[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_223":224,"_225":226},"routes/_app.x.$handle.$name",{"_93":92,"_31":43,"_102":83,"_26":103,"_13":14,"_104":-5,"_11":105,"_106":107,"_108":109,"_110":111,"_112":113,"_20":-5,"_114":-5,"_115":-5,"_116":24,"_117":118,"_119":24,"_120":-5,"_121":-5,"_122":123},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":76,"_77":78,"_79":80,"_81":24},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","adversarial_review_luna_v2.ts","latestPath","fileId","5db1f148-ac8a-11f1-a1b8-1607ee4eb77e","name","fileType","script","content","import { ValTownOpenAI } from \"https://esm.town/v/std/openai/main.ts\";\nconst openai=new ValTownOpenAI({});\nconst source=\"export const QUALIFIED_MUTATORS=new Set([\\\"register-agent\\\",\\\"ensure-task\\\",\\\"claim\\\",\\\"renew-lease\\\",\\\"commit\\\",\\\"recover-stale\\\",\\\"supersede-task-context\\\",\\\"migrate-task-invariants\\\"]);\\nexport const READ_ONLY=new Set([\\\"status\\\",\\\"verify-chain\\\",\\\"verify-claim-graph\\\"]);\\nconst HEX64=/^[0-9a-f]{64}$/;\\nfunction trustedContext(env:any){return env?.server_context_trusted===true&&env?.caller_fields_separated===true}\\nfunction exactBinding(b:any){return !!b&&HEX64.test(String(b.kernel_sha256||\\\"\\\"))&&HEX64.test(String(b.executor_sha256||\\\"\\\"))&&HEX64.test(String(b.protocol_sha256||\\\"\\\"))&&HEX64.test(String(b.installation_nonce||\\\"\\\"))&&Number.isInteger(b.authority_epoch)&&b.authority_epoch>=1&&b.authority_writer===\\\"val_native\\\"&&b.authority_mode===\\\"ACTIVE\\\"}\\nfunction sameBinding(a:any,b:any){return exactBinding(a)&&exactBinding(b)&&a.kernel_sha256===b.kernel_sha256&&a.executor_sha256===b.executor_sha256&&a.protocol_sha256===b.protocol_sha256&&a.installation_nonce===b.installation_nonce&&a.authority_epoch===b.authority_epoch&&a.authority_writer===b.authority_writer&&a.authority_mode===b.authority_mode}\\nfunction prebindOk(env:any){const p=env?.protocol_prebind;return trustedContext(env)&&!!p&&p.server_derived===true&&p.caller_authored===false&&p.fresh===true&&p.frozen===true&&p.source===\\\"AUTHORIZED_PRODUCTION_MAINTENANCE\\\"&&Number.isInteger(p.generation)&&p.generation>=0&&sameBinding(p.binding,env?.installed_binding)}\\nfunction receiptOk(r:any,cmd:string,env:any){if(!trustedContext(env)||!r||r.server_derived!==true||r.caller_authored===true||r.command!==cmd||r.ok!==true)return false;if(!sameBinding(r.serving_binding,env.installed_binding))return false;if(Number(r.authority_epoch)!==Number(env.installed_binding.authority_epoch))return false;if(!HEX64.test(String(r.payload_sha256||\\\"\\\"))||typeof r.job_id!==\\\"string\\\"||!r.job_id)return false;if(r.transport_lease_generation!==1||typeof r.lease_attempt_id!==\\\"string\\\"||!r.lease_attempt_id||!Number.isInteger(r.committed_generation))return false;if(r.committed_generationenv.canonical_generation)return false;if(p.historical_activation_event_used!==false)return false;return true}\\nexport function derivePhase(env:any){if(!trustedContext(env)||!exactBinding(env?.installed_binding))return\\\"CLOSED\\\";if(!prebindOk(env))return\\\"CLOSED\\\";return activationProofOk(env)?\\\"ACTIVE\\\":\\\"PROBE_ONLY\\\"}\\nfunction probeTransportOk(env:any,cmd:string){const t=env?.transport,b=env?.probe_binding;if(!trustedContext(env)||!t||!b||t.server_derived!==true||t.caller_authored===true||t.transport_lease_generation!==1||t.installation_nonce!==env?.installed_binding?.installation_nonce||b.installation_nonce!==env?.installed_binding?.installation_nonce)return false;if(cmd===\\\"register-agent\\\")return t.job_id===b.register_job_id&&t.payload_sha256===b.register_payload_sha256&&t.agent_id===b.agent_id;if(cmd===\\\"claim\\\")return t.job_id===b.claim_job_id&&t.payload_sha256===b.claim_payload_sha256&&t.agent_id===b.agent_id&&t.task_id===b.task_id;return false}\\nexport function decideMutation(env:any,req:any){const cmd=String(req?.cmd||\\\"\\\");if(READ_ONLY.has(cmd))return{allow:true,reason:\\\"READ_ONLY_ALWAYS_AVAILABLE\\\",phase:derivePhase(env)};if(!trustedContext(env))return{allow:false,reason:\\\"TRUSTED_SERVER_CONTEXT_REQUIRED\\\",phase:\\\"CLOSED\\\"};if(!QUALIFIED_MUTATORS.has(cmd))return{allow:false,reason:\\\"UNCLASSIFIED_MUTATOR_FAIL_CLOSED\\\",phase:derivePhase(env)};if(cmd===\\\"recover-stale\\\")return req?.args_exact===true?{allow:true,reason:\\\"AGENTLESS_DETERMINISTIC_RECOVERY\\\",phase:derivePhase(env)}:{allow:false,reason:\\\"RECOVERY_SHAPE_REJECT\\\",phase:derivePhase(env)};const phase=derivePhase(env);if(phase===\\\"CLOSED\\\")return{allow:false,reason:\\\"PREBIND_NOT_ESTABLISHED_CANONICAL_MUTATION_CLOSED\\\",phase};if(phase===\\\"PROBE_ONLY\\\"){if(cmd===\\\"register-agent\\\"&&req?.type===\\\"CHAT_UNPROVEN\\\"&&req?.agent_id===env?.probe_binding?.agent_id&&probeTransportOk(env,cmd)&&req?.exact_probe_shape===true)return{allow:true,reason:\\\"EXACT_MACHINE_BOUND_PROBE_REGISTER\\\",phase};if(cmd===\\\"claim\\\"&&req?.agent_id===env?.probe_binding?.agent_id&&req?.task_id===env?.probe_binding?.task_id&&req?.lease_seconds===60&&probeTransportOk(env,cmd)&&req?.exact_probe_shape===true&&req?.register_receipt_present===true)return{allow:true,reason:\\\"EXACT_MACHINE_BOUND_PROBE_CLAIM\\\",phase};return{allow:false,reason:\\\"PROBE_ONLY_MUTATION_REJECTED\\\",phase}}if(cmd===\\\"register-agent\\\"){if(req?.existing_agent===true)return{allow:true,reason:\\\"ACTIVE_EXISTING_IDENTITY_REJOIN_SUBJECT_TO_LOCAL_CHECKS\\\",phase};if(req?.type!==\\\"CHAT_UNPROVEN\\\"&&req?.positive_ingress!==true)return{allow:false,reason:\\\"POSITIVE_INGRESS_REQUIRED_FOR_STRONGER_TYPE\\\",phase};return{allow:true,reason:req?.type===\\\"CHAT_UNPROVEN\\\"?\\\"ACTIVE_CHAT_UNPROVEN_REGISTER\\\":\\\"ACTIVE_POSITIVE_INGRESS_REGISTER\\\",phase}}if(req?.agent_present!