stylegallery 0.1.0

package/scripts/test-agent-identity-integrity-cases.mjs

@@ -0,0 +1,160 @@
+import { createHash } from "node:crypto";
+import { canonicalize, hashCanonical } from "./agent-native/canonical-json.mjs";
+import {
+  createManifest,
+  createStableRef,
+  createVersionId,
+  parseStableRef,
+  parseVersionId,
+  verifyManifest,
+} from "./agent-native/identity.mjs";
+import { createImmutableStore } from "./agent-native/immutable-store.mjs";
+
+class IntegrityAssertionError extends Error {
+  constructor(message) {
+    super(message);
+    this.code = "assertion_failed";
+  }
+}
+
+function assert(condition, message) {
+  if (!condition) throw new IntegrityAssertionError(message);
+}
+
+function expectCode(execute, code, message) {
+  try {
+    execute();
+  } catch (error) {
+    assert(error?.code === code, `${message}: expected ${code}, got ${error?.code}`);
+    return error.code;
+  }
+  throw new IntegrityAssertionError(`${message}: operation succeeded`);
+}
+
+async function runCase(name, expected, execute) {
+  try {
+    return { actual: await execute(), expected, name, ok: true };
+  } catch (error) {
+    return {
+      actual: {
+        code: error?.code ?? "integrity_case_exception",
+        message: error instanceof Error ? error.message : String(error),
+        ...(error?.path ? { path: error.path } : {}),
+      },
+      expected,
+      name,
+      ok: false,
+    };
+  }
+}
+
+function versioned(stable_ref, content) {
+  return { ...content, stable_ref, version_id: createVersionId({ stable_ref, payload: content }) };
+}
+
+export async function runIdentityIntegrityCases() {
+  const results = [];
+  results.push(await runCase("canonical_json_is_recursive_and_deterministic", "keys sorted recursively", () => {
+    const bytes = canonicalize({ z: 2, a: { z: false, b: 1 }, m: [3, { y: 1, x: 0 }] });
+    assert(bytes === '{"a":{"b":1,"z":false},"m":[3,{"x":0,"y":1}],"z":2}', `unexpected canonical bytes: ${bytes}`);
+    const hashBytes = canonicalize({ b: 2, a: 1 });
+    const digest = hashCanonical({ b: 2, a: 1 }).slice("sha256:".length);
+    assert(digest === createHash("sha256").update(hashBytes).digest("hex"), "canonical hash does not match canonical UTF-8 bytes");
+    return { bytes, digest };
+  }));
+  results.push(await runCase("stable_ref_grammar_and_round_trip", "governed StableRef round-trips", () => {
+    const stable_ref = createStableRef({ kind: "claim", id: "editorial-layout" });
+    assert(parseStableRef(stable_ref).id === "editorial-layout", "opaque id was not parsed");
+    expectCode(() => parseStableRef("claim/editorial layout"), "stable_ref_invalid", "malformed StableRef accepted");
+    return { stable_ref };
+  }));
+  results.push(await runCase("version_id_binds_domain_identity_and_all_content", "StableRef and domain id alter digest", () => {
+    const first = createVersionId({ stable_ref: "sg:claim/shared", id: "alpha", statement: "same" });
+    const reordered = createVersionId({ statement: "same", id: "alpha", stable_ref: "sg:claim/shared" });
+    const second = createVersionId({ stable_ref: "sg:claim/shared", id: "beta", statement: "same" });
+    const otherRef = createVersionId({ stable_ref: "sg:claim/other", id: "alpha", statement: "same" });
+    assert(first === reordered, "VersionID depends on object key order");
+    assert(first !== second, "records differing only by domain id collided");
+    assert(first.split("@sha256:")[1] !== otherRef.split("@sha256:")[1], "StableRef was absent from digest input");
+    const parsed = parseVersionId({ version_id: first, stable_ref: "sg:claim/shared", payload: { id: "alpha", statement: "same" } });
+    assert(parsed.stable_ref === "sg:claim/shared", "VersionID lost its StableRef");
+    const parsedString = parseVersionId(first);
+    assert(parsedString.version_id === first && parsedString.stable_ref === "sg:claim/shared", "raw VersionID string did not round-trip");
+    expectCode(
+      () => parseVersionId({ version_id: first, payload: { id: "beta", statement: "same" } }),
+      "version_digest_mismatch",
+      "changed domain id verified",
+    );
+    return { first, second, other_ref: otherRef };
+  }));
+  results.push(await runCase("immutable_store_rehashes_every_append", "forged and altered records are rejected", () => {
