[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_317":318,"_319":320},"routes/_app.x.$handle.$name",{"_97":96,"_32":44,"_106":85,"_27":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":120,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",20,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":20,"_34":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":20,"_34":35},"deleted",false,"deletedHere","path","claim-evidence-admission.mjs","latestPath","fileId","6ae1ab5e-af4d-11f1-b08a-1607ee4eb77e","name","fileType","content","import { sha256Canonical, stableJson, stableValue } from './vendor/rumbo-core/src/canonical.js';\nimport { validateEvidence, resolveSupersession } from './vendor/rumbo-core/src/evidence.js';\n\nexport const VERSION = 'RUMBO-CEA-V1.2.0-CANDIDATE';\nexport const CLAIM_BINDING_SCHEMA = 'rumbo.claim-binding/v1';\nexport const EVIDENCE_SCHEMA = 'rumbo-state-evidence/r1/evidence';\n\nfunction isPlainObject(v) {\n if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;\n const proto = Object.getPrototypeOf(v);\n return proto === Object.prototype || proto === null;\n}\n\nfunction strictParseJson(text, field) {\n if (isPlainObject(text) || Array.isArray(text)) return text;\n if (typeof text !== 'string' || !text.trim()) throw new Error(`${field}:JSON_REQUIRED`);\n\n const s = text.trim();\n let i = 0;\n const fail = (code) => { throw new Error(`${field}:${code}`); };\n const ws = () => { while (i < s.length && /\\s/.test(s[i])) i += 1; };\n\n const readString = () => {\n if (s[i] !== '\"') fail('INVALID_JSON_STRING');\n const start = i;\n i += 1;\n while (i < s.length) {\n const ch = s[i];\n if (ch === '\"') {\n i += 1;\n try { return JSON.parse(s.slice(start, i)); } catch { fail('INVALID_JSON_STRING'); }\n }\n if (ch === '\\\\') {\n if (i + 1 >= s.length) fail('INVALID_JSON_ESCAPE');\n if (s[i + 1] === 'u') {\n if (!/^[0-9A-Fa-f]{4}$/.test(s.slice(i + 2, i + 6))) fail('INVALID_JSON_UNICODE_ESCAPE');\n i += 6;\n } else {\n if (!/[\"\\\\/bfnrt]/.test(s[i + 1])) fail('INVALID_JSON_ESCAPE');\n i += 2;\n }\n continue;\n }\n if (ch.charCodeAt(0) < 0x20) fail('INVALID_JSON_CONTROL_CHAR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_STRING');\n };\n\n const readValue = () => {\n ws();\n if (i >= s.length) fail('UNEXPECTED_JSON_EOF');\n if (s[i] === '{') return readObject();\n if (s[i] === '[') return readArray();\n if (s[i] === '\"') { readString(); return; }\n const start = i;\n while (i < s.length && !/[\\s,\\]}]/.test(s[i])) i += 1;\n const token = s.slice(start, i);\n if (!token) fail('INVALID_JSON_VALUE');\n try { JSON.parse(token); } catch { fail('INVALID_JSON_VALUE'); }\n };\n\n const readObject = () => {\n i += 1;\n ws();\n const seen = new Set();\n if (s[i] === '}') { i += 1; return; }\n while (i < s.length) {\n ws();\n const key = readString();\n if (seen.has(key)) fail(`DUPLICATE_JSON_KEY:${key}`);\n seen.add(key);\n ws();\n if (s[i] !== ':') fail('INVALID_JSON_OBJECT_COLON');\n i += 1;\n readValue();\n ws();\n if (s[i] === '}') { i += 1; return; }\n if (s[i] !== ',') fail('INVALID_JSON_OBJECT_SEPARATOR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_OBJECT');\n };\n\n const readArray = () => {\n i += 1;\n ws();\n if (s[i] === ']') { i += 1; return; }\n while (i < s.length) {\n readValue();\n ws();\n if (s[i] === ']') { i += 1; return; }\n if (s[i] !== ',') fail('INVALID_JSON_ARRAY_SEPARATOR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_ARRAY');\n };\n\n readValue();\n ws();\n if (i !== s.length) fail('TRAILING_JSON_DATA');\n try { return JSON.parse(s); } catch { fail('INVALID_JSON'); }\n}\n\nfunction assertAllowedKeys(value, allowed, field) {\n if (!isPlainObject(value)) throw new Error(`${field}:OBJECT_REQUIRED`);\n for (const key of Object.keys(value)) {\n if (!allowed.includes(key)) throw new Error(`${field}:UNKNOWN_FIELD:${key}`);\n }\n}\n\nfunction canonicalId(v, field) {\n if (typeof v !== 'string' || !v.length) throw new Error(`${field}:ID_REQUIRED`);\n if (v !== v.trim()) throw new Error(`${field}:ID_NOT_CANONICAL`);\n return v;\n}\n\nfunction identity(v, field) {\n assertAllowedKeys(v, ['kind', 'id'], field);\n const kindRaw = typeof v.kind === 'string' ? v.kind : '';\n const idRaw = typeof v.id === 'string' ? v.id : '';\n if (!kindRaw || !idRaw) throw new Error(`${field}:KIND_AND_ID_REQUIRED`);\n if (kindRaw !== kindRaw.trim() || idRaw !== idRaw.trim()) throw new Error(`${field}:IDENTITY_NOT_CANONICAL`);\n const kind = kindRaw.toLowerCase();\n if (!/^[a-z][a-z0-9_.-]*$/.test(kind)) throw new Error(`${field}:INVALID_KIND`);\n return { kind, id: idRaw };\n}\n\nfunction sameIdentity(a, b) {\n return a?.kind === b?.kind && a?.id === b?.id;\n}\n\nfunction identityKey(v) {\n return `${v.kind}\\u0000${v.id}`;\n}\n\nfunction uniqueClaimIds(items) {\n const seen = new Set();\n for (const item of items) {\n if (!isPlainObject(item)) throw new Error('claims:ITEM_OBJECT_REQUIRED');\n const id = canonicalId(item.id, 'claim');\n if (seen.has(id)) throw new Error(`claims:DUPLICATE_ID:${id}`);\n seen.add(id);\n }\n}\n\nfunction uniqueEvidenceIds(records) {\n const seen = new Set();\n for (const record of records) {\n if (!isPlainObject(record)) throw new Error('evidence:RECORD_OBJECT_REQUIRED');\n const id = canonicalId(record.evidenceId, 'evidence');\n if (seen.has(id)) throw new Error(`evidence:DUPLICATE_ID:${id}`);\n seen.add(id);\n }\n}\n\nfunction normalizeClaim(cl, expectedIdentity = null) {\n assertAllowedKeys(cl, ['id', 'scope', 'predicate', 'value', 'subject', 'capability', 'evidence_refs'], 'claim');\n const id = canonicalId(cl.id, 'claim');\n const scope = typeof cl.scope === 'string' ? cl.scope.trim().toLowerCase() : '';\n if (!['target', 'capability'].includes(scope)) throw new Error(`claim.${id}:INVALID_SCOPE`);\n if (typeof cl.predicate !== 'string' || !cl.predicate.trim()) throw new Error(`claim.${id}:PREDICATE_REQUIRED`);\n if (cl.predicate !== cl.predicate.trim()) throw new Error(`claim.${id}:PREDICATE_NOT_CANONICAL`);\n if (!Object.hasOwn(cl, 'value')) throw new Error(`claim.${id}:VALUE_REQUIRED`);\n try { stableValue(cl.value); } catch { throw new Error(`claim.${id}:VALUE_NOT_CANONICALIZABLE`); }\n\n if (scope === 'target' && Object.hasOwn(cl, 'capability')) throw new Error(`claim.${id}:UNEXPECTED_CAPABILITY`);\n if (scope === 'capability' && Object.hasOwn(cl, 'subject')) throw new Error(`claim.${id}:UNEXPECTED_SUBJECT`);\n const claimIdentity = scope === 'target'\n ? identity(cl.subject, `claim.${id}.subject`)\n : identity(cl.capability, `claim.${id}.capability`);\n\n if (expectedIdentity && !sameIdentity(claimIdentity, expectedIdentity)) throw new Error(`claim.${id}:CLAIM_TARGET_MISMATCH`);\n if (!Array.isArray(cl.evidence_refs) || cl.evidence_refs.length === 0) throw new Error(`claim.${id}:EVIDENCE_REFS_REQUIRED`);\n const evidenceRefs = cl.evidence_refs.map((ref) => canonicalId(ref, `claim.${id}.evidence_ref`));\n if (new Set(evidenceRefs).size !== evidenceRefs.length) throw new Error(`claim.${id}:DUPLICATE_EVIDENCE_REF`);\n\n return {\n id,\n scope,\n predicate: cl.predicate,\n value: stableValue(cl.value),\n identity: claimIdentity,\n evidence_refs: evidenceRefs,\n };\n}\n\nexport function claimBindingDigest(claim) {\n const normalized = normalizeClaim(claim);\n return sha256Canonical({\n schema: CLAIM_BINDING_SCHEMA,\n claim_id: normalized.id,\n scope: normalized.scope,\n predicate: normalized.predicate,\n value: normalized.value,\n identity: normalized.identity,\n });\n}\n\nexport function claimToken(claim) {\n return `sha256:${claimBindingDigest(claim)}`;\n}\n\nfunction exclusionSet(negativeBindings) {\n const out = new Set();\n if (!negativeBindings) return out;\n const nb = strictParseJson(negativeBindings, 'negativeBindings');\n assertAllowedKeys(nb, ['subjects', 'capabilities'], 'negativeBindings');\n for (const key of ['subjects', 'capabilities']) {\n if (Object.hasOwn(nb, key) && !Array.isArray(nb[key])) throw new Error(`negativeBindings:${key.toUpperCase()}_ARRAY_REQUIRED`);\n }\n for (const raw of [...(nb.subjects ?? []), ...(nb.capabilities ?? [])]) out.add(identityKey(identity(raw, 'negativeBindings.identity')));\n return out;\n}\n\nfunction reject(id, reason, detail = {}) {\n return { id, admitted: false, reason, ...detail };\n}\n\nfunction nextGateFor(rejectedClaims, conflicts) {\n if (conflicts.length) return 'EVIDENCE_RECONCILIATION_REQUIRED';\n if (rejectedClaims.some((x) => x.reason === 'NEGATIVE_BINDING_EXCLUSION')) return 'RECOVERY_SCOPE_RECONCILIATION_REQUIRED';\n const nested = rejectedClaims.flatMap((x) => Array.isArray(x.problems) ? x.problems : []);\n if (nested.some((x) => x.reason === 'FOREIGN_EVIDENCE_IDENTITY' && x.scope === 'target')) return 'EXACT_SUBJECT_EVIDENCE_REQUIRED';\n if (nested.some((x) => x.reason === 'FOREIGN_EVIDENCE_IDENTITY' && x.scope === 'capability')) return 'EXACT_CAPABILITY_EVIDENCE_REQUIRED';\n if (nested.some((x) => x.reason === 'UNKNOWN_EVIDENCE_REF')) return 'EVIDENCE_REQUIRED';\n if (nested.some((x) => ['CLAIM_DIGEST_MISMATCH', 'EVIDENCE_VALUE_MISMATCH'].includes(x.reason))) return 'EXACT_CLAIM_ATTESTATION_REQUIRED';\n if (nested.some((x) => x.reason === 'SUPERSEDED_EVIDENCE_REF')) return 'FRESH_ACTIVE_EVIDENCE_REQUIRED';\n if (nested.some((x) => x.reason === 'EVIDENCE_CLASSIFICATION_NOT_ADMISSIBLE')) return 'ADMISSIBLE_EVIDENCE_CLASSIFICATION_REQUIRED';\n if (rejectedClaims.some((x) => x.reason === 'CLAIM_TARGET_MISMATCH')) return 'TARGET_IDENTITY_RECONCILIATION_REQUIRED';\n return 'INPUT_OR_CONTRACT_REPAIR_REQUIRED';\n}\n\nexport function evaluateClaimEvidenceAdmission({ target, claims, evidence, negativeBindings = '' }) {\n let parsedTarget;\n let parsedClaims;\n let parsedEvidence;\n let exclusions;\n try {\n parsedTarget = strictParseJson(target, 'target');\n parsedClaims = strictParseJson(claims, 'claims');\n parsedEvidence = strictParseJson(evidence, 'evidence');\n exclusions = exclusionSet(negativeBindings);\n } catch (err) {\n return finalize({\n verdict: 'NO_GO', classification: 'FAIL_CLOSED_INVALID_INPUT', nextGate: 'STRICT_INPUT_REQUIRED', target: null,\n admittedClaims: [], rejectedClaims: [reject(null, String(err?.message || err))], conflicts: [], evidenceRefs: [],\n });\n }\n\n try {\n assertAllowedKeys(parsedTarget, ['subject', 'capability'], 'target');\n assertAllowedKeys(parsedClaims, ['claims'], 'claims');\n assertAllowedKeys(parsedEvidence, ['records'], 'evidence');\n\n const subject = parsedTarget.subject ? identity(parsedTarget.subject, 'target.subject') : null;\n const capability = parsedTarget.capability ? identity(parsedTarget.capability, 'target.capability') : null;\n if (!subject && !capability) throw new Error('target:SUBJECT_OR_CAPABILITY_REQUIRED');\n\n const claimList = Array.isArray(parsedClaims.claims) ? parsedClaims.claims : null;\n const records = Array.isArray(parsedEvidence.records) ? parsedEvidence.records : null;\n if (!claimList?.length) throw new Error('claims:NONEMPTY_ARRAY_REQUIRED');\n if (!records?.length) throw new Error('evidence:NONEMPTY_RECORDS_REQUIRED');\n uniqueClaimIds(claimList);\n uniqueEvidenceIds(records);\n\n const normalizedClaims = new Map();\n const rejectedClaims = [];\n for (const raw of claimList) {\n try {\n const scope = typeof raw.scope === 'string' ? raw.scope.trim().toLowerCase() : '';\n const expected = scope === 'target' ? subject : scope === 'capability' ? capability : null;\n if (scope === 'target' && !subject) { rejectedClaims.push(reject(raw.id ?? null, 'TARGET_SUBJECT_NOT_DECLARED')); continue; }\n if (scope === 'capability' && !capability) { rejectedClaims.push(reject(raw.id ?? null, 'TARGET_CAPABILITY_NOT_DECLARED')); continue; }\n const cl = normalizeClaim(raw, expected);\n normalizedClaims.set(cl.id, { ...cl, claim_sha256: claimBindingDigest(raw), claim_token: claimToken(raw) });\n } catch (err) {\n const msg = String(err?.message || err);\n if (msg.includes('CLAIM_TARGET_MISMATCH')) rejectedClaims.push(reject(raw.id ?? null, 'CLAIM_TARGET_MISMATCH'));\n else rejectedClaims.push(reject(raw.id ?? null, 'INVALID_CLAIM_CONTRACT', { detail: msg }));\n }\n }\n\n const conflicts = [];\n const recordMap = new Map();\n for (const record of records) {\n const validation = validateEvidence(record);\n if (!validation.ok) {\n conflicts.push({ evidence_id: record?.evidenceId ?? null, reason: 'INVALID_R1_EVIDENCE', detail: validation.reason });\n continue;\n }\n recordMap.set(record.evidenceId, record);\n }\n\n let activeIds = new Set();\n let supersededIds = new Set();\n if (conflicts.length === 0) {\n const resolved = resolveSupersession(records);\n for (const link of resolved.invalidLinks) conflicts.push({ reason: 'INVALID_SUPERSESSION_LINK', ...link });\n for (const cycle of resolved.cycles) conflicts.push({ reason: 'SUPERSESSION_CYCLE', cycle });\n activeIds = new Set(resolved.active.map((record) => record.evidenceId));\n supersededIds = new Set(resolved.superseded.map((record) => record.evidenceId));\n }\n\n const admittedClaims = [];\n for (const [claimId, cl] of normalizedClaims.entries()) {\n if (exclusions.has(identityKey(cl.identity))) {\n rejectedClaims.push(reject(claimId, 'NEGATIVE_BINDING_EXCLUSION', { identity: cl.identity }));\n continue;\n }\n\n const problems = [];\n const used = [];\n for (const ref of cl.evidence_refs) {\n const record = recordMap.get(ref);\n if (!record) {\n problems.push({ ref, scope: cl.scope, reason: 'UNKNOWN_EVIDENCE_REF' });\n continue;\n }\n used.push(ref);\n\n if (supersededIds.has(ref)) problems.push({ ref, scope: cl.scope, reason: 'SUPERSEDED_EVIDENCE_REF' });\n else if (activeIds.size && !activeIds.has(ref)) problems.push({ ref, scope: cl.scope, reason: 'EVIDENCE_NOT_ACTIVE' });\n\n const actualIdentity = { kind: record.subject.kind, id: record.subject.id };\n if (!sameIdentity(actualIdentity, cl.identity)) {\n problems.push({ ref, scope: cl.scope, reason: 'FOREIGN_EVIDENCE_IDENTITY', expected: cl.identity, actual: actualIdentity });\n }\n\n if (record.subject.claim !== cl.claim_token) {\n problems.push({ ref, scope: cl.scope, reason: 'CLAIM_DIGEST_MISMATCH', expected_claim: cl.claim_token, actual_claim: record.subject.claim });\n }\n\n if (stableJson(record.after) !== stableJson(cl.value)) {\n problems.push({ ref, scope: cl.scope, reason: 'EVIDENCE_VALUE_MISMATCH', expected_value: cl.value, actual_value: record.after });\n }\n\n if (record.classification === 'NOT_PROVEN') {\n problems.push({ ref, scope: cl.scope, reason: 'EVIDENCE_CLASSIFICATION_NOT_ADMISSIBLE', classification: record.classification });\n }\n }\n\n if (problems.length) {\n rejectedClaims.push(reject(claimId, 'CLAIM_EVIDENCE_BINDING_FAILED', {\n scope: cl.scope, predicate: cl.predicate, value: cl.value, claim_sha256: cl.claim_sha256,\n evidenceRefs: used, problems,\n }));\n } else {\n admittedClaims.push({\n id: claimId, admitted: true, scope: cl.scope, predicate: cl.predicate, value: cl.value,\n identity: cl.identity, claim_sha256: cl.claim_sha256, claim_token: cl.claim_token,\n evidenceRefs: cl.evidence_refs,\n });\n }\n }\n\n if (conflicts.length) {\n for (const conflict of conflicts) rejectedClaims.push(reject(null, 'EVIDENCE_RECONCILIATION_CONFLICT', conflict));\n }\n\n const verdict = rejectedClaims.length === 0 && admittedClaims.length === claimList.length ? 'GO' : 'NO_GO';\n const nextGate = verdict === 'GO' ? 'NONE' : nextGateFor(rejectedClaims, conflicts);\n return finalize({\n verdict,\n classification: verdict === 'GO' ? 'R1_EVIDENCE_BOUND_TO_EXACT_SUBJECT_CLAIM_AND_VALUE' : 'UNPROVEN_OR_CROSS_BOUND_EVIDENCE',\n nextGate,\n target: { subject, capability },\n admittedClaims,\n rejectedClaims,\n conflicts,\n evidenceRefs: [...recordMap.keys()].sort(),\n canonicalEvidenceContract: EVIDENCE_SCHEMA,\n });\n } catch (err) {\n return finalize({\n verdict: 'NO_GO', classification: 'FAIL_CLOSED_INVALID_CONTRACT', nextGate: 'CONTRACT_REPAIR_REQUIRED', target: null,\n admittedClaims: [], rejectedClaims: [reject(null, String(err?.message || err))], conflicts: [], evidenceRefs: [],\n });\n }\n}\n\nfunction finalize(body) {\n const receiptBody = {\n schema: 'rumbo.claim-evidence-admission/v1.2',\n runtime_id: VERSION,\n authority: 'PRE_ANSWER_ADMISSION_ONLY_NO_PROMOTION_AUTHORITY',\n trust_boundary: 'R1_CANONICALITY_AND_HASH_INTEGRITY_DO_NOT_AUTHENTICATE_SOURCE_OR_AUTHORIZE_ACTION',\n required_outer_controls: ['SOURCE_TRUST_OR_AUTHENTICITY_WHEN_REQUIRED', 'LIVE_FRESHNESS_FOR_VOLATILE_STATE', 'SEPARATE_PROMOTION_AUTHORIZATION_FOR_CONSEQUENTIAL_ACTIONS'],\n ...body,\n };\n return {\n ...receiptBody,\n receipt_sha256: sha256Canonical(receiptBody),\n canonicalization: 'rumbo-core/stableJson',\n };\n}\n","import { sha256Canonical, stableJson, stableValue } from './vendor/rumbo-core/src/canonical.js';\nimport { validateEvidence, resolveSupersession } from './vendor/rumbo-core/src/evidence.js';\n\nexport const VERSION = 'RUMBO-CEA-V1.2.0';\nexport const CLAIM_BINDING_SCHEMA = 'rumbo.claim-binding/v1';\nexport const EVIDENCE_SCHEMA = 'rumbo-state-evidence/r1/evidence';\n\nfunction isPlainObject(v) {\n if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;\n const proto = Object.getPrototypeOf(v);\n return proto === Object.prototype || proto === null;\n}\n\nfunction strictParseJson(text, field) {\n if (isPlainObject(text) || Array.isArray(text)) return text;\n if (typeof text !== 'string' || !text.trim()) throw new Error(`${field}:JSON_REQUIRED`);\n\n const s = text.trim();\n let i = 0;\n const fail = (code) => { throw new Error(`${field}:${code}`); };\n const ws = () => { while (i < s.length && /\\s/.test(s[i])) i += 1; };\n\n const readString = () => {\n if (s[i] !== '\"') fail('INVALID_JSON_STRING');\n const start = i;\n i += 1;\n while (i < s.length) {\n const ch = s[i];\n if (ch === '\"') {\n i += 1;\n try { return JSON.parse(s.slice(start, i)); } catch { fail('INVALID_JSON_STRING'); }\n }\n if (ch === '\\\\') {\n if (i + 1 >= s.length) fail('INVALID_JSON_ESCAPE');\n if (s[i + 1] === 'u') {\n if (!/^[0-9A-Fa-f]{4}$/.test(s.slice(i + 2, i + 6))) fail('INVALID_JSON_UNICODE_ESCAPE');\n i += 6;\n } else {\n if (!/[\"\\\\/bfnrt]/.test(s[i + 1])) fail('INVALID_JSON_ESCAPE');\n i += 2;\n }\n continue;\n }\n if (ch.charCodeAt(0) < 0x20) fail('INVALID_JSON_CONTROL_CHAR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_STRING');\n };\n\n const readValue = () => {\n ws();\n if (i >= s.length) fail('UNEXPECTED_JSON_EOF');\n if (s[i] === '{') return readObject();\n if (s[i] === '[') return readArray();\n if (s[i] === '\"') { readString(); return; }\n const start = i;\n while (i < s.length && !/[\\s,\\]}]/.test(s[i])) i += 1;\n const token = s.slice(start, i);\n if (!token) fail('INVALID_JSON_VALUE');\n try { JSON.parse(token); } catch { fail('INVALID_JSON_VALUE'); }\n };\n\n const readObject = () => {\n i += 1;\n ws();\n const seen = new Set();\n if (s[i] === '}') { i += 1; return; }\n while (i < s.length) {\n ws();\n const key = readString();\n if (seen.has(key)) fail(`DUPLICATE_JSON_KEY:${key}`);\n seen.add(key);\n ws();\n if (s[i] !== ':') fail('INVALID_JSON_OBJECT_COLON');\n i += 1;\n readValue();\n ws();\n if (s[i] === '}') { i += 1; return; }\n if (s[i] !== ',') fail('INVALID_JSON_OBJECT_SEPARATOR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_OBJECT');\n };\n\n const readArray = () => {\n i += 1;\n ws();\n if (s[i] === ']') { i += 1; return; }\n while (i < s.length) {\n readValue();\n ws();\n if (s[i] === ']') { i += 1; return; }\n if (s[i] !== ',') fail('INVALID_JSON_ARRAY_SEPARATOR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_ARRAY');\n };\n\n readValue();\n ws();\n if (i !== s.length) fail('TRAILING_JSON_DATA');\n try { return JSON.parse(s); } catch { fail('INVALID_JSON'); }\n}\n\nfunction assertAllowedKeys(value, allowed, field) {\n if (!isPlainObject(value)) throw new Error(`${field}:OBJECT_REQUIRED`);\n for (const key of Object.keys(value)) {\n if (!allowed.includes(key)) throw new Error(`${field}:UNKNOWN_FIELD:${key}`);\n }\n}\n\nfunction canonicalId(v, field) {\n if (typeof v !== 'string' || !v.length) throw new Error(`${field}:ID_REQUIRED`);\n if (v !== v.trim()) throw new Error(`${field}:ID_NOT_CANONICAL`);\n return v;\n}\n\nfunction identity(v, field) {\n assertAllowedKeys(v, ['kind', 'id'], field);\n const kindRaw = typeof v.kind === 'string' ? v.kind : '';\n const idRaw = typeof v.id === 'string' ? v.id : '';\n if (!kindRaw || !idRaw) throw new Error(`${field}:KIND_AND_ID_REQUIRED`);\n if (kindRaw !