tickmarkr 2.5.8 → 2.6.0

package/dist/run/protocol.js

@@ -33,6 +33,41 @@ export const ShellReceiptSchema = z.object({
     error: z.string().optional(),
     durationMs: z.number().nonnegative().optional(),
 }).strict();
+export const EVIDENCE_AVAILABILITIES = ["available", "not-started", "capture-failed", "killed", "expired", "missing"];
+export const EvidenceArtifactSchema = z.object({
+    path: z.string().refine(p => p.length > 0 && !p.startsWith("/") && !p.includes("\\") && !p.split("/").includes("..")),
+    availability: z.enum(EVIDENCE_AVAILABILITIES),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/).nullable(),
+    retainedBytes: z.number().int().min(0).max(16 * 1024),
+    droppedBytes: z.number().int().nonnegative(),
+    truncated: z.boolean(),
+}).strict().superRefine((ref, ctx) => {
+    if (ref.truncated !== (ref.droppedBytes > 0))
+        ctx.addIssue({ code: "custom", message: "truncation must agree with dropped bytes" });
+    if (ref.availability === "available" && ref.sha256 === null)
+        ctx.addIssue({ code: "custom", message: "available bytes require a hash" });
+});
+export const GateEvidenceReceiptSchema = z.object({
+    invocationId: NonEmptyStringSchema,
+    nonce: NonEmptyStringSchema.optional(),
+    subject: z.object({
+        runId: NonEmptyStringSchema,
+        taskId: NonEmptyStringSchema.nullable(),
+        attempt: AttemptSchema.nullable(),
+        gate: NonEmptyStringSchema,
+        subjectCommit: NonEmptyStringSchema.nullable(),
+    }).strict(),
+    termination: z.object({
+        kind: z.enum(["exit", "signal", "timeout", "not-started", "unknown"]),
+        exitCode: z.number().int().nullable(),
+        signal: NonEmptyStringSchema.nullable(),
+        timedOut: z.boolean().nullable(),
+    }).strict(),
+    availability: z.enum(EVIDENCE_AVAILABILITIES),
+    redaction: z.object({ material: z.boolean() }).strict(),
+    stdout: EvidenceArtifactSchema,
+    stderr: EvidenceArtifactSchema,
+}).strict();
 /** A task-build row must carry the entire caller-owned correlation, even before spawn. */
 export const CommandReceiptSchema = ShellReceiptSchema.extend({
     attribution: CommandReceiptAttributionSchema,

package/dist/run/receipt-resolver.d.ts

@@ -0,0 +1,18 @@
+import { type GateEvidenceReceipt } from "./protocol.js";
+export declare const RECEIPT_UNAVAILABLE_REASONS: readonly ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
+export type ReceiptUnavailableReason = (typeof RECEIPT_UNAVAILABLE_REASONS)[number];
+export type ReceiptResolution = {
+    readonly ok: true;
+    readonly path: string;
+    readonly sha256: string;
+} | {
+    readonly ok: false;
+    readonly path: string;
+    readonly reason: ReceiptUnavailableReason;
+};
+/** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
+export declare function resolveReceipt(reference: unknown, runRoot: string): ReceiptResolution;
+/** Both artifacts of a receipt, stdout first, each resolved independently. */
+export declare function resolveReceiptArtifacts(receipt: GateEvidenceReceipt, runRoot: string): ReceiptResolution[];
+/** One line per artifact for a human surface: the reference, then its verified availability. */
+export declare function formatReceiptResolution(r: ReceiptResolution): string;

