trustdex 0.9.0 → 0.10.0

package/docs/THREAT_MODEL.md

@@ -26,6 +26,8 @@ TrustDex addresses one narrow question:
 - precedence changes across explicitly supplied Claude or Codex settings sources
 - automatic MCP tool grants that no longer match the server's policy/provenance result
 - wildcard, unmatched, or ambiguous grants that hide the effective tool boundary
+- explicitly reported runtime inventories that expose blocked, review-required, or unconfigured MCP servers
+- effective runtime inventories expanding by server visibility or tool count
 
 ## Trust boundaries
 
@@ -54,6 +56,8 @@ TrustDex does **not** treat a familiar project name, star count, package name, o
 - authenticating the author of an unsigned permission posture snapshot
 - proving that a binding snapshot reflects the files actually loaded by a running agent
 - intercepting or enforcing individual MCP tool calls at runtime
+- authenticating an inventory producer, proving inventory completeness, or preventing a compromised adapter from lying
+- discovering live Claude/Codex sessions or reading their private state automatically
 
 ## Important failure mode
 

package/examples/adversarial/README.ko.md

@@ -11,7 +11,7 @@
 - `expected.json`은 필수 결정과 최소 신호를 기록합니다.
 - `drift-before.json`과 `drift-after.json`은 검토된 패키지에 비밀 정보를 포함하는 환경 키가 추가되는 상황을 모델링합니다.
 - [`permissions/`](permissions/README.ko.md)는 값이 제거된 Claude/Codex 권한 상태 드리프트를 다룹니다.
-- [`bindings/`](bindings/README.ko.md)는 MCP 출처와 자동 권한의 연결을 다룹니다.
+- [`bindings/`](bindings/README.ko.md)는 MCP 출처와 자동 권한 연결 및 명시적 런타임 인벤토리 대조를 다룹니다.
 
 모든 패키지 이름은 가상이며, 모든 원격 엔드포인트는 예약된 `.invalid` 최상위 도메인을 사용하고, 자격 증명으로 보이는 모든 값은 자리표시자입니다. 이를 실제 값으로 바꾸지 마세요. TrustDex는 이 파일을 읽지만 나열된 명령을 실행하거나 나열된 엔드포인트에 연결하지 않습니다.
 

package/examples/adversarial/README.md

@@ -11,7 +11,7 @@ These files provide a reproducible defensive test of TrustDex's policy boundary.
 - `expected.json` records the required decisions and minimum signals.
 - `drift-before.json` and `drift-after.json` model a reviewed package gaining a secret-bearing environment key.
 - [`permissions/`](permissions/README.md) covers value-free Claude/Codex permission posture drift.
-- [`bindings/`](bindings/README.md) covers MCP provenance-to-automatic-grant bindings.
+- [`bindings/`](bindings/README.md) covers MCP provenance-to-automatic-grant bindings and explicit runtime inventory reconciliation.
 
 All package names are fictional, all remote endpoints use the reserved `.invalid` top-level domain, and all apparent credentials are placeholders. Do not replace them with real values. TrustDex reads these files but never executes the listed commands or contacts the listed endpoints.
 

package/examples/adversarial/bindings/README.ko.md

@@ -13,6 +13,10 @@ node ../../../bin/trustdex.mjs snapshot-claude-bindings ./claude.mcp.json \
 node ../../../bin/trustdex.mjs snapshot-codex-bindings ./codex.toml \
   --trust-store ./trust-store.json \
   --out ./codex.bindings.json
+
+node ../../../bin/trustdex.mjs snapshot-runtime-tools \
+  ./claude.bindings.json ./runtime-after.json \
+  --out ./runtime.evidence.json
 ```
 
 검토된 Claude 서버의 범위 제한 승인은 `ALLOW` 결과와 결합됩니다. 출처를 알 수
@@ -22,3 +26,7 @@ node ../../../bin/trustdex.mjs snapshot-codex-bindings ./codex.toml \
 
 생성된 보고서는 엔드포인트 경로, 권한 지정자, 도구 이름 및 마커 값을 의도적으로
 제외합니다. `expected.json`은 안정적인 구조적 결과만 기록합니다.
+런타임 인벤토리는 명시적으로 제공되는 값 없는 어댑터 출력입니다. 도구 이름 대신
+서버 이름과 도구 개수만 포함합니다. `runtime-after.json`은 차단된 설정 서버와 예상
+밖 서버가 노출되는 상황을 모델링합니다. TrustDex는 런타임 상태를 자동으로 찾거나
+인벤토리 생성자를 인증하지 않습니다.

package/examples/adversarial/bindings/README.md

@@ -14,6 +14,10 @@ node ../../../bin/trustdex.mjs snapshot-claude-bindings ./claude.mcp.json \
 node ../../../bin/trustdex.mjs snapshot-codex-bindings ./codex.toml \
   --trust-store ./trust-store.json \
   --out ./codex.bindings.json
+
+node ../../../bin/trustdex.mjs snapshot-runtime-tools \
+  ./claude.bindings.json ./runtime-after.json \
+  --out ./runtime.evidence.json
 ```
 
