forge-autonomy 2.3.2__tar.gz → 2.7.20__tar.gz

{forge_autonomy-2.3.2 → forge_autonomy-2.7.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forge-autonomy
-Version: 2.3.2
+Version: 2.7.20
 Summary: Forge mission planning, producer contracts, and evidence interpretation runtime.
 Author: Forge maintainers
 License-Expression: Apache-2.0
@@ -32,6 +32,97 @@ forge --version
 qualification verify that its value equals the wheel metadata and installed
 CLI version; a package build never allocates or changes a version.
 
+## Engineering Platform peer configuration
+
+Forge provides one explicit, durable configuration route for its selected
+Engineering Platform Execution Host peer. Initialize the chosen Forge data
+root first, then configure only already-issued identities and an opaque macOS
+Keychain reference:
+
+```text
+forge --data-root "/path/to/Forge Server" server init
+forge --data-root "/path/to/Forge Server" execution-host configure \
+  --binding-id ep-primary \
+  --endpoint https://ep.example.invalid \
+  --expected-instance-id ep-instance-1 \
+  --host-id engineering-platform \
+  --project-id forge-project \
+  --repository-id forge-repository \
+  --repository-identity forge-source \
+  --credential-reference keychain://forge.ep/consumer \
+  --operator-id local-admin
+forge --data-root "/path/to/Forge Server" execution-host show
+forge --data-root "/path/to/Forge Server" execution-host preflight
+```
+
+`--repository-id` is the EP repository ID. `--repository-identity` is the
+Forge-side identity that every `ExecutionRequest.repository_identity` must
+repeat (legacy callers default it to their repository ID). No project,
+repository, consumer credential, Mission, grant, or submission is created by
+these commands.
+
+The only supported credential-reference backend is macOS Keychain generic
+password lookup. Its exact form is
+`keychain://<service>/<account>?namespace=<optional>&version=<optional>`; the
+query values are reference metadata and lookup remains fixed to the explicit
+service/account pair. Put the bearer value in that Keychain item through the
+operator's normal Keychain administration, never on the Forge command line.
+Forge persists and prints the reference, never its value. Unknown schemes,
+missing items, unavailable or access-denied Keychain state fail closed without
+credential discovery or fallback.
+
+### Explicit first Keychain access
+
+Before a full EP peer binding exists, a local administrator can explicitly ask
+macOS to perform exactly one read of one already-known credential reference:
+
+```text
+forge execution-host credential-access \
+  --interactive \
+  --credential-reference keychain://forge.ep/consumer
+```
+
+This is a bounded access-setup action, not general onboarding: it does not
+initialize a data root, create or modify a peer binding, issue an EP
+credential, create a grant, configure a provider, or submit any work. The
+reference is validated before the one existing Keychain reader is called. The
+`--interactive` opt-in is mandatory; without it Forge never asks macOS and
+does not retry or fall back to an interactive read.
+
+The setup read waits for at most 120 seconds (adjustable downward with
+`--timeout-seconds`). Forge tells the local user that macOS may ask for
+Keychain access by `/usr/bin/security`, which is the executable that actually
+requests this read. That macOS decision is not a cryptographically
+Forge-exclusive permission; Forge neither automates the prompt nor changes
+Keychain ACLs, partition lists, search domains, entitlements, or signing.
+The command returns only a status and redacted diagnostic, never credential
+material.
+
+Normal installed runtime resolution remains a separate, short 5-second read.
+It never increases its timeout, retries, chooses another Keychain item, or
+switches itself to interactive mode. `TIMEOUT` means only that the Keychain
+subprocess did not finish within its bound; it does not by itself prove denial,
+an open prompt, a missing Keychain, or an entitlement problem. Diagnostics
+distinguish `TIMEOUT`, `PROCESS_START_FAILED`, `MISSING`, `ACCESS_DENIED`, and
+`COMMAND_FAILED`, while all non-resolvable states fail closed. A successful
+`INTERACTIVE_CREDENTIAL_READ_SUCCEEDED` result does not claim that a fresh
+normal process can read the item or that EP authentication succeeded; those
+are separate proofs.
+
+HTTPS uses normal certificate validation. Plain HTTP requires both a loopback
+origin and `--allow-loopback-http`. URL credentials, paths, queries, fragments,
+redirects, unbounded timeouts, discovery and retargeting are rejected. To
+replace a binding, repeat `configure` with `--replace` plus both the current
+`--expected-revision` and `--expected-digest` from `show`; identical writes are
+idempotent. `show`, `status`, and `preflight` do not initialize or migrate
+storage. Preflight performs only authenticated
+`GET /v1/producer-compatibility`, verifies product, exact instance ID, and the
+explicit `1.2` readback and `1.4` terminal-evidence contracts, and reports project/repository and
+mutation authority as `NOT_VERIFIED` because that route does not prove them.
+The exact instance-ID comparison is consistency evidence, not a newly invented
+cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
+`CONFIGURED` is therefore never presented as `LIVE_READY`.
+
 ## Managed repository status
 