package/dist/run/receipt-resolver.js

@@ -0,0 +1,132 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { EvidenceArtifactSchema } from "./protocol.js";
+// OBS-1101 retrieval (D-174): the one production reader of an execution-evidence receipt. It answers
+// from the bytes on disk under the run root the receipt was minted in and nothing else — no
+// re-execution, no substitute chosen by name or timestamp, no symlink followed anywhere: not in the
+// reference, not at the root, not above it. The caller hands a canonical root (its own trust anchor);
+// a root reached through any link is refused outright.
+export const RECEIPT_UNAVAILABLE_REASONS = ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
+/** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
+export function resolveReceipt(reference, runRoot) {
+    const parsed = EvidenceArtifactSchema.safeParse(reference);
+    const path = typeof reference?.path === "string" ? reference.path : "";
+    if (!parsed.success) {
+        const escapes = path && (isAbsolute(path) || path.includes("\\") || path.split("/").includes(".."));
+        return { ok: false, path, reason: escapes ? "outside-root" : "missing" };
+    }
+    const ref = parsed.data;
+    if (ref.availability === "expired")
+        return { ok: false, path: ref.path, reason: "expired" };
+    if (ref.availability !== "available" || ref.sha256 === null)
+        return { ok: false, path: ref.path, reason: "missing" };
+    const root = resolve(runRoot);
+    const full = resolve(root, ref.path);
+    const rel = relative(root, full);
+    if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        return { ok: false, path: ref.path, reason: "outside-root" };
+    const read = readUnderRoot(root, rel.split(sep));
+    if (typeof read === "string")
+        return { ok: false, path: ref.path, reason: read };
+    const sha256 = createHash("sha256").update(read).digest("hex");
+    if (sha256 !== ref.sha256 || read.length !== ref.retainedBytes)
+        return { ok: false, path: ref.path, reason: "hash-mismatch" };
+    return { ok: true, path: ref.path, sha256 };
+}
+const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
+/** Every ancestor of the root, root first excluded — "/" itself cannot be a link. */
+function ancestors(root) {
+    const out = [];
+    for (let p = dirname(root); p !== dirname(p); p = dirname(p))
+        out.push(p);
+    return out;
+}
+/**
+ * Walk `parts` below `root` one descriptor at a time and return the leaf's bytes. Every component —
+ * the root's ancestors, the root, each directory, the leaf — is opened O_NOFOLLOW and must be the
+ * same inode lstat reports for that name before AND after the open, so a component swapped for a
+ * link mid-walk is refused rather than followed. Every platform takes the same pathname open: an
+ * ancestor swap by a same-privilege writer can only ever yield hash-identical bytes (D-269), so no
+ * descriptor-anchored traversal is layered on top (D-279: the boundary is the run root).
+ */
+function readUnderRoot(root, parts) {
+    for (const p of ancestors(root)) {
+        let st;
+        try {
+            st = lstatSync(p);
+        }
+        catch {
+            return "missing";
+        }
+        if (st.isSymbolicLink())
+            return "symlink";
+    }
+    const fds = [];
+    try {
+        let parent = openComponent(root, true);
+        if (typeof parent === "string")
+            return parent;
+        fds.push(parent);
+        let at = root;
+        for (let i = 0; i < parts.length; i++) {
+            at = resolve(at, parts[i]);
+            const fd = openComponent(at, i < parts.length - 1);
+            if (typeof fd === "string")
+                return fd;
+            fds.push(fd);
+            parent = fd;
+        }
+        return readFileSync(parent);
+    }
+    catch (e) {
+        return e.code === "ELOOP" ? "symlink" : "missing";
+    }
+    finally {
+        for (const fd of fds)
+            closeSync(fd);
+    }
+}
+function openComponent(path, dir) {
+    let before;
+    try {
+        before = lstatSync(path);
+    }
+    catch {
+        return "missing";
+    }
+    if (before.isSymbolicLink())
+        return "symlink";
+    if (dir ? !before.isDirectory() : !before.isFile())
+        return "missing";
+    const flags = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK | (dir ? constants.O_DIRECTORY : 0);
+    const fd = openSync(path, flags);
+    let after;
+    try {
+        after = lstatSync(path);
+    }
+    catch {
+        closeSync(fd);
+        return "missing";
+    }
+    const opened = fstatSync(fd);
+    if (after.isSymbolicLink() || !same(before, opened) || !same(after, opened)) {
+        closeSync(fd);
+        return "symlink";
+    }
+    // A leaf reachable under a second name (a hard link) is an alias the inode check cannot see through;
+    // evidence is written once under one name, so any aliased leaf is refused.
+    if (!dir && opened.nlink !== 1) {
+        closeSync(fd);
+        return "symlink";
+    }
+    return fd;
+}
+/** Both artifacts of a receipt, stdout first, each resolved independently. */
+export function resolveReceiptArtifacts(receipt, runRoot) {
+    return [receipt.stdout, receipt.stderr].map(ref => resolveReceipt(ref, runRoot));
+}
+/** One line per artifact for a human surface: the reference, then its verified availability. */
+export function formatReceiptResolution(r) {
+    return r.ok ? `${r.path} available sha256=${r.sha256}` : `${r.path} unavailable (${r.reason})`;
+}