+    const store = createImmutableStore();
+    const valid = versioned("sg:claim/store-fixture", { id: "alpha", nested: { value: "original" } });
+    const inserted = store.append(valid);
+    assert(Object.isFrozen(inserted) && Object.isFrozen(inserted.nested), "stored record is not deeply frozen");
+    try { inserted.nested.value = "tampered"; } catch { /* frozen ESM records throw */ }
+    assert(inserted.nested.value === "original", "stored nested bytes were mutable");
+    expectCode(
+      () => store.append({ ...valid, stable_ref: "sg:claim/forged", version_id: `sg:claim/forged@sha256:${"0".repeat(64)}` }),
+      "version_digest_mismatch",
+      "forged VersionID accepted",
+    );
+    expectCode(
+      () => store.append({ ...valid, nested: { value: "tampered" } }),
+      "version_digest_mismatch",
+      "altered bytes accepted under an existing VersionID",
+    );
+    return { size: store.size, version_id: valid.version_id };
+  }));
+  results.push(await runCase("manifest_binds_version_digest_content_digest_and_content", "inline content is checked three ways", () => {
+    const alphaContent = { id: "alpha", statement: "A" };
+    const zetaContent = { id: "zeta", statement: "Z" };
+    const entry = (stable_ref, content) => ({
+      stable_ref,
+      content,
+      content_sha256: hashCanonical(content).slice("sha256:".length),
+      version_id: createVersionId({ stable_ref, payload: content }),
+    });
+    const manifest = createManifest({
+      manifest_ref: "sg:manifest/identity-fixture",
+      entries: [entry("sg:claim/zeta", zetaContent), entry("sg:claim/alpha", alphaContent)],
+    });
+    assert(manifest.entries[0].stable_ref === "sg:claim/alpha", "entries were not sorted");
+    assert(new Set(manifest.entries.map(({ stable_ref }) => stable_ref)).size === manifest.entries.length, "entries were not unique");
+    assert(verifyManifest(manifest).ok, "fresh content-backed manifest failed verification");
+    expectCode(
+      () => createManifest({ manifest_ref: "sg:manifest/identity-fixture", entries: [entry("sg:claim/alpha", alphaContent), entry("sg:claim/alpha", alphaContent)] }),
+      "manifest_entry_duplicate",
+      "duplicate StableRefs accepted",
+    );
+    expectCode(
+      () => createManifest({ manifest_ref: "sg:manifest/identity-fixture", entries: [{ ...entry("sg:claim/alpha", alphaContent), content: { id: "beta", statement: "A" } }] }),
+      "version_digest_mismatch",
+      "VersionID unrelated to inline content accepted",
+    );
+    expectCode(
+      () => createManifest({ manifest_ref: "sg:manifest/identity-fixture", entries: [{ ...entry("sg:claim/alpha", alphaContent), content_sha256: "1".repeat(64) }] }),
+      "manifest_content_digest_mismatch",
+      "content digest unrelated to inline content accepted",
+    );
+    expectCode(
+      () => createManifest({ manifest_ref: "sg:manifest/identity-fixture", entries: [{ ...entry("sg:claim/alpha", alphaContent), content: { ...alphaContent, stable_ref: "sg:claim/zeta" } }] }),
+      "manifest_content_ref_mismatch",
+      "content carrying a different StableRef accepted",
+    );
+    expectCode(
+      () => createManifest({ manifest_ref: "sg:manifest/identity-fixture", entries: [{ ...entry("sg:claim/alpha", alphaContent), content: { ...alphaContent, version_id: `sg:claim/alpha@sha256:${"0".repeat(64)}` } }] }),
+      "manifest_content_version_mismatch",
+      "content carrying a different VersionID accepted",
+    );
+    const tampered = structuredClone(manifest);
+    tampered.entries[0].content.statement = "tampered";
+    const verification = verifyManifest(tampered);
+    assert(!verification.ok && verification.failures.some(({ code }) => code === "version_digest_mismatch"), "tampered inline content verified");
+    const digestTampered = structuredClone(manifest);
+    digestTampered.sha256 = "0".repeat(64);
+    assert(!verifyManifest(digestTampered).ok, "tampered manifest digest verified");
+    return { entries: manifest.entries.length, version_id: manifest.version_id };
+  }));
+  return results;
+}

package/scripts/test-agent-knowledge-kernel.mjs

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { runIdentityIntegrityCases } from "./test-agent-identity-integrity-cases.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const moduleFiles = Object.freeze({
