sentinelayer-cli 0.46.5 → 0.48.0

package/src/engram/contracts/index.js

@@ -0,0 +1,149 @@
+/**
+ * ENGRAM §EW02 — Versioned contracts barrel.
+ *
+ * This is the single validated contract set for all parallel agents (ticket
+ * 73ead329). It freezes the graph, capability, evidence, and money contracts
+ * so every consumer validates against the same schemas.
+ *
+ * Module name: agent-web-contracts (per ticket proposal).
+ * Actual location: src/engram/contracts/ (within the detachable ENGRAM tree).
+ */
+
+// Money contract (§ step-9, step-10)
+export {
+  KNOWN_CURRENCIES,
+  moneySchema,
+  migrateLegacyMoney,
+  minorUnitsSchema,
+  decimalStringSchema,
+  toMinorUnits,
+  formatFromMinorUnits,
+  currencyExponent,
+} from "./money.js";
+
+// Graph contract (R02 graph, R09 truth)
+export {
+  MONEY_FIELD_NAMES,
+  PROVENANCE_CLASSES,
+  SCHEMA_VALIDITY,
+  MODEL_CONFIDENCE,
+  provenanceClassSchema,
+  schemaValiditySchema,
+  modelConfidenceSchema,
+  quantitySchema,
+  entitySchema,
+  linkSchema,
+  freshnessSchema,
+  assertionSchema,
+  graphSchema,
+  classifyProvenance,
+  validateGraphIntegrity,
+} from "./graph.js";
+
+// Capability contract (R04 skills, R14 parallelism)
+export {
+  capabilityVersionSchema,
+  tenantScopeSchema,
+  tenantScopeDescriptorSchema,
+  sourceDescriptorSchema,
+  capabilityEntrySchema,
+  negotiationResultSchema,
+  paginationSchema,
+  migrationPolicySchema,
+  CapabilityError,
+  unknownCapability,
+  unsupportedCapability,
+  staleCapability,
+  negotiateCapability,
+} from "./capability.js";
+
+// Evidence contract (R09 truth)
+export {
+  evidenceAddressSchema,
+  evidenceRecordSchema,
+  evidencePageSchema,
+  evidenceMigrationPolicySchema,
+  evidenceFreshnessSchema,
+  EvidenceError,
+  evidenceNotFound,
+  evidenceStale,
+  evidenceUnsupportedScheme,
+  validateNotScreenshotInferred,
+} from "./evidence.js";
+
+// SourceSnapshot contract
+export {
+  sourceSnapshotSchema,
+  VALID_SOURCE_SNAPSHOT,
+  MINIMAL_SOURCE_SNAPSHOT,
+} from "./source-snapshot.js";
+
+// MediaAsset contract
+export {
+  MEDIA_ASSET_TYPES,
+  mediaAssetTypeSchema,
+  mediaAssetSchema,
+  VALID_MEDIA_ASSET,
+} from "./media-asset.js";
+
+// TemporalSegment contract
+export {
+  TEMPORAL_SEGMENT_KINDS,
+  temporalSegmentKindSchema,
+  temporalSegmentSchema,
+  VALID_TEMPORAL_SEGMENT,
+} from "./temporal-segment.js";
+
+// TaskContextPack contract
+export {
+  delegationReferenceSchema,
+  taskContextPackSchema,
+  VALID_TASK_CONTEXT_PACK,
+} from "./task-context-pack.js";
+
+// Contract versions
+export {
+  CONTRACT_VERSIONS,
+  GRAPH_SCHEMA_VERSION,
+  EVIDENCE_SCHEMA_VERSION,
+  COMPAT_FIXTURES,
+} from "./versions.js";
+
+// ActionReceipt contract
+export {
+  ACTION_RECEIPT_STATUSES,
+  actionReceiptStatusSchema,
+  actionReceiptSchema,
+  VALID_ACTION_RECEIPT,
+} from "./action-receipt.js";
+
+// Capability Index contract (EW08)
+export {
+  skillSchema,
+  capabilityIndexSchema,
+  CapabilityIndexError,
+  digestMismatch,
+  indexExpired,
+  originMismatch,
+  capabilityRevoked,
+} from "./capability-index.js";
+
+// Live-state contract (EW14)
+export {
+  FRESHNESS_CLASSES,
+  classifyFreshness,
+  isValidFreshnessClass,
+  createFreshnessMarker,
+  isFreshnessStale,
+  FreshnessClassError,
+  SOURCE_STATUSES,
+  createSourceVersion,
+  resolveAuthoritativeSource,
+  SourceVersionError,
+  mustRevalidate,
+  RevalidationRequiredError,
+  disabledByOutage,
+  SourceOutageError,
+  createCommerceContext,
+  CommerceContextError,
+} from "../live-state.js";

package/src/engram/contracts/media-asset.js

@@ -0,0 +1,85 @@
+/**
+ * ENGRAM §EW02 — MediaAsset contract.
