wicked-garden 12.27.0

package/scripts/jam/save_transcript.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""
+wicked-jam transcript persistence helper.
+
+Called by facilitator and council agents after each session to store
+individual persona contributions for later retrieval via jam.py.
+
+Usage:
+    save_transcript.py --session-id ID --entries '[{...}, ...]'
+
+The --entries argument must be a JSON array of transcript entry objects.
+Each entry schema:
+    {
+        "session_id": "...",
+        "round": 1,
+        "persona_name": "Technical Architect",
+        "persona_type": "technical",   # technical | user | business | process | council
+        "raw_text": "...",
+        "timestamp": "...",            # ISO 8601 (auto-set if omitted)
+        "entry_type": "perspective"    # perspective | synthesis | council_response
+    }
+
+Existing entries for the session are loaded, new entries are appended,
+then the whole transcript is saved back via DomainStore.
+"""
+
+import argparse
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+_sm = None
+
+VALID_ENTRY_TYPES = {"perspective", "synthesis", "council_response"}
+VALID_PERSONA_TYPES = {"technical", "user", "business", "process", "council"}
+
+
+def _iso_now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _validate_entry(entry: dict, session_id: str) -> dict:
+    """Fill defaults and validate a single transcript entry. Returns the normalised entry."""
+    entry = dict(entry)
+
+    # Enforce session_id
+    entry["session_id"] = session_id
+
+    # Default timestamp
+    if not entry.get("timestamp"):
+        entry["timestamp"] = _iso_now()
+
+    # Default round
+    if "round" not in entry:
+        entry["round"] = 1
+
+    # Validate entry_type
+    etype = entry.get("entry_type", "")
+    if etype not in VALID_ENTRY_TYPES:
+        raise ValueError(
+            f"Invalid entry_type {etype!r}. Must be one of: {sorted(VALID_ENTRY_TYPES)}"
+        )
+
+    # Validate persona_type (soft — unknown types are kept but warned)
+    ptype = entry.get("persona_type", "")
+    if ptype and ptype not in VALID_PERSONA_TYPES:
+        print(
+            f"Warning: unknown persona_type {ptype!r}. "
+            f"Expected one of: {sorted(VALID_PERSONA_TYPES)}",
+            file=sys.stderr,
+        )
+
+    # Require raw_text
+    if not entry.get("raw_text", "").strip():
+        raise ValueError("Entry is missing required field: raw_text")
+
+    # Require persona_name
+    if not entry.get("persona_name", "").strip():
+        raise ValueError("Entry is missing required field: persona_name")
+
+    return entry
+
+
+def _get_sm():
+    """Lazy DomainStore init — deferred to call time, not import time."""
+    global _sm
+    if _sm is None:
+        from _domain_store import DomainStore
+        _sm = DomainStore("wicked-jam")
+    return _sm
+
+
+def save_transcript_entries(session_id: str, new_entries: list) -> dict:
+    """
+    Append new_entries to the stored transcript for session_id.
+
+    Returns a result dict with counts and any error.