+  canonical: "scripts/agent-native/canonical-json.mjs",
+  identity: "scripts/agent-native/identity.mjs",
+  store: "scripts/agent-native/immutable-store.mjs",
+  knowledge: "scripts/agent-native/knowledge.mjs",
+});
+
+function failure(code, message, recordPath) {
+  return { code, message, ...(recordPath ? { path: recordPath } : {}) };
+}
+
+function valueAt(record, ...keys) {
+  for (const key of keys) {
+    if (record && Object.hasOwn(record, key)) return record[key];
+  }
+  return undefined;
+}
+
+class ContractError extends Error {
+  constructor(code, message, recordPath) {
+    super(message);
+    this.code = code;
+    this.path = recordPath;
+  }
+}
+
+function requireExport(modules, moduleName, names) {
+  const moduleRecord = modules[moduleName];
+  if (!moduleRecord || moduleRecord.error) {
+    const detail = moduleRecord?.error?.message ?? "module was not loaded";
+    throw new ContractError("kernel_module_missing", `${moduleFiles[moduleName]} is unavailable: ${detail}`, moduleFiles[moduleName]);
+  }
+  for (const name of names) {
+    if (typeof moduleRecord.value?.[name] === "function") return moduleRecord.value[name];
+  }
+  throw new ContractError("kernel_export_missing", `${moduleFiles[moduleName]} must export one of ${names.join(", ")}`, moduleFiles[moduleName]);
+}
+
+function assert(condition, message, recordPath) {
+  if (!condition) throw new ContractError("assertion_failed", message, recordPath);
+}
+
+function resultState(result) {
+  const state = valueAt(result, "state", "evidence_state", "aggregation", "status");
+  return typeof state === "string" ? state.toUpperCase() : state;
+}
+
+function makeFixture(modules) {
+  const claimFactory = requireExport(modules, "knowledge", ["createClaim", "makeClaim"]);
+  const evidenceFactory = requireExport(modules, "knowledge", ["createEvidenceLink", "makeEvidenceLink"]);
+  const validationFactory = requireExport(modules, "knowledge", ["createValidationReport", "makeValidationReport"]);
+  const governanceFactory = requireExport(modules, "knowledge", ["createGovernanceDecision", "makeGovernanceDecision"]);
+  const claim = claimFactory({
+    stable_ref: "sg:claim/editorial-layout",
+    statement: "Editorial layout keeps reading order stable.",
+    subject: "sg:profile/editorial-reference-profile",
+    actor: "sg:agent/fixture",
+  });
+  const evidence = (polarity, suffix) => evidenceFactory({
+    stable_ref: `sg:evidence/editorial-layout-${suffix}`,
+    claim_ref: valueAt(claim, "stable_ref", "stableRef") ?? "sg:claim/editorial-layout",
+    claim_version: valueAt(claim, "version_id", "versionId"),
+    source_ref: "sg:artifact/editorial-layout-fixture",
+    source_version: "sg:artifact/editorial-layout-fixture@sha256:" + "1".repeat(64),
+    polarity,
+    independence_group: `fixture-${suffix}`,
+    actor: `sg:observer/${suffix}`,
+  });
+  const validation = validationFactory({
+    stable_ref: "sg:validation/editorial-layout-pass",
+    claim_ref: valueAt(claim, "stable_ref", "stableRef"),
+    claim_version: valueAt(claim, "version_id", "versionId"),
+    validator: "sg:validator/fixture",
+    validator_version: "sg:validator/fixture@sha256:" + "2".repeat(64),
+    status: "PASSED",
+    inputs: [valueAt(claim, "version_id", "versionId")],
+  });
+  const governance = governanceFactory({
+    stable_ref: "sg:governance/editorial-layout-accept",
+    claim_ref: valueAt(claim, "stable_ref", "stableRef"),
+    claim_version: valueAt(claim, "version_id", "versionId"),
+    actor: "sg:governor/fixture",
+    decision: "ACCEPTED",
+    scope: "fixture",
+    policy_version: "sg:governance-policy/fixture@sha256:" + "3".repeat(64),
+  });
+  return { claim, evidence, evidence_sample: evidence("SUPPORT", "fixture"), validation, governance };
+}
+
+async function loadModules() {
+  const modules = {};
+  for (const [name, relative] of Object.entries(moduleFiles)) {
+    try {
+      modules[name] = { value: await import(path.join(root, relative)) };
+    } catch (error) {
+      modules[name] = { error: error instanceof Error ? error : new Error(String(error)) };
+    }
+  }
+  return modules;
+}
+
+async function runCase(name, expected, execute) {
+  try {
