tamperward 2.37.1 → 2.38.0

package/dist/cli/index.js

@@ -5300,13 +5300,13 @@ function merge(a, b) {
 function literals(e) {
   if (ts.isStringLiteral(e)) return { items: [e.text], opaque: false };
   if (!ts.isArrayLiteralExpression(e)) return { items: [], opaque: true };
-  const items = [];
+  const items2 = [];
   let opaque = false;
   for (const el of e.elements) {
-    if (ts.isStringLiteral(el) || ts.isNoSubstitutionTemplateLiteral(el)) items.push(el.text);
+    if (ts.isStringLiteral(el) || ts.isNoSubstitutionTemplateLiteral(el)) items2.push(el.text);
     else opaque = true;
   }
-  return { items, opaque };
+  return { items: items2, opaque };
 }
 function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], ignoreRe: [], opaqueCollect: false, opaqueIgnore: false };
@@ -5319,13 +5319,13 @@ function parseLists(src) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve23(node.initializer));
-          res.collectFrom = items;
+          const { items: items2, opaque } = literals(resolve23(node.initializer));
+          res.collectFrom = items2;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve23(node.initializer));
-          (k === "exclude" ? res.ignore : res.ignoreRe).push(...items);
+          const { items: items2, opaque } = literals(resolve23(node.initializer));
+          (k === "exclude" ? res.ignore : res.ignoreRe).push(...items2);
           if (opaque) res.opaqueIgnore = true;
         }
       }
@@ -5923,15 +5923,15 @@ function keyName2(name) {
 function literals2(e) {
   if (isStr(e)) return { items: [e.text], opaque: false };
   if (!ts.isArrayLiteralExpression(e)) return { items: [], opaque: true };
-  const items = [];
+  const items2 = [];
   let opaque = false;
   for (const el of e.elements) {
-    if (isStr(el)) items.push(el.text);
+    if (isStr(el)) items2.push(el.text);
     else if (ts.isSpreadElement(el) && /^(?:configDefaults\.|default)(?:exclude|include)$/i.test(el.expression.getText())) {
-      items.push(.../exclude$/i.test(el.expression.getText()) ? VITEST_DEFAULT_EXCLUDE : VITEST_DEFAULT_INCLUDE);
+      items2.push(.../exclude$/i.test(el.expression.getText()) ? VITEST_DEFAULT_EXCLUDE : VITEST_DEFAULT_INCLUDE);
     } else opaque = true;
   }
-  return { items, opaque };
+  return { items: items2, opaque };
 }
 function ownerKey2(node) {
   const obj = node.parent;
@@ -6054,11 +6054,11 @@ function collect(root, runner) {
   const sel = empty();
   const seen = /* @__PURE__ */ new Set();
   const take = (key2, e) => {
-    const { items, opaque } = literals2(e);
+    const { items: items2, opaque } = literals2(e);
     if (opaque || seen.has(key2)) sel.opaque = true;
     seen.add(key2);
     sel.present = true;
-    return items.map(stripRootDir);
+    return items2.map(stripRootDir);
   };
   const ignores = (key2, e) => {
     const entries = take(key2, e).map((pattern) => ({ pattern, key: key2 }));
@@ -10701,10 +10701,10 @@ function validate(r, where) {
     throw new PolicyError(`${where}: ${msg}`);
   }
   const show = (v) => JSON.stringify(v) ?? String(v);
-  function refuseNegated(field, list3) {
+  function refuseNegated(field2, list3) {
     const neg = list3.find(isNegatedGlob);
     if (neg !== void 0) {
-      bad2(`${field}: negated glob ${show(neg)} is not allowed \u2014 a "!" pattern matches every path, so it would ${field === "ignore" ? "ignore every file" : field.startsWith("protected.") ? `put every file in ${field}` : "blind the rule on every file"}; list the paths to include instead`);
+      bad2(`${field2}: negated glob ${show(neg)} is not allowed \u2014 a "!" pattern matches every path, so it would ${field2 === "ignore" ? "ignore every file" : field2.startsWith("protected.") ? `put every file in ${field2}` : "blind the rule on every file"}; list the paths to include instead`);
     }
   }
   const out3 = {};
@@ -14395,6 +14395,10 @@ jobs:
       # Requires a \`verify:\` block in .tamperward.yml naming the suite command;
       # without one this step fails closed (exit 2) rather than passing quietly.
       - name: Tamperward verify (pristine re-execution)
+        # bash so \`set -o pipefail\` propagates verify's exit through the tee \u2014 the
+        # default GitHub shell does not enable pipefail, and tee's own 0 would
+        # otherwise mask a red verify.
+        shell: bash
         env:
           # The same channel as the gate. A compact token generated for \`verify\`
           # (or legacy \`tamperward:allow:verify@<head-sha>\`) accepts a MASKED_FAILURE \u2014
@@ -14404,7 +14408,53 @@ jobs:
           # stays red whatever the labels say.
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
-        run: tamperward verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
+        # --json to a file for the reconciliation step below; the tee keeps the
+        # verdict visible in the log. This step remains the ENFORCEMENT authority:
+        # its own exit gates the job.
+        run: tamperward verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}" --json | tee "$RUNNER_TEMP/tw-verify.json"
+      # EVIDENCE, not authority (#601). CI has now rerun the canonical verification
+      # itself; this step reconciles a claimed LOCAL verification receipt against
+      # THAT result and writes a job summary separating the local claim, the CI
+      # result and their agreement/divergence. A stale/mismatched/tampered/missing/
+      # unknown-schema receipt can NEVER promote a CI result \u2014 the reconciled
+      # verdict is CI's own (consumed from the verify --json above), recomputed from
+      # trusted inputs. Set TAMPERWARD_RECEIPT (e.g. from a download-artifact step)
+      # to a receipt exported by \`tamperward receipt export\` on the BRANCH TIP;
+      # with none, reconciliation reports NO_CLAIM and CI's verdict stands.
+      # \`if: always()\` re-asserts CI's verdict even when the verify step failed.
+      #
+      # The reconcile computes CI's candidate identity from pull_request.head.sha \u2014
+      # the branch tip a developer verifies \u2014 NOT this job's merge-ref HEAD, so a
+      # genuine receipt's \`head\`/\`tree\` line up (a receipt binds the branch tip;
+      # the merge ref is a synthetic commit that no receipt can match). A linked
+      # worktree reuses this checkout's object store (base, head and the merge
+      # commit are all present from fetch-depth: 0), so merge-base resolves without
+      # a second fetch. reconcile with --ci-result runs NO candidate code here \u2014 it
+      # only computes identity (git/filesystem reads) and consumes the verdict the
+      # verify step already produced. The enforcement authority remains the verify
+      # step, which runs over the MERGE result as before.
+      - name: Tamperward receipt reconciliation (evidence)
+        if: always()
+        shell: bash
+        env:
+          # The reconcile step's exit re-asserts CI's verdict, and a MASKED_FAILURE
+          # a reviewer has signed off must exit 0 here just as the verify step does.
+          # reconcile recomputes that sign-off from this SAME trusted channel \u2014 never
+          # from the --ci-result document \u2014 so a forged oob_signoff field inside the
+          # file it validates can never flip the exit (#601 re-review).
+          TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
+          TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          HEAD_TREE="$RUNNER_TEMP/tw-head"
+          rm -rf "$HEAD_TREE"
+          git worktree add --detach "$HEAD_TREE" "\${{ github.event.pull_request.head.sha }}"
+          args=(receipt reconcile --require-ancestor --cwd "$HEAD_TREE" --base "\${{ github.event.pull_request.base.sha }}" --ci-result "$RUNNER_TEMP/tw-verify.json")
+          if [ -n "\${TAMPERWARD_RECEIPT:-}" ] && [ -f "\${TAMPERWARD_RECEIPT:-}" ]; then
+            args+=(--receipt "$TAMPERWARD_RECEIPT")
+          fi
+          tamperward "\${args[@]}"
+          git worktree remove --force "$HEAD_TREE" || true
 `;
     WORKFLOW_MARK = "# tamperward:generated";
     WORKFLOW_MARK_RE = /^# tamperward:generated v(\S+) sha256:([0-9a-f]+)\n/m;
@@ -15752,6 +15802,14 @@ function resolveBaseRev(baseRef, cwd) {
     return rev2;
   }
 }
+function resolveConcreteCommit(cwd, ref) {
+  try {
+    assertRev(ref);
+    return git2(["rev-parse", "--verify", `${ref}^{commit}`], repoRoot(cwd)).trim();
+  } catch {
+    return null;
+  }
+}
 function canonicalJson(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
@@ -16001,6 +16059,15 @@ function firstMismatch(recorded, live) {
   }
   return null;
 }
+function firstCandidateIdentityMismatch(recorded, live) {
+  for (const input of CANDIDATE_MISMATCH_PRIORITY) {
+    if (recorded[input] !== live[input]) return input;
+  }
+  return null;
+}
+function environmentInputDivergences(recorded, live) {
+  return ENVIRONMENT_INPUTS.filter((input) => recorded[input] !== live[input]);
+}
 function evaluateVerificationState(cwd) {
   if (readVerifyingMarker(cwd)) {
     return { state: "VERIFYING", reason: "a verification is in progress" };
@@ -16047,7 +16114,7 @@ function evaluateVerificationState(cwd) {
     record
   };
 }
-var VERIFICATION_STATE_SCHEMA_VERSION, BINDING_INPUTS, STALE_REASON, MISMATCH_PRIORITY;
+var VERIFICATION_STATE_SCHEMA_VERSION, BINDING_INPUTS, STALE_REASON, MISMATCH_PRIORITY, CANDIDATE_IDENTITY_INPUTS, ENVIRONMENT_INPUTS, CANDIDATE_IDENTITY_SET, CANDIDATE_MISMATCH_PRIORITY;
 var init_verification_state = __esm({
   "src/verification-state.ts"() {
     "use strict";
@@ -16090,15 +16157,257 @@ var init_verification_state = __esm({
       "policy",
       "tree"
     ];
+    CANDIDATE_IDENTITY_INPUTS = [
+      "tree",
+      "head",
+      "base",
+      "policy",
+      "verifier",
+      "surface"
+    ];
+    ENVIRONMENT_INPUTS = ["intervention", "dependencies"];
+    CANDIDATE_IDENTITY_SET = new Set(CANDIDATE_IDENTITY_INPUTS);
+    CANDIDATE_MISMATCH_PRIORITY = MISMATCH_PRIORITY.filter(
+      (i) => CANDIDATE_IDENTITY_SET.has(i)
+    );
+  }
+});
+
+// src/verification-receipt.ts
+import { createHash as createHash13 } from "node:crypto";
+import { mkdirSync as mkdirSync9, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname9, join as join20 } from "node:path";
+function isRecord5(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function canonicalJson2(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson2).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson2(v)}`).join(",")}}`;
+}
+function receiptEvidenceDigest(fields2) {
+  const canonical2 = {
+    schema_version: fields2.schema_version,
+    verdict: fields2.verdict,
+    binding: BINDING_INPUTS.reduce((acc2, k) => {
+      acc2[k] = fields2.binding[k];
+      return acc2;
+    }, {}),
+    stages: fields2.stages
+  };
+  return "sha256:" + createHash13("sha256").update(canonicalJson2(canonical2)).digest("hex");
+}
+function receiptFromRecord(record) {
+  const stages = { candidate: "PASS", pristine: "PASS", integrity: "CLEAN" };
+  const core = {
