toolroll 0.9.40 → 0.9.42

package/dist/surface.d.ts

@@ -1,57 +1,6 @@
-/**
- * The declared command guide (arc 5): the agent-facing surface as data,
- * dumped by `contract --commands`. This is DOCUMENTATION with a stable
- * shape, not authority — legacy verbs do not execute from it,
- * and the runtime envelope remains the truth. Its honest limits ride the
- * envelope itself as SURFACE_NOTES, because a source comment is invisible
- * to consumers (arc-5 review, finding 1).
- *
- * What the tests DO hold to the code: every root here is a routed verb
- * and every routed verb appears here; every declared flag lives in the
- * parser's global vocabulary with the declared arity; the subcommand
- * inventories for task/publish/config/approver/routine/contest match the
- * exported action lists their dispatchers consult; keyed mutations
- * declare --key; notableReasons come from DOCUMENTED_REASONS. What they
- * CANNOT prove — that a given flag is read by a given handler — is why
- * SURFACE_NOTES.flags says "intended".
- */
-import { type SessionDescriptor } from './session-contract.js';
-export type CommandFlag = {
-    readonly name: string;
-    readonly takesValue: boolean;
-    readonly meaning: string;
-};
-export type CommandRow = {
-    /** What you type after `toolroll` (subcommands included). */
-    readonly invocation: string;
-    /** The `command` field the envelope answers with, where it differs
-     * from the invocation (the no-verb report answers as "scan"). */
-    readonly envelopeCommand?: string;
-    readonly synopsis: string;
-    /** Who this act belongs to. "operator" rows are ceremonies or
-     * infrastructure: an agent must not invoke them even when credentials
-     * are within reach — the credential IS the person. The operator() helper
-     * omits flag detail on purpose; an explicit row may document flags when
-     * its command contract requires them. A schema is never permission. */
-    readonly audience: "agent" | "operator";
-    readonly agentMayInvoke: boolean;
-    /** Truthful retry semantics, not a boolean:
-     *  keyed — takes --key; same key returns the first answer.
-     *  identity-idempotent — repeating it converges (same lease, same
-     *    path, same managed file); no key needed.
-     *  unkeyed — a mutation without replay protection: do not blind-retry.
-     *  none — a read. */
-    readonly mutation: "keyed" | "identity-idempotent" | "unkeyed" | "none";
-    readonly positionals?: readonly {
-        name: string;
-        required: boolean;
-        meaning: string;
-    }[];
-    readonly flags?: readonly CommandFlag[];
-    readonly notableReasons?: readonly string[];
-    /** Session schemas are executable input contracts, not a grant of authority. */
-    readonly inputSchema?: SessionDescriptor['inputSchema'];
-};
+import { type CommandFlag, type CommandRow } from './contracts/cli.js';
+/** A guide row and its flags are derived from their schemas in src/contracts/cli.ts. */
+export type { CommandFlag, CommandRow };
 /** The guide's limits, stated machine-readably in every dump. */
 export declare const SURFACE_NOTES: {
     readonly authority: "documentation is not permission; session descriptors also drive parser and request validation; legacy entries remain advisory";
@@ -60,4 +9,7 @@ export declare const SURFACE_NOTES: {
     readonly database: "local database commands wait up to 15 seconds for another writer; an exhausted wait returns database-busy and names the selected file";
 };
 export declare const SURFACE_SCHEMA_VERSION = 1;
+/** Every declared command, in guide order, paired with the schema of its `--json` answer (src/contracts/cli.ts). */
+export declare const COMMAND_ENTRIES: readonly import("./contracts/cli.js").CommandEntry[];
+/** The guide `contract --commands` dumps: each declared command's row, projected from COMMAND_ENTRIES. */
 export declare const COMMAND_GUIDE: readonly CommandRow[];

package/dist/surface.js

@@ -21,6 +21,7 @@ import { FLOWS_DESCRIPTORS } from "./flows-cli.js";
  */
 import { SESSION_DESCRIPTORS } from './session-contract.js';
 import { sessionCliFlags } from './session-cli.js';
+import { commandEntries } from './contracts/cli.js';
 /** The guide's limits, stated machine-readably in every dump. */