+    const actual = await execute();
+    return { actual, expected, name, ok: true };
+  } catch (error) {
+    return {
+      actual: {
+        code: error instanceof ContractError ? error.code : "kernel_case_exception",
+        message: error instanceof Error ? error.message : String(error),
+        ...(error?.path ? { path: error.path } : {}),
+      },
+      expected,
+      name,
+      ok: false,
+    };
+  }
+}
+
+async function main() {
+  const unsupported = process.argv.slice(2).filter((argument) => argument !== "--json");
+  if (unsupported.length > 0) {
+    const report = { ok: false, status: "RED", failures: [failure("argument_unknown", `unknown argument ${unsupported[0]}`)], results: [] };
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const modules = await loadModules();
+  const aggregate = () => requireExport(modules, "knowledge", ["aggregateEvidence", "aggregateEvidenceState"]);
+
+  const results = await runIdentityIntegrityCases();
+  results.push(await runCase("claim_evidence_validation_governance_are_distinct_frozen_objects", "each epistemic object has its own immutable identity and lifecycle", () => {
+    const fixture = makeFixture(modules);
+    for (const [name, value] of Object.entries(fixture)) {
+      if (name === "evidence") continue;
+      assert(value && typeof value === "object" && Object.isFrozen(value), `${name} is not deeply frozen`);
+      assert(typeof valueAt(value, "stable_ref", "stableRef") === "string", `${name} has no StableRef`);
+      assert(typeof valueAt(value, "version_id", "versionId") === "string", `${name} has no VersionID`);
+    }
+    assert(fixture.claim !== fixture.validation && fixture.claim !== fixture.governance, "knowledge layers were conflated");
+    return { refs: Object.fromEntries(Object.entries(fixture).map(([name, value]) => [name, valueAt(value, "stable_ref", "stableRef")])) };
+  }));
+  for (const [name, expectedState, links] of [["supported", "SUPPORTED", ["SUPPORT"]], ["refuted", "REFUTED", ["REFUTE"]], ["both", "BOTH", ["SUPPORT", "REFUTE"]], ["neither", "NEITHER", []]]) {
+    results.push(await runCase(`evidence_aggregation_${name}`, `aggregation is ${expectedState}`, () => {
+      const fixture = makeFixture(modules);
+      const evidence = links.map((polarity, index) => fixture.evidence(polarity, `${name}-${index}`));
+      const value = aggregate()({ claim: fixture.claim, evidence_links: evidence, evidenceLinks: evidence });
+      assert(resultState(value) === expectedState, `expected ${expectedState}, got ${resultState(value)}`);
+      return { state: resultState(value) };
+    }));
+  }
+  results.push(await runCase("validation_and_governance_do_not_erase_contradiction", "validation approval and governance acceptance remain separate from BOTH evidence", () => {
+    const fixture = makeFixture(modules);
+    const evidence = [fixture.evidence("SUPPORT", "contradiction-support"), fixture.evidence("REFUTE", "contradiction-refute")];
+    const before = resultState(aggregate()({ claim: fixture.claim, evidence_links: evidence, evidenceLinks: evidence }));
+    assert(before === "BOTH", `contradiction fixture did not aggregate BOTH: ${before}`);
+    assert(valueAt(fixture.validation, "status") === "PASSED", "validation fixture is not passed");
+    assert(valueAt(fixture.governance, "decision", "status") === "ACCEPTED", "governance fixture is not accepted");
+    const after = resultState(aggregate()({ claim: fixture.claim, evidence_links: evidence, evidenceLinks: evidence }));
+    assert(after === "BOTH", `validation/governance erased contradiction: ${after}`);
+    return { before, after, validation: valueAt(fixture.validation, "status"), governance: valueAt(fixture.governance, "decision", "status") };
+  }));
+
+  const ok = results.every((result) => result.ok);
+  const report = {
+    ok,
+    status: ok ? "GREEN" : "RED",
+    modules: Object.fromEntries(Object.entries(modules).map(([name, loaded]) => [name, loaded.error ? { ok: false, error: loaded.error.message } : { ok: true }])),
+    results,
+  };
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  process.exitCode = ok ? 0 : 1;
+}
+
+await main();

package/scripts/test-agent-learning.mjs

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+import { createVersionId, parseVersionId } from "./agent-native/identity.mjs";