+    schema_version: RECEIPT_SCHEMA_VERSION,
+    verdict: "VERIFIED",
+    binding: record.binding,
+    stages
+  };
+  return {
+    ...core,
+    tw_version: record.tw_version,
+    verified_at: record.verified_at,
+    evidence_digest: receiptEvidenceDigest(core)
+  };
+}
+function receiptPath(cwd) {
+  const ctx = repoContext(cwd);
+  return ctx ? join20(ctx.gitDir, "tamperward", "verification-receipt.json") : null;
+}
+function storeReceipt(cwd, receipt) {
+  const path = receiptPath(cwd);
+  if (!path) return false;
+  try {
+    mkdirSync9(dirname9(path), { recursive: true });
+    writeFileSync10(path, JSON.stringify(receipt) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function removeStoredReceipt(cwd) {
+  const path = receiptPath(cwd);
+  if (!path) return;
+  try {
+    rmSync8(path, { force: true });
+  } catch {
+  }
+}
+function isOneOf(list3, v) {
+  return typeof v === "string" && list3.includes(v);
+}
+function isStages(v) {
+  return isRecord5(v) && isOneOf(RECEIPT_STAGE_RESULTS, v.candidate) && isOneOf(RECEIPT_STAGE_RESULTS, v.pristine) && isOneOf(RECEIPT_INTEGRITY_RESULTS, v.integrity);
+}
+function isBinding2(v) {
+  if (!isRecord5(v)) return false;
+  return BINDING_INPUTS.every((k) => {
+    const val = v[k];
+    return typeof val === "string" && val.length > 0;
+  });
+}
+function classifyReceipt(value) {
+  if (value === null || value === void 0) {
+    return { disposition: "ABSENT", detail: "no local verification receipt was provided" };
+  }
+  if (!isRecord5(value)) {
+    return { disposition: "UNKNOWN_SCHEMA", detail: "receipt is not a JSON object" };
+  }
+  if (value.schema_version !== RECEIPT_SCHEMA_VERSION) {
+    return {
+      disposition: "UNKNOWN_SCHEMA",
+      detail: `unrecognised receipt schema_version ${JSON.stringify(value.schema_version)} (this build understands ${RECEIPT_SCHEMA_VERSION})`
+    };
+  }
+  if (value.verdict !== "VERIFIED") {
+    return { disposition: "MALFORMED", detail: "receipt verdict is not VERIFIED" };
+  }
+  if (typeof value.tw_version !== "string" || typeof value.verified_at !== "string") {
+    return { disposition: "MALFORMED", detail: "receipt is missing tw_version or verified_at" };
+  }
+  if (!isBinding2(value.binding)) {
+    return { disposition: "MALFORMED", detail: "receipt binding is incomplete or malformed" };
+  }
+  if (!isStages(value.stages)) {
+    return { disposition: "MALFORMED", detail: "receipt stages are incomplete or malformed" };
+  }
+  if (value.stages.candidate !== "PASS" || value.stages.pristine !== "PASS" || value.stages.integrity !== "CLEAN") {
+    return {
+      disposition: "MALFORMED",
+      detail: "receipt verdict is VERIFIED but a stage result is not a clean pass"
+    };
+  }
+  if (typeof value.evidence_digest !== "string") {
+    return { disposition: "MALFORMED", detail: "receipt evidence_digest is missing" };
+  }
+  const b = value.binding;
+  const binding = {
+    tree: b.tree,
+    head: b.head,
+    base: b.base,
+    policy: b.policy,
+    verifier: b.verifier,
+    surface: b.surface,
+    intervention: b.intervention,
+    dependencies: b.dependencies
+  };
+  const stages = {
+    candidate: value.stages.candidate,
+    pristine: value.stages.pristine,
+    integrity: value.stages.integrity
+  };
+  const expected = receiptEvidenceDigest({
+    schema_version: RECEIPT_SCHEMA_VERSION,
+    verdict: "VERIFIED",
+    binding,
+    stages
+  });
+  if (expected !== value.evidence_digest) {
+    return { disposition: "MALFORMED", detail: "receipt evidence_digest does not match its own contents (tampered)" };
+  }
+  return {
+    disposition: "PRESENT",
+    receipt: {
+      schema_version: RECEIPT_SCHEMA_VERSION,
+      verdict: "VERIFIED",
+      tw_version: value.tw_version,
+      verified_at: value.verified_at,
+      binding,
+      stages,
+      evidence_digest: value.evidence_digest
+    }
+  };
+}
+function reconcile(ci, claimed) {
+  const base = {
+    result: ci.verdict,
+    // CI is the sole authority for the verdict — always.
+    agreement: "NO_CLAIM",
+    applicable: false,
+    local: { disposition: claimed.disposition },
+    ci: { verdict: ci.verdict },
+    divergence: [],
+    environment_divergence: []
+  };
+  if (claimed.disposition !== "PRESENT") {
+    base.local.detail = claimed.detail;
+    if (claimed.disposition === "ABSENT") {
+      base.agreement = "NO_CLAIM";
+    } else {
+      base.agreement = "NON_APPLICABLE";
+      base.divergence.push(`local receipt ${claimed.disposition === "UNKNOWN_SCHEMA" ? "has an unknown schema/version" : "is malformed or tampered"} \u2014 ignored as evidence`);
+    }
+    return base;
+  }
+  const receipt = claimed.receipt;
+  base.local.verdict = receipt.verdict;
+  base.local.verified_at = receipt.verified_at;
+  if (!ci.binding) {
+    base.agreement = "NON_APPLICABLE";
+    base.divergence.push(`CI could not independently compute the candidate identity${ci.binding_error ? ` (${ci.binding_error})` : ""}; the receipt cannot be applied`);
+    return base;
+  }
+  base.environment_divergence = environmentInputDivergences(receipt.binding, ci.binding);
+  const mismatch = firstCandidateIdentityMismatch(receipt.binding, ci.binding);
+  if (mismatch) {
+    base.agreement = "NON_APPLICABLE";
+    base.mismatched_input = mismatch;
+    base.divergence.push(`receipt binds a different \`${mismatch}\` than CI computed \u2014 the receipt describes another state`);
+    return base;
+  }
+  if (ci.adjudicated_tree === void 0) {
+    base.agreement = "NON_APPLICABLE";
+    base.mismatched_input = "tree";
+    base.divergence.push(
+      "CI verify result predates adjudicated-tree reporting \u2014 cannot confirm CI ran this tree; treating as non-applicable"
+    );
+    return base;
+  }
+  if (ci.adjudicated_tree !== receipt.binding.tree) {
+    base.agreement = "NON_APPLICABLE";
+    base.mismatched_input = "tree";
+    base.divergence.push(
+      "CI adjudicated the merge result, not this tree \u2014 bring the branch up to date to reconcile"
+    );
+    return base;
+  }
+  for (const env of base.environment_divergence) {
+    base.divergence.push(`informational: ${STALE_REASON[env]} (machine-local; not load-bearing for cross-machine applicability)`);
+  }
+  base.applicable = true;
+  if (ci.verdict === "VERIFIED") {
+    base.agreement = "AGREE";
+    return base;
+  }
+  base.agreement = "DIVERGENCE";
+  base.divergence.push(`local claim VERIFIED, CI ${ci.verdict}`);
+  if (receipt.stages.pristine === "PASS" && ci.verdict === "MASKED_FAILURE") {
+    base.divergence.push("local pristine: PASS / CI pristine: FAIL");
+  }
+  return base;
+}
+var RECEIPT_SCHEMA_VERSION, RECEIPT_STAGE_RESULTS, RECEIPT_INTEGRITY_RESULTS;
+var init_verification_receipt = __esm({
+  "src/verification-receipt.ts"() {
+    "use strict";
+    init_repo_context();
+    init_verification_state();
+    init_machine_output();
+    RECEIPT_SCHEMA_VERSION = 1;
+    RECEIPT_STAGE_RESULTS = ["PASS", "FAIL"];
+    RECEIPT_INTEGRITY_RESULTS = ["CLEAN", "CHANGED"];
   }
 });
 
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync8, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync14 } from "node:fs";
+import { createHash as createHash14 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync11, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute11, join as join20, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute11, join as join21, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
   return {
     level: "suite-exit-only",
@@ -16162,15 +16471,15 @@ function rootedLinkTarget(target) {
   return isAbsolute11(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out3, root, label) {
-  if (rootedLinkTarget(target) || !inside2(root, resolve9(dirname9(out3), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve9(dirname10(out3), target))) {
     throw linkEscape(label, target);
   }
-  rmSync8(out3, { force: true });
+  rmSync9(out3, { force: true });
   symlinkSync(target, out3);
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative6(root, dirname9(out3)));
+  let stack = linkParts(relative6(root, dirname10(out3)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -16187,7 +16496,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
       continue;
     }
     const base = domain === "deps" && dependencyRoot ? dependencyRoot : root;
-    const current = join20(base, ...stack);
+    const current = join21(base, ...stack);
     let st;
     try {
       st = lstatSync9(current);
@@ -16229,7 +16538,7 @@ function rejectLinkedParent(cwd, rel) {
   const parts = rel.split("/").slice(0, -1);
   let current = cwd;
   for (const part of parts) {
-    current = join20(current, part);
+    current = join21(current, part);
     let st;
     try {
       st = lstatSync9(current);
@@ -16254,7 +16563,7 @@ function materialize(cwd, dest, dependencyRoot) {
   }
   const links = [];
   for (const rel of listed) {
-    const src = join20(cwd, rel);
+    const src = join21(cwd, rel);
     rejectLinkedParent(cwd, rel);
     let st;
     try {
@@ -16262,8 +16571,8 @@ function materialize(cwd, dest, dependencyRoot) {
     } catch {
       continue;
     }
-    const out3 = join20(dest, rel);
-    mkdirSync9(dirname9(out3), { recursive: true });
+    const out3 = join21(dest, rel);
+    mkdirSync10(dirname10(out3), { recursive: true });
     dropSymlink(out3);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -16282,19 +16591,19 @@ function materialize(cwd, dest, dependencyRoot) {
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(dependencyRoot, join20(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join21(dest, "node_modules"), "dir");
 }
 function workingTreePaths(cwd) {
   return git3(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
 }
 function probeFilesystemCaseSensitivity(dir) {
-  const upper = join20(dir, ".tw-case-probe-A");
-  const lower = join20(dir, ".tw-case-probe-a");
+  const upper = join21(dir, ".tw-case-probe-A");
+  const lower = join21(dir, ".tw-case-probe-a");
   try {
-    writeFileSync10(upper, "", { flag: "wx" });
+    writeFileSync11(upper, "", { flag: "wx" });
     return !existsSync14(lower);
   } finally {
-    rmSync8(upper, { force: true });
+    rmSync9(upper, { force: true });
   }
 }
 function foldCase(p) {
@@ -16312,7 +16621,7 @@ function caseFoldCollision(paths) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync9(p).isSymbolicLink()) rmSync8(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync9(p, { force: true });
   } catch {
   }
 }
@@ -16348,11 +16657,11 @@ function baseEntries(base, cwd) {
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash13("sha256");
+  const h = createHash14("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join20(dest, rel);
+    const p = join21(dest, rel);
     try {
       const st = lstatSync9(p);
       h.update(String(st.mode));
@@ -16386,15 +16695,15 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync9("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out3 = join20(dest, e.path);
