clm-kernel 0.0.0__py3-none-any.whl

clm/layer1/verifier.py

@@ -0,0 +1,772 @@
+"""CLM Verifier — Pre/post condition verification, identity bootstrapping, and type validation.
+
+Handles the execution lifecycle gates:
+- verify_precondition: integrity check + agent bootstrap + type validation
+- validate_postcondition: seal result as VCard execution MCard
+- emit_exec_mcard_py: emit execution MCard to Tri-Database
+- resolve_active_hashes_py: resolve A-hash / C-hash pair from manifest
+- check_precondition_py: runtime requirement guard (e.g. interpreter:python>=3.9)
+- normalize_output_py: output normalization helper
+"""
+
+import asyncio
+import json
+import logging
+import os
+import subprocess
+import sys
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+import base58
+import yaml
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ed25519
+
+try:
+    from clm.layer0.model.card import MCard
+except ImportError:
+    from clm.layer0.mcard import MCard
+
+from clm.cross_cutting.clm_logger import get_logger
+from clm.layer0.narrative import Writer
+from clm.layer0.utils import (
+    clm_hash_file,
+    clm_hash_string,
+    get_bash_command,
+    prefixed_hash_raw,
+    resolve_clm_path,
+)
+from clm.layer0.verifier_core import (  # re-export for backward compat
+    emit_exec_mcard_py as _emit_exec_mcard_py_core,
+)
+from clm.layer0.verifier_core import (
+    verify_precondition as _verify_precondition_core,
+)
+
+_logger = get_logger("clm.layer1.verifier")
+
+
+# Lazy load algebra helpers to avoid circular dependencies
+def get_load_manifest_str() -> Callable:
+    """
+    Lazy loads the manifest string loader from algebra.py to avoid circular dependencies.
+    """
+    from clm.layer0.algebra import load_normalized_manifest_str
+    return load_normalized_manifest_str
+
+def get_load_manifest() -> Callable:
+    """
+    Lazy loads the manifest parser from algebra.py.
+    """
+    from clm.layer0.algebra import load_normalized_manifest
+    return load_normalized_manifest
+
+
+def verify_precondition(clm_root: str, clm_file: str) -> bool:
+    """
+    Validates the precondition bounds and zero-trust identity before executing a PCard.
+
+    Delegates to clm.layer0.verifier_core.verify_precondition (Sprint 143 V-1 fix).
+    """
+    return _verify_precondition_core(clm_root, clm_file)
+
+def emit_exec_mcard_py(clm_root: str, operation: str, content_hash: str, extra_yaml: str = "", a_hash: str = "", c_hash: str = "") -> str:
+    """
+    Emits an Execution MCard to the Tri-Database to track state changes.
+
+    Delegates to clm.layer0.verifier_core.emit_exec_mcard_py (Sprint 143 V-1 fix).
+    """
+    return _emit_exec_mcard_py_core(clm_root, operation, content_hash, extra_yaml, a_hash, c_hash)
+
+def resolve_active_hashes_py(clm_file: str) -> tuple[str | None, str | None]:
+    """
+    Resolves the abstract and concrete hashes from a CLM manifest.
+
+    Args:
+        clm_file (str): The CLM manifest file.
+
+    Returns:
+        Tuple[Optional[str], Optional[str]]: A tuple containing the a_hash and c_hash, or (None, None) if parsing fails.