+ *
+ * A MediaAsset represents any media resource referenced by the ENGRAM graph:
+ * images, audio, video, documents, or other binary/textual assets. Every
+ * asset must declare its address scheme, content hash for integrity, and
+ * a source snapshot reference.
+ */
+
+import { z } from "zod";
+import { sourceSnapshotSchema } from "./source-snapshot.js";
+import { sha256ContentHashSchema } from "./content-hash.js";
+
+export const MEDIA_ASSET_TYPES = Object.freeze([
+  "image",
+  "audio",
+  "video",
+  "document",
+  "text",
+  "binary",
+  "other",
+]);
+
+export const mediaAssetTypeSchema = z.enum([
+  "image",
+  "audio",
+  "video",
+  "document",
+  "text",
+  "binary",
+  "other",
+]);
+
+/**
+ * A media asset in the ENGRAM graph.
+ *
+ * Every asset carries a content hash for integrity verification and a
+ * source snapshot for provenance. Assets without a source snapshot cannot
+ * be treated as authoritative evidence.
+ */
+export const mediaAssetSchema = z.object({
+  assetId: z.string().min(1),
+  type: mediaAssetTypeSchema,
+  uri: z.string().min(1),
+  contentHash: sha256ContentHashSchema,
+  mimeType: z.string().optional(),
+  sizeBytes: z.number().int().positive().optional(),
+  sourceSnapshot: sourceSnapshotSchema,
+  metadata: z.record(z.string(), z.json()).optional(),
+  tenantScope: z.string().min(1),
+}).strict().refine(
+  (data) => {
+    // Tenant scope must be consistent: top-level tenantScope must match
+    // the sourceSnapshot's tenantScope, or an explicit authorization boundary
+    // must be declared. Without authorization, cross-tenant is refused.
+    if (data.tenantScope !== data.sourceSnapshot.tenantScope) {
+      return false;
+    }
+    return true;
+  },
+  {
+    message: "tenantScope must match sourceSnapshot.tenantScope; cross-tenant requires explicit authorization",
+    path: ["tenantScope"],
+  },
+);
+
+/**
+ * Valid fixture: a complete, valid media asset.
+ */
+export const VALID_MEDIA_ASSET = Object.freeze({
+  assetId: "ma-img-001",
+  type: "image",
+  uri: "https://evidence.example.com/assets/img-001.png",
+  contentHash: "sha256:a6f2f770889daacf470cedb54e76c426817431a5e18aff6b270f182f22e0d43d",
+  mimeType: "image/png",
+  sizeBytes: 102400,
+  sourceSnapshot: {
+    sourceId: "src-session-abc123",
+    sourceType: "session",
+    version: "1.2.0",
+    capturedAt: "2026-10-23T12:00:00Z",
+    tenantScope: "tenant/acme",
+  },
+  tenantScope: "tenant/acme",
+});

package/src/engram/contracts/money.js

@@ -0,0 +1,249 @@
+/**
+ * ENGRAM §EW02 — Money contract: integer minor units + currency + exponent,
+ * or validated decimal strings. Never binary floats.
+ *
+ * Design constraint (ticket 73ead329): money is integer minor units plus
+ * currency and correct exponent, or validated decimal strings; never binary
+ * floats for totals. This module is the single codified source of truth for
+ * every path that stores, reads, or validates monetary values in ENGRAM.
+ *
+ * Luna-judge F5: use exact BigInt conversion, never floating-point rounding.
+ * Luna-judge F8: minorUnitsSchema must check both safe integer bounds.
+ * Luna-judge P2: validate against a complete currency registry; reject unknown codes.
+ * Luna-judge P2: strict schema — reject extra fields.