+import {
+  createProposal,
+  decideProposal,
+  promoteProposal,
+  verifyProposal,
+} from "./agent-native/learning.mjs";
+
+function omitVersion(record) {
+  const payload = structuredClone(record);
+  delete payload.version_id;
+  delete payload.versionId;
+  return payload;
+}
+
+function reversion(record, changes) {
+  const payload = { ...omitVersion(record), ...changes };
+  return {
+    ...payload,
+    version_id: createVersionId({ stable_ref: payload.stable_ref, payload }),
+  };
+}
+
+function isVersioned(record, kind) {
+  if (!record || record.record_kind !== kind || typeof record.version_id !== "string") return false;
+  try {
+    parseVersionId({
+      payload: omitVersion(record),
+      stable_ref: record.stable_ref,
+      version_id: record.version_id,
+    });
+    return Object.isFrozen(record);
+  } catch {
+    return false;
+  }
+}
+
+function rejected(call) {
+  try {
+    const value = call();
+    return value?.promoted !== true && (value?.ok === false || value?.status === "BLOCKED");
+  } catch (error) {
+    return typeof error?.code === "string" && error.code.startsWith("learning_");
+  }
+}
+
+function result(id, ok, detail) {
+  return { id, ok, detail };
+}
+
+const proposalInput = {
+  claim: {
+    stable_ref: "sg:claim/retrieval-improvement",
+    text: "The retriever preserves citation coverage.",
+  },
+  changes: [{ path: "retriever.strategy", value: "hybrid" }],
+  evidence: [{
+    independence_group: "capture-a",
+    source_ref: "sg:source/execution-fixture",
+    stable_ref: "sg:evidence/retrieval-proposal",
+  }],
+  proposer: "agent:proposer",
+  proposal_id: "sg:proposal/retrieval-improvement",
+  source_task: "sg:task/execution-fixture",
+  validation: {
+    status: "PASS",
+    validator: "agent:proposal-validator",
+    validator_version: "validator@v1",
+  },
+};
+
+const proposal = createProposal(proposalInput);
+const verification = verifyProposal({
+  evidence: [{
+    independence_group: "capture-b",
+    source_ref: "sg:source/independent-fixture",
+    stable_ref: "sg:evidence/retrieval-verification",
+  }],
+  independent_of: "agent:proposer",
+  proposal,
+  validation: {
+    status: "PASS",
+    validator: "agent:independent-validator",
+    validator_version: "validator@v2",
+  },
+  verifier: "agent:verifier",
+});
+const decision = decideProposal({
+  decision: "ACCEPT",
+  governance_decision: {
+    actor: "governor:review-board",
+    decided_at: "2026-07-23T00:00:00.000Z",
+  },
+  proposal,
+  verification,
+});
+
+const validPromotion = promoteProposal({
+  governance_decision: decision,
+  proposal,
+  verification,
+});
+const proposalV2 = createProposal({
+  ...proposalInput,
+  changes: [{ path: "retriever.strategy", value: "semantic" }],
+});
+const forgedProposal = {
+  ...structuredClone(proposal),
+  changes: [{ path: "retriever.strategy", value: "forged" }],
+};
+const forgedVerification = {
+  ...structuredClone(verification),
+  verifier: "agent:forger",
+  verifier_actor: "agent:forger",
+};
+const wrongKindVerification = reversion(verification, {
+  record_kind: "evidence_link",
+});
+const wrongLinkDecision = reversion(decision, {
+  verification_ref: "sg:validation/unrelated-verification",
+});
+const wrongKindDecision = reversion(decision, {
+  record_kind: "learning_verification",
+});
+const forgedDecision = {
+  ...structuredClone(decision),
+  actor: "governor:forger",
+};
+const aliasInjectedDecision = {
+  ...structuredClone(decision),
+  versionId: `sg:governance/alias@sha256:${"0".repeat(64)}`,
+};
+const tamperedEvidence = structuredClone(verification.evidence);
+tamperedEvidence[0].source_ref = "sg:source/tampered-fixture";
+const verificationWithTamperedEvidence = reversion(verification, {
+  evidence: tamperedEvidence,
+});
+
+const rows = [
+  result(
+    "immutable_chain_is_fully_versioned",
+    isVersioned(proposal, "learning_proposal")
+      && proposal.evidence.every((item) => isVersioned(item, "evidence_link"))
+      && isVersioned(proposal.validation, "validation_report")
+      && isVersioned(verification, "learning_verification")
+      && verification.evidence.every((item) => isVersioned(item, "evidence_link"))
+      && isVersioned(verification.validation, "validation_report")
