sneakoscope 7.0.2 → 7.0.3

package/dist/core/subagents/naruto-proof-projection.js

@@ -1,9 +1,13 @@
+import { constants as fsConstants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { sha256 } from '../fsx.js';
-import { SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_EVENT_LOG_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME, buildSubagentEvidence, normalizeSubagentEvent, normalizeSubagentParentSummary } from './subagent-evidence.js';
+import { SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_EVENT_LOG_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME, buildSubagentEvidence, normalizeSubagentEvent, normalizeSubagentParentSummary, trustedHostCapabilityReceiptBindingBlockers } from './subagent-evidence.js';
 import { NARUTO_GATE_FILENAME, NARUTO_RESULT_SCHEMA, NARUTO_SUMMARY_FILENAME, SUBAGENT_PLAN_FILENAME } from './official-subagent-preparation.js';
 import { effectiveSubagentTarget, normalizeLegacySubagentCountFields, subagentCountContractBlockers } from './wave-lifecycle.js';
+import { HOST_CAPABILITY_DESCRIPTORS, hostCapabilityDigest } from '../agent-bridge/agent-manifest.js';
+import { HOST_CAPABILITY_EVIDENCE_SCHEMA, HOST_CAPABILITY_RUNTIME_SCHEMA } from '../agent-bridge/host-capability-runtime.js';
 export const NARUTO_PROOF_ARTIFACT_FILENAMES = Object.freeze([
     SUBAGENT_PLAN_FILENAME,
     SUBAGENT_EVENT_LOG_FILENAME,
@@ -17,6 +21,25 @@ const MAX_CHANGED_FILES = 256;
 const MAX_CHANGED_FILE_CHARS = 512;
 const MAX_VERIFICATION_ROWS = 32;
 const MAX_VERIFICATION_NAME_CHARS = 240;
+const MAX_ARTIFACTS = 64;
+const MAX_ARTIFACT_PATH_CHARS = 512;
+const MAX_ARTIFACT_KIND_CHARS = 64;
+const MAX_MEDIA_TYPE_CHARS = 160;
+const MAX_CAPABILITY_USES = 64;
+const MAX_CAPABILITY_ID_CHARS = 160;
+const MAX_CAPABILITY_TOOL_NAMES = 64;
+const MAX_CAPABILITY_TOOL_NAME_CHARS = 128;
+const MAX_CANONICAL_PROOF_ARTIFACT_BYTES = 4 * 1024 * 1024;
+const MAX_CANONICAL_PROOF_AGGREGATE_BYTES = 16 * 1024 * 1024;
+const MAX_DELIVERABLE_ARTIFACT_BYTES = 128 * 1024 * 1024;
+const MAX_DELIVERABLE_ARTIFACT_AGGREGATE_BYTES = 512 * 1024 * 1024;
+const SHA256_RECEIPT_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const ARTIFACT_ROLES = new Set(['deliverable', 'scratch', 'temp', 'log']);
+const NON_DELIVERABLE_ARTIFACT_KINDS = new Set(['scratch', 'temp', 'tmp', 'log']);
+const NON_DELIVERABLE_PATH_SEGMENTS = new Set(['scratch', 'temp', 'tmp', 'log', 'logs']);
+const ARTIFACT_RECEIPT_KEYS = new Set(['path', 'kind', 'media_type', 'sha256', 'bytes', 'role']);
+const CAPABILITY_USE_KEYS = new Set(['id', 'status', 'tool_names', 'receipt_sha256']);
+const HOST_CAPABILITY_BY_ID = new Map(HOST_CAPABILITY_DESCRIPTORS.map((descriptor) => [descriptor.id, descriptor]));
 const INCOMPLETE_BLOCKER_PATTERNS = [
     /^proof_artifact_missing:/,
     /^requested_subagent_(?:starts|completions)_incomplete:/,
@@ -28,7 +51,14 @@ const INCOMPLETE_BLOCKER_PATTERNS = [
 export async function readNarutoProofArtifactSnapshot(artifactDir) {
     const rows = await Promise.all(NARUTO_PROOF_ARTIFACT_FILENAMES.map(async (filename) => {
         try {
-            return { filename, bytes: await fsp.readFile(path.join(artifactDir, filename)), blocker: null };
+            const file = path.join(artifactDir, filename);
+            const stat = await fsp.stat(file);
+            if (!stat.isFile())
+                return { filename, bytes: null, blocker: `proof_artifact_unreadable:${filename}` };
+            if (stat.size > MAX_CANONICAL_PROOF_ARTIFACT_BYTES) {
+                return { filename, bytes: null, blocker: `proof_artifact_too_large:${filename}` };
+            }
+            return { filename, bytes: await fsp.readFile(file), blocker: null };
         }
         catch (error) {
             const code = errorCode(error);
@@ -44,24 +74,54 @@ export async function readNarutoProofArtifactSnapshot(artifactDir) {
     const bytes = {};
     const byteHashes = {};
     const blockers = [];
+    let aggregateBytes = 0;
     for (const row of rows) {
         bytes[row.filename] = row.bytes;
         byteHashes[row.filename] = row.bytes ? `sha256:${sha256(row.bytes)}` : null;
+        aggregateBytes += row.bytes?.length || 0;
         if (row.blocker)
             blockers.push(row.blocker);
     }
+    if (aggregateBytes > MAX_CANONICAL_PROOF_AGGREGATE_BYTES)
+        blockers.push('proof_artifacts_aggregate_too_large');