 export const SURFACE_NOTES = {
     authority: "documentation is not permission; session descriptors also drive parser and request validation; legacy entries remain advisory",
@@ -47,7 +48,7 @@ const operatorRead = (invocation, synopsis) => ({
     agentMayInvoke: false,
     mutation: "none",
 });
-export const COMMAND_GUIDE = [
+const GUIDE_ROWS = [
     // ---- reports (reads) ----
     {
         invocation: "",
@@ -412,3 +413,7 @@ export const COMMAND_GUIDE = [
     operator("onboard", "add this repository, report signed-in agents, install or --remove the operator skill (--yes), offer the starter flows (--starter <ids>), and print the handoff"),
     operator("daemon", "install the loop under the OS service manager"),
 ];
+/** Every declared command, in guide order, paired with the schema of its `--json` answer (src/contracts/cli.ts). */
+export const COMMAND_ENTRIES = commandEntries(GUIDE_ROWS);
+/** The guide `contract --commands` dumps: each declared command's row, projected from COMMAND_ENTRIES. */
+export const COMMAND_GUIDE = COMMAND_ENTRIES.map(entry => entry.guide);

package/dist/toolroll-update.d.ts

@@ -1,14 +1,14 @@
 import type { DatabaseSync } from "node:sqlite";
-import { type LingeringRun, type UpdateWaiting } from "./desktop-update.js";
-import { type ReleasedCodingOwner } from "./coding-update.js";
+import { type UpdateWaiting } from "./desktop-update.js";
 import { type SupervisorRunner } from "./daemon.js";
+import { RUNTIME_PHASES, type RuntimeUpdateJournalRecord } from "./contracts/update-journal.js";
 export declare const PROVENANCE_REPOSITORY = "https://github.com/ap9000/toolroll";
 export declare const PROVENANCE_WORKFLOW = ".github/workflows/publish.yml";
 export declare const PROVENANCE_ISSUER = "https://token.actions.githubusercontent.com";
 /** The steps a person sees, in order. */
 export declare const UPDATE_STEPS: readonly ["verifying", "draining", "backing-up", "rehearsing", "switching", "restarting", "health"];
 export type UpdateStep = typeof UPDATE_STEPS[number];
-export type RuntimePhase = "scheduled" | UpdateStep | "complete" | "rolling-back" | "restored" | "refused" | "cancelled" | "needs-attention";
+export type RuntimePhase = typeof RUNTIME_PHASES[number];
 export declare const STEP_WORDS: Record<UpdateStep, string>;
 export type When = "now" | "when-idle" | "at";
 export type RuntimeRef = {
@@ -19,100 +19,9 @@ export type RuntimeRef = {
 export declare const KEEP_RUNTIMES = 2;
 /** The one-off launchd job the console starts the updater as. */
 export declare const UPDATE_JOB_LABEL = "com.toolroll.update";
-export type RuntimeUpdateJournal = {
-    version: 1;
-    id: string;
-    kind: "update" | "rollback";
-    stateDir: string;
-    databaseFile: string;
-    stageDir: string;
-    from: RuntimeRef;
-    to: RuntimeRef;
-    when: When;
-    at: string | null;
-    actor: string;
-    phase: RuntimePhase;
-    detail: string;
-    error?: string;
-    steps: {
-        phase: RuntimePhase;
-        at: string;
-    }[];
-    startedAt: string;
-    updatedAt: string;
-    finishedAt?: string;
-    package?: {
-        sha512: string;
-        repository: string;
-        workflow: string;
-    };
-    notes?: string[];
-    /** This run's own verified copies of the live database and coding catalog: what a failure restores. */
-    backupPath?: string;
-    backupHash?: string;
-    codingBackupPath?: string;
-    codingBackupHash?: string;
-    /** A rollback installs the update's earlier backups (checked against their recorded hashes). */
-    restoreFrom?: {
-        path: string;
-        hash: string;
-        updateId: string;
-        codingPath?: string;
-        codingHash?: string;
-    };
-    rehearsal?: {
-        tables: number;
-        rows: number;
-    };
-    /** The background service, recorded before it is stopped: its definition and the processes that must be gone. */
-    service?: {
-        unit: string;
-        pids: number[];
-    };
-    /** Each repo's watch daemon that runs this version, recorded the same way: switched with the service, and stopped and
-     * restarted with it only when launchd had it loaded before the update (`loaded` absent: 0.8.1 stopped every one). */
-    watches?: {
-        unit: string;
-        pids: number[];
