agent-lifecycle-kit 1.87.0__tar.gz → 1.89.0__tar.gz

{agent_lifecycle_kit-1.87.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-1.89.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 1.87.0
+Version: 1.89.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -43,7 +43,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.87.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.89.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -68,7 +68,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The boundaries of [planning-only launch](docs/reference/planning-only-launch.md) and [frozen-task launch through a verified profile](docs/reference/qualified-host-launch.md) are documented in the reference. Shipped planning profiles remain candidates with safe failure until the corresponding profile is verified.
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
-- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md).
+- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md).
 - For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority.
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.
@@ -194,7 +194,7 @@ Adapter installation and support-level details live in [Adapter install](docs/ad
 
 - Start: [English documentation](docs/README.md), [Русская документация](docs/ru/README.md), [Install](docs/guides/install-and-first-run.md), [Quickstart](docs/guides/quickstart.md), [Beginner and advanced workflows](docs/guides/beginner-and-advanced-workflows.md), [Commands by task](docs/guides/commands-by-task.md), [Research workflow](docs/guides/research-workflow.md), [Lifecycle task scenarios](docs/guides/lifecycle-cookbook.md), and [Code review workflows](docs/guides/code-review-workflows.md).
 - Planning and adapters: [Issue to specification drafts](docs/guides/issue-to-spec.md), [Adapter install](docs/adapters/install.md), and [Adapter support matrix](docs/adapters/support-matrix.md).
-- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
+- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [External verification checks](docs/reference/external-verification-checks.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
 - Quality and resources: [Reference-task evaluation](docs/reference/reference-task-evaluation.md), [model routing](docs/reference/model-routing.md), [quality-cost learning](docs/reference/quality-cost-learning.md), [performance and resource budgets](docs/reference/performance-and-resource-budgets.md), [lifecycle cost accounting](docs/reference/lifecycle-cost.md), [host-local token accounting](docs/reference/host-local-token-accounting.md), [process execution observability](docs/reference/process-execution-observability.md), [Usage export](docs/reference/usage-export.md), and [Evidence integrity](docs/reference/evidence-integrity.md).
 - Profiles and operations: [Project workflow presets](docs/reference/workflow-presets.md), [Project workflow profile](docs/reference/project-workflow-profile.md), [Read-only status views](docs/reference/read-only-status-view.md), [Adapter progress bridge](docs/reference/automatic-progress-bridge.md), [Sandbox boundaries](docs/reference/sandbox-boundaries.md), [Import mappers](docs/reference/import-mappers.md), [Episode retrieval](docs/reference/episode-retrieval.md), [Runner recovery](docs/reference/runner-recovery.md), [Cross-check profile](docs/reference/cross-check-profile.md), [Review Mesh](docs/reference/review-mesh.md), [Bug Forensics profile](docs/reference/bug-forensics.md), and [Bug Forensics context budget](docs/reference/bug-forensics-context-budget.md).
 - Release assets: [Task templates](templates/tasks/README.md), [Neutrality scanning](docs/reference/neutrality.md), and [Release security](docs/security/release-security.md).

{agent_lifecycle_kit-1.87.0 → agent_lifecycle_kit-1.89.0}/README.md

@@ -21,7 +21,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.87.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.89.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -46,7 +46,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The boundaries of [planning-only launch](docs/reference/planning-only-launch.md) and [frozen-task launch through a verified profile](docs/reference/qualified-host-launch.md) are documented in the reference. Shipped planning profiles remain candidates with safe failure until the corresponding profile is verified.
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
-- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md).
+- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md).
 - For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority.
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.
@@ -172,7 +172,7 @@ Adapter installation and support-level details live in [Adapter install](docs/ad
 