==true)return{allow:false,reason:\\\"MUTATION_AGENT_REQUIRED\\\",phase};if(req?.agent_exists!==true)return{allow:false,reason:\\\"UNKNOWN_MUTATION_AGENT\\\",phase};if(req?.workstream_match!==true)return{allow:false,reason:\\\"MUTATION_AGENT_WORKSTREAM_MISMATCH\\\",phase};if(req?.agent_id===env?.probe_binding?.agent_id)return{allow:false,reason:\\\"RESERVED_PROBE_ID_INERT_AFTER_ACTIVATION\\\",phase};return{allow:true,reason:\\\"ACTIVE_REGISTERED_ACTOR_MUTATION_SUBJECT_TO_LOCAL_CHECKS\\\",phase}}\";\nconst input=`Adversarially review this exact candidate-only activation reference contract. Its environment object is an INTERNAL server-constructed view from DB/transport/file readback, never caller payload; req is caller-derived. A prior candidate was invalid because stale historical activation could authorize new serving bytes and because PROBE_ONLY did not centrally gate all mutators. This version adds an installation_nonce bound through installed bytes, prebind, transport, receipts, and probe binding; unknown mutators fail closed.\n\nFind only concrete promotion blockers in the pure contract. Check exact-byte replay, same-hash reinstall replay, nonce mismatch/replay, stale/future receipts, forged caller state, preactivation ensure/supersede/migrate, malformed probe flows, future mutators, and reserved probe reuse. Read control flow literally.\n\nReturn JSON only:\n{\"verdict\":\"PASS\"|\"FAIL\",\"promotion_blockers\":[{\"title\":\"...\",\"counterexample\":\"...\",\"repair\":\"...\"}],\"nonblocking_notes\":[]}\n\nPASS is only review evidence, not promotion.\n\nSOURCE:\n${source}`;\nconst r=await openai.responses.create({model:\"gpt-5.6-luna\",input,max_output_tokens:1800});\nconsole.log(JSON.stringify({id:(r as any).id??null,model:(r as any).model??null,output_text:(r as any).output_text??null},null,2));","createdAt",["D",1788984570163],"branchVersion","branchId","f6f3364b-7818-4095-ab58-8f221ec31cf9","id","5ab79402-9293-4232-828b-46643645eb9c","brain-v6r2-admission-repair-0909",["D",1788984284014],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","V6R2 fresh-serving activation + global mutator gate","imageUrl","6be0fc5c-1fef-4bd6-a1e1-67a3f8c0764e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0715b-703f-741f-ab35-c85020e4a5e0","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_93":92,"_101":97},"org",{"_93":92,"_94":95,"_96":97,"_18":53,"_98":99,"_100":24},"branch",{"_13":82,"_31":83,"_41":40,"_84":42,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":43,"_91":92},"isOwned",9,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mosadek","handle","displayName","Mo Sadek","avatar","https://lh3.googleusercontent.com/a/ACg8ocL1eT_LHhKSg5px3nXIO6eez79aZXef466qXKh2gak-0iwrvw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":219,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":220,"_77":221,"_79":222,"_81":24},"tree",[190,191,192,193,194,195,196],"files",[190,191,192,193,194,195,196],"counts",{"_180":59,"_181":176,"_182":59,"_183":184,"_185":186},"contents",[124,125,126,127,128,129,130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":173,"_31":174,"_29":175,"_134":-5,"_39":40,"_38":176,"_136":137,"_36":177,"_13":59,"_32":33,"_34":178,"_23":24,"_140":-5,"_26":179},{"_41":166,"_31":167,"_29":168,"_134":-5,"_39":40,"_38":169,"_136":137,"_36":170,"_13":59,"_32":33,"_34":171,"_23":24,"_140":-5,"_26":172},{"_41":159,"_31":160,"_29":161,"_134":-5,"_39":40,"_38":162,"_136":137,"_36":163,"_13":59,"_32":33,"_34":164,"_23":24,"_140":-5,"_26":165},{"_41":156,"_31":27,"_29":30,"_134":-5,"_39":40,"_38":14,"_136":137,"_36":157,"_13":59,"_32":33,"_34":35,"_23":24,"_140":-5,"_26":158},{"_41":149,"_31":150,"_29":151,"_134":-5,"_39":40,"_38":152,"_136":137,"_36":153,"_13":59,"_32":33,"_34":154,"_23":24,"_140":-5,"_26":155},{"_41":142,"_31":143,"_29":144,"_134":-5,"_39":40,"_38":145,"_136":137,"_36":146,"_13":59,"_32":33,"_34":147,"_23":24,"_140":-5,"_26":148},{"_41":131,"_31":132,"_29":133,"_134":-5,"_39":40,"_38":135,"_136":137,"_36":138,"_13":59,"_32":33,"_34":139,"_23":24,"_140":-5,"_26":141},"580b0489-fafb-4ca7-9805-f994d1beb4e2","test_v2.ts","2084ca8e-ac8a-11f1-936f-1607ee4eb77e","parentId",5,"latest",true,["D",1788984467613],"import {decideMutation,derivePhase,activationProofVerdict} from \"./admission_model_v2.ts\";\nconst H=(c:string)=>c.repeat(64);\nconst nonce=H(\"9\");\nconst binding={kernel_sha256:H(\"a\"),executor_sha256:H(\"b\"),protocol_sha256:H(\"c\"),installation_nonce:nonce,authority_epoch:2,authority_writer:\"val_native\",authority_mode:\"ACTIVE\"};\nconst probe={agent_id:\"probe-a1\",task_id:\"probe-task-a1\",register_job_id:\"reg-job-a1\",claim_job_id:\"claim-job-a1\",register_payload_sha256:H(\"d\"),claim_payload_sha256:H(\"e\"),installation_nonce:nonce};\nconst prebind={server_derived:true,caller_authored:false,fresh:true,frozen:true,source:\"AUTHORIZED_PRODUCTION_MAINTENANCE\",binding:{...binding},generation:5000};\nfunction receipt(cmd:string){return{server_derived:true,caller_authored:false,command:cmd,ok:true,serving_binding:{...binding},authority_epoch:2,payload_sha256:cmd===\"register-agent\"?H(\"d\"):H(\"e\"),job_id:cmd===\"register-agent\"?\"reg-job-a1\":\"claim-job-a1\",transport_lease_generation:1,lease_attempt_id:cmd+\"-attempt\",committed_generation:5001,result:cmd===\"register-agent\"?