+    """
+    if not session_id:
+        return {"ok": False, "error": "session_id is required"}
+
+    if not isinstance(new_entries, list) or not new_entries:
+        return {"ok": False, "error": "entries must be a non-empty JSON array"}
+
+    sm = _get_sm()
+
+    # Load existing transcript (or start fresh)
+    existing = sm.get("transcripts", session_id)
+    existing_entries = existing.get("entries", []) if existing else []
+
+    validated = []
+    for i, entry in enumerate(new_entries):
+        try:
+            validated.append(_validate_entry(entry, session_id))
+        except (ValueError, TypeError) as exc:
+            return {"ok": False, "error": f"Entry #{i}: {exc}"}
+
+    merged = existing_entries + validated
+    transcript_doc = {"id": session_id, "session_id": session_id, "entries": merged}
+
+    if existing:
+        sm.update("transcripts", session_id, {"entries": merged})
+    else:
+        sm.create("transcripts", transcript_doc)
+
+    return {
+        "ok": True,
+        "session_id": session_id,
+        "entries_added": len(validated),
+        "entries_total": len(merged),
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Persist jam transcript entries")
+    parser.add_argument("--session-id", required=True, help="Brainstorm session ID")
+    parser.add_argument(
+        "--entries",
+        required=True,
+        help="JSON array of transcript entry objects",
+    )
+    parser.add_argument("--json", action="store_true", help="Output result as JSON")
+    args = parser.parse_args()
+
+    try:
+        entries = json.loads(args.entries)
+    except json.JSONDecodeError as exc:
+        result = {"ok": False, "error": f"Invalid JSON in --entries: {exc}"}
+        print(json.dumps(result, indent=2) if getattr(args, "json", False) else result["error"])
+        sys.exit(1)
+
+    result = save_transcript_entries(session_id=args.session_id, new_entries=entries)
+
+    if getattr(args, "json", False):
+        print(json.dumps(result, indent=2))
+    else:
+        if result.get("ok"):
+            added = result["entries_added"]
+            total = result["entries_total"]
+            print(f"Saved {added} transcript {'entry' if added == 1 else 'entries'} "
+                  f"(total: {total}) for session: {args.session_id}")
+        else:
+            print(f"Error: {result.get('error', 'unknown error')}", file=sys.stderr)
+            sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/loom/__init__.py

@@ -0,0 +1,22 @@
+"""loom — absorbed peer-resolution runtime (wicked-loom Phase B absorption).
+
+This package is the absorbed peer-resolution surface from wicked-loom,
+moved into wicked-garden as part of the wicked-* ecosystem rationalization
+(ECOSYSTEM-RATIONALIZATION.md §5a Phase B).
+
+KEPT (peer-resolution surface — this package):
+  manifest.py  — peer registry: peer names, version pins, install/probe commands
+  resolve.py   — runtime resolution ladder: env → PATH → npx
+  compose.py   — version-check + install orchestration (doctor / compose install)
+  gate.py      — synchronous fail-closed produces gate (vault cross-check wrapper)
+  cli.py       — slim CLI: resolve / doctor / compose / gate ONLY
+
+RETIRED (flow conductor surface — NOT included):
+  flow.py      — loom flow run/status/resume  → RETIRED, replaced by wicked-crew
+  flowstate.py — flow state persistence       → RETIRED
+  busemit.py   — bus event emission for flow  → RETIRED
+
+wicked-loom as a standalone npm package is absorbed — users do not need to
+install it separately. The external CLI (wicked-loom / loom) is no longer
+required; garden's scripts/_loom.py dispatches to this package in-process.
+"""

package/scripts/loom/cli.py

@@ -0,0 +1,170 @@
+"""cli.py — argument dispatch + JSON output for the peer-resolution surface.
+
+Absorbed from wicked-loom (Phase B — ECOSYSTEM-RATIONALIZATION.md §5a).
+
+ACTIVE commands (absorbed into wicked-garden):
+  loom resolve <peer>              -> {"peer","command"}            exit 0/1
+  loom doctor [--strict]           -> {"peers":[check rows], ...}   exit 0/1
+  loom compose install [--peer X]  -> {"results":[install rows]}    exit 0/1
+  loom gate <produces> [--scope S] -> {"gate":{...}}                exit 0/1
+
+RETIRED commands (NOT included — replaced by wicked-crew + wicked-orchestration):
+  loom flow run    — RETIRED (was: run a flow from a JSON definition)
+  loom flow status — RETIRED (was: read persisted flow state)
+  loom flow resume — RETIRED (was: resume a parked/running flow)
+
+No business logic lives here — only parsing + formatting.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from typing import Optional
+
+from loom import manifest
+from loom.compose import check_all, install_peer
+from loom.resolve import resolve
+from loom.gate import run_gate
+
+
+def _emit(obj: dict) -> None:
+    sys.stdout.write(json.dumps(obj) + "\n")
+
+
+def _cmd_resolve(args: list) -> int:
+    if not args:
+        _emit({"error": "usage: loom resolve <peer>"})
+        return 2
+    cmd = resolve(args[0])
+    _emit({"peer": args[0], "command": cmd})
+    return 0 if cmd is not None else 1
+
+
+def _cmd_doctor(args: list) -> int:
+    """Report every peer's reachability AND declared capability.
