settld 0.1.0

package/src/core/signer-keys.js

@@ -0,0 +1,33 @@
+export const SIGNER_KEY_STATUS = Object.freeze({
+  ACTIVE: "active",
+  ROTATED: "rotated",
+  REVOKED: "revoked"
+});
+
+export const SIGNER_KEY_PURPOSE = Object.freeze({
+  ROBOT: "robot",
+  OPERATOR: "operator",
+  SERVER: "server"
+});
+
+const SIGNER_KEY_STATUSES = new Set(Object.values(SIGNER_KEY_STATUS));
+const SIGNER_KEY_PURPOSES = new Set(Object.values(SIGNER_KEY_PURPOSE));
+
+function assertNonEmptyString(value, name) {
+  if (typeof value !== "string" || value.trim() === "") throw new TypeError(`${name} must be a non-empty string`);
+}
+
+export function normalizeSignerKeyStatus(status) {
+  assertNonEmptyString(status, "status");
+  const normalized = String(status).trim().toLowerCase();
+  if (!SIGNER_KEY_STATUSES.has(normalized)) throw new TypeError("status is not supported");
+  return normalized;
+}
+
+export function normalizeSignerKeyPurpose(purpose) {
+  assertNonEmptyString(purpose, "purpose");
+  const normalized = String(purpose).trim().toLowerCase();
+  if (!SIGNER_KEY_PURPOSES.has(normalized)) throw new TypeError("purpose is not supported");
+  return normalized;
+}
+

package/src/core/skills.js

@@ -0,0 +1,86 @@
+function assertNonEmptyString(value, name) {
+  if (typeof value !== "string" || value.trim() === "") throw new TypeError(`${name} must be a non-empty string`);
+}
+
+function assertPlainObject(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`${name} must be an object`);
+  if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+    throw new TypeError(`${name} must be a plain object`);
+  }
+}
+
+function assertSafePositiveCents(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${name} must be a positive safe integer (cents)`);
+}
+
+export function validateSkillLicensedPayload(payload) {
+  assertPlainObject(payload, "payload");
+  const allowed = new Set(["jobId", "skill", "pricing", "licenseId", "terms"]);
+  for (const key of Object.keys(payload)) {
+    if (!allowed.has(key)) throw new TypeError(`payload contains unknown field: ${key}`);
+  }
+
+  assertNonEmptyString(payload.jobId, "payload.jobId");
+
+  assertPlainObject(payload.skill, "payload.skill");
+  const skillAllowed = new Set(["skillId", "version", "developerId"]);
+  for (const key of Object.keys(payload.skill)) {
+    if (!skillAllowed.has(key)) throw new TypeError(`payload.skill contains unknown field: ${key}`);
+  }
+  assertNonEmptyString(payload.skill.skillId, "payload.skill.skillId");
+  assertNonEmptyString(payload.skill.version, "payload.skill.version");
+  assertNonEmptyString(payload.skill.developerId, "payload.skill.developerId");
+
+  assertPlainObject(payload.pricing, "payload.pricing");
+  const pricingAllowed = new Set(["model", "amountCents", "currency"]);
+  for (const key of Object.keys(payload.pricing)) {
+    if (!pricingAllowed.has(key)) throw new TypeError(`payload.pricing contains unknown field: ${key}`);
+  }
+  assertNonEmptyString(payload.pricing.model, "payload.pricing.model");
+  if (payload.pricing.model !== "PER_JOB") throw new TypeError("payload.pricing.model must be PER_JOB");
+  assertSafePositiveCents(payload.pricing.amountCents, "payload.pricing.amountCents");
+  assertNonEmptyString(payload.pricing.currency, "payload.pricing.currency");
+
+  assertNonEmptyString(payload.licenseId, "payload.licenseId");