 Forge is the first-class repository [`pcvantol/forge`](https://github.com/pcvantol/forge),

{forge_autonomy-2.3.2 → forge_autonomy-2.7.20}/README.md

@@ -15,6 +15,97 @@ forge --version
 qualification verify that its value equals the wheel metadata and installed
 CLI version; a package build never allocates or changes a version.
 
+## Engineering Platform peer configuration
+
+Forge provides one explicit, durable configuration route for its selected
+Engineering Platform Execution Host peer. Initialize the chosen Forge data
+root first, then configure only already-issued identities and an opaque macOS
+Keychain reference:
+
+```text
+forge --data-root "/path/to/Forge Server" server init
+forge --data-root "/path/to/Forge Server" execution-host configure \
+  --binding-id ep-primary \
+  --endpoint https://ep.example.invalid \
+  --expected-instance-id ep-instance-1 \
+  --host-id engineering-platform \
+  --project-id forge-project \
+  --repository-id forge-repository \
+  --repository-identity forge-source \
+  --credential-reference keychain://forge.ep/consumer \
+  --operator-id local-admin
+forge --data-root "/path/to/Forge Server" execution-host show
+forge --data-root "/path/to/Forge Server" execution-host preflight
+```
+
+`--repository-id` is the EP repository ID. `--repository-identity` is the
+Forge-side identity that every `ExecutionRequest.repository_identity` must
+repeat (legacy callers default it to their repository ID). No project,
+repository, consumer credential, Mission, grant, or submission is created by
+these commands.
+
+The only supported credential-reference backend is macOS Keychain generic
+password lookup. Its exact form is
+`keychain://<service>/<account>?namespace=<optional>&version=<optional>`; the
+query values are reference metadata and lookup remains fixed to the explicit
+service/account pair. Put the bearer value in that Keychain item through the
+operator's normal Keychain administration, never on the Forge command line.
+Forge persists and prints the reference, never its value. Unknown schemes,
+missing items, unavailable or access-denied Keychain state fail closed without
+credential discovery or fallback.
+
+### Explicit first Keychain access
+
+Before a full EP peer binding exists, a local administrator can explicitly ask
+macOS to perform exactly one read of one already-known credential reference:
+
+```text
+forge execution-host credential-access \
+  --interactive \
+  --credential-reference keychain://forge.ep/consumer
+```
+
+This is a bounded access-setup action, not general onboarding: it does not
+initialize a data root, create or modify a peer binding, issue an EP
+credential, create a grant, configure a provider, or submit any work. The
+reference is validated before the one existing Keychain reader is called. The
+`--interactive` opt-in is mandatory; without it Forge never asks macOS and
+does not retry or fall back to an interactive read.
+
+The setup read waits for at most 120 seconds (adjustable downward with
+`--timeout-seconds`). Forge tells the local user that macOS may ask for
+Keychain access by `/usr/bin/security`, which is the executable that actually
+requests this read. That macOS decision is not a cryptographically
+Forge-exclusive permission; Forge neither automates the prompt nor changes
+Keychain ACLs, partition lists, search domains, entitlements, or signing.
+The command returns only a status and redacted diagnostic, never credential
+material.
+
+Normal installed runtime resolution remains a separate, short 5-second read.
+It never increases its timeout, retries, chooses another Keychain item, or
+switches itself to interactive mode. `TIMEOUT` means only that the Keychain
+subprocess did not finish within its bound; it does not by itself prove denial,
+an open prompt, a missing Keychain, or an entitlement problem. Diagnostics
+distinguish `TIMEOUT`, `PROCESS_START_FAILED`, `MISSING`, `ACCESS_DENIED`, and
+`COMMAND_FAILED`, while all non-resolvable states fail closed. A successful
+`INTERACTIVE_CREDENTIAL_READ_SUCCEEDED` result does not claim that a fresh
+normal process can read the item or that EP authentication succeeded; those
+are separate proofs.
+
+HTTPS uses normal certificate validation. Plain HTTP requires both a loopback
+origin and `--allow-loopback-http`. URL credentials, paths, queries, fragments,
+redirects, unbounded timeouts, discovery and retargeting are rejected. To
+replace a binding, repeat `configure` with `--replace` plus both the current
+`--expected-revision` and `--expected-digest` from `show`; identical writes are
+idempotent. `show`, `status`, and `preflight` do not initialize or migrate
+storage. Preflight performs only authenticated
+`GET /v1/producer-compatibility`, verifies product, exact instance ID, and the
+explicit `1.2` readback and `1.4` terminal-evidence contracts, and reports project/repository and
+mutation authority as `NOT_VERIFIED` because that route does not prove them.
+The exact instance-ID comparison is consistency evidence, not a newly invented
+cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
+`CONFIGURED` is therefore never presented as `LIVE_READY`.
+
 ## Managed repository status
 