     return { bytes, byte_hashes: byteHashes, read_blockers: blockers };
 }
 export async function buildNarutoProofProjection(input) {
     const snapshot = await readNarutoProofArtifactSnapshot(input.artifactDir);
-    return projectNarutoProofSnapshot({ snapshot, missionId: input.missionId });
+    const projected = projectNarutoProofSnapshot({ snapshot, missionId: input.missionId });
+    if (!projected.result.artifacts?.length)
+        return projected;
+    const artifactBlockers = await verifyProjectedArtifactFiles({
+        artifacts: projected.result.artifacts,
+        artifactDir: input.artifactDir,
+        workspaceRoot: input.workspaceRoot
+    });
+    if (artifactBlockers.length === 0)
+        return projected;
+    return projectNarutoProofSnapshot({
+        snapshot: {
+            ...snapshot,
+            read_blockers: [...snapshot.read_blockers, ...artifactBlockers]
+        },
+        missionId: input.missionId
+    });
 }
 export function projectNarutoProofSnapshot(input) {
     const missionId = String(input.missionId || '').trim();
-    const blockers = [...input.snapshot.read_blockers];
+    const readBlockers = input.snapshot.read_blockers;
+    const blockers = Array.isArray(readBlockers)
+        ? readBlockers.filter((blocker) => typeof blocker === 'string')
+        : ['proof_read_blockers_invalid'];
+    if (Array.isArray(readBlockers) && blockers.length !== readBlockers.length)
+        blockers.push('proof_read_blockers_invalid');
     const plan = parseJsonArtifact(input.snapshot, SUBAGENT_PLAN_FILENAME, blockers);
     const parentSummaryValue = parseJsonArtifact(input.snapshot, SUBAGENT_PARENT_SUMMARY_FILENAME, blockers);
     const persistedEvidence = normalizeLegacySubagentCountFields(parseJsonArtifact(input.snapshot, SUBAGENT_EVIDENCE_FILENAME, blockers), isRecord(plan) ? plan : null);
+    const receiptProjectedPersistedEvidence = projectReceiptAdditiveFields(SUBAGENT_EVIDENCE_FILENAME, persistedEvidence);
+    const trustedHostCapabilityEvidence = projectTrustedHostCapabilityEvidence(recordValue(receiptProjectedPersistedEvidence, 'host_capability_evidence'), blockers);
+    const projectedPersistedEvidence = isRecord(receiptProjectedPersistedEvidence) && trustedHostCapabilityEvidence
+        ? { ...receiptProjectedPersistedEvidence, host_capability_evidence: trustedHostCapabilityEvidence }
+        : receiptProjectedPersistedEvidence;
     const summary = normalizeLegacySubagentCountFields(parseJsonArtifact(input.snapshot, NARUTO_SUMMARY_FILENAME, blockers), isRecord(plan) ? plan : null);
     const gate = normalizeLegacySubagentCountFields(parseJsonArtifact(input.snapshot, NARUTO_GATE_FILENAME, blockers), isRecord(plan) ? plan : null);
     const events = parseJsonlArtifact(input.snapshot, blockers);
@@ -100,6 +160,7 @@ export function projectNarutoProofSnapshot(input) {
             workflowStatus: firstText(recordValue(summary, 'status')),
             preparationOnly: recordValue(persistedEvidence, 'preparation_only') === true,
             runId: workflowRunId,
+            ...(trustedHostCapabilityEvidence ? { hostCapabilityEvidence: trustedHostCapabilityEvidence } : {}),
             additionalBlockers: subagentCountContractBlockers(isRecord(plan) ? plan : null, observedStarts)
         });
     if (planRequestedSubagents === null && plan !== null)
@@ -108,9 +169,42 @@ export function projectNarutoProofSnapshot(input) {
         && input.snapshot.bytes[SUBAGENT_EVENT_LOG_FILENAME] !== null
         && input.snapshot.bytes[SUBAGENT_PARENT_SUMMARY_FILENAME] !== null;
     if (evidenceInputsPresent)
-        validatePersistedEvidence(persistedEvidence, rebuiltEvidence, blockers);
+        validatePersistedEvidence(projectedPersistedEvidence, rebuiltEvidence, blockers);
     const changedFiles = projectChangedFiles(normalizedParentSummary.raw?.changed_files, blockers);
     const verification = projectVerification(normalizedParentSummary.raw?.verification, blockers);
+    const parentArtifacts = projectArtifacts(recordValue(parentSummaryValue, 'artifacts'), blockers);
+    const parentCapabilitiesUsed = projectCapabilityUses(recordValue(parentSummaryValue, 'capabilities_used'), blockers);
+    const trustedArtifacts = trustedHostCapabilityEvidence
+        ? projectArtifacts(trustedHostCapabilityEvidence.artifacts, blockers) || []
+        : undefined;
+    const trustedCapabilitiesUsed = trustedHostCapabilityEvidence