+
+  if (payload.terms !== undefined) {
+    assertPlainObject(payload.terms, "payload.terms");
+    const termsAllowed = new Set(["refundableUntilState", "requiresCertificationTier"]);
+    for (const key of Object.keys(payload.terms)) {
+      if (!termsAllowed.has(key)) throw new TypeError(`payload.terms contains unknown field: ${key}`);
+    }
+    if (payload.terms.refundableUntilState !== undefined) {
+      assertNonEmptyString(payload.terms.refundableUntilState, "payload.terms.refundableUntilState");
+    }
+    if (payload.terms.requiresCertificationTier !== undefined) {
+      assertNonEmptyString(payload.terms.requiresCertificationTier, "payload.terms.requiresCertificationTier");
+    }
+  }
+
+  return payload;
+}
+
+export function validateSkillUsedPayload(payload) {
+  assertPlainObject(payload, "payload");
+  const allowed = new Set(["jobId", "licenseId", "step"]);
+  for (const key of Object.keys(payload)) {
+    if (!allowed.has(key)) throw new TypeError(`payload contains unknown field: ${key}`);
+  }
+
+  assertNonEmptyString(payload.jobId, "payload.jobId");
+  assertNonEmptyString(payload.licenseId, "payload.licenseId");
+  if (payload.step !== undefined) assertNonEmptyString(payload.step, "payload.step");
+  return payload;
+}
+
+export function sumSkillLicenseFeesCents(skillLicenses) {
+  if (!Array.isArray(skillLicenses)) return 0;
+  let sum = 0;
+  for (const lic of skillLicenses) {
+    const amount = lic?.pricing?.amountCents;
+    if (!Number.isSafeInteger(amount) || amount <= 0) continue;
+    sum += amount;
+  }
+  return sum;
+}
+

package/src/core/sla-events.js

@@ -0,0 +1,229 @@
+export const SLA_BREACH_TYPE = Object.freeze({
+  START_LATE: "START_LATE",
+  COMPLETE_LATE: "COMPLETE_LATE",
+  EXCESS_STALL: "EXCESS_STALL",
+  ABORTED: "ABORTED"
+});
+
+export const SLA_CREDIT_REASON = Object.freeze({
+  SLA_BREACH: "SLA_BREACH"
+});
+
+export const SLA_CREDIT_TRIGGER_TYPE = Object.freeze({
+  SLA_BREACH: "SLA_BREACH"
+});
+
+const BREACH_TYPES = new Set(Object.values(SLA_BREACH_TYPE));
+const CREDIT_REASONS = new Set(Object.values(SLA_CREDIT_REASON));
+const TRIGGER_TYPES = new Set(Object.values(SLA_CREDIT_TRIGGER_TYPE));
+
+function assertNonEmptyString(value, name) {
+  if (typeof value !== "string" || value.trim() === "") throw new TypeError(`${name} must be a non-empty string`);
+}
+
+function assertPlainObject(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`${name} must be an object`);
+  if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+    throw new TypeError(`${name} must be a plain object`);
+  }
+}
+
+function assertIsoDate(value, name) {
+  assertNonEmptyString(value, name);
+  const t = Date.parse(value);
+  if (!Number.isFinite(t)) throw new TypeError(`${name} must be an ISO date string`);
+}
+
+function assertSafeInt(value, name) {
+  if (!Number.isSafeInteger(value)) throw new TypeError(`${name} must be a safe integer`);
+}
+
+function assertSlaSnapshot(sla, name) {
+  assertPlainObject(sla, name);
+  const allowed = new Set(["slaVersion", "mustStartWithinWindow", "maxStallMs", "maxExecutionMs"]);
+  for (const key of Object.keys(sla)) {
+    if (!allowed.has(key)) throw new TypeError(`${name} contains unknown field: ${key}`);
+  }
+  assertSafeInt(sla.slaVersion, `${name}.slaVersion`);