 Forge is the first-class repository [`pcvantol/forge`](https://github.com/pcvantol/forge),

forge_autonomy-2.7.20/forge/__main__.py

@@ -0,0 +1,202 @@
+"""Administration and read-only qualification entrypoint for packaged Forge."""
+from __future__ import annotations
+
+import argparse
+import json
+import sqlite3
+import sys
+
+from ._version import canonical_version
+from .execution_host_configuration import (
+    EngineeringPlatformPeerConfigurationService,
+    PeerConfigurationError,
+    read_peer_configuration,
+)
+from .runtime.data_root import DataRootResolver
+from .secure_store import CredentialAccessSetupService, SecretReference
+
+
+def _status(data_root: str | None) -> dict[str, object]:
+    """Read only the operator-safe instance projection; never initialise it."""
+    root = DataRootResolver(cli_data_root=data_root).resolve()
+    database = root / "forge.db"
+    marker = root / "instance" / "runtime-instance.json"
+    result: dict[str, object] = {"product_version": canonical_version(), "data_root": str(root),
+                                 "initialized": marker.is_file() and database.is_file(),
+                                 "runtime_status": "uninitialized",
+                                 "execution_host_peer": {"status": "NOT_CONFIGURED", "live_status": "NOT_VERIFIED"}}
+    if not result["initialized"]:
+        return result
+    try:
+        connection = sqlite3.connect(f"file:{database}?mode=ro", uri=True)
+        try:
+            metadata = dict(connection.execute("SELECT key, value FROM runtime_metadata"))
+            dispatcher = connection.execute(
+                "SELECT status FROM dispatcher_state WHERE singleton = 1"
+            ).fetchone()
+            dispatcher_status = "IDLE" if dispatcher is None else dispatcher[0]
+            if dispatcher_status not in {"IDLE", "ACTIVE"}:
+                raise sqlite3.DatabaseError("invalid durable dispatcher state")
+        finally:
+            connection.close()
+    except sqlite3.Error:
+        result["runtime_status"] = "unavailable"
+        result["execution_host_peer"] = {
+            "status": "ERROR", "live_status": "NOT_VERIFIED", "error": "Forge runtime storage is unavailable",
+        }
+        return result
+    result.update({"instance_id": metadata.get("runtime_id"), "storage_schema": metadata.get("schema_version"),
+                   "runtime_status": metadata.get("status", "unavailable")})
+    result["dispatcher"] = {"status": dispatcher_status}
+    try:
+        peer_readback = read_peer_configuration(root)
+        peer = peer_readback.configuration
+        if peer is not None:
+            result["execution_host_peer"] = {
+                "status": "CONFIGURED", "live_status": "NOT_VERIFIED",
+                "binding_id": peer.binding_id,
+                "configuration_revision": peer.configuration_revision,
+                "configuration_digest": peer.configuration_digest,
+                "owning_forge_runtime_id": peer.owning_forge_runtime_id,
+                "ep_consumer_id": peer.ep_consumer_id,
+            }
+        elif peer_readback.stored_document is not None:
+            result["execution_host_peer"] = {
+                "status": peer_readback.status,
+                "live_status": "NOT_VERIFIED",
+                "binding_id": peer_readback.stored_document["binding_id"],
+                "configuration_revision": peer_readback.stored_document["configuration_revision"],
+                "configuration_digest": peer_readback.stored_document["configuration_digest"],
+                "owning_forge_runtime_id": peer_readback.stored_document["owning_forge_runtime_id"],
+            }
+    except PeerConfigurationError as error:
+        result["execution_host_peer"] = {
+            "status": "ERROR", "live_status": "NOT_VERIFIED", "error": str(error),
+        }
+    return result
+
+
+def _failure(command: str, error: Exception) -> int:
+    print(json.dumps({"command": command, "status": "ERROR", "error": str(error)}, sort_keys=True))
+    return 1
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="forge",
+        description="Forge mission planning and evidence interpretation runtime.",
+    )
+    parser.add_argument("--version", action="version", version=canonical_version())
+    parser.add_argument("--data-root", help="Forge-owned runtime data root")
+    subparsers = parser.add_subparsers(dest="command")
+    server = subparsers.add_parser("server", help="manage local Forge storage")
+    server_commands = server.add_subparsers(dest="server_command", required=True)
+    server_commands.add_parser("init", help="create and validate the configured Forge data root")
+    server_commands.add_parser("status", help="print read-only runtime status as JSON")
+    subparsers.add_parser("status", help="print read-only runtime status as JSON")
+    execution_host = subparsers.add_parser("execution-host", help="manage the selected Execution Host peer")
+    execution_host_commands = execution_host.add_subparsers(dest="execution_host_command", required=True)
+    configure = execution_host_commands.add_parser("configure", help="persist one explicit EP peer binding")
+    configure.add_argument("--binding-id", required=True)
+    configure.add_argument("--endpoint", required=True)
+    configure.add_argument("--expected-instance-id", required=True)
+    configure.add_argument("--consumer-id", required=True)