{created:true,agent_id:\"probe-a1\"}:{agent_id:\"probe-a1\",task_id:\"probe-task-a1\",lease_seconds:60}}}\nconst proof={schema:\"PROJECT_BRAIN_FRESH_SERVING_ACTIVATION_PROOF_V2\",server_derived:true,caller_authored:false,binding:{...binding},prebind_generation:5000,register_receipt:receipt(\"register-agent\"),claim_receipt:receipt(\"claim\"),probe_task:{id:\"probe-task-a1\",execution_allowed:false,canary_only:true,independence_eligible:false,p_real_eligible:false},verify_chain:{ok:true},verify_claim_graph:{ok:true},proof_generation:5002,historical_activation_event_used:false};\nconst baseTrust={server_context_trusted:true,caller_fields_separated:true,canonical_generation:5002};\nconst closed={...baseTrust,installed_binding:{...binding},probe_binding:{...probe}};\nconst probeOnly={...closed,protocol_prebind:{...prebind}};\nconst active={...probeOnly,activation_proof:JSON.parse(JSON.stringify(proof))};\nconst tests:any[]=[];\nfunction t(name:string,got:any,check:(x:any)=>boolean){tests.push({name,pass:check(got),got})}\nt(\"closed without prebind\",derivePhase(closed),x=>x===\"CLOSED\");\nt(\"probe only exact prebind\",derivePhase(probeOnly),x=>x===\"PROBE_ONLY\");\nt(\"active fresh exact proof\",derivePhase(active),x=>x===\"ACTIVE\");\nfor(const cmd of [\"ensure-task\",\"supersede-task-context\",\"migrate-task-invariants\",\"commit\",\"renew-lease\"]){\n t(\"closed deny \"+cmd,decideMutation(closed,{cmd,agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.phase===\"CLOSED\");\n t(\"probe deny \"+cmd,decideMutation(probeOnly,{cmd,agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.reason===\"PROBE_ONLY_MUTATION_REJECTED\");\n}\nt(\"reviewer claimed fallthrough is impossible\",decideMutation(probeOnly,{cmd:\"ensure-task\",agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.reason===\"PROBE_ONLY_MUTATION_REJECTED\");\nt(\"unknown future mutator denied\",decideMutation(active,{cmd:\"future-mutator\",agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.reason===\"UNCLASSIFIED_MUTATOR_FAIL_CLOSED\");\nt(\"read status allowed without trust context\",decideMutation({}, {cmd:\"status\"}),x=>x.allow===true);\nt(\"mutation denied without trusted server context\",decideMutation({installed_binding:binding},{cmd:\"ensure-task\",agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.reason===\"TRUSTED_SERVER_CONTEXT_REQUIRED\");\nt(\"recover exact closed\",decideMutation(closed,{cmd:\"recover-stale\",args_exact:true}),x=>x.allow===true);\nt(\"recover malformed denied\",decideMutation(closed,{cmd:\"recover-stale\",args_exact:false}),x=>x.allow===false);\nconst regTransport={server_derived:true,caller_authored:false,transport_lease_generation:1,job_id:\"reg-job-a1\",payload_sha256:H(\"d\"),agent_id:\"probe-a1\",installation_nonce:nonce};\nconst claimTransport={server_derived:true,caller_authored:false,transport_lease_generation:1,job_id:\"claim-job-a1\",payload_sha256:H(\"e\"),agent_id:\"probe-a1\",task_id:\"probe-task-a1\",installation_nonce:nonce};\nconst regReq={cmd:\"register-agent\",type:\"CHAT_UNPROVEN\",agent_id:\"probe-a1\",exact_probe_shape:true};\nconst claimReq={cmd:\"claim\",agent_id:\"probe-a1\",task_id:\"probe-task-a1\",lease_seconds:60,exact_probe_shape:true,register_receipt_present:true};\nt(\"exact probe register allowed\",decideMutation({...probeOnly,transport:regTransport},regReq),x=>x.allow===true);\nt(\"exact probe claim allowed\",decideMutation({...probeOnly,transport:claimTransport},claimReq),x=>x.allow===true);\n{const e={...probeOnly,transport:{...regTransport,installation_nonce:H(\"8\")}};t(\"old-install transport replay denied\",decideMutation(e,regReq),x=>x.allow===false)}\n{const e=JSON.parse(JSON.stringify(active));e.installed_binding.installation_nonce=H(\"8\");t(\"old proof cannot open new installation nonce\",derivePhase(e),x=>x===\"CLOSED\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.binding.installation_nonce=H(\"8\");t(\"old activation proof nonce rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.register_receipt.serving_binding.installation_nonce=H(\"8\");t(\"old register receipt nonce rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.probe_binding.installation_nonce=H(\"8\");t(\"old probe binding nonce rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\nfor(const field of [\"kernel_sha256\",\"executor_sha256\",\"protocol_sha256\"]){const e=JSON.parse(JSON.stringify(active));e.activation_proof.binding[field]=H(\"f\");t(\"binding mismatch \"+field,derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.historical_activation_event_used=true;t(\"historical event rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));delete e.activation_proof.historical_activation_event_used;t(\"historical flag must explicitly false\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.server_derived=false;t(\"nonserver proof rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.server_context_trusted=false;t(\"untrusted environment closes\",derivePhase(e),x=>x===\"CLOSED\")}\n{const e=JSON.parse(JSON.stringify(active));e.caller_fields_separated=false;t(\"caller/env merge closes\",derivePhase(e),x=>x===\"CLOSED\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.proof_generation=4999;t(\"proof before receipts rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.proof_generation=5003;e.canonical_generation=5002;t(\"proof from future canonical generation rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.register_receipt.committed_generation=4999;t(\"receipt before prebind rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.protocol_prebind.binding.protocol_sha256=H(\"f\");t(\"stale prebind closes\",derivePhase(e),x=>x===\"CLOSED\")}\n{const e=JSON.parse(JSON.stringify(active));e.protocol_prebind.source=\"CALLER\";t(\"caller prebind closes\",derivePhase(e),x=>x===\"CLOSED\")}\nt(\"active unproven register\",decideMutation(active,{cmd:\"register-agent\",type:\"CHAT_UNPROVEN\",agent_id:\"normal\"}),x=>x.allow===true);\nt(\"stronger self assert denied\",decideMutation(active,{cmd:\"register-agent\",type:\"CHAT\",agent_id:\"normal\",positive_ingress:false}),x=>x.allow===false);\nt(\"stronger ingress