== kindRaw.trim() || idRaw !== idRaw.trim()) throw new Error(`${field}:IDENTITY_NOT_CANONICAL`);\n const kind = kindRaw.toLowerCase();\n if (!/^[a-z][a-z0-9_.-]*$/.test(kind)) throw new Error(`${field}:INVALID_KIND`);\n return { kind, id: idRaw };\n}\n\nfunction sameIdentity(a, b) {\n return a?.kind === b?.kind && a?.id === b?.id;\n}\n\nfunction identityKey(v) {\n return `${v.kind}\\u0000${v.id}`;\n}\n\nfunction uniqueClaimIds(items) {\n const seen = new Set();\n for (const item of items) {\n if (!isPlainObject(item)) throw new Error('claims:ITEM_OBJECT_REQUIRED');\n const id = canonicalId(item.id, 'claim');\n if (seen.has(id)) throw new Error(`claims:DUPLICATE_ID:${id}`);\n seen.add(id);\n }\n}\n\nfunction uniqueEvidenceIds(records) {\n const seen = new Set();\n for (const record of records) {\n if (!isPlainObject(record)) throw new Error('evidence:RECORD_OBJECT_REQUIRED');\n const id = canonicalId(record.evidenceId, 'evidence');\n if (seen.has(id)) throw new Error(`evidence:DUPLICATE_ID:${id}`);\n seen.add(id);\n }\n}\n\nfunction normalizeClaim(cl, expectedIdentity = null) {\n assertAllowedKeys(cl, ['id', 'scope', 'predicate', 'value', 'subject', 'capability', 'evidence_refs'], 'claim');\n const id = canonicalId(cl.id, 'claim');\n const scope = typeof cl.scope === 'string' ? cl.scope.trim().toLowerCase() : '';\n if (!['target', 'capability'].includes(scope)) throw new Error(`claim.${id}:INVALID_SCOPE`);\n if (typeof cl.predicate !== 'string' || !cl.predicate.trim()) throw new Error(`claim.${id}:PREDICATE_REQUIRED`);\n if (cl.predicate !== cl.predicate.trim()) throw new Error(`claim.${id}:PREDICATE_NOT_CANONICAL`);\n if (!Object.hasOwn(cl, 'value')) throw new Error(`claim.${id}:VALUE_REQUIRED`);\n try { stableValue(cl.value); } catch { throw new Error(`claim.${id}:VALUE_NOT_CANONICALIZABLE`); }\n\n if (scope === 'target' && Object.hasOwn(cl, 'capability')) throw new Error(`claim.${id}:UNEXPECTED_CAPABILITY`);\n if (scope === 'capability' && Object.hasOwn(cl, 'subject')) throw new Error(`claim.${id}:UNEXPECTED_SUBJECT`);\n const claimIdentity = scope === 'target'\n ? identity(cl.subject, `claim.${id}.subject`)\n : identity(cl.capability, `claim.${id}.capability`);\n\n if (expectedIdentity && !sameIdentity(claimIdentity, expectedIdentity)) throw new Error(`claim.${id}:CLAIM_TARGET_MISMATCH`);\n if (!Array.isArray(cl.evidence_refs) || cl.evidence_refs.length === 0) throw new Error(`claim.${id}:EVIDENCE_REFS_REQUIRED`);\n const evidenceRefs = cl.evidence_refs.map((ref) => canonicalId(ref, `claim.${id}.evidence_ref`));\n if (new Set(evidenceRefs).size !== evidenceRefs.length) throw new Error(`claim.${id}:DUPLICATE_EVIDENCE_REF`);\n\n return {\n id,\n scope,\n predicate: cl.predicate,\n value: stableValue(cl.value),\n identity: claimIdentity,\n evidence_refs: evidenceRefs,\n };\n}\n\nexport function claimBindingDigest(claim) {\n const normalized = normalizeClaim(claim);\n return sha256Canonical({\n schema: CLAIM_BINDING_SCHEMA,\n claim_id: normalized.id,\n scope: normalized.scope,\n predicate: normalized.predicate,\n value: normalized.value,\n identity: normalized.identity,\n });\n}\n\nexport function claimToken(claim) {\n return `sha256:${claimBindingDigest(claim)}`;\n}\n\nfunction exclusionSet(negativeBindings) {\n const out = new Set();\n if (!negativeBindings) return out;\n const nb = strictParseJson(negativeBindings, 'negativeBindings');\n assertAllowedKeys(nb, ['subjects', 'capabilities'], 'negativeBindings');\n for (const key of ['subjects', 'capabilities']) {\n if (Object.hasOwn(nb, key) && !Array.isArray(nb[key])) throw new Error(`negativeBindings:${key.toUpperCase()}_ARRAY_REQUIRED`);\n }\n for (const raw of [...(nb.subjects ?? []), ...(nb.capabilities ?? [])]) out.add(identityKey(identity(raw, 'negativeBindings.identity')));\n return out;\n}\n\nfunction reject(id, reason, detail = {}) {\n return { id, admitted: false, reason, ...detail };\n}\n\nfunction nextGateFor(rejectedClaims, conflicts) {\n if (conflicts.length) return 'EVIDENCE_RECONCILIATION_REQUIRED';\n if (rejectedClaims.some((x) => x.reason === 'NEGATIVE_BINDING_EXCLUSION')) return 'RECOVERY_SCOPE_RECONCILIATION_REQUIRED';\n const nested = rejectedClaims.flatMap((x) => Array.isArray(x.problems) ? x.problems : []);\n if (nested.some((x) => x.reason === 'FOREIGN_EVIDENCE_IDENTITY' && x.scope === 'target')) return 'EXACT_SUBJECT_EVIDENCE_REQUIRED';\n if (nested.some((x) => x.reason === 'FOREIGN_EVIDENCE_IDENTITY' && x.scope === 'capability')) return 'EXACT_CAPABILITY_EVIDENCE_REQUIRED';\n if (nested.some((x) => x.reason === 'UNKNOWN_EVIDENCE_REF')) return 'EVIDENCE_REQUIRED';\n if (nested.some((x) => ['CLAIM_DIGEST_MISMATCH', 'EVIDENCE_VALUE_MISMATCH'].includes(x.reason))) return 'EXACT_CLAIM_ATTESTATION_REQUIRED';\n if (nested.some((x) => x.reason === 'SUPERSEDED_EVIDENCE_REF')) return 'FRESH_ACTIVE_EVIDENCE_REQUIRED';\n if (nested.some((x) => x.reason === 'EVIDENCE_CLASSIFICATION_NOT_ADMISSIBLE')) return 'ADMISSIBLE_EVIDENCE_CLASSIFICATION_REQUIRED';\n if (rejectedClaims.some((x) => x.reason === 'CLAIM_TARGET_MISMATCH')) return 'TARGET_IDENTITY_RECONCILIATION_REQUIRED';\n return 'INPUT_OR_CONTRACT_REPAIR_REQUIRED';\n}\n\nexport function evaluateClaimEvidenceAdmission({ target, claims, evidence, negativeBindings = '' }) {\n let parsedTarget;\n let parsedClaims;\n let parsedEvidence;\n let exclusions;\n try {\n parsedTarget = strictParseJson(target, 'target');\n parsedClaims = strictParseJson(claims, 'claims');\n parsedEvidence = strictParseJson(evidence, 'evidence');\n exclusions = exclusionSet(negativeBindings);\n } catch (err) {\n return finalize({\n verdict: 'NO_GO', classification: 'FAIL_CLOSED_INVALID_INPUT', nextGate: 'STRICT_INPUT_REQUIRED', target: null,\n admittedClaims: [], rejectedClaims: [reject(null, String(err?.message || err))], conflicts: [], evidenceRefs: [],\n });\n }\n\n try {\n assertAllowedKeys(parsedTarget, ['subject', 'capability'], 'target');\n assertAllowedKeys(parsedClaims, ['claims'], 'claims');\n assertAllowedKeys(parsedEvidence, ['records'], 'evidence');\n\n const subject = parsedTarget.subject ? identity(parsedTarget.subject, 'target.subject') : null;\n const capability = parsedTarget.capability ? identity(parsedTarget.capability, 'target.capability') : null;\n if (!subject && !capability) throw new Error('target:SUBJECT_OR_CAPABILITY_REQUIRED');\n\n const claimList = Array.isArray(parsedClaims.claims) ? parsedClaims.claims : null;\n const records = Array.isArray(parsedEvidence.records) ? parsedEvidence.records : null;\n if (!claimList?.length) throw new Error('claims:NONEMPTY_ARRAY_REQUIRED');\n if (!records?.length) throw new Error('evidence:NONEMPTY_RECORDS_REQUIRED');\n uniqueClaimIds(claimList);\n uniqueEvidenceIds(records);\n\n const normalizedClaims = new Map();\n const rejectedClaims = [];\n for (const raw of claimList) {\n try {\n const scope = typeof raw.scope === 'string' ? raw.scope.trim().toLowerCase() : '';\n const expected = scope === 'target' ? subject : scope === 'capability' ? capability : null;\n if (scope === 'target' && !subject) { rejectedClaims.push(reject(raw.id ?? null, 'TARGET_SUBJECT_NOT_DECLARED')); continue; }\n if (scope === 'capability' && !capability) { rejectedClaims.push(reject(raw.id ?? null, 'TARGET_CAPABILITY_NOT_DECLARED')); continue; }\n const cl = normalizeClaim(raw, expected);\n normalizedClaims.set(cl.id, { ...cl, claim_sha256: claimBindingDigest(raw), claim_token: claimToken(raw) });\n } catch (err) {\n const msg = String(err?.message || err);\n if (msg.includes('CLAIM_TARGET_MISMATCH')) rejectedClaims.push(reject(raw.id ?? null, 'CLAIM_TARGET_MISMATCH'));\n else rejectedClaims.push(reject(raw.id ?? null, 'INVALID_CLAIM_CONTRACT', { detail: msg }));\n }\n }\n\n const conflicts = [];\n const recordMap = new Map();\n for (const record of records) {\n const validation = validateEvidence(record);\n if (!validation.ok) {\n conflicts.push({ evidence_id: record?.evidenceId ?? null, reason: 'INVALID_R1_EVIDENCE', detail: validation.reason });\n continue;\n }\n recordMap.set(record.evidenceId, record);\n }\n\n let activeIds = new Set();\n let supersededIds = new Set();\n if (conflicts.length === 0) {\n const resolved = resolveSupersession(records);\n for (const link of resolved.invalidLinks) conflicts.push({ reason: 'INVALID_SUPERSESSION_LINK', ...link });\n for (const cycle of resolved.cycles) conflicts.push({ reason: 'SUPERSESSION_CYCLE', cycle });\n activeIds = new Set(resolved.active.map((record) => record.evidenceId));\n supersededIds = new Set(resolved.superseded.map((record) => record.evidenceId));\n }\n\n const admittedClaims = [];\n for (const [claimId, cl] of normalizedClaims.entries()) {\n if (exclusions.has(identityKey(cl.identity))) {\n rejectedClaims.push(reject(claimId, 'NEGATIVE_BINDING_EXCLUSION', { identity: cl.identity }));\n continue;\n }\n\n const problems = [];\n const used = [];\n for (const ref of cl.evidence_refs) {\n const record = recordMap.get(ref);\n if (!record) {\n problems.push({ ref, scope: cl.scope, reason: 'UNKNOWN_EVIDENCE_REF' });\n continue;\n }\n used.push(ref);\n\n if (supersededIds.has(ref)) problems.push({ ref, scope: cl.scope, reason: 'SUPERSEDED_EVIDENCE_REF' });\n else if (activeIds.size && !activeIds.has(ref)) problems.push({ ref, scope: cl.scope, reason: 'EVIDENCE_NOT_ACTIVE' });\n\n const actualIdentity = { kind: record.subject.kind, id: record.subject.id };\n if (!sameIdentity(actualIdentity, cl.identity)) {\n problems.push({ ref, scope: cl.scope, reason: 'FOREIGN_EVIDENCE_IDENTITY', expected: cl.identity, actual: actualIdentity });\n }\n\n if (record.subject.claim !== cl.claim_token) {\n problems.push({ ref, scope: cl.scope, reason: 'CLAIM_DIGEST_MISMATCH', expected_claim: cl.claim_token, actual_claim: record.subject.claim });\n }\n\n if (stableJson(record.after) !