+ */
+
+import { z } from "zod";
+
+/**
+ * ISO 4217 currency codes (supported subset validated at runtime).
+ */
+const CURRENCY_RE = /^[A-Z]{3}$/;
+const CURRENCY_MINOR_UNITS = new Map([
+  ["USD", 2], ["EUR", 2], ["GBP", 2], ["JPY", 0], ["KRW", 0],
+  ["CNY", 2], ["INR", 2], ["CAD", 2], ["AUD", 2], ["CHF", 2],
+  ["BRL", 2], ["MXN", 2], ["SEK", 2], ["NOK", 2], ["DKK", 2],
+  ["PLN", 2], ["RUB", 2], ["TRY", 2], ["ZAR", 2], ["NGN", 2],
+  ["BHD", 3], ["KWD", 3], ["OMR", 3], ["JOD", 3], ["TND", 3],
+  ["CLF", 4], ["UYW", 4],
+]);
+
+/** Complete list of known currency codes — used to reject unknown codes. */
+export const KNOWN_CURRENCIES = new Set(CURRENCY_MINOR_UNITS.keys());
+
+/**
+ * Reject binary floating-point in monetary positions.
+ * NaN, Infinity, -Infinity, non-integer, and unsafe integers are all refused.
+ */
+function rejectFloat(value, ctx) {
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "monetary value must be finite; got non-finite number" });
+      return z.NEVER;
+    }
+    if (!Number.isInteger(value)) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "monetary value must be an integer (minor units); binary floats are not allowed for totals" });
+      return z.NEVER;
+    }
+    if (!Number.isSafeInteger(value)) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "monetary value exceeds safe integer range; use decimal string instead" });
+      return z.NEVER;
+    }
+    return value;
+  }
+  return value;
+}
+
+/** Validated decimal string: no scientific notation. */
+const DECIMAL_STRING_RE = /^-?(0|[1-9][0-9]*)(\.[0-9]+)?$/;
+
+/** Minor-units integer: safe, finite, both bounds checked (F8). */
+export const minorUnitsSchema = z.number().int().finite().refine(
+  (v) => Number.isSafeInteger(v),
+  { message: "minor units outside safe representable range" },
+);
+
+/** Decimal string that parses cleanly and never encodes scientific notation. */
+export const decimalStringSchema = z.string().regex(
+  DECIMAL_STRING_RE,
+  { message: "money decimal string must match /^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$/; no scientific notation" },
+);
+
+/**
+ * The single canonical money schema — strict: rejects extra fields.
+ *
+ * A well-formed monetary value in ENGRAM is exactly one of:
+ *   { amount: <integer minor units>, amountUnit: "minor_units", currency: "USD", exponent: 2 }
+ *   { amount: "-?[0-9]+(\\.[0-9]+)?", amountUnit: "major_decimal", currency: "USD", exponent: 2 }
+ *
+ * Binary floats (1.99), NaN, Infinity, and unsafe integers are REFUSED.
+ * Unknown currency codes are REFUSED (P2: pinned registry only).
+ * Extra fields are REFUSED (P2: strict).
+ */
+export const moneySchema = z.object({
+  amount: z.union([
+    z.number().superRefine(rejectFloat),
+    decimalStringSchema,
+  ]),
+  // Do not infer units from JSON number/string representation. A lost quote
+  // must fail validation rather than silently changing a total by 10^exponent.
+  amountUnit: z.enum(["minor_units", "major_decimal"]),
+  currency: z.string().regex(CURRENCY_RE, { message: "currency must be a 3-letter ISO 4217 code" }),
+  exponent: z.number().int().min(0).max(6).optional(),
+}).strict().refine(
+  (data) => (data.amountUnit === "minor_units") === (typeof data.amount === "number"),
+  { message: "amountUnit must match numeric minor units or string major decimal", path: ["amountUnit"] },
+).refine(
+  (data) => {
+    if (!KNOWN_CURRENCIES.has(data.currency)) {
+      return false;
+    }
+    return true;
+  },
+  { message: "currency code is not in the supported ISO 4217 registry; register it before use", path: ["currency"] },
+).refine(
+  (data) => {
+    const known = CURRENCY_MINOR_UNITS.get(data.currency);
+    if (data.exponent != null && known != null && data.exponent !== known) {
+      return false;
+    }
+    return true;
+  },
+  { message: "exponent must match the currency's standard minor units when both are known", path: ["exponent"] },
+).refine(
+  (data) => {
+    // Require exponent for decimal strings or use currency default
+    const exponent = data.exponent ?? CURRENCY_MINOR_UNITS.get(data.currency);
+    if (exponent == null) {
+      return false;
+    }
+    if (typeof data.amount === "string") {
+      const dot = data.amount.indexOf(".");
+      if (dot >= 0) {
+        const fracLen = data.amount.length - dot - 1;
+        if (fracLen > exponent) return false;
+      }
+    }
+    return true;
+  },
+  { message: "currency requires a known exponent; provide exponent or use a known currency code", path: ["exponent"] },
+);
+
+/**
+ * Migrate a pre-freeze `{amount, currency, exponent}` value only when the
+ * importing source explicitly declares its old unit convention. Never guess
+ * a unit from a number/string, since that can multiply a total by 10^exponent.