allowed\",decideMutation(active,{cmd:\"register-agent\",type:\"CHAT\",agent_id:\"normal\",positive_ingress:true}),x=>x.allow===true);\nt(\"active ensure missing actor denied\",decideMutation(active,{cmd:\"ensure-task\"}),x=>x.allow===false);\nt(\"active unknown actor denied\",decideMutation(active,{cmd:\"ensure-task\",agent_present:true,agent_exists:false,workstream_match:true}),x=>x.allow===false);\nt(\"active cross-workstream migrate denied\",decideMutation(active,{cmd:\"migrate-task-invariants\",agent_present:true,agent_exists:true,workstream_match:false}),x=>x.allow===false);\nt(\"active migrate preserved\",decideMutation(active,{cmd:\"migrate-task-invariants\",agent_present:true,agent_exists:true,workstream_match:true,agent_id:\"normal\"}),x=>x.allow===true);\nt(\"reserved probe inert after active\",decideMutation(active,{cmd:\"commit\",agent_present:true,agent_exists:true,workstream_match:true,agent_id:\"probe-a1\"}),x=>x.allow===false&&x.reason===\"RESERVED_PROBE_ID_INERT_AFTER_ACTIVATION\");\nconst verdict=activationProofVerdict(active);t(\"full verdict\",verdict,x=>x.phase===\"ACTIVE\"&&x.activation_proof_ok===true&&x.trusted_context===true);\nconst failed=tests.filter(x=>!x.pass);console.log(JSON.stringify({schema:\"V6R2_ADMISSION_REFERENCE_TEST_REPORT_V2\",total:tests.length,passed:tests.length-failed.length,failed:failed.length,pass:failed.length===0,results:tests},null,2));if(failed.length)throw new Error(\"TEST_FAILURE\");\n","label",[132],"3efab658-e8a0-4a4e-8e49-516a4fd76553","test.ts","c5dbaee0-ac89-11f1-98ac-1607ee4eb77e",2,["D",1788984315506],"import {decideMutation,derivePhase,activationProofVerdict} from \"./admission_model.ts\";\nconst H=(c:string)=>c.repeat(64);\nconst binding={kernel_sha256:H(\"a\"),executor_sha256:H(\"b\"),protocol_sha256:H(\"c\"),authority_epoch:2,authority_writer:\"val_native\",authority_mode:\"ACTIVE\"};\nconst probe={agent_id:\"probe-a1\",task_id:\"probe-task-a1\",register_job_id:\"reg-job-a1\",claim_job_id:\"claim-job-a1\",register_payload_sha256:H(\"d\"),claim_payload_sha256:H(\"e\")};\nconst prebind={server_derived:true,caller_authored:false,fresh:true,frozen:true,source:\"AUTHORIZED_PRODUCTION_MAINTENANCE\",binding:{...binding},generation:5000};\nfunction receipt(cmd:string){return{server_derived:true,caller_authored:false,command:cmd,ok:true,serving_binding:{...binding},authority_epoch:2,payload_sha256:cmd===\"register-agent\"?H(\"d\"):H(\"e\"),job_id:cmd===\"register-agent\"?\"reg-job-a1\":\"claim-job-a1\",transport_lease_generation:1,lease_attempt_id:cmd+\"-attempt\",committed_generation:5001,result:cmd===\"register-agent\"?{created:true,agent_id:\"probe-a1\"}:{agent_id:\"probe-a1\",task_id:\"probe-task-a1\",lease_seconds:60}}}\nconst proof={schema:\"PROJECT_BRAIN_FRESH_SERVING_ACTIVATION_PROOF_V1\",server_derived:true,caller_authored:false,binding:{...binding},prebind_generation:5000,register_receipt:receipt(\"register-agent\"),claim_receipt:receipt(\"claim\"),probe_task:{id:\"probe-task-a1\",execution_allowed:false,canary_only:true,independence_eligible:false,p_real_eligible:false},verify_chain:{ok:true},verify_claim_graph:{ok:true},proof_generation:5002,historical_activation_event_used:false};\nconst closed={installed_binding:{...binding},probe_binding:{...probe}};\nconst probeOnly={installed_binding:{...binding},protocol_prebind:{...prebind},probe_binding:{...probe}};\nconst active={...probeOnly,activation_proof:JSON.parse(JSON.stringify(proof))};\nconst tests:any[]=[];\nfunction t(name:string,got:any,check:(x:any)=>boolean){tests.push({name,pass:check(got),got})}\nt(\"closed without prebind\",derivePhase(closed),x=>x===\"CLOSED\");\nt(\"probe only after exact prebind\",derivePhase(probeOnly),x=>x===\"PROBE_ONLY\");\nt(\"active after fresh exact proof\",derivePhase(active),x=>x===\"ACTIVE\");\nfor(const cmd of [\"ensure-task\",\"supersede-task-context\",\"migrate-task-invariants\",\"commit\",\"renew-lease\"]){\n t(\"closed denies \"+cmd,decideMutation(closed,{cmd,agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.phase===\"CLOSED\");\n t(\"probe-only denies \"+cmd,decideMutation(probeOnly,{cmd,agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.reason===\"PROBE_ONLY_MUTATION_REJECTED\");\n}\nt(\"unknown future mutator denied\",decideMutation(active,{cmd:\"future-mutator\",agent_present:true,agent_exists:true,workstream_match:true}),x=>x.allow===false&&x.reason===\"UNCLASSIFIED_MUTATOR_FAIL_CLOSED\");\nt(\"read only status closed\",decideMutation(closed,{cmd:\"status\"}),x=>x.allow===true);\nt(\"recover exact closed\",decideMutation(closed,{cmd:\"recover-stale\",args_exact:true}),x=>x.allow===true);\nt(\"recover malformed closed\",decideMutation(closed,{cmd:\"recover-stale\",args_exact:false}),x=>x.allow===false);\nconst regReq={cmd:\"register-agent\",type:\"CHAT_UNPROVEN\",agent_id:\"probe-a1\",exact_probe_shape:true};\nconst claimReq={cmd:\"claim\",agent_id:\"probe-a1\",task_id:\"probe-task-a1\",lease_seconds:60,exact_probe_shape:true,register_receipt_present:true};\nt(\"probe register without transport denied\",decideMutation(probeOnly,regReq),x=>x.allow===false);\nt(\"probe claim without transport denied\",decideMutation(probeOnly,claimReq),x=>x.allow===false);\nt(\"exact probe register allowed\",decideMutation({...probeOnly,transport:{server_derived:true,caller_authored:false,transport_lease_generation:1,job_id:\"reg-job-a1\",payload_sha256:H(\"d\"),agent_id:\"probe-a1\"}},regReq),x=>x.allow===true&&x.reason===\"EXACT_MACHINE_BOUND_PROBE_REGISTER\");\nt(\"exact probe claim allowed\",decideMutation({...probeOnly,transport:{server_derived:true,caller_authored:false,transport_lease_generation:1,job_id:\"claim-job-a1\",payload_sha256:H(\"e\"),agent_id:\"probe-a1\",task_id:\"probe-task-a1\"}},claimReq),x=>x.allow===true&&x.reason===\"EXACT_MACHINE_BOUND_PROBE_CLAIM\");\nt(\"probe