== stableJson(cl.value)) {\n problems.push({ ref, scope: cl.scope, reason: 'EVIDENCE_VALUE_MISMATCH', expected_value: cl.value, actual_value: record.after });\n }\n\n if (record.classification === 'NOT_PROVEN') {\n problems.push({ ref, scope: cl.scope, reason: 'EVIDENCE_CLASSIFICATION_NOT_ADMISSIBLE', classification: record.classification });\n }\n }\n\n if (problems.length) {\n rejectedClaims.push(reject(claimId, 'CLAIM_EVIDENCE_BINDING_FAILED', {\n scope: cl.scope, predicate: cl.predicate, value: cl.value, claim_sha256: cl.claim_sha256,\n evidenceRefs: used, problems,\n }));\n } else {\n admittedClaims.push({\n id: claimId, admitted: true, scope: cl.scope, predicate: cl.predicate, value: cl.value,\n identity: cl.identity, claim_sha256: cl.claim_sha256, claim_token: cl.claim_token,\n evidenceRefs: cl.evidence_refs,\n });\n }\n }\n\n if (conflicts.length) {\n for (const conflict of conflicts) rejectedClaims.push(reject(null, 'EVIDENCE_RECONCILIATION_CONFLICT', conflict));\n }\n\n const verdict = rejectedClaims.length === 0 && admittedClaims.length === claimList.length ? 'GO' : 'NO_GO';\n const nextGate = verdict === 'GO' ? 'NONE' : nextGateFor(rejectedClaims, conflicts);\n return finalize({\n verdict,\n classification: verdict === 'GO' ? 'R1_EVIDENCE_BOUND_TO_EXACT_SUBJECT_CLAIM_AND_VALUE' : 'UNPROVEN_OR_CROSS_BOUND_EVIDENCE',\n nextGate,\n target: { subject, capability },\n admittedClaims,\n rejectedClaims,\n conflicts,\n evidenceRefs: [...recordMap.keys()].sort(),\n canonicalEvidenceContract: EVIDENCE_SCHEMA,\n });\n } catch (err) {\n return finalize({\n verdict: 'NO_GO', classification: 'FAIL_CLOSED_INVALID_CONTRACT', nextGate: 'CONTRACT_REPAIR_REQUIRED', target: null,\n admittedClaims: [], rejectedClaims: [reject(null, String(err?.message || err))], conflicts: [], evidenceRefs: [],\n });\n }\n}\n\nfunction finalize(body) {\n const receiptBody = {\n schema: 'rumbo.claim-evidence-admission/v1.2',\n runtime_id: VERSION,\n authority: 'PRE_ANSWER_ADMISSION_ONLY_NO_PROMOTION_AUTHORITY',\n trust_boundary: 'R1_CANONICALITY_AND_HASH_INTEGRITY_DO_NOT_AUTHENTICATE_SOURCE_OR_AUTHORIZE_ACTION',\n required_outer_controls: ['SOURCE_TRUST_OR_AUTHENTICITY_WHEN_REQUIRED', 'LIVE_FRESHNESS_FOR_VOLATILE_STATE', 'SEPARATE_PROMOTION_AUTHORIZATION_FOR_CONSEQUENTIAL_ACTIONS'],\n ...body,\n };\n return {\n ...receiptBody,\n receipt_sha256: sha256Canonical(receiptBody),\n canonicalization: 'rumbo-core/stableJson',\n };\n}\n","createdAt",["D",1789289006751],"branchVersion","branchId","3dfd20c4-436f-4774-915d-073b4bed3530","id","1991cca8-bf13-4945-bf68-f1df4a1a5770","rumbo-agent-reliability-mcp",["D",1788582330391],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","RUMBO agent reliability MCP tools","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","01a06fd0-810d-7419-8d90-6ae071d33f35","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":54,"_102":103,"_104":25},"branch",{"_13":84,"_32":85,"_42":41,"_86":43,"_87":88,"_89":90,"_91":49,"_92":43,"_93":63,"_94":44,"_95":96},"isOwned",32,"cea-v1-2-candidate","projectId","forkedBranchId","ebecba93-11f3-4e98-9277-46a8ff8ddda6","forkedBranchVersion",15,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":313,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":314,"_79":315,"_81":316,"_83":25},"tree",[212,221,222,223,224,225,226,227],"files",[212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227],"counts",{"_201":61,"_202":203,"_204":61,"_205":206,"_207":208},"contents",[136,137,138,139,140,141,142,143],"upstreamProject","upstreamBranch",{"_42":88,"_37":130,"_131":132,"_32":133,"_86":43,"_13":90,"_87":-5,"_89":-5,"_134":135,"_46":-5,"_83":25,"_48":49,"_95":96,"_62":63,"_94":44},"emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},["D",1788582330391],"updatedAt",["D",1789289681119],"main","lockfileKey","1789289681251-esm.town_v_sebas1_rumbo-agent-reliability-mcp@15-main",{"_42":194,"_32":195,"_30":196,"_147":-5,"_40":41,"_39":197,"_149":125,"_37":198,"_13":61,"_33":199,"_34":-5,"_24":25,"_152":-5,"_27":200},{"_42":188,"_32":189,"_30":190,"_147":-5,"_40":41,"_39":148,"_149":125,"_37":191,"_13":61,"_33":20,"_34":192,"_24":25,"_152":-5,"_27":193},{"_42":181,"_32":182,"_30":183,"_147":-5,"_40":41,"_39":184,"_149":25,"_37":185,"_13":61,"_33":178,"_34":186,"_24":25,"_152":-5,"_27":187},{"_42":172,"_32":173,"_30":174,"_147":-5,"_40":41,"_39":175,"_149":25,"_37":176,"_13":177,"_33":178,"_34":179,"_24":25,"_152":-5,"_27":180},{"_42":169,"_32":28,"_30":31,"_147":-5,"_40":41,"_39":14,"_149":125,"_37":170,"_13":148,"_33":20,"_34":36,"_24":25,"_152":-5,"_27":171},{"_42":162,"_32":163,"_30":164,"_147":-5,"_40":41,"_39":90,"_149":25,"_37":165,"_13":148,"_33":166,"_34":167,"_24":25,"_152":-5,"_27":168},{"_42":154,"_32":155,"_30":156,"_147":-5,"_40":41,"_39":157,"_149":25,"_37":158,"_13":148,"_33":159,"_34":160,"_24":25,"_152":-5,"_27":161},{"_42":144,"_32":145,"_30":146,"_147":-5,"_40":41,"_39":148,"_149":125,"_37":150,"_13":61,"_33":20,"_34":151,"_24":25,"_152":-5,"_27":153},"3a0a09c6-2939-4f37-9377-5882da5c02ca","rumbo-semantic-core.mjs","01a099e2-134e-77a7-a880-2796bf303c5b","parentId",1,"latest",["D",1789288125263],"/**\n * RUMBO Agent Reliability semantic hardening core v1.3.12\n * Dependency-free, deterministic, fail-closed.\n * Designed to sit behind the existing MCP tool names without changing their input schemas.\n */\n\nconst IDS = Object.freeze({\n csr: 'RUMBO-CSR-V1.3.12',\n drr: 'RUMBO-DRR-V1.3.12',\n glc: 'RUMBO-GLC-V1.3.12',\n evc: 'RUMBO-EVC-V1.3.12',\n afs: 'RUMBO-AFS-V1.3.12',\n});\n\nfunction asText(v) { return typeof v === 'string' ? v.trim() : ''; }\n\nfunction strictJsonParse(text) {\n const s = String(text ?? '').trim();\n let i = 0;\n const fail = (code) => { throw new Error(code); };\n const ws = () => { while (i < s.length && /\\s/.test(s[i])) i += 1; };\n\n const parseStringToken = () => {\n if (s[i] !== '\"') fail('INVALID_JSON_STRING');\n const start = i;\n i += 1;\n while (i < s.length) {\n const ch = s[i];\n if (ch === '\"') {\n i += 1;\n try { return JSON.parse(s.slice(start, i)); } catch { fail('INVALID_JSON_STRING'); }\n }\n if (ch === '\\\\') {\n if (i + 1 >= s.length) fail('INVALID_JSON_ESCAPE');\n if (s[i + 1] === 'u') {\n if (!/^[0-9A-Fa-f]{4}$/.test(s.slice(i + 2, i + 6))) fail('INVALID_JSON_UNICODE_ESCAPE');\n i += 6;\n } else {\n if (!/[\"\\\\/bfnrt]/.test(s[i + 1])) fail('INVALID_JSON_ESCAPE');\n i += 2;\n }\n continue;\n }\n if (ch.charCodeAt(0) < 0x20) fail('INVALID_JSON_CONTROL_CHAR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_STRING');\n };\n\n const parseValue = () => {\n ws();\n if (i >= s.length) fail('UNEXPECTED_JSON_EOF');\n if (s[i] === '{') return parseObject();\n if (s[i] === '[') return parseArray();\n if (s[i] === '\"') { parseStringToken(); return; }\n const start = i;\n while (i < s.length && !/[\\s,\\]}]/.test(s[i])) i += 1;\n const token = s.slice(start, i);\n if (!token) fail('INVALID_JSON_VALUE');\n try { JSON.parse(token); } catch { fail('INVALID_JSON_VALUE'); }\n };\n\n const parseObject = () => {\n i += 1;\n ws();\n const seen = new Set();\n if (s[i] === '}') { i += 1; return; }\n while (i < s.length) {\n ws();\n const key = parseStringToken();\n if (seen.has(key)) fail(`DUPLICATE_JSON_KEY:${key}`);\n seen.add(key);\n ws();\n if (s[i] !== ':') fail('INVALID_JSON_OBJECT_COLON');\n i += 1;\n parseValue();\n ws();\n if (s[i] === '}') { i += 1; return; }\n if (s[i] !== ',') fail('INVALID_JSON_OBJECT_SEPARATOR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_OBJECT');\n };\n\n const parseArray = () => {\n i += 1;\n ws();\n if (s[i] === ']') { i += 1; return; }\n while (i < s.length) {\n parseValue();\n ws();\n if (s[i] === ']') { i += 1; return; }\n if (s[i] !== ',') fail('INVALID_JSON_ARRAY_SEPARATOR');\n i += 1;\n }\n fail('UNTERMINATED_JSON_ARRAY');\n };\n\n parseValue();\n ws();\n if (i !== s.length) fail('TRAILING_JSON_DATA');\n return JSON.parse(s);\n}\n\nfunction jsonInputState(v) {\n if (v && typeof v === 'object') return { kind: 'VALID', value: v, error: null };\n if (typeof v !== 'string') return { kind: 'NOT_JSON', value: null, error: null };\n const s = v.trim();\n if (!s || !['{', '['].includes(s[0])) return { kind: 'NOT_JSON', value: null, error: null };\n try { return { kind: 'VALID', value: strictJsonParse(s), error: null }; }\n catch (err) { return { kind: 'INVALID', value: null, error: String(err?.message || 'INVALID_JSON') }; }\n}\n\nfunction tryJson(v) {\n const state = jsonInputState(v);\n return state.kind === 'VALID' ? state.value : null;\n}\n\nfunction cleanToken(v) {\n return String(v ?? '').trim().replace(/[.;,!?:]+$/g, '').trim();\n}\n\nfunction extractAssignments(text) {\n const out = [];\n const re = /\\b([A-Za-zÁÉÍÓÚÜÑáéíóúüñ_][\\wÁÉÍÓÚÜÑáéíóúüñ-]*)\\s*=\\s*([^\\s,;]+)/g;\n for (const m of asText(text).matchAll(re)) out.push({ key: m[1], value: cleanToken(m[2]), raw: m[0] });\n return out;\n}\n\nfunction flattenJsonScalarAssignments(value, prefix = '') {\n const out = [];\n if (value === null || typeof value !== 'object') {\n if (prefix) out.push({ key: prefix, value: cleanToken(value), raw: `${prefix}=${String(value)}` });\n return out;\n }\n if (Array.isArray(value)) {\n value.forEach((item, index) => out.push(...flattenJsonScalarAssignments(item, prefix ? `${prefix}[${index}]` : `[${index}]`)));\n return out;\n }\n for (const [key, item] of Object.entries(value)) {\n const path = prefix ? `${prefix}.${key}` : key;\n out.push(...flattenJsonScalarAssignments(item, path));\n }\n return out;\n}\n\nfunction semanticAssignments(text) {\n const state = jsonInputState(text);\n if (state.kind === 'VALID') return flattenJsonScalarAssignments(state.value);\n return extractAssignments(text);\n}\n\nfunction lastAssignment(text, preferredKey) {\n const a = extractAssignments(text).filter(x => !preferredKey || x.key === preferredKey);\n return a.length ? a[a.length - 1] : null;\n}\n\nconst NEGATIVE_SCOPE_RE = /\\b(?:SUPERSEDED|HISTORICAL|ARCHIVED|REJECTED|NO_AUTHORITY|SUPERSEDIDO|HIST[OÓ]RICO|ARCHIVADO|RECHAZADO)\\b/i;\nconst SELECTED_SCOPE_RE = /\\b(?:SELECTED|CANONICAL_SELECTED|SELECCIONADO|CANDIDATO_SELECCIONADO)\\b/i;\n\nfunction scopedAssignments(text) {\n const input = asText(text);\n const out = [];\n const re = /\\b([A-Za-zÁÉÍÓÚÜÑáéíóúüñ_][\\wÁÉÍÓÚÜÑáéíóúüñ-]*)\\s*=\\s*([^\\s,;]+)/g;\n for (const m of input.matchAll(re)) {\n const left = input.slice(Math.max(0, m.index - 120), m.index);\n const segment = left.split(/[;\\n.]