-    mkdirSync9(dirname9(out3), { recursive: true });
-    rmSync8(out3, { force: true });
+    const out3 = join21(dest, e.path);
+    mkdirSync10(dirname10(out3), { recursive: true });
+    rmSync9(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
-      writeFileSync10(out3, content);
+      writeFileSync11(out3, content);
       chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -16403,7 +16712,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync8(join20(dest, rel), { force: true });
+    rmSync9(join21(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -16417,9 +16726,9 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join20(scratch, "npmrc-user");
-  const globalRc = join20(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync10(f, "", { mode: 292 });
+  const userRc = join21(scratch, "npmrc-user");
+  const globalRc = join21(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync11(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -16450,7 +16759,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       reason: `checkpointed-local verifier is unsupported on ${process.platform}; no trusted local shell contract is defined`
     };
   }
-  const scratch = mkdtempSync3(join20(tmpdir4(), "tw-verify-run-"));
+  const scratch = mkdtempSync3(join21(tmpdir4(), "tw-verify-run-"));
   try {
     const r = runCapturedProcessSync(shell.executable, shell.args, {
       cwd: dir,
@@ -16495,7 +16804,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
       diagnostics: r.diagnostics
     };
   } finally {
-    rmSync8(scratch, { recursive: true, force: true });
+    rmSync9(scratch, { recursive: true, force: true });
   }
 }
 function diagnosticsJson(diagnostics, includeTail) {
@@ -16696,17 +17005,17 @@ function runVerifyImpl(opts) {
   } catch {
     return cannotVerify("BASE_UNRESOLVABLE", `cannot resolve base rev "${opts.base ?? "HEAD"}"`);
   }
-  const visRoot = mkdtempSync3(join20(tmpdir4(), "tw-verify-vis-"));
-  const visDir = join20(visRoot, "t");
+  const visRoot = mkdtempSync3(join21(tmpdir4(), "tw-verify-vis-"));
+  const visDir = join21(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync8(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync9(d, { recursive: true, force: true });
   };
   filesystemCaseSensitive = (opts.probeCaseSensitivity ?? probeFilesystemCaseSensitivity)(visRoot);
   if (!filesystemCaseSensitive) {
     const present = (rel) => {
       try {
-        lstatSync9(join20(cwd, rel));
+        lstatSync9(join21(cwd, rel));
         return true;
       } catch {
         return false;
@@ -16738,7 +17047,7 @@ function runVerifyImpl(opts) {
     );
   }
   try {
-    mkdirSync9(visDir);
+    mkdirSync10(visDir);
     materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
@@ -16839,12 +17148,12 @@ function runVerifyImpl(opts) {
       { stage: "visible", dependency_environment: dependencyReport(), verifier_backend: backendReport(), oracle_assurance: oracleAssuranceReport() }
     );
   }
-  const priRoot = mkdtempSync3(join20(tmpdir4(), "tw-verify-pri-"));
-  const priDir = join20(priRoot, "t");
+  const priRoot = mkdtempSync3(join21(tmpdir4(), "tw-verify-pri-"));
+  const priDir = join21(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
-    mkdirSync9(priDir);
+    mkdirSync10(priDir);
     materialize(cwd, priDir, frozenNodeModules);
     ({ restored, removed: removedAdded } = overlayPristine(
       cwd,
@@ -16941,11 +17250,13 @@ function runVerifyImpl(opts) {
         budget
       };
       recordVerification(cwd, inputs, treeBefore);
+      const written = readVerificationRecord(cwd);
+      if (written) storeReceipt(cwd, receiptFromRecord(written));
     } catch {
     }
   } else {
     try {
-      invalidateVerificationRecordIfCurrent(cwd);
+      if (invalidateVerificationRecordIfCurrent(cwd)) removeStoredReceipt(cwd);
     } catch {
     }
   }
@@ -16957,6 +17268,15 @@ function runVerifyImpl(opts) {
         schema_version: MACHINE_SCHEMA_VERSION,
         verdict: verdict2,
         base,
+        // The candidate tree fingerprint this run actually ADJUDICATED — the same
+        // identity `verify` binds into the #600 record (`treeBefore`). Additive
+        // (verify-v1 is `additionalProperties: true`), it lets `receipt reconcile`
+        // tell whether CI's verdict is about the receipt's tree or a different one:
+        // in a `pull_request` run the enforcement verify runs over the MERGE result,
+        // so when the branch is behind its base this differs from the branch-tip
+        // tree a receipt binds, and reconcile must report NON_APPLICABLE rather than
+        // attribute CI's verdict to a tree CI never ran (#601 re-review).
+        adjudicated_tree: treeBefore,
         command: cmd,
         budget_secs: budget,
         visible: stageJson(visible),
@@ -17055,6 +17375,7 @@ var init_verify = __esm({
     init_machine_output();
     init_signoff();
     init_verification_state();
+    init_verification_receipt();
     init_suite_diagnostics();
     init_text();
     init_status();
@@ -17153,9 +17474,9 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync12 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname10, join as join21, resolve as resolve10 } from "node:path";
+import { dirname as dirname11, join as join22, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
   return platform === "linux";
 }
@@ -17192,7 +17513,7 @@ function writableByCaller2(path) {
       return true;
     } catch {
     }
-    const parent = dirname10(cur);
+    const parent = dirname11(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -17231,9 +17552,9 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   };
 }
 function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecycleTestMode, machineMode = false) {
-  const stateDir2 = mkdtempSync4(join21(tmpdir5(), "tw-agent-supervisor-"));
-  const resultFile = join21(stateDir2, "result.json");
-  const agentEnvFile = join21(stateDir2, "agent-env.json");
+  const stateDir2 = mkdtempSync4(join22(tmpdir5(), "tw-agent-supervisor-"));
+  const resultFile = join22(stateDir2, "result.json");
+  const agentEnvFile = join22(stateDir2, "agent-env.json");
   try {
     const linux = process.platform === "linux";
     let executable;
@@ -17250,7 +17571,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
           failure: trustedPython.reason ?? "trusted Linux python3 interpreter is unavailable"
         };
       }
-      writeFileSync11(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
+      writeFileSync12(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
       executable = trustedPython.path;
       args = [
         "-I",
@@ -17332,7 +17653,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
       ...state.failure ? { failure: state.failure } : {}
     };
   } finally {
-    rmSync9(stateDir2, { recursive: true, force: true });
+    rmSync10(stateDir2, { recursive: true, force: true });
   }
 }
 function waitMs(ms) {
@@ -17359,8 +17680,8 @@ function observerExited(pid) {
   }
 }
 function supervisedObserverLog(cwd) {
-  const gd = gitDir(cwd) ?? join21(cwd, ".git");
-  return join21(
+  const gd = gitDir(cwd) ?? join22(cwd, ".git");
+  return join22(
     gd,
     "tamperward",
     `run-observer-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}.jsonl`
@@ -18070,7 +18391,7 @@ raise SystemExit(0)
 // src/cli/doctor.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
 import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
-import { join as join22, resolve as resolve11 } from "node:path";
+import { join as join23, resolve as resolve11 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
     if (linuxPython?.path) {
@@ -18268,9 +18589,9 @@ function collectLocalPosture(cwd, policy, authorityWorkflows, explicitWorkflow =
   addWiring("codeowners", "codeowners", true);
   checks.push(workflowPermissionCheck(cwd, authorityWorkflows));
   const pins = [
-    ...pinsInFile(join22(cwd, ".claude", "settings.json")),
-    ...pinsInFile(join22(cwd, ".git", "hooks", "pre-commit")),
-    ...pinsInFile(join22(cwd, ".husky", "pre-commit"))
+    ...pinsInFile(join23(cwd, ".claude", "settings.json")),
+    ...pinsInFile(join23(cwd, ".git", "hooks", "pre-commit")),
+    ...pinsInFile(join23(cwd, ".husky", "pre-commit"))
   ];
   const below = pins.filter((pin) => (compareVersions(pin, TW_VERSION) ?? 0) < 0);
   const above = pins.filter((pin) => (compareVersions(TW_VERSION, pin) ?? 0) < 0);
@@ -18566,7 +18887,7 @@ function diagnose(opts = {}) {
         `${workflowDirRel}: could not enumerate workflows (${e instanceof Error ? e.message : String(e)})`
       );
     }
-    for (const name of entries) workflowRels.push(join22(workflowDirRel, name));
+    for (const name of entries) workflowRels.push(join23(workflowDirRel, name));
   }
   const requiredSecs = requiredVerifierAuthoritySeconds(policy.verify.budget);
   const requiredMinutes = Math.ceil(requiredSecs / 60);
@@ -18895,11 +19216,11 @@ import {
   readFileSync as readFileSync19,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
-  rmSync as rmSync10,
+  rmSync as rmSync11,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { isAbsolute as isAbsolute12, join as join23, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join24, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 function unescapeStraceString(s) {
   return s.replace(/\\([0-7]{1,3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8))).replace(/\\x([0-9a-fA-F]{2})/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
@@ -19147,8 +19468,8 @@ function materializeBase(base, cwd, dest) {
       `tar extraction failed${untar.stderr?.length ? `: ${String(untar.stderr).trim()}` : ""}`
     );
   }
-  const hostModules = join23(cwd, "node_modules");
-  const tracedModules = join23(dest, "node_modules");
+  const hostModules = join24(cwd, "node_modules");
+  const tracedModules = join24(dest, "node_modules");
   if (existsSync16(hostModules) && !existsSync16(tracedModules)) {
     symlinkSync2(resolve12(hostModules), tracedModules, "dir");
   }
@@ -19156,7 +19477,7 @@ function materializeBase(base, cwd, dest) {
 function traceFiles(prefix) {
   const dir = resolve12(prefix, "..");
   const base = prefix.split(sep5).at(-1) ?? prefix;
-  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join23(dir, name)).sort();
+  return readdirSync6(dir).filter((name) => name === base || name.startsWith(base + ".")).map((name) => join24(dir, name)).sort();
 }
 function rewriteTraceRoot(accesses, actualRoot) {
   return accesses.map((item) => {
@@ -19171,13 +19492,13 @@ function rewriteTraceRoot(accesses, actualRoot) {
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
-    return { ...item, path: join23(TRACE_ROOT, ...rel.split("/")) };
+    return { ...item, path: join24(TRACE_ROOT, ...rel.split("/")) };
   });
 }
 function straceOnce(root, command, budget) {
-  const traceDir = mkdtempSync5(join23(tmpdir6(), "tw-trace-log-"));
+  const traceDir = mkdtempSync5(join24(tmpdir6(), "tw-trace-log-"));