+    configure.add_argument("--host-id", required=True)
+    configure.add_argument("--project-id", required=True)
+    configure.add_argument("--repository-id", required=True)
+    configure.add_argument("--repository-identity", required=True)
+    configure.add_argument("--credential-reference", required=True)
+    configure.add_argument("--operator-id", required=True)
+    configure.add_argument("--timeout-seconds", type=float, default=10.0)
+    configure.add_argument("--allow-loopback-http", action="store_true")
+    configure.add_argument("--replace", action="store_true")
+    configure.add_argument("--expected-revision", type=int)
+    configure.add_argument("--expected-digest")
+    execution_host_commands.add_parser("show", help="print the persisted secret-free EP peer binding")
+    execution_host_commands.add_parser("preflight", help="perform read-only EP identity and v1.2 compatibility checks")
+    credential_access = execution_host_commands.add_parser(
+        "credential-access",
+        help="perform one explicit local Keychain credential-access setup read",
+    )
+    credential_access.add_argument("--credential-reference", required=True, action="append")
+    credential_access.add_argument(
+        "--interactive",
+        action="store_true",
+        help="explicitly request the one bounded local Keychain access read",
+    )
+    credential_access.add_argument(
+        "--timeout-seconds",
+        type=float,
+        default=120.0,
+        help="bounded interactive setup timeout in seconds (maximum: 120)",
+    )
+    args = parser.parse_args(argv)
+    if args.command == "server" and args.server_command == "init":
+        from .runtime import RuntimeBootstrap
+        database = RuntimeBootstrap(data_root=args.data_root, forge_version=canonical_version()).open()
+        try:
+            print(json.dumps(_status(args.data_root), sort_keys=True))
+        finally:
+            database.close()
+    elif args.command == "status" or (args.command == "server" and args.server_command == "status"):
+        print(json.dumps(_status(args.data_root), sort_keys=True))
+    elif args.command == "execution-host":
+        try:
+            if args.execution_host_command == "credential-access":
+                if len(args.credential_reference) != 1:
+                    raise ValueError("credential-access requires exactly one credential reference")
+                if args.interactive:
+                    print(
+                        "macOS may ask you to allow Keychain access by /usr/bin/security. "
+                        "This is a macOS Keychain decision, not a Forge-exclusive cryptographic permission.",
+                        file=sys.stderr,
+                    )
+                result = CredentialAccessSetupService(timeout_seconds=args.timeout_seconds).read(
+                    SecretReference.parse(args.credential_reference[0]), interactive=args.interactive,
+                )
+                print(json.dumps(result.to_safe_dict(), sort_keys=True))
+                return 0 if result.succeeded else 1
+            service = EngineeringPlatformPeerConfigurationService(args.data_root)
+            if args.execution_host_command == "configure":
+                if args.replace != (args.expected_revision is not None and args.expected_digest is not None):
+                    raise PeerConfigurationError(
+                        "--replace requires both --expected-revision and --expected-digest; guards are invalid without --replace"
+                    )
+                configured = service.configure(
+                    binding_id=args.binding_id,
+                    endpoint=args.endpoint,
+                    expected_ep_instance_id=args.expected_instance_id,
+                    ep_consumer_id=args.consumer_id,
+                    execution_host_id=args.host_id,
+                    ep_project_id=args.project_id,
+                    ep_repository_id=args.repository_id,
+                    repository_identity=args.repository_identity,
+                    credential_reference=SecretReference.parse(args.credential_reference),
+                    operator_id=args.operator_id,
+                    allow_loopback_http=args.allow_loopback_http,
+                    timeout_seconds=args.timeout_seconds,
+                    replace=args.replace,
+                    expected_revision=args.expected_revision,
+                    expected_digest=args.expected_digest,
+                )
+                print(json.dumps({"status": "CONFIGURED", "configuration": configured.to_dict()}, sort_keys=True))
+            elif args.execution_host_command == "show":
+                readback = service.readback()
+                if readback.stored_document is None:
+                    print(json.dumps({"status": "NOT_CONFIGURED"}, sort_keys=True))
+                    return 1
+                print(json.dumps({
+                    "status": readback.status,
+                    "configuration": readback.stored_document,
+                }, sort_keys=True))
+                if readback.configuration is None:
+                    return 1
+            elif args.execution_host_command == "preflight":
+                print(json.dumps(service.preflight(), sort_keys=True))
+        except (PeerConfigurationError, ValueError) as error:
+            return _failure(f"execution-host {args.execution_host_command}", error)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