+    """
+    load_normalized_manifest_fn = get_load_manifest()
+    try:
+        clm_root = os.environ.get("CLM_ROOT") or os.getcwd()
+        yaml_data = load_normalized_manifest_fn(clm_root, clm_file)
+        inner = yaml_data.get("clm", yaml_data)
+        abstract_spec = inner.get("abstract_spec")
+        concrete_impl = inner.get("concrete_impl")
+        if not abstract_spec or not concrete_impl:
+            return None, None
+
+        import copy
+        c_clean = copy.deepcopy(concrete_impl)
+        if "precondition" in c_clean and isinstance(c_clean["precondition"], dict):
+            c_clean["precondition"].pop("vcard_pre", None)
+        if "postcondition" in c_clean and isinstance(c_clean["postcondition"], dict):
+            c_clean["postcondition"].pop("vcard_post", None)
+
+        a_json = json.dumps(abstract_spec, separators=(',', ':'))
+        a_hash = clm_hash_string(a_json)
+
+        c_clean["a_hash"] = prefixed_hash_raw(a_hash)
+        c_json = json.dumps(c_clean, separators=(',', ':'))
+        c_hash = clm_hash_string(c_json)
+        return prefixed_hash_raw(a_hash), prefixed_hash_raw(c_hash)
+    except Exception as e:
+        _logger.info(f"[RESOLVE] Failed to resolve active hashes: {e}")
+        return None, None
+
+def validate_postcondition(clm_root: str, clm_file: str, eval_rc: int) -> bool:
+    """
+    Validates the postcondition invariants and emits a signed VCard to seal the result.
+
+    Args:
+        clm_root (str): The root directory of the CLM workspace.
+        clm_file (str): The PCard file.
+        eval_rc (int): The exit code from the execution layer.
+
+    Returns:
+        bool: True if the postcondition was validated, False otherwise.
+    """
+    load_normalized_manifest_fn = get_load_manifest()
+    clm_file = resolve_clm_path(clm_root, clm_file)
+    content = ""
+    exec_out = os.environ.get("_EXEC_OUT")
+    if exec_out and os.path.exists(exec_out) and os.path.getsize(exec_out) > 0:
+        with open(exec_out, encoding="utf-8") as f:
+            lines = f.readlines()
+        if len(lines) < 5:
+            content = " ".join([ln.strip() for ln in lines]).replace('"', '').replace('\\', '')
+        else:
+            content = prefixed_hash_raw(clm_hash_file(exec_out))
+    else:
+        content = f"exit code: {eval_rc}"
+
+    content_hash = clm_hash_string(content)
+    extra_yaml = f"content: \"{content}\""
+    operation = "validate_postcondition"
+
+    if clm_file and os.path.exists(clm_file):
+        try:
+            yaml_data = load_normalized_manifest_fn(clm_root, clm_file)
+            inner = yaml_data.get("clm", yaml_data)
+            operation = inner.get("concrete_impl", {}).get("operation", "unknown")
+        except Exception:
+            operation = "unknown"
+        impl_hash = clm_hash_file(clm_file)
+        extra_yaml += f"\noperation: \"{operation}\"\nimpl_hash: \"{impl_hash}\""
+
+    a_hash, c_hash = None, None
+    if clm_file and os.path.exists(clm_file):
+        a_hash, c_hash = resolve_active_hashes_py(clm_file)
+
+    mcard_file = emit_exec_mcard_py(clm_root, operation, content_hash, extra_yaml, a_hash or "", c_hash or "")
+    os.environ["CLM_LAST_MCARD_FILE"] = mcard_file
+    os.environ["CLM_LAST_MCARD_HASH"] = content_hash
+    _logger.info(f"[VCARD POST] ✅ Execution MCard generated: {mcard_file}")
+    _logger.info(f"[VCARD POST]   content_hash: {content_hash}")
+    return True
+
+def check_precondition_py(req_string: str) -> bool:
+    """
+    Evaluates a runtime requirement string (e.g. interpreter:python>=3.9) against the current host environment.
+
+    Args:
+        req_string (str): The requirement string.
+
+    Returns:
+        bool: True if the requirement is satisfied, False otherwise.