+        ? projectCapabilityUses(trustedHostCapabilityEvidence.capabilities_used, blockers) || []
+        : undefined;
+    const rawParentArtifacts = recordValue(parentSummaryValue, 'artifacts');
+    const rawParentCapabilitiesUsed = recordValue(parentSummaryValue, 'capabilities_used');
+    const parentHostClaimsPresent = hasNonEmptyHostCapabilityClaim(rawParentArtifacts)
+        || hasNonEmptyHostCapabilityClaim(rawParentCapabilitiesUsed);
+    const trustedHostBindingRequired = Boolean(trustedHostCapabilityEvidence && (trustedHostCapabilityEvidence.runtime.requested_capability_ids.length > 0
+        || trustedHostCapabilityEvidence.tool_calls.length > 0
+        || trustedHostCapabilityEvidence.artifacts.length > 0
+        || parentHostClaimsPresent));
+    if (trustedHostCapabilityEvidence) {
+        if (trustedHostBindingRequired && JSON.stringify(parentArtifacts || []) !== JSON.stringify(trustedArtifacts || [])) {
+            blockers.push('proof_parent_host_artifacts_mismatch');
+        }
+        if (trustedHostBindingRequired && JSON.stringify(parentCapabilitiesUsed || []) !== JSON.stringify(trustedCapabilitiesUsed || [])) {
+            blockers.push('proof_parent_host_capabilities_mismatch');
+        }
+    }
+    else if (parentHostClaimsPresent) {
+        blockers.push('proof_host_capability_evidence_missing');
+    }
+    const artifacts = trustedHostBindingRequired ? trustedArtifacts : parentArtifacts;
+    const capabilitiesUsed = trustedHostBindingRequired ? trustedCapabilitiesUsed : parentCapabilitiesUsed;
+    for (const receipt of capabilitiesUsed || []) {
+        if (receipt.status !== 'passed')
+            blockers.push(`proof_capability_use_not_passed:${receipt.id}`);
+    }
     const parentText = normalizedParentSummary.summary || '';
     if (parentText.length > MAX_RESULT_SUMMARY_CHARS)
         blockers.push('proof_result_summary_too_large');
@@ -123,11 +217,13 @@ export function projectNarutoProofSnapshot(input) {
             ? parentText
             : '',
         changed_files: changedFiles,
-        verification
+        verification,
+        ...(artifacts === undefined ? {} : { artifacts }),
+        ...(capabilitiesUsed === undefined ? {} : { capabilities_used: capabilitiesUsed })
     };
     const completed = gatePassed(gate)
-        && recordValue(persistedEvidence, 'ok') === true
-        && firstText(recordValue(persistedEvidence, 'status')).toLowerCase() === 'completed'
+        && recordValue(projectedPersistedEvidence, 'ok') === true
+        && firstText(recordValue(projectedPersistedEvidence, 'status')).toLowerCase() === 'completed'
         && rebuiltEvidence?.ok === true
         && normalizedParentSummary.trustworthy
         && normalizedParentSummary.status === 'completed'
@@ -138,8 +234,8 @@ export function projectNarutoProofSnapshot(input) {
     const explicitBlocked = !completed && isExplicitlyBlocked({
         blockers,
         parentStatus: normalizedParentSummary.status,
-        evidenceStatus: firstText(recordValue(persistedEvidence, 'status')),
-        failedThreads: Number(recordValue(persistedEvidence, 'failed_threads') || 0),
+        evidenceStatus: firstText(recordValue(projectedPersistedEvidence, 'status')),
+        failedThreads: Number(recordValue(projectedPersistedEvidence, 'failed_threads') || 0),
         summaryStatus: firstText(recordValue(summary, 'status')),
         gate
     });
@@ -151,7 +247,7 @@ export function projectNarutoProofSnapshot(input) {
         status,
         missionId,
         workflowRunId,
-        artifactHashes: input.snapshot.byte_hashes,
+        artifactHashes: projectFingerprintArtifactHashes(input.snapshot),
         result
     });
     return {
@@ -163,13 +259,16 @@ export function projectNarutoProofSnapshot(input) {
         workflow: 'official_codex_subagent',
         workflow_run_id: workflowRunId,
         blockers: uniqueBlockers,
-        evidence: persistedEvidence,
+        evidence: projectedPersistedEvidence,
         summary,
         gate,
         result,
         proof_fingerprint: proofFingerprint
     };
 }
+function hasNonEmptyHostCapabilityClaim(value) {
+    return Array.isArray(value) ? value.length > 0 : value !== undefined;
+}
 export function validateNarutoProofStatus(value) {
     const status = String(value.status || '').trim();
     if (status !== 'completed' && status !== 'blocked' && status !== 'incomplete') {