forge_autonomy-2.7.20/forge/completion/__init__.py

@@ -0,0 +1,6 @@
+"""Deterministic, local-only completion assessment."""
+
+from .assessor import PhaseCompletionAssessor
+from .mission import MissionCompletionEvaluationError, MissionCompletionEvaluator
+
+__all__ = ["MissionCompletionEvaluationError", "MissionCompletionEvaluator", "PhaseCompletionAssessor"]

forge_autonomy-2.7.20/forge/completion/mission.py

@@ -0,0 +1,120 @@
+"""Deterministic Architecture Mission completion evaluation."""
+
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+from typing import Any, Mapping, Sequence
+
+from forge.models.architecture_mission import ArchitectureMission
+from forge.models.mission_completion import (
+    CanonicalExecutionEvidenceReference,
+    MissionCompletionEvaluation,
+    MissionCompletionEvidence,
+    MissionCriterionEvaluation,
+    MissionCriterionEvaluationStatus,
+    RepositoryTruthReference,
+    mission_criterion_id,
+)
+
+
+class MissionCompletionEvaluationError(ValueError):
+    """Completion input is stale, malformed, or outside the approved Mission."""
+
+
+def _digest(value: object) -> str:
+    return "sha256:" + sha256(
+        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    ).hexdigest()
+
+
+def _truth_reference(document: Mapping[str, Any]) -> RepositoryTruthReference:
+    try:
+        values = tuple(document[item] for item in ("source_id", "revision", "locator", "content_digest"))
+        if any(not isinstance(item, str) or not item for item in values):
+            raise TypeError
+        return RepositoryTruthReference(*values)
+    except (KeyError, TypeError, ValueError) as error:
+        raise MissionCompletionEvaluationError("current Repository Truth provenance is incomplete") from error
+
+
+def _canonical_execution_references(
+    mission_id: str, evidence: Sequence[Mapping[str, Any]],
+) -> dict[str, CanonicalExecutionEvidenceReference]:
+    references: dict[str, CanonicalExecutionEvidenceReference] = {}
+    for document in evidence:
+        if document.get("outcome") != "complete":
+            continue
+        repository = document.get("repository_evidence")
+        if not isinstance(repository, Mapping) or repository.get("mission_id") != mission_id:
+            continue
+        try:
+            values = (
+                document["receipt_id"], repository["action_id"], document["report_id"],
+                repository["repository_revision"], repository["content_digest"],
+            )
+            if any(not isinstance(item, str) or not item for item in values):
+                raise TypeError
+            reference = CanonicalExecutionEvidenceReference(*values)
+        except (KeyError, TypeError, ValueError):
+            continue
+        if any(document.get(key) != repository.get(key) for key in ("correlation_id", "host_run_id", "report_id")):
+            continue
+        previous = references.get(reference.receipt_id)
+        if previous is not None and previous != reference:
+            raise MissionCompletionEvaluationError("execution receipt identity binds conflicting terminal evidence")
