toolroll 0.9.34 → 0.9.37

package/dist/contracts/verification-receipt.d.ts

@@ -0,0 +1,148 @@
+/**
+ * The machine verification receipt (`verification-receipt.json`): one schema for what `sealVerificationReceipt`
+ * writes and what `verificationEvidence` reads back. Only the machine writes it, from typed values, so every receipt
+ * ever sealed already has exactly this shape; the bindings that need the store — the run, its candidate, the approved
+ * command, the retained log and a reused gate's source — are checked in plain code after parsing.
+ *
+ * Version 1 is a gate executed in its own run. Version 2 added `reusedFrom` and `executedHere: false` for a gate
+ * reused by an unchanged observation follow-up. A direct receipt is still sealed as version 1, so its bytes (and the
+ * digests bound to them) read the same in every Toolroll that reads receipts.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost"];
+/**
+ * What the repository's approved verification command did: not configured; configured but the run could not attempt
+ * it (`attemptFailed`, which downgrades to `short` rather than `refuted`: "we could not check" is not "the claim is
+ * false"); or ran, with its exit code.
+ */
+export declare const verifyCommandFactsSchema: z.ZodUnion<readonly [z.ZodObject<{
+    configured: z.ZodLiteral<false>;
+}, z.core.$strict>, z.ZodObject<{
+    configured: z.ZodLiteral<true>;
+    ran: z.ZodLiteral<false>;
+    attemptFailed: z.ZodLiteral<true>;
+    failure: z.ZodOptional<z.ZodEnum<{
+        "checkout-moved": "checkout-moved";
+        "cleanliness-unavailable": "cleanliness-unavailable";
+        "custody-lost": "custody-lost";
+        "dependency-missing": "dependency-missing";
+        "dependency-still-missing": "dependency-still-missing";
+        "own-install-failed": "own-install-failed";
+        "retry-spawn-failed": "retry-spawn-failed";
+        "retry-timed-out": "retry-timed-out";
+        "setup-changed-files": "setup-changed-files";
+        "setup-failed": "setup-failed";
+        "setup-stale": "setup-stale";
+        "spawn-failed": "spawn-failed";
+        "timed-out": "timed-out";
+        "tracked-files-changed": "tracked-files-changed";
+    }>>;
+}, z.core.$strict>, z.ZodObject<{
+    configured: z.ZodLiteral<true>;
+    ran: z.ZodLiteral<true>;
+    exitCode: z.ZodInt;
+    setupReplayed: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>]>;
+export type VerifyCommandFacts = z.infer<typeof verifyCommandFactsSchema>;
+/** The approved verification grant the gate ran, exactly as the store held it. */
+export declare const receiptCommandSchema: z.ZodObject<{
+    id: z.ZodInt;
+    repo: z.ZodString;
+    command: z.ZodString;
+    timeoutMs: z.ZodInt;
+    digest: z.ZodString;
+    recoverySetupDigest: z.ZodNullable<z.ZodString>;
+    approvedBy: z.ZodString;
+    approvedAt: z.ZodString;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    revokedBy: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+/** The retained check log the receipt binds, by artifact id and content. */
+export declare const receiptLogSchema: z.ZodObject<{
+    artifactId: z.ZodInt;
+    sha256: z.ZodString;
+    bytesStored: z.ZodInt;
+    bytesOriginal: z.ZodInt;
+    truncated: z.ZodBoolean;
+    redacted: z.ZodBoolean;
+    captureStatus: z.ZodNullable<z.ZodEnum<{
+        failed: "failed";
+        ok: "ok";
+    }>>;
+}, z.core.$strict>;
+export declare const RECEIPT_VERSION = 2;
+/** The receipt as read: a reused gate names its source run and digest; a direct one names neither. */
+export declare const verificationReceiptSchema: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    run: z.ZodInt;
+    head: z.ZodString;
+    base: z.ZodNullable<z.ZodString>;