+    """
+    import re
+    m = re.match(r"^interpreter:([a-zA-Z0-9_-]+)(>=|<=|>|<|==|=)([0-9.]+)$", req_string)
+    if not m:
+        return True
+    interpreter, op, req_ver = m.groups()
+
+    current_ver = ""
+    if interpreter == "python":
+        current_ver = ".".join(map(str, sys.version_info[:3]))
+    elif interpreter in ("shell", "bash"):
+        try:
+            proc = subprocess.Popen([get_bash_command(), "-c", "echo $BASH_VERSION"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8")
+            stdout_data, _ = proc.communicate()
+            current_ver = stdout_data.strip().split("(")[0]
+        except Exception:
+            return False
+    elif interpreter == "node":
+        try:
+            proc = subprocess.Popen(["node", "-v"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8")
+            stdout_data, _ = proc.communicate()
+            current_ver = stdout_data.strip().lstrip("v")
+        except Exception:
+            return False
+    elif interpreter == "rustc":
+        try:
+            proc = subprocess.Popen(["rustc", "--version"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8")
+            stdout_data, _ = proc.communicate()
+            parts = stdout_data.strip().split()
+            if len(parts) >= 2:
+                current_ver = parts[1]
+                import tempfile
+                with tempfile.TemporaryDirectory() as tmpdir:
+                    test_src = os.path.join(tmpdir, "chk.rs")
+                    test_bin = os.path.join(tmpdir, "chk.exe" if sys.platform == "win32" else "chk")
+                    with open(test_src, "w") as f:
+                        f.write('fn main(){println!("1");}')
+                    c_proc = subprocess.Popen(["rustc", "-O", "-o", test_bin, test_src], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                    c_proc.communicate()
+                    if c_proc.returncode != 0:
+                        return False
+        except Exception:
+            return False
+    else:
+        import shutil
+        return shutil.which(interpreter) is not None
+
+    def parse_version(v_str):
+        m_v = re.search(r"(\d+)\.(\d+)(?:\.(\d+))?", v_str)
+        if not m_v:
+            return (0, 0, 0)
+        return (int(m_v.group(1)), int(m_v.group(2)), int(m_v.group(3)) if m_v.group(3) else 0)
+
+    try:
+        v1 = parse_version(current_ver)
+        v2 = parse_version(req_ver)
+        ops = {">=": v1 >= v2, "<=": v1 <= v2, ">": v1 > v2, "<": v1 < v2}
+        return ops.get(op, v1 == v2)
+    except Exception:
+        return False
+
+def normalize_output_py(raw_out: str) -> str:
+    """
+    Normalizes command output by stripping returns and sorting JSON keys.
+
+    Args:
+        raw_out (str): The raw standard output string.
+
+    Returns:
+        str: The normalized string.
+    """
+    stripped = raw_out.replace("\r", "").rstrip()
+    try:
+        parsed = json.loads(stripped)
+        return json.dumps(parsed, sort_keys=True, separators=(",", ":"))
+    except Exception:
+        return stripped
+
+
+def pem_to_did(pem_bytes: bytes) -> str:
+    pubkey = serialization.load_pem_public_key(pem_bytes)
+    raw_bytes = pubkey.public_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PublicFormat.Raw
+    )
+    multicodec = b'\xed\x01' + raw_bytes
+    return 'did:key:z' + base58.b58encode(multicodec).decode('utf-8')
+
+
+def did_to_pubkey(did: str) -> ed25519.Ed25519PublicKey:
+    if not did.startswith('did:key:z'):
+        raise ValueError('Unsupported DID method: ' + did)
+    b58_part = did[9:]
+    decoded = base58.b58decode(b58_part)
+    if decoded[0] != 0xed or decoded[1] != 0x01:
+        raise ValueError('Unsupported multicodec identifier in did:key')
+    raw_key = decoded[2:]
+    return ed25519.Ed25519PublicKey.from_public_bytes(raw_key)
+
+
+def clm_derive_session_key() -> dict:
+    private_key = ed25519.Ed25519PrivateKey.generate()
+    public_key = private_key.public_key()
+
+    private_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption()
+    ).decode('utf-8')
+
+    public_pem = public_key.public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo
+    ).decode('utf-8')