 The reviewed Claude server has a scoped grant bound to an `ALLOW` result. Its
@@ -23,3 +27,7 @@ review because `default_tools_approval_mode = "approve"` grants every tool.
 
 Generated reports intentionally omit endpoint paths, permission specifiers, tool
 names, and marker values. `expected.json` records only stable structural outcomes.
+The runtime inventories are explicit, value-free adapter outputs: they contain server
+names and tool counts, not tool names. `runtime-after.json` models a blocked configured
+server and an unexpected server becoming visible. TrustDex does not discover runtime
+state or authenticate the inventory producer.

package/examples/adversarial/bindings/expected.json

@@ -11,5 +11,17 @@
     "automaticGrantCount": 2,
     "reviewCount": 1,
     "blockedCount": 1
+  },
+  "runtimeBefore": {
+    "status": "restricted",
+    "observedServerCount": 1,
+    "matchedCount": 1,
+    "notObservedCount": 1
+  },
+  "runtimeAfter": {
+    "status": "block",
+    "observedServerCount": 3,
+    "blockedCount": 1,
+    "unexpectedCount": 1
   }
 }

package/examples/adversarial/bindings/runtime-after.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 1,
+  "kind": "agent-runtime-tool-inventory",
+  "runtime": "claude",
+  "capturedAt": "2026-10-24T00:05:00.000Z",
+  "captureMethod": "runtime-adapter",
+  "servers": [
+    {
+      "name": "reviewed",
+      "toolCount": 2
+    },
+    {
+      "name": "unknown",
+      "toolCount": 1
+    },
+    {
+      "name": "unexpected",
+      "toolCount": 1
+    }
+  ]
+}

package/examples/adversarial/bindings/runtime-before.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "kind": "agent-runtime-tool-inventory",
+  "runtime": "claude",
+  "capturedAt": "2026-10-24T00:00:00.000Z",
+  "captureMethod": "runtime-adapter",
+  "servers": [
+    {
+      "name": "reviewed",
+      "toolCount": 2
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustdex",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "A local-first trust, provenance, and review gate for AI agent tools, MCP servers, skills, and plugins.",
   "type": "module",
   "bin": {
@@ -8,8 +8,8 @@
   },
   "scripts": {
     "test": "node --test",
-    "test:research": "node --test test/research-fixtures.test.mjs test/claude-settings.test.mjs test/codex-settings.test.mjs test/posture.test.mjs test/settings-stack.test.mjs test/bindings.test.mjs",
-    "check": "node --check bin/trustdex.mjs && node --check src/bindings.mjs && node --check src/canonical.mjs && node --check src/claude-config.mjs && node --check src/claude-settings.mjs && node --check src/codex-config.mjs && node --check src/codex-settings.mjs && node --check src/extensions.mjs && node --check src/gate.mjs && node --check src/inspect.mjs && node --check src/policy.mjs && node --check src/policy-packs.mjs && node --check src/posture.mjs && node --check src/provenance.mjs && node --check src/provenance-online.mjs && node --check src/review.mjs && node --check src/snapshot.mjs && node --check src/trust-record.mjs",
+    "test:research": "node --test test/research-fixtures.test.mjs test/claude-settings.test.mjs test/codex-settings.test.mjs test/posture.test.mjs test/settings-stack.test.mjs test/bindings.test.mjs test/runtime-evidence.test.mjs",
+    "check": "node --check bin/trustdex.mjs && node --check src/bindings.mjs && node --check src/runtime-evidence.mjs && node --check src/canonical.mjs && node --check src/claude-config.mjs && node --check src/claude-settings.mjs && node --check src/codex-config.mjs && node --check src/codex-settings.mjs && node --check src/extensions.mjs && node --check src/gate.mjs && node --check src/inspect.mjs && node --check src/policy.mjs && node --check src/policy-packs.mjs && node --check src/posture.mjs && node --check src/provenance.mjs && node --check src/provenance-online.mjs && node --check src/review.mjs && node --check src/snapshot.mjs && node --check src/trust-record.mjs",
     "prepublishOnly": "npm test && npm run check"
   },
   "engines": {