 - Start: [English documentation](docs/README.md), [Русская документация](docs/ru/README.md), [Install](docs/guides/install-and-first-run.md), [Quickstart](docs/guides/quickstart.md), [Beginner and advanced workflows](docs/guides/beginner-and-advanced-workflows.md), [Commands by task](docs/guides/commands-by-task.md), [Research workflow](docs/guides/research-workflow.md), [Lifecycle task scenarios](docs/guides/lifecycle-cookbook.md), and [Code review workflows](docs/guides/code-review-workflows.md).
 - Planning and adapters: [Issue to specification drafts](docs/guides/issue-to-spec.md), [Adapter install](docs/adapters/install.md), and [Adapter support matrix](docs/adapters/support-matrix.md).
-- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
+- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [External verification checks](docs/reference/external-verification-checks.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
 - Quality and resources: [Reference-task evaluation](docs/reference/reference-task-evaluation.md), [model routing](docs/reference/model-routing.md), [quality-cost learning](docs/reference/quality-cost-learning.md), [performance and resource budgets](docs/reference/performance-and-resource-budgets.md), [lifecycle cost accounting](docs/reference/lifecycle-cost.md), [host-local token accounting](docs/reference/host-local-token-accounting.md), [process execution observability](docs/reference/process-execution-observability.md), [Usage export](docs/reference/usage-export.md), and [Evidence integrity](docs/reference/evidence-integrity.md).
 - Profiles and operations: [Project workflow presets](docs/reference/workflow-presets.md), [Project workflow profile](docs/reference/project-workflow-profile.md), [Read-only status views](docs/reference/read-only-status-view.md), [Adapter progress bridge](docs/reference/automatic-progress-bridge.md), [Sandbox boundaries](docs/reference/sandbox-boundaries.md), [Import mappers](docs/reference/import-mappers.md), [Episode retrieval](docs/reference/episode-retrieval.md), [Runner recovery](docs/reference/runner-recovery.md), [Cross-check profile](docs/reference/cross-check-profile.md), [Review Mesh](docs/reference/review-mesh.md), [Bug Forensics profile](docs/reference/bug-forensics.md), and [Bug Forensics context budget](docs/reference/bug-forensics-context-budget.md).
 - Release assets: [Task templates](templates/tasks/README.md), [Neutrality scanning](docs/reference/neutrality.md), and [Release security](docs/security/release-security.md).

{agent_lifecycle_kit-1.87.0 → agent_lifecycle_kit-1.89.0}/benchmarks/reference-tasks/manifest.json

@@ -3,11 +3,11 @@
   "suiteId": "alk-core-reference",
   "suiteVersion": "1.0.0",
   "tasks": [
-    {"id": "rt01-planning", "version": "1.0.0", "family": "planning", "tier": "S0", "shape": "planning", "taskPath": "rt01-planning/task.md", "oraclePath": "rt01-planning/oracle.json"},