package/dist/run/supervision.d.ts

@@ -39,7 +39,20 @@ export interface SupervisionBeatObservation {
 export declare const supervisionBeatPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export declare const supervisionStandDownPath: (repoRoot: string, tier: SupervisionTier) => string;
-export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string, observation?: SupervisionBeatObservation): void;
+/** Durable CLI arm; ticks never advance its epoch or its stand-down fence. */
+export interface SupervisionArm {
+    armId: string;
+    armEpoch: string;
+    markerFence: string;
+}
+export declare const supervisionArmPath: (repoRoot: string, tier: SupervisionTier) => string;
+/** Explicit arming acknowledges the current marker without deleting it. */
+export declare function newSupervisionArm(repoRoot: string, tier: SupervisionTier, armId?: string, initial?: boolean): SupervisionArm;
+export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string, observation?: SupervisionBeatObservation, options?: {
+    arm?: SupervisionArm;
+    armId?: string;
+    loop?: boolean;
+}): boolean;
 /** Handle a watcher holds for as long as it is supervising; disarm stands it down and is idempotent. */
 export interface ArmedSupervision {
     disarm: () => void;

package/dist/run/supervision.js

@@ -1,5 +1,5 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { randomUUID } from "node:crypto";
+import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { parseRunId } from "./journal.js";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
@@ -86,6 +86,63 @@ const supervisionDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "sup
 export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.beat`);
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
+export const supervisionArmPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.arm`);
+function readArm(repoRoot, tier) {
+    try {
+        const arm = JSON.parse(readFileSync(supervisionArmPath(repoRoot, tier), "utf8"));
+        if (typeof arm.armId !== "string" || !arm.armId.trim() ||
+            typeof arm.armEpoch !== "string" || Number.isNaN(Date.parse(arm.armEpoch)) ||
+            typeof arm.markerFence !== "string")
+            throw new Error("invalid arm");
+        return arm;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`${tier} arm is unreadable`, { cause: error });
+    }
+}
+function markerFence(repoRoot, tier) {
+    const marker = readStandDown(repoRoot, tier);
+    if (marker === "UNREADABLE")
+        throw new Error(`${tier} stand-down is unreadable`);
+    return marker === "NONE" ? "NONE" : marker.fence;
+}
+/** Explicit arming acknowledges the current marker without deleting it. */
+export function newSupervisionArm(repoRoot, tier, armId = randomUUID(), initial = false) {
+    // Acknowledge only the marker observed when arming begins. In particular, do not
+    // sample it after stamping the epoch: a stand-down published in that gap is a
+    // later act, and must fence this arm rather than be silently acknowledged by it.
+    const fence = initial ? "NONE" : markerFence(repoRoot, tier);
+    const previous = readArm(repoRoot, tier);
+    const arm = {
+        armId, armEpoch: new Date(Math.max(Date.now(), previous ? Date.parse(previous.armEpoch) + 1 : 0)).toISOString(),
+        markerFence: fence,
+    };
+    tickmarkrDir(repoRoot);
+    const path = supervisionArmPath(repoRoot, tier);
+    if (!initial) {
+        atomicRecord(path, arm);
+        return arm;
+    }
+    // Only one legacy first tick may install the initial arm. A losing process reuses the winner.
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(arm) + "\n");
+        try {
+            linkSync(tmp, path);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+    return readArm(repoRoot, tier);
+}
 /** The independent latch a stand-down cannot overwrite or remove. */
 const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.clear-owed`);
 // SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.
@@ -190,6 +247,22 @@ function dischargeClearObligation(repoRoot, tier, observation) {
         rmSync(supervisionObligationPath(repoRoot, tier), { force: true });
     }
 }
+function raiseIfCrossed(repoRoot, tier, observation) {
+    if (observation.pct >= observation.thresholdPct) {
+        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
+    }
+}
+// The latch is orthogonal to liveness: a stood-down tier still raises a crossing and still lets a
+// different arm below threshold discharge it. Otherwise the context instrument goes silent after the
+// first hand-off — the watcher script stands its tier down on every exit.
+function observeWithoutBeat(repoRoot, tier, observation) {
+    if (observation !== undefined) {
+        tickmarkrDir(repoRoot);
+        raiseIfCrossed(repoRoot, tier, observation);
+        dischargeClearObligation(repoRoot, tier, observation);
+    }
+    return false;
+}
 function validateObservation(observation) {
     if (!observation.armId.trim())
         throw new Error("a supervision observation needs a non-empty arm identity");
@@ -202,7 +275,7 @@ function validateObservation(observation) {
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
+function writeSupervisionBeat(repoRoot, tier, seat, armId, observation, arm, loop = false) {
     // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
     // verb: any caller that could write a seatless record could arm a tier nobody occupies.
     if (isSeatTier(tier) && !seat?.trim()) {
@@ -215,19 +288,42 @@ function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
     mkdirSync(dirname(p), { recursive: true });
     // Raise before the beat so a later beat failure cannot hide a duty; discharge only after the
     // below-threshold observation exists on disk.
-    if (observation !== undefined && observation.pct >= observation.thresholdPct) {
-        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
-    }
-    writeFileSync(p, JSON.stringify({
+    if (observation !== undefined)
+        raiseIfCrossed(repoRoot, tier, observation);
+    atomicRecord(p, {
         tier, ...(seat ? { seat } : {}), ...(armId ? { armId } : {}),
         ...(observation !== undefined ? { pct: observation.pct, thresholdPct: observation.thresholdPct } : {}),
-        exitedWriterPid: process.pid, beatAt: new Date().toISOString(),
-    }) + "\n");
+        ...arm,
+        ...(loop ? { pid: process.pid } : { exitedWriterPid: process.pid }),
+        beatAt: new Date().toISOString(),
+    });
     if (observation !== undefined)
         dischargeClearObligation(repoRoot, tier, observation);
 }
-export function beatSupervision(repoRoot, tier, seat, observation) {
-    writeSupervisionBeat(repoRoot, tier, seat, undefined, observation);
+export function beatSupervision(repoRoot, tier, seat, observation, options = {}) {
+    // `armId` only NAMES a first legacy arm; an existing arm is never refused for a name mismatch —
+    // the recorded id is a UUID no operator can know, and a mismatch is not a stand-down.
+    if (isSeatTier(tier) && !seat?.trim()) {
+        throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
+    }
+    if (observation !== undefined)
+        validateObservation(observation);
+    let arm = options.arm ?? readArm(repoRoot, tier);
+    if (!arm) {
+        if (markerFence(repoRoot, tier) !== "NONE")
+            return observeWithoutBeat(repoRoot, tier, observation);
+        arm = newSupervisionArm(repoRoot, tier, options.armId ?? observation?.armId, true);
+        // A marker published during initial creation must not be acknowledged implicitly.
+        if (arm.markerFence !== "NONE")
+            return observeWithoutBeat(repoRoot, tier, observation);
+    }
+    const current = readArm(repoRoot, tier);
+    if (current?.armId !== arm.armId || current.armEpoch !== arm.armEpoch ||
+        markerFence(repoRoot, tier) !== arm.markerFence)
+        return observeWithoutBeat(repoRoot, tier, observation);
+    writeSupervisionBeat(repoRoot, tier, seat, arm.armId, observation, arm, options.loop);
+    // The immutable fence travels WITH the beat, so a rename racing stand-down cannot outrank it.
+    return markerFence(repoRoot, tier) === arm.markerFence;
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -348,11 +444,12 @@ function readBeat(repoRoot, tier) {
     // is not evidence that nobody armed the tier). On a SEAT tier it is the opposite: a record naming no
     // seat leaves the tier armed and unattributable, which reads as coverage no seat is providing, so
     // it is UNREADABLE — something is there and no beat any reader can attribute comes out of it.
-    const { seat, armId } = beatMetadata(p);
+    const { seat, armId, markerFence } = beatMetadata(p);
     if (isSeatTier(tier) && seat === undefined)
         return "UNREADABLE";
     return {
         mtimeMs: st.mtimeMs,
+        ...(markerFence !== undefined ? { markerFence } : {}),
         ...(seat !== undefined ? { seat } : {}),
         ...(armId !== undefined ? { armId } : {}),
     };
@@ -363,7 +460,8 @@ function beatMetadata(path) {
         const rec = JSON.parse(readFileSync(path, "utf8"));
         const seat = typeof rec?.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
         const armId = typeof rec?.armId === "string" && rec.armId.trim() ? rec.armId : undefined;
-        return { ...(seat !== undefined ? { seat } : {}), ...(armId !== undefined ? { armId } : {}) };
+        const markerFence = typeof rec?.markerFence === "string" ? rec.markerFence : undefined;
+        return { ...(markerFence !== undefined ? { markerFence } : {}), ...(seat !== undefined ? { seat } : {}), ...(armId !== undefined ? { armId } : {}) };
     }
     catch {
         return {};
@@ -414,8 +512,11 @@ function readStandDown(repoRoot, tier) {
         return "UNREADABLE";
     let seat;
     let armId;
+    let fence;
     try {
-        const rec = JSON.parse(readFileSync(p, "utf8"));
+        const bytes = readFileSync(p, "utf8");
+        fence = createHash("sha256").update(bytes).digest("hex");
+        const rec = JSON.parse(bytes);
         if (rec?.tier !== tier)
             return "UNREADABLE";
         if (typeof rec.disarmedAt !== "string" || Number.isNaN(Date.parse(rec.disarmedAt)))
@@ -431,25 +532,22 @@ function readStandDown(repoRoot, tier) {
         return "UNREADABLE";
     } // unparseable or unreadable bytes — not a stand-down anyone can read
     return {
-        mtimeMs: st.mtimeMs,
+        mtimeMs: st.mtimeMs, fence,
         ...(seat !== undefined ? { seat } : {}),
         ...(armId !== undefined ? { armId } : {}),
     };
 }
-// THE TIER'S STATE — what every surface and every operator reads. A valid stand-down outranks the beat:
-// the watcher that wrote it is gone ON PURPOSE, and its last beat ages out exactly like a dead one's
-// would. It outranks the beat it FOLLOWED and no other — a later timestamp OR a FRESH different
-// armed-watcher identity is another arm, so a marker whose rename lost that race cannot mask a live
-// watcher. Once that foreign beat is stale, a newer clean hand-off must win: otherwise overlapping
-// boards closed in last-beater-first order would leave the tier reporting a death forever.
+// CLI beats carry the marker generation acknowledged at arm time, never at tick time. A new
+// marker dominates every tick of that arm regardless of rename order or beat mtime. The separate
+// presence-based lifecycle retains overlapping watch owners and their last-owner stand-down.
 export function supervisionStatus(repoRoot, tier, now = Date.now()) {
     const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
         return withClearObligation(repoRoot, tier, { tier, state: "UNREADABLE" });
-    const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
-        beat.armId !== undefined && standDown.armId !== undefined && beat.armId !== standDown.armId &&
-        existsSync(supervisionPresencePath(repoRoot, tier, beat.armId))));
+    const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.markerFence !== undefined ? beat.markerFence === standDown.fence :
+        beat.armId !== undefined && existsSync(supervisionPresencePath(repoRoot, tier, beat.armId)) && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
+            standDown.armId !== undefined && beat.armId !== standDown.armId)));
     if (standDown !== "NONE" && !beatOutranksStandDown) {
         // the seat that stood down is named by the marker, falling back to whatever its last beat named
         const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);

package/dist/tui/cockpit/evidence-view.d.ts

@@ -27,6 +27,10 @@ export interface EvidenceRow {
     /** Durable artifact locations this row's detail names (e.g. a saved raw-review capture); empty
      *  when none were recorded — rendered as "missing", never silently omitted. */
     readonly artifacts: readonly string[];
+    /** The row's execution-evidence receipt, each artifact resolved through the shared resolver against
+     *  the run root it was minted in (`originRunRoot` for a reused verdict) — reference then verified
+     *  availability; empty when the row carries no receipt. */
+    readonly receipts: readonly string[];
     readonly taskId?: string;
     readonly gate?: string;
 }
@@ -34,7 +38,10 @@ export interface EvidenceRow {
 export declare function parseArtifactLocations(details: string): string[];
 /** Pure C2-journal-to-Evidence-rows mapping: the original journal position IS the evidence identity
  *  — assigned once here, from the full unfiltered event list, never recomputed from a display slice. */
-export declare function deriveEvidenceJournal(eventsOrRows: readonly (JournalEvent | TrackedJournalRow)[], source?: string): EvidenceRow[];
+export declare function deriveEvidenceJournal(eventsOrRows: readonly (JournalEvent | TrackedJournalRow)[], source?: string, runRoot?: string): EvidenceRow[];
+/** The live cockpit names its journal by absolute path (`<state>/runs/<runId>/journal.jsonl`); that
+ *  directory IS the run root. A relative or foreign source names no root — nothing is guessed. */
+export declare function runRootOf(source: string | undefined): string | undefined;
 /** The most recent review verdict recorded for a task — by original journal position, so a merged
  *  task's review opens the row it actually happened on rather than any on-screen index. */
 export declare function selectTaskReview(journal: readonly EvidenceRow[], taskId: string): EvidenceRow | undefined;
@@ -42,6 +49,8 @@ export interface EvidenceViewInput {
     readonly events?: readonly JournalEvent[];
     readonly rows?: readonly TrackedJournalRow[];
     readonly source?: string;
+    /** The displayed run's root (its journal directory); receipts minted by this run resolve under it. */
+    readonly runRoot?: string;
     readonly costs?: readonly ChannelCost[];
     /** Caller-supplied Report-tab text (e.g. from `renderMarkdownRecord`/`textReport`) — kept as a pure
      *  input so this leaf never reads config/telemetry itself. */