   try {
-    const prefix = join23(traceDir, "trace");
+    const prefix = join24(traceDir, "trace");
     const traced = spawnSync5(
       "strace",
       [
@@ -19217,26 +19538,26 @@ function straceOnce(root, command, budget) {
     };
     return { raw, accesses };
   } finally {
-    rmSync10(traceDir, { recursive: true, force: true });
+    rmSync11(traceDir, { recursive: true, force: true });
   }
 }
 function runOneTrace(cwd, base, command, budget) {
-  const root = mkdtempSync5(join23(tmpdir6(), "tw-trace-base-"));
+  const root = mkdtempSync5(join24(tmpdir6(), "tw-trace-base-"));
   try {
     materializeBase(base, cwd, root);
     const { raw, accesses } = straceOnce(root, command, budget);
     return { outcome: classifyTraceRun(raw), accesses: rewriteTraceRoot(accesses, root) };
   } finally {
-    rmSync10(root, { recursive: true, force: true });
+    rmSync11(root, { recursive: true, force: true });
   }
 }
 function tracerPreflight(budget = 10) {
-  const probeRoot = mkdtempSync5(join23(tmpdir6(), "tw-trace-probe-"));
+  const probeRoot = mkdtempSync5(join24(tmpdir6(), "tw-trace-probe-"));
   try {
     const { raw } = straceOnce(probeRoot, "true", Math.max(1, Math.min(budget, 10)));
     return classifyTraceRun(raw);
   } finally {
-    rmSync10(probeRoot, { recursive: true, force: true });
+    rmSync11(probeRoot, { recursive: true, force: true });
   }
 }
 function renderText2(report2) {
@@ -19439,25 +19760,25 @@ var init_trace_verify = __esm({
 
 // src/runtimes.ts
 import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
-import { join as join24 } from "node:path";
-function isRecord5(x) {
+import { join as join25 } from "node:path";
+function isRecord6(x) {
   return typeof x === "object" && x !== null && !Array.isArray(x);
 }
 function hooksBeyondTamperward(hooks) {
-  if (!isRecord5(hooks)) return hooks != null;
+  if (!isRecord6(hooks)) return hooks != null;
   for (const entries of Object.values(hooks)) {
     if (!Array.isArray(entries)) {
       if (entries != null) return true;
       continue;
     }
     for (const entry of entries) {
-      const hs = isRecord5(entry) ? entry.hooks : null;
+      const hs = isRecord6(entry) ? entry.hooks : null;
       if (!Array.isArray(hs)) {
         if (hs != null) return true;
         continue;
       }
       for (const h of hs) {
-        const cmd = isRecord5(h) ? String(h.command ?? "") : "";
+        const cmd = isRecord6(h) ? String(h.command ?? "") : "";
         if (!/tamperward/.test(cmd)) return true;
       }
     }
@@ -19465,7 +19786,7 @@ function hooksBeyondTamperward(hooks) {
   return false;
 }
 function claudeSettingsBeyondTamperward(cwd) {
-  const path = join24(cwd, ".claude", "settings.json");
+  const path = join25(cwd, ".claude", "settings.json");
   let raw;
   try {
     if (!existsSync17(path)) return false;
@@ -19479,7 +19800,7 @@ function claudeSettingsBeyondTamperward(cwd) {
   } catch {
     return raw.trim().length > 0;
   }
-  if (!isRecord5(parsed)) return raw.trim().length > 0;
+  if (!isRecord6(parsed)) return raw.trim().length > 0;
   for (const [key2, value] of Object.entries(parsed)) {
     if (key2 === "disableAllHooks") continue;
     if (key2 === "hooks") {
@@ -19495,7 +19816,7 @@ function detectRuntimes(cwd) {
   for (const rt of KNOWN_RUNTIMES) {
     const marker = rt.markers.find((m) => {
       try {
-        return existsSync17(join24(cwd, m));
+        return existsSync17(join25(cwd, m));
       } catch {
         return false;
       }
@@ -19576,9 +19897,9 @@ var init_runtimes = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync12 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join25, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
+import { join as join26, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
 import { createInterface } from "node:readline";
 import { parseDocument } from "yaml";
 function readlineAsker(input, output) {
@@ -19643,7 +19964,7 @@ function explainVerdict(v, code2) {
   }
 }
 function writeVerifyCommand(cwd, command) {
-  const path = join25(cwd, POLICY_FILE);
+  const path = join26(cwd, POLICY_FILE);
   const kind = writeTargetKind(path);
   if (kind === "symlink" || kind === "irregular") {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
@@ -19666,7 +19987,7 @@ function writeVerifyCommand(cwd, command) {
     if (loaded2.verify?.command !== command) throw new Error("verify.command did not round-trip");
     return null;
   } catch (e) {
-    if (original === null) rmSync11(path, { force: true });
+    if (original === null) rmSync12(path, { force: true });
     else atomicReplaceFile(path, original, mode);
     return `the updated ${POLICY_FILE} does not load (${errorMessage(e)}); restored the previous file`;
   }
@@ -20036,13 +20357,13 @@ function runDemo(cwd, head, runners, out3) {
   }
   const before = treeFingerprint(cwd);
   out3(`working tree fingerprint before: ${before.slice(0, 16)}`);
-  const wt = mkdtempSync6(join25(tmpdir7(), "tw-onboard-demo-"));
+  const wt = mkdtempSync6(join26(tmpdir7(), "tw-onboard-demo-"));
   try {
     if (git6(cwd, ["worktree", "add", "--detach", wt, head]) === null) {
       out3("Demo skipped: could not create a temporary worktree (git worktree add failed).");
       return;
     }
-    const targetPath = join25(wt, target.path);
+    const targetPath = join26(wt, target.path);
     const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
     if (!targetStat || !targetStat.isFile() || targetStat.isSymbolicLink()) {
       out3("Demo skipped: the selected test is not a regular file in the disposable worktree.");
@@ -20073,7 +20394,7 @@ function runDemo(cwd, head, runners, out3) {
   } finally {
     git6(cwd, ["worktree", "remove", "--force", wt]);
     git6(cwd, ["worktree", "prune"]);
-    rmSync11(wt, { recursive: true, force: true });
+    rmSync12(wt, { recursive: true, force: true });
   }
   const after = treeFingerprint(cwd);
   out3(`working tree fingerprint after:  ${after.slice(0, 16)}`);
@@ -20260,9 +20581,9 @@ var init_capture = __esm({
 });
 
 // src/research/manifest.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 import { readFileSync as readFileSync22 } from "node:fs";
-import { dirname as dirname11, resolve as resolve15 } from "node:path";
+import { dirname as dirname12, resolve as resolve15 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
   if (!isRecord(raw)) throw new ResearchError(`task manifest: ${where} is not an object`);
@@ -20312,13 +20633,13 @@ function readManifest(path) {
   if (!Array.isArray(raw.tasks) || raw.tasks.length === 0) {
     throw new ResearchError(`task manifest ${abs}: no tasks (tasks must be a non-empty array)`);
   }
-  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname11(abs)));
+  const tasks = raw.tasks.map((t, i) => taskFrom(t, i, dirname12(abs)));
   const seen = /* @__PURE__ */ new Set();
   for (const t of tasks) {
     if (seen.has(t.id)) throw new ResearchError(`task manifest ${abs}: duplicate task id "${t.id}"`);
     seen.add(t.id);
   }
-  return { path: abs, sha256: createHash14("sha256").update(bytes).digest("hex"), tasks };
+  return { path: abs, sha256: createHash15("sha256").update(bytes).digest("hex"), tasks };
 }
 var MANIFEST_VERSION;
 var init_manifest = __esm({
@@ -20577,7 +20898,52 @@ function pairRecordFrom(raw, where = "record") {
     }
   };
 }
-var SHA_RE, SHA256_RE;
+function onlyFields(raw, allowed, where) {
+  if (!isRecord(raw)) return;
+  for (const key2 of Object.keys(raw)) {
+    if (!allowed.includes(key2)) bad(`${where}.${key2} is not a field of the v1 pair record; refusing to carry it as portable evidence`);
+  }
+}
+function portableObject(raw, spec2, where) {
+  if (!isRecord(raw)) bad(`${where} is not an object`);
+  for (const [key2, value] of Object.entries(raw)) {
+    const field2 = spec2.get(key2);
+    const at = `${where}.${key2}`;
+    if (field2 === void 0) bad(`${at} is not a field of the v1 run document; refusing to carry it as portable evidence`);
+    if (field2 === "scalar") {
+      if (value !== null && typeof value === "object") bad(`${at} is not a scalar; refusing to carry it as portable evidence`);
+    } else if ("items" in field2) {
+      if (!Array.isArray(value)) bad(`${at} is not an array`);
+      value.forEach((item, i) => portableObject(item, field2.items, `${at}[${i}]`));
+    } else {
+      portableObject(value, field2.fields, at);
+    }
+  }
+}
+function portablePairRecordFrom(raw, where = "record") {
+  onlyFields(raw, PAIR_FIELDS, where);
+  if (isRecord(raw)) {
+    onlyFields(raw.adapter, ADAPTER_FIELDS, `${where}.adapter`);
+    onlyFields(raw.arms, ARMS_FIELDS, `${where}.arms`);
+    if (isRecord(raw.arms)) {
+      for (const arm of ARMS_FIELDS) {
+        const trajectory = raw.arms[arm];
+        const at = `${where}.arms.${arm}`;
+        onlyFields(trajectory, TRAJECTORY_FIELDS, at);
+        if (isRecord(trajectory)) {
+          onlyFields(trajectory.agent, AGENT_FIELDS, `${at}.agent`);
+          onlyFields(trajectory.treatment, TREATMENT_FIELDS, `${at}.treatment`);
+          if (isRecord(trajectory.treatment) && trajectory.treatment.envelope !== null && trajectory.treatment.envelope !== void 0) {
+            portableObject(trajectory.treatment.envelope, RUN_DOCUMENT_FIELDS, `${at}.treatment.envelope`);
+          }
+          onlyFields(trajectory.outcome, OUTCOME_FIELDS, `${at}.outcome`);
+        }
+      }
+    }
+  }
+  return pairRecordFrom(raw, where);
+}
+var SHA_RE, SHA256_RE, PAIR_FIELDS, ADAPTER_FIELDS, ARMS_FIELDS, TRAJECTORY_FIELDS, AGENT_FIELDS, TREATMENT_FIELDS, OUTCOME_FIELDS, fields, items, RUN_DOCUMENT_FIELDS;
 var init_record = __esm({
   "src/research/record.ts"() {
     "use strict";
@@ -20587,23 +20953,99 @@ var init_record = __esm({
     init_derive();
     SHA_RE = /^[0-9a-f]{40,64}$/;
     SHA256_RE = /^[0-9a-f]{64}$/;
+    PAIR_FIELDS = [
+      "schema_version",
+      "command",
+      "document",
+      "task",
+      "pair",
+      "adapter",
+      "model",
+      "tamperward_version",
+      "agent_argv",
+      "agent_budget",
+      "manifest_sha256",
+      "verify_command",
+      "arms"
+    ];
+    ADAPTER_FIELDS = ["name", "layers"];
+    ARMS_FIELDS = ["ungated", "gated"];
+    TRAJECTORY_FIELDS = [
+      "arm",
+      "workspace",
+      "base",
+      "head",
+      "started_at",
+      "finished_at",
+      "agent",
+      "treatment",
+      "outcome",
+      "released_green",
+      "measured",
+      "unmeasurable"
+    ];
+    AGENT_FIELDS = ["exit_code", "signal", "timed_out", "failure"];
+    TREATMENT_FIELDS = ["verdict", "exit_code", "complete", "disposition", "envelope"];
+    OUTCOME_FIELDS = [
+      "verify_verdict",
+      "visible_exit",
+      "pristine_exit",
+      "visible_green",
+      "pristine_green",
+      "masked_failure",
+      "surviving_protected_mutations",
+      "warn_findings",
+      "rules",
+      "honest_completion"
+    ];
+    fields = (entries) => ({ fields: new Map(entries) });