/).at(-1) ?? left;\n out.push({\n key: m[1],\n value: cleanToken(m[2]),\n raw: m[0],\n selected: SELECTED_SCOPE_RE.test(segment),\n excluded: NEGATIVE_SCOPE_RE.test(segment),\n });\n }\n return out;\n}\n\nconst POSITIVE_EVIDENCE_STATUS = /^(?:PASS|TRUE|OK|VERIFIED)$/i;\nconst NEGATIVE_EVIDENCE_STATUS = /^(?:FAIL|FAILED|FALSE|UNVERIFIED|NO_GO|NOT_PROVEN|UNPROVEN)$/i;\n\nfunction evidenceCategoryState(text, key) {\n const input = asText(text);\n const re = new RegExp(`\\\\b${key}\\\\s*=\\\\s*([^\\\\s,;]+)`, 'ig');\n const rawValues = [...input.matchAll(re)].map(m => cleanToken(m[1]));\n if (!rawValues.length) return { present: false, positive: false, conflict: false, invalid: false, values: [] };\n\n const semantic = rawValues.map(v => {\n if (POSITIVE_EVIDENCE_STATUS.test(v)) return 'POSITIVE';\n if (NEGATIVE_EVIDENCE_STATUS.test(v)) return 'NEGATIVE';\n return 'INVALID';\n });\n const distinct = [...new Set(semantic)];\n const invalid = distinct.includes('INVALID');\n const conflict = distinct.includes('POSITIVE') && distinct.includes('NEGATIVE');\n const positive = !invalid && !conflict && distinct.length === 1 && distinct[0] === 'POSITIVE';\n return { present: true, positive, conflict, invalid, values: rawValues };\n}\n\nfunction externalGateCategory(text) {\n const input = asText(text);\n const re = /\\bexternal_gate_status\\s*=\\s*([^;\\n]+)/ig;\n const values = [...input.matchAll(re)].map(m => cleanToken(m[1])).filter(Boolean);\n if (!values.length) return { present: false, clear: false, conflict: false, values: [], value: null };\n\n const states = values.map(value => /^(?:NONE|CLEAR|PASS|NO_EXTERNAL_GATES?|NO_EXTERNAL_GATES_PENDING)$/i.test(value) ? 'CLEAR' : 'OPEN');\n const distinct = [...new Set(states)];\n const conflict = distinct.length > 1;\n const clear = !conflict && distinct.length === 1 && distinct[0] === 'CLEAR';\n return { present: true, clear, conflict, values, value: values.at(-1) ?? null };\n}\n\nfunction extractTarget(goal) {\n const json = tryJson(goal);\n if (json && typeof json === 'object') {\n if (json.target != null) return json.target;\n if (json.TARGET != null) return json.TARGET;\n }\n const t = asText(goal);\n const marker = t.match(/\\bTARGET(?:\\s+expl[ií]cito)?\\s*:\\s*([^\\n]+)/i);\n const fromMarker = marker ? lastAssignment(marker[1]) : null;\n if (fromMarker) return { [fromMarker.key]: fromMarker.value };\n const any = lastAssignment(t);\n return any ? { [any.key]: any.value } : null;\n}\n\nfunction currentFromEvidence(evidence, priorState, preferredKey = '') {\n const ej = tryJson(evidence);\n if (ej && typeof ej === 'object') {\n const selected = ej.selected ?? ej.SELECTED ?? ej.canonicalSelected ?? ej.canonical_selected ?? null;\n if (selected != null) {\n if (preferredKey && selected && typeof selected === 'object' && !Array.isArray(selected) && Object.hasOwn(selected, preferredKey)) {\n return { [preferredKey]: cleanToken(selected[preferredKey]) };\n }\n if (selected && typeof selected === 'object' && !Array.isArray(selected)) return selected;\n }\n const direct = ej.current ?? ej.CURRENT ?? ej.state ?? null;\n if (direct != null) {\n if (preferredKey && direct && typeof direct === 'object' && !Array.isArray(direct) && Object.hasOwn(direct, preferredKey)) {\n return { [preferredKey]: cleanToken(direct[preferredKey]) };\n }\n return direct;\n }\n }\n\n const text = asText(evidence);\n const scoped = scopedAssignments(text);\n const selectedScoped = scoped.filter(x => x.selected && !x.excluded && (!preferredKey || x.key === preferredKey));\n if (selectedScoped.length) {\n const selected = selectedScoped.at(-1);\n return { [selected.key]: selected.value };\n }\n\n const primary = text.match(/(?:EVIDENCIA\\s+PRIMARIA\\s+ACTUAL|CURRENT|ESTADO\\s+ACTUAL)\\s*:\\s*([^\\n.]+)/i);\n if (primary) {\n const primaryAssignments = scopedAssignments(primary[1]).filter(x => !x.excluded);\n const selected = preferredKey\n ? primaryAssignments.filter(x => x.key === preferredKey).at(-1)\n : primaryAssignments.at(-1);\n if (selected) return { [selected.key]: selected.value };\n }\n\n const evidenceAssignments = scoped.filter(x => !x.excluded);\n if (preferredKey) {\n const preferred = evidenceAssignments.filter(x => x.key === preferredKey).at(-1);\n if (preferred) return { [preferred.key]: preferred.value };\n }\n\n const priorAssignment = lastAssignment(priorState);\n if (priorAssignment) {\n const sameKeyCurrent = evidenceAssignments.filter(x => x.key === priorAssignment.key).at(-1);\n if (sameKeyCurrent) return { [sameKeyCurrent.key]: sameKeyCurrent.value };\n }\n\n // Unscoped current evidence outranks priorState. Explicitly historical/superseded\n // assignments are excluded before freshness selection.\n const freshestEvidence = evidenceAssignments.at(-1);\n if (freshestEvidence) return { [freshestEvidence.key]: freshestEvidence.value };\n\n if (priorAssignment) return { [priorAssignment.key]: priorAssignment.value };\n return null;\n}\n\nfunction equals(a, b) { return JSON.stringify(a) === JSON.stringify(b); }\n\nfunction resultEnvelope(capability, id, result, classification, confidence, evidenceGrounding) {\n // Keep the structured `result` while mirroring result fields at top level for\n // backward compatibility with the live V1.2 response shape.\n return { capability, id, ...result, result, classification, confidence, evidenceGrounding };\n}\n\nexport function canonicalStateRecovery({ goal, evidence, priorState = '' }) {\n const goalJsonState = jsonInputState(goal);\n const evidenceJsonState = jsonInputState(evidence);\n const invalidJson = [\n ...(goalJsonState.kind === 'INVALID' ? [{ field: 'goal', error: goalJsonState.error }] : []),\n ...(evidenceJsonState.kind === 'INVALID' ? [{ field: 'evidence', error: evidenceJsonState.error }] : []),\n ];\n if (invalidJson.length) {\n return resultEnvelope('RUMBO Canonical State Recovery', IDS.csr,\n { current: null, target: null, currentRecovered: false, targetSpecified: false, targetReached: false, nextGate: 'INVALID_JSON_INPUT', jsonErrors: invalidJson },\n 'FAIL_CLOSED_INVALID_JSON', 'unknown',\n { usedPriorState: Boolean(asText(priorState)), evidencePresent: Boolean(asText(evidence)), precedence: 'STRICT_JSON_BEFORE_SEMANTIC_RECOVERY', terminalPunctuationNormalized: true, selectedMarkerUsed: false, suppressedHistoricalAssignments: 0, strictJsonValid: false });\n }\n const target = extractTarget(goal);\n const targetKey = target && typeof target === 'object' && !Array.isArray(target) ? Object.keys(target)[0] : '';\n const current = currentFromEvidence(evidence, priorState, targetKey);\n const ej = tryJson(evidence);\n let nextGate = null;\n if (ej && typeof ej === 'object' && ej.nextGate) nextGate = ej.nextGate;\n if (!nextGate) {\n const text = asText(evidence);\n const explicit = text.match(/(?:[uú]nica|unica)\\s+transici[oó]n\\s+v[aá]lida(?:\\s+disponible)?\\s+(?:es|:)\\s*([A-Z][A-Z0-9_-]*)/)\n || text.match(/next(?:Gate|\\s+gate|\\s+transition)\\s*[:=]\\s*([A-Za-z0-9_-]+)/i);\n if (explicit) nextGate = explicit[1];\n }\n if (!nextGate && current && target && !equals(current, target)) {\n const ck = Object.keys(current)[0];\n const tk = Object.keys(target)[0];\n nextGate = ck && tk && ck === tk\n ? `TRANSITION ${ck}=${current[ck]} -> ${tk}=${target[tk]}`\n : 'APPLY_SINGLE_VALID_TRANSITION';\n }\n if (current && target && equals(current, target)) nextGate = 'NONE';\n const currentRecovered = Boolean(current);\n const targetSpecified = Boolean(target);\n const targetReached = Boolean(current && target && equals(current, target));\n const confidence = currentRecovered ? 'proven' : 'unknown';\n const classification = !currentRecovered\n ? 'FAIL_CLOSED_INSUFFICIENT_EVIDENCE'\n : targetSpecified\n ? 'RESOLVED'\n : 'CURRENT_RECOVERED_TARGET_UNSPECIFIED';\n const scoped = scopedAssignments(asText(evidence));\n const jsonEvidence = tryJson(evidence);\n const selectedMarkerUsed = scoped.some(x => x.selected && !x.excluded)\n || Boolean(jsonEvidence && typeof jsonEvidence === 'object' && (jsonEvidence.selected ?? jsonEvidence.SELECTED ?? jsonEvidence.canonicalSelected ?? jsonEvidence.canonical_selected));\n const suppressedHistoricalAssignments = scoped.filter(x => x.excluded).length;\n return resultEnvelope(\n 'RUMBO Canonical State Recovery', IDS.csr,\n { current, target, currentRecovered, targetSpecified, targetReached, nextGate: nextGate ?? 'EVIDENCE_REQUIRED' },\n classification, confidence,\n { usedPriorState: Boolean(asText(priorState)), evidencePresent: Boolean(asText(evidence)), precedence: 'SELECTED_THEN_CURRENT_EVIDENCE_THEN_PRIOR_STATE', terminalPunctuationNormalized: true, selectedMarkerUsed, suppressedHistoricalAssignments }\n );\n}\n\nexport function deepResearchReconcile({ question, evidence, constraints = '' }) {\n const evidenceJsonState = jsonInputState(evidence);\n if (evidenceJsonState.kind === 'INVALID') {\n return resultEnvelope('RUMBO Deep Research Reconcile', IDS.drr,\n { facts: [], conclusion: null, reconciledConclusion: null, conflicts: [{ key: 'JSON', values: [evidenceJsonState.error], basis: 'STRICT_JSON_REQUIRED' }], superseded: [], unresolved: ['INVALID_JSON_EVIDENCE'] },\n 'FAIL_CLOSED_INVALID_JSON', 'unknown', { question: asText(question), constraints: asText(constraints), strictJsonValid: false });\n }\n const ej = tryJson(evidence);\n if (ej && typeof ej === 'object') {\n const facts = Array.isArray(ej.facts) ? ej.facts : [];\n const conclusion = ej.reconciledConclusion ?? ej.conclusion ?? ej.current ?? ej.resolution ?? null;\n const unresolved = Array.isArray(ej.unresolved) ? ej.unresolved : (conclusion ? [] : ['No explicit resolution in evidence JSON']);\n return resultEnvelope('RUMBO Deep Research Reconcile', IDS.drr,\n { facts, conclusion, reconciledConclusion: conclusion, conflicts: ej.conflicts ?? [], superseded: ej.superseded ?? [], unresolved },\n conclusion ? 'RECONCILED' : 'FAIL_CLOSED_INSUFFICIENT_EVIDENCE', conclusion ? 'proven' : 'unknown',\n { question: asText(question), constraints: asText(constraints) });\n }\n\n const text = asText(evidence);\n const primary = text.match(/Fuente\\s+primaria\\s+actual\\s*:\\s*([\\wÁÉÍÓÚÜÑáéíóúüñ-]+\\s*=\\s*[^.\\s]+)/i);\n const secondary = text.match(/Fuente\\s+secundaria\\s+antigua\\s*:\\s*([\\wÁÉÍÓÚÜÑáéíóúüñ-]+\\s*=\\s*[^.