package/dist/tui/cockpit/evidence-view.js

@@ -1,11 +1,12 @@
 import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
-import { existsSync, renameSync, statSync, unlinkSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { existsSync, realpathSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { Box, useInput } from "ink";
 import { useEffect, useRef, useState } from "react";
 import { buildOperatorRecord, formatOperatorRecordRow } from "../../report/operator-record.js";
 import { EMPTY_OPERATOR_PAGE_SUMMARY, foldOperatorPages, operatorPageRow } from "../../run/operator-page-summary.js";
 import { formatJournalNarration } from "../../run/journal.js";
+import { formatReceiptResolution, resolveReceipt } from "../../run/receipt-resolver.js";
 import { BodyText, JournalRowPanel, Panel } from "./components.js";
 import { cellWidth, sliceCells } from "./width.js";
 // review.ts:485 emits `; raw saved: <path>) — failing closed`, the path immediately followed by
@@ -30,7 +31,7 @@ function stateFor(e) {
 }
 /** Pure C2-journal-to-Evidence-rows mapping: the original journal position IS the evidence identity
  *  — assigned once here, from the full unfiltered event list, never recomputed from a display slice. */
-export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl") {
+export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl", runRoot) {
     const result = [];
     for (let i = 0; i < eventsOrRows.length; i++) {
         const item = eventsOrRows[i];
@@ -61,6 +62,7 @@ export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl") {
                 artifacts.push(p);
         }
         const gate = typeof e.data?.gate === "string" ? e.data.gate : (e.event === "review-leg2" ? "review" : undefined);
+        const receipts = resolveRowReceipt(e.data, runRoot ?? runRootOf(rowSource));
         result.push({
             evidence: { source: rowSource, line, id },
             time: e.ts,
@@ -68,12 +70,42 @@ export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl") {
             text: formatJournalNarration(e),
             fullText: details || JSON.stringify(e.data, null, 2),
             artifacts,
+            receipts,
             ...(e.taskId ? { taskId: e.taskId } : {}),
             ...(gate ? { gate } : {}),
         });
     }
     return result;
 }
+/** The live cockpit names its journal by absolute path (`<state>/runs/<runId>/journal.jsonl`); that
+ *  directory IS the run root. A relative or foreign source names no root — nothing is guessed. */
+export function runRootOf(source) {
+    return source && isAbsolute(source) && basename(source) === "journal.jsonl" ? dirname(source) : undefined;
+}
+// A reused verdict's receipt stays bound to the run root that minted it; the current run's root
+// answers only for evidence this run produced. No root known → nothing can be verified. A receipt
+// the schema rejects is still a receipt the row carries: each reference it names goes through the
+// resolver and is shown with its reason, never dropped. D-279: the boundary is the run root — the
+// host's ancestors are canonicalised (macOS `/var` → `/private/var`) but the root's own name is
+// passed as recorded, so a root that IS a symlink stays visible and the resolver refuses it.
+function resolveRowReceipt(data, runRoot) {
+    const receipt = data?.evidenceReceipt;
+    if (!receipt || typeof receipt !== "object")
+        return [];
+    const refs = [receipt.stdout, receipt.stderr];
+    const recorded = typeof data?.originRunRoot === "string" && data.originRunRoot ? data.originRunRoot : runRoot;
+    let root;
+    try {
+        root = recorded ? join(realpathSync(dirname(recorded)), basename(recorded)) : undefined;
+    }
+    catch {
+        root = undefined;
+    }
+    return refs.map(ref => {
+        const path = typeof ref?.path === "string" ? ref.path : "";
+        return formatReceiptResolution(root ? resolveReceipt(ref, root) : { ok: false, path, reason: "missing" });
+    });
+}
 /** The most recent review verdict recorded for a task — by original journal position, so a merged
  *  task's review opens the row it actually happened on rather than any on-screen index. */