-        loaded?: boolean;
-    }[];
-    /** Recorded before each change so a resumed or failed run knows what to put back. */
-    switched?: {
-        links: {
-            path: string;
-            previous: string;
-        }[];
-        unit: {
-            path: string;
-            saved: string;
-        } | null;
-        watches?: {
-            path: string;
-            saved: string;
-        }[];
-        databaseRestored?: boolean;
-    };
-    /** What the live database held when a failed run restored its backup: nothing written is lost. The newest of `kept`. */
-    keptAside?: string;
-    /** The live database could not be read, so it was moved aside whole rather than copied. */
-    keptAsideUnreadable?: boolean;
-    /** Every copy kept aside, oldest first: a retried restore adds one and never drops the pointer to an earlier one. */
-    kept?: {
-        path: string;
-        unreadable: boolean;
-    }[];
-    /** The restore put the backup back: a retried restore never puts it back again (what was written since belongs to
-     * the restored version and would be lost), and it keeps a fresh copy aside before every attempt until then. */
-    restoredDatabase?: boolean;
-    /** A stale coding owner record this run released after proving its processes gone. */
-    codingOwnerReleased?: ReleasedCodingOwner;
-    seen?: boolean;
-    /** The finished run the update is waiting on (or stopped waiting on): what is in the way and the command that
-     * clears it. Absent while it waits on ordinary running work. */
-    waiting?: LingeringRun & {
-        since: string;
-    };
-};
+/** The update's journal (`toolroll-update.json`, `.last.json` and the stage's `update.json`):
+ * src/contracts/update-journal.ts. */
+export type RuntimeUpdateJournal = RuntimeUpdateJournalRecord;
 export type PackageRelease = {
     version: string;
     tarball: string;
@@ -164,11 +73,11 @@ export type UpdateSystem = {
 };
 export type UpdateOutcome = {
     ok: boolean;
-    phase: RuntimePhase;
+    phase: RuntimeUpdateJournal["phase"];
     message: string;
     journal: RuntimeUpdateJournal | null;
 };
-export declare const runtimeUpdateTerminal: (phase: RuntimePhase) => boolean;
+export declare const runtimeUpdateTerminal: (phase: string) => boolean;
 /** How long a launched or resuming updater is expected to take to start and hold the lock. */
 export declare const UPDATER_START_MS: number;
 export declare function readRuntimeUpdate(stateDir: string, file?: string): RuntimeUpdateJournal | null;

package/dist/toolroll-update.js

@@ -37,6 +37,7 @@ import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurab
 import { NAME } from "./names.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
+import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -48,7 +49,7 @@ export const PROVENANCE_ISSUER = "https://token.actions.githubusercontent.com";
 /** How long a watch's `toolroll up` may take to exit once launchd stops it (controller-supervisor's shutdown). */
 const UP_EXIT_MS = 45_000;
 /** The steps a person sees, in order. */
-export const UPDATE_STEPS = ["verifying", "draining", "backing-up", "rehearsing", "switching", "restarting", "health"];
+export const UPDATE_STEPS = RUNTIME_UPDATE_STEPS;
 export const STEP_WORDS = {
     verifying: "Verify the package", draining: "Let running work finish", "backing-up": "Stop and back up",
     rehearsing: "Rehearse the migration", switching: "Switch to the new version", restarting: "Restart", health: "Health check",
@@ -58,7 +59,7 @@ export const KEEP_RUNTIMES = 2;
 /** The one-off launchd job the console starts the updater as. */
 export const UPDATE_JOB_LABEL = "com.toolroll.update";
 const TERMINAL = ["complete", "restored", "refused", "cancelled"];
-export const runtimeUpdateTerminal = (phase) => TERMINAL.includes(phase);
+export const runtimeUpdateTerminal = (phase) => TERMINAL.some(known => known === phase);
 const journalFile = (stateDir) => join(stateDir, "toolroll-update.json");
 /** The last completed update, kept apart from the journal: what `--rollback` returns from. */
 const lastUpdateFile = (stateDir) => join(stateDir, "toolroll-update.last.json");
@@ -73,8 +74,10 @@ function markStarting(j, state, now) {
 }
 function updaterStarting(j, now) {