register wrong job denied\",decideMutation({...probeOnly,transport:{server_derived:true,caller_authored:false,transport_lease_generation:1,job_id:\"wrong\",payload_sha256:H(\"d\"),agent_id:\"probe-a1\"}},regReq),x=>x.allow===false);\nt(\"probe register caller authored denied\",decideMutation({...probeOnly,transport:{server_derived:true,caller_authored:true,transport_lease_generation:1,job_id:\"reg-job-a1\",payload_sha256:H(\"d\"),agent_id:\"probe-a1\"}},regReq),x=>x.allow===false);\nfor(const field of [\"kernel_sha256\",\"executor_sha256\",\"protocol_sha256\"]){\n const e=JSON.parse(JSON.stringify(active));e.activation_proof.binding[field]=H(\"f\");\n t(\"activation rejects mismatched \"+field,derivePhase(e),x=>x===\"PROBE_ONLY\");\n}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.historical_activation_event_used=true;t(\"historical activation event rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.server_derived=false;t(\"caller/model proof rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.register_receipt.serving_binding.kernel_sha256=H(\"f\");t(\"stale register receipt serving bytes rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.claim_receipt.payload_sha256=H(\"f\");t(\"claim payload mismatch rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.verify_chain.ok=false;t(\"chain failure blocks activation\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.verify_claim_graph.ok=false;t(\"claim graph failure blocks activation\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.activation_proof.probe_task.execution_allowed=true;t(\"executable canary rejected\",derivePhase(e),x=>x===\"PROBE_ONLY\")}\n{const e=JSON.parse(JSON.stringify(active));e.protocol_prebind.binding.protocol_sha256=H(\"f\");t(\"stale protocol prebind closes\",derivePhase(e),x=>x===\"CLOSED\")}\n{const e=JSON.parse(JSON.stringify(active));e.protocol_prebind.source=\"CALLER\";t(\"untrusted prebind closes\",derivePhase(e),x=>x===\"CLOSED\")}\nt(\"active chat unproven register\",decideMutation(active,{cmd:\"register-agent\",type:\"CHAT_UNPROVEN\",agent_id:\"normal\"}),x=>x.allow===true);\nt(\"active stronger self assert denied\",decideMutation(active,{cmd:\"register-agent\",type:\"CHAT\",agent_id:\"normal\",positive_ingress:false}),x=>x.allow===false);\nt(\"active stronger positive ingress allowed\",decideMutation(active,{cmd:\"register-agent\",type:\"CHAT\",agent_id:\"normal\",positive_ingress:true}),x=>x.allow===true);\nt(\"active ensure missing actor denied\",decideMutation(active,{cmd:\"ensure-task\"}),x=>x.allow===false&&x.reason===\"MUTATION_AGENT_REQUIRED\");\nt(\"active ensure unknown actor denied\",decideMutation(active,{cmd:\"ensure-task\",agent_present:true,agent_exists:false,workstream_match:true}),x=>x.allow===false);\nt(\"active cross-workstream migrate denied\",decideMutation(active,{cmd:\"migrate-task-invariants\",agent_present:true,agent_exists:true,workstream_match:false}),x=>x.allow===false);\nt(\"active migrate qualified preserved\",decideMutation(active,{cmd:\"migrate-task-invariants\",agent_present:true,agent_exists:true,workstream_match:true,agent_id:\"normal\"}),x=>x.allow===true);\nt(\"reserved probe inert active\",decideMutation(active,{cmd:\"commit\",agent_present:true,agent_exists:true,workstream_match:true,agent_id:\"probe-a1\"}),x=>x.allow===false&&x.reason===\"RESERVED_PROBE_ID_INERT_AFTER_ACTIVATION\");\nconst verdict=activationProofVerdict(active);t(\"full activation verdict\",verdict,x=>x.phase===\"ACTIVE\"&&x.prebind_ok===true&&x.activation_proof_ok===true);\nconst failed=tests.filter(x=>!x.pass);\nconsole.log(JSON.stringify({schema:\"V6R2_ADMISSION_REFERENCE_TEST_REPORT_V1\",total:tests.length,passed:tests.length-failed.length,failed:failed.length,pass:failed.length===0,results:tests},null,2));\nif(failed.length)throw new Error(\"TEST_FAILURE\");\n",[143],"013a55a5-4742-4939-a453-f1414247f63a","adversarial_review_v2.ts","3e23859e-ac8a-11f1-a27a-1607ee4eb77e",6,["D",1788984517298],"const source=\"export const QUALIFIED_MUTATORS=new Set([\\\"register-agent\\\",\\\"ensure-task\\\",\\\"claim\\\",\\\"renew-lease\\\",\\\"commit\\\",\\\"recover-stale\\\",\\\"supersede-task-context\\\",\\\"migrate-task-invariants\\\"]);\\nexport const READ_ONLY=new Set([\\\"status\\\",\\\"verify-chain\\\",\\\"verify-claim-graph\\\"]);\\nconst HEX64=/^[0-9a-f]{64}$/;\\nfunction trustedContext(env:any){return env?.server_context_trusted===true&&env?.caller_fields_separated===true}\\nfunction exactBinding(b:any){return !!b&&HEX64.test(String(b.kernel_sha256||\\\"\\\"))&&HEX64.test(String(b.executor_sha256||\\\"\\\"))&&HEX64.test(String(b.protocol_sha256||\\\"\\\"))&&HEX64.test(String(b.installation_nonce||\\\"\\\"))&&Number.isInteger(b.authority_epoch)&&b.authority_epoch>=1&&b.authority_writer===\\\"val_native\\\"&&b.authority_mode===\\\"ACTIVE\\\"}\\nfunction sameBinding(a:any,b:any){return exactBinding(a)&&exactBinding(b)&&a.kernel_sha256===b.kernel_sha256&&a.executor_sha256===b.executor_sha256&&a.protocol_sha256===b.protocol_sha256&&a.installation_nonce===b.installation_nonce&&a.authority_epoch===b.authority_epoch&&a.authority_writer===b.authority_writer&&a.authority_mode===b.authority_mode}\\nfunction prebindOk(env:any){const p=env?.protocol_prebind;return trustedContext(env)&&!!p&&p.server_derived===true&&p.caller_authored===false&&p.fresh===true&&p.frozen===true&&p.source===\\\"AUTHORIZED_PRODUCTION_MAINTENANCE\\\"&&Number.isInteger(p.generation)&&p.generation>=0&&sameBinding(p.binding,env?.installed_binding)}\\nfunction receiptOk(r:any,cmd:string,env:any){if(!trustedContext(env)||!r||r.server_derived!==true||r.caller_authored===true||r.command!