\\s]+)/i);\n if (primary) {\n const conclusion = cleanToken(primary[1]);\n const superseded = secondary ? [cleanToken(secondary[1])] : [];\n const facts = [{ raw: conclusion, authority: 'primary/current' }];\n return resultEnvelope('RUMBO Deep Research Reconcile', IDS.drr,\n { facts, conclusion, reconciledConclusion: conclusion, conflicts: secondary ? [{ preferred: conclusion, superseded: cleanToken(secondary[1]), basis: 'primary/current authority' }] : [], superseded, unresolved: [] },\n 'RECONCILED', 'proven', { authorityRule: 'primary/current over secondary/older' });\n }\n\n const assignments = extractAssignments(text);\n if (assignments.length) {\n const byKey = new Map();\n for (const item of assignments) {\n if (!byKey.has(item.key)) byKey.set(item.key, []);\n byKey.get(item.key).push(item);\n }\n const facts = [];\n const conflicts = [];\n const superseded = [];\n for (const [key, items] of byKey) {\n const latest = items.at(-1);\n facts.push({ key, value: latest.value, raw: latest.raw });\n const unique = [...new Set(items.map(x => x.value))];\n if (unique.length > 1) {\n conflicts.push({ key, values: unique, preferred: latest.value, basis: 'freshest supplied evidence order' });\n superseded.push(...items.slice(0, -1).map(x => `${x.key}=${x.value}`));\n }\n }\n const reconciledConclusion = facts.map(x => `${x.key}=${x.value}`).join('; ');\n return resultEnvelope('RUMBO Deep Research Reconcile', IDS.drr,\n { facts, conclusion: reconciledConclusion, reconciledConclusion, conflicts, superseded, unresolved: [] },\n conflicts.length ? 'RECONCILED_WITH_CONFLICTS' : 'RECONCILED', conflicts.length ? 'supported' : 'proven',\n { question: asText(question), constraints: asText(constraints), authorityRule: 'freshest same-key assignment within supplied evidence' });\n }\n\n return resultEnvelope('RUMBO Deep Research Reconcile', IDS.drr,\n { facts: [], conclusion: null, reconciledConclusion: null, conflicts: [], superseded: [], unresolved: ['Evidence does not encode an authority-resolvable conclusion'] },\n 'FAIL_CLOSED_INSUFFICIENT_EVIDENCE', 'unknown', { question: asText(question), constraints: asText(constraints) });\n}\n\nexport function goalLoopController({ goal, currentState, blockers = '' }) {\n const currentJsonState = jsonInputState(currentState);\n if (currentJsonState.kind === 'INVALID') {\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: null, why: 'Invalid or ambiguous JSON current state', stopCondition: 'Provide strict duplicate-free JSON or unambiguous text state', openGates: ['INVALID_JSON_CURRENT_STATE'], jsonError: currentJsonState.error },\n 'FAIL_CLOSED_INVALID_JSON', 'unknown', { blockers: asText(blockers) || 'NONE', strictJsonValid: false });\n }\n const cj = tryJson(currentState);\n if (cj && typeof cj === 'object' && cj.nextAction) {\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: cj.nextAction, why: cj.why ?? 'Provided by current canonical state', stopCondition: cj.stopCondition ?? 'Observable goal state reached', openGates: cj.openGates ?? [] },\n 'NEXT_ACTION_SELECTED', 'proven', { blockers: asText(blockers) || 'NONE' });\n }\n const s = asText(currentState);\n const pending = s.match(/Acci[oó]n\\s+([A-Za-z0-9_-]+)\\s+es\\s+la\\s+[uú]nica\\s+acci[oó]n\\s+pendiente/i);\n const stop = s.match(/estado\\s+observable\\s+ser[aá]\\s+([A-Za-z0-9_-]+)/i) || s.match(/estado\\s+(?:final\\s+)?(?:ser[aá]|=)\\s*([A-Za-z0-9_-]+)/i);\n const blockerText = asText(blockers);\n const blockerLead = blockerText.split(/[.\\n;]/, 1)[0].trim();\n const hasBlocker = Boolean(blockerText) && !/^(ninguno|none|no blockers?|sin bloqueos?)$/i.test(blockerLead);\n if (hasBlocker) {\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: 'CLOSE_BLOCKER', why: asText(blockers), stopCondition: 'Blocker cleared with evidence', openGates: [blockerLead] },\n 'BLOCKED', 'supported', { duplicateAvoidance: true });\n }\n if (pending) {\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: pending[1], why: `${pending[1]} is the only evidenced pending action; completed actions must not be repeated`, stopCondition: stop ? `STATE=${stop[1]}` : 'Goal state observed', openGates: [] },\n 'NEXT_ACTION_SELECTED', 'proven', { duplicateAvoidance: true });\n }\n\n const assignments = extractAssignments(s);\n const negative = assignments.find(x => /^(?:FAIL(?:ED|_CLOSED)?|NO_GO|NOT_PROVEN|UNPROVEN|NOT_EXECUTED|PENDING|UNKNOWN)$/i.test(x.value));\n if (negative) {\n const gate = `${negative.key}=${negative.value}`;\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: `CLOSE_GATE: ${gate}`, why: `${gate} is the first evidence-supported open gate`, stopCondition: `Fresh evidence no longer reports ${gate}`, openGates: [gate] },\n 'NEXT_ACTION_SELECTED', 'supported', { duplicateAvoidance: true });\n }\n if (assignments.length) {\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: 'VERIFY_TARGET_STATE', why: 'Concrete current-state assignments are present and no open blocker is evidenced; verify the target state before promotion.', stopCondition: `Direct evidence proves the target goal: ${asText(goal)}`, openGates: [] },\n 'NEXT_ACTION_SELECTED', 'proven', { duplicateAvoidance: true });\n }\n return resultEnvelope('RUMBO Goal Loop Controller', IDS.glc,\n { nextAction: null, why: 'No unique evidence-grounded next action', stopCondition: 'Provide a unique pending gate or blocker', openGates: [] },\n 'FAIL_CLOSED_AMBIGUOUS_NEXT_ACTION', 'unknown', { goal: asText(goal) });\n}\n\nfunction resultCounts(text) {\n return [...asText(text).matchAll(/\\b(\\d+)\\s*\\/\\s*(\\d+)(?:\\s+|_)(PASS|FAIL)\\b/gi)]\n .map(m => ({ passed: Number(m[1]), total: Number(m[2]), status: m[3].toUpperCase() }));\n}\nfunction allObservedCountsPass(text) {\n const counts = resultCounts(text);\n return counts.length > 0 && counts.every(x => x.status === 'PASS' && x.passed === x.total);\n}\n\nexport function executeVerifyClose({ objective, implementation, verification = '' }) {\n const verificationJsonState = jsonInputState(verification);\n if (verificationJsonState.kind === 'INVALID') {\n return resultEnvelope('RUMBO Execute Verify Close', IDS.evc,\n { classification: 'INVALID_JSON_EVIDENCE', complete: false, evidenceSufficient: false, implementationComplete: false, promotionReady: false, externalGateStatusPresent: false, externalGatesClear: false, externalGateStatus: null, openGates: ['INVALID_JSON_EVIDENCE'], requiredEvidence: 'STRICT_DUPLICATE_FREE_JSON_OR_MACHINE_READABLE_TEXT', verificationState: asText(verification), missingEvidence: ['INVALID_JSON_EVIDENCE'], evidenceConflicts: [{ key: 'JSON', values: [verificationJsonState.error], reason: 'INVALID_OR_DUPLICATE_JSON' }], objective: asText(objective) },\n 'INVALID_JSON_EVIDENCE', 'unknown', { targetedTests: false, exactArtifact: false, regressions: false, externalGateStatusPresent: false, noExternalGates: false, conflictFree: false, strictJsonValid: false });\n }\n const v = asText(verification);\n const i = asText(implementation);\n const counts = resultCounts(v);\n\n const targetedState = evidenceCategoryState(v, 'targeted_or_smoke_test_pass');\n const exactState = evidenceCategoryState(v, 'exact_artifact_readback');\n const regressionState = evidenceCategoryState(v, 'regression_evidence');\n const externalCategory = externalGateCategory(v);\n\n const smokePass = /smoke(?:\\s+end-to-end)?\\s*[=:]?\\s*PASS/i.test(v);\n const explicitTestFailure = counts.some(x => x.status === 'FAIL' || x.passed !== x.total)\n || /\\b(?:test|tests|smoke|regresi[oó]n|regression|adversarial|static)[^.;\\n]{0,80}\\bFAIL\\b/i.test(v)\n || /\\b[A-Z][A-Z0-9_-]*\\s*=\\s*(?:FAIL|FAILED|NO_GO|NOT_PROVEN|UNPROVEN)\\b/i.test(v);\n const legacyPositive = !explicitTestFailure && (counts.length ? allObservedCountsPass(v) : smokePass || /(?:TESTS?|ADVERSARIAL|STATIC)\\s*=\\s*PASS/i.test(v));\n const positive = targetedState.present ? targetedState.positive : legacyPositive;\n\n const legacyExactArtifact = /(?:SOURCE_READBACK_SHA|DEPLOY_READBACK|READBACK_SHA)\\s*=\\s*PASS\\b/i.test(v)\n || (/SHA\\s*=\\s*[A-Za-z0-9_-]+/i.test(i + ' ' + v) && /readback[^.;\\n]{0,80}PASS/i.test(v));\n const exactArtifact = exactState.present ? exactState.positive : legacyExactArtifact;\n\n const legacyRegressions = counts.length >= 1 && allObservedCountsPass(v);\n const regressions = regressionState.present ? regressionState.positive : legacyRegressions;\n\n const legacyNoExternal = /(?:EXTERNAL_GATES?|REMOTE_EXTERNAL_GATES?)\\s*=\\s*NONE\\b/i.test(v)\n || /no\\s+hay\\s+gates?\\s+externos?\\s+pendientes?/i.test(v)\n || /external gates?\\s*[:=]\\s*none/i.test(v);\n const externalGateStatusPresent = externalCategory.present || legacyNoExternal;\n const noExternal = externalCategory.present ? externalCategory.clear : legacyNoExternal;\n const evidenceConflicts = [];\n if (targetedState.conflict || targetedState.invalid) evidenceConflicts.push({ key: 'targeted_or_smoke_test_pass', values: targetedState.values, reason: targetedState.conflict ? 'CONFLICTING_VALUES' : 'INVALID_VALUE' });\n if (exactState.conflict || exactState.invalid) evidenceConflicts.push({ key: 'exact_artifact_readback', values: exactState.values, reason: exactState.conflict ? 'CONFLICTING_VALUES' : 'INVALID_VALUE' });\n if (regressionState.conflict || regressionState.invalid) evidenceConflicts.push({ key: 'regression_evidence', values: regressionState.values, reason: regressionState.conflict ? 'CONFLICTING_VALUES' : 'INVALID_VALUE' });\n if (externalCategory.conflict) evidenceConflicts.push({ key: 'external_gate_status', values: externalCategory.values, reason: 'CONFLICTING_VALUES' });\n\n const missing = [];\n if (!positive) missing.push('targeted_or_smoke_test_pass');\n if (!exactArtifact) missing.push('exact_artifact_readback');\n if (!regressions) missing.push('regression_evidence');\n if (!externalGateStatusPresent) missing.push('external_gate_status');\n\n const conflictFree = evidenceConflicts.length === 0;\n const evidenceSufficient = missing.length === 0 && conflictFree;\n const implementationComplete = positive && exactArtifact && regressions && conflictFree;\n const promotionReady = evidenceSufficient && noExternal;\n const complete = promotionReady;\n const classification = evidenceConflicts.length\n ? 