+ * Returns null for malformed or already-tagged input.
+ */
+export function migrateLegacyMoney(legacy, amountUnit) {
+  if (!legacy || typeof legacy !== "object" || Array.isArray(legacy) || "amountUnit" in legacy) return null;
+  const result = moneySchema.safeParse({ ...legacy, amountUnit });
+  return result.success ? result.data : null;
+}
+
+/**
+ * Exact decimal multiplication using BigInt for lossless conversion.
+ * Parses a decimal string and multiplies by 10^exp using integer arithmetic.
+ * @param {string} decimal — e.g. "19.99" or "90071992547409.90"
+ * @param {number} exponent — minor-units exponent
+ * @returns {bigint|null}
+ */
+function decimalToMinorUnitsExact(decimal, exponent) {
+  const negative = decimal.startsWith("-");
+  const abs = negative ? decimal.slice(1) : decimal;
+
+  const dot = abs.indexOf(".");
+  let integerPart, fracPart;
+  if (dot >= 0) {
+    integerPart = abs.slice(0, dot);
+    fracPart = abs.slice(dot + 1).padEnd(exponent, "0").slice(0, exponent);
+    // Reject extra fractional digits beyond the exponent
+    const origFracLen = abs.length - dot - 1;
+    if (origFracLen > exponent) return null;
+  } else {
+    integerPart = abs;
+    fracPart = "0".repeat(exponent);
+  }
+
+  // Pad fraction to exactly exponent digits
+  if (fracPart.length < exponent) {
+    fracPart = fracPart.padEnd(exponent, "0");
+  }
+
+  let result;
+  try {
+    const int = BigInt(integerPart);
+    const frac = BigInt(fracPart);
+    const multiplier = 10n ** BigInt(exponent);
+    result = int * multiplier + frac;
+  } catch {
+    return null;
+  }
+
+  return negative ? -result : result;
+}
+
+/**
+ * Normalize a money value to its canonical minor-units integer representation.
+ * Uses exact BigInt conversion for decimal strings (F5).
+ * Validates the input: rejects extra fractional digits that would truncate.
+ *
+ * @param {object} money — an explicitly unit-tagged money object
+ * @returns {number|null}
+ */
+export function toMinorUnits(money) {
+  const parsed = moneySchema.safeParse(money);
+  if (!parsed.success) return null;
+  const value = parsed.data;
+  const exponent = value.exponent ?? CURRENCY_MINOR_UNITS.get(value.currency);
+  if (exponent == null) return null;
+
+  if (value.amountUnit === "minor_units") return value.amount;
+
+  // Validate: reject if fractional digits exceed exponent (would truncate)
+  const dot = value.amount.indexOf(".");
+  if (dot >= 0) {
+    const fracLen = value.amount.length - dot - 1;
+    if (fracLen > exponent) return null;
+  }
+
+  // Exact BigInt conversion for decimal strings
+  const exact = decimalToMinorUnitsExact(value.amount, exponent);
+  if (exact == null) return null;
+
+  // Check safe integer range before converting back to Number
+  if (exact > 9007199254740991n || exact < -9007199254740991n) return null;
+
+  return Number(exact);
+}
+
+/**
+ * Format minor units back to a decimal string using exact BigInt arithmetic (F5).