@@ -177,6 +276,202 @@ export function validateNarutoProofStatus(value) {
     }
     return value.ok === (status === 'completed') ? [] : ['proof_status_ok_inconsistent'];
 }
+function projectTrustedHostCapabilityEvidence(value, blockers) {
+    if (value === undefined || value === null)
+        return null;
+    if (!isRecord(value)
+        || value.schema !== HOST_CAPABILITY_EVIDENCE_SCHEMA
+        || typeof value.ok !== 'boolean'
+        || !isRecord(value.runtime)
+        || value.runtime.schema !== HOST_CAPABILITY_RUNTIME_SCHEMA
+        || value.runtime.server !== 'acas-tools'
+        || value.runtime.capability_digest !== hostCapabilityDigest(HOST_CAPABILITY_DESCRIPTORS)
+        || !Array.isArray(value.runtime.requested_capability_ids)
+        || !Array.isArray(value.runtime.blockers)
+        || !Array.isArray(value.tool_calls)
+        || !Array.isArray(value.capabilities_used)
+        || !Array.isArray(value.artifacts)
+        || !Array.isArray(value.blockers)) {
+        blockers.push('proof_host_capability_evidence_invalid');
+        return null;
+    }
+    const requestedIds = value.runtime.requested_capability_ids.map((id) => String(id || '').trim());
+    if (requestedIds.some((id) => !HOST_CAPABILITY_BY_ID.has(id))
+        || new Set(requestedIds).size !== requestedIds.length
+        || value.runtime.blockers.some((blocker) => !isBoundedBlockerCode(blocker))
+        || value.blockers.some((blocker) => !isBoundedBlockerCode(blocker))) {
+        blockers.push('proof_host_capability_runtime_invalid');
+        return null;
+    }
+    const knownTools = new Set(HOST_CAPABILITY_DESCRIPTORS.flatMap((descriptor) => descriptor.tool_names));
+    if (value.tool_calls.length > 1024 || value.tool_calls.some((row) => {
+        if (!isRecord(row))
+            return true;
+        return row.server !== 'acas-tools'
+            || typeof row.tool !== 'string'
+            || !knownTools.has(row.tool)
+            || (row.status !== 'passed' && row.status !== 'failed')
+            || typeof row.event_sha256 !== 'string'
+            || !SHA256_RECEIPT_PATTERN.test(row.event_sha256);
+    })) {
+        blockers.push('proof_host_capability_tool_calls_invalid');
+        return null;
+    }
+    const receiptBlockers = [];
+    const capabilities = projectCapabilityUses(value.capabilities_used, receiptBlockers);
+    const artifacts = projectArtifacts(value.artifacts, receiptBlockers);
+    if (!capabilities || !artifacts || receiptBlockers.length > 0
+        || capabilities.length !== value.capabilities_used.length
+        || artifacts.length !== value.artifacts.length) {
+        blockers.push(...receiptBlockers, 'proof_host_capability_receipts_invalid');
+        return null;
+    }
+    const observedIds = capabilities.map((receipt) => receipt.id);
+    if (JSON.stringify([...observedIds].sort()) !== JSON.stringify([...requestedIds].sort())) {
+        blockers.push('proof_host_capability_requested_receipts_mismatch');
+    }
+    const expectedOk = value.blockers.length === 0 && capabilities.every((receipt) => receipt.status === 'passed');
+    if (value.ok !== expectedOk)
+        blockers.push('proof_host_capability_evidence_status_inconsistent');
+    const bindingBlockers = trustedHostCapabilityReceiptBindingBlockers({
+        ...value,
+        capabilities_used: capabilities,
+        artifacts
+    });
+    blockers.push(...bindingBlockers.map((blocker) => `proof_${blocker}`));
+    blockers.push(...value.blockers);
+    return {
+        ...value,
+        capabilities_used: capabilities,
+        artifacts
+    };
+}
+async function verifyProjectedArtifactFiles(input) {
+    const workspaceRoot = await resolveArtifactWorkspaceRoot(input.artifactDir, input.workspaceRoot);
+    if (!workspaceRoot)
+        return ['proof_artifact_workspace_root_missing'];
+    const blockers = [];
+    for (const artifact of input.artifacts) {
+        blockers.push(...await verifyProjectedArtifactFile(workspaceRoot, artifact));
+    }
+    return uniqueStrings(blockers);
+}
+async function resolveArtifactWorkspaceRoot(artifactDir, explicitRoot) {
+    let candidate = explicitRoot ? path.resolve(explicitRoot) : '';
+    if (!candidate) {
+        let cursor = path.resolve(artifactDir);
+        while (true) {
+            if (path.basename(cursor) === '.sneakoscope') {
+                candidate = path.dirname(cursor);
+                break;
+            }
+            const parent = path.dirname(cursor);
+            if (parent === cursor)
+                break;
+            cursor = parent;
+        }
+    }
+    if (!candidate)
+        return null;
+    try {
+        const realRoot = await fsp.realpath(candidate);
+        return (await fsp.stat(realRoot)).isDirectory() ? realRoot : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function verifyProjectedArtifactFile(workspaceRoot, artifact) {
+    if (artifact.bytes > MAX_DELIVERABLE_ARTIFACT_BYTES)
+        return ['proof_artifact_file_too_large'];
+    const segments = artifact.path.split('/');
+    const candidate = path.join(workspaceRoot, ...segments);
+    if (!pathWithinRoot(workspaceRoot, candidate))
+        return ['proof_artifact_file_escape'];
+    let cursor = workspaceRoot;
+    for (let index = 0; index < segments.length; index += 1) {
+        cursor = path.join(cursor, segments[index]);
+        try {
+            const stat = await fsp.lstat(cursor);
+            if (stat.isSymbolicLink())
+                return ['proof_artifact_file_symlink'];
+            if (index < segments.length - 1 && !stat.isDirectory())
+                return ['proof_artifact_file_not_regular'];
+            if (index === segments.length - 1 && !stat.isFile())
+                return ['proof_artifact_file_not_regular'];
+        }
+        catch (error) {
+            return [errorCode(error) === 'ENOENT' ? 'proof_artifact_file_missing' : 'proof_artifact_file_unreadable'];
+        }
+    }
+    try {
+        const realCandidate = await fsp.realpath(candidate);
+        if (!pathWithinRoot(workspaceRoot, realCandidate))
+            return ['proof_artifact_file_escape'];
+        const expected = await fsp.stat(realCandidate);
+        if (expected.size > MAX_DELIVERABLE_ARTIFACT_BYTES)
+            return ['proof_artifact_file_too_large'];
+        const handle = await fsp.open(candidate, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        try {
+            const before = await handle.stat();
+            if (!before.isFile())
+                return ['proof_artifact_file_not_regular'];
+            if (before.dev !== expected.dev || before.ino !== expected.ino) {
+                return ['proof_artifact_file_changed_during_hash'];
+            }
+            const header = Buffer.alloc(8);
+            const headerRead = await handle.read(header, 0, header.length, 0);
+            const digest = createHash('sha256');
+            for await (const chunk of handle.createReadStream({ autoClose: false, start: 0 }))
+                digest.update(chunk);
+            const after = await handle.stat();
+            const finalPathStat = await fsp.lstat(candidate);
+            if (finalPathStat.isSymbolicLink())
+                return ['proof_artifact_file_symlink'];
+            if (before.dev !== after.dev
+                || before.ino !== after.ino
+                || before.size !== after.size
+                || before.mtimeMs !== after.mtimeMs
+                || finalPathStat.dev !== after.dev
+                || finalPathStat.ino !== after.ino) {
+                return ['proof_artifact_file_changed_during_hash'];
+            }
+            const blockers = [];
+            if (after.size !== artifact.bytes)
+                blockers.push('proof_artifact_file_bytes_mismatch');
+            if (`sha256:${digest.digest('hex')}` !== artifact.sha256)
+                blockers.push('proof_artifact_file_sha256_mismatch');
+            blockers.push(...artifactSignatureBlockers(artifact, header.subarray(0, headerRead.bytesRead)));
+            return blockers;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        return [errorCode(error) === 'ELOOP' ? 'proof_artifact_file_symlink' : 'proof_artifact_file_unreadable'];
+    }
+}
+function artifactSignatureBlockers(artifact, header) {
+    if (artifact.media_type === 'application/pdf') {
+        return header.subarray(0, 5).equals(Buffer.from('%PDF-')) ? [] : ['proof_artifact_pdf_signature_invalid'];
+    }
+    if (artifact.media_type === 'image/png') {
+        const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+        return header.subarray(0, png.length).equals(png) ? [] : ['proof_artifact_png_signature_invalid'];
+    }
+    if (artifact.media_type === 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet') {
+        const zipLocalHeader = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+        return header.subarray(0, zipLocalHeader.length).equals(zipLocalHeader)
+            ? []
+            : ['proof_artifact_xlsx_signature_invalid'];
+    }
+    return [];
+}
+function pathWithinRoot(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
 function parseJsonArtifact(snapshot, filename, blockers) {
     const bytes = snapshot.bytes[filename];
     if (!bytes)
@@ -275,6 +570,9 @@ function validatePersistedEvidence(persisted, rebuilt, blockers) {
             blockers.push(`proof_evidence_rebuild_mismatch:${key}`);
         }
     }
+    if (JSON.stringify(persisted.host_capability_evidence) !== JSON.stringify(rebuilt.host_capability_evidence)) {
+        blockers.push('proof_evidence_rebuild_mismatch:host_capability_evidence');
+    }
 }
 function validateCountContractArtifacts(input, blockers) {
     for (const [label, value] of [
@@ -361,6 +659,210 @@ function projectVerificationRow(value) {
     const rawStatus = isRecord(value) ? firstText(value.status) : '';
     return { name, status: normalizeVerificationStatus(rawStatus, name) };
 }
+function projectArtifacts(value, blockers) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value)) {
+        blockers.push('proof_artifacts_invalid');
+        return [];
+    }
+    if (value.length > MAX_ARTIFACTS)
+        blockers.push('proof_artifacts_too_many');
+    const result = [];
+    const seenPaths = new Set();
+    let aggregateBytes = 0;
+    for (const row of value.slice(0, MAX_ARTIFACTS)) {
+        if (!isRecord(row)) {
+            blockers.push('proof_artifact_invalid');
+            continue;
+        }
+        const artifactPath = normalizeArtifactPath(row.path, blockers);
+        const kind = boundedToken(row.kind, MAX_ARTIFACT_KIND_CHARS, /^[a-z][a-z0-9_-]*$/);
+        const mediaType = boundedToken(row.media_type, MAX_MEDIA_TYPE_CHARS, /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/i);
+        const artifactSha256 = typeof row.sha256 === 'string' && SHA256_RECEIPT_PATTERN.test(row.sha256)
+            ? row.sha256
+            : null;
+        const bytes = typeof row.bytes === 'number' && Number.isSafeInteger(row.bytes) && row.bytes > 0
+            ? row.bytes
+            : null;
+        const role = typeof row.role === 'string' && ARTIFACT_ROLES.has(row.role)
+            ? row.role
+            : null;
+        if (!kind)
+            blockers.push('proof_artifact_kind_invalid');
+        if (!mediaType)
+            blockers.push('proof_artifact_media_type_invalid');
+        if (!artifactSha256)
+            blockers.push('proof_artifact_sha256_invalid');
+        if (bytes === null)
+            blockers.push('proof_artifact_bytes_invalid');
+        if (bytes !== null && bytes > MAX_DELIVERABLE_ARTIFACT_BYTES)
+            blockers.push('proof_artifact_bytes_too_large');
+        if (!role)
+            blockers.push('proof_artifact_role_invalid');
+        if (!artifactPath || !kind || !mediaType || !artifactSha256 || bytes === null || !role)
+            continue;
+        if (seenPaths.has(artifactPath)) {
+            blockers.push('proof_artifact_path_duplicate');
+            continue;
+        }
+        if (role === 'deliverable' && isNonDeliverableArtifact(artifactPath, kind)) {
+            blockers.push('proof_artifact_deliverable_role_invalid');
+            continue;
+        }
+        blockers.push(...artifactMediaConsistencyBlockers(artifactPath, mediaType));
+        seenPaths.add(artifactPath);
+        aggregateBytes += bytes;
+        result.push({ path: artifactPath, kind, media_type: mediaType, sha256: artifactSha256, bytes, role });
+    }
+    if (aggregateBytes > MAX_DELIVERABLE_ARTIFACT_AGGREGATE_BYTES)
+        blockers.push('proof_artifact_bytes_aggregate_too_large');
+    return result;
+}
+function normalizeArtifactPath(value, blockers) {
+    if (typeof value !== 'string') {
+        blockers.push('proof_artifact_path_invalid');
+        return null;
+    }
+    const original = value.trim();
+    if (!original || original.length > MAX_ARTIFACT_PATH_CHARS || /[\r\n\0]/.test(original)) {
+        blockers.push('proof_artifact_path_invalid');
+        return null;
+    }
+    if (original.includes('\\')) {
+        blockers.push('proof_artifact_path_not_posix');
+        return null;
+    }
+    if (path.posix.isAbsolute(original) || path.win32.isAbsolute(original)) {
+        blockers.push('proof_artifact_path_absolute');
+        return null;
+    }
+    const normalized = path.posix.normalize(original).replace(/^\.\//, '');
+    if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../')) {
+        blockers.push('proof_artifact_path_escape');
+        return null;
+    }
+    if (normalized.length > MAX_ARTIFACT_PATH_CHARS) {
+        blockers.push('proof_artifact_path_invalid');
+        return null;
+    }
+    return normalized;
+}
+function isNonDeliverableArtifact(artifactPath, kind) {
+    if (NON_DELIVERABLE_ARTIFACT_KINDS.has(kind.toLowerCase()))
+        return true;
+    const segments = artifactPath.toLowerCase().split('/');
+    return segments.some((segment) => NON_DELIVERABLE_PATH_SEGMENTS.has(segment))
+        || artifactPath.toLowerCase().endsWith('.log');
+}
+function artifactMediaConsistencyBlockers(artifactPath, mediaType) {
+    const extension = path.posix.extname(artifactPath).toLowerCase();
+    const expectedByExtension = {
+        '.csv': 'text/csv',
+        '.pdf': 'application/pdf',
+        '.png': 'image/png',
+        '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+    };
+    const expectedExtensionsByMedia = {
+        'text/csv': ['.csv'],
+        'application/pdf': ['.pdf'],
+        'image/png': ['.png'],
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': ['.xlsx']
+    };
+    const blockers = [];
+    const expectedMedia = expectedByExtension[extension];
+    if (expectedMedia && mediaType !== expectedMedia)
+        blockers.push('proof_artifact_media_extension_mismatch');
+    const expectedExtensions = expectedExtensionsByMedia[mediaType];
+    if (expectedExtensions && !expectedExtensions.includes(extension))
+        blockers.push('proof_artifact_extension_media_mismatch');
+    return blockers;
+}
+function projectCapabilityUses(value, blockers) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value)) {
+        blockers.push('proof_capabilities_used_invalid');
+        return [];
+    }
+    if (value.length > MAX_CAPABILITY_USES)
+        blockers.push('proof_capabilities_used_too_many');
+    const result = [];
+    const seenIds = new Set();
+    for (const row of value.slice(0, MAX_CAPABILITY_USES)) {
+        if (!isRecord(row)) {
+            blockers.push('proof_capability_use_invalid');
+            continue;
+        }
+        const id = boundedToken(row.id, MAX_CAPABILITY_ID_CHARS, /^[a-z][a-z0-9._-]*$/);
+        const descriptor = id ? HOST_CAPABILITY_BY_ID.get(id) : undefined;
+        const status = normalizeCapabilityStatus(row.status);
+        const toolNames = projectCapabilityToolNames(row.tool_names, descriptor?.tool_names || [], status, blockers);
+        const receiptSha256 = typeof row.receipt_sha256 === 'string' && SHA256_RECEIPT_PATTERN.test(row.receipt_sha256)
+            ? row.receipt_sha256
+            : null;
+        if (!id)
+            blockers.push('proof_capability_use_id_invalid');
+        else if (!descriptor)
+            blockers.push('proof_capability_use_unknown_id');
+        if (!status)
+            blockers.push('proof_capability_use_status_invalid');
+        if (!receiptSha256)
+            blockers.push('proof_capability_use_receipt_sha256_invalid');
+        if (!id || !descriptor || !status || !toolNames || !receiptSha256)
+            continue;
+        if (seenIds.has(id)) {
+            blockers.push('proof_capability_use_duplicate');
+            continue;
+        }
+        seenIds.add(id);
+        result.push({ id, status, tool_names: toolNames, receipt_sha256: receiptSha256 });
+    }
+    return result;
+}
+function projectCapabilityToolNames(value, allowedToolNames, status, blockers) {
+    if (!Array.isArray(value) || (status === 'passed' && value.length === 0)) {
+        blockers.push('proof_capability_use_tool_names_invalid');
+        return null;
+    }
+    if (value.length > MAX_CAPABILITY_TOOL_NAMES) {
+        blockers.push('proof_capability_use_tool_names_too_many');
+        return null;
+    }
+    const result = [];
+    const seen = new Set();
+    const allowed = new Set(allowedToolNames);
+    for (const valueItem of value) {
+        const toolName = boundedToken(valueItem, MAX_CAPABILITY_TOOL_NAME_CHARS, /^[A-Za-z][A-Za-z0-9_.:-]*$/);
+        if (!toolName) {