+  if (typeof sla.mustStartWithinWindow !== "boolean") throw new TypeError(`${name}.mustStartWithinWindow must be a boolean`);
+  assertSafeInt(sla.maxStallMs, `${name}.maxStallMs`);
+  if (sla.maxStallMs <= 0) throw new TypeError(`${name}.maxStallMs must be > 0`);
+  assertSafeInt(sla.maxExecutionMs, `${name}.maxExecutionMs`);
+  if (sla.maxExecutionMs <= 0) throw new TypeError(`${name}.maxExecutionMs must be > 0`);
+}
+
+export function validateSlaBreachDetectedPayload(payload) {
+  assertPlainObject(payload, "payload");
+  const allowed = new Set(["jobId", "detectedAt", "settledEventId", "policyHash", "window", "policy", "breaches"]);
+  for (const key of Object.keys(payload)) {
+    if (!allowed.has(key)) throw new TypeError(`payload contains unknown field: ${key}`);
+  }
+
+  assertNonEmptyString(payload.jobId, "payload.jobId");
+  assertIsoDate(payload.detectedAt, "payload.detectedAt");
+  if (payload.settledEventId !== undefined && payload.settledEventId !== null) assertNonEmptyString(payload.settledEventId, "payload.settledEventId");
+  if (payload.policyHash !== undefined && payload.policyHash !== null) assertNonEmptyString(payload.policyHash, "payload.policyHash");
+
+  assertPlainObject(payload.window, "payload.window");
+  const winAllowed = new Set(["startAt", "endAt"]);
+  for (const key of Object.keys(payload.window)) {
+    if (!winAllowed.has(key)) throw new TypeError(`payload.window contains unknown field: ${key}`);
+  }
+  assertIsoDate(payload.window.startAt, "payload.window.startAt");
+  assertIsoDate(payload.window.endAt, "payload.window.endAt");
+  if (Date.parse(payload.window.startAt) >= Date.parse(payload.window.endAt)) throw new TypeError("payload.window.startAt must be before endAt");
+
+  assertSlaSnapshot(payload.policy, "payload.policy");
+
+  if (!Array.isArray(payload.breaches) || payload.breaches.length === 0) {
+    throw new TypeError("payload.breaches must be a non-empty array");
+  }
+  for (let i = 0; i < payload.breaches.length; i += 1) {
+    const b = payload.breaches[i];
+    assertPlainObject(b, `payload.breaches[${i}]`);
+    const bAllowed = new Set([
+      "type",
+      "startedAt",
+      "completedAt",
+      "abortedAt",
+      "windowStartAt",
+      "windowEndAt",
+      "latenessMs",
+      "totalStallMs",
+      "maxStallMs"
+    ]);
+    for (const key of Object.keys(b)) {
+      if (!bAllowed.has(key)) throw new TypeError(`payload.breaches[${i}] contains unknown field: ${key}`);
+    }
+    assertNonEmptyString(b.type, `payload.breaches[${i}].type`);
+    if (!BREACH_TYPES.has(b.type)) throw new TypeError(`payload.breaches[${i}].type is not supported`);
+
+    if (b.type === SLA_BREACH_TYPE.START_LATE) {
+      assertIsoDate(b.startedAt, `payload.breaches[${i}].startedAt`);
+      assertIsoDate(b.windowStartAt, `payload.breaches[${i}].windowStartAt`);
+      assertSafeInt(b.latenessMs, `payload.breaches[${i}].latenessMs`);
+      if (b.latenessMs < 0) throw new TypeError("latenessMs must be >= 0");
+    }
+    if (b.type === SLA_BREACH_TYPE.COMPLETE_LATE) {
+      assertIsoDate(b.completedAt, `payload.breaches[${i}].completedAt`);
+      assertIsoDate(b.windowEndAt, `payload.breaches[${i}].windowEndAt`);
+      assertSafeInt(b.latenessMs, `payload.breaches[${i}].latenessMs`);
+      if (b.latenessMs < 0) throw new TypeError("latenessMs must be >= 0");
+    }