+      && isVersioned(decision, "governance_decision")
+      && decision.proposal_version_id === proposal.version_id
+      && decision.verification_version_id === verification.version_id,
+    "proposal, evidence, validation, verification, and decision have content-bound VersionIDs",
+  ),
+  result(
+    "valid_independent_chain_promotes",
+    validPromotion.promoted === true
+      && isVersioned(validPromotion.version, "governed_version")
+      && validPromotion.version.proposal_version_id === proposal.version_id
+      && validPromotion.version.verification_version_id === verification.version_id
+      && validPromotion.version.governance_decision_version_id === decision.version_id,
+    "a correctly linked independent chain produces one governed version",
+  ),
+  result(
+    "self_verification_is_rejected",
+    rejected(() => verifyProposal({
+      evidence: proposalInput.evidence,
+      proposal,
+      validation: proposalInput.validation,
+      verifier: "agent:proposer",
+    })),
+    "the proposer cannot verify its own proposal",
+  ),
+  result(
+    "whitespace_cannot_bypass_self_verification",
+    rejected(() => verifyProposal({
+      evidence: proposalInput.evidence,
+      proposal,
+      validation: proposalInput.validation,
+      verifier: " agent:proposer ",
+    })),
+    "actor identity is canonicalized before the independence comparison",
+  ),
+  result(
+    "forged_proposal_bytes_are_rejected",
+    rejected(() => promoteProposal({ governance_decision: decision, proposal: forgedProposal, verification })),
+    "changing proposal bytes without minting a matching VersionID is rejected",
+  ),
+  result(
+    "forged_verification_bytes_are_rejected",
+    rejected(() => promoteProposal({ governance_decision: decision, proposal, verification: forgedVerification })),
+    "changing verification bytes without minting a matching VersionID is rejected",
+  ),
+  result(
+    "stale_verification_is_rejected",
+    rejected(() => promoteProposal({ governance_decision: decision, proposal: proposalV2, verification })),
+    "verification and governance for an older proposal version cannot promote a newer proposal",
+  ),
+  result(
+    "wrong_kind_verification_is_rejected",
+    rejected(() => promoteProposal({ governance_decision: decision, proposal, verification: wrongKindVerification })),
+    "a content-valid record with the wrong semantic kind cannot stand in for verification",
+  ),
+  result(
+    "wrong_governance_link_is_rejected",
+    rejected(() => promoteProposal({ governance_decision: wrongLinkDecision, proposal, verification })),
+    "governance must bind the exact verification StableRef and VersionID",
+  ),
+  result(
+    "wrong_kind_governance_is_rejected",
+    rejected(() => promoteProposal({ governance_decision: wrongKindDecision, proposal, verification })),
+    "a content-valid record with the wrong semantic kind cannot stand in for governance",
+  ),
+  result(
+    "forged_governance_bytes_are_rejected",
+    rejected(() => promoteProposal({ governance_decision: forgedDecision, proposal, verification })),
+    "changing governance bytes without minting a matching VersionID is rejected",
+  ),
+  result(
+    "nested_evidence_bytes_are_rejected",
+    rejected(() => promoteProposal({ governance_decision: decision, proposal, verification: verificationWithTamperedEvidence })),
+    "an outer-valid verification cannot hide evidence whose bytes no longer match its VersionID",
+  ),
+  result(
+    "unbound_identity_alias_is_rejected",
+    rejected(() => promoteProposal({ governance_decision: aliasInjectedDecision, proposal, verification })),
+    "canonical learning records reject alternate identity fields that are not part of their VersionID",
+  ),
+  result(
+    "verification_actor_cannot_govern_same_proposal",
+    rejected(() => decideProposal({
+      decision: "ACCEPT",
+      governance_decision: { actor: "agent:verifier" },
+      proposal,
+      verification,
+    })),
+    "independent verification and governance remain separate actors",
+  ),
+];
+
+const report = {
+  contract: "agent-native-governed-learning-integrity",
+  ok: rows.every((row) => row.ok),
+  results: rows,
+};
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+process.exitCode = report.ok ? 0 : 1;