==cmd||r.ok!==true)return false;if(!sameBinding(r.serving_binding,env.installed_binding))return false;if(Number(r.authority_epoch)!==Number(env.installed_binding.authority_epoch))return false;if(!HEX64.test(String(r.payload_sha256||\\\"\\\"))||typeof r.job_id!==\\\"string\\\"||!r.job_id)return false;if(r.transport_lease_generation!==1||typeof r.lease_attempt_id!==\\\"string\\\"||!r.lease_attempt_id||!Number.isInteger(r.committed_generation))return false;if(r.committed_generationenv.canonical_generation)return false;if(p.historical_activation_event_used!==false)return false;return true}\\nexport function derivePhase(env:any){if(!trustedContext(env)||!exactBinding(env?.installed_binding))return\\\"CLOSED\\\";if(!prebindOk(env))return\\\"CLOSED\\\";return activationProofOk(env)?\\\"ACTIVE\\\":\\\"PROBE_ONLY\\\"}\\nfunction probeTransportOk(env:any,cmd:string){const t=env?.transport,b=env?.probe_binding;if(!trustedContext(env)||!t||!b||t.server_derived!==true||t.caller_authored===true||t.transport_lease_generation!==1||t.installation_nonce!==env?.installed_binding?.installation_nonce||b.installation_nonce!==env?.installed_binding?.installation_nonce)return false;if(cmd===\\\"register-agent\\\")return t.job_id===b.register_job_id&&t.payload_sha256===b.register_payload_sha256&&t.agent_id===b.agent_id;if(cmd===\\\"claim\\\")return t.job_id===b.claim_job_id&&t.payload_sha256===b.claim_payload_sha256&&t.agent_id===b.agent_id&&t.task_id===b.task_id;return false}\\nexport function decideMutation(env:any,req:any){const cmd=String(req?.cmd||\\\"\\\");if(READ_ONLY.has(cmd))return{allow:true,reason:\\\"READ_ONLY_ALWAYS_AVAILABLE\\\",phase:derivePhase(env)};if(!trustedContext(env))return{allow:false,reason:\\\"TRUSTED_SERVER_CONTEXT_REQUIRED\\\",phase:\\\"CLOSED\\\"};if(!QUALIFIED_MUTATORS.has(cmd))return{allow:false,reason:\\\"UNCLASSIFIED_MUTATOR_FAIL_CLOSED\\\",phase:derivePhase(env)};if(cmd===\\\"recover-stale\\\")return req?.args_exact===true?{allow:true,reason:\\\"AGENTLESS_DETERMINISTIC_RECOVERY\\\",phase:derivePhase(env)}:{allow:false,reason:\\\"RECOVERY_SHAPE_REJECT\\\",phase:derivePhase(env)};const phase=derivePhase(env);if(phase===\\\"CLOSED\\\")return{allow:false,reason:\\\"PREBIND_NOT_ESTABLISHED_CANONICAL_MUTATION_CLOSED\\\",phase};if(phase===\\\"PROBE_ONLY\\\"){if(cmd===\\\"register-agent\\\"&&req?.type===\\\"CHAT_UNPROVEN\\\"&&req?.agent_id===env?.probe_binding?.agent_id&&probeTransportOk(env,cmd)&&req?.exact_probe_shape===true)return{allow:true,reason:\\\"EXACT_MACHINE_BOUND_PROBE_REGISTER\\\",phase};if(cmd===\\\"claim\\\"&&req?.agent_id===env?.probe_binding?.agent_id&&req?.task_id===env?.probe_binding?.task_id&&req?.lease_seconds===60&&probeTransportOk(env,cmd)&&req?.exact_probe_shape===true&&req?.register_receipt_present===true)return{allow:true,reason:\\\"EXACT_MACHINE_BOUND_PROBE_CLAIM\\\",phase};return{allow:false,reason:\\\"PROBE_ONLY_MUTATION_REJECTED\\\",phase}}if(cmd===\\\"register-agent\\\"){if(req?.existing_agent===true)return{allow:true,reason:\\\"ACTIVE_EXISTING_IDENTITY_REJOIN_SUBJECT_TO_LOCAL_CHECKS\\\",phase};if(req?.type!==\\\"CHAT_UNPROVEN\\\"&&req?.positive_ingress!==true)return{allow:false,reason:\\\"POSITIVE_INGRESS_REQUIRED_FOR_STRONGER_TYPE\\\",phase};return{allow:true,reason:req?.type===\\\"CHAT_UNPROVEN\\\"?\\\"ACTIVE_CHAT_UNPROVEN_REGISTER\\\":\\\"ACTIVE_POSITIVE_INGRESS_REGISTER\\\",phase}}if(req?.agent_present!==true)return{allow:false,reason:\\\"MUTATION_AGENT_REQUIRED\\\",phase};if(req?.agent_exists!==true)return{allow:false,reason:\\\"UNKNOWN_MUTATION_AGENT\\\",phase};if(req?.workstream_match!==true)return{allow:false,reason:\\\"MUTATION_AGENT_WORKSTREAM_MISMATCH\\\",phase};if(req?.agent_id===env?.probe_binding?.agent_id)return{allow:false,reason:\\\"RESERVED_PROBE_ID_INERT_AFTER_ACTIVATION\\\",phase};return{allow:true,reason:\\\"ACTIVE_REGISTERED_ACTOR_MUTATION_SUBJECT_TO_LOCAL_CHECKS\\\",phase}}\";\nconst prompt=`Adversarially review this candidate-only reference contract for a canonical mutation activation gate. The previous version had one under-specified same-hash reinstall replay ambiguity, now addressed with installation_nonce. The contract's env is intended to be constructed internally by server code from DB/transport/readback state, never from caller payload; req is caller-derived.\n\nFind concrete promotion-blocking counterexamples only. Check: stale exact-byte replay within same authority epoch, nonce replay/mismatch, forged ACTIVE through caller fields, stale/future receipts, preactivation ensure/supersede/migrate bypass, malformed probe register/claim, future mutators, and reserved probe reuse.\n\nImportant: do not invent control-flow fallthrough. Read the PROBE_ONLY block literally.\n\nReturn JSON only:\n{\"verdict\":\"PASS\"|\"FAIL\",\"promotion_blockers\":[{\"title\":\"...\",\"counterexample\":\"...\",\"repair\":\"...\"}],\"false_positive_corrections\":[],\"nonblocking_notes\":[]}\n\nPASS means only that this pure reference contract has no concrete blocker you can demonstrate. It is NOT production promotion.\n\nSOURCE:\n${source}`;\nconst res=await fetch(\"https://api.kilo.ai/api/gateway/chat/completions\",{method:\"POST\",headers:{\"content-type\":\"application/json\"},body:JSON.stringify({model:\"poolside/laguna-s-2.1:free\",messages:[{role:\"user\",content:prompt}],temperature:0,max_tokens:1800})});\nconst raw=await res.text();if(!res.ok)throw new Error(\"HTTP_\"+res.status+\":\"+raw.slice(0,1000));const env=JSON.parse(raw);console.log(JSON.stringify({id:env.id??null,model:env.model??null,cost:env?.usage?.cost??null,content:env?.choices?.