+
+    Two orthogonal signals live on each row:
+      * ``status``        — runtime REACHABILITY (ok/drift/present/missing/error)
+      * ``capability_ok`` — declared CAPABILITY readiness (True only for ``wired``)
+
+    Default exit keys on reachability only (``status == "ok"``). ``--strict``
+    makes the EXIT additionally assert ``capability_ok`` for every peer.
+    """
+    strict = "--strict" in args
+    rows = check_all()
+    all_reachable = all(r.get("status") == "ok" for r in rows)
+    not_capable = [r.get("peer") for r in rows if not r.get("capability_ok")]
+    all_capable = not not_capable
+    _emit({
+        "peers": rows,
+        "all_reachable": all_reachable,
+        "all_capable": all_capable,
+        "not_capable": not_capable,
+        "strict": strict,
+    })
+    ok = all_reachable and (all_capable if strict else True)
+    return 0 if ok else 1
+
+
+def _cmd_compose(args: list) -> int:
+    if not args or args[0] != "install":
+        _emit({"error": "usage: loom compose install [--peer <name>]"})
+        return 2
+    target = None
+    if "--peer" in args:
+        i = args.index("--peer")
+        if i + 1 < len(args):
+            target = args[i + 1]
+    names = [target] if target else list(manifest.PEERS)
+    results = [install_peer(n) for n in names]
+    _emit({"results": results})
+    return 0 if all(r.get("status") == "installed" for r in results) else 1
+
+
+_VALUE_OPTS = ("--scope", "--verifier-spec")
+
+
+def _positionals(args: list) -> list:
+    """Return the positional tokens, skipping flags and value-taking option tokens."""
+    out: list = []
+    i = 0
+    n = len(args)
+    while i < n:
+        tok = args[i]
+        if tok in _VALUE_OPTS:
+            i += 2
+            continue
+        if tok.startswith("--"):
+            i += 1
+            continue
+        out.append(tok)
+        i += 1
+    return out
+
+
+def _opt(args: list, name: str) -> Optional[str]:
+    """Return the value following ``--name`` in args, or None."""
+    if name in args:
+        i = args.index(name)
+        if i + 1 < len(args):
+            return args[i + 1]
+    return None
+
+
+def _cmd_gate(args: list) -> int:
+    scope = _opt(args, "--scope") or "default"
+    verifier_spec = _opt(args, "--verifier-spec")
+    positional = _positionals(args)
+    produces = positional[0] if positional else None
+    if produces is None:
+        _emit({"error": "usage: loom gate <produces> [--scope S] "
+                        "[--verifier-spec PATH] [--with-attestations]"})
+        return 2
+    verdict = run_gate(produces, scope=scope, verifier_spec=verifier_spec,
+                       with_attestations="--with-attestations" in args)
+    _emit({"gate": verdict})
+    return 0 if verdict.get("satisfied") else 1
+
+
+_DISPATCH = {
+    "resolve": _cmd_resolve,
+    "doctor": _cmd_doctor,
+    "compose": _cmd_compose,
+    "gate": _cmd_gate,
+    # flow subcommands are RETIRED — not included. Use wicked-crew for
+    # multi-phase orchestration (see ECOSYSTEM-RATIONALIZATION.md §5a).
+}
+
+
+def main(argv: "list[str] | None" = None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if not argv or argv[0] in ("-h", "--help"):
+        _emit({"commands": list(_DISPATCH)})
+        return 0
+    handler = _DISPATCH.get(argv[0])
+    if handler is None:
+        if argv[0] == "flow":
+            _emit({
+                "error": "loom flow is retired",
+                "detail": (
+                    "loom flow run/status/resume was part of the loom conduct "
+                    "surface, replaced by wicked-crew + wicked-orchestration "
+                    "(ECOSYSTEM-RATIONALIZATION.md §5a Phase B). "
+                    "See /wicked-garden:archetype:migrate for the migration path."
+                ),
+            })
+            return 2
+        _emit({"error": f"unknown command: {argv[0]}", "commands": list(_DISPATCH)})
+        return 2
+    try:
+        return handler(argv[1:])
+    except Exception as e:  # noqa: BLE001 — surface as data, never traceback.
+        _emit({"error": f"{type(e).__name__}: {e}",
+               "command": argv[0],
+               "detail": "loom never raises at the CLI boundary (R4)."})
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/loom/compose.py

@@ -0,0 +1,180 @@
+"""compose.py — version-check + install orchestration over the peer set.