+
+    did = pem_to_did(public_pem.encode('utf-8'))
+
+    return {
+        "private_key": private_pem,
+        "public_key": public_pem,
+        "did": did
+    }
+
+
+def clm_issue_delegation(parent_private_key_path: str, session_did: str, ttl: int = 3600, capabilities: str = "exec") -> str:
+    with open(parent_private_key_path, "rb") as f:
+        parent_priv = serialization.load_pem_private_key(f.read(), password=None)
+
+    parent_pub = parent_priv.public_key()
+    parent_pub_pem = parent_pub.public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo
+    )
+    parent_did = pem_to_did(parent_pub_pem)
+
+    import datetime
+    expires_at = (datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(seconds=ttl)).isoformat()
+    if expires_at.endswith('+00:00'):
+        expires_at = expires_at[:-6] + 'Z'
+    elif '+' not in expires_at and '-' not in expires_at[-6:] and not expires_at.endswith('Z'):
+        expires_at = expires_at + 'Z'
+
+    payload = f"{parent_did}|{session_did}|{expires_at}|{capabilities}"
+    signature = parent_priv.sign(payload.encode('utf-8'))
+    signature_hex = signature.hex()
+
+    caps_list = [c.strip() for c in capabilities.split(",") if c.strip()]
+
+    delegation_data = {
+        "session_delegation": {
+            "type": "meta/session_delegation",
+            "parent_did": parent_did,
+            "session_did": session_did,
+            "expires_at": expires_at,
+            "capabilities": caps_list,
+            "signature": f"ed25519:{signature_hex}"
+        }
+    }
+    return yaml.dump(delegation_data, default_flow_style=False)
+
+
+def clm_verify_delegation(cert_yaml: str, expected_session_did: str = None, expected_cap: str = None) -> bool:
+    try:
+        data = yaml.safe_load(cert_yaml)
+        sd = data.get("session_delegation", {})
+        parent_did = sd.get("parent_did")
+        session_did = sd.get("session_did")
+        expires_at = sd.get("expires_at")
+        signature = sd.get("signature")
+        capabilities = sd.get("capabilities", [])
+    except Exception:
+        return False
+
+    if not all([parent_did, session_did, expires_at, signature]):
+        return False
+
+    if expected_session_did and session_did != expected_session_did:
+        return False
+
+    if expected_cap and expected_cap not in capabilities:
+        return False
+
+    import datetime
+    try:
+        exp_str = expires_at
+        if exp_str.endswith('Z'):
+            exp_str = exp_str[:-1] + '+00:00'
+        exp_dt = datetime.datetime.fromisoformat(exp_str)
+        now_dt = datetime.datetime.now(datetime.timezone.utc)
+        if now_dt > exp_dt:
+            return False
+    except Exception:
+        return False
+
+    try:
+        caps_comma = ",".join(capabilities)
+        payload = f"{parent_did}|{session_did}|{expires_at}|{caps_comma}"
+
+        signature_hex = signature.split("ed25519:")[1]
+        signature_bytes = bytes.fromhex(signature_hex)
+
+        parent_pub = did_to_pubkey(parent_did)
+        parent_pub.verify(signature_bytes, payload.encode('utf-8'))
+
+        os.environ["CLM_DELEGATED_PARENT_DID"] = parent_did
+        return True
+    except Exception:
+        return False
+
+
+@dataclass
+class VerificationResult:
+    """Result of CLM verification"""
+
+    is_valid: bool
+    abstract_valid: bool
+    concrete_valid: bool
+    balanced_valid: bool
+    errors: list[str]
+    warnings: list[str]
+    verification_details: dict[str, Any]
+
+
+class CLMVerifier:
+    """
+    Verifier for the Cubical Logic Model.
+
+    Ensures that every PCard maintains consistency between:
+    1. Abstract Specification (WHAT - the specification)
+    2. Concrete Implementation (HOW - the implementation)
+    3. Balanced Expectations (WHY - the verification proofs)
+    """
+
+    def __init__(self, engine):
+        self.engine = engine
+        self.logger = logging.getLogger(__name__)
+        self.verification_cache = {}
+
+    def verify_clm_consistency(
+        self, pcard: MCard, target: MCard, context: dict[str, Any] | None = None
+    ) -> VerificationResult:
+        """
+        Verify CLM consistency for a PCard-target pair.