+    items = (entries) => ({ items: new Map(entries) });
+    RUN_DOCUMENT_FIELDS = /* @__PURE__ */ new Map([
+      ["schema_version", "scalar"],
+      ["verdict", "scalar"],
+      ["exit_code", "scalar"],
+      ["complete", "scalar"],
+      ["base", "scalar"],
+      ["head", "scalar"],
+      ["reason", "scalar"],
+      ["agent", fields([["exit_code", "scalar"], ["timed_out", "scalar"], ["lifecycle_owned", "scalar"], ["budget_secs", "scalar"]])],
+      ["checks", fields([["diff", "scalar"], ["worktree", "scalar"], ["verify", "scalar"]])],
+      ["verifier_backend", fields([
+        ["kind", "scalar"],
+        ["trust", "scalar"],
+        ["available", "scalar"],
+        ["image", "scalar"],
+        ["engine", "scalar"],
+        ["reason", "scalar"],
+        ["resources", fields([["memory_bytes", "scalar"], ["memory_swap_bytes", "scalar"], ["cpus", "scalar"], ["pids", "scalar"]])]
+      ])],
+      ["dependency_environment", fields([
+        ["status", "scalar"],
+        ["fingerprint", "scalar"],
+        ["reason", "scalar"],
+        ["image", "scalar"],
+        ["roots", items([["kind", "scalar"], ["path", "scalar"]])],
+        ["diagnostics", fields([["full_snapshots", "scalar"], ["reused_snapshots", "scalar"], ["total_ms", "scalar"]])]
+      ])],
+      ["observer", fields([["enabled", "scalar"], ["blocking", "scalar"]])]
+    ]);
   }
 });
 
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync14 } from "node:child_process";
-import { closeSync as closeSync4, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync10, openSync as openSync4, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync12, unlinkSync, writeFileSync as writeFileSync12, writeSync } from "node:fs";
+import { closeSync as closeSync4, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync11, openSync as openSync4, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync13, unlinkSync, writeFileSync as writeFileSync13, writeSync } from "node:fs";
 import { hostname } from "node:os";
-import { join as join26, resolve as resolve16 } from "node:path";
+import { join as join27, resolve as resolve16 } from "node:path";
 function git7(args, cwd) {
   return execFileSync14("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function pairRecordPath(ledger, task, pair) {
-  return join26(ledger, "pairs", `${task}--${pair}.json`);
+  return join27(ledger, "pairs", `${task}--${pair}.json`);
 }
 function researchLockPath(ledger) {
-  return join26(ledger, "run.lock");
+  return join27(ledger, "run.lock");
 }
 function readLockOwner(path) {
   try {
@@ -20628,7 +21070,7 @@ function lockHolder(path) {
   return owner ? `pid ${owner.pid} on ${owner.host}, started ${owner.started_at}` : "an unreadable lock file";
 }
 function acquireResearchLock(ledger, breakStaleLock = false) {
-  mkdirSync10(ledger, { recursive: true });
+  mkdirSync11(ledger, { recursive: true });
   const path = researchLockPath(ledger);
   if (breakStaleLock && existsSync18(path)) {
     const owner2 = readLockOwner(path);
@@ -20738,16 +21180,16 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync12(tmp, text);
+  writeFileSync13(tmp, text);
   renameSync4(tmp, path);
 }
 function cloneArgs(repo, ws3) {
   return ["-c", "protocol.ext.allow=never", "clone", "-q", "--no-hardlinks", "--", repo, ws3];
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
-  const ws3 = join26(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync12(ws3, { recursive: true, force: true });
-  mkdirSync10(join26(ledger, "workspaces"), { recursive: true });
+  const ws3 = join27(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
+  rmSync13(ws3, { recursive: true, force: true });
+  mkdirSync11(join27(ledger, "workspaces"), { recursive: true });
   try {
     execFileSync14("git", cloneArgs(task.repo, ws3), { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
@@ -20996,7 +21438,7 @@ function runResearch(opts) {
   }
   try {
     const pairs = opts.pairs ?? 1;
-    mkdirSync10(join26(ledger, "pairs"), { recursive: true });
+    mkdirSync11(join27(ledger, "pairs"), { recursive: true });
     for (const task of tasks) {
       const existingRecords = /* @__PURE__ */ new Map();
       let sourceBase = null;
@@ -21122,27 +21564,95 @@ var init_run2 = __esm({
   }
 });
 
-// src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
-import { join as join27, resolve as resolve17 } from "node:path";
-function readLedger2(dir) {
-  const pairsDir = join27(resolve17(dir), "pairs");
+// src/research/ledger-files.ts
+import { closeSync as closeSync5, constants as constants4, fstatSync as fstatSync2, lstatSync as lstatSync11, openSync as openSync5, readFileSync as readFileSync24, readdirSync as readdirSync7, realpathSync as realpathSync11 } from "node:fs";
+import { join as join28, resolve as resolve17 } from "node:path";
+function lstatOrNull(path) {
+  try {
+    return lstatSync11(path);
+  } catch {
+    return null;
+  }
+}
+function kindOf(st) {
+  if (st.isSymbolicLink()) return "a symlink";
+  if (st.isDirectory()) return "a directory";
+  if (st.isFIFO()) return "a FIFO";
+  if (st.isSocket()) return "a socket";
+  if (st.isCharacterDevice() || st.isBlockDevice()) return "a device";
+  return "not a regular file";
+}
+function readRegularFile(path, realPairsDir, name) {
+  const listed = lstatOrNull(path);
+  if (listed === null) throw new ResearchError(`ledger record ${path} vanished while the ledger was being read`);
+  if (!listed.isFile()) {
+    throw new ResearchError(`ledger record ${path} is ${kindOf(listed)}; only a regular file placed directly in pairs/ is read`);
+  }
+  if (listed.nlink !== 1) {
+    throw new ResearchError(`ledger record ${path} has ${listed.nlink} links; a hard link can name a file outside pairs/, so only a singly linked regular file is read`);
+  }
+  const real = realpathSync11.native(path);
+  if (real !== join28(realPairsDir, name)) {
+    throw new ResearchError(`ledger record ${path} resolves outside the pairs directory (${real}); refusing to read it`);
+  }
+  const flags = constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0);
+  let fd;
+  try {
+    fd = openSync5(path, flags);
+  } catch (e) {
+    throw new ResearchError(`cannot open ledger record ${path}: ${errorMessage(e)}`);
+  }
+  try {
+    const opened = fstatSync2(fd);
+    const sameInode = process.platform === "win32" || opened.dev === listed.dev && opened.ino === listed.ino;
+    if (!opened.isFile() || !sameInode || opened.nlink !== 1) {
+      throw new ResearchError(`ledger record ${path} changed between listing and reading; refusing to read it`);
+    }
+    return readFileSync24(fd);
+  } finally {
+    closeSync5(fd);
+  }
+}
+function readPairFiles(ledger) {
+  const root = resolve17(ledger);
+  const pairsDir = join28(root, "pairs");
+  const dirStat = lstatOrNull(pairsDir);
+  if (dirStat !== null && dirStat.isSymbolicLink()) {
+    throw new ResearchError(`ledger pairs directory ${pairsDir} is a symlink; only a real directory is read`);
+  }
+  if (dirStat === null || !dirStat.isDirectory()) throw new ResearchError(`ledger ${root} has no pairs directory`);
+  const realPairsDir = realpathSync11.native(pairsDir);
   let names;
   try {
     names = readdirSync7(pairsDir).filter((n2) => n2.endsWith(".json")).sort();
   } catch (e) {
     throw new ResearchError(`cannot read ledger ${pairsDir}: ${errorMessage(e)}`);
   }
-  if (names.length === 0) throw new ResearchError(`ledger ${pairsDir} holds no pair records`);
-  return names.map((n2) => {
-    const path = join27(pairsDir, n2);
+  return names.map((name) => {
+    const path = join28(pairsDir, name);
+    return { name, path, bytes: readRegularFile(path, realPairsDir, name) };
+  });
+}
+var init_ledger_files = __esm({
+  "src/research/ledger-files.ts"() {
+    "use strict";
+    init_narrow();
+    init_adapter();
+  }
+});
+
+// src/research/summarize.ts
+function readLedger2(dir) {
+  const files = readPairFiles(dir);
+  if (files.length === 0) throw new ResearchError(`ledger ${dir} holds no pair records`);
+  return files.map((f) => {
     let raw;
     try {
-      raw = JSON.parse(readFileSync24(path, "utf8"));
+      raw = JSON.parse(f.bytes.toString("utf8"));
     } catch (e) {
-      throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
+      throw new ResearchError(`ledger record ${f.path} is not valid JSON: ${errorMessage(e)}`);
     }
-    return pairRecordFrom(raw, path);
+    return pairRecordFrom(raw, f.path);
   });
 }
 function weakened(t) {
@@ -21263,15 +21773,16 @@ var init_summarize = __esm({
     "use strict";
     init_machine_output();
     init_narrow();
+    init_ledger_files();
     init_adapter();
     init_record();
   }
 });
 
 // src/research/init.ts
-import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "node:fs";
-import { basename as basename5, dirname as dirname12, resolve as resolve18 } from "node:path";
+import { createHash as createHash16 } from "node:crypto";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync25, writeFileSync as writeFileSync14 } from "node:fs";
+import { basename as basename5, dirname as dirname13, resolve as resolve18 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
   return (basename5(clean, ".git").replace(/[^A-Za-z0-9._-]+/g, "-") || "task").slice(0, 80);
@@ -21299,8 +21810,8 @@ function createResearchManifest(opts) {
     }]
   };
   const text = JSON.stringify(doc, null, 2) + "\n";
-  mkdirSync11(dirname12(out3), { recursive: true });
-  writeFileSync13(out3, text, { flag: "wx", mode: 384 });
+  mkdirSync12(dirname13(out3), { recursive: true });
+  writeFileSync14(out3, text, { flag: "wx", mode: 384 });
   const parsed = readManifest(out3);
   if (parsed.tasks.length !== 1 || parsed.tasks[0].id !== id) throw new ResearchError(`research init wrote an invalid manifest ${out3}`);
   return out3;
@@ -21322,7 +21833,7 @@ function runResearchInit(opts) {
   }
 }
 function requireHash(path) {
-  return createHash15("sha256").update(readFileSync25(path)).digest("hex");
+  return createHash16("sha256").update(readFileSync25(path)).digest("hex");
 }
 var init_init2 = __esm({
   "src/research/init.ts"() {
@@ -21387,65 +21898,107 @@ var init_report2 = __esm({
 });
 
 // src/research/bundle.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { existsSync as existsSync20, mkdirSync as mkdirSync12, readdirSync as readdirSync8, readFileSync as readFileSync26, statSync as statSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { dirname as dirname13, join as join28, resolve as resolve19 } from "node:path";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync26, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname14, resolve as resolve19 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
 }
-function tarEntry(name, bytes) {
+function tarHeader(name, size) {
   const header = Buffer.alloc(BLOCK, 0);
-  const safe = name.replace(/^\/+/, "").slice(0, 99);
-  header.write(safe, 0, "utf8");
+  header.write(name, 0, "utf8");
   header.write(octal(420, 8), 100, "ascii");