-    {"id": "rt02-architecture-review", "version": "1.0.0", "family": "architecture-review", "tier": "S2", "shape": "review", "taskPath": "rt02-architecture-review/task.md", "oraclePath": "rt02-architecture-review/oracle.json"},
-    {"id": "rt03-bug-forensics", "version": "1.0.0", "family": "bug-forensics", "tier": "S1", "shape": "investigation", "taskPath": "rt03-bug-forensics/task.md", "oraclePath": "rt03-bug-forensics/oracle.json"},
-    {"id": "rt04-s1-managed-task", "version": "1.0.0", "family": "s1-managed-task", "tier": "S1", "shape": "implementation", "taskPath": "rt04-s1-managed-task/task.md", "oraclePath": "rt04-s1-managed-task/oracle.json"},
-    {"id": "rt05-s2-evidence-task", "version": "1.0.0", "family": "s2-evidence-task", "tier": "S2", "shape": "evidence", "taskPath": "rt05-s2-evidence-task/task.md", "oraclePath": "rt05-s2-evidence-task/oracle.json"}
+    {"id": "rt01-planning", "version": "1.0.0", "family": "planning", "tier": "S0", "shape": "planning", "taskPath": "rt01-planning/task.md", "oraclePath": "rt01-planning/oracle.json", "structuredResult": {"operationId": "reference-evaluation", "requiredModes": ["JSON_ENFORCED", "VALIDATED_TEXT"], "fixtureClasses": ["positive", "boundary", "malformed"]}},
+    {"id": "rt02-architecture-review", "version": "1.0.0", "family": "architecture-review", "tier": "S2", "shape": "review", "taskPath": "rt02-architecture-review/task.md", "oraclePath": "rt02-architecture-review/oracle.json", "structuredResult": {"operationId": "reference-evaluation", "requiredModes": ["SCHEMA_ENFORCED", "JSON_ENFORCED"], "fixtureClasses": ["positive", "boundary", "malformed"]}},
+    {"id": "rt03-bug-forensics", "version": "1.0.0", "family": "bug-forensics", "tier": "S1", "shape": "investigation", "taskPath": "rt03-bug-forensics/task.md", "oraclePath": "rt03-bug-forensics/oracle.json", "structuredResult": {"operationId": "reference-evaluation", "requiredModes": ["JSON_ENFORCED", "VALIDATED_TEXT"], "fixtureClasses": ["positive", "boundary", "malformed"]}},
+    {"id": "rt04-s1-managed-task", "version": "1.0.0", "family": "s1-managed-task", "tier": "S1", "shape": "implementation", "taskPath": "rt04-s1-managed-task/task.md", "oraclePath": "rt04-s1-managed-task/oracle.json", "structuredResult": {"operationId": "reference-evaluation", "requiredModes": ["SCHEMA_ENFORCED", "JSON_ENFORCED"], "fixtureClasses": ["positive", "boundary", "malformed"]}},
+    {"id": "rt05-s2-evidence-task", "version": "1.0.0", "family": "s2-evidence-task", "tier": "S2", "shape": "evidence", "taskPath": "rt05-s2-evidence-task/task.md", "oraclePath": "rt05-s2-evidence-task/oracle.json", "structuredResult": {"operationId": "reference-evaluation", "requiredModes": ["SCHEMA_ENFORCED", "JSON_ENFORCED"], "fixtureClasses": ["positive", "boundary", "malformed"]}}
   ],
   "productionPromotionClaimed": false
 }