+    scopeDigest: z.ZodNullable<z.ZodString>;
+    reusedFrom: z.ZodOptional<z.ZodObject<{
+        run: z.ZodInt;
+        digest: z.ZodString;
+    }, z.core.$strict>>;
+    executedHere: z.ZodOptional<z.ZodLiteral<false>>;
+    command: z.ZodObject<{
+        id: z.ZodInt;
+        repo: z.ZodString;
+        command: z.ZodString;
+        timeoutMs: z.ZodInt;
+        digest: z.ZodString;
+        recoverySetupDigest: z.ZodNullable<z.ZodString>;
+        approvedBy: z.ZodString;
+        approvedAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        revokedBy: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        configured: z.ZodLiteral<false>;
+    }, z.core.$strict>, z.ZodObject<{
+        configured: z.ZodLiteral<true>;
+        ran: z.ZodLiteral<false>;
+        attemptFailed: z.ZodLiteral<true>;
+        failure: z.ZodOptional<z.ZodEnum<{
+            "checkout-moved": "checkout-moved";
+            "cleanliness-unavailable": "cleanliness-unavailable";
+            "custody-lost": "custody-lost";
+            "dependency-missing": "dependency-missing";
+            "dependency-still-missing": "dependency-still-missing";
+            "own-install-failed": "own-install-failed";
+            "retry-spawn-failed": "retry-spawn-failed";
+            "retry-timed-out": "retry-timed-out";
+            "setup-changed-files": "setup-changed-files";
+            "setup-failed": "setup-failed";
+            "setup-stale": "setup-stale";
+            "spawn-failed": "spawn-failed";
+            "timed-out": "timed-out";
+            "tracked-files-changed": "tracked-files-changed";
+        }>>;
+    }, z.core.$strict>, z.ZodObject<{
+        configured: z.ZodLiteral<true>;
+        ran: z.ZodLiteral<true>;
+        exitCode: z.ZodInt;
+        setupReplayed: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>]>;
+    log: z.ZodObject<{
+        artifactId: z.ZodInt;
+        sha256: z.ZodString;
+        bytesStored: z.ZodInt;
+        bytesOriginal: z.ZodInt;
+        truncated: z.ZodBoolean;
+        redacted: z.ZodBoolean;
+        captureStatus: z.ZodNullable<z.ZodEnum<{
+            failed: "failed";
+            ok: "ok";
+        }>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type VerificationReceipt = z.infer<typeof verificationReceiptSchema>;
+/** A version 1 receipt read as version 2: the same fields. Reuse is a version 2 field; a version 1 receipt naming it
+ * is refused by its reader, which still knows the version it was sealed as. */
+export declare function upgradeDirectReceipt(body: Record<string, unknown>): Record<string, unknown>;
+export declare const RECEIPT_UPGRADES: {
+    readonly 1: typeof upgradeDirectReceipt;
+};
+/** Read a receipt: version 2 as itself, version 1 as a direct gate, a newer one refused plainly. */
+export declare function readVerificationReceipt(input: unknown): ContractResult<VerificationReceipt>;

package/dist/contracts/verification-receipt.js

@@ -0,0 +1,87 @@
+/**
+ * The machine verification receipt (`verification-receipt.json`): one schema for what `sealVerificationReceipt`
+ * writes and what `verificationEvidence` reads back. Only the machine writes it, from typed values, so every receipt
+ * ever sealed already has exactly this shape; the bindings that need the store — the run, its candidate, the approved
+ * command, the retained log and a reused gate's source — are checked in plain code after parsing.
+ *
+ * Version 1 is a gate executed in its own run. Version 2 added `reusedFrom` and `executedHere: false` for a gate
+ * reused by an unchanged observation follow-up. A direct receipt is still sealed as version 1, so its bytes (and the
+ * digests bound to them) read the same in every Toolroll that reads receipts.