     try {
-        const mark = JSON.parse(readFileSync(startingFile(j), "utf8"));
-        const age = now.getTime() - Date.parse(mark.at ?? "");
+        const mark = updaterStartingOf(JSON.parse(readFileSync(startingFile(j), "utf8")));
+        if (mark === null)
+            return false;
+        const age = now.getTime() - mark.at;
         return mark.id === j.id && age >= 0 && age < UPDATER_START_MS;
     }
     catch {
@@ -93,14 +96,17 @@ export function readRuntimeUpdate(stateDir, file = journalFile(stateDir)) {
     const stat = lstatSync(file);
     if (!stat.isFile() || stat.isSymbolicLink())
         throw Error("The saved update record is not a regular file. Nothing was changed.");
-    const j = JSON.parse(readFileSync(file, "utf8"));
+    const read = readRuntimeUpdateJournal(JSON.parse(readFileSync(file, "utf8")));
+    if (!read.ok)
+        throw Error(`The saved update record is invalid. Preserve it and its backups; nothing was changed. (${read.issues.map(issue => issue.line).join("; ")})`);
+    const j = read.value;
     const real = (path) => { try {
         return realpathSync(path);
     }
     catch {
         return resolve(path);
     } };
-    if (j.version !== 1 || !/^[a-f0-9-]{36}$/.test(j.id) || typeof j.stateDir !== "string" || real(j.stateDir) !== real(stateDir) || !isAbsolute(j.stageDir ?? "") || real(dirname(j.stageDir)) !== real(join(stateDir, "staged-upgrades")))
+    if (!/^[a-f0-9-]{36}$/.test(j.id) || typeof j.stateDir !== "string" || real(j.stateDir) !== real(stateDir) || !isAbsolute(j.stageDir ?? "") || real(dirname(j.stageDir)) !== real(join(stateDir, "staged-upgrades")))
         throw Error("The saved update record is invalid. Preserve it and its backups; nothing was changed.");
     return j;
 }
@@ -121,13 +127,16 @@ function keepCompletedUpdate(stateDir) {
         return;
     durableJson(lastUpdateFile(stateDir), saved);
 }
+/** A null phase saves progress without changing the saved phase, including one a newer release wrote. */
 function save(j, phase, detail, now) {
-    if (j.phase !== phase)
-        j.steps.push({ phase, at: now.toISOString() });
-    j.phase = phase;
+    if (phase !== null) {
+        if (j.phase !== phase)
+            j.steps.push({ phase, at: now.toISOString() });
+        j.phase = phase;
+    }
     j.detail = detail;
     j.updatedAt = now.toISOString();
-    if (runtimeUpdateTerminal(phase))
+    if (runtimeUpdateTerminal(j.phase))
         j.finishedAt = now.toISOString();
     durableJson(join(j.stageDir, "update.json"), j);
     durableJson(journalFile(j.stateDir), j);
@@ -518,7 +527,7 @@ async function stopServices(j, system, main, watches) {
     }
     if (watching.length > 0)
         j.watches = watching;
-    save(j, j.phase, j.detail, system.now());
+    save(j, null, j.detail, system.now());
     for (const unit of [main, ...loadedWatches(j, watches)])
         if (unit)
             await system.stopService(unit);
@@ -781,7 +790,7 @@ export function requestRuntimeUpdateCancel(stateDir, now = new Date(), seams = {
     if (!j || runtimeUpdateTerminal(j.phase))
         return "No update is in progress.";
     const tooLate = (at) => `The update to ${at.to.version} is past the point it can be cancelled (${at.phase}); it will finish or restore on its own.`;
-    if (!CANCELLABLE.includes(j.phase))
+    if (!CANCELLABLE.some(phase => phase === j.phase))
         return tooLate(j);
     // No updater is running to see the request: cancel here, so the admission pause does not outlive it.
     const lock = sqliteLock(join(j.stageDir, "worker.sqlite"));
@@ -797,7 +806,7 @@ export function requestRuntimeUpdateCancel(stateDir, now = new Date(), seams = {
             return "No update is in progress.";
         if (held.id !== j.id)
             return "A different update was saved while cancelling. Nothing was cancelled.";
-        if (!CANCELLABLE.includes(held.phase))
+        if (!CANCELLABLE.some(phase => phase === held.phase))
             return tooLate(held);
         durableJson(cancelFile(held), { id: held.id, action: "cancel" });
         try {
@@ -840,7 +849,7 @@ async function driveRuntimeUpdate(j, system) {
     }
     // The lock now says an updater is here; the starting mark has done its job.