+ * @param {number} minorUnits
+ * @param {number} exponent
+ * @returns {string}
+ * @throws {RangeError} when minorUnits is not a safe integer or exponent is outside 0..6
+ */
+export function formatFromMinorUnits(minorUnits, exponent = 2) {
+  if (!Number.isSafeInteger(minorUnits)) {
+    throw new RangeError("minorUnits must be a finite safe integer");
+  }
+  if (!Number.isInteger(exponent) || exponent < 0 || exponent > 6) {
+    throw new RangeError("exponent must be an integer from 0 to 6");
+  }
+  if (exponent === 0) return String(minorUnits);
+
+  const negative = minorUnits < 0;
+  const abs = negative ? -minorUnits : minorUnits;
+  const divisor = 10n ** BigInt(exponent);
+  const bigAbs = BigInt(abs);
+  const whole = bigAbs / divisor;
+  const frac = String(bigAbs % divisor).padStart(exponent, "0");
+
+  return `${negative ? "-" : ""}${whole}.${frac}`;
+}
+
+/** Known minor-unit exponent for a currency code (null if unknown). */
+export function currencyExponent(currency) {
+  return CURRENCY_MINOR_UNITS.get(currency) ?? null;
+}

package/src/engram/contracts/source-snapshot.js

@@ -0,0 +1,57 @@
+/**
+ * ENGRAM §EW02 — SourceSnapshot contract.
+ *
+ * A SourceSnapshot captures the provenance of every fact: what source produced
+ * it, at what version, when, and under which tenant scope. No assertion is
+ * authoritative without a reachable, versioned source snapshot.
+ */
+
+import { z } from "zod";
+import { nonblankIdentitySchema } from "./identity.js";
+
+/**
+ * A point-in-time snapshot of a data source.
+ *
+ * Every fact in the ENGRAM graph MUST be traceable to a source snapshot that
+ * declares its version, capture time, and tenant scope. Absence of any of
+ * these fields means the fact cannot be classified as authoritative.
+ */
+export const sourceSnapshotSchema = z.object({
+  sourceId: nonblankIdentitySchema,
+  sourceType: z.enum([
+    "session",
+    "api",
+    "ingest",
+    "manual",
+    "derived",
+    "import",
+  ]),
+  version: nonblankIdentitySchema,
+  capturedAt: z.string().datetime(),
+  tenantScope: nonblankIdentitySchema,
+  contentHash: z.string().min(1).optional(),
+  metadata: z.record(z.string(), z.json()).optional(),
+}).strict();
+
+/**
+ * Valid fixture: a complete, valid source snapshot.
+ */
+export const VALID_SOURCE_SNAPSHOT = Object.freeze({
+  sourceId: "src-session-abc123",
+  sourceType: "session",
+  version: "1.2.0",
+  capturedAt: "2026-10-23T12:00:00Z",
+  tenantScope: "tenant/acme",
+  contentHash: "sha256:abc123def456",
+});
+
+/**
+ * A minimal but valid source snapshot (no optional fields).
+ */
+export const MINIMAL_SOURCE_SNAPSHOT = Object.freeze({
+  sourceId: "src-min-001",
+  sourceType: "manual",
+  version: "0.1.0",
+  capturedAt: "2026-10-23T00:00:00Z",
+  tenantScope: "tenant/default",
+});

package/src/engram/contracts/task-context-pack.js

@@ -0,0 +1,114 @@
+/**
+ * ENGRAM §EW02 — TaskContextPack contract.
+ *
+ * A TaskContextPack bundles the minimal context needed for a parallel agent
+ * to operate: capabilities, evidence references, and delegation instructions.
+ * Every pack carries its own version, tenant scope, and source snapshot.
+ *
+ * Cross-field tenant validation: source snapshots must share the pack's
+ * tenant scope. A pack cannot grant itself a cross-tenant exception.
+ */
+
+import { z } from "zod";
+import { sourceSnapshotSchema } from "./source-snapshot.js";
+import { capabilityVersionSchema } from "./capability.js";
+import { CONTRACT_VERSIONS } from "./versions.js";
+
+// Bounds are bare SemVer versions of the named capability, inclusive.
+const VERSION_RE = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const boundVersionSchema = z.string().regex(VERSION_RE);
+
+function compareVersions(left, right) {
+  const a = left.split(".").map(BigInt);
+  const b = right.split(".").map(BigInt);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * A delegation reference: what agent or capability is delegated, with
+ * constraints and version requirements.