'CONFLICTING_EVIDENCE'\n : promotionReady\n ? 'RESUELTO_CON_EVIDENCIA'\n : evidenceSufficient\n ? 'VERIFICADO_GATE_EXTERNO_ABIERTO'\n : 'EJECUCION_SIN_EVIDENCIA';\n const openGates = evidenceConflicts.length\n ? ['EVIDENCE_CONFLICT']\n : missing.length ? [...missing] : (noExternal ? [] : ['EXTERNAL_GATE_OPEN']);\n\n return resultEnvelope('RUMBO Execute Verify Close', IDS.evc,\n {\n classification,\n complete,\n evidenceSufficient,\n implementationComplete,\n promotionReady,\n externalGateStatusPresent,\n externalGatesClear: noExternal,\n externalGateStatus: externalCategory.value,\n openGates,\n requiredEvidence: missing.length ? missing.join('; ') : 'NONE',\n verificationState: v,\n missingEvidence: missing,\n evidenceConflicts,\n objective: asText(objective),\n },\n classification, evidenceSufficient ? 'proven' : 'unknown',\n { targetedTests: positive, exactArtifact, regressions, externalGateStatusPresent, noExternalGates: noExternal, conflictFree });\n}\n\nconst NEGATIVE_STATUS_TOKEN_RE = /\\b(?:FAIL(?:ED|_CLOSED)?|NO_GO|NOT_PROVEN|UNPROVEN|NOT_EXECUTED|NOT_DEPLOYED|NOT_AUTHORIZED|NOT_EVALUATED|BLOCKED|PENDING|UNKNOWN|DENIED|REJECTED|NO_AUTHORITY|FALSE)\\b/ig;\n\nfunction explicitNegativeStatusTokens(text) {\n return [...new Set([...asText(text).matchAll(NEGATIVE_STATUS_TOKEN_RE)].map(m => m[0].toUpperCase()))];\n}\n\nfunction normalizedAssignmentValue(v) {\n return cleanToken(v).toUpperCase();\n}\n\nfunction distinctAssignmentValues(assignments, key) {\n return [...new Set(assignments\n .filter(x => x.key.toUpperCase() === key.toUpperCase())\n .map(x => normalizedAssignmentValue(x.value)))];\n}\n\nfunction negativeEvidenceAssignments(assignments) {\n const negative = /^(?:FAIL|FAILED|FAIL_CLOSED|NO_GO|NOT_PROVEN|UNPROVEN|NOT_EXECUTED|NOT_DEPLOYED|BLOCKED|PENDING|UNKNOWN|DENIED|REJECTED|NO_AUTHORITY|FALSE)$/i;\n return assignments.filter(x => negative.test(normalizedAssignmentValue(x.value)));\n}\n\nfunction assignmentConflicts(assignments) {\n const grouped = new Map();\n for (const item of assignments) {\n const key = item.key.toUpperCase();\n if (!grouped.has(key)) grouped.set(key, { key: item.key, values: [] });\n grouped.get(key).values.push(item.value);\n }\n const conflicts = [];\n for (const entry of grouped.values()) {\n const distinct = [...new Set(entry.values.map(normalizedAssignmentValue))];\n if (distinct.length > 1) conflicts.push({ key: entry.key, values: entry.values, reason: 'CONFLICTING_VALUES' });\n }\n return conflicts;\n}\n\nfunction conditionalGateRequirements(gates) {\n const g = asText(gates);\n const marker = g.match(/PASS\\s+(?:only if|[uú]nicamente\\s+si)\\s+(.+)/i);\n return marker ? extractAssignments(marker[1]) : [];\n}\n\nconst POSITIVE_STATUS_VALUE_RE = /^(?:PASS|PROVEN|VERIFIED|OK|TRUE|EXECUTED|DEPLOYED|AUTHORIZED|COMPLETE|COMPLETED)$/i;\nconst NEGATED_POSITIVE_RE = /(?:\\b(?:NO|NOT|DID\\s+NOT|DIDN['’]?T|FAILED\\s+TO|FAILURE\\s+TO|UNABLE\\s+TO|WITHOUT)\\b[^.;\\n]{0,64}\\b(?:PASS|PROVEN|VERIFIED|OK|EXECUTED|DEPLOYED|AUTHORIZED|SUCCEED(?:ED)?)\\b|\\b(?:PASS|PROVEN|VERIFIED|OK|EXECUTED|DEPLOYED|AUTHORIZED|SUCCEED(?:ED)?)\\b[^.;\\n]{0,64}\\b(?:NOT\\s+ACHIEVED|NOT\\s+PROVEN|NOT\\s+VERIFIED|FAILED|FALSE)\\b)/i;\n\nfunction claimStructureAssessment(text) {\n const input = asText(text);\n const state = jsonInputState(input);\n if (!input) return { structured: false, kind: 'EMPTY', residual: input };\n if (state.kind === 'INVALID') return { structured: false, kind: 'INVALID_JSON', residual: input };\n if (state.kind === 'VALID') {\n const assignments = flattenJsonScalarAssignments(state.value);\n return { structured: assignments.length > 0, kind: 'JSON', residual: assignments.length > 0 ? '' : input };\n }\n\n const pure = /^\\s*[A-Za-zÁÉÍÓÚÜÑáéíóúüñ_][\\wÁÉÍÓÚÜÑáéíóúüñ-]*\\s*=\\s*[^\\s,;]+(?:\\s*[;\\n]\\s*[A-Za-zÁÉÍÓÚÜÑáéíóúüñ_][\\wÁÉÍÓÚÜÑáéíóúüñ-]*\\s*=\\s*[^\\s,;]+)*\\s*[.;]?\\s*$/;\n const structured = pure.test(input);\n return { structured, kind: structured ? 'ASSIGNMENT_LIST' : 'UNSTRUCTURED_TEXT', residual: structured ? '' : input };\n}\n\nfunction positiveEvidenceAssessment(text) {\n const input = asText(text);\n const assignments = semanticAssignments(input);\n const positiveAssignments = assignments.filter(x => POSITIVE_STATUS_VALUE_RE.test(normalizedAssignmentValue(x.value)));\n const counts = resultCounts(input);\n const failedCounts = counts.filter(x => x.total <= 0 || x.status !== 'PASS' || x.passed !== x.total);\n const positiveCounts = counts.filter(x => x.total > 0 && x.status === 'PASS' && x.passed === x.total);\n const http200 = /\\bhttp_status\\s*[:=]\\s*200\\b/i.test(input);\n const statusOk = /\\bstatus\\s*[:=]\\s*ok\\b/i.test(input);\n const negatedPositive = NEGATED_POSITIVE_RE.test(input);\n const signals = [\n ...positiveAssignments.map(x => `${x.key}=${x.value}`),\n ...positiveCounts.map(x => `${x.passed}/${x.total}_${x.status}`),\n ...(http200 ? ['http_status=200'] : []),\n ...(statusOk ? ['status=ok'] : []),\n ];\n return {\n positive: !negatedPositive && failedCounts.length === 0 && signals.length > 0,\n signals,\n negatedPositive,\n failedCounts,\n };\n}\n\nexport function auditFinalState({ objective, claims, evidence, gates = '' }) {\n const objectiveText = asText(objective);\n const claimsText = asText(claims);\n const evidenceText = asText(evidence);\n const gatesText = asText(gates);\n\n const claimsJsonState = jsonInputState(claims);\n const evidenceJsonState = jsonInputState(evidence);\n const gatesJsonState = jsonInputState(gates);\n const invalidJson = [\n ...(claimsJsonState.kind === 'INVALID' ? [{ field: 'claims', error: claimsJsonState.error }] : []),\n ...(evidenceJsonState.kind === 'INVALID' ? [{ field: 'evidence', error: evidenceJsonState.error }] : []),\n ...(gatesJsonState.kind === 'INVALID' ? [{ field: 'gates', error: gatesJsonState.error }] : []),\n ];\n if (invalidJson.length) {\n return resultEnvelope('RUMBO Audit Final State', IDS.afs,\n { verdict: 'NO_GO', classification: 'UNPROVEN', nextGate: 'INVALID_JSON_INPUT', openGates: ['INVALID_JSON_INPUT'], conflicts: invalidJson.map(x => ({ key: x.field.toUpperCase(), values: [x.error], reason: 'INVALID_OR_DUPLICATE_JSON' })), objective: objectiveText, gateRequirements: [], claimRequirements: [], negativeEvidence: [], negativeEvidenceTokens: [], negativeClaimTokens: [], requiredGateSatisfied: null, claimBindingComplete: false },\n 'UNPROVEN', 'unknown', { objectivePresent: Boolean(objectiveText), claimsPresent: Boolean(claimsText), evidencePresent: Boolean(evidenceText), gatesPresent: Boolean(gatesText), explicitGatePolicy: false, gateRequiresSuccess: false, gatePolicyConflict: false, conditionalGateParsed: false, requiredGateSatisfied: null, claimBindingComplete: false, conflictFree: false, claimConflictFree: false, negativeEvidenceCount: 0, negativeClaimCount: 0, strictJsonValid: false, runtimeIdMustBeVerifiedExternally: IDS.afs });\n }\n\n const objectivePresent = Boolean(objectiveText);\n const claimsPresent = Boolean(claimsText);\n const evidencePresent = Boolean(evidenceText);\n const gatesPresent = Boolean(gatesText);\n\n const evidenceAssignments = semanticAssignments(evidenceText);\n const claimAssignments = semanticAssignments(claimsText);\n const claimStructure = claimStructureAssessment(claimsText);\n const negativeAssignments = negativeEvidenceAssignments(evidenceAssignments);\n const negativeEvidenceTokens = explicitNegativeStatusTokens(evidenceText);\n const evidenceConflicts = assignmentConflicts(evidenceAssignments);\n const claimNegativeAssignments = negativeEvidenceAssignments(claimAssignments);\n const negativeClaimTokens = explicitNegativeStatusTokens(claimsText);\n const claimConflicts = assignmentConflicts(claimAssignments);\n const evidenceConflictKeys = new Set(evidenceConflicts.map(x => x.key.toUpperCase()));\n const claimConflictKeys = new Set(claimConflicts.map(x => x.key.toUpperCase()));\n\n const claimRequirements = claimAssignments.map(req => {\n const matching = evidenceAssignments.filter(x => x.key.toUpperCase() === req.key.toUpperCase());\n const exact = matching.find(x => normalizedAssignmentValue(x.value) === normalizedAssignmentValue(req.value)) ?? null;\n const evidenceConflict = evidenceConflictKeys.has(req.key.toUpperCase());\n const claimConflict = claimConflictKeys.has(req.key.toUpperCase());\n return {\n key: req.key,\n expected: req.value,\n actual: matching.map(x => x.value),\n match: !evidenceConflict && !claimConflict && Boolean(exact),\n };\n });\n const claimBindingComplete = claimStructure.structured && claimAssignments.length > 0 && claimRequirements.every(x => x.match);\n const claimStateFailure = claimNegativeAssignments.length > 0 || negativeClaimTokens.length > 0 || claimConflicts.length > 0;\n\n const positiveAssessment = positiveEvidenceAssessment(evidenceText);\n const evidenceFailure = negativeEvidenceTokens.length > 0\n || negativeAssignments.length > 0\n || evidenceConflicts.length > 0\n || positiveAssessment.negatedPositive\n || positiveAssessment.failedCounts.length > 0;\n\n const gateObservedFailure = /\\b(?:gate|state|verdict|status)\\s*[:=]\\s*(?:FAIL(?:ED|_CLOSED)?|NO_GO|NOT_PROVEN|UNPROVEN)\\b/i.test(gatesText);\n const successEvidence = positiveAssessment.positive;\n const gateRequiresSuccess = /PASS\\s+(?:[uú]nicamente\\s+si|only if)/i.test(gatesText);\n const noneMarkerPresent = /(?:OPEN_GATES?|GATES?)\\s*=\\s*NONE\\b/i.test(gatesText);\n const explicitNoGates = /^(?:NONE|NINGUNO|SIN BLOQUEOS?|(?:OPEN_GATES?|GATES?)\\s*=\\s*NONE)\\.?