   header.write(octal(0, 8), 108, "ascii");
   header.write(octal(0, 8), 116, "ascii");
-  header.write(octal(bytes.length, 12), 124, "ascii");
+  header.write(octal(size, 12), 124, "ascii");
   header.write(octal(0, 12), 136, "ascii");
   header.fill(32, 148, 156);
-  header[156] = 48;
+  header[TYPE_OFFSET] = 48;
   header.write("ustar", 257, "ascii");
   header.write("00", 263, "ascii");
   const checksum = header.reduce((sum, b) => sum + b, 0);
   header.write(octal(checksum, 8), 148, "ascii");
+  return header;
+}
+function tarEntry(name, bytes) {
+  if (name.startsWith("/") || Buffer.byteLength(name, "utf8") > TAR_NAME_MAX) {
+    throw new ResearchError(`archive entry name ${name} cannot be stored byte for byte in a ustar header`);
+  }
   const padding = Buffer.alloc((BLOCK - bytes.length % BLOCK) % BLOCK, 0);
-  return Buffer.concat([header, bytes, padding]);
+  return Buffer.concat([tarHeader(name, bytes.length), bytes, padding]);
 }
 function makeTar(entries) {
   return Buffer.concat([...entries.map((e) => tarEntry(e.name, e.bytes)), Buffer.alloc(BLOCK * 2, 0)]);
 }
+function field(header, start, length) {
+  const raw = header.subarray(start, start + length);
+  const end = raw.indexOf(0);
+  return raw.subarray(0, end === -1 ? raw.length : end).toString("utf8");
+}
 function parseTar(bytes) {
   const files = /* @__PURE__ */ new Map();
-  for (let offset = 0; offset + BLOCK <= bytes.length; ) {
+  let offset = 0;
+  for (; ; ) {
+    if (offset + BLOCK > bytes.length) throw new ResearchError("research bundle is missing its end-of-archive blocks");
     const header = bytes.subarray(offset, offset + BLOCK);
-    if (header.every((b) => b === 0)) break;
-    const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
-    const sizeText = header.subarray(124, 136).toString("ascii").replace(/\0.*$/, "").trim();
-    const size = Number.parseInt(sizeText || "0", 8);
+    if (header.every((b) => b === 0)) {
+      const second = bytes.subarray(offset + BLOCK, offset + 2 * BLOCK);
+      if (second.length !== BLOCK || !second.every((b) => b === 0) || offset + 2 * BLOCK !== bytes.length) {
+        throw new ResearchError("research bundle carries bytes after its end-of-archive blocks");
+      }
+      return files;
+    }
+    const name = field(header, 0, NAME_FIELD);
+    const prefix = field(header, PREFIX_OFFSET, PREFIX_FIELD);
+    if (prefix) {
+      throw new ResearchError(`research bundle entry ${prefix}/${name} uses a ustar prefix; this bundle format stores every name in the name field`);
+    }
+    const type = header[TYPE_OFFSET];
+    if (type !== 48) {
+      throw new ResearchError(`research bundle entry ${name} is not a regular file entry (type flag ${JSON.stringify(String.fromCharCode(type))})`);
+    }
+    const size = Number.parseInt(field(header, 124, 12).trim() || "0", 8);
     if (!name || name.startsWith("/") || name.split("/").includes("..") || !Number.isSafeInteger(size) || size < 0) {
       throw new ResearchError("research bundle contains an unsafe or malformed archive entry");
     }
+    if (Buffer.byteLength(name, "utf8") > TAR_NAME_MAX || !header.equals(tarHeader(name, size))) {
+      throw new ResearchError(`research bundle entry ${name} has a header this bundle format does not write`);
+    }
     const start = offset + BLOCK;
     const end = start + size;
     if (end > bytes.length) throw new ResearchError("research bundle is truncated");
+    const padded = start + Math.ceil(size / BLOCK) * BLOCK;
+    if (padded > bytes.length || !bytes.subarray(end, padded).every((b) => b === 0)) {
+      throw new ResearchError(`research bundle entry ${name} carries bytes in its padding`);
+    }
+    if (files.has(name)) throw new ResearchError(`research bundle contains a duplicate archive entry ${name}`);
     files.set(name, Buffer.from(bytes.subarray(start, end)));
-    offset = start + Math.ceil(size / BLOCK) * BLOCK;
+    offset = padded;
   }
-  return files;
 }
-function walkLedger(ledger) {
+function packagedRecords(ledger) {
+  const files = readPairFiles(ledger);
+  if (files.length === 0) throw new ResearchError(`ledger ${ledger} holds no pair records`);
+  const records = [];
   const entries = [];
-  const pairs = join28(ledger, "pairs");
-  if (!existsSync20(pairs) || !statSync6(pairs).isDirectory()) throw new ResearchError(`ledger ${ledger} has no pairs directory`);
-  const names = readdirSync8(pairs).filter((n2) => n2.endsWith(".json")).sort();
-  if (names.length === 0) throw new ResearchError(`ledger ${ledger} holds no pair records`);
-  for (const name of names) {
-    const path = join28(pairs, name);
-    if (!statSync6(path).isFile()) continue;
-    entries.push({ name: `ledger/pairs/${name}`, bytes: readFileSync26(path) });
+  for (const f of files) {
+    let raw;
+    try {
+      raw = JSON.parse(f.bytes.toString("utf8"));
+    } catch (e) {
+      throw new ResearchError(`ledger record ${f.path} is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const record = portablePairRecordFrom(raw, f.path);
+    const archiveName = `ledger/pairs/${f.name}`;
+    const nameBytes = Buffer.byteLength(archiveName, "utf8");
+    if (nameBytes > TAR_NAME_MAX) {
+      throw new ResearchError(`pair record name ${f.name} is too long for the archive (${nameBytes} bytes as ${archiveName}; the limit is ${TAR_NAME_MAX})`);
+    }
+    records.push(record);
+    entries.push({ name: archiveName, bytes: jsonBytes(record) });
   }
-  return entries;
+  return { records, entries };
 }
 function jsonBytes(value) {
   return Buffer.from(JSON.stringify(value, null, 2) + "\n", "utf8");
@@ -21457,6 +22010,11 @@ function validateResearchBundle(path) {
   } catch (e) {
     throw new ResearchError(`cannot read research bundle ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
+  for (const name of files.keys()) {
+    if (!TOP_LEVEL_ENTRIES.has(name) && !PAIR_ENTRY_RE.test(name)) {
+      throw new ResearchError(`research bundle carries an entry that is not evidence: ${name}`);
+    }
+  }
   const provenance = files.get("provenance.json");
   const summaryBytes = files.get("summary.json");
   const report2 = files.get("report.txt");
@@ -21476,21 +22034,23 @@ function validateResearchBundle(path) {
   if (p.manifest_included !== Boolean(manifest) || p.prompts_included !== Boolean(manifest)) {
     throw new ResearchError("research bundle manifest inclusion metadata is inconsistent");
   }
-  if (manifest && createHash16("sha256").update(manifest).digest("hex") !== p.manifest_sha256) {
+  if (manifest && createHash17("sha256").update(manifest).digest("hex") !== p.manifest_sha256) {
     throw new ResearchError("research bundle manifest does not match its recorded sha256");
   }
   const parsedSummary = summary;
   if (parsedSummary.document !== "summary" || parsedSummary.command !== "research") throw new ResearchError("research bundle summary is not a research summary");
   const records = [];
   for (const [name, bytes] of files) {
-    if (!name.startsWith("ledger/pairs/") || !name.endsWith(".json")) continue;
+    if (!PAIR_ENTRY_RE.test(name)) continue;
     let raw;
     try {
       raw = JSON.parse(bytes.toString("utf8"));
     } catch {
       throw new ResearchError(`invalid JSON in ${name}`);
     }
-    records.push(pairRecordFrom(raw, name));
+    const record = portablePairRecordFrom(raw, name);
+    if (!bytes.equals(jsonBytes(record))) throw new ResearchError(`${name} is not the canonical serialization of its pair record`);
+    records.push(record);
   }
   if (records.length === 0) throw new ResearchError("research bundle contains no pair records");
   const derived = summarizeRecords(records);
@@ -21504,11 +22064,11 @@ function createResearchBundle(opts) {
   if (!opts.ledger) throw new ResearchError("research bundle requires --ledger");
   if (!opts.out) throw new ResearchError("research bundle requires --out");
   const ledger = resolve19(opts.ledger);
-  const summary = summarizeLedger(ledger);
-  const entries = walkLedger(ledger);
+  const { records, entries } = packagedRecords(ledger);
+  const summary = summarizeRecords(records);
   if (opts.manifest) {
     const manifest = readFileSync26(resolve19(opts.manifest));
-    const sha3 = createHash16("sha256").update(manifest).digest("hex");
+    const sha3 = createHash17("sha256").update(manifest).digest("hex");
     if (sha3 !== summary.manifest_sha256) throw new ResearchError(`manifest sha256 ${sha3} does not match ledger ${summary.manifest_sha256}`);
     entries.push({ name: "manifest.json", bytes: manifest });
   }
@@ -21530,8 +22090,8 @@ function createResearchBundle(opts) {
   entries.push({ name: "report.txt", bytes: Buffer.from(renderResearchReport(summary), "utf8") });
   entries.push({ name: "provenance.json", bytes: jsonBytes(provenance) });
   const out3 = resolve19(opts.out);
-  mkdirSync12(dirname13(out3), { recursive: true });
-  writeFileSync14(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
+  mkdirSync13(dirname14(out3), { recursive: true });
+  writeFileSync15(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
   return out3;
 }
 function runResearchBundle(opts) {
@@ -21555,17 +22115,25 @@ function runResearchBundle(opts) {
     throw e;
   }
 }
-var BLOCK, BUNDLE_VERSION;
+var BLOCK, BUNDLE_VERSION, TOP_LEVEL_ENTRIES, PAIR_ENTRY_RE, TAR_NAME_MAX, NAME_FIELD, TYPE_OFFSET, PREFIX_OFFSET, PREFIX_FIELD;
 var init_bundle = __esm({
   "src/research/bundle.ts"() {
     "use strict";
     init_machine_output();
     init_adapter();
+    init_ledger_files();
     init_record();
     init_report2();
     init_summarize();
     BLOCK = 512;
     BUNDLE_VERSION = 1;
+    TOP_LEVEL_ENTRIES = /* @__PURE__ */ new Set(["summary.json", "report.txt", "provenance.json", "manifest.json"]);
+    PAIR_ENTRY_RE = /^ledger\/pairs\/[^/]+\.json$/;
+    TAR_NAME_MAX = 99;
+    NAME_FIELD = 100;
+    TYPE_OFFSET = 156;
+    PREFIX_OFFSET = 345;
+    PREFIX_FIELD = 155;
   }
 });
 
@@ -22535,9 +23103,9 @@ var init_adapter4 = __esm({
 
 // src/adapters/copilot-sdk/changes.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
-import { mkdtempSync as mkdtempSync7, writeFileSync as writeFileSync15, readFileSync as readFileSync27, rmSync as rmSync13, existsSync as existsSync21, realpathSync as realpathSync11 } from "node:fs";
+import { mkdtempSync as mkdtempSync7, writeFileSync as writeFileSync16, readFileSync as readFileSync27, rmSync as rmSync14, existsSync as existsSync20, realpathSync as realpathSync12 } from "node:fs";
 import { tmpdir as tmpdir8 } from "node:os";
-import { basename as basename6, dirname as dirname14, isAbsolute as isAbsolute17, relative as relative12, resolve as resolve22, join as join29 } from "node:path";
+import { basename as basename6, dirname as dirname15, isAbsolute as isAbsolute17, relative as relative12, resolve as resolve22, join as join30 } from "node:path";
 function asStr4(v) {
   return typeof v === "string" ? v : "";
 }
@@ -22548,25 +23116,25 @@ function relForDisplay5(path, cwd) {