 export function selectTaskReview(journal, taskId) {
@@ -100,7 +132,7 @@ export function deriveEvidenceView(input) {
             const row = operatorPageRow(event, tracked ? item.line : index + 1, tracked ? item.source ?? source : source);
             return row ? [row] : [];
         })).groups,
-        journal: deriveEvidenceJournal(items, source),
+        journal: deriveEvidenceJournal(items, source, input.runRoot),
         channels: buildOperatorRecord(events, input.costs ?? []),
         reportLines: input.reportLines ?? [],
         statsLines: input.statsLines ?? [],
@@ -229,7 +261,7 @@ export function EvidenceView({ model, width, focused = true, focusEvidence, onSe
         return { id: row.evidence.id, time, state: row.state, text: clipped };
     });
     return (_jsxs(Box, { flexDirection: "column", width: width, children: [_jsxs(BodyText, { emphasis: "strong", children: ["EVIDENCE ", TABS.map((t) => (t === tab ? `[${TAB_TITLE[t]}]` : TAB_TITLE[t])).join("  "), tab === "journal" ? `  | Follow ${follow ? "on" : "off"}` : "", selectedRow ? `  | selected ${selectedRow.evidence.id}` : ""] }), tab === "journal" && (_jsxs(_Fragment, { children: [_jsx(JournalRowPanel, { title: "RAW JOURNAL", rows: journalRows, selection: selectedIndex >= 0 ? selectedIndex : undefined }), _jsx(Panel, { title: "OPERATOR PAGE GROUPS", children: model.operatorPages.length ? model.operatorPages.map((group, index) => (_jsxs(Box, { flexDirection: "column", children: [_jsxs(BodyText, { emphasis: "strong", children: [group.taskId, " \u00B7 ", group.park, " \u00B7 ", group.status] }), _jsxs(BodyText, { children: ["first ", group.firstEvidenceAt] }), _jsxs(BodyText, { children: ["last ", group.lastEvidenceAt] }), _jsxs(BodyText, { children: ["visible ", group.observedCount, " \u00B7 suppressed ", group.suppressedCount, group.rawOnly ? " · raw-only (suppression unrecorded)" : ""] }), _jsx(BodyText, { children: "Raw source lines (\u2191\u2193 select, Enter open):" }), group.lines.map(line => _jsxs(BodyText, { children: ["#L", line] }, line))] }, `${group.key}:${index}`))) : _jsx(BodyText, { emphasis: "dim", children: "no operator pages" }) }), _jsx(Panel, { title: "SELECTED EVIDENCE", children: selectedRow
-                            ? (_jsxs(_Fragment, { children: [_jsxs(BodyText, { emphasis: "dim", children: ["Original journal ", selectedRow.evidence.id] }), selectedRow.fullText.split("\n").map((line, i) => _jsx(BodyText, { children: line }, i)), _jsxs(BodyText, { emphasis: "dim", children: ["Artifacts: ", selectedRow.artifacts.length ? selectedRow.artifacts.join(", ") : "missing"] })] }))
+                            ? (_jsxs(_Fragment, { children: [_jsxs(BodyText, { emphasis: "dim", children: ["Original journal ", selectedRow.evidence.id] }), selectedRow.fullText.split("\n").map((line, i) => _jsx(BodyText, { children: line }, i)), _jsxs(BodyText, { emphasis: "dim", children: ["Artifacts: ", selectedRow.artifacts.length ? selectedRow.artifacts.join(", ") : "missing"] }), selectedRow.receipts.map((line, i) => _jsxs(BodyText, { emphasis: "dim", children: ["Receipt: ", line] }, `r${i}`))] }))
                             : _jsx(BodyText, { emphasis: "dim", children: "no history" }) })] })), tab === "report" && (_jsx(Panel, { title: "REPORT", children: model.reportLines.length
                     ? model.reportLines.map((line, i) => _jsx(BodyText, { children: line }, i))
                     : _jsx(BodyText, { emphasis: "dim", children: "no history" }) })), tab === "stats" && (_jsx(Panel, { title: "STATS", children: model.statsLines.length

package/dist/tui/cockpit/live-runtime.d.ts

@@ -22,6 +22,10 @@ export interface ShellDelivery {
     diagnostics: LiveStore["diagnostics"];
     stage: (edits: readonly string[]) => void;
     geometry: () => ShellCommit | undefined;
+    /** Application render commits since mount (OBS-1132: an idle board adds none). */
+    frames: () => number;
+    /** Model derivations (the App body) since mount. */
+    derivations: () => number;
 }
 export interface ConsolidatedOptions {
     input: NodeJS.ReadStream;