+ */
+import { z } from "zod";
+import { readVersioned, versioned } from "./contract.js";
+export const VERIFICATION_FAILURES = [
+    "spawn-failed",
+    "timed-out",
+    "dependency-missing",
+    "setup-stale",
+    "setup-failed",
+    "own-install-failed",
+    "tracked-files-changed",
+    "setup-changed-files",
+    "checkout-moved",
+    "cleanliness-unavailable",
+    "dependency-still-missing",
+    "retry-spawn-failed",
+    "retry-timed-out",
+    "custody-lost",
+];
+/**
+ * What the repository's approved verification command did: not configured; configured but the run could not attempt
+ * it (`attemptFailed`, which downgrades to `short` rather than `refuted`: "we could not check" is not "the claim is
+ * false"); or ran, with its exit code.
+ */
+export const verifyCommandFactsSchema = z.union([
+    z.strictObject({ configured: z.literal(false) }),
+    z.strictObject({ configured: z.literal(true), ran: z.literal(false), attemptFailed: z.literal(true), failure: z.enum(VERIFICATION_FAILURES).optional() }),
+    z.strictObject({ configured: z.literal(true), ran: z.literal(true), exitCode: z.int().min(0).max(255), setupReplayed: z.literal(true).optional() }),
+]);
+/** The approved verification grant the gate ran, exactly as the store held it. */
+export const receiptCommandSchema = z.strictObject({
+    id: z.int(),
+    repo: z.string(),
+    command: z.string(),
+    timeoutMs: z.int(),
+    digest: z.string(),
+    recoverySetupDigest: z.string().nullable(),
+    approvedBy: z.string(),
+    approvedAt: z.string(),
+    revokedAt: z.string().nullable(),
+    revokedBy: z.string().nullable(),
+});
+/** The retained check log the receipt binds, by artifact id and content. */
+export const receiptLogSchema = z.strictObject({
+    artifactId: z.int(),
+    sha256: z.string(),
+    bytesStored: z.int(),
+    bytesOriginal: z.int(),
+    truncated: z.boolean(),
+    redacted: z.boolean(),
+    captureStatus: z.enum(["ok", "failed"]).nullable(),
+});
+export const RECEIPT_VERSION = 2;
+const receiptFields = {
+    run: z.int(),
+    head: z.string(),
+    base: z.string().nullable(),
+    scopeDigest: z.string().nullable(),
+};
+/** The receipt as read: a reused gate names its source run and digest; a direct one names neither. */
+export const verificationReceiptSchema = versioned(RECEIPT_VERSION, {
+    ...receiptFields,
+    reusedFrom: z.strictObject({ run: z.int(), digest: z.string() }).optional(),
+    executedHere: z.literal(false).optional(),
+    command: receiptCommandSchema,
+    result: verifyCommandFactsSchema,
+    log: receiptLogSchema,
+});
+/** A version 1 receipt read as version 2: the same fields. Reuse is a version 2 field; a version 1 receipt naming it
+ * is refused by its reader, which still knows the version it was sealed as. */
+export function upgradeDirectReceipt(body) {
+    return { ...body, version: RECEIPT_VERSION };
+}
+export const RECEIPT_UPGRADES = { 1: upgradeDirectReceipt };
+/** Read a receipt: version 2 as itself, version 1 as a direct gate, a newer one refused plainly. */
+export function readVerificationReceipt(input) {
+    return readVersioned(verificationReceiptSchema, input, RECEIPT_UPGRADES);
+}

package/dist/decision.d.ts

@@ -14,18 +14,11 @@
  * caps also keep one screen one screen: an option list that needs scrolling
  * has already failed the milestone sentence.