+    if (b.type === SLA_BREACH_TYPE.EXCESS_STALL) {
+      assertSafeInt(b.totalStallMs, `payload.breaches[${i}].totalStallMs`);
+      assertSafeInt(b.maxStallMs, `payload.breaches[${i}].maxStallMs`);
+      if (b.totalStallMs < 0) throw new TypeError("totalStallMs must be >= 0");
+      if (b.maxStallMs <= 0) throw new TypeError("maxStallMs must be > 0");
+    }
+    if (b.type === SLA_BREACH_TYPE.ABORTED) {
+      assertIsoDate(b.abortedAt, `payload.breaches[${i}].abortedAt`);
+    }
+  }
+
+  return payload;
+}
+
+export function validateSlaCreditIssuedPayload(payload) {
+  assertPlainObject(payload, "payload");
+  const allowed = new Set([
+    "jobId",
+    "creditId",
+    "issuedAt",
+    "amountCents",
+    "currency",
+    "reason",
+    "settledEventId",
+    "policyHash",
+    "trigger"
+  ]);
+  for (const key of Object.keys(payload)) {
+    if (!allowed.has(key)) throw new TypeError(`payload contains unknown field: ${key}`);
+  }
+
+  assertNonEmptyString(payload.jobId, "payload.jobId");
+  assertNonEmptyString(payload.creditId, "payload.creditId");
+  assertIsoDate(payload.issuedAt, "payload.issuedAt");
+  assertSafeInt(payload.amountCents, "payload.amountCents");
+  if (payload.amountCents <= 0) throw new TypeError("payload.amountCents must be positive");
+  assertNonEmptyString(payload.currency, "payload.currency");
+  if (payload.currency !== "USD") throw new TypeError("payload.currency is not supported");
+  assertNonEmptyString(payload.reason, "payload.reason");
+  if (!CREDIT_REASONS.has(payload.reason)) throw new TypeError("payload.reason is not supported");
+  if (payload.settledEventId !== undefined && payload.settledEventId !== null) assertNonEmptyString(payload.settledEventId, "payload.settledEventId");
+  if (payload.policyHash !== undefined && payload.policyHash !== null) assertNonEmptyString(payload.policyHash, "payload.policyHash");
+
+  if (payload.trigger !== undefined && payload.trigger !== null) {
+    assertPlainObject(payload.trigger, "payload.trigger");
+    const trigAllowed = new Set(["type", "breachEventId", "detectedAt", "window", "policy", "breaches"]);
+    for (const key of Object.keys(payload.trigger)) {
+      if (!trigAllowed.has(key)) throw new TypeError(`payload.trigger contains unknown field: ${key}`);
+    }
+
+    assertNonEmptyString(payload.trigger.type, "payload.trigger.type");
+    if (!TRIGGER_TYPES.has(payload.trigger.type)) throw new TypeError("payload.trigger.type is not supported");
+    assertNonEmptyString(payload.trigger.breachEventId, "payload.trigger.breachEventId");
+    assertIsoDate(payload.trigger.detectedAt, "payload.trigger.detectedAt");
+
+    assertPlainObject(payload.trigger.window, "payload.trigger.window");
+    const winAllowed = new Set(["startAt", "endAt"]);
+    for (const key of Object.keys(payload.trigger.window)) {
+      if (!winAllowed.has(key)) throw new TypeError(`payload.trigger.window contains unknown field: ${key}`);
+    }
+    assertIsoDate(payload.trigger.window.startAt, "payload.trigger.window.startAt");
+    assertIsoDate(payload.trigger.window.endAt, "payload.trigger.window.endAt");
+    if (Date.parse(payload.trigger.window.startAt) >= Date.parse(payload.trigger.window.endAt)) {
+      throw new TypeError("payload.trigger.window.startAt must be before endAt");
+    }
+
+    assertSlaSnapshot(payload.trigger.policy, "payload.trigger.policy");
