "min-policy": { type: "string" },
         "max-policy-violations": { type: "string" },
         "max-unsafe": { type: "string" },
+        // verify only.
+        "max-undetermined": { type: "string" },
+        "min-exercised": { type: "string" },
+        strict: { type: "boolean", default: false },
         help: { type: "boolean", short: "h", default: false },
         version: { type: "boolean", short: "v", default: false }
       }
@@ -16108,6 +17763,7 @@ async function dispatch(argv) {
     project: values.project,
     home: values.home,
     baseline: values.baseline,
+    allowReference: values["allow-reference"] ?? false,
     minSuccess: rateFlag(values["min-success"], "min-success"),
     minPolicy: rateFlag(values["min-policy"], "min-policy"),
     maxPolicyViolations: numberFlag(values["max-policy-violations"], "max-policy-violations"),
@@ -16183,6 +17839,15 @@ async function dispatch(argv) {
       return cmdInspectEnvironment(target, flags);
     case "privacy":
       return cmdPrivacyInspect(target, parsed.positionals[2], flags.json);
+    case "verify":
+      return cmdVerify(target, {
+        json: flags.json,
+        quiet: flags.quiet,
+        out: flags.out,
+        maxUndetermined: numberFlag(values["max-undetermined"], "max-undetermined"),
+        minExercised: numberFlag(values["min-exercised"], "min-exercised"),
+        strict: values.strict === true
+      });
     case "doctor":
       return cmdDoctor(flags);
     default: