sneakoscope 7.0.2 → 7.0.3

package/dist/core/agent-bridge/host-capability-runtime.js

@@ -0,0 +1,1395 @@
+import { sha256 } from '../fsx.js';
+import { HOST_CAPABILITY_DESCRIPTORS, hostCapabilityDigest } from './agent-manifest.js';
+import { HOST_CAPABILITY_MCP_SERVER, HOST_CAPABILITY_RUNTIME_SCHEMA, hostCapabilityRuntimeDigest } from './host-capability-policy.js';
+export { HOST_CAPABILITY_MCP_SERVER, HOST_CAPABILITY_RUNTIME_SCHEMA, hostCapabilityCodexConfigArgs, inspectHostCapabilityRuntime, requestHostCapabilities } from './host-capability-policy.js';
+export const HOST_CAPABILITY_EVIDENCE_SCHEMA = 'sks.host-capability-evidence.v1';
+export const HOST_CAPABILITY_HOOK_RUNTIME_SCHEMA = 'sks.host-capability-hook-runtime.v1';
+export const HOST_CAPABILITY_HOOK_PENDING_RUNTIME_SCHEMA = 'sks.host-capability-hook-pending-runtime.v1';
+export const HOST_CAPABILITY_HOOK_OBSERVATIONS_SCHEMA = 'sks.host-capability-hook-observations.v1';
+export const HOST_CAPABILITY_HOOK_RUNTIME_FILENAME = 'host-capability-runtime.json';
+export const HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME = 'host-capability-runtime-pending.json';
+export const HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME = 'host-capability-hook-observations.json';
+export const HOST_CAPABILITY_HOOK_EVIDENCE_FILENAME = 'host-capability-evidence.json';
+const MAX_EVENT_LINE_BYTES = 512 * 1024;
+const MAX_MCP_TOOL_CALLS = 1024;
+const MAX_PRE_TOOL_OBSERVATIONS = 2048;
+const MAX_RECEIPT_JSON_STRING_BYTES = 64 * 1024;
+const MAX_ARTIFACT_RECEIPTS = 64;
+const MAX_ARTIFACT_PATH_CHARS = 512;
+const MAX_SEMANTIC_RECEIPT_ITEMS = 10_000;
+const SHA256_RECEIPT_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const XLSX_MEDIA_TYPE = 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet';
+const EXPLICIT_DENIAL_PATTERN = /(?:^|[_.:-])(?:slack|center|tenant|lease|connector|outbox|message|upload|send|post)(?:$|[_.:-])/i;
+export function createHostCapabilityHookPendingRuntime(input) {
+    const missionId = boundedIdentity(input.missionId);
+    const workflowRunId = boundedIdentity(input.workflowRunId);
+    const launchNonce = boundedIdentity(input.launchNonce);
+    if (!missionId || !workflowRunId || !launchNonce || !isHostCapabilityRuntime(input.runtime)) {
+        throw new Error('host_capability_hook_pending_runtime_invalid');
+    }
+    return {
+        schema: HOST_CAPABILITY_HOOK_PENDING_RUNTIME_SCHEMA,
+        mission_id: missionId,
+        workflow_run_id: workflowRunId,
+        launch_nonce_sha256: `sha256:${sha256(launchNonce)}`,
+        runtime: input.runtime
+    };
+}
+export function resolveHostCapabilityHookPendingRuntime(value, input) {
+    if (!value)
+        return { pending: null, blocker: 'host_capability_hook_pending_runtime_missing' };
+    if (!isRecord(value)
+        || value.schema !== HOST_CAPABILITY_HOOK_PENDING_RUNTIME_SCHEMA
+        || !boundedIdentity(value.mission_id)
+        || !boundedIdentity(value.workflow_run_id)
+        || !SHA256_RECEIPT_PATTERN.test(String(value.launch_nonce_sha256 || ''))
+        || !isHostCapabilityRuntime(value.runtime)) {
+        return { pending: null, blocker: 'host_capability_hook_pending_runtime_invalid' };
+    }
+    const pending = value;
+    const launchNonce = boundedIdentity(input.launchNonce);
+    if (pending.mission_id !== boundedIdentity(input.missionId)
+        || pending.workflow_run_id !== boundedIdentity(input.workflowRunId)
+        || !launchNonce
+        || pending.launch_nonce_sha256 !== `sha256:${sha256(launchNonce)}`) {
+        return { pending: null, blocker: 'host_capability_hook_pending_runtime_scope_mismatch' };
+    }
+    if (input.request && !hostCapabilityRuntimeMatchesRequest(pending.runtime, input.request)) {
+        return { pending: null, blocker: 'host_capability_hook_pending_runtime_request_scope_mismatch' };
+    }
+    return { pending, blocker: '' };
+}
+export function createHostCapabilityHookRuntimeBinding(input) {
+    const missionId = boundedIdentity(input.missionId);
+    const workflowRunId = boundedIdentity(input.workflowRunId);
+    const sessionScope = boundedIdentity(input.sessionScope);
+    if (!missionId || !workflowRunId || !sessionScope) {
+        throw new Error('host_capability_hook_runtime_identity_missing');
+    }
+    return {
+        schema: HOST_CAPABILITY_HOOK_RUNTIME_SCHEMA,
+        mission_id: missionId,
+        workflow_run_id: workflowRunId,
+        session_scope: sessionScope,
+        runtime: input.runtime
+    };
+}
+export function normalizeHostCapabilityHookRuntimeBinding(value) {
+    if (!isRecord(value)
+        || value.schema !== HOST_CAPABILITY_HOOK_RUNTIME_SCHEMA
+        || !boundedIdentity(value.mission_id)
+        || !boundedIdentity(value.workflow_run_id)
+        || !boundedIdentity(value.session_scope)
+        || !isHostCapabilityRuntime(value.runtime))
+        return null;
+    return value;
+}
+export function hostCapabilityHookBindingMatches(binding, input) {
+    return binding.mission_id === boundedIdentity(input.missionId)
+        && binding.workflow_run_id === boundedIdentity(input.workflowRunId)
+        && binding.session_scope === boundedIdentity(input.sessionScope);
+}
+export function resolveHostCapabilityHookRuntimeBinding(value, input) {
+    if (!value)
+        return { binding: null, blocker: 'host_capability_hook_runtime_missing' };
+    const binding = normalizeHostCapabilityHookRuntimeBinding(value);
+    if (!binding)
+        return { binding: null, blocker: 'host_capability_hook_runtime_invalid' };
+    if (!hostCapabilityHookBindingMatches(binding, input)) {
+        return { binding: null, blocker: 'host_capability_hook_runtime_scope_mismatch' };
+    }
+    if (input.request && !hostCapabilityRuntimeMatchesRequest(binding.runtime, input.request)) {
+        return { binding: null, blocker: 'host_capability_hook_runtime_request_scope_mismatch' };
+    }
+    return { binding, blocker: '' };
+}
+export function acasHostToolName(value) {
+    const toolName = String(value || '').trim();
+    if (!toolName || toolName.length > 256 || /[\r\n\0]/.test(toolName))
+        return null;
+    const match = toolName.match(/^mcp__(?:acas-tools|acas_tools)__([A-Za-z][A-Za-z0-9_.:-]{0,127})$/);
+    return match?.[1] || null;
+}
+export function explicitlyDeniedHostCapabilityTool(value) {
+    return EXPLICIT_DENIAL_PATTERN.test(String(value || ''));
+}
+export function sanitizeHostCapabilityPreToolUse(runtime, payload) {
+    if (!isRecord(payload))
+        return null;
+    const tool = acasHostToolName(payload.tool_name);
+    const toolUseId = boundedIdentity(payload.tool_use_id);
+    if (!tool || !toolUseId)
+        return null;
+    const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+    const resourceKey = extractToolResourceKey({ arguments: payload.tool_input });
+    const datasource = tool === 'datasource_schema_context' || tool === 'datasource_query_readonly'
+        ? boundedIdentity(toolInput.datasource)
+        : null;
+    const schemaSnapshotId = tool === 'datasource_query_readonly'
+        ? boundedIdentity(toolInput.schema_snapshot_id)
+        : null;
+    const allowed = runtime.ok
+        && runtime.allowed_tool_names.includes(tool)
+        && !explicitlyDeniedHostCapabilityTool(tool);
+    const blocker = !runtime.ok
+        ? 'host_capability_runtime_unavailable'
+        : explicitlyDeniedHostCapabilityTool(tool)
+            ? `host_tool_call_explicitly_denied:${tool}`
+            : !runtime.allowed_tool_names.includes(tool)
+                ? `host_tool_call_not_allowed:${tool}`
+                : null;
+    return {
+        tool_use_id_sha256: `sha256:${sha256(toolUseId)}`,
+        tool,
+        resource_key: resourceKey,
+        datasource_sha256: datasource ? `sha256:${sha256(datasource)}` : null,
+        schema_snapshot_sha256: schemaSnapshotId ? `sha256:${sha256(schemaSnapshotId)}` : null,
+        decision: allowed ? 'allowed' : 'denied',
+        reservation_status: allowed ? 'pending' : 'denied',
+        blocker
+    };
+}
+export function sanitizeHostCapabilityPostToolUse(payload) {
+    if (!isRecord(payload))
+        return null;
+    const tool = acasHostToolName(payload.tool_name);
+    const toolUseId = boundedIdentity(payload.tool_use_id);
+    if (!tool || !toolUseId)
+        return null;
+    const response = structuredHostToolResponse(payload.tool_response);
+    const malformed = !response || Object.keys(response).length === 0;
+    const semantic = malformed
+        ? { receipt: null, blocker: `host_tool_response_malformed:${tool}` }
+        : normalizeHostToolSemanticReceipt(tool, payload.tool_input, response);
+    const status = hostToolResponseFailed(payload.tool_response)
+        || hostToolResponseFailed(response)
+        || malformed
+        || Boolean(semantic.blocker)
+        ? 'failed'
+        : 'passed';
+    const artifacts = status === 'passed'
+        ? extractArtifactReceipts(payload.tool_response)
+        : [];
+    const resourceKey = extractToolResourceKey({
+        arguments: payload.tool_input,
+        result: payload.tool_response
+    });
+    const toolUseIdSha256 = `sha256:${sha256(toolUseId)}`;
+    const eventSha256 = `sha256:${sha256(JSON.stringify({
+        server: HOST_CAPABILITY_MCP_SERVER,
+        tool,
+        status,
+        tool_use_id_sha256: toolUseIdSha256,
+        resource_key: resourceKey,
+        semantic_receipt: semantic.receipt,
+        validation_blocker: semantic.blocker,
+        artifacts
+    }))}`;
+    return {
+        sequence: 0,
+        tool_use_id_sha256: toolUseIdSha256,
+        tool,
+        status,
+        event_sha256: eventSha256,
+        resource_key: resourceKey,
+        semantic_receipt: semantic.receipt,
+        validation_blocker: semantic.blocker,
+        artifacts
+    };
+}
+export function mergeHostCapabilityPreToolObservation(input) {
+    return authorizeAndMergeHostCapabilityPreToolObservation(input).observations;
+}
+export function authorizeAndMergeHostCapabilityPreToolObservation(input) {
+    const current = normalizeHostCapabilityHookObservations(input.current, input.binding)
+        || emptyHookObservations(input.binding);
+    const existing = current.pre_tool_uses.find((row) => row.tool_use_id_sha256 === input.observation.tool_use_id_sha256);
+    if (existing) {
+        if (preToolReservationIdentityMatches(existing, input.observation)) {
+            if (existing.decision !== 'allowed' || existing.reservation_status !== 'pending') {
+                const observation = denyPreToolReservation(input.observation, `host_tool_reservation_replay_${existing.reservation_status}`);
+                return { observations: current, observation, decision: 'denied', blocker: observation.blocker };
+            }
+            return {
+                observations: current,
+                observation: existing,
+                decision: 'allowed',
+                blocker: null
+            };
+        }
+        const observation = denyPreToolReservation(input.observation, 'host_tool_reservation_identity_mismatch');
+        return { observations: current, observation, decision: 'denied', blocker: observation.blocker };
+    }
+    if (current.pre_tool_uses.length >= MAX_PRE_TOOL_OBSERVATIONS) {
+        const observation = denyPreToolReservation(input.observation, 'host_pre_tool_observations_too_many');
+        return { observations: current, observation, decision: 'denied', blocker: observation.blocker };
+    }
+    const observation = authorizePreToolReservation(input.binding.runtime, current, input.observation);
+    const observations = {
+        ...current,
+        pre_tool_uses: [...current.pre_tool_uses, observation]
+    };
+    return {
+        observations,
+        observation,
+        decision: observation.decision,
+        blocker: observation.blocker
+    };
+}
+function authorizePreToolReservation(runtime, current, observation) {
+    if (observation.decision === 'denied')
+        return denyPreToolReservation(observation, observation.blocker);
+    if (observation.tool === 'datasource_query_readonly') {
+        if (hasReservedOrObservedToolCall(current, observation.tool)) {
+            return denyPreToolReservation(observation, 'host_capability_readonly_query_already_reserved');
+        }
+        const schemaReceipts = completedPassedToolCalls(current, 'datasource_schema_context')
+            .map((call) => call.semantic_receipt?.kind === 'datasource_schema' ? call.semantic_receipt : null)
+            .filter(Boolean);
+        if (schemaReceipts.length === 0) {
+            return denyPreToolReservation(observation, 'host_capability_readonly_query_schema_not_completed');
+        }
+        const matchingDatasource = observation.datasource_sha256
+            ? schemaReceipts.filter((receipt) => receipt.datasource_sha256 === observation.datasource_sha256)
+            : [];
+        if (matchingDatasource.length === 0) {
+            return denyPreToolReservation(observation, 'host_capability_readonly_query_datasource_mismatch');
+        }
+        if (!observation.schema_snapshot_sha256
+            || !matchingDatasource.some((receipt) => (receipt.schema_snapshot_sha256 === observation.schema_snapshot_sha256))) {
+            return denyPreToolReservation(observation, 'host_capability_readonly_query_schema_mismatch');
+        }
+    }
+    if (observation.tool === 'spreadsheet_create'
+        && hasReservedOrObservedToolCall(current, observation.tool)) {
+        return denyPreToolReservation(observation, 'host_capability_spreadsheet_create_already_reserved');
+    }
+    if (observation.tool === 'spreadsheet_update') {
+        if (hasReservedOrObservedToolCall(current, observation.tool)) {
+            return denyPreToolReservation(observation, 'host_capability_spreadsheet_update_already_reserved');
+        }
+        let completedCreateSequence = null;
+        if (runtime.task_workflows.includes('spreadsheet_create')) {
+            const completedCreates = completedPassedToolCalls(current, 'spreadsheet_create');
+            if (completedCreates.length === 0) {
+                return denyPreToolReservation(observation, 'host_capability_spreadsheet_update_create_not_completed');
+            }
+            const matchingCreates = observation.resource_key
+                ? completedCreates.filter((call) => call.resource_key === observation.resource_key)
+                : [];
+            if (matchingCreates.length === 0) {
+                return denyPreToolReservation(observation, 'host_capability_spreadsheet_update_resource_mismatch');
+            }
+            completedCreateSequence = Math.max(...matchingCreates.map((call) => call.sequence));
+        }
+        const completedInspections = completedPassedToolCalls(current, 'spreadsheet_inspect');
+        if (completedInspections.length === 0) {
+            return denyPreToolReservation(observation, 'host_capability_spreadsheet_update_inspection_not_completed');
+        }
+        const matchingInspections = observation.resource_key
+            ? completedInspections.filter((call) => call.resource_key === observation.resource_key)
+            : [];
+        if (matchingInspections.length === 0) {
+            return denyPreToolReservation(observation, 'host_capability_spreadsheet_update_resource_mismatch');
+        }
+        if (completedCreateSequence !== null
+            && !matchingInspections.some((call) => call.sequence > completedCreateSequence)) {
+            return denyPreToolReservation(observation, 'host_capability_spreadsheet_update_inspection_not_completed');
+        }
+    }
+    return {
+        ...observation,
+        decision: 'allowed',
+        reservation_status: 'pending',
+        blocker: null
+    };
+}
+function hasReservedOrObservedToolCall(observations, tool) {
+    return observations.tool_calls.some((row) => row.tool === tool)
+        || observations.pre_tool_uses.some((row) => (row.tool === tool && row.reservation_status !== 'denied'));
+}
+function preToolReservationIdentityMatches(left, right) {
+    return left.tool === right.tool
+        && left.resource_key === right.resource_key
+        && left.datasource_sha256 === right.datasource_sha256
+        && left.schema_snapshot_sha256 === right.schema_snapshot_sha256;
+}
+function denyPreToolReservation(observation, blocker) {
+    return {
+        ...observation,
+        decision: 'denied',
+        reservation_status: 'denied',
+        blocker: blocker || 'host_tool_reservation_denied'
+    };
+}
+function completedPassedToolCalls(observations, tool) {
+    return observations.tool_calls.filter((call) => {
+        if (call.tool !== tool || call.status !== 'passed')
+            return false;
+        const reservation = observations.pre_tool_uses.find((row) => (row.tool_use_id_sha256 === call.tool_use_id_sha256
+            && row.tool === call.tool
+            && row.resource_key === call.resource_key));
+        return reservation?.reservation_status === 'completed';
+    });
+}
+export function mergeHostCapabilityPostToolObservation(input) {
+    const current = normalizeHostCapabilityHookObservations(input.current, input.binding)
+        || emptyHookObservations(input.binding);
+    if (current.tool_calls.some((row) => row.tool_use_id_sha256 === input.observation.tool_use_id_sha256)) {
+        return {
+            ...current,
+            blockers: uniqueStrings([
+                ...current.blockers,
+                `host_tool_call_post_replay:${input.observation.tool}`
+            ])
+        };
+    }
+    if (current.tool_calls.length >= MAX_MCP_TOOL_CALLS) {
+        return { ...current, blockers: uniqueStrings([...current.blockers, 'host_tool_call_receipts_too_many']) };
+    }
+    const existingArtifactCount = current.tool_calls.reduce((sum, row) => sum + row.artifacts.length, 0);
+    const remainingArtifactSlots = Math.max(0, MAX_ARTIFACT_RECEIPTS - existingArtifactCount);
+    const sequence = current.tool_calls.reduce((max, row) => Math.max(max, row.sequence), 0) + 1;
+    const observation = {
+        ...input.observation,
+        sequence,
+        artifacts: input.observation.artifacts.slice(0, remainingArtifactSlots)
+    };
+    const reservationById = current.pre_tool_uses.find((row) => (row.tool_use_id_sha256 === observation.tool_use_id_sha256));
+    const matchingReservation = reservationById
+        && reservationById.tool === observation.tool
+        && reservationById.resource_key === observation.resource_key
+        && semanticReceiptMatchesReservation(reservationById, observation)
+        ? reservationById
+        : null;
+    const preToolUses = matchingReservation && matchingReservation.decision === 'allowed'
+        ? current.pre_tool_uses.map((row) => row === matchingReservation
+            ? {
+                ...row,
+                reservation_status: observation.status === 'passed' ? 'completed' : 'failed'
+            }
+            : row)
+        : current.pre_tool_uses;
+    const reservationBlocker = reservationById && !matchingReservation
+        ? `host_tool_call_pre_use_identity_mismatch:${observation.tool}`
+        : matchingReservation?.decision === 'denied'
+            ? `host_tool_call_pre_use_denied:${observation.tool}`
+            : matchingReservation
+                ? null
+                : `host_tool_call_pre_use_missing:${observation.tool}`;
+    return {
+        ...current,
+        pre_tool_uses: preToolUses,
+        tool_calls: [...current.tool_calls, observation],
+        blockers: uniqueStrings([
+            ...current.blockers,
+            ...(input.observation.artifacts.length > remainingArtifactSlots ? ['host_artifact_receipts_too_many'] : []),
+            ...(reservationBlocker ? [reservationBlocker] : [])
+        ])
+    };
+}
+function semanticReceiptMatchesReservation(reservation, observation) {
+    if (observation.status !== 'passed')
+        return true;
+    if (observation.tool === 'datasource_schema_context') {
+        return observation.semantic_receipt?.kind === 'datasource_schema'
+            && (!reservation.datasource_sha256
+                || observation.semantic_receipt.datasource_sha256 === reservation.datasource_sha256);
+    }
+    if (observation.tool === 'datasource_query_readonly') {
+        return observation.semantic_receipt?.kind === 'datasource_query'
+            && observation.semantic_receipt.datasource_sha256 === reservation.datasource_sha256
+            && observation.semantic_receipt.schema_snapshot_sha256 === reservation.schema_snapshot_sha256;
+    }
+    return true;
+}
+export function normalizeHostCapabilityHookObservations(value, binding) {
+    if (!isRecord(value)
+        || value.schema !== HOST_CAPABILITY_HOOK_OBSERVATIONS_SCHEMA
+        || value.mission_id !== binding.mission_id
+        || value.workflow_run_id !== binding.workflow_run_id
+        || value.session_scope !== binding.session_scope
+        || value.allowlist_digest !== binding.runtime.allowlist_digest
+        || !Array.isArray(value.pre_tool_uses)
+        || !Array.isArray(value.tool_calls)
+        || !Array.isArray(value.blockers)
+        || value.pre_tool_uses.length > MAX_PRE_TOOL_OBSERVATIONS
+        || value.tool_calls.length > MAX_MCP_TOOL_CALLS
+        || value.blockers.length > 16
+        || value.blockers.some((blocker) => typeof blocker !== 'string' || blocker.length > 128))
+        return null;
+    let preToolUses = value.pre_tool_uses.map(normalizePreToolObservation).filter(Boolean);
+    const toolCalls = value.tool_calls.map(normalizePostToolObservation).filter(Boolean);
+    if (preToolUses.length !== value.pre_tool_uses.length || toolCalls.length !== value.tool_calls.length)
+        return null;
+    if (toolCalls.reduce((sum, row) => sum + row.artifacts.length, 0) > MAX_ARTIFACT_RECEIPTS)
+        return null;
+    preToolUses = preToolUses.map((row) => {
+        if (row.decision !== 'allowed')
+            return row;
+        const call = toolCalls.find((candidate) => (candidate.tool_use_id_sha256 === row.tool_use_id_sha256
+            && candidate.tool === row.tool
+            && candidate.resource_key === row.resource_key));
+        return call && semanticReceiptMatchesReservation(row, call)
+            ? { ...row, reservation_status: call.status === 'passed' ? 'completed' : 'failed' }
+            : row;
+    });
+    return {
+        schema: HOST_CAPABILITY_HOOK_OBSERVATIONS_SCHEMA,
+        mission_id: binding.mission_id,
+        workflow_run_id: binding.workflow_run_id,
+        session_scope: binding.session_scope,
+        allowlist_digest: binding.runtime.allowlist_digest,
+        pre_tool_uses: preToolUses,
+        tool_calls: [...toolCalls].sort((left, right) => left.sequence - right.sequence),
+        blockers: uniqueStrings(value.blockers)
+    };
+}
+export function buildHostCapabilityEvidenceFromHookObservations(input) {
+    const observations = normalizeHostCapabilityHookObservations(input.observations, input.binding)
+        || emptyHookObservations(input.binding);
+    const observationBlockers = [...observations.blockers];
+    const preToolUses = new Map(observations.pre_tool_uses.map((row) => [
+        `${row.tool_use_id_sha256}:${row.tool}`,
+        row
+    ]));
+    for (const row of observations.tool_calls) {
+        const preToolUse = preToolUses.get(`${row.tool_use_id_sha256}:${row.tool}`);
+        if (!preToolUse)
+            observationBlockers.push(`host_tool_call_pre_use_missing:${row.tool}`);
+        else if (preToolUse.decision !== 'allowed')
+            observationBlockers.push(`host_tool_call_pre_use_denied:${row.tool}`);
+        else if (preToolUse.resource_key !== row.resource_key)
+            observationBlockers.push(`host_tool_call_pre_use_identity_mismatch:${row.tool}`);
+        if (row.validation_blocker)
+            observationBlockers.push(row.validation_blocker);
+    }
+    for (const row of observations.pre_tool_uses) {
+        if (row.blocker)
+            observationBlockers.push(row.blocker);
+        if (row.reservation_status === 'pending')
+            observationBlockers.push(`host_tool_reservation_pending:${row.tool}`);
+    }
+    const calls = observations.tool_calls.map((row) => ({
+        server: HOST_CAPABILITY_MCP_SERVER,
+        tool: row.tool,
+        status: row.status,
+        event_sha256: row.event_sha256,
+        raw_hash: row.event_sha256,
+        index: row.sequence,
+        resource_key: row.resource_key,
+        semantic_receipt: row.semantic_receipt
+    }));
+    const artifacts = observations.tool_calls.flatMap((row) => row.artifacts.map((artifact) => ({
+        ...artifact,
+        source_tool: row.tool,
+        source_hash: row.event_sha256,
+        source_index: row.sequence
+    })));
+    return buildExecutionEvidence(input.binding.runtime, calls, artifacts, observationBlockers);
+}
+export function createHostCapabilityEventCollector(runtime) {
+    let buffer = '';
+    let parsedEvents = 0;
+    let callIndex = 0;
+    const internalCalls = [];
+    const observedArtifacts = [];
+    const blockers = [];
+    const parseLine = (line) => {
+        const trimmed = line.trim();
+        if (!trimmed)
+            return;
+        if (Buffer.byteLength(trimmed, 'utf8') > MAX_EVENT_LINE_BYTES) {
+            blockers.push('host_tool_event_line_too_large');
+            return;
+        }
+        let event;
+        try {
+            event = JSON.parse(trimmed);
+        }
+        catch {
+            return;
+        }
+        parsedEvents += 1;
+        const item = event?.type === 'item.completed' ? event.item : null;
+        if (!item || item.type !== 'mcp_tool_call')
+            return;
+        if (internalCalls.length >= MAX_MCP_TOOL_CALLS) {
+            blockers.push('host_tool_call_receipts_too_many');
+            return;
+        }
+        const server = String(item.server || '').trim();
+        const tool = String(item.tool || '').trim();
+        const declaredStatus = item.status === 'completed' ? 'passed' : item.status === 'failed' ? 'failed' : null;
+        const response = structuredHostToolResponse(item.result);
+        const malformed = !response || Object.keys(response).length === 0;
+        const semantic = malformed
+            ? { receipt: null, blocker: `host_tool_response_malformed:${tool}` }
+            : normalizeHostToolSemanticReceipt(tool, item.arguments, response);
+        const status = declaredStatus === 'passed' && (malformed || semantic.blocker)
+            ? 'failed'
+            : declaredStatus;
+        if (!server || !tool || !status)
+            return;
+        callIndex += 1;
+        if (server !== runtime.server)
+            return;
+        const rawHash = `sha256:${sha256(trimmed)}`;
+        internalCalls.push({
+            server,
+            tool,
+            status,
+            event_sha256: rawHash,
+            raw_hash: rawHash,
+            index: callIndex,
+            resource_key: extractToolResourceKey(item),
+            semantic_receipt: semantic.receipt
+        });
+        if (semantic.blocker)
+            blockers.push(semantic.blocker);
+        if (status === 'passed') {
+            for (const artifact of extractArtifactReceipts(item.result?.structured_content ?? item.result?.structuredContent ?? item.result)) {
+                observedArtifacts.push({ ...artifact, source_tool: tool, source_hash: rawHash, source_index: callIndex });
+            }
+        }
+    };
+    const push = (chunk) => {
+        buffer += String(chunk || '');
+        if (Buffer.byteLength(buffer, 'utf8') > MAX_EVENT_LINE_BYTES * 2 && !buffer.includes('\n')) {
+            blockers.push('host_tool_event_buffer_too_large');
+            buffer = '';
+            return;
+        }
+        const lines = buffer.split(/\r?\n/);
+        buffer = lines.pop() || '';
+        for (const line of lines)
+            parseLine(line);
+    };
+    const finish = (fallbackOutput = '') => {
+        if (parsedEvents === 0 && fallbackOutput)
+            push(fallbackOutput);
+        if (buffer.trim())
+            parseLine(buffer);
+        buffer = '';
+        return buildExecutionEvidence(runtime, internalCalls, observedArtifacts, blockers);
+    };
+    return { push, finish };
+}
+export function bindParentSummaryToHostCapabilityEvidence(value, evidence) {
+    const parsed = parseJsonObject(value);
+    const hostEvidenceRequired = evidence.runtime.requested_capability_ids.length > 0
+        || evidence.tool_calls.length > 0
+        || evidence.artifacts.length > 0;
+    if (!parsed) {
+        return {
+            value,
+            blockers: hostEvidenceRequired ? ['host_capability_parent_summary_not_structured'] : []
+        };
+    }
+    const blockers = [...evidence.blockers];
+    if (parsed.capabilities_used !== undefined
+        && JSON.stringify(parsed.capabilities_used) !== JSON.stringify(evidence.capabilities_used)) {
+        blockers.push('host_capability_parent_receipts_mismatch');
+    }
+    if (parsed.artifacts !== undefined
+        && JSON.stringify(parsed.artifacts) !== JSON.stringify(evidence.artifacts)) {
+        blockers.push('host_artifact_parent_receipts_mismatch');
+    }
+    const bindReceipts = hostEvidenceRequired
+        || parsed.capabilities_used !== undefined
+        || parsed.artifacts !== undefined;
+    const mergedBlockers = uniqueStrings([
+        ...arrayStrings(parsed.blockers),
+        ...blockers
+    ]);
+    const next = {
+        ...parsed,
+        ...(bindReceipts ? {
+            capabilities_used: evidence.capabilities_used,
+            artifacts: evidence.artifacts
+        } : {}),
+        ...(mergedBlockers.length > 0 ? { blockers: mergedBlockers } : {}),
+        ...(parsed.status === 'completed' && mergedBlockers.length > 0 ? { status: 'blocked' } : {})
+    };
+    return { value: next, blockers: uniqueStrings(blockers) };
+}
+function buildExecutionEvidence(runtime, calls, artifactRows, initialBlockers) {
+    const blockers = [...runtime.blockers, ...initialBlockers];
+    const requested = new Set(runtime.requested_capability_ids);
+    for (const call of calls) {
+        if (!runtime.allowed_tool_names.includes(call.tool))
+            blockers.push(`host_tool_call_not_allowed:${call.tool}`);
+        if (EXPLICIT_DENIAL_PATTERN.test(call.tool))
+            blockers.push(`host_tool_call_explicitly_denied:${call.tool}`);
+        if (call.status === 'failed')
+            blockers.push(`host_tool_call_failed:${call.tool}`);
+    }
+    const dedupedArtifactRows = dedupeObservedArtifacts(artifactRows);
+    if (dedupedArtifactRows.length > MAX_ARTIFACT_RECEIPTS)
+        blockers.push('host_artifact_receipts_too_many');
+    const receiptArtifactRows = dedupedArtifactRows.slice(0, MAX_ARTIFACT_RECEIPTS);
+    const artifacts = receiptArtifactRows.map(projectArtifactReceipt);
+    const artifactSources = receiptArtifactRows.map(projectArtifactSourceReceipt);
+    if (requested.size === 0 && calls.length > 0) {
+        for (const call of calls)
+            blockers.push(`host_tool_call_not_requested:${call.tool}`);
+    }
+    const capabilitiesUsed = [];
+    for (const descriptor of HOST_CAPABILITY_DESCRIPTORS) {
+        if (!requested.has(descriptor.id))
+            continue;
+        const relevantCalls = calls.filter((call) => descriptor.tool_names.includes(call.tool));
+        const capabilityBlockers = validateCapabilityWorkflow(runtime, descriptor, relevantCalls, calls, artifactRows);
+        blockers.push(...capabilityBlockers);
+        const status = capabilityBlockers.length === 0 && relevantCalls.every((call) => call.status === 'passed')
+            ? 'passed'
+            : 'failed';
+        const capabilityArtifactSources = descriptor.executable === false
+            ? artifactSources
+            : [];
+        const toolNames = uniqueStrings([
+            ...relevantCalls.map((call) => call.tool),
+            ...capabilityArtifactSources.map((source) => source.source_tool)
+        ]);
+        const receiptSha256 = `sha256:${sha256(JSON.stringify({
+            id: descriptor.id,
+            calls: relevantCalls.map((call) => call.raw_hash),
+            artifacts: capabilityArtifactSources.map((source) => source.source_event_sha256)
+        }))}`;
+        capabilitiesUsed.push({ id: descriptor.id, status, tool_names: toolNames, receipt_sha256: receiptSha256 });
+    }
+    const uniqueBlockersValue = uniqueStrings(blockers);
+    return {
+        schema: HOST_CAPABILITY_EVIDENCE_SCHEMA,
+        ok: uniqueBlockersValue.length === 0 && capabilitiesUsed.every((receipt) => receipt.status === 'passed'),
+        runtime,
+        tool_calls: calls.map(({ server, tool, status, event_sha256 }) => ({ server, tool, status, event_sha256 })),
+        capabilities_used: capabilitiesUsed,
+        artifacts,
+        artifact_sources: artifactSources,
+        blockers: uniqueBlockersValue
+    };
+}
+function validateCapabilityWorkflow(runtime, descriptor, calls, allCalls, artifacts) {
+    const blockers = [];
+    const passed = (tool) => calls.filter((call) => call.tool === tool && call.status === 'passed');
+    if (descriptor.executable !== false && calls.length === 0)
+        blockers.push(`host_capability_call_missing:${descriptor.id}`);
+    if (calls.some((call) => call.status !== 'passed'))
+        blockers.push(`host_capability_call_failed:${descriptor.id}`);
+    if (descriptor.id === 'host.datasource.schema.v1' && passed('datasource_schema_context').length === 0) {
+        blockers.push('host_capability_schema_call_missing');
+    }
+    if (descriptor.id === 'host.datasource.query.readonly.v1') {
+        const schemaCall = allCalls.find((call) => call.tool === 'datasource_schema_context' && call.status === 'passed') || null;
+        const queryCalls = passed('datasource_query_readonly');
+        const queryCall = queryCalls[0] || null;
+        const schemaIndex = schemaCall?.index ?? -1;
+        const queryIndex = queryCall?.index ?? -1;
+        if (queryIndex < 0)
+            blockers.push('host_capability_readonly_query_call_missing');
+        if (runtime.task_workflows.includes('datasource_query') && queryCalls.length !== 1) {
+            blockers.push('host_capability_readonly_query_count_invalid');
+        }
+        if (runtime.task_workflows.includes('datasource_query') && (schemaIndex < 0 || queryIndex <= schemaIndex)) {
+            blockers.push('host_capability_datasource_sequence_invalid');
+        }
+        const schemaReceipt = schemaCall?.semantic_receipt?.kind === 'datasource_schema'
+            ? schemaCall.semantic_receipt
+            : null;
+        const queryReceipts = queryCalls
+            .map((call) => call.semantic_receipt?.kind === 'datasource_query' ? call.semantic_receipt : null);
+        if (queryCalls.length > 0 && queryReceipts.some((receipt) => !receipt)) {
+            blockers.push('host_capability_readonly_query_receipt_invalid');
+        }
+        if (schemaCall && !schemaReceipt)
+            blockers.push('host_capability_schema_receipt_invalid');
+        if (schemaReceipt && queryReceipts.some((receipt) => receipt
+            && schemaReceipt.schema_snapshot_sha256 !== receipt.schema_snapshot_sha256)) {
+            blockers.push('host_capability_readonly_query_schema_mismatch');
+        }
+        if (schemaReceipt && queryReceipts.some((receipt) => receipt
+            && schemaReceipt.datasource_sha256 !== receipt.datasource_sha256)) {
+            blockers.push('host_capability_readonly_query_datasource_mismatch');
+        }
+    }
+    if (descriptor.id === 'host.spreadsheet.workbook.v1') {
+        const creates = passed('spreadsheet_create');
+        const updates = passed('spreadsheet_update');
+        const inspections = passed('spreadsheet_inspect');
+        const create = creates[0]?.index ?? -1;
+        const updateIndexes = updates.map((call) => call.index);
+        const inspectionIndexes = inspections.map((call) => call.index);
+        if (runtime.task_workflows.includes('spreadsheet_create')) {
+            if (creates.length !== 1)
+                blockers.push('host_capability_spreadsheet_create_sequence_invalid');
+            if (updates.length > 1)
+                blockers.push('host_capability_spreadsheet_create_update_count_invalid');
+            const update = updateIndexes[0] ?? -1;
+            const inspectedAfterCreate = inspectionIndexes.some((index) => index > create && (update < 0 || index < update));
+            const inspectedAfterMutation = update >= 0
+                ? inspectionIndexes.some((index) => index > update)
+                : inspectionIndexes.some((index) => index > create);
+            if (create < 0
+                || !inspectedAfterCreate
+                || !inspectedAfterMutation
+                || (update >= 0 && update <= create)) {
+                blockers.push('host_capability_spreadsheet_create_sequence_invalid');
+            }
+        }
+        if (runtime.task_workflows.includes('spreadsheet_edit')) {
+            const update = updateIndexes[0] ?? -1;
+            if (updates.length !== 1)
+                blockers.push('host_capability_spreadsheet_edit_update_count_invalid');
+            if (update < 0
+                || !inspectionIndexes.some((index) => index < update)
+                || !inspectionIndexes.some((index) => index > update)) {
+                blockers.push('host_capability_spreadsheet_edit_sequence_invalid');
+            }
+        }
+        if (runtime.task_workflows.includes('spreadsheet_create') || runtime.task_workflows.includes('spreadsheet_edit')) {
+            if (inspections.some((call) => call.semantic_receipt?.kind !== 'spreadsheet_inspection')) {
+                blockers.push('host_capability_spreadsheet_inspection_receipt_invalid');
+            }
+            const passedSpreadsheetCalls = calls.filter((call) => call.status === 'passed');
+            const resourceKeys = uniqueStrings(passedSpreadsheetCalls.map((call) => call.resource_key));
+            const lastMutation = [...creates, ...updates].sort((left, right) => right.index - left.index)[0] || null;
+            if (passedSpreadsheetCalls.some((call) => !call.resource_key)) {
+                blockers.push('host_capability_spreadsheet_resource_missing');
+            }
+            if (resourceKeys.length > 1)
+                blockers.push('host_capability_spreadsheet_resource_mismatch');
+            const finalMutationArtifacts = lastMutation
+                ? artifacts.filter((artifact) => (artifact.source_index === lastMutation.index
+                    && artifact.source_tool === lastMutation.tool))
+                : [];
+            if (lastMutation && finalMutationArtifacts.some((artifact) => (isSpreadsheetDeliverable(artifact)
+                && !artifactMatchesResource(artifact, lastMutation.resource_key)))) {
+                blockers.push('host_capability_spreadsheet_resource_mismatch');
+            }
+            if (!lastMutation || !finalMutationArtifacts.some((artifact) => (isSpreadsheetDeliverable(artifact)
+                && artifactMatchesResource(artifact, lastMutation.resource_key)))) {
+                blockers.push('host_capability_spreadsheet_final_artifact_missing');
+            }
+        }
+    }
+    if (descriptor.id === 'host.document.render.v1' && runtime.task_workflows.includes('document_render')) {
+        const renderCalls = [...passed('html_to_pdf'), ...passed('html_to_screenshot')].sort((left, right) => left.index - right.index);
+        if (renderCalls.length === 0) {
+            blockers.push('host_capability_document_render_call_missing');
+        }
+        else {
+            const sourceWrite = allCalls.find((call) => (call.status === 'passed'
+                && (call.tool === 'write_file' || call.tool === 'edit_file')
+                && call.index < renderCalls[0].index));
+            if (!sourceWrite)
+                blockers.push('host_capability_document_source_sequence_invalid');
+            const finalRender = renderCalls.at(-1);
+            if (!artifacts.some((artifact) => (artifact.source_tool === finalRender.tool
+                && artifact.source_index === finalRender.index
+                && isDocumentRenderDeliverable(artifact, finalRender.tool)))) {
+                blockers.push('host_capability_document_render_artifact_missing');
+            }
+        }
+    }
+    if (descriptor.id === 'host.web.capture.v1'
+        && runtime.task_workflows.includes('web_capture')
+        && passed('capture_url_screenshot').length === 0) {
+        blockers.push('host_capability_web_capture_call_missing');
+    }
+    if (descriptor.id === 'host.artifact.receipt.v1' && artifacts.length === 0) {
+        blockers.push('host_capability_artifact_receipt_missing');
+    }
+    return uniqueStrings(blockers);
+}
+function extractToolResourceKey(item) {
+    if (!isRecord(item))
+        return null;
+    const queue = [
+        { value: item.arguments, depth: 0 },
+        { value: item.input, depth: 0 },
+        { value: item.result?.structured_content ?? item.result?.structuredContent ?? item.result, depth: 0 }
+    ];
+    let visited = 0;
+    while (queue.length > 0 && visited < 256) {
+        const current = queue.shift();
+        visited += 1;
+        if (current.depth > 5 || current.value === null || current.value === undefined)
+            continue;
+        if (Array.isArray(current.value)) {
+            for (const child of current.value)
+                queue.push({ value: child, depth: current.depth + 1 });
+            continue;
+        }
+        if (!isRecord(current.value))
+            continue;
+        for (const [key, value] of Object.entries(current.value)) {
+            if (/^(?:path|file_path|filepath|workbook_path|workbook|source_path|target_path|output_path)$/i.test(key)) {
+                const resourcePath = normalizeWorkspaceResourcePath(value);
+                if (resourcePath)
+                    return `sha256:${sha256(resourcePath)}`;
+            }
+            queue.push({ value, depth: current.depth + 1 });
+        }
+    }
+    return null;
+}
+function normalizeWorkspaceResourcePath(value) {
+    if (typeof value !== 'string')
+        return null;
+    const original = value.trim();
+    if (!original
+        || original.length > MAX_ARTIFACT_PATH_CHARS
+        || /[\r\n\0\\]/.test(original)
+        || original.startsWith('/')
+        || /^[a-z]:/i.test(original))
+        return null;
+    const segments = original.split('/');
+    if (segments.length === 0 || segments.some((segment) => !segment || segment === '.' || segment === '..'))
+        return null;
+    return segments.join('/');
+}
+function isSpreadsheetDeliverable(artifact) {
+    const artifactPath = normalizeWorkspaceResourcePath(artifact.path);
+    return artifact.role === 'deliverable'
+        && (artifact.kind === 'xlsx' || artifact.kind === 'spreadsheet')
+        && artifact.media_type === XLSX_MEDIA_TYPE
+        && Boolean(artifactPath && /\.xlsx$/i.test(artifactPath));
+}
+function artifactMatchesResource(artifact, resourceKey) {
+    const artifactPath = normalizeWorkspaceResourcePath(artifact.path);
+    return Boolean(resourceKey && artifactPath && `sha256:${sha256(artifactPath)}` === resourceKey);
+}
+function isDocumentRenderDeliverable(artifact, tool) {
+    const artifactPath = normalizeWorkspaceResourcePath(artifact.path);
+    const pdf = tool === 'html_to_pdf';
+    return artifact.role === 'deliverable'
+        && artifact.kind === (pdf ? 'pdf' : 'png')
+        && artifact.media_type === (pdf ? 'application/pdf' : 'image/png')
+        && Boolean(artifactPath && (pdf ? /\.pdf$/i : /\.png$/i).test(artifactPath));
+}
+function extractArtifactReceipts(value) {
+    const result = [];
+    const queue = [{ value, depth: 0 }];
+    let visited = 0;
+    while (queue.length > 0 && visited < 512) {
+        const current = queue.shift();
+        visited += 1;
+        if (current.depth > 6 || current.value === null || current.value === undefined)
+            continue;
+        if (typeof current.value === 'string') {
+            const text = current.value.trim();
+            if (text && Buffer.byteLength(text, 'utf8') <= MAX_RECEIPT_JSON_STRING_BYTES && /^[{[]/.test(text)) {
+                try {
+                    queue.push({ value: JSON.parse(text), depth: current.depth + 1 });
+                }
+                catch { }
+            }
+            continue;
+        }
+        if (Array.isArray(current.value)) {
+            for (const child of current.value)
+                queue.push({ value: child, depth: current.depth + 1 });
+            continue;
+        }
+        if (!isRecord(current.value))
+            continue;
+        const artifact = normalizeArtifactReceipt(current.value);
+        if (artifact)
+            result.push(artifact);
+        for (const child of Object.values(current.value))
+            queue.push({ value: child, depth: current.depth + 1 });
+    }
+    return dedupeArtifacts(result);
+}
+function normalizeArtifactReceipt(value) {
+    const artifactPath = normalizeWorkspaceResourcePath(value.path) || '';
+    const kind = typeof value.kind === 'string' ? value.kind.trim().toLowerCase() : '';
+    const mediaType = typeof value.media_type === 'string'
+        ? value.media_type.trim().toLowerCase()
+        : typeof value.mediaType === 'string' ? value.mediaType.trim().toLowerCase() : '';
+    const receiptHash = typeof value.sha256 === 'string' ? value.sha256.trim().toLowerCase() : '';
+    const bytes = typeof value.bytes === 'number' && Number.isSafeInteger(value.bytes) && value.bytes > 0 ? value.bytes : 0;
+    const role = typeof value.role === 'string' && ['deliverable', 'scratch', 'temp', 'log'].includes(value.role)
+        ? value.role
+        : null;
+    if (!artifactPath
+        || !kind
+        || kind.length > 64
+        || !mediaType
+        || mediaType.length > 160
+        || !SHA256_RECEIPT_PATTERN.test(receiptHash)
+        || !bytes
+        || !role)
+        return null;
+    return { path: artifactPath, kind, media_type: mediaType, sha256: receiptHash, bytes, role };
+}
+function dedupeArtifacts(values) {
+    const byPath = new Map(values.map((value) => [value.path, {
+            path: value.path,
+            kind: value.kind,
+            media_type: value.media_type,
+            sha256: value.sha256,
+            bytes: value.bytes,
+            role: value.role
+        }]));
+    return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+function dedupeObservedArtifacts(values) {
+    const byPath = new Map(values.map((value) => [value.path, value]));
+    return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+function projectArtifactReceipt(value) {
+    return {
+        path: value.path,
+        kind: value.kind,
+        media_type: value.media_type,
+        sha256: value.sha256,
+        bytes: value.bytes,
+        role: value.role
+    };
+}
+function projectArtifactSourceReceipt(value) {
+    return {
+        path: value.path,
+        source_tool: value.source_tool,
+        source_event_sha256: value.source_hash
+    };
+}
+function emptyHookObservations(binding) {
+    return {
+        schema: HOST_CAPABILITY_HOOK_OBSERVATIONS_SCHEMA,
+        mission_id: binding.mission_id,
+        workflow_run_id: binding.workflow_run_id,
+        session_scope: binding.session_scope,
+        allowlist_digest: binding.runtime.allowlist_digest,
+        pre_tool_uses: [],
+        tool_calls: [],
+        blockers: []
+    };
+}
+function normalizePreToolObservation(value) {
+    if (!isRecord(value)
+        || !SHA256_RECEIPT_PATTERN.test(String(value.tool_use_id_sha256 || ''))
+        || typeof value.tool !== 'string'
+        || value.tool.length === 0
+        || value.tool.length > 128
+        || (value.decision !== 'allowed' && value.decision !== 'denied'))
+        return null;
+    const resourceKey = value.resource_key === undefined || value.resource_key === null
+        ? null
+        : SHA256_RECEIPT_PATTERN.test(String(value.resource_key || ''))
+            ? String(value.resource_key)
+            : undefined;
+    if (resourceKey === undefined)
+        return null;
+    const datasourceSha256 = value.datasource_sha256 === undefined || value.datasource_sha256 === null
+        ? null
+        : SHA256_RECEIPT_PATTERN.test(String(value.datasource_sha256 || ''))
+            ? String(value.datasource_sha256)
+            : undefined;
+    const schemaSnapshotSha256 = value.schema_snapshot_sha256 === undefined || value.schema_snapshot_sha256 === null
+        ? null
+        : SHA256_RECEIPT_PATTERN.test(String(value.schema_snapshot_sha256 || ''))
+            ? String(value.schema_snapshot_sha256)
+            : undefined;
+    if (datasourceSha256 === undefined || schemaSnapshotSha256 === undefined)
+        return null;
+    const legacyStatus = value.decision === 'denied' ? 'denied' : 'pending';
+    const reservationStatus = value.reservation_status === undefined
+        ? legacyStatus
+        : ['pending', 'completed', 'failed', 'denied'].includes(String(value.reservation_status || ''))
+            ? value.reservation_status
+            : null;
+    const blocker = value.blocker === undefined || value.blocker === null
+        ? null
+        : typeof value.blocker === 'string' && value.blocker.length > 0 && value.blocker.length <= 160
+            ? value.blocker
+            : undefined;
+    if (!reservationStatus || blocker === undefined
+        || (value.decision === 'denied' && reservationStatus !== 'denied')
+        || (value.decision === 'allowed' && reservationStatus === 'denied'))
+        return null;
+    return {
+        tool_use_id_sha256: value.tool_use_id_sha256,
+        tool: value.tool,
+        resource_key: resourceKey,
+        datasource_sha256: datasourceSha256,
+        schema_snapshot_sha256: schemaSnapshotSha256,
+        decision: value.decision,
+        reservation_status: reservationStatus,
+        blocker
+    };
+}
+function isPostToolObservation(value) {
+    if (!isRecord(value)
+        || !Number.isSafeInteger(value.sequence)
+        || Number(value.sequence) < 1
+        || !SHA256_RECEIPT_PATTERN.test(String(value.tool_use_id_sha256 || ''))
+        || typeof value.tool !== 'string'
+        || value.tool.length === 0
+        || value.tool.length > 128
+        || (value.status !== 'passed' && value.status !== 'failed')
+        || !SHA256_RECEIPT_PATTERN.test(String(value.event_sha256 || ''))
+        || (value.resource_key !== null && !SHA256_RECEIPT_PATTERN.test(String(value.resource_key || '')))
+        || !isHostToolSemanticReceipt(value.semantic_receipt)
+        || (value.validation_blocker !== null
+            && (typeof value.validation_blocker !== 'string' || value.validation_blocker.length > 160))
+        || !Array.isArray(value.artifacts))
+        return false;
+    return value.artifacts.length <= MAX_ARTIFACT_RECEIPTS
+        && value.artifacts.every((artifact) => isRecord(artifact) && normalizeArtifactReceipt(artifact) !== null);
+}
+function normalizePostToolObservation(value) {
+    if (!isPostToolObservation(value))
+        return null;
+    const semanticReceipt = normalizeStoredSemanticReceipt(value.semantic_receipt);
+    if (value.semantic_receipt !== null && !semanticReceipt)
+        return null;
+    return {
+        sequence: value.sequence,
+        tool_use_id_sha256: value.tool_use_id_sha256,
+        tool: value.tool,
+        status: value.status,
+        event_sha256: value.event_sha256,
+        resource_key: value.resource_key,
+        semantic_receipt: semanticReceipt,
+        validation_blocker: value.validation_blocker,
+        artifacts: value.artifacts.map((artifact) => normalizeArtifactReceipt(artifact))
+    };
+}
+function isHostCapabilityRuntime(value) {
+    if (!isRecord(value)
+        || value.schema !== HOST_CAPABILITY_RUNTIME_SCHEMA
+        || typeof value.ok !== 'boolean'
+        || value.server !== HOST_CAPABILITY_MCP_SERVER
+        || !Array.isArray(value.requested_capability_ids)
+        || !Array.isArray(value.task_workflows)
+        || !Array.isArray(value.requested_tool_names)
+        || !Array.isArray(value.observed_tool_names)
+        || !Array.isArray(value.allowed_tool_names)
+        || !Array.isArray(value.denied_tool_names)
+        || !Array.isArray(value.explicit_denied_tool_names)
+        || !Array.isArray(value.capabilities)
+        || !Array.isArray(value.blockers))
+        return false;
+    const knownIds = new Set(HOST_CAPABILITY_DESCRIPTORS.map((descriptor) => descriptor.id));
+    const knownTools = new Set(HOST_CAPABILITY_DESCRIPTORS.flatMap((descriptor) => descriptor.tool_names));
+    const requested = uniqueStrings(value.requested_capability_ids);
+    const requestedTools = uniqueStrings(value.requested_tool_names);
+    const observed = uniqueStrings(value.observed_tool_names);
+    const allowed = uniqueStrings(value.allowed_tool_names);
+    const denied = uniqueStrings(value.denied_tool_names);
+    const blockers = uniqueStrings(value.blockers);
+    if (requested.length !== value.requested_capability_ids.length
+        || requested.some((id) => !knownIds.has(id))
+        || requestedTools.length !== value.requested_tool_names.length
+        || requestedTools.some((tool) => !knownTools.has(tool))
+        || observed.length !== value.observed_tool_names.length
+        || allowed.length !== value.allowed_tool_names.length
+        || allowed.some((tool) => !knownTools.has(tool) || !observed.includes(tool) || EXPLICIT_DENIAL_PATTERN.test(tool))
+        || denied.length !== value.denied_tool_names.length
+        || JSON.stringify(denied) !== JSON.stringify(observed.filter((tool) => !allowed.includes(tool)))
+        || blockers.length !== value.blockers.length
+        || value.blockers.some((blocker) => typeof blocker !== 'string' || blocker.length > 256)
+        || value.ok !== (blockers.length === 0)
+        || JSON.stringify(uniqueWorkflows(value.task_workflows)) !== JSON.stringify(value.task_workflows)
+        || value.capabilities.length !== HOST_CAPABILITY_DESCRIPTORS.length
+        || JSON.stringify(value.capabilities.map((entry) => entry?.id))
+            !== JSON.stringify(HOST_CAPABILITY_DESCRIPTORS.map((descriptor) => descriptor.id))
+        || value.capabilities.some((entry) => !isHostCapabilityRuntimeEntry(entry, requested, observed, allowed))
+        || typeof value.server_present !== 'boolean'
+        || typeof value.server_enabled !== 'boolean'
+        || value.server_scope !== (value.server_present ? 'project' : null)
+        || (value.inventory_source !== null && !boundedRuntimeText(value.inventory_source, 512))
+        || !boundedRuntimeText(value.health_status, 128))
+        return false;
+    const allowedFromEntries = uniqueStrings(value.capabilities.flatMap((entry) => entry.allowed_tool_names));
+    if (JSON.stringify(allowedFromEntries) !== JSON.stringify(allowed))
+        return false;
+    const explicitDenied = denied.filter((tool) => EXPLICIT_DENIAL_PATTERN.test(tool));
+    if (JSON.stringify(explicitDenied) !== JSON.stringify(value.explicit_denied_tool_names))
+        return false;
+    const expectedDigest = hostCapabilityRuntimeDigest(value);
+    return value.allowlist_digest === expectedDigest
+        && value.capability_digest === hostCapabilityDigest(HOST_CAPABILITY_DESCRIPTORS);
+}
+function isHostCapabilityRuntimeEntry(value, requested, observed, allowed) {
+    if (!isRecord(value)
+        || typeof value.id !== 'string'
+        || typeof value.requested !== 'boolean'
+        || !['available', 'missing', 'unhealthy', 'not_requested'].includes(String(value.state || ''))
+        || !Array.isArray(value.expected_tool_names)
+        || !Array.isArray(value.observed_tool_names)
+        || !Array.isArray(value.allowed_tool_names)
+        || !Array.isArray(value.blockers))
+        return false;
+    const descriptor = HOST_CAPABILITY_DESCRIPTORS.find((entry) => entry.id === value.id);
+    if (!descriptor)
+        return false;
+    const expectedObserved = uniqueStrings(descriptor.tool_names.filter((tool) => observed.includes(tool)));
+    const expectedAllowed = descriptor.executable !== false && requested.includes(value.id)
+        ? uniqueStrings(descriptor.tool_names.filter((tool) => allowed.includes(tool)))
+        : [];
+    const entryBlockers = uniqueStrings(value.blockers);
+    return value.requested === requested.includes(value.id)
+        && JSON.stringify(value.expected_tool_names) === JSON.stringify(descriptor.tool_names)
+        && JSON.stringify(value.allowed_tool_names) === JSON.stringify(expectedAllowed)
+        && JSON.stringify(value.observed_tool_names) === JSON.stringify(expectedObserved)
+        && JSON.stringify(value.blockers) === JSON.stringify(entryBlockers)
+        && entryBlockers.every((blocker) => blocker.length <= 256)
+        && (requested.includes(value.id) ? value.state !== 'not_requested' : value.state === 'not_requested');
+}
+function hostCapabilityRuntimeMatchesRequest(runtime, request) {
+    return JSON.stringify(runtime.requested_capability_ids) === JSON.stringify(uniqueStrings(request.capability_ids))
+        && JSON.stringify(runtime.task_workflows) === JSON.stringify(uniqueWorkflows(request.workflows))
+        && JSON.stringify(runtime.requested_tool_names) === JSON.stringify(uniqueStrings(request.tool_names || []));
+}
+function structuredHostToolResponse(value) {
+    if (!isRecord(value))
+        return null;
+    const nested = value.structured_content ?? value.structuredContent;
+    if (nested !== undefined)
+        return parseJsonObject(nested);
+    return value;
+}
+function normalizeHostToolSemanticReceipt(tool, toolInput, response) {
+    if (tool === 'datasource_schema_context') {
+        const input = isRecord(toolInput) ? toolInput : {};
+        const datasource = boundedIdentity(response.datasource);
+        const inputDatasource = boundedIdentity(input.datasource);
+        const snapshotId = boundedIdentity(response.schema_snapshot_id);
+        return datasource && (!inputDatasource || datasource === inputDatasource) && snapshotId
+            ? {
+                receipt: {
+                    kind: 'datasource_schema',
+                    datasource_sha256: `sha256:${sha256(datasource)}`,
+                    schema_snapshot_sha256: `sha256:${sha256(snapshotId)}`
+                },
+                blocker: null
+            }
+            : {
+                receipt: null,
+                blocker: datasource && inputDatasource && datasource !== inputDatasource
+                    ? 'host_capability_schema_datasource_mismatch'
+                    : 'host_capability_schema_receipt_invalid'
+            };
+    }
+    if (tool === 'datasource_query_readonly') {
+        const input = isRecord(toolInput) ? toolInput : {};
+        const datasource = boundedIdentity(response.datasource);
+        const inputDatasource = boundedIdentity(input.datasource);
+        const snapshotId = boundedIdentity(response.schema_snapshot_id);
+        const inputSnapshotId = boundedIdentity(input.schema_snapshot_id);
+        const query = boundedQueryText(input.query ?? input.sql);
+        const querySha256 = typeof response.query_sha256 === 'string'
+            ? response.query_sha256.trim().toLowerCase()
+            : '';
+        const rowCount = nonnegativeSafeInteger(response.row_count);
+        const columnCount = nonnegativeSafeInteger(response.column_count);
+        const status = String(response.status || '').trim().toLowerCase();
+        if (!datasource) {