+
+Absorbed from wicked-loom (Phase B — ECOSYSTEM-RATIONALIZATION.md §5a).
+
+check_peer:  resolve -> probe -> parse version -> compare MAJOR.MINOR to the pin.
+install_peer: run the peer's headless install command.
+check_all:   one check_peer row per known peer.
+
+Subprocess execution is injected (the ``run`` parameter) so callers (and tests)
+control side effects. Nothing here raises — failures are returned as status
+rows ("ok" | "drift" | "present" | "missing" | "error" | "installed"
+| "install-failed").
+
+Status semantics (no cry-wolf — see R4 "never raise, surface as data"):
+  ok       — resolved, probe ran, version parsed, version >= pin.
+  drift    — resolved, probe ran, version parsed, version <  pin.
+  present  — resolved AND the probe binary RAN (we got a RunResult, not an
+             exception), but its version could not be determined: a non-zero
+             exit (older CLIs print help/usage when given ``--version``) or
+             unparseable output. The peer is healthy/responding; we just can't
+             read its version. This is WARN-level, NOT an error — reporting a
+             responding peer as "error" was a false alarm (cry-wolf). The
+             ``ok`` flag on the row is True so health probes don't fail hard.
+  missing  — unresolvable: no binary on PATH / npx / env override (kill-switch).
+  error    — reserved for genuine faults: unknown peer, or the probe attempt
+             RAISED (binary vanished, OS error). A responding-but-unparseable
+             peer is NEVER "error".
+
+``status`` above is runtime REACHABILITY (can we run it / does its version meet
+the pin). Every row ALSO carries the peer's declared CAPABILITY readiness under
+a separate ``capability`` key (``wired``/``planned``/``experimental`` from
+manifest.Peer.status) plus ``capability_ok``. The two are deliberately distinct:
+a peer can be perfectly reachable (status ``ok``) yet not wired as a capability
+(``capability`` ``planned``) — doctor must answer "reachable but not wired yet"
+distinctly from "missing/drift". Overloading the reachability ``status`` key
+would break doctor's exit logic, so the capability lives on its own key.
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from dataclasses import dataclass
+from typing import Callable
+
+from loom import manifest
+from loom.manifest import Peer
+from loom.resolve import resolve_version_bin
+
+_VERSION_RE = re.compile(r"(\d+)\.(\d+)(?:\.(\d+))?")
+
+
+@dataclass
+class RunResult:
+    returncode: int
+    stdout: str
+    stderr: str
+
+
+Runner = Callable[..., RunResult]
+
+
+def _default_run(cmd: list, timeout: int = 30) -> RunResult:
+    p = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    return RunResult(returncode=p.returncode, stdout=p.stdout, stderr=p.stderr)
+
+
+def _parse_version(text: str) -> "str | None":
+    m = _VERSION_RE.search(text or "")
+    if not m:
+        return None
+    major, minor, patch = m.group(1), m.group(2), m.group(3) or "0"
+    return f"{major}.{minor}.{patch}"
+
+
+def _meets_pin(installed: str, pin: str) -> bool:
+    iv = _parse_version(installed)
+    pv = _parse_version(pin)
+    if iv is None or pv is None:
+        return False
+    ip = [int(x) for x in iv.split(".")]
+    pp = [int(x) for x in pv.split(".")]
+    return (ip[0], ip[1]) >= (pp[0], pp[1])  # MAJOR.MINOR floor
+
+
+def _probe_command(version_cmd: list, peer: Peer) -> list:
+    """The version-probe argv: the resolved version binary + the probe's
+    trailing args.
+
+    The version binary can differ from the runnable package — brain runs as
+    ``wicked-brain`` but reports its version via ``wicked-brain-server`` — so
+    we resolve ``peer.version_package`` (not npm_package) here.
+    """
+    return version_cmd + peer.probe_cmd[1:]
+
+
+def _stamp_capability(row: dict, peer: "Peer | None") -> dict:
+    """Add the peer's declared capability readiness to a reachability row.