[0]?.message?.content??null},null,2));",[150],"9dada5d6-f23c-41e3-b18b-cd1f738ed15f",["D",1788984570163],[27],"a8167655-5002-41bd-ac23-6dd82af55b7b","adversarial_review.ts","e630d828-ac89-11f1-a0c2-1607ee4eb77e",3,["D",1788984369754],"const source=\"export const QUALIFIED_MUTATORS=new Set([\\\"register-agent\\\",\\\"ensure-task\\\",\\\"claim\\\",\\\"renew-lease\\\",\\\"commit\\\",\\\"recover-stale\\\",\\\"supersede-task-context\\\",\\\"migrate-task-invariants\\\"]);\\nexport const READ_ONLY=new Set([\\\"status\\\",\\\"verify-chain\\\",\\\"verify-claim-graph\\\"]);\\nconst HEX64=/^[0-9a-f]{64}$/;\\nfunction exactBinding(b:any){return !!b&&HEX64.test(String(b.kernel_sha256||\\\"\\\"))&&HEX64.test(String(b.executor_sha256||\\\"\\\"))&&HEX64.test(String(b.protocol_sha256||\\\"\\\"))&&Number.isInteger(b.authority_epoch)&&b.authority_epoch>=1&&b.authority_writer===\\\"val_native\\\"&&b.authority_mode===\\\"ACTIVE\\\"}\\nfunction sameBinding(a:any,b:any){return exactBinding(a)&&exactBinding(b)&&a.kernel_sha256===b.kernel_sha256&&a.executor_sha256===b.executor_sha256&&a.protocol_sha256===b.protocol_sha256&&a.authority_epoch===b.authority_epoch&&a.authority_writer===b.authority_writer&&a.authority_mode===b.authority_mode}\\nfunction prebindOk(env:any){const p=env?.protocol_prebind;return !!p&&p.server_derived===true&&p.caller_authored===false&&p.fresh===true&&p.frozen===true&&p.source===\\\"AUTHORIZED_PRODUCTION_MAINTENANCE\\\"&&sameBinding(p.binding,env?.installed_binding)}\\nfunction receiptOk(r:any,cmd:string,env:any){if(!r||r.server_derived!==true||r.caller_authored===true||r.command!==cmd||r.ok!==true)return false;if(!sameBinding(r.serving_binding,env.installed_binding))return false;if(Number(r.authority_epoch)!==Number(env.installed_binding.authority_epoch))return false;if(!HEX64.test(String(r.payload_sha256||\\\"\\\"))||typeof r.job_id!==\\\"string\\\"||!r.job_id)return false;if(r.transport_lease_generation!==1||typeof r.lease_attempt_id!==\\\"string\\\"||!r.lease_attempt_id)return false;return true}\\nfunction activationProofOk(env:any){const p=env?.activation_proof;if(!prebindOk(env)||!p||p.schema!==\\\"PROJECT_BRAIN_FRESH_SERVING_ACTIVATION_PROOF_V1\\\"||p.server_derived!==true||p.caller_authored===true)return false;if(!sameBinding(p.binding,env.installed_binding))return false;if(p.prebind_generation!==env.protocol_prebind.generation||!Number.isInteger(p.prebind_generation))return false;if(!receiptOk(p.register_receipt,\\\"register-agent\\\",env)||!receiptOk(p.claim_receipt,\\\"claim\\\",env))return false;if(p.register_receipt.job_id!==env.probe_binding.register_job_id||p.register_receipt.payload_sha256!==env.probe_binding.register_payload_sha256)return false;if(p.claim_receipt.job_id!==env.probe_binding.claim_job_id||p.claim_receipt.payload_sha256!==env.probe_binding.claim_payload_sha256)return false;if(p.register_receipt.result?.agent_id!==env.probe_binding.agent_id||p.register_receipt.result?.created!==true)return false;if(p.claim_receipt.result?.agent_id!==env.probe_binding.agent_id||p.claim_receipt.result?.task_id!==env.probe_binding.task_id||p.claim_receipt.result?.lease_seconds!==60)return false;if(p.probe_task?.id!==env.probe_binding.task_id||p.probe_task?.execution_allowed!==false||p.probe_task?.canary_only!==true||p.probe_task?.independence_eligible!==false||p.probe_task?.p_real_eligible!==false)return false;if(p.verify_chain?.ok!==true||p.verify_claim_graph?.ok!==true)return false;if(!Number.isInteger(p.proof_generation)||p.proof_generation=1&&b.authority_writer===\"val_native\"&&b.authority_mode===\"ACTIVE\"}\nfunction sameBinding(a:any,b:any){return exactBinding(a)&&exactBinding(b)&&a.kernel_sha256===b.kernel_sha256&&a.executor_sha256===b.executor_sha256&&a.protocol_sha256===b.protocol_sha256&&a.installation_nonce===b.installation_nonce&&a.authority_epoch===b.authority_epoch&&a.authority_writer===b.authority_writer&&a.authority_mode===b.authority_mode}\nfunction prebindOk(env:any){const p=env?.protocol_prebind;return trustedContext(env)&&!!p&&p.server_derived===true&&p.caller_authored===false&&p.fresh===true&&p.frozen===true&&p.source===\"AUTHORIZED_PRODUCTION_MAINTENANCE\"&&Number.isInteger(p.generation)&&p.generation>=0&&sameBinding(p.binding,env?.installed_binding)}\nfunction receiptOk(r:any,cmd:string,env:any){if(!trustedContext(env)||!r||r.server_derived!==true||r.caller_authored===true||r.command!==cmd||r.ok!==true)return false;if(!sameBinding(r.serving_binding,env.installed_binding))return false;if(Number(r.authority_epoch)!==Number(env.installed_binding.authority_epoch))return false;if(!HEX64.test(String(r.payload_sha256||\"\"))||typeof r.job_id!==\"string\"||!r.job_id)return false;if(r.transport_lease_generation!==1||typeof r.lease_attempt_id!==\"string\"||!r.lease_attempt_id||!Number.isInteger(r.committed_generation))return false;if(r.committed_generationenv.canonical_generation)return false;if(p.historical_activation_event_used!==false)return false;return true}\nexport function derivePhase(env:any){if(!trustedContext(env)||!exactBinding(env?.installed_binding))return\"CLOSED\";if(!prebindOk(env))return\"CLOSED\";return activationProofOk(env)?\"ACTIVE\":\"PROBE_ONLY\"}\nfunction probeTransportOk(env:any,cmd:string){const t=env?.transport,b=env?.probe_binding;if(!trustedContext(env)||!t||!b||t.server_derived!==true||t.caller_authored===true||t.transport_lease_generation!==1||t.installation_nonce!==env?.installed_binding?.installation_nonce||b.installation_nonce!