+            return { receipt: null, blocker: 'host_capability_readonly_query_receipt_invalid' };
+        }
+        if (inputDatasource && datasource !== inputDatasource) {
+            return { receipt: null, blocker: 'host_capability_readonly_query_datasource_mismatch' };
+        }
+        if (!snapshotId || !inputSnapshotId || snapshotId !== inputSnapshotId) {
+            return { receipt: null, blocker: 'host_capability_readonly_query_schema_mismatch' };
+        }
+        if (!query || !SHA256_RECEIPT_PATTERN.test(querySha256)
+            || querySha256 !== `sha256:${sha256(query)}`) {
+            return { receipt: null, blocker: 'host_capability_readonly_query_hash_mismatch' };
+        }
+        if (rowCount === null || columnCount === null || typeof response.truncated !== 'boolean' || status !== 'passed') {
+            return { receipt: null, blocker: 'host_capability_readonly_query_receipt_invalid' };
+        }
+        return {
+            receipt: {
+                kind: 'datasource_query',
+                datasource_sha256: `sha256:${sha256(datasource)}`,
+                schema_snapshot_sha256: `sha256:${sha256(snapshotId)}`,
+                query_sha256: querySha256,
+                row_count: rowCount,
+                column_count: columnCount,
+                truncated: response.truncated,
+                status: 'passed'
+            },
+            blocker: null
+        };
+    }
+    if (tool === 'spreadsheet_inspect') {
+        const sheetNames = Array.isArray(response.sheet_names)
+            ? response.sheet_names.map((value) => boundedIdentity(value)).filter(Boolean)
+            : [];
+        const rowCountKeys = isRecord(response.row_counts) ? Object.keys(response.row_counts).sort() : [];
+        const rowCounts = isRecord(response.row_counts)
+            ? Object.values(response.row_counts).map(nonnegativeSafeInteger)
+            : [];
+        const formulas = Array.isArray(response.formulas) ? response.formulas : null;
+        const errorCells = Array.isArray(response.error_cells) ? response.error_cells : null;
+        const successful = response.ok === true || response.success === true
+            || ['passed', 'success', 'completed'].includes(String(response.status || '').trim().toLowerCase());
+        if (!successful
+            || sheetNames.length === 0
+            || sheetNames.length > 256
+            || uniqueStrings(sheetNames).length !== sheetNames.length
+            || sheetNames.length !== response.sheet_names.length
+            || rowCounts.length !== sheetNames.length
+            || JSON.stringify(rowCountKeys) !== JSON.stringify([...sheetNames].sort())
+            || rowCounts.some((count) => count === null)
+            || formulas === null
+            || formulas.length > MAX_SEMANTIC_RECEIPT_ITEMS
+            || errorCells === null
+            || errorCells.length > MAX_SEMANTIC_RECEIPT_ITEMS) {
+            return { receipt: null, blocker: 'host_capability_spreadsheet_inspection_receipt_invalid' };
+        }
+        if (errorCells.length > 0) {
+            return { receipt: null, blocker: 'host_capability_spreadsheet_error_cells_present' };
+        }
+        const totalRowCount = rowCounts.reduce((sum, count) => sum + count, 0);
+        if (!Number.isSafeInteger(totalRowCount)) {
+            return { receipt: null, blocker: 'host_capability_spreadsheet_inspection_receipt_invalid' };
+        }
+        return {
+            receipt: {
+                kind: 'spreadsheet_inspection',
+                sheet_names_sha256: `sha256:${sha256(JSON.stringify(sheetNames))}`,
+                sheet_count: sheetNames.length,
+                row_count: totalRowCount,
+                formula_count: formulas.length,
+                error_cell_count: 0
+            },
+            blocker: null
+        };
+    }
+    return { receipt: null, blocker: null };
+}
+function isHostToolSemanticReceipt(value) {
+    if (value === null)
+        return true;
+    if (!isRecord(value))
+        return false;
+    if (value.kind === 'datasource_schema') {
+        return SHA256_RECEIPT_PATTERN.test(String(value.datasource_sha256 || ''))
+            && SHA256_RECEIPT_PATTERN.test(String(value.schema_snapshot_sha256 || ''));
+    }
+    if (value.kind === 'datasource_query') {
+        return SHA256_RECEIPT_PATTERN.test(String(value.datasource_sha256 || ''))
+            && SHA256_RECEIPT_PATTERN.test(String(value.schema_snapshot_sha256 || ''))
+            && SHA256_RECEIPT_PATTERN.test(String(value.query_sha256 || ''))
+            && nonnegativeSafeInteger(value.row_count) !== null
+            && nonnegativeSafeInteger(value.column_count) !== null
+            && typeof value.truncated === 'boolean'
+            && value.status === 'passed';
+    }
+    if (value.kind === 'spreadsheet_inspection') {
+        return SHA256_RECEIPT_PATTERN.test(String(value.sheet_names_sha256 || ''))
+            && nonnegativeSafeInteger(value.sheet_count) !== null
+            && nonnegativeSafeInteger(value.row_count) !== null
+            && nonnegativeSafeInteger(value.formula_count) !== null
+            && value.error_cell_count === 0;
+    }
+    return false;
+}
+function normalizeStoredSemanticReceipt(value) {
+    if (value === null)
+        return null;
+    if (!isHostToolSemanticReceipt(value))
+        return null;
+    if (value.kind === 'datasource_schema') {
+        return {
+            kind: value.kind,
+            datasource_sha256: value.datasource_sha256,
+            schema_snapshot_sha256: value.schema_snapshot_sha256
+        };
+    }
+    if (value.kind === 'datasource_query') {
+        return {
+            kind: value.kind,
+            datasource_sha256: value.datasource_sha256,
+            schema_snapshot_sha256: value.schema_snapshot_sha256,
+            query_sha256: value.query_sha256,
+            row_count: value.row_count,
+            column_count: value.column_count,
+            truncated: value.truncated,
+            status: 'passed'
+        };
+    }
+    return {
+        kind: value.kind,
+        sheet_names_sha256: value.sheet_names_sha256,
+        sheet_count: value.sheet_count,
+        row_count: value.row_count,
+        formula_count: value.formula_count,
+        error_cell_count: 0
+    };
+}
+function nonnegativeSafeInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function boundedRuntimeText(value, maxLength) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    return text && text.length <= maxLength && !/[\r\n\0]/.test(text) ? text : null;
+}
+function boundedQueryText(value) {
+    const text = typeof value === 'string' ? value : '';
+    return text.trim()
+        && Buffer.byteLength(text, 'utf8') <= MAX_RECEIPT_JSON_STRING_BYTES
+        && !/[\0]/.test(text)
+        ? text
+        : null;
+}
+function hostToolResponseFailed(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.isError === true || value.is_error === true || value.ok === false || value.success === false)
+        return true;
+    const status = String(value.status || '').trim().toLowerCase();
+    return status === 'failed' || status === 'error';
+}
+function boundedIdentity(value) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    return text && text.length <= 256 && !/[\r\n\0]/.test(text) ? text : null;
+}
+function parseJsonObject(value) {
+    if (isRecord(value))
+        return value;
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    const trimmed = value.trim();
+    const fenced = /^```(?:json)?\s*([\s\S]*?)\s*```$/i.exec(trimmed)?.[1]?.trim();
+    for (const candidate of [trimmed, ...(fenced ? [fenced] : [])]) {
+        try {
+            const parsed = JSON.parse(candidate);
+            if (isRecord(parsed))
+                return parsed;
+        }
+        catch { }
+    }
+    return null;
+}
+function uniqueStrings(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))].sort();
+}
+function arrayStrings(value) {
+    return Array.isArray(value)
+        ? value.map((item) => String(item || '').trim()).filter(Boolean)
+        : [];
+}
+function uniqueWorkflows(values) {
+    const valid = new Set([
+        'datasource_sql_generation',
+        'datasource_query',
+        'spreadsheet_create',
+        'spreadsheet_edit',
+        'document_render',
+        'web_capture',
+        'workspace_files',
+        'artifact_delivery'
+    ]);
+    return uniqueStrings(values).filter((value) => valid.has(value));
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}