+
+        This implements the core verification workflow:
+        1. Load PCard and extract CLM dimensions
+        2. Verify Abstract Specification
+        3. Verify Concrete Implementation
+        4. Verify Balanced Expectations
+        5. Check cross-dimensional consistency
+        """
+        context = context or {}
+        errors = []
+        warnings = []
+        details = {}
+
+        try:
+            # Step 1: Parse PCard content
+            pcard_content = pcard.get_content().decode("utf-8")
+            pcard_data = yaml.safe_load(pcard_content)
+
+            if not isinstance(pcard_data, dict):
+                raise ValueError("PCard content must be a YAML dictionary")
+
+            # Extract CLM base (it might be nested under a 'clm' key)
+            clm_base = pcard_data.get("clm", pcard_data)
+
+            # Extract CLM dimensions (with aliases)
+            abstract = clm_base.get("abstract_spec", clm_base.get("abstract", {}))
+            concrete = clm_base.get("concrete_impl", clm_base.get("concrete", {}))
+            balanced = clm_base.get("balanced_exp", clm_base.get("balanced", {}))
+
+            self.logger.info(f"Verifying CLM dimensions for PCard {pcard.hash}")
+            self.logger.info(f"PCard keys: {list(pcard_data.keys())}")
+            self.logger.info(f"Abstract keys: {list(abstract.keys())}")
+
+            # Step 2: Verify Abstract Specification (Writer Monad)
+            abstract_writer = self._verify_abstract(abstract, target, context)
+            abstract_details, abstract_errors = abstract_writer.run()
+
+            errors.extend(abstract_errors)
+            details["abstract"] = abstract_details
+            abstract_valid = len(abstract_errors) == 0
+
+            # Step 3: Verify Concrete Implementation (Writer Monad)
+            concrete_writer = self._verify_concrete(concrete, abstract, target, context)
+            concrete_details, concrete_errors = concrete_writer.run()
+
+            errors.extend(concrete_errors)
+            details["concrete"] = concrete_details
+            concrete_valid = len(concrete_errors) == 0
+
+            # Step 4: Verify Balanced Expectations (Writer Monad)
+            balanced_writer = self._verify_balanced(
+                balanced, abstract, concrete, target, context
+            )
+            balanced_details, balanced_errors = balanced_writer.run()
+
+            errors.extend(balanced_errors)
+            details["balanced"] = balanced_details
+            balanced_valid = len(balanced_errors) == 0
+
+            # Step 5: Check cross-dimensional consistency (Writer Monad)
+            consistency_writer = self._verify_cross_consistency(
+                abstract, concrete, balanced
+            )
+            consistency_valid_flag, consistency_errors = consistency_writer.run()
+
+            errors.extend(consistency_errors)
+            consistency_valid = consistency_valid_flag and len(consistency_errors) == 0
+
+            details["cross_consistency"] = {
+                "valid": consistency_valid,
+                "errors": consistency_errors,
+            }
+
+            # Overall validity
+            is_valid = (
+                abstract_valid
+                and concrete_valid
+                and balanced_valid
+                and consistency_valid
+            )
+
+            if is_valid:
+                self.logger.info(f"CLM verification PASSED for PCard {pcard.hash}")
+            else:
+                self.logger.warning(
+                    f"CLM verification FAILED for PCard {pcard.hash}: {errors}"
+                )
+
+            return VerificationResult(
+                is_valid=is_valid,
+                abstract_valid=abstract_valid,
+                concrete_valid=concrete_valid,
+                balanced_valid=balanced_valid,
+                errors=errors,
+                warnings=warnings,
+                verification_details=details,
+            )
+
+        except (
+            yaml.YAMLError,
+            UnicodeDecodeError,
+            ValueError,
+            TypeError,
+            KeyError,
+            AttributeError,
+        ) as e:
+            self.logger.error(f"CLM verification error: {str(e)}", exc_info=True)
+            return VerificationResult(
+                is_valid=False,
+                abstract_valid=False,
+                concrete_valid=False,
+                balanced_valid=False,
+                errors=[f"Verification error: {str(e)}"],
+                warnings=[],
+                verification_details={},
+            )
+
+    async def averify_clm_consistency(
+        self, pcard: MCard, target: MCard, context: dict[str, Any] | None = None
+    ) -> VerificationResult:
+        """Async wrapper for verify_clm_consistency using a thread pool."""