+
+    ``capability`` is the manifest's honest status (wired/planned/experimental)
+    — orthogonal to the row's ``status`` (reachability). ``capability_ok`` mirrors
+    the never-fake predicate (``True`` only for ``wired``). For an unknown peer
+    (no manifest entry) there is no declared capability, so both are None/False.
+    Doctor surfaces these so "reachable but not wired" reads distinctly from
+    "missing/drift". This NEVER changes the reachability ``status`` or ``ok`` keys
+    — the capability is purely additive (no cry-wolf, no exit-logic change).
+    """
+    if peer is None:
+        row["capability"] = None
+        row["capability_ok"] = False
+    else:
+        row["capability"] = peer.status
+        row["capability_ok"] = peer.is_wired
+    return row
+
+
+def check_peer(name: str, run: Runner = _default_run) -> dict:
+    peer = manifest.get(name)
+    return _stamp_capability(_check_peer_reachability(name, peer, run=run), peer)
+
+
+def _check_peer_reachability(name: str, peer: "Peer | None",
+                             run: Runner = _default_run) -> dict:
+    if peer is None:
+        return {"peer": name, "status": "error", "ok": False, "detail": "unknown peer"}
+
+    version_cmd = resolve_version_bin(name)
+    if version_cmd is None:
+        # Genuinely unresolvable — no binary anywhere. Legitimately not-ok.
+        return {"peer": name, "status": "missing", "ok": False, "pin": peer.version_pin}
+
+    try:
+        result = run(_probe_command(version_cmd, peer))
+    except Exception as e:  # noqa: BLE001 — surface as data, never crash (R4)
+        # The probe itself RAISED (binary vanished mid-call, OS error). This is
+        # the only path that means "absent/unrunnable" once resolution succeeded
+        # — a genuine error, not cry-wolf.
+        return {"peer": name, "status": "error", "ok": False,
+                "detail": str(e), "pin": peer.version_pin}
+
+    # From here the binary resolved AND produced a RunResult: the peer is
+    # PRESENT and RESPONDING. Prefer stdout for the version, but tolerate older
+    # CLIs that print it to stderr.
+    installed = _parse_version(result.stdout) or _parse_version(result.stderr)
+
+    if installed is not None:
+        status = "ok" if _meets_pin(installed, peer.version_pin) else "drift"
+        return {"peer": name, "status": status, "ok": status == "ok",
+                "installed": installed, "pin": peer.version_pin}
+
+    # Present + responding, but version unknown: a non-zero exit (older buses
+    # print help/usage JSON for an unrecognized ``--version``) OR parseable-free
+    # output. The peer is healthy — do NOT raise a hard "error" (the cry-wolf
+    # finding). Surface it as WARN-level "present" with ok=True so doctor/health
+    # probes don't treat a responding peer as a failure.
+    detail = (
+        "probe exited %d; version not reported (older CLI may print help "
+        "for --version)" % result.returncode
+        if result.returncode != 0
+        else "version not reported by probe output"
+    )
+    return {"peer": name, "status": "present", "ok": True,
+            "detail": detail, "pin": peer.version_pin}
+
+
+def install_peer(name: str, run: Runner = _default_run) -> dict:
+    peer = manifest.get(name)
+    if peer is None:
+        return {"peer": name, "status": "error", "detail": "unknown peer"}
+    try:
+        result = run(peer.install_cmd, timeout=300)
+    except Exception as e:  # noqa: BLE001
+        return {"peer": name, "status": "install-failed", "detail": str(e)}
+    if result.returncode != 0:
+        return {"peer": name, "status": "install-failed", "detail": result.stderr.strip()}
+    return {"peer": name, "status": "installed"}
+
+
+def check_all(run: Runner = _default_run) -> list:
+    return [check_peer(name, run=run) for name in manifest.PEERS]

package/scripts/loom/gate.py

@@ -0,0 +1,120 @@
+"""gate.py — the synchronous, fail-closed produces gate (vault re-derivation).
+
+Absorbed from wicked-loom (Phase B — ECOSYSTEM-RATIONALIZATION.md §5a).
+
+Ported from wicked-garden scripts/qe/vault_gate.py, with the subprocess
+execution injected (the ``run`` parameter, same RunResult shape as compose.py)
+so callers and tests control side effects and no real vault is ever spawned in
+a unit test.