  */
-export type ParsedOption = {
-    id: string;
-    label: string;
-    consequence: string;
-    reversible: boolean;
-};
-export type ParsedDecision = {
-    urgency: "blocking";
-    recap: string;
-    question: string;
-    options: ParsedOption[];
-    recommendation: string;
+import { type DecisionOption, type DecisionPayload } from "./contracts/decision.js";
+/** One option as a decision keeps it (src/contracts/decision.ts). */
+export type ParsedOption = DecisionOption;
+/** A decision as read: the payload's fields, its text trimmed, and the optional ones present or null. */
+export type ParsedDecision = Omit<DecisionPayload, "assignee" | "deadline"> & {
     assignee: string | null;
     /** Normalized to toISOString(), like every timestamp in the store. */
     deadline: string | null;
@@ -41,17 +34,10 @@ export type ParseResult = {
     ok: false;
     problems: Problem[];
 };
-/** One screen's worth, enforced rather than hoped for. */
+/** One screen's worth, enforced rather than hoped for. The payload's fields are bounded by its schema (src/contracts/decision.ts, from TEXT_LIMITS). */
 export declare const LIMITS: {
     /** Bytes, before parsing. Applied by the reader too; this is the backstop. */
     readonly payload: number;
-    readonly recap: 2000;
-    readonly question: 2000;
-    readonly consequence: 500;
-    readonly label: 120;
-    readonly optionId: 40;
-    readonly assignee: 120;
-    readonly options: 6;
     /** UTF-16 code units (TEXT_LIMITS.note: revise feedback, steering and decision notes); the byte backstop lives in validateNote. */
     readonly note: 4000;
 };
@@ -79,6 +65,11 @@ export declare function hasForbiddenControls(text: string): boolean;
  * backwards is not a title, it is a costume.
  */
 export declare function hasDisguisedText(text: string): boolean;
+/**
+ * A parked decision, read against its contract (src/contracts/decision.ts): fail closed, every problem at once, each
+ * naming its path (`options[1].reversible: required`) under the reason code the repair turn, incidents and tests have
+ * always used (`missing-reversible`). A decision written without `version` reads as it always did.
+ */
 export declare function parseDecision(raw: string): ParseResult;
 /**
  * The terminal handoff: how every non-parking attempt says how it ended.

package/dist/decision.js

@@ -14,18 +14,12 @@
  * caps also keep one screen one screen: an option list that needs scrolling
  * has already failed the milestone sentence.
  */
+import { readDecisionPayload } from "./contracts/decision.js";
 import { TEXT_LIMITS } from "./text-limits.js";
-/** One screen's worth, enforced rather than hoped for. */
+/** One screen's worth, enforced rather than hoped for. The payload's fields are bounded by its schema (src/contracts/decision.ts, from TEXT_LIMITS). */
 export const LIMITS = {
     /** Bytes, before parsing. Applied by the reader too; this is the backstop. */
     payload: 64 * 1024,
-    recap: 2_000,
-    question: 2_000,
-    consequence: 500,
-    label: 120,
-    optionId: 40,
-    assignee: 120,
-    options: 6,
     /** UTF-16 code units (TEXT_LIMITS.note: revise feedback, steering and decision notes); the byte backstop lives in validateNote. */
     note: TEXT_LIMITS.note,
 };
@@ -58,8 +52,6 @@ export function validateNote(raw) {
     }
     return { ok: true, note };
 }
-/** Option ids travel in URLs, CLI arguments, and CAS updates — they are identifiers, not prose. */
-const OPTION_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 /**
  * Multi-line prose may contain newlines and tabs; nothing anywhere in a
  * decision may contain the rest of C0/C1 — those are how text stops being
@@ -82,9 +74,14 @@ export function hasForbiddenControls(text) {
 export function hasDisguisedText(text) {
     return FORBIDDEN_MULTILINE.test(text) || FORBIDDEN_INVISIBLES.test(text);
 }
+/**
+ * A parked decision, read against its contract (src/contracts/decision.ts): fail closed, every problem at once, each
+ * naming its path (`options[1].reversible: required`) under the reason code the repair turn, incidents and tests have
+ * always used (`missing-reversible`). A decision written without `version` reads as it always did.