+ */
+export const delegationReferenceSchema = z.object({
+  delegateId: z.string().min(1),
+  capability: capabilityVersionSchema,
+  constraints: z.record(z.string(), z.json()).optional(),
+  minVersion: boundVersionSchema.optional(),
+  maxVersion: boundVersionSchema.optional(),
+}).strict().superRefine((delegation, ctx) => {
+  const capabilityVersion = delegation.capability.split("@").at(-1);
+  if (!VERSION_RE.test(capabilityVersion)) return;
+  if (delegation.minVersion && VERSION_RE.test(delegation.minVersion) &&
+      compareVersions(capabilityVersion, delegation.minVersion) < 0) {
+    ctx.addIssue({ code: "custom", path: ["minVersion"], message: "delegated capability is below minVersion" });
+  }
+  if (delegation.maxVersion && VERSION_RE.test(delegation.maxVersion) &&
+      compareVersions(capabilityVersion, delegation.maxVersion) > 0) {
+    ctx.addIssue({ code: "custom", path: ["maxVersion"], message: "delegated capability is above maxVersion" });
+  }
+  if (delegation.minVersion && delegation.maxVersion &&
+      VERSION_RE.test(delegation.minVersion) && VERSION_RE.test(delegation.maxVersion) &&
+      compareVersions(delegation.minVersion, delegation.maxVersion) > 0) {
+    ctx.addIssue({ code: "custom", path: ["maxVersion"], message: "maxVersion must not precede minVersion" });
+  }
+});
+
+/**
+ * A task context pack: the minimal validated context for a parallel agent.
+ *
+ * Packs carry capabilities, evidence references, and delegation instructions
+ * so every agent gets a consistent, validated starting context.
+ *
+ * Tenant scope reconciliation: nested objects must share the pack's tenant
+ * scope. Cross-tenant delegation needs a separate, trusted authorization
+ * boundary rather than a self-declared field in an incoming pack.
+ */
+export const taskContextPackSchema = z.object({
+  packId: z.string().min(1),
+  version: z.literal(CONTRACT_VERSIONS.taskContextPack),
+  tenantScope: z.string().min(1),
+  sourceSnapshot: sourceSnapshotSchema,
+  capabilities: z.array(capabilityVersionSchema).optional(),
+  evidenceRefs: z.array(z.string().min(1)).optional(),
+  delegations: z.array(delegationReferenceSchema).optional(),
+  createdAt: z.string().datetime(),
+  expiresAt: z.string().datetime().optional(),
+  metadata: z.record(z.string(), z.json()).optional(),
+}).strict().superRefine((data, ctx) => {
+  if (data.sourceSnapshot.tenantScope !== data.tenantScope) {
+    ctx.addIssue({ code: "custom", message: "sourceSnapshot tenantScope must match pack tenantScope", path: ["sourceSnapshot", "tenantScope"] });
+  }
+  if (Date.parse(data.sourceSnapshot.capturedAt) > Date.parse(data.createdAt)) {
+    ctx.addIssue({ code: "custom", message: "sourceSnapshot cannot be captured after pack creation", path: ["sourceSnapshot", "capturedAt"] });
+  }
+  if (data.expiresAt && Date.parse(data.expiresAt) <= Date.parse(data.createdAt)) {
+    ctx.addIssue({ code: "custom", message: "expiresAt must be after createdAt", path: ["expiresAt"] });
+  }
+  const declared = new Set(data.capabilities ?? []);
+  for (const [index, delegation] of (data.delegations ?? []).entries()) {
+    if (!declared.has(delegation.capability)) {
+      ctx.addIssue({ code: "custom", message: "delegation capability must be declared by this pack", path: ["delegations", index, "capability"] });
+    }
+  }
+});
+
+/**
+ * Valid fixture: a complete task context pack.
+ */
+export const VALID_TASK_CONTEXT_PACK = Object.freeze({
+  packId: "tcp-ew02-001",
+  version: "1.0.0",
+  tenantScope: "tenant/acme",
+  sourceSnapshot: {
+    sourceId: "src-session-abc123",
+    sourceType: "session",
+    version: "1.2.0",
+    capturedAt: "2026-10-23T12:00:00Z",
+    tenantScope: "tenant/acme",
+  },
+  capabilities: ["graph-read@1.0.0"],
+  evidenceRefs: ["evi-abc123"],
+  createdAt: "2026-10-23T12:00:00Z",
+});