+            blockers.push('proof_capability_use_tool_name_invalid');
+            return null;
+        }
+        if (seen.has(toolName)) {
+            blockers.push('proof_capability_use_tool_name_duplicate');
+            return null;
+        }
+        if (!allowed.has(toolName)) {
+            blockers.push('proof_capability_use_tool_name_not_declared');
+            return null;
+        }
+        seen.add(toolName);
+        result.push(toolName);
+    }
+    return result;
+}
+function normalizeCapabilityStatus(value) {
+    const status = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    return status === 'passed' || status === 'failed' ? status : null;
+}
+function boundedToken(value, maxChars, pattern) {
+    if (typeof value !== 'string')
+        return null;
+    const text = value.trim();
+    if (!text || text.length > maxChars || containsLeakageMarker(text) || !pattern.test(text))
+        return null;
+    return text;
+}
 function normalizeVerificationStatus(value, name) {
     const normalized = value.trim().toLowerCase();
     if (normalized === 'passed' || normalized === 'pass' || normalized === 'ok' || normalized === 'verified')
@@ -391,6 +893,12 @@ function containsLeakageMarker(value) {
     return /(?:^|\s)(?:prompt|system_prompt|user_prompt|stdout|stderr|environment|env_dump)\s*[:=]/i.test(value)
         || /\b(?:api[_-]?key|access[_-]?token|secret|password)\s*[:=]/i.test(value);
 }
+function isBoundedBlockerCode(value) {
+    return typeof value === 'string'
+        && value.length > 0
+        && value.length <= 240
+        && /^[A-Za-z0-9_.:-]+$/.test(value);
+}
 function isExplicitlyBlocked(input) {
     if (input.parentStatus === 'blocked' || input.parentStatus === 'failed' || input.failedThreads > 0)
         return true;
@@ -420,6 +928,66 @@ function fingerprintProof(input) {
     };
     return `sha256:${sha256(JSON.stringify(stableInput))}`;
 }
+function projectFingerprintArtifactHashes(snapshot) {
+    const hashes = { ...snapshot.byte_hashes };
+    for (const filename of [SUBAGENT_PARENT_SUMMARY_FILENAME, SUBAGENT_EVIDENCE_FILENAME]) {
+        const bytes = snapshot.bytes[filename];
+        if (!bytes)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(bytes.toString('utf8'));
+        }
+        catch {
+            continue;
+        }
+        const projected = projectReceiptAdditiveFields(filename, parsed);
+        if (projected === parsed)
+            continue;
+        hashes[filename] = `sha256:${sha256(`${JSON.stringify(projected, null, 2)}\n`)}`;
+    }
+    return hashes;
+}
+function projectReceiptAdditiveFields(filename, value) {
+    if (!isRecord(value))
+        return value;
+    if (filename === SUBAGENT_PARENT_SUMMARY_FILENAME) {
+        return projectReceiptContainerAdditiveFields(value);
+    }
+    const hostEvidence = recordValue(value, 'host_capability_evidence');
+    if (!isRecord(hostEvidence))
+        return value;
+    const projectedHostEvidence = projectReceiptContainerAdditiveFields(hostEvidence);
+    return projectedHostEvidence === hostEvidence
+        ? value
+        : { ...value, host_capability_evidence: projectedHostEvidence };
+}
+function projectReceiptContainerAdditiveFields(value) {
+    const artifacts = projectReceiptRowsAdditiveFields(value.artifacts, ARTIFACT_RECEIPT_KEYS);
+    const capabilitiesUsed = projectReceiptRowsAdditiveFields(value.capabilities_used, CAPABILITY_USE_KEYS);
+    if (artifacts === value.artifacts && capabilitiesUsed === value.capabilities_used)
+        return value;
+    return {
+        ...value,
+        ...(artifacts === value.artifacts ? {} : { artifacts }),
+        ...(capabilitiesUsed === value.capabilities_used ? {} : { capabilities_used: capabilitiesUsed })
+    };
+}
+function projectReceiptRowsAdditiveFields(value, allowedKeys) {
+    if (!Array.isArray(value))
+        return value;
+    let changed = false;
+    const projected = value.map((row) => {
+        if (!isRecord(row))
+            return row;
+        const unknownKeys = Object.keys(row).filter((key) => !allowedKeys.has(key));
+        if (unknownKeys.length === 0)
+            return row;
+        changed = true;
+        return Object.fromEntries(Object.entries(row).filter(([key]) => allowedKeys.has(key)));
+    });
+    return changed ? projected : value;
+}
 function recordValue(value, key) {
     return isRecord(value) ? value[key] : undefined;
 }