 function canonicalContainedTarget(abs, root) {
   let realRoot;
   try {
-    realRoot = realpathSync11(root);
+    realRoot = realpathSync12(root);
   } catch (e) {
     throw new Error(`trusted repository root ${root} cannot be resolved: ${e instanceof Error ? e.message : String(e)}`);
   }
   let dir = abs;
   const tail = [];
-  while (!existsSync21(dir)) {
-    const parent = dirname14(dir);
+  while (!existsSync20(dir)) {
+    const parent = dirname15(dir);
     if (parent === dir) break;
     tail.unshift(basename6(dir));
     dir = parent;
   }
   let realDir;
   try {
-    realDir = realpathSync11(dir);
+    realDir = realpathSync12(dir);
   } catch (e) {
     throw new Error(`write target ${abs} cannot be resolved: ${e instanceof Error ? e.message : String(e)}`);
   }
-  const real = tail.length ? join29(realDir, ...tail) : realDir;
+  const real = tail.length ? join30(realDir, ...tail) : realDir;
   const rel = relative12(realRoot, real);
   if (rel === "" || rel.startsWith("..") || isAbsolute17(rel)) {
     throw new Error(`write target ${abs} resolves outside the trusted repository root ${realRoot} \u2014 refusing to judge a write beyond the repository`);
@@ -22609,12 +23177,12 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
   const bytes = Buffer.byteLength(rawDiff);
   if (bytes > DIFF_MAX_BYTES()) throw new Error(`write diff for ${display2} is ${bytes} bytes (over the ${DIFF_MAX_BYTES()}-byte reconstruction budget)`);
   const { op, patch } = canonicalPatch(rawDiff, display2, isCreate);
-  const dir = mkdtempSync7(join29(tmpdir8(), "hf-sdk-apply-"));
+  const dir = mkdtempSync7(join30(tmpdir8(), "hf-sdk-apply-"));
   try {
-    const targetPath = join29(dir, TARGET);
-    if (op !== "create") writeFileSync15(targetPath, before ?? "");
-    const patchPath = join29(dir, "change.patch");
-    writeFileSync15(patchPath, patch);
+    const targetPath = join30(dir, TARGET);
+    if (op !== "create") writeFileSync16(targetPath, before ?? "");
+    const patchPath = join30(dir, "change.patch");
+    writeFileSync16(patchPath, patch);
     const git8 = (extra) => execFileSync15("git", ["apply", ...extra, patchPath], {
       cwd: dir,
       encoding: "utf8",
@@ -22633,7 +23201,7 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
   } catch (e) {
     throw new Error(`could not reconstruct the write to ${display2} from its diff via git apply: ${e instanceof Error ? e.message : String(e)}`);
   } finally {
-    rmSync13(dir, { recursive: true, force: true });
+    rmSync14(dir, { recursive: true, force: true });
   }
 }
 function canonicalPatch(raw, display2, isCreate) {
@@ -23082,7 +23650,7 @@ var init_evidence = __esm({
 });
 
 // src/runtime-qualification.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function includesKind(set, kind) {
   return set.includes(kind);
 }
@@ -23253,7 +23821,7 @@ function aggregateInLoop(assessments) {
   return "PARTIAL";
 }
 function sha16(s) {
-  return createHash17("sha256").update(s).digest("hex").slice(0, 16);
+  return createHash18("sha256").update(s).digest("hex").slice(0, 16);
 }
 function capabilityHash(caps) {
   const stable = JSON.stringify({
@@ -23373,15 +23941,15 @@ var init_runtime_qualification = __esm({
 
 // src/cli/runtime.ts
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync28, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join30, dirname as dirname15 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync14, readFileSync as readFileSync28, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join31, dirname as dirname16 } from "node:path";
 function storePath(cwd) {
   const dir = gitDir(cwd);
-  return dir ? join30(dir, "tamperward", "runtime-qualification.json") : null;
+  return dir ? join31(dir, "tamperward", "runtime-qualification.json") : null;
 }
 function readStore(cwd) {
   const path = storePath(cwd);
-  if (!path || !existsSync22(path)) return null;
+  if (!path || !existsSync21(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync28(path, "utf8"));
     if (parsed && typeof parsed === "object" && parsed.records && typeof parsed.records === "object") return parsed;
@@ -23504,8 +24072,8 @@ function writeRecord(cwd, id, report2) {
   store.records[id] = report2;
   store.updated_at = report2.timestamp;
   try {
-    mkdirSync13(dirname15(path), { recursive: true });
-    writeFileSync16(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    mkdirSync14(dirname16(path), { recursive: true });
+    writeFileSync17(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
     return true;
   } catch {
     return false;
@@ -23540,10 +24108,10 @@ function resolveHookConfigHash(canonicalId, cwd) {
     return sha16(JSON.stringify(interventionWiring(cwd)));
   }
   const files = {
-    "github-copilot-cli": join30(cwd, ".github", "hooks", "tamperward.json")
+    "github-copilot-cli": join31(cwd, ".github", "hooks", "tamperward.json")
   };
   const file = files[canonicalId];
-  if (!file || !existsSync22(file)) return null;
+  if (!file || !existsSync21(file)) return null;
   try {
     const raw = readFileSync28(file, "utf8");
     let hooks = raw;
@@ -23810,6 +24378,352 @@ var init_runtime = __esm({
   }
 });
 
+// src/cli/receipt.ts
+import { appendFileSync as appendFileSync6, readFileSync as readFileSync29, writeFileSync as writeFileSync18 } from "node:fs";
+function parseReceipt(args) {
+  const [sub, ...rest] = args;
+  const exportOpts = {};
+  const reconcileOpts = {};
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    const next = () => rest[++i];
+    switch (a) {
+      case "--json":
+        reconcileOpts.json = true;
+        break;
+      case "--require-ancestor":
+        reconcileOpts.requireAncestor = true;
+        break;
+      case "--out":
+        exportOpts.out = next();
+        break;
+      case "--cwd": {
+        const v = next();
+        exportOpts.cwd = v;
+        reconcileOpts.cwd = v;
+        break;
+      }
+      case "--base":
+        reconcileOpts.base = next();
+        break;
+      case "--cmd":
+        reconcileOpts.cmd = next();
+        break;
+      case "--budget": {
+        const v = next();
+        if (v !== void 0) reconcileOpts.budget = Number(v);
+        break;
+      }
+      case "--receipt":
+        reconcileOpts.receipt = next();
+        break;
+      case "--ci-result":
+        reconcileOpts.ciResult = next();
+        break;
+    }
+  }
+  return {
+    sub: isOneOf(RECEIPT_SUBCOMMANDS, sub) ? sub : void 0,
+    exportOpts,
+    reconcileOpts
+  };
+}
+function runReceipt(args) {
+  const { sub, exportOpts, reconcileOpts } = parseReceipt(args);
+  if (sub === "export") return runReceiptExport(exportOpts);
+  if (sub === "reconcile") return runReceiptReconcile(reconcileOpts);
+  process.stderr.write(`tamperward: receipt requires a subcommand (${RECEIPT_SUBCOMMANDS.join(" | ")})
+`);
+  return 2;
+}
+function reconcileInputs(opts) {
+  return {
+    base_ref: opts.base ?? "HEAD",
+    explicit_base: opts.base !== void 0,
+    command_source: opts.cmd !== void 0 ? "flag" : "policy",
+    command: opts.cmd ?? "",
+    budget_source: opts.budget !== void 0 ? "flag" : "policy",
+    budget: opts.budget ?? 300
+  };
+}
+function verdictExit(verdict2, signedOff) {
+  switch (verdict2) {
+    case "VERIFIED":
+      return 0;
+    case "MASKED_FAILURE":
+      return signedOff ? 0 : 1;
+    case "SUITE_RED":
+      return 1;
+    default:
+      return 2;
+  }
+}
+function needRepo(cwd, what) {
+  if (repoContext(cwd)) return null;
+  const why = outsideRepository(cwd) ?? "cwd is not inside a repository the gate can read";
+  process.stderr.write(`tamperward: receipt ${what} needs a git repository (${why})
+`);
+  return 2;
+}
+function runReceiptExport(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const guard = needRepo(cwd, "export");
+  if (guard !== null) return guard;
+  const evaluation = evaluateVerificationState(cwd);
+  const record = readVerificationRecord(cwd);
+  if (evaluation.state !== "CURRENT" || !record) {
+    const detail = evaluation.state === "CURRENT" ? "no verification record is available to export" : `no CURRENT verification to export (state: ${evaluation.state}) \u2014 run \`tamperward verify\` first`;
+    process.stderr.write(`tamperward: ${detail}
+`);
+    return 2;
+  }
+  const receipt = receiptFromRecord(record);
+  const serialized = JSON.stringify(receipt) + "\n";
+  if (opts.out) {
+    try {
+      writeFileSync18(opts.out, serialized);
+    } catch (e) {
+      process.stderr.write(`tamperward: could not write receipt to ${opts.out} (${e instanceof Error ? e.message : String(e)})
+`);
+      return 2;
+    }
+    process.stdout.write(`receipt: exported VERIFIED receipt for tree ${receipt.binding.tree.slice(0, 10)} to ${opts.out}
+`);
+  } else {
+    process.stdout.write(serialized);
+  }
+  return 0;
+}
+function ciAdjudicate(cwd, opts) {
+  const inputs = reconcileInputs(opts);
+  let binding = null;
+  let bindingError;
+  try {
+    binding = computeBinding(cwd, inputs);
+  } catch (e) {
+    bindingError = e instanceof Error ? e.message : String(e);
+  }
+  if (opts.ciResult !== void 0) {
+    let doc;
+    try {
+      doc = JSON.parse(readFileSync29(opts.ciResult, "utf8"));
+    } catch (e) {
+      return {
+        ci: { verdict: "CANNOT_VERIFY", binding, binding_error: `unreadable CI verify result: ${e instanceof Error ? e.message : String(e)}` },
+        exit: 2
+      };
+    }
+    const check2 = readCiVerify(doc, binding, cwd, opts);
+    if (check2.reason !== void 0) {
+      return { ci: { verdict: "CANNOT_VERIFY", binding, binding_error: check2.reason }, exit: 2 };
+    }
+    const signedOff = check2.verdict === "MASKED_FAILURE" && oobToken("verify", oobFromEnv(), oobHeadFromEnv()) !== null;
+    return {
+      ci: {
+        verdict: check2.verdict,
+        binding,
+        ...check2.adjudicated_tree !== void 0 ? { adjudicated_tree: check2.adjudicated_tree } : {},
+        ...bindingError ? { binding_error: bindingError } : {}
+      },
+      exit: verdictExit(check2.verdict, signedOff)
+    };
+  }
+  const impl = opts.runVerifyImpl ?? runVerify;
+  let summary;
+  const exit = impl({
+    cwd,
+    base: opts.base,
+    cmd: opts.cmd,
+    budget: opts.budget,
+    requireAncestor: opts.requireAncestor,
+    silent: true,
+    // reconcile prints its own summary; suppress verify's stdout
+    onVerdict: (s) => {
+      summary = s;
+    }
+  });
+  const verdict2 = summary?.verdict ?? "CANNOT_VERIFY";
+  return {
+    ci: {
+      verdict: verdict2,
+      binding,
+      ...binding ? { adjudicated_tree: binding.tree } : {},
+      ...bindingError ? { binding_error: bindingError } : {}
+    },
+    exit
+  };
+}
+function isCommitId(v) {
+  return typeof v === "string" && /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/.test(v);
+}
+function readCiVerify(doc, binding, cwd, opts) {
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    return { verdict: "CANNOT_VERIFY", reason: "CI verify result is not a JSON object" };
+  }