+ */
 export function parseDecision(raw) {
     if (Buffer.byteLength(raw, "utf8") > LIMITS.payload) {
-        return refuse("too-large", `the payload is over ${LIMITS.payload} bytes — one screen does not need that`);
+        return refuse("too-large", `payload: over ${LIMITS.payload} bytes — one screen does not need that`);
     }
     let parsed;
     try {
@@ -94,187 +91,109 @@ export function parseDecision(raw) {
         return refuse("not-json", `the payload is not JSON: ${error instanceof Error ? error.message : String(error)}`);
     }
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        return refuse("not-an-object", "the payload must be one JSON object");
+        return refuse("not-an-object", "payload: must be one JSON object");
     }
+    const read = readDecisionPayload(parsed);
+    const contract = read.ok ? [] : read.issues.map(decisionProblemOf);
     const body = parsed;
-    const problems = [];
-    // Urgency is required rather than defaulted: an agent that did not say
-    // whether the loop can continue has not composed a decision. Only
-    // 'blocking' exists in M3 — advisory needs a commit-and-complete lifecycle
-    // this park-before-commit path does not have.
-    if (body["urgency"] !== "blocking") {
-        problems.push({
-            reason: "bad-urgency",
-            message: `urgency must be the string "blocking" (got ${describe(body["urgency"])})`,
-        });
-    }
-    const recap = prose(body["recap"], "recap", LIMITS.recap, problems);
-    const question = prose(body["question"], "question", LIMITS.question, problems);
-    const options = parseOptions(body["options"], problems);
-    let recommendation = null;
-    if (typeof body["recommendation"] !== "string" || body["recommendation"] === "") {
-        problems.push({
-            reason: "missing-recommendation",
-            message: "recommendation is required and must be an option id — a decision without one is a shrug",
-        });
-    }
-    else if (options !== null && !options.some(option => option.id === body["recommendation"])) {
-        problems.push({
-            reason: "bad-recommendation",
-            message: `recommendation "${truncate(String(body["recommendation"]), 60)}" does not match any option id`,
-        });
-    }
-    else {
-        recommendation = body["recommendation"];
-    }
-    let assignee = null;
-    if (body["assignee"] !== undefined && body["assignee"] !== null) {
-        const line = singleLine(body["assignee"], "assignee", LIMITS.assignee, problems);
-        if (line !== null)
-            assignee = line;
-    }
-    let deadline = null;
-    if (body["deadline"] !== undefined && body["deadline"] !== null) {
-        const stamp = typeof body["deadline"] === "string" ? Date.parse(body["deadline"]) : NaN;
-        if (Number.isNaN(stamp)) {
-            problems.push({
-                reason: "bad-deadline",
-                message: `deadline must be an ISO 8601 timestamp (got ${describe(body["deadline"])})`,
-            });
-        }
-        else {
-            // Normalized so the store's lexicographic-comparison invariant holds.
-            deadline = new Date(stamp).toISOString();
-        }
-    }
-    if (problems.length > 0)
+    const problems = [...contract, ...decisionRuleProblems(body, contract)];
+    if (!read.ok || problems.length > 0)
         return { ok: false, problems };
+    const payload = read.value;
     return {
         ok: true,
         decision: {
-            urgency: "blocking",
-            recap: recap,
-            question: question,
-            options: options,
-            recommendation: recommendation,
-            assignee,
-            deadline,
+            urgency: payload.urgency,
+            recap: payload.recap.trim(),
+            question: payload.question.trim(),
+            options: payload.options.map(option => ({ id: option.id, label: option.label.trim(), consequence: option.consequence.trim(), reversible: option.reversible })),
+            recommendation: recommendedId(payload.recommendation),
+            assignee: payload.assignee === undefined || payload.assignee === null ? null : payload.assignee.trim(),
+            // Normalized so the store's lexicographic-comparison invariant holds.