+        references[reference.receipt_id] = reference
+    return references
+
+
+class MissionCompletionEvaluator:
+    """Evaluate explicit evidence associations without accepting prose authority."""
+
+    def evaluate(
+        self,
+        mission: ArchitectureMission,
+        repository_truth: Mapping[str, Any],
+        execution_evidence: Sequence[Mapping[str, Any]],
+        evidence: MissionCompletionEvidence | None,
+    ) -> MissionCompletionEvaluation:
+        if not mission.acceptance_criteria:
+            raise MissionCompletionEvaluationError("approved Mission has no acceptance criteria")
+        mission_digest = _digest(mission.to_dict())
+        truth = _truth_reference(repository_truth)
+        identifiers = {mission_criterion_id(mission.id, criterion): criterion for criterion in mission.acceptance_criteria}
+        canonical = _canonical_execution_references(mission.id, execution_evidence)
+        bindings = {} if evidence is None else {item.criterion_id: item for item in evidence.bindings}
+        if evidence is not None:
+            if evidence.mission_id != mission.id or evidence.mission_digest != mission_digest:
+                raise MissionCompletionEvaluationError("completion evidence does not bind the approved Mission")
+            unknown = set(bindings) - set(identifiers)
+            if unknown:
+                raise MissionCompletionEvaluationError("completion evidence references an unknown Mission criterion")
+
+        evaluations: list[MissionCriterionEvaluation] = []
+        for criterion_id, criterion in identifiers.items():
+            binding = bindings.get(criterion_id)
+            if binding is None:
+                evaluations.append(MissionCriterionEvaluation(
+                    criterion_id, criterion, MissionCriterionEvaluationStatus.UNSATISFIED, "MISSING_EVIDENCE"
+                ))
+                continue
+            if binding.repository_truth != truth:
+                evaluations.append(MissionCriterionEvaluation(
+                    criterion_id, criterion, MissionCriterionEvaluationStatus.UNSATISFIED,
+                    "STALE_REPOSITORY_TRUTH", binding.execution_evidence, binding.repository_truth,
+                ))
+                continue
+            if any(canonical.get(reference.receipt_id) != reference for reference in binding.execution_evidence):
+                evaluations.append(MissionCriterionEvaluation(
+                    criterion_id, criterion, MissionCriterionEvaluationStatus.UNSATISFIED,
+                    "NON_CANONICAL_EXECUTION_EVIDENCE", binding.execution_evidence, truth,
+                ))
+                continue
+            evaluations.append(MissionCriterionEvaluation(
+                criterion_id, criterion, MissionCriterionEvaluationStatus.PROVEN,
+                "CANONICAL_EXECUTION_AND_REPOSITORY_TRUTH", binding.execution_evidence, truth,
+            ))
+        return MissionCompletionEvaluation(
+            mission.id, mission_digest, tuple(evaluations), None if evidence is None else evidence.digest
+        )