package/schemas/effective-runtime-tools-diff-v1.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/effective-runtime-tools-diff-v1.schema.json",
+  "title": "TrustDex effective runtime tool boundary diff v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "runtime", "status", "baselineDigest", "currentDigest", "summary", "changes"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "runtime": { "enum": ["claude", "codex"] },
+    "status": { "enum": ["unchanged", "restricted", "needs-review"] },
+    "baselineDigest": { "$ref": "#/$defs/digest" },
+    "currentDigest": { "$ref": "#/$defs/digest" },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["expansions", "restrictions", "reviews"],
+      "properties": {
+        "expansions": { "$ref": "#/$defs/count" },
+        "restrictions": { "$ref": "#/$defs/count" },
+        "reviews": { "$ref": "#/$defs/count" }
+      }
+    },
+    "changes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["impact", "type", "name", "field", "before", "after"],
+        "properties": {
+          "impact": { "enum": ["expansion", "restriction", "review"] },
+          "type": {
+            "enum": [
+              "bindings-changed", "capture-method-changed", "server-added", "server-removed",
+              "observation-changed", "tool-count-changed", "binding-state-changed", "server-status-changed"
+            ]
+          },
+          "name": { "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] },
+          "field": { "type": "string", "minLength": 1 },
+          "before": {},
+          "after": {}
+        }
+      }
+    }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "count": { "type": "integer", "minimum": 0 }
+  }
+}

package/schemas/effective-runtime-tools-v1.schema.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/effective-runtime-tools-v1.schema.json",
+  "title": "TrustDex effective runtime tool boundary v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion", "kind", "createdAt", "runtime", "capturedAt", "captureMethod",
+    "bindingDigest", "inventoryDigest", "status", "summary", "servers", "digest"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "agent-effective-tool-boundary" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "runtime": { "enum": ["claude", "codex"] },
+    "capturedAt": { "type": "string", "format": "date-time" },
+    "captureMethod": { "enum": ["runtime-export", "runtime-adapter"] },
+    "bindingDigest": { "$ref": "#/$defs/digest" },
+    "inventoryDigest": { "$ref": "#/$defs/digest" },
+    "status": { "enum": ["matched", "restricted", "needs-review", "block"] },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "configuredServerCount", "observedServerCount", "observedToolCount", "matchedCount",
+        "reviewCount", "blockedCount", "unexpectedCount", "notObservedCount"
+      ],
+      "properties": {
+        "configuredServerCount": { "$ref": "#/$defs/count" },
+        "observedServerCount": { "$ref": "#/$defs/count" },
+        "observedToolCount": { "$ref": "#/$defs/count" },
+        "matchedCount": { "$ref": "#/$defs/count" },
+        "reviewCount": { "$ref": "#/$defs/count" },
+        "blockedCount": { "$ref": "#/$defs/count" },
+        "unexpectedCount": { "$ref": "#/$defs/count" },
+        "notObservedCount": { "$ref": "#/$defs/count" }
+      }
+    },
+    "servers": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/server" }
+    },
+    "digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "count": { "type": "integer", "minimum": 0 },
+    "server": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name", "configured", "observed", "toolCount", "sourceDecision", "provenanceStatus",
+        "automaticGrant", "bindingStatus", "status"
+      ],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "configured": { "type": "boolean" },
+        "observed": { "type": "boolean" },
+        "toolCount": { "oneOf": [{ "$ref": "#/$defs/count" }, { "type": "null" }] },
+        "sourceDecision": { "oneOf": [{ "enum": ["allow", "ask", "block"] }, { "type": "null" }] },
+        "provenanceStatus": { "oneOf": [{ "enum": ["unknown", "verified", "mismatch"] }, { "type": "null" }] },
+        "automaticGrant": { "oneOf": [{ "enum": ["none", "scoped", "all"] }, { "type": "null" }] },
+        "bindingStatus": { "oneOf": [{ "enum": ["not-granted", "bound", "needs-review", "blocked"] }, { "type": "null" }] },
+        "status": { "enum": ["matched", "not-observed", "needs-review", "blocked", "unexpected"] }
+      }
+    }
+  }
+}