+            deadline: payload.deadline === undefined || payload.deadline === null ? null : new Date(Date.parse(payload.deadline)).toISOString(),
         },
     };
 }
-function parseOptions(value, problems) {
-    if (!Array.isArray(value)) {
-        problems.push({ reason: "no-options", message: "options must be an array" });
-        return null;
+/** The reason code a contract issue has always had: `missing-recap`, `too-few-options`, `bad-option-id`. */
+function decisionReasonOf(issue) {
+    const at = issue.path;
+    const text = (field) => (issue.kind === "too-long" ? `${field}-too-long` : `missing-${field}`);
+    switch (at) {
+        case "urgency": return "bad-urgency";
+        case "options": return issue.kind === "too-few" ? "too-few-options" : issue.kind === "too-many" ? "too-many-options" : "no-options";
+        case "recommendation": return issue.kind === "too-long" ? "bad-recommendation" : "missing-recommendation";
+        case "deadline": return "bad-deadline";
     }
-    if (value.length < 2) {
-        // One option is not a decision, it is a notification wearing one's
-        // clothes — and the operator's real alternative ("do neither") deserves
-        // to be an option with a stated consequence, not an implied one.
-        problems.push({ reason: "too-few-options", message: "a decision needs at least 2 options" });
-        return null;
-    }
-    if (value.length > LIMITS.options) {
-        problems.push({
-            reason: "too-many-options",
-            message: `at most ${LIMITS.options} options fit on one screen (got ${value.length})`,
-        });
-        return null;
+    const option = /^options\[(\d+)\](?:\.(\w+))?$/.exec(at);
+    if (option !== null) {
+        const [, index, field] = option;
+        if (field === undefined)
+            return "bad-option";
+        if (field === "id")
+            return "bad-option-id";
+        if (field === "reversible")
+            return "missing-reversible";
+        return text(`option-${index}-${field}`);
     }
-    const options = [];
-    const seen = new Set();
-    let sound = true;
-    value.forEach((entry, index) => {
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            problems.push({ reason: "bad-option", message: `option ${index} must be an object` });
-            sound = false;
+    return text(at);
+}
+const decisionProblemOf = (issue) => ({ reason: decisionReasonOf(issue), message: issue.line });
+/** True when `problems` name `field` or anything under it. */
+const touched = (problems, field) => problems.some(problem => problem.message.startsWith(`${field}:`) || problem.message.startsWith(`${field}[`) || problem.message.startsWith(`${field}.`));
+/**
+ * The rules JSON Schema cannot state, in plain code with named errors: text not blank once trimmed and free of control
+ * characters (a label or assignee on one line), unique option ids, a recommendation naming one of them, and a deadline
+ * that is a timestamp. Fields the contract already refused are skipped, so every problem is reported once and all at
+ * once.
+ */
+function decisionRuleProblems(body, contract) {
+    const problems = [];
+    const text = (value, path, slug, oneLine) => {
+        if (typeof value !== "string" || touched(contract, path))
             return;
+        if (value.trim() === "")
+            problems.push({ reason: `missing-${slug}`, message: `${path}: must not be blank` });
+        else if ((oneLine ? FORBIDDEN_SINGLE_LINE : FORBIDDEN_MULTILINE).test(value)) {
+            problems.push({ reason: `${slug}-control-characters`, message: `${path}: ${oneLine ? "must be one line with no control characters" : "contains control characters — text only"}` });
         }
+    };
+    text(body["recap"], "recap", "recap", false);
+    text(body["question"], "question", "question", false);
+    const options = Array.isArray(body["options"]) ? body["options"] : [];
+    const seen = new Set();
+    options.forEach((entry, index) => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            return;
         const option = entry;
         const id = option["id"];
-        if (typeof id !== "string" || !OPTION_ID.test(id) || id.length > LIMITS.optionId) {
-            problems.push({
-                reason: "bad-option-id",
-                message: `option ${index} needs an id of 1-${LIMITS.optionId} letters, digits, - or _ (got ${describe(id)})`,
-            });
-            sound = false;
-        }
-        else if (seen.has(id)) {
-            problems.push({ reason: "duplicate-option-id", message: `option id "${id}" appears twice` });
-            sound = false;
-        }
-        else {
+        if (typeof id === "string" && !touched(contract, `options[${index}].id`)) {
+            if (seen.has(id))
+                problems.push({ reason: "duplicate-option-id", message: `options[${index}].id: "${id}" appears twice` });
             seen.add(id);
         }
-        const label = singleLine(option["label"], `option ${index} label`, LIMITS.label, problems);
-        const consequence = prose(option["consequence"], `option ${index} consequence`, LIMITS.consequence, problems);
-        // Absent is invalid, never defaulted: a defaulted reversibility is a
-        // guess wearing a schema, and reversible=false is the field the
-        // scheduler's refusal to auto-apply rests on.