+        return await asyncio.to_thread(
+            self.verify_clm_consistency, pcard, target, context
+        )
+
+    def _verify_abstract(
+        self, abstract: dict[str, Any], target: MCard, context: dict[str, Any]
+    ) -> Writer[str, dict[str, Any]]:
+        """
+        Verify the Abstract Specification dimension using Writer Monad.
+        Returns Writer(details, errors).
+        """
+        errors = []
+        details = {}
+
+        # Check required abstract fields
+        required_fields = [
+            "purpose",
+            "inputs",
+            "outputs",
+            "preconditions",
+            "postconditions",
+        ]
+        for field in required_fields:
+            if field not in abstract:
+                errors.append(f"Missing required abstract field: {field}")
+
+        # Validate input/output specifications
+        inputs = abstract.get("inputs", {})
+        outputs = abstract.get("outputs", {})
+
+        if not isinstance(inputs, dict):
+            errors.append("Abstract inputs must be a dictionary")
+        else:
+            details["input_count"] = len(inputs)
+
+        if not isinstance(outputs, dict):
+            errors.append("Abstract outputs must be a dictionary")
+        else:
+            details["output_count"] = len(outputs)
+
+        # Validate preconditions and postconditions
+        preconditions = abstract.get("preconditions", [])
+        postconditions = abstract.get("postconditions", [])
+
+        if not isinstance(preconditions, list):
+            errors.append("Abstract preconditions must be a list")
+        else:
+            details["precondition_count"] = len(preconditions)
+
+        if not isinstance(postconditions, list):
+            errors.append("Abstract postconditions must be a list")
+        else:
+            details["postcondition_count"] = len(postconditions)
+
+        # Check semantic consistency
+        purpose = abstract.get("purpose", "")
+        if len(purpose) < 10:
+            errors.append("Abstract purpose should be descriptive (min 10 characters)")
+
+        details["purpose_length"] = len(purpose)
+
+        return Writer(lambda: (details, errors))
+
+    def _verify_concrete(
+        self,
+        concrete: dict[str, Any],
+        abstract: dict[str, Any],
+        target: MCard,
+        context: dict[str, Any],
+    ) -> Writer[str, dict[str, Any]]:
+        """
+        Verify the Concrete Implementation dimension using Writer Monad.
+        Returns Writer(details, errors).
+        """
+        errors = []
+        details = {}
+
+        # Check required concrete fields
+        if "operation" not in concrete:
+            errors.append("Missing required concrete field: operation")
+
+        # Validate operation matches abstract purpose
+        operation = concrete.get("operation", "")
+        abstract_purpose = abstract.get("purpose", "").lower()
+
+        if operation and abstract_purpose:
+            # Simple semantic check - in production would use NLP
+            if "transform" in abstract_purpose and "transform" not in operation:
+                errors.append("Concrete operation doesn't match abstract purpose")
+
+        details["operation"] = operation
+
+        # Check implementation details
+        implementation = concrete.get("implementation", {})
+        if not isinstance(implementation, dict):
+            errors.append("Concrete implementation must be a dictionary")
+        else:
+            details["implementation_keys"] = list(implementation.keys())
+
+        # Validate resource requirements
+        resources = concrete.get("resources", {})
+        if resources:
+            if not isinstance(resources, dict):
+                errors.append("Concrete resources must be a dictionary")
+            else:
+                details["resource_requirements"] = resources
+
+        # Check error handling
+        error_handling = concrete.get("error_handling", {})
+        if error_handling and not isinstance(error_handling, dict):
+            errors.append("Concrete error_handling must be a dictionary")
+
+        return Writer(lambda: (details, errors))
+
+    def _verify_balanced(
+        self,
+        balanced: dict[str, Any],
+        abstract: dict[str, Any],
+        concrete: dict[str, Any],
+        target: MCard,
+        context: dict[str, Any],
+    ) -> Writer[str, dict[str, Any]]:
+        """
+        Verify the Balanced Expectations dimension using Writer Monad.