+
+    if (!Array.isArray(payload.trigger.breaches) || payload.trigger.breaches.length === 0) {
+      throw new TypeError("payload.trigger.breaches must be a non-empty array");
+    }
+    for (let i = 0; i < payload.trigger.breaches.length; i += 1) {
+      const b = payload.trigger.breaches[i];
+      assertPlainObject(b, `payload.trigger.breaches[${i}]`);
+      const bAllowed = new Set([
+        "type",
+        "startedAt",
+        "completedAt",
+        "abortedAt",
+        "windowStartAt",
+        "windowEndAt",
+        "latenessMs",
+        "totalStallMs",
+        "maxStallMs"
+      ]);
+      for (const key of Object.keys(b)) {
+        if (!bAllowed.has(key)) throw new TypeError(`payload.trigger.breaches[${i}] contains unknown field: ${key}`);
+      }
+      assertNonEmptyString(b.type, `payload.trigger.breaches[${i}].type`);
+      if (!BREACH_TYPES.has(b.type)) throw new TypeError(`payload.trigger.breaches[${i}].type is not supported`);
+
+      if (b.type === SLA_BREACH_TYPE.START_LATE) {
+        assertIsoDate(b.startedAt, `payload.trigger.breaches[${i}].startedAt`);
+        assertIsoDate(b.windowStartAt, `payload.trigger.breaches[${i}].windowStartAt`);
+        assertSafeInt(b.latenessMs, `payload.trigger.breaches[${i}].latenessMs`);
+        if (b.latenessMs < 0) throw new TypeError("latenessMs must be >= 0");
+      }
+      if (b.type === SLA_BREACH_TYPE.COMPLETE_LATE) {
+        assertIsoDate(b.completedAt, `payload.trigger.breaches[${i}].completedAt`);
+        assertIsoDate(b.windowEndAt, `payload.trigger.breaches[${i}].windowEndAt`);
+        assertSafeInt(b.latenessMs, `payload.trigger.breaches[${i}].latenessMs`);
+        if (b.latenessMs < 0) throw new TypeError("latenessMs must be >= 0");
+      }
+      if (b.type === SLA_BREACH_TYPE.EXCESS_STALL) {
+        assertSafeInt(b.totalStallMs, `payload.trigger.breaches[${i}].totalStallMs`);
+        assertSafeInt(b.maxStallMs, `payload.trigger.breaches[${i}].maxStallMs`);
+        if (b.totalStallMs < 0) throw new TypeError("totalStallMs must be >= 0");
+        if (b.maxStallMs <= 0) throw new TypeError("maxStallMs must be > 0");
+      }
+      if (b.type === SLA_BREACH_TYPE.ABORTED) {
+        assertIsoDate(b.abortedAt, `payload.trigger.breaches[${i}].abortedAt`);
+      }
+    }
+  }
+
+  return payload;
+}

package/src/core/sla-metering.js

@@ -0,0 +1,169 @@
+import { canonicalJsonStringify, normalizeForCanonicalJson } from "./canonical-json.js";
+import { sha256Hex } from "./crypto.js";
+
+export const SLA_RULE_KIND_V1 = Object.freeze({
+  MUST_START_WITHIN_WINDOW: "MUST_START_WITHIN_WINDOW",
+  MAX_EXECUTION_MS: "MAX_EXECUTION_MS",
+  MAX_STALL_MS: "MAX_STALL_MS",
+  PROOF_ZONE_COVERAGE_MIN_PCT: "PROOF_ZONE_COVERAGE_MIN_PCT"
+});
+
+function assertPlainObject(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`${name} must be an object`);
+  if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) throw new TypeError(`${name} must be a plain object`);
+}
+
+function assertNonEmptyString(value, name) {
+  if (typeof value !== "string" || value.trim() === "") throw new TypeError(`${name} must be a non-empty string`);
+}
+
+function safeIsoToMs(value) {
+  const t = Date.parse(String(value ?? ""));
+  return Number.isFinite(t) ? t : NaN;
+}
+
+function executionWindowFromEvents(events) {