{agent_lifecycle_kit-1.87.0 → agent_lifecycle_kit-1.89.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "1.87.0"
+version = "1.89.0"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

{agent_lifecycle_kit-1.87.0 → agent_lifecycle_kit-1.89.0}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "1.87.0"
+__version__ = "1.89.0"

agent_lifecycle_kit-1.89.0/src/agent_lifecycle/adapter_sessions/external_check.py

@@ -0,0 +1,346 @@
+"""Run optional external checks through the bounded process boundary."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from agent_lifecycle.adapter_sessions.env import resolve_launch_env
+from agent_lifecycle.adapter_sessions.process import run_process
+from agent_lifecycle.adapter_sessions.worktree_identity import capture_git_worktree_identity
+from agent_lifecycle.audit.external_checks import audit_external_check_result
+from agent_lifecycle.contracts import LifecycleError, canonical_digest, read_json_object
+from agent_lifecycle.contracts.external_check_schemas import (
+    MAX_ARG_BYTES,
+    MAX_OUTPUT_BYTES,
+    build_external_check_descriptor,
+    build_external_check_invocation,
+)
+from agent_lifecycle.contracts.paths import normalize_repo_path, read_stable_repository_file
+from agent_lifecycle.quality.external_checks import normalize_external_check_result
+
+PROFILE_SCHEMA = "agent-external-check-profile.v1"
+MAX_PROFILE_BYTES = 32768
+MAX_SOURCE_FILE_LIST_BYTES = 4 * 1024 * 1024
+MAX_PROFILE_ARG_COUNT = 64
+MAX_PROFILE_TIMEOUT_SECONDS = 3600
+DEFAULT_PROFILE_DIRECTORY = "external-checks"
+SUPPORTED_CHECKS = ("import-boundaries", "module-dependencies", "declared-dependencies")
+
+
+def default_external_check_profile(check_id: str) -> Path:
+    """Return the installed package-data profile for one supported check."""
+
+    if check_id not in SUPPORTED_CHECKS:
+        raise LifecycleError("external-check-profile-unsupported", "external check is not supported")
+    from agent_lifecycle.resources import builtin_profile_path
+
+    return builtin_profile_path(f"{DEFAULT_PROFILE_DIRECTORY}/{check_id}.v1.json")
+
+
+def load_external_check_profile(profile_path: Path) -> dict[str, Any]:
+    """Load and validate one static, provider-neutral external-check profile."""
+
+    try:
+        if profile_path.stat().st_size > MAX_PROFILE_BYTES:
+            raise LifecycleError("external-check-profile-too-large", "external check profile exceeds its byte limit")
+        profile = read_json_object(profile_path, label="external check profile")
+    except OSError as exc:
+        raise LifecycleError("external-check-profile-unavailable", "external check profile is unavailable") from exc
+    _validate_profile(profile)
+    return profile
+
+
+def run_external_check(
+    *,
+    project_root: Path,
+    plan_digest: str,
+    plan_lock_digest: str,
+    operation_id: str,
+    check_id: str,
+    profile_path: Path | None = None,
+    config_path: str | None = None,
+    source_revision: str | None = None,
+    blocking_required: bool = False,
+    process_runner: Any = run_process,
+) -> dict[str, Any]:
+    """Run an explicitly requested check and return only bounded evidence."""
+
+    root = project_root.resolve()
+    profile = load_external_check_profile(profile_path or default_external_check_profile(check_id))
+    if profile["checkId"] != check_id:
+        raise LifecycleError("external-check-profile-mismatch", "profile checkId does not match the request")
+    source_snapshot = _source_snapshot(root, source_revision)
+    selected_config = config_path or profile.get("configPath")
+    config_digest, config_blocker = _config_identity(root, selected_config)
+    descriptor = build_external_check_descriptor(
+        descriptor_id=f"{profile['profileId']}-{source_snapshot['revision'][:12]}",
+        check_id=profile["checkId"],
+        tool_id=profile["toolId"],
+        tool_version=profile["toolVersion"],
+        executable=profile["executable"],
+        argv=list(profile["argv"]),
+        config_digest=config_digest,
+        source_snapshot=source_snapshot,
+        plan_digest=plan_digest,
+        plan_lock_digest=plan_lock_digest,
+        working_directory=profile.get("workingDirectory"),
+        timeout_seconds=profile["timeoutSeconds"],
+        max_output_bytes=profile["maxOutputBytes"],
+        environment_allow=list(profile["environment"]["allow"]),
+    )
+    started_at = _now()
+    env, _env_receipt = resolve_launch_env(
+        {"env": profile["environment"]},
+        process_env=dict(os.environ),
+    )
+    executable = _resolve_executable(profile["executable"], env)
+    if config_blocker is not None:
+        process_payload = _unavailable_payload(config_blocker)
+        invocation_status = "ABORTED"
+    elif executable is None:
+        process_payload = _unavailable_payload({"code": "external-check-executable-unavailable"})