     rmSync(startingFile(j), { force: true });
-    const at = (phase) => UPDATE_STEPS.indexOf(phase);
+    const at = (phase) => UPDATE_STEPS.findIndex(step => step === phase);
     const step = (phase, detail) => { save(j, phase, detail, system.now()); system.checkpoint?.(phase); };
     const noun = j.kind === "update" ? "update" : "rollback";
     const verb = j.kind === "update" ? `${j.from.version} → ${j.to.version}` : `${j.from.version} → ${j.to.version} (back)`;
@@ -1137,12 +1146,13 @@ async function drain(j, system) {
  * the rollback-* records are not this updater's to remove. */
 export function pruneRuntimes(stateDir, keep) {
     const root = join(stateDir, "staged-upgrades");
+    // A partial or older stage file still says when it started; one that is not JSON (or is null) falls back to the mtime.
     const started = (dir) => { try {
-        return String(JSON.parse(readFileSync(join(dir, "update.json"), "utf8")).startedAt ?? "");
+        const at = stagedStartedAt(JSON.parse(readFileSync(join(dir, "update.json"), "utf8")));
+        if (at !== null)
+            return at;
     }
-    catch {
-        return statSync(dir).mtime.toISOString();
-    } };
+    catch { /* below */ } return statSync(dir).mtime.toISOString(); };
     const releases = readdirSync(root, { withFileTypes: true }).filter(entry => entry.isDirectory() && entry.name.startsWith("release-"))
         .map(entry => join(root, entry.name)).sort((a, b) => started(b).localeCompare(started(a)));
     const kept = new Set(releases.filter(dir => keep.some(dist => dist !== "" && dist.startsWith(dir + sep))));

package/dist/verification-evidence.js

@@ -8,6 +8,8 @@ import { adjudicate } from "./proof.js";
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { readVerifiedArtifact, storeEvidence, scanForSecrets, redactSecretLines } from "./evidence.js";
 import { readVerificationReceipt } from "./contracts/verification-receipt.js";
+import { LEGACY_GATE_SOURCE, readVerificationView } from "./contracts/verification-view.js";
+import { readCandidateEndpoints, savedInventoryPaths } from "./contracts/diff-stat.js";
 import { liveQuickCommand, quickVerifyKey, runCheckLevel } from "./check-levels.js";
 export const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
 export const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
@@ -97,7 +99,10 @@ export function verificationEvidence(store, root, runId) {
                 const original = verificationEvidence(store, root, reused.run);
                 if (!original.ok || !original.bytes || original.digest !== reused.digest)
                     return fail("The original passing gate no longer verifies.");
-                const previous = JSON.parse(original.bytes);
+                const previousRead = readVerificationView(original.bytes);
+                if (!previousRead.ok)
+                    return fail("The original passing gate no longer verifies.");
+                const previous = previousRead.value;
                 const originalLog = store.getArtifact(previous.log.artifactId);
                 if (previous.head !== source.headRevision || !("exitCode" in previous.result) || previous.result.exitCode !== 0 || JSON.stringify(previous.command) !== JSON.stringify(command) ||
                     JSON.stringify(previous.result) !== JSON.stringify(receipt.result) || originalLog?.sha256 !== log.sha256 ||
@@ -123,13 +128,17 @@ export function verificationEvidence(store, root, runId) {
         const readStat = readVerifiedArtifact(root, stat[0]);
         if (!readStat.ok)
             return fail("Legacy candidate inventory no longer verifies.");
-        let endpoints;
+        let inventory;
         try {
-            endpoints = JSON.parse(readStat.content.toString("utf8"));
+            inventory = JSON.parse(readStat.content.toString("utf8"));
         }
         catch {
             return fail("Legacy candidate inventory is unreadable.");
         }
+        const endpointsRead = readCandidateEndpoints(inventory);
+        if (!endpointsRead.ok)
+            return fail("Legacy verification candidate endpoints do not match.");
+        const endpoints = endpointsRead.value;
         if (!source.headRevision || endpoints.head !== source.headRevision || endpoints.base !== source.baseRevision || endpoints.filesTruncated !== false)
             return fail("Legacy verification candidate endpoints do not match.");
         const text = read.content.toString("utf8");
@@ -139,7 +148,8 @@ export function verificationEvidence(store, root, runId) {
             return fail("The original log lacks an unambiguous machine gate receipt; historical output was not reconstructed.");
         if (verified && exitCode !== 0)
             return fail("The passing machine verdict disagrees with the original failed check.");
-        receipt = { version: 1, source: "legacy machine log header", run: runId, head: source.headRevision, base: source.baseRevision, scopeDigest: source.scopeDigest, command, result: { configured: true, ran: true, exitCode }, log: binding(log), candidate: binding(stat[0]) };
+        const view = { version: 1, source: LEGACY_GATE_SOURCE, run: runId, head: source.headRevision, base: source.baseRevision, scopeDigest: source.scopeDigest, command, result: { configured: true, ran: true, exitCode }, log: binding(log), candidate: binding(stat[0]) };
+        receipt = view;
     }
     // The view preserves shortened/redacted status and does not claim the omitted
     // output exists. Its fingerprint is re-proved before every turn and ingestion.