==env?.installed_binding?.installation_nonce)return false;if(cmd===\"register-agent\")return t.job_id===b.register_job_id&&t.payload_sha256===b.register_payload_sha256&&t.agent_id===b.agent_id;if(cmd===\"claim\")return t.job_id===b.claim_job_id&&t.payload_sha256===b.claim_payload_sha256&&t.agent_id===b.agent_id&&t.task_id===b.task_id;return false}\nexport function decideMutation(env:any,req:any){const cmd=String(req?.cmd||\"\");if(READ_ONLY.has(cmd))return{allow:true,reason:\"READ_ONLY_ALWAYS_AVAILABLE\",phase:derivePhase(env)};if(!trustedContext(env))return{allow:false,reason:\"TRUSTED_SERVER_CONTEXT_REQUIRED\",phase:\"CLOSED\"};if(!QUALIFIED_MUTATORS.has(cmd))return{allow:false,reason:\"UNCLASSIFIED_MUTATOR_FAIL_CLOSED\",phase:derivePhase(env)};if(cmd===\"recover-stale\")return req?.args_exact===true?{allow:true,reason:\"AGENTLESS_DETERMINISTIC_RECOVERY\",phase:derivePhase(env)}:{allow:false,reason:\"RECOVERY_SHAPE_REJECT\",phase:derivePhase(env)};const phase=derivePhase(env);if(phase===\"CLOSED\")return{allow:false,reason:\"PREBIND_NOT_ESTABLISHED_CANONICAL_MUTATION_CLOSED\",phase};if(phase===\"PROBE_ONLY\"){if(cmd===\"register-agent\"&&req?.type===\"CHAT_UNPROVEN\"&&req?.agent_id===env?.probe_binding?.agent_id&&probeTransportOk(env,cmd)&&req?.exact_probe_shape===true)return{allow:true,reason:\"EXACT_MACHINE_BOUND_PROBE_REGISTER\",phase};if(cmd===\"claim\"&&req?.agent_id===env?.probe_binding?.agent_id&&req?.task_id===env?.probe_binding?.task_id&&req?.lease_seconds===60&&probeTransportOk(env,cmd)&&req?.exact_probe_shape===true&&req?.register_receipt_present===true)return{allow:true,reason:\"EXACT_MACHINE_BOUND_PROBE_CLAIM\",phase};return{allow:false,reason:\"PROBE_ONLY_MUTATION_REJECTED\",phase}}if(cmd===\"register-agent\"){if(req?.existing_agent===true)return{allow:true,reason:\"ACTIVE_EXISTING_IDENTITY_REJOIN_SUBJECT_TO_LOCAL_CHECKS\",phase};if(req?.type!==\"CHAT_UNPROVEN\"&&req?.positive_ingress!==true)return{allow:false,reason:\"POSITIVE_INGRESS_REQUIRED_FOR_STRONGER_TYPE\",phase};return{allow:true,reason:req?.type===\"CHAT_UNPROVEN\"?\"ACTIVE_CHAT_UNPROVEN_REGISTER\":\"ACTIVE_POSITIVE_INGRESS_REGISTER\",phase}}if(req?.agent_present!==true)return{allow:false,reason:\"MUTATION_AGENT_REQUIRED\",phase};if(req?.agent_exists!==true)return{allow:false,reason:\"UNKNOWN_MUTATION_AGENT\",phase};if(req?.workstream_match!==true)return{allow:false,reason:\"MUTATION_AGENT_WORKSTREAM_MISMATCH\",phase};if(req?.agent_id===env?.probe_binding?.agent_id)return{allow:false,reason:\"RESERVED_PROBE_ID_INERT_AFTER_ACTIVATION\",phase};return{allow:true,reason:\"ACTIVE_REGISTERED_ACTOR_MUTATION_SUBJECT_TO_LOCAL_CHECKS\",phase}}\nexport function activationProofVerdict(env:any){return{phase:derivePhase(env),prebind_ok:prebindOk(env),activation_proof_ok:activationProofOk(env),trusted_context:trustedContext(env)}}\n",[167],"a0201763-a590-45b9-8c3a-33fdd80e3c49","admission_model.ts","b3233142-ac89-11f1-ac43-1607ee4eb77e",1,["D",1788984284096],"export const QUALIFIED_MUTATORS=new Set([\n \"register-agent\",\"ensure-task\",\"claim\",\"renew-lease\",\"commit\",\"recover-stale\",\"supersede-task-context\",\"migrate-task-invariants\"\n]);\nexport const READ_ONLY=new Set([\"status\",\"verify-chain\",\"verify-claim-graph\"]);\nconst HEX64=/^[0-9a-f]{64}$/;\nfunction exactBinding(b:any){return !!b&&HEX64.test(String(b.kernel_sha256||\"\"))&&HEX64.test(String(b.executor_sha256||\"\"))&&HEX64.test(String(b.protocol_sha256||\"\"))&&Number.isInteger(b.authority_epoch)&&b.authority_epoch>=1&&b.authority_writer===\"val_native\"&&b.authority_mode===\"ACTIVE\"}\nfunction sameBinding(a:any,b:any){return exactBinding(a)&&exactBinding(b)&&a.kernel_sha256===b.kernel_sha256&&a.executor_sha256===b.executor_sha256&&a.protocol_sha256===b.protocol_sha256&&a.authority_epoch===b.authority_epoch&&a.authority_writer===b.authority_writer&&a.authority_mode===b.authority_mode}\nfunction prebindOk(env:any){const p=env?.protocol_prebind;return !!p&&p.server_derived===true&&p.caller_authored===false&&p.fresh===true&&p.frozen===true&&p.source===\"AUTHORIZED_PRODUCTION_MAINTENANCE\"&&sameBinding(p.binding,env?.installed_binding)}\nfunction receiptOk(r:any,cmd:string,env:any){if(!r||r.server_derived!==true||r.caller_authored===true||r.command!==cmd||r.ok!==true)return false;if(!sameBinding(r.serving_binding,env.installed_binding))return false;if(Number(r.authority_epoch)!==Number(env.installed_binding.authority_epoch))return false;if(!HEX64.test(String(r.payload_sha256||\"\"))||typeof r.job_id!==\"string\"||!r.job_id)return false;if(r.transport_lease_generation!==1||typeof r.lease_attempt_id!==\"string\"||!r.lease_attempt_id)return false;return true}\nfunction activationProofOk(env:any){const p=env?.activation_proof;if(!prebindOk(env)||!p||p.schema!==\"PROJECT_BRAIN_FRESH_SERVING_ACTIVATION_PROOF_V1\"||p.server_derived!==true||p.caller_authored===true)return false;if(!sameBinding(p.binding,env.installed_binding))return false;if(p.prebind_generation!==env.protocol_prebind.generation||!Number.isInteger(p.prebind_generation))return false;if(!receiptOk(p.register_receipt,\"register-agent\",env)||!receiptOk(p.claim_receipt,\"claim\",env))return false;if(p.register_receipt.job_id!==env.probe_binding.register_job_id||p.register_receipt.payload_sha256!==env.probe_binding.register_payload_sha256)return false;if(p.claim_receipt.job_id!==env.probe_binding.claim_job_id||p.claim_receipt.payload_sha256!==env.probe_binding.claim_payload_sha256)return false;if(p.register_receipt.result?.agent_id!==env.probe_binding.agent_id||p.register_receipt.result?.created!==true)return false;if(p.claim_receipt.result?.agent_id!==env.probe_binding.agent_id||p.claim_receipt.result?.task_id!==env.probe_binding.task_id||p.claim_receipt.result?.lease_seconds!==60)return false;if(p.probe_task?.id!==env.probe_binding.task_id||p.probe_task?.execution_allowed!==false||p.probe_task?.canary_only!==true||p.probe_task?.independence_eligible!==false||p.probe_task?.p_real_eligible!==false)return false;if(p.verify_chain?.ok!==true||p.verify_claim_graph?.ok!==true)return false;if(!Number.isInteger(p.proof_generation)||p.proof_generation

Diff · v7