+  const list = Array.isArray(events) ? events : [];
+  let startedAt = null;
+  let completedAt = null;
+
+  for (const e of list) {
+    if (!e || typeof e !== "object") continue;
+    if (startedAt === null && (e.type === "EXECUTION_STARTED" || e.type === "JOB_EXECUTION_STARTED")) startedAt = e.at ?? null;
+    if (completedAt === null && (e.type === "EXECUTION_COMPLETED" || e.type === "JOB_EXECUTION_COMPLETED")) completedAt = e.at ?? null;
+  }
+
+  return { startedAt, completedAt };
+}
+
+function stallMsFromEvents(events) {
+  const list = Array.isArray(events) ? events : [];
+  let stallStartMs = null;
+  let total = 0;
+
+  for (const e of list) {
+    if (!e || typeof e !== "object") continue;
+    if (e.type === "JOB_EXECUTION_STALLED") {
+      const t = safeIsoToMs(e.at);
+      if (Number.isFinite(t)) stallStartMs = t;
+      continue;
+    }
+    if (e.type === "JOB_EXECUTION_RESUMED") {
+      const t = safeIsoToMs(e.at);
+      if (Number.isFinite(t) && stallStartMs !== null) {
+        const delta = Math.max(0, t - stallStartMs);
+        total += delta;
+      }
+      stallStartMs = null;
+    }
+  }
+
+  return total;
+}
+
+export function deriveSlaDefinitionV1({ generatedAt, job }) {
+  assertNonEmptyString(generatedAt, "generatedAt");
+  assertPlainObject(job, "job");
+
+  const rules = [];
+  const sla = job?.booking?.sla ?? null;
+  if (sla && typeof sla === "object" && !Array.isArray(sla)) {
+    if (sla.mustStartWithinWindow === true) {
+      rules.push({ ruleId: "must_start_within_window", kind: SLA_RULE_KIND_V1.MUST_START_WITHIN_WINDOW });
+    }
+    if (Number.isSafeInteger(sla.maxExecutionMs)) {
+      rules.push({ ruleId: "max_execution_ms", kind: SLA_RULE_KIND_V1.MAX_EXECUTION_MS, maxExecutionMs: sla.maxExecutionMs });
+    }
+    if (Number.isSafeInteger(sla.maxStallMs)) {
+      rules.push({ ruleId: "max_stall_ms", kind: SLA_RULE_KIND_V1.MAX_STALL_MS, maxStallMs: sla.maxStallMs });
+    }
+  }
+
+  const zc = job?.booking?.policySnapshot?.proofPolicy?.zoneCoverage ?? job?.booking?.policySnapshot?.proof?.zoneCoverage ?? null;
+  if (zc && typeof zc === "object" && !Array.isArray(zc) && Number.isSafeInteger(zc.thresholdPct)) {
+    rules.push({ ruleId: "proof_zone_coverage_min_pct", kind: SLA_RULE_KIND_V1.PROOF_ZONE_COVERAGE_MIN_PCT, thresholdPct: zc.thresholdPct });
+  }
+
+  rules.sort((a, b) => String(a.ruleId ?? "").localeCompare(String(b.ruleId ?? "")));
+  return { schemaVersion: "SlaDefinition.v1", generatedAt, rules };
+}
+
+export function evaluateSlaDefinitionV1({ generatedAt, job, events, slaDefinition }) {
+  assertNonEmptyString(generatedAt, "generatedAt");
+  assertPlainObject(job, "job");
+  if (!Array.isArray(events)) throw new TypeError("events must be an array");
+  assertPlainObject(slaDefinition, "slaDefinition");
+  if (slaDefinition.schemaVersion !== "SlaDefinition.v1") throw new TypeError("unsupported slaDefinition.schemaVersion");
+
+  const booking = job.booking ?? null;
+  const { startedAt, completedAt } = executionWindowFromEvents(events);
+  const stallMs = stallMsFromEvents(events);
+
+  const startedAtMs = safeIsoToMs(startedAt);
+  const completedAtMs = safeIsoToMs(completedAt);
+  const execMs = Number.isFinite(startedAtMs) && Number.isFinite(completedAtMs) ? Math.max(0, completedAtMs - startedAtMs) : null;
+
+  const results = [];