+        invocation_status = "ABORTED"
+    else:
+        process_payload = _run_process(
+            process_runner,
+            profile,
+            root,
+            env,
+            operation_id,
+        )
+        _mark_source_drift(process_payload, root, source_snapshot)
+        invocation_status = "COMPLETED"
+    invocation = build_external_check_invocation(
+        invocation_id=f"{operation_id}-invocation",
+        operation_id=operation_id,
+        descriptor=descriptor,
+        started_at=started_at,
+        status=invocation_status,
+        ended_at=_now(),
+    )
+    normalized = normalize_external_check_result(
+        process_payload,
+        descriptor=descriptor,
+        invocation=invocation,
+        result_id=f"{operation_id}-result",
+    )
+    audit = audit_external_check_result(
+        normalized,
+        descriptor=descriptor,
+        invocation=invocation,
+        blocking_required=blocking_required,
+    )
+    return {
+        "schemaVersion": "agent-external-check-run.v1",
+        "status": normalized["status"],
+        "checkId": check_id,
+        "descriptor": descriptor,
+        "invocation": invocation,
+        "result": normalized,
+        "audit": audit,
+        "productionPromotionClaimed": False,
+    }
+
+
+def _run_process(
+    process_runner: Any,
+    profile: dict[str, Any],
+    root: Path,
+    env: dict[str, str],
+    operation_id: str,
+) -> dict[str, Any]:
+    result = process_runner(
+        list(profile["argv"]),
+        env=env,
+        timeout_seconds=float(profile["timeoutSeconds"]),
+        cwd=root,
+        max_output_bytes=profile["maxOutputBytes"],
+        operation_id=operation_id,
+        attempt_id=operation_id,
+        adapter_id=profile["toolId"],
+    )
+    payload = _parse_output(profile, result)
+    payload.update(
+        {
+            "complete": _process_complete(result),
+            "timedOut": result.get("timedOut") is True,
+            "outputTruncated": result.get("outputLimitExceeded") is True,
+            "processCleanupStatus": _cleanup_status(result),
+            "exitCode": result.get("exitCode"),
+            "stdout": result.get("stdout", ""),
+            "stderr": result.get("stderr", ""),
+        }
+    )
+    return payload
+
+
+def _parse_output(profile: dict[str, Any], result: dict[str, Any]) -> dict[str, Any]:
+    stdout = result.get("stdout")
+    if profile["outputFormat"] == "json" and isinstance(stdout, str):
+        try:
+            parsed = json.loads(stdout)
+        except (json.JSONDecodeError, RecursionError):
+            return {"status": "INVALID", "blockers": [{"code": "external-check-output-json-invalid"}]}
+        if isinstance(parsed, dict):
+            return dict(parsed)
+        return {"status": "INVALID", "blockers": [{"code": "external-check-output-json-not-object"}]}
+    return {"status": "PASS" if result.get("status") == "PASS" else "FAIL", "findings": []}
+
+
+def _unavailable_payload(blocker: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "status": "UNAVAILABLE",
+        "unavailable": True,
+        "complete": False,
+        "timedOut": False,
+        "outputTruncated": False,
+        "processCleanupStatus": "UNAVAILABLE",
+        "exitCode": None,
+        "blockers": [blocker],
+        "findings": [],
+    }
+
+
+def _mark_source_drift(payload: dict[str, Any], root: Path, before: dict[str, Any]) -> None:
+    try:
+        after = _source_snapshot(root, before["revision"])
+    except LifecycleError:
+        payload.setdefault("blockers", []).append({"code": "external-check-source-unavailable-after-run"})
+        payload["status"] = "INVALID"
+        return
+    if after != before:
+        payload.setdefault("blockers", []).append({"code": "external-check-source-drift"})
+        payload["status"] = "FAIL"
+
+
+def _process_complete(result: dict[str, Any]) -> bool:
+    return bool(
+        result.get("processStarted") is True
+        and result.get("timedOut") is False
+        and result.get("outputLimitExceeded") is False
+        and _cleanup_status(result) == "PASS"
+    )
+
+
+def _cleanup_status(result: dict[str, Any]) -> str:
+    cleanup = result.get("cleanup")
+    status = cleanup.get("status") if isinstance(cleanup, dict) else None
+    return status if status in {"PASS", "FAIL", "UNAVAILABLE"} else "UNAVAILABLE"
+
+
+def _resolve_executable(executable: str, env: dict[str, str]) -> Path | None:
+    candidate = Path(executable)
+    if candidate.is_absolute():
+        return candidate if candidate.is_file() else None
+    resolved = shutil.which(executable, path=env.get("PATH"))
+    return Path(resolved) if resolved else None
+
+
+def _source_snapshot(root: Path, revision: str | None) -> dict[str, Any]:
+    identity = capture_git_worktree_identity(root)