+  const d = doc;
+  if (d.schema_version !== 1) {
+    return { verdict: "CANNOT_VERIFY", reason: `CI verify result is not a verify --json document (schema_version ${JSON.stringify(d.schema_version)})` };
+  }
+  if (!isCommitId(d.base)) {
+    return { verdict: "CANNOT_VERIFY", reason: "CI verify result has no resolved base commit \u2014 not a verify --json document (a receipt is not a verify result)" };
+  }
+  if (!isRecordObject(d.visible) || !isRecordObject(d.pristine)) {
+    return { verdict: "CANNOT_VERIFY", reason: "CI verify result is missing the visible/pristine stage objects \u2014 not a verify --json document" };
+  }
+  if (!isOneOf(VERIFY_VERDICTS, d.verdict)) {
+    return { verdict: "CANNOT_VERIFY", reason: `CI verify result has an unknown verdict ${JSON.stringify(d.verdict)}` };
+  }
+  if (binding) {
+    const concrete = resolveConcreteCommit(cwd, opts.base ?? "HEAD");
+    const accepted = /* @__PURE__ */ new Set([binding.base, ...concrete ? [concrete] : []]);
+    if (!accepted.has(d.base)) {
+      return {
+        verdict: "CANNOT_VERIFY",
+        reason: `CI verify result binds base ${d.base.slice(0, 10)} but CI computed ${binding.base.slice(0, 10)} \u2014 the document describes a different base`
+      };
+    }
+  }
+  const adjudicated_tree = typeof d.adjudicated_tree === "string" && d.adjudicated_tree.length > 0 ? d.adjudicated_tree : void 0;
+  return { verdict: d.verdict, adjudicated_tree };
+}
+function isRecordObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function reconcileDocument(r) {
+  return machineOutput({
+    command: "reconcile",
+    result: r.result,
+    ci: r.ci,
+    local: r.local,
+    reconciliation: {
+      agreement: r.agreement,
+      applicable: r.applicable,
+      ...r.mismatched_input ? { mismatched_input: r.mismatched_input } : {},
+      divergence: r.divergence,
+      environment_divergence: r.environment_divergence
+    }
+  });
+}
+function renderReconcile(r, claimedReceipt, ciBinding, adjudicatedTree, colour) {
+  const tick = (s) => paint(s, severityColour("ok"), colour);
+  const cross = (s) => paint(s, BOLD + severityColour("bad"), colour);
+  const stageMark = (value, pass) => value === pass ? tick("\u2713") : cross("\u2717");
+  const lines = [];
+  lines.push("LOCAL");
+  if (claimedReceipt) {
+    lines.push(`  ${stageMark(claimedReceipt.stages.candidate, "PASS")} candidate ${claimedReceipt.binding.tree.slice(0, 10)} locally verified`);
+    lines.push(`  ${stageMark(claimedReceipt.stages.pristine, "PASS")} pristine ${claimedReceipt.stages.pristine}`);
+    lines.push(`  ${stageMark(claimedReceipt.stages.integrity, "CLEAN")} integrity ${claimedReceipt.stages.integrity}`);
+  } else if (r.local.disposition === "ABSENT") {
+    lines.push("  (no receipt provided)");
+  } else {
+    lines.push(`  ${cross("\u2717")} receipt ${r.local.disposition}${r.local.detail ? ` \u2014 ${r.local.detail}` : ""}`);
+  }
+  lines.push("");
+  lines.push("CI");
+  if (ciBinding) {
+    const mark = r.ci.verdict === "VERIFIED" ? tick("\u2713") : cross("\u2717");
+    const shownTree = adjudicatedTree ?? ciBinding.tree;
+    lines.push(`  ${mark} independently ${r.ci.verdict} ${shownTree.slice(0, 10)}`);
+  } else {
+    lines.push(`  ${cross("\u2717")} ${r.ci.verdict} (identity not computable)`);
+  }
+  lines.push("");
+  lines.push("RESULT");
+  lines.push(`  ${paint(r.result, (r.result === "VERIFIED" ? "" : BOLD) + severityColour(r.result === "VERIFIED" ? "ok" : "bad"), colour)}`);
+  const agreementLine = {
+    AGREE: "Local and CI evidence agree",
+    DIVERGENCE: "EVIDENCE DIVERGENCE \u2014 local claim not confirmed by CI",
+    NON_APPLICABLE: "Local receipt does not apply to the CI-adjudicated state \u2014 ignored",
+    NO_CLAIM: "No local receipt to reconcile \u2014 CI verdict stands"
+  };
+  lines.push(`  ${paint(agreementLine[r.agreement], severityColour(AGREEMENT_SEVERITY[r.agreement]), colour)}`);
+  for (const d of r.divergence) lines.push(`  ${d}`);
+  return lines.join("\n") + "\n";
+}
+function loadClaimedReceipt(path) {
+  if (path === void 0) {
+    return { disposition: "ABSENT", detail: "no local verification receipt was provided (pass one with --receipt)" };
+  }
+  let raw;
+  try {
+    raw = readFileSync29(path, "utf8");
+  } catch (e) {
+    return { disposition: "MALFORMED", detail: `receipt file could not be read (${e instanceof Error ? e.message : String(e)})` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { disposition: "MALFORMED", detail: `receipt file could not be parsed as JSON (${e instanceof Error ? e.message : String(e)})` };
+  }
+  return classifyReceipt(parsed);
+}
+function runReceiptReconcile(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const guard = needRepo(cwd, "reconcile");
+  if (guard !== null) return guard;
+  const { ci, exit } = ciAdjudicate(cwd, opts);
+  const claimed = loadClaimedReceipt(opts.receipt);
+  const r = reconcile(ci, claimed);
+  const claimedReceipt = claimed.disposition === "PRESENT" ? claimed.receipt : null;
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(reconcileDocument(r)) + "\n");
+  } else {
+    process.stdout.write(renderReconcile(r, claimedReceipt, ci.binding, ci.adjudicated_tree, colourEnabled(process.env, process.stdout)));
+  }
+  writeJobSummary(r, claimedReceipt, ci.binding, ci.adjudicated_tree);
+  return exit;
+}
+function writeJobSummary(r, receipt, ciBinding, adjudicatedTree) {
+  const path = process.env.GITHUB_STEP_SUMMARY;
+  if (!path) return;
+  const md = ["## TamperWard receipt reconciliation", ""];
+  const mark = (value, pass) => value === pass ? "\u2713" : "\u2717";
+  md.push("### LOCAL");
+  if (receipt) {
+    md.push(`- ${mark(receipt.stages.candidate, "PASS")} candidate \`${receipt.binding.tree.slice(0, 10)}\` locally verified`);
+    md.push(`- ${mark(receipt.stages.pristine, "PASS")} pristine ${receipt.stages.pristine}`);
+    md.push(`- ${mark(receipt.stages.integrity, "CLEAN")} integrity ${receipt.stages.integrity}`);
+  } else if (r.local.disposition === "ABSENT") {
+    md.push("- _no receipt provided_");
+  } else {
+    md.push(`- receipt **${r.local.disposition}**${r.local.detail ? ` \u2014 ${r.local.detail}` : ""}`);
+  }
+  md.push("", "### CI");
+  const shownTree = adjudicatedTree ?? ciBinding?.tree;
+  md.push(`- independently **${r.ci.verdict}**${shownTree ? ` \`${shownTree.slice(0, 10)}\`` : " (identity not computable)"}`);
+  md.push("", "### RESULT");
+  md.push(`**${r.result}** \u2014 ${r.agreement}`);
+  for (const d of r.divergence) md.push(`- ${d}`);
+  md.push("");
+  try {
+    appendFileSync6(path, md.join("\n") + "\n");
+  } catch {
+  }
+}
+var RECEIPT_SUBCOMMANDS, AGREEMENT_SEVERITY;
+var init_receipt = __esm({
+  "src/cli/receipt.ts"() {
+    "use strict";
+    init_machine_output();
+    init_repo_context();
+    init_verification_state();
+    init_verification_receipt();
+    init_verify();
+    init_signoff();
+    init_text();
+    init_status();
+    RECEIPT_SUBCOMMANDS = ["export", "reconcile"];
+    AGREEMENT_SEVERITY = {
+      AGREE: "ok",
+      DIVERGENCE: "bad",
+      NON_APPLICABLE: "warn",
+      NO_CLAIM: "info"
+    };
+  }
+});
+
 // src/cli/signoff-label.ts
 function runSignoffLabel(opts) {
   if (!opts.rule) {
@@ -24267,6 +25181,29 @@ function validateCliArgs(cmd, args) {
     }
     return `unknown research subcommand "${sub}" (${RESEARCH_SUBCOMMANDS.join(" | ")})`;
   }
+  if (cmd === "receipt") {
+    const [sub, ...rest] = args;
+    if (sub === void 0) return `receipt requires a subcommand (${RECEIPT_SUBCOMMANDS.join(" | ")})`;
+    if (sub === "export") {
+      return validateFlatArgs(rest, {
+        values: { "--out": "string", "--cwd": "string" }
+      }).error;
+    }
+    if (sub === "reconcile") {
+      return validateFlatArgs(rest, {
+        flags: ["--json", "--require-ancestor"],
+        values: {
+          "--base": "string",
+          "--cmd": "string",
+          "--budget": "positive",
+          "--cwd": "string",
+          "--receipt": "string",
+          "--ci-result": "string"
+        }
+      }).error;
+    }
+    return `unknown receipt subcommand "${sub}" (${RECEIPT_SUBCOMMANDS.join(" | ")})`;
+  }
   return void 0;
 }
 function printHelp() {
@@ -24402,6 +25339,23 @@ Formats:
                                             emits the versioned status document for
                                             editors, CI and dashboards. Local CURRENT
                                             is posture, never repository/CI authority.
+  tamperward receipt export [--out F]       emit the bounded, transportable verification
+             [--cwd D]                      receipt for the CURRENT verified state (to F,
+                                            else stdout). Refuses when the state is not
+                                            CURRENT. Raw evidence otherwise stays under
+                                            .git/tamperward/, never in the tracked tree.
+  tamperward receipt reconcile [--base R]   CI reruns the canonical verification FIRST,
+             [--cmd C] [--budget S]         then reconciles a claimed receipt against its
+             [--receipt F] [--ci-result F]  own adjudication. --receipt is the claimed
+             [--require-ancestor] [--json]  local receipt (absent \u2192 NO_CLAIM, never a
+             [--cwd D]                       failure by itself); --ci-result consumes a
+                                            preceding "verify --json" so the suite runs
+                                            once. Prints LOCAL / CI / RESULT and (--json)
+                                            a machine-readable reconciliation document,
+                                            plus a GitHub job summary. The receipt is
+                                            evidence, never authority: a stale, mismatched,
+                                            tampered, missing or unknown-schema receipt can
+                                            NEVER promote a CI result. Exit is CI's verdict.
   tamperward runtime verify [--runtime ID]  qualify the in-loop runtime: an operation-
              [--mode headless|interactive]  specific capability matrix (pre-deny:shell,
              [--model M] [--json] [--cwd D]  native-edit, mcp, end-of-turn, transport:*,
@@ -24492,6 +25446,8 @@ function main(argv) {
       const { sub, opts } = parseRuntime(rest);
       return runRuntime(sub, opts);
     }
+    case "receipt":
+      return runReceipt(rest);
     case "run":
       return runEnvelope({
         ...parseRun(rest),
@@ -24543,6 +25499,7 @@ var init_main = __esm({
     init_onboard();
     init_research();
     init_runtime();
+    init_receipt();
     init_audit();
     init_signoff_label();
   }
@@ -24551,7 +25508,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -24564,7 +25521,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync29(0, "utf8");
+      raw = readFileSync30(0, "utf8");
     } catch {
       raw = null;
     }