package/schemas/runtime-tool-inventory-v1.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/runtime-tool-inventory-v1.schema.json",
+  "title": "TrustDex value-free runtime tool inventory v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "runtime", "capturedAt", "captureMethod", "servers"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "agent-runtime-tool-inventory" },
+    "runtime": { "enum": ["claude", "codex"] },
+    "capturedAt": { "type": "string", "format": "date-time" },
+    "captureMethod": { "enum": ["runtime-export", "runtime-adapter"] },
+    "servers": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "toolCount"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "toolCount": { "type": "integer", "minimum": 0 }
+        }
+      }
+    }
+  }
+}

package/src/bindings.mjs

@@ -214,6 +214,10 @@ function validateSnapshot(snapshot) {
   return snapshot;
 }
 
+export function validateToolPermissionBindingSnapshot(snapshot) {
+  return validateSnapshot(snapshot);
+}
+
 function createSummary(bindings, input) {
   return {
     serverCount: bindings.length,

package/src/runtime-evidence.mjs

@@ -0,0 +1,318 @@
+import { sha256Json } from './canonical.mjs';
+import { validateToolPermissionBindingSnapshot } from './bindings.mjs';
+
+const RUNTIMES = new Set(['claude', 'codex']);
+const CAPTURE_METHODS = new Set(['runtime-export', 'runtime-adapter']);
+const EVIDENCE_STATUSES = new Set(['matched', 'restricted', 'needs-review', 'block']);
+const SERVER_STATUSES = new Set(['matched', 'not-observed', 'needs-review', 'blocked', 'unexpected']);
+const KIND = 'agent-effective-tool-boundary';
+const INVENTORY_KIND = 'agent-runtime-tool-inventory';
+
+function requireObject(value, message) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(message);
+  return value;
+}
+
+function requireExactKeys(value, expected, message) {
+  const keys = Object.keys(requireObject(value, message));
+  if (keys.length !== expected.size || keys.some((key) => !expected.has(key))) throw new Error(message);
+  return value;
+}
+
+function requireCount(value, field) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error(`Invalid runtime evidence count: ${field}`);
+  return value;
+}
+
+function requireDigest(value, field) {
+  if (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value)) {
+    throw new Error(`Invalid runtime evidence digest: ${field}`);
+  }
+  return value;
+}
+
+function requireTimestamp(value, field) {
+  if (typeof value !== 'string' || Number.isNaN(Date.parse(value)) ||
+      new Date(value).toISOString() !== value) {
+    throw new Error(`Invalid runtime evidence timestamp: ${field}`);
+  }
+  return value;
+}
+
+function normalizeInventory(input) {
+  const inventory = requireExactKeys(input, new Set([
+    'schemaVersion', 'kind', 'runtime', 'capturedAt', 'captureMethod', 'servers'
+  ]), 'Invalid runtime tool inventory.');
+  if (inventory.schemaVersion !== 1 || inventory.kind !== INVENTORY_KIND) {
+    throw new Error('Unsupported runtime tool inventory schema.');
+  }
+  if (!RUNTIMES.has(inventory.runtime)) throw new Error('Invalid runtime tool inventory runtime.');
+  requireTimestamp(inventory.capturedAt, 'capturedAt');
+  if (!CAPTURE_METHODS.has(inventory.captureMethod)) throw new Error('Invalid runtime tool inventory capture method.');
+  if (!Array.isArray(inventory.servers)) throw new Error('Runtime tool inventory is missing servers.');
+
+  const servers = inventory.servers.map((server) => {
+    requireExactKeys(server, new Set(['name', 'toolCount']), 'Invalid runtime tool inventory server.');
+    if (typeof server.name !== 'string' || !server.name.trim()) {
+      throw new Error('Runtime tool inventory server is missing a name.');
+    }
+    return { name: server.name, toolCount: requireCount(server.toolCount, 'toolCount') };
+  }).sort((left, right) => left.name.localeCompare(right.name));
+  if (new Set(servers.map((server) => server.name)).size !== servers.length) {