@@ -173,8 +183,10 @@ export function failedVerificationEvidence(store, root, runId) {
         return { kind: "unavailable", problem: verified.problem };
     if (verified.bytes === null)
         return { kind: "none" };
-    const receipt = JSON.parse(verified.bytes);
-    const result = receipt.result;
+    const view = readVerificationView(verified.bytes);
+    if (!view.ok)
+        return { kind: "unavailable", problem: "The verification receipt cannot be read." };
+    const receipt = view.value, result = receipt.result;
     if (!result.configured || (result.ran ? result.exitCode === 0 :
         result.failure !== "timed-out" && result.failure !== "retry-timed-out"))
         return { kind: "none" };
@@ -223,15 +235,15 @@ export function assessmentFromSavedEvidence(store, root, runId) {
     if (!gate.ok || gate.bytes === null)
         return null;
     try {
-        const inventory = JSON.parse(stat), receipt = JSON.parse(gate.bytes);
+        const view = readVerificationView(gate.bytes);
         const base = source.branch ? store.firstBuilderBase(source.taskRef, source.branch) ?? source.baseRevision : source.baseRevision;
-        if (inventory.schema !== 1 || inventory.head !== source.headRevision || inventory.base !== base || inventory.filesTruncated !== false ||
-            !Array.isArray(inventory.files) || inventory.fileCount !== inventory.files.length || !inventory.files.every((one) => typeof one?.path === "string") ||
-            new Set(inventory.files.map((one) => one.path)).size !== inventory.files.length)
+        const paths = savedInventoryPaths(stat, source.headRevision, base);
+        if (!view.ok || paths === null)
             return null;
+        const receipt = view.value;
         return adjudicate({ directAssessment: true, proofArtifactPresent: false, proofParse: null,
             handoffPresent: true, terminalDiffPresent: true, terminalDiffCaptureStatus: "ok",
-            diffStat: { captured: true, truncated: false, paths: new Set(inventory.files.map((one) => one.path)) },
+            diffStat: { captured: true, truncated: false, paths },
             verifyCommand: receipt.result, verificationCommand: receipt.command.command, screenshots: [],
             approvedCriteria: scope.acceptance, reviewContext: parsedContext.inventory.coverage });
     }
@@ -255,7 +267,10 @@ export function reuseObservationVerification(store, root, runId, now) {
     const original = verificationEvidence(store, root, brief.sourceRun);
     if (!original.ok || !original.bytes || original.digest !== brief.gateDigest)
         throw Error("The original passing gate is unavailable or changed.");
-    const receipt = JSON.parse(original.bytes), log = store.getArtifact(receipt.log.artifactId);
+    const view = readVerificationView(original.bytes);
+    if (!view.ok)
+        throw Error("The original passing gate is unavailable or changed.");
+    const receipt = view.value, log = store.getArtifact(receipt.log.artifactId);
     if (!log || receipt.head !== brief.head || !("ran" in receipt.result) || receipt.result.ran !== true || receipt.result.exitCode !== 0)
         throw Error("The source gate did not pass this candidate.");
     const read = readVerifiedArtifact(root, log);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.40",
+  "version": "0.9.42",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"