+        Returns Writer(details, errors).
+        """
+        errors = []
+        details = {}
+
+        # Check required balanced fields
+        required_fields = ["test_cases", "expectations"]
+        for field in required_fields:
+            if field not in balanced:
+                errors.append(f"Missing required balanced field: {field}")
+
+        # Validate test cases
+        test_cases = balanced.get("test_cases", [])
+        if not isinstance(test_cases, list):
+            errors.append("Balanced test_cases must be a list")
+        else:
+            details["test_case_count"] = len(test_cases)
+
+            # Validate each test case structure
+            for i, test_case in enumerate(test_cases):
+                if not isinstance(test_case, dict):
+                    errors.append(f"Test case {i} must be a dictionary")
+                    continue
+
+                # Check for either BDD ('given', 'when', 'then') or ABC ('assumption', 'behavior', 'confirmation')
+                has_bdd = all(field in test_case for field in ["given", "when", "then"])
+                has_abc = all(
+                    field in test_case
+                    for field in ["assumption", "behavior", "confirmation"]
+                )
+
+                if not (has_bdd or has_abc):
+                    errors.append(
+                        f"Test case {i} missing required routing fields (BDD given/when/then or ABC assumption/behavior/confirmation)"
+                    )
+
+        # Validate expectations
+        expectations = balanced.get("expectations", {})
+        if not isinstance(expectations, dict):
+            errors.append("Balanced expectations must be a dictionary")
+        else:
+            details["expectation_keys"] = list(expectations.keys())
+
+            # Check performance expectations
+            performance = expectations.get("performance", {})
+            if performance:
+                if not isinstance(performance, dict):
+                    errors.append("Performance expectations must be a dictionary")
+                else:
+                    details["performance_expectations"] = performance
+
+            # Check quality metrics
+            quality = expectations.get("quality", {})
+            if quality:
+                if not isinstance(quality, dict):
+                    errors.append("Quality expectations must be a dictionary")
+                else:
+                    details["quality_expectations"] = quality
+
+        return Writer(lambda: (details, errors))
+
+    def _verify_cross_consistency(
+        self,
+        abstract: dict[str, Any],
+        concrete: dict[str, Any],
+        balanced: dict[str, Any],
+    ) -> Writer[str, bool]:
+        """
+        Verify cross-dimensional consistency between CLM dimensions using Writer Monad.
+        Returns Writer(valid_flag, errors).
+
+        Note: This is intentionally lenient to match JavaScript CLMRunner behavior,
+        which doesn't perform strict abstract/concrete input matching.
+        """
+        errors = []
+        valid = len(errors) == 0
+        return Writer(lambda: (valid, errors))
+
+
+__all__ = [
+    "verify_precondition",
+    "emit_exec_mcard_py",
+    "resolve_active_hashes_py",
+    "validate_postcondition",
+    "check_precondition_py",
+    "normalize_output_py",
+    "pem_to_did",
+    "did_to_pubkey",
+    "clm_derive_session_key",
+    "clm_issue_delegation",
+    "clm_verify_delegation",
+    "VerificationResult",
+    "CLMVerifier",
+]
+
+# Register manifest evaluator with native layer (Dependency Inversion for layer stratification)
+try:
+    from clm.cross_cutting.native import register_manifest_evaluator
+    from clm.layer1.gate_composer import run_nested_evaluate
+
+    register_manifest_evaluator(run_nested_evaluate)
+except ImportError:
+    pass
+