+  for (const r of Array.isArray(slaDefinition.rules) ? slaDefinition.rules : []) {
+    if (!r || typeof r !== "object") continue;
+    const kind = String(r.kind ?? "");
+    const ruleId = String(r.ruleId ?? "");
+    if (!ruleId || !kind) continue;
+
+    if (kind === SLA_RULE_KIND_V1.MUST_START_WITHIN_WINDOW) {
+      const winStartMs = safeIsoToMs(booking?.startAt);
+      const winEndMs = safeIsoToMs(booking?.endAt);
+      if (!Number.isFinite(winStartMs) || !Number.isFinite(winEndMs) || !Number.isFinite(startedAtMs)) {
+        results.push({ ruleId, kind, status: "unknown", detail: { startedAt: startedAt ?? null, window: booking ? { startAt: booking.startAt ?? null, endAt: booking.endAt ?? null } : null } });
+      } else {
+        const ok = startedAtMs >= winStartMs && startedAtMs <= winEndMs;
+        results.push({ ruleId, kind, status: ok ? "ok" : "breach", detail: { startedAt, window: { startAt: booking?.startAt ?? null, endAt: booking?.endAt ?? null } } });
+      }
+      continue;
+    }
+
+    if (kind === SLA_RULE_KIND_V1.MAX_EXECUTION_MS) {
+      const maxExecutionMs = Number.isSafeInteger(r.maxExecutionMs) ? r.maxExecutionMs : null;
+      if (!Number.isFinite(maxExecutionMs) || maxExecutionMs === null || execMs === null) {
+        results.push({ ruleId, kind, status: "unknown", detail: { startedAt: startedAt ?? null, completedAt: completedAt ?? null, executionMs: execMs, maxExecutionMs } });
+      } else {
+        const ok = execMs <= maxExecutionMs;
+        results.push({ ruleId, kind, status: ok ? "ok" : "breach", detail: { startedAt, completedAt, executionMs: execMs, maxExecutionMs } });
+      }
+      continue;
+    }
+
+    if (kind === SLA_RULE_KIND_V1.MAX_STALL_MS) {
+      const maxStallMs = Number.isSafeInteger(r.maxStallMs) ? r.maxStallMs : null;
+      if (!Number.isFinite(maxStallMs) || maxStallMs === null) {
+        results.push({ ruleId, kind, status: "unknown", detail: { stallMs, maxStallMs } });
+      } else {
+        const ok = stallMs <= maxStallMs;
+        results.push({ ruleId, kind, status: ok ? "ok" : "breach", detail: { stallMs, maxStallMs } });
+      }
+      continue;
+    }
+
+    if (kind === SLA_RULE_KIND_V1.PROOF_ZONE_COVERAGE_MIN_PCT) {
+      const thresholdPct = Number.isSafeInteger(r.thresholdPct) ? r.thresholdPct : null;
+      const minCoveragePct = Number.isSafeInteger(job?.proof?.metrics?.minCoveragePct) ? job.proof.metrics.minCoveragePct : null;
+      if (thresholdPct === null || minCoveragePct === null) {
+        results.push({ ruleId, kind, status: "unknown", detail: { minCoveragePct, thresholdPct } });
+      } else {
+        const ok = minCoveragePct >= thresholdPct;
+        results.push({ ruleId, kind, status: ok ? "ok" : "breach", detail: { minCoveragePct, thresholdPct } });
+      }
+      continue;
+    }
+
+    results.push({ ruleId, kind, status: "unknown", detail: { reason: "unsupported rule kind" } });
+  }
+
+  results.sort((a, b) => String(a.ruleId ?? "").localeCompare(String(b.ruleId ?? "")));
+
+  let overallStatus = "ok";
+  if (results.some((r) => r.status === "breach")) overallStatus = "breach";
+  else if (results.some((r) => r.status === "unknown")) overallStatus = "unknown";
+
+  return normalizeForCanonicalJson({ schemaVersion: "SlaEvaluation.v1", generatedAt, overallStatus, results }, { path: "$" });
+}