+
+Invariants (spec §5):
+  I1 — synchronous + in-line: exactly one blocking vault call per invocation;
+       no events are consulted. An event NEVER satisfies a gate.
+  I2 — fail-closed: vault unresolvable OR unrunnable OR non-JSON ->
+       gate "unavailable" / overall "ERROR", satisfied False. Never a pass.
+  I3 — fail-soft on the verifier spec only: a present ``verifier_spec`` is
+       forwarded to the vault; its ABSENCE never blocks and never vacates the
+       gate — the vault falls back to generic detection.
+
+Hard gates additionally require an independent attestation: pass
+``with_attestations=True`` -> ``--with-attestations`` forwarded to the vault.
+
+The return is a status dict (R4 — surface as data, never raise):
+  {satisfied, re_derived, gate, overall, exit_code, argv, detail, error}
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Callable, Optional
+
+from loom.compose import RunResult, _default_run
+from loom.resolve import resolve
+
+Runner = Callable[..., RunResult]
+
+_DEFAULT_TIMEOUT = 120  # seconds; bounds the blocking re-derivation (R5).
+
+
+def _build_argv(vault_prefix: list, produces: str, scope: str, *,
+                with_attestations: bool,
+                verifier_spec: Optional[str]) -> list:
+    """The full vault argv: <prefix> cross-check --scope S --phase <produces> ...
+
+    ``produces`` maps to the vault's ``--phase`` (the produces-contract id, e.g.
+    "test-report"); ``scope`` maps to ``--scope`` (the project/flow scope).
+    """
+    argv = list(vault_prefix) + ["cross-check", "--scope", scope, "--phase", produces]
+    if with_attestations:
+        argv.append("--with-attestations")
+    if verifier_spec:
+        argv += ["--verifier-spec", verifier_spec]
+    return argv
+
+
+def run_gate(produces: str, *, scope: str,
+             with_attestations: bool = False,
+             verifier_spec: Optional[str] = None,
+             run: Runner = _default_run,
+             timeout: int = _DEFAULT_TIMEOUT) -> dict:
+    """Re-derive ``produces`` via ``vault cross-check`` and return the verdict.
+
+    Fail-closed (I2): no resolvable vault, an unrunnable vault, or non-JSON
+    output all yield ``satisfied: False`` with ``gate: "unavailable"`` (or
+    overall "ERROR") — never an invented pass.
+    """
+    vault_prefix = resolve("vault")
+    if vault_prefix is None:
+        return {
+            "satisfied": False,
+            "re_derived": False,
+            "gate": "unavailable",
+            "overall": "ERROR",
+            "argv": [],
+            "error": "wicked-vault not resolvable",
+            "detail": "Gate fails closed — 'done' cannot be self-asserted (I2).",
+        }
+
+    argv = _build_argv(vault_prefix, produces, scope,
+                       with_attestations=with_attestations,
+                       verifier_spec=verifier_spec)
+    try:
+        result = run(argv, timeout=timeout)
+    except Exception as e:  # noqa: BLE001 — surface as data, fail closed (R4/I2)
+        return {
+            "satisfied": False,
+            "re_derived": False,
+            "gate": "unavailable",
+            "overall": "ERROR",
+            "argv": argv,
+            "error": str(e),
+            "detail": "vault resolvable but not runnable; gate fails closed (I2).",
+        }
+
+    try:
+        parsed = json.loads(result.stdout) if (result.stdout or "").strip() else {}
+    except json.JSONDecodeError:
+        return {
+            "satisfied": False,
+            "re_derived": True,
+            "gate": "vault-cross-check",
+            "overall": "ERROR",
+            "exit_code": result.returncode,
+            "argv": argv,
+            "error": "vault returned non-JSON output",
+            "detail": result.stderr.strip()[:500],
+        }
+
+    overall = parsed.get("overall", "ERROR")
+    return {
+        "satisfied": overall == "PASS",
+        "re_derived": True,
+        "gate": "vault-cross-check",
+        "overall": overall,
+        "exit_code": result.returncode,
+        "argv": argv,
+        "claims": parsed.get("claims", []),
+        "contract_version": parsed.get("contract_version"),
+        "detail": parsed.get("detail"),
+        "error": None,
+    }