-        if (typeof option["reversible"] !== "boolean") {
-            problems.push({
-                reason: "missing-reversible",
-                message: `option ${index} must say reversible: true or false — unstated is not reversible, it is unstated`,
-            });
-            sound = false;
-        }
-        if (label === null || consequence === null) {
-            sound = false;
-            return;
-        }
-        if (sound) {
-            options.push({
-                id: id,
-                label,
-                consequence,
-                reversible: option["reversible"],
-            });
-        }
+        text(option["label"], `options[${index}].label`, `option-${index}-label`, true);
+        text(option["consequence"], `options[${index}].consequence`, `option-${index}-consequence`, false);
     });
-    return sound && options.length === value.length ? options : null;
-}
-function prose(value, field, cap, problems) {
-    if (typeof value !== "string" || value.trim() === "") {
-        problems.push({ reason: `missing-${slug(field)}`, message: `${field} is required` });
-        return null;
+    const recommendation = body["recommendation"];
+    if (typeof recommendation === "string" && !touched(contract, "recommendation") && !touched(contract, "options") && !options.some(option => typeof option === "object" && option !== null && option["id"] === recommendedId(recommendation))) {
+        problems.push({ reason: "bad-recommendation", message: `recommendation: "${truncate(recommendation, 60)}" does not match any option id` });
     }
-    if (value.length > cap) {
-        problems.push({ reason: `${slug(field)}-too-long`, message: `${field} is over ${cap} characters` });
-        return null;
-    }
-    if (FORBIDDEN_MULTILINE.test(value)) {
-        problems.push({
-            reason: `${slug(field)}-control-characters`,
-            message: `${field} contains control characters — text only`,
-        });
-        return null;
+    if (body["assignee"] !== null)
+        text(body["assignee"], "assignee", "assignee", true);
+    const deadline = body["deadline"];
+    if (typeof deadline === "string" && !touched(contract, "deadline") && Number.isNaN(Date.parse(deadline))) {
+        problems.push({ reason: "bad-deadline", message: `deadline: must be an ISO 8601 timestamp (got ${describe(deadline)})` });
     }
-    return value.trim();
+    return problems;
 }
-function singleLine(value, field, cap, problems) {
-    if (typeof value !== "string" || value.trim() === "") {
-        problems.push({ reason: `missing-${slug(field)}`, message: `${field} is required` });
-        return null;
-    }
-    if (value.length > cap) {
-        problems.push({ reason: `${slug(field)}-too-long`, message: `${field} is over ${cap} characters` });
-        return null;
-    }
-    if (FORBIDDEN_SINGLE_LINE.test(value)) {
-        problems.push({
-            reason: `${slug(field)}-control-characters`,
-            message: `${field} must be one line with no control characters`,
-        });
-        return null;
-    }
-    return value.trim();
+/** The option id a recommendation names: a bare id, or the id before the first ":" in "<id>: why". */
+function recommendedId(recommendation) {
+    const colon = recommendation.indexOf(":");
+    return (colon === -1 ? recommendation : recommendation.slice(0, colon)).trim();
 }
 function refuse(reason, message) {
     return { ok: false, problems: [{ reason, message }] };
 }
-function slug(field) {
-    return field.replace(/[^a-z0-9]+/gi, "-").toLowerCase();
-}
 function describe(value) {
     if (value === undefined)
         return "nothing";