+    throw new Error('Runtime tool inventory server names must be unique.');
+  }
+  return {
+    schemaVersion: 1,
+    kind: INVENTORY_KIND,
+    runtime: inventory.runtime,
+    capturedAt: inventory.capturedAt,
+    captureMethod: inventory.captureMethod,
+    servers
+  };
+}
+
+function serverStatus(binding, observed) {
+  if (!binding) return 'unexpected';
+  if (!observed) return 'not-observed';
+  if (binding.status === 'blocked' || binding.sourceDecision === 'block' ||
+      binding.provenanceStatus === 'mismatch') return 'blocked';
+  if (binding.status === 'needs-review' || binding.sourceDecision === 'ask') return 'needs-review';
+  return 'matched';
+}
+
+function createSummary(servers) {
+  const observedToolCount = servers.reduce((total, server) => total + (server.toolCount || 0), 0);
+  requireCount(observedToolCount, 'observedToolCount');
+  return {
+    configuredServerCount: servers.filter((server) => server.configured).length,
+    observedServerCount: servers.filter((server) => server.observed).length,
+    observedToolCount,
+    matchedCount: servers.filter((server) => server.status === 'matched').length,
+    reviewCount: servers.filter((server) => server.status === 'needs-review').length,
+    blockedCount: servers.filter((server) => server.status === 'blocked').length,
+    unexpectedCount: servers.filter((server) => server.status === 'unexpected').length,
+    notObservedCount: servers.filter((server) => server.status === 'not-observed').length
+  };
+}
+
+function evidenceStatus(summary) {
+  if (summary.blockedCount || summary.unexpectedCount) return 'block';
+  if (summary.reviewCount) return 'needs-review';
+  if (summary.notObservedCount) return 'restricted';
+  return 'matched';
+}
+
+function evidenceDigest(snapshot) {
+  return sha256Json({
+    schemaVersion: snapshot.schemaVersion,
+    kind: snapshot.kind,
+    runtime: snapshot.runtime,
+    capturedAt: snapshot.capturedAt,
+    captureMethod: snapshot.captureMethod,
+    bindingDigest: snapshot.bindingDigest,
+    inventoryDigest: snapshot.inventoryDigest,
+    status: snapshot.status,
+    summary: snapshot.summary,
+    servers: snapshot.servers
+  });
+}
+
+function inventoryFromEvidence(snapshot) {
+  return {
+    schemaVersion: 1,
+    kind: INVENTORY_KIND,
+    runtime: snapshot.runtime,
+    capturedAt: snapshot.capturedAt,
+    captureMethod: snapshot.captureMethod,
+    servers: snapshot.servers
+      .filter((server) => server.observed)
+      .map((server) => ({ name: server.name, toolCount: server.toolCount }))
+  };
+}
+
+export function createEffectiveRuntimeEvidence(bindingInput, inventoryInput) {
+  const bindings = validateToolPermissionBindingSnapshot(bindingInput);
+  const inventory = normalizeInventory(inventoryInput);
+  if (bindings.runtime !== inventory.runtime) {
+    throw new Error('Runtime inventory does not match the binding runtime.');
+  }
+
+  const configured = new Map(bindings.bindings.map((binding) => [binding.name, binding]));
+  const observed = new Map(inventory.servers.map((server) => [server.name, server]));
+  const names = [...new Set([...configured.keys(), ...observed.keys()])].sort();
+  const servers = names.map((name) => {
+    const binding = configured.get(name) || null;
+    const runtimeServer = observed.get(name) || null;
+    return {
+      name,
+      configured: binding !== null,
+      observed: runtimeServer !== null,
+      toolCount: runtimeServer ? runtimeServer.toolCount : null,
+      sourceDecision: binding ? binding.sourceDecision : null,
+      provenanceStatus: binding ? binding.provenanceStatus : null,
+      automaticGrant: binding ? binding.automaticGrant : null,
+      bindingStatus: binding ? binding.status : null,
+      status: serverStatus(binding, runtimeServer)
+    };
+  });
+  const summary = createSummary(servers);
+  const snapshot = {
+    schemaVersion: 1,
+    kind: KIND,