+    resolved_revision = revision or identity["head"]
+    if resolved_revision != identity["head"]:
+        raise LifecycleError("external-check-source-revision-mismatch", "requested source revision is not HEAD")
+    paths = _source_paths(root)
+    return {
+        "revision": identity["head"],
+        "fileSetDigest": canonical_digest({"paths": paths}),
+        "workingTreeDigest": identity["identityDigest"],
+    }
+
+
+def _source_paths(root: Path) -> list[str]:
+    try:
+        completed = subprocess.run(
+            ["git", "ls-files", "--cached", "--others", "--exclude-standard", "-z"],
+            cwd=root,
+            shell=False,
+            stdin=subprocess.DEVNULL,
+            capture_output=True,
+            timeout=30,
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise LifecycleError("external-check-source-unavailable", "source file set could not be captured") from exc
+    if completed.returncode != 0 or len(completed.stdout) > MAX_SOURCE_FILE_LIST_BYTES:
+        raise LifecycleError("external-check-source-unavailable", "source file set could not be captured")
+    try:
+        paths = [item.decode("utf-8") for item in completed.stdout.split(b"\0") if item]
+        return sorted(normalize_repo_path(item, label="source file") for item in paths)
+    except (LifecycleError, UnicodeDecodeError) as exc:
+        raise LifecycleError("external-check-source-invalid", "source file set is invalid") from exc
+
+
+def _config_identity(root: Path, config_path: str | None) -> tuple[str, dict[str, Any] | None]:
+    if config_path is None:
+        return canonical_digest({"config": None}), None
+    try:
+        normalized = normalize_repo_path(config_path, label="external check config")
+        data = read_stable_repository_file(root, normalized, max_bytes=MAX_OUTPUT_BYTES, label="external check config")
+    except LifecycleError as exc:
+        return canonical_digest({"config": config_path, "status": "UNAVAILABLE"}), {"code": exc.code}
+    return hashlib.sha256(data).hexdigest(), None
+
+
+def _validate_profile(profile: dict[str, Any]) -> None:
+    required = (
+        "profileId",
+        "checkId",
+        "toolId",
+        "toolVersion",
+        "executable",
+        "argv",
+        "timeoutSeconds",
+        "maxOutputBytes",
+        "environment",
+        "outputFormat",
+    )
+    if profile.get("schemaVersion") != PROFILE_SCHEMA or any(
+        not isinstance(profile.get(item), str) or not profile[item] for item in required[:5]
+    ):
+        raise LifecycleError("external-check-profile-invalid", "external check profile identity is invalid")
+    argv = profile.get("argv")
+    if not isinstance(argv, list) or not 1 <= len(argv) <= MAX_PROFILE_ARG_COUNT or argv[0] != profile["executable"]:
+        raise LifecycleError("external-check-profile-invalid", "external check profile argv is invalid")
+    if any(
+        not isinstance(item, str) or not item or "\x00" in item or len(item.encode()) > MAX_ARG_BYTES
+        for item in argv
+    ):
+        raise LifecycleError("external-check-profile-invalid", "external check profile argv is invalid")
+    if (
+        not isinstance(profile.get("timeoutSeconds"), int)
+        or not 1 <= profile["timeoutSeconds"] <= MAX_PROFILE_TIMEOUT_SECONDS
+    ):
+        raise LifecycleError("external-check-profile-invalid", "external check profile timeout is invalid")
+    if not isinstance(profile.get("maxOutputBytes"), int) or not 1 <= profile["maxOutputBytes"] <= MAX_OUTPUT_BYTES:
+        raise LifecycleError("external-check-profile-invalid", "external check profile output limit is invalid")
+    environment = profile.get("environment")
+    if (
+        not isinstance(environment, dict)
+        or not isinstance(environment.get("allow"), list)
+        or environment.get("allowPatterns") != []
+    ):
+        raise LifecycleError("external-check-profile-invalid", "external check profile environment is invalid")
+    if not all(isinstance(item, str) and item for item in environment["allow"]):
+        raise LifecycleError("external-check-profile-invalid", "external check profile environment is invalid")
+    if profile.get("outputFormat") not in {"text", "json"}:
+        raise LifecycleError("external-check-profile-invalid", "external check profile output format is invalid")
+    config_path = profile.get("configPath")
+    if config_path is not None:
+        normalize_repo_path(config_path, label="external check config")
+    if profile.get("workingDirectory") is not None:
+        normalize_repo_path(profile["workingDirectory"], label="external check working directory")
+
+
+def _now() -> str:
+    return datetime.now(UTC).isoformat().replace("+00:00", "Z")
+
+
+__all__ = ["SUPPORTED_CHECKS", "default_external_check_profile", "load_external_check_profile", "run_external_check"]