+    createdAt: new Date().toISOString(),
+    runtime: inventory.runtime,
+    capturedAt: inventory.capturedAt,
+    captureMethod: inventory.captureMethod,
+    bindingDigest: bindings.digest,
+    inventoryDigest: sha256Json(inventory),
+    status: evidenceStatus(summary),
+    summary,
+    servers
+  };
+  return { ...snapshot, digest: evidenceDigest(snapshot) };
+}
+
+function validateServer(server) {
+  requireExactKeys(server, new Set([
+    'name', 'configured', 'observed', 'toolCount', 'sourceDecision', 'provenanceStatus',
+    'automaticGrant', 'bindingStatus', 'status'
+  ]), 'Invalid effective runtime server evidence.');
+  if (typeof server.name !== 'string' || !server.name) throw new Error('Runtime server evidence is missing a name.');
+  if (typeof server.configured !== 'boolean' || typeof server.observed !== 'boolean') {
+    throw new Error('Invalid runtime server configured/observed state.');
+  }
+  if (server.observed) requireCount(server.toolCount, 'toolCount');
+  else if (server.toolCount !== null) throw new Error('Unobserved runtime server must have a null tool count.');
+  if (!server.configured) {
+    for (const field of ['sourceDecision', 'provenanceStatus', 'automaticGrant', 'bindingStatus']) {
+      if (server[field] !== null) throw new Error('Unexpected runtime server has binding metadata.');
+    }
+  } else {
+    if (!['allow', 'ask', 'block'].includes(server.sourceDecision) ||
+        !['unknown', 'verified', 'mismatch'].includes(server.provenanceStatus) ||
+        !['none', 'scoped', 'all'].includes(server.automaticGrant) ||
+        !['not-granted', 'bound', 'needs-review', 'blocked'].includes(server.bindingStatus)) {
+      throw new Error('Invalid configured runtime server binding metadata.');
+    }
+  }
+  if (!SERVER_STATUSES.has(server.status) || server.status !== serverStatus(
+    server.configured ? {
+      status: server.bindingStatus,
+      sourceDecision: server.sourceDecision,
+      provenanceStatus: server.provenanceStatus
+    } : null,
+    server.observed ? server : null
+  )) throw new Error('Invalid effective runtime server status.');
+  return server;
+}
+
+function validateEvidence(snapshot) {
+  requireExactKeys(snapshot, new Set([
+    'schemaVersion', 'kind', 'createdAt', 'runtime', 'capturedAt', 'captureMethod',
+    'bindingDigest', 'inventoryDigest', 'status', 'summary', 'servers', 'digest'
+  ]), 'Invalid effective runtime evidence snapshot.');
+  if (snapshot.schemaVersion !== 1 || snapshot.kind !== KIND) {
+    throw new Error('Unsupported effective runtime evidence schema.');
+  }
+  if (!RUNTIMES.has(snapshot.runtime)) throw new Error('Invalid effective runtime evidence runtime.');
+  requireTimestamp(snapshot.createdAt, 'createdAt');
+  requireTimestamp(snapshot.capturedAt, 'capturedAt');
+  if (!CAPTURE_METHODS.has(snapshot.captureMethod)) throw new Error('Invalid effective runtime capture method.');
+  requireDigest(snapshot.bindingDigest, 'bindingDigest');
+  requireDigest(snapshot.inventoryDigest, 'inventoryDigest');
+  requireDigest(snapshot.digest, 'digest');
+  if (!EVIDENCE_STATUSES.has(snapshot.status)) throw new Error('Invalid effective runtime evidence status.');
+  if (!Array.isArray(snapshot.servers)) throw new Error('Effective runtime evidence is missing servers.');
+  for (const server of snapshot.servers) validateServer(server);
+  const names = snapshot.servers.map((server) => server.name);
+  if (new Set(names).size !== names.length || [...names].sort().join('\0') !== names.join('\0')) {
+    throw new Error('Effective runtime server evidence is not canonical.');
+  }
+  const summaryFields = [
+    'configuredServerCount', 'observedServerCount', 'observedToolCount', 'matchedCount',
+    'reviewCount', 'blockedCount', 'unexpectedCount', 'notObservedCount'
+  ];
+  requireExactKeys(snapshot.summary, new Set(summaryFields), 'Invalid effective runtime evidence summary.');
+  for (const field of summaryFields) requireCount(snapshot.summary[field], field);
+  const summary = createSummary(snapshot.servers);
+  if (sha256Json(summary) !== sha256Json(snapshot.summary)) throw new Error('Effective runtime evidence summary mismatch.');
+  if (snapshot.inventoryDigest !== sha256Json(inventoryFromEvidence(snapshot))) {
+    throw new Error('Effective runtime inventory digest mismatch.');
+  }
+  if (snapshot.status !== evidenceStatus(summary)) throw new Error('Effective runtime evidence status mismatch.');
+  if (snapshot.digest !== evidenceDigest(snapshot)) throw new Error('Effective runtime evidence digest mismatch.');
+  return snapshot;
+}
+
+export function validateEffectiveRuntimeEvidence(snapshot) {
+  return validateEvidence(snapshot);
+}
+
+function addChange(changes, impact, type, name, field, before, after) {
+  changes.push({ impact, type, name, field, before, after });
+}
+
+export function diffEffectiveRuntimeEvidence(beforeInput, afterInput) {
+  const before = validateEvidence(beforeInput);
+  const after = validateEvidence(afterInput);
+  if (before.runtime !== after.runtime) throw new Error('Cannot compare different runtime evidence types.');
+  const changes = [];
+  if (before.bindingDigest !== after.bindingDigest) {
+    addChange(changes, 'review', 'bindings-changed', null, 'bindingDigest', null, null);
+  }
+  if (before.captureMethod !== after.captureMethod) {
+    addChange(changes, 'review', 'capture-method-changed', null, 'captureMethod', before.captureMethod, after.captureMethod);
+  }
+
+  const left = new Map(before.servers.map((server) => [server.name, server]));
+  const right = new Map(after.servers.map((server) => [server.name, server]));
+  const risk = { 'not-observed': 0, matched: 1, 'needs-review': 2, blocked: 3, unexpected: 3 };
+  for (const [name, current] of right) {
+    const previous = left.get(name);
+    if (!previous) {
+      addChange(changes, current.observed ? 'expansion' : 'review', 'server-added', name, 'server', null, current.status);
+      continue;
+    }
+    if (previous.observed !== current.observed) {
+      addChange(changes, current.observed ? 'expansion' : 'restriction', 'observation-changed', name, 'observed', previous.observed, current.observed);
+    }
+    const beforeCount = previous.toolCount || 0;
+    const afterCount = current.toolCount || 0;
+    if (beforeCount !== afterCount) {
+      addChange(changes, afterCount > beforeCount ? 'expansion' : 'restriction', 'tool-count-changed', name, 'toolCount', previous.toolCount, current.toolCount);
+    }
+    for (const field of ['configured', 'sourceDecision', 'provenanceStatus', 'automaticGrant', 'bindingStatus']) {
+      if (previous[field] !== current[field]) {
+        addChange(changes, 'review', 'binding-state-changed', name, field, previous[field], current[field]);
+      }
+    }
+    if (previous.status !== current.status) {
+      addChange(
+        changes,
+        risk[current.status] > risk[previous.status] ? 'expansion' :
+          risk[current.status] < risk[previous.status] ? 'restriction' : 'review',
+        'server-status-changed', name, 'status', previous.status, current.status
+      );
+    }
+  }
+  for (const [name, previous] of left) {
+    if (!right.has(name)) {
+      addChange(changes, previous.observed ? 'restriction' : 'review', 'server-removed', name, 'server', previous.status, null);
+    }
+  }
+  const summary = {
+    expansions: changes.filter((change) => change.impact === 'expansion').length,
+    restrictions: changes.filter((change) => change.impact === 'restriction').length,
+    reviews: changes.filter((change) => change.impact === 'review').length
+  };
+  return {
+    schemaVersion: 1,
+    runtime: before.runtime,
+    status: summary.expansions || summary.reviews ? 'needs-review' :
+      summary.restrictions ? 'restricted' : 'unchanged',
+    baselineDigest: before.digest,
+    currentDigest: after.digest,
+    summary,
+    changes
+  };
+}