$/i.test(gatesText.trim());\n const gatePolicyConflict = gateRequiresSuccess && noneMarkerPresent;\n const gatesNone = !gateRequiresSuccess && explicitNoGates;\n const explicitGatePolicy = gatesPresent && (gateRequiresSuccess || explicitNoGates);\n const requirements = conditionalGateRequirements(gatesText);\n const conflictKeys = new Set(evidenceConflicts.map(x => x.key.toUpperCase()));\n const gateRequirementStates = requirements.map(req => {\n const matching = evidenceAssignments.filter(x => x.key.toUpperCase() === req.key.toUpperCase());\n const actual = matching.at(-1) ?? null;\n const conflict = conflictKeys.has(req.key.toUpperCase());\n const match = !conflict && Boolean(actual) && normalizedAssignmentValue(actual.value) === normalizedAssignmentValue(req.value);\n return { key: req.key, expected: req.value, actual: actual?.value ?? null, match };\n });\n const requiredGateSatisfied = gateRequiresSuccess\n && requirements.length > 0\n && gateRequirementStates.every(x => x.match);\n\n const contextComplete = objectivePresent && claimsPresent && evidencePresent && gatesPresent;\n const verdict = contextComplete\n && explicitGatePolicy\n && claimStructure.structured\n && claimBindingComplete\n && !claimStateFailure\n && !evidenceFailure\n && !gateObservedFailure\n && !gatePolicyConflict\n && successEvidence\n && (gatesNone || requiredGateSatisfied)\n ? 'GO' : 'NO_GO';\n\n let nextGate = 'EVIDENCE_REQUIRED';\n if (!objectivePresent) nextGate = 'OBJECTIVE_REQUIRED';\n else if (!claimsPresent) nextGate = 'CLAIMS_REQUIRED';\n else if (!evidencePresent) nextGate = 'EVIDENCE_REQUIRED';\n else if (!gatesPresent || !explicitGatePolicy) nextGate = 'GATE_POLICY_REQUIRED';\n else if (!claimStructure.structured) nextGate = 'UNSTRUCTURED_CLAIM';\n else if (claimConflicts.length > 0) nextGate = 'CLAIM_CONFLICT';\n else if (claimNegativeAssignments.length > 0 || negativeClaimTokens.length > 0) nextGate = 'CLAIM_STATE_NOT_POSITIVE';\n else if (!claimBindingComplete) nextGate = 'CLAIM_EVIDENCE_BINDING_REQUIRED';\n else if (gatePolicyConflict) nextGate = 'GATE_POLICY_CONFLICT';\n else if (gateRequiresSuccess && !requiredGateSatisfied) nextGate = 'REQUIRED_GATE_NOT_PROVEN';\n else if (verdict === 'GO') nextGate = 'NONE';\n\n const classification = verdict === 'GO' ? 'PROVEN' : 'UNPROVEN';\n const conflicts = [\n ...evidenceConflicts,\n ...claimConflicts.map(x => ({ ...x, reason: 'CLAIM_CONFLICTING_VALUES' })),\n ...(gatePolicyConflict ? [{ key: 'GATE_POLICY', values: [gatesText], reason: 'NONE_AND_CONDITIONAL_REQUIREMENT' }] : []),\n ];\n\n return resultEnvelope('RUMBO Audit Final State', IDS.afs,\n {\n verdict,\n classification,\n nextGate,\n openGates: verdict === 'GO' ? [] : [nextGate],\n conflicts,\n objective: objectiveText,\n gateRequirements: gateRequirementStates,\n claimStructure,\n claimRequirements,\n claimBindingComplete,\n negativeClaims: claimNegativeAssignments.map(x => ({ key: x.key, value: x.value })),\n negativeClaimTokens,\n negativeEvidence: negativeAssignments.map(x => ({ key: x.key, value: x.value })),\n negativeEvidenceTokens,\n positiveEvidenceSignals: positiveAssessment.signals,\n failedResultCounts: positiveAssessment.failedCounts,\n negatedPositiveEvidence: positiveAssessment.negatedPositive,\n requiredGateSatisfied: gateRequiresSuccess ? requiredGateSatisfied : null,\n },\n classification, verdict === 'GO' ? 'proven' : 'unknown',\n {\n objectivePresent,\n claimsPresent,\n evidencePresent,\n gatesPresent,\n explicitGatePolicy,\n gateRequiresSuccess,\n gatePolicyConflict,\n conditionalGateParsed: !gateRequiresSuccess || requirements.length > 0,\n requiredGateSatisfied: gateRequiresSuccess ? requiredGateSatisfied : null,\n claimStructureKind: claimStructure.kind,\n structuredClaimsOnly: claimStructure.structured,\n claimBindingComplete,\n conflictFree: evidenceConflicts.length === 0,\n claimConflictFree: claimConflicts.length === 0,\n negativeEvidenceCount: Math.max(negativeAssignments.length, negativeEvidenceTokens.length) + positiveAssessment.failedCounts.length + (positiveAssessment.negatedPositive ? 1 : 0),\n negativeClaimCount: Math.max(claimNegativeAssignments.length, negativeClaimTokens.length),\n positiveEvidenceCount: positiveAssessment.signals.length,\n structuredPositiveEvidence: successEvidence,\n strictJsonValid: true,\n runtimeIdMustBeVerifiedExternally: IDS.afs,\n });\n}\n\nexport const semanticHandlers = Object.freeze({\n 'rumbo-canonical-state-recovery': canonicalStateRecovery,\n 'rumbo-deep-research-reconcile': deepResearchReconcile,\n 'rumbo-goal-loop-controller': goalLoopController,\n 'rumbo-execute-verify-close': executeVerifyClose,\n 'rumbo-audit-final-state': auditFinalState,\n});\n\nexport function mcpToolResult(output) {\n return {\n content: [{ type: 'text', text: JSON.stringify(output, null, 2) }],\n structuredContent: output,\n };\n}\n","label",[145],"b00af806-2384-4ef8-b322-283c20a6d5e9","rumbo-drift-sentinel.ts","01a099e2-134e-77a7-a880-20231c382c41",18,["D",1789288929058],"interval","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst EXPECTED = {\n runtime: \"V1.3.13-RC1\",\n files: {\n \"main.ts\": {\n bytes: 3996,\n sha256: \"3e3a5761c715c8d36de96e7529bd863165cefb9b2bf0b60b9837f759a2b2aa84\",\n },\n \"rumbo-semantic-core.mjs\": {\n bytes: 41135,\n sha256: \"5b143075ff78cd2cb4b55af85e4e540a0cc16262e79ebfcab97152e19df36f47\",\n },\n \"claim-evidence-admission.mjs\": {\n bytes: 16766,\n sha256: \"f9690a36c4c20a6a112ec83b16ceffdf2455d13bcc52018a1cea937cbb0b5536\",\n },\n \"vendor/rumbo-core/src/canonical.js\": {\n bytes: 2570,\n sha256: \"f9bc4d5d2c5c84f1d0ca03a4361fa9cf9082ce46834c6e9f63c014d2c1a3e975\",\n },\n \"vendor/rumbo-core/src/evidence.js\": {\n bytes: 7048,\n sha256: \"e258ac6d0e76829c6823f7e5f8fb33312b9a111714ad75528d2ee98b9496fe1a\",\n },\n \"vendor/rumbo-core/src/revision.js\": {\n bytes: 1177,\n sha256: \"f0f8de12d4df2979e85924ffa460a47e0e0f328380e7ae79ffec66ec4fc241c7\",\n },\n \"vendor/rumbo-core/src/state.js\": {\n bytes: 516,\n sha256: \"a0a654d528321e66397da57c02af8411726f065591028cdb7036e3ed7257525b\",\n },\n \"vendor/rumbo-core/src/supersession.js\": {\n bytes: 3577,\n sha256: \"ac9cd3674d74833c5b554ba94fe485947b4d59739e0ed72948a5cdab9ff795fa\",\n },\n \"vendor/rumbo-core/src/timestamp.js\": {\n bytes: 1266,\n sha256: \"1c54cdc372f5c73a58847605303f3cf1c4e7c0b9204c8edeae1dfb3a94d6a338\",\n },\n },\n} as const;\n\nconst enc = new TextEncoder();\nconst hex = (buf: ArrayBuffer) =>\n Array.from(new Uint8Array(buf))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\nasync function fingerprint(path: string) {\n const res = await fetch(new URL(`./${path}`, import.meta.url), { cache: \"no-store\" });\n const text = await res.text();\n const bytes = enc.encode(text);\n return {\n status: res.status,\n bytes: bytes.length,\n sha256: hex(await crypto.subtle.digest(\"SHA-256\", bytes)),\n };\n}\n\nexport default async function (interval?: Interval) {\n const checkedAt = new Date().toISOString();\n const observed: Record>> = {};\n const checks: Record = {};\n\n for (const [path, expected] of Object.entries(EXPECTED.files)) {\n const fp = await fingerprint(path);\n observed[path] = fp;\n checks[`${path}:status`] = fp.status === 200;\n checks[`${path}:bytes`] = fp.bytes === expected.bytes;\n checks[`${path}:sha256`] = fp.sha256 === expected.sha256;\n }\n\n const failures = Object.entries(checks)\n .filter(([, ok]) => !ok)\n .map(([name]) => name);\n const verdict = failures.length === 0 ? \"PASS\" : \"DRIFT\";\n\n const receipt = {\n schema: \"rumbo-agent-reliability-drift-sentinel/v2\",\n checked_at_utc: checkedAt,\n previous_successful_run_at: interval?.lastRunAt?.toISOString() ?? null,\n runtime_expected: EXPECTED.runtime,\n verdict,\n failures,\n expected: EXPECTED,\n observed,\n checks,\n };\n\n await blob.setJSON(\"rumbo/drift/latest.json\", receipt);\n await blob.setJSON(`rumbo/drift/history/${checkedAt}.json`, receipt);\n console.log(JSON.stringify(receipt));\n\n if (verdict !== \"PASS\") {\n throw new Error(`RUMBO_DRIFT_DETECTED:${failures.join(\",\")}`);\n }\n\n return receipt;\n}\n",[155],"6ec6e5e5-6545-45e8-a280-32be4c38f1cf","main.ts","01a099e2-134e-77a7-a880-1e108f792b07",["D",1789288399505],"http","import { createMcpHandler, McpServer } from \"npm:@modelcontextprotocol/server\";\nimport * as z from \"npm:zod/v4\";\nimport {\n canonicalStateRecovery,\n deepResearchReconcile,\n goalLoopController,\n executeVerifyClose,\n auditFinalState,\n mcpToolResult,\n} from \"./rumbo-semantic-core.mjs\";\nimport { evaluateClaimEvidenceAdmission } from \"./claim-evidence-admission.mjs\";\n\nfunction buildServer() {\n const server = new McpServer({ name: \"RUMBO Agent Reliability\", version: \"1.3.13-rc1\" });\n\n server.registerTool(\"rumbo-canonical-state-recovery\", {\n description: \"Recover one evidence-grounded canonical state before continuing long-running work. Read-only and fail-closed.\",\n inputSchema: z.object({ goal: z.string(), evidence: z.string(), priorState: z.string().optional() }),\n annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },\n }, async (args) => mcpToolResult(canonicalStateRecovery(args)));\n\n server.registerTool(\"rumbo-deep-research-reconcile\", {\n description: \"Turn supplied evidence into a reconciled answer while distinguishing facts, conflicts, and missing evidence.\",\n inputSchema: z.object({ question: z.string(), evidence: z.string(), constraints: z.string().optional() }),\n annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },\n }, async (args) => mcpToolResult(deepResearchReconcile(args)));\n\n server.registerTool(\"rumbo-goal-loop-controller\", {\n description: \"Choose the highest-value next action toward a goal without loops, duplicate work, or unsupported promotion.\",\n inputSchema: z.object({ goal: z.string(), currentState: z.string(), blockers: z.string().optional() }),\n annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },\n }, async (args) => mcpToolResult(goalLoopController(args)));\n\n server.registerTool(\"rumbo-execute-verify-close\", {\n description: \"Audit an implementation and define the exact evidence required before declaring it complete.\",\n inputSchema: z.object({ objective: z.string(), implementation: z.string(), verification: z.string().optional() }),\n annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },\n }, async (args) => mcpToolResult(executeVerifyClose(args)));\n\n server.registerTool(\"rumbo-audit-final-state\", {\n description: \"Perform a final fail-closed audit of claims, evidence, gates, and promotion readiness.\",\n inputSchema: z.object({ objective: z.string(), claims: z.string(), evidence: z.string(), gates: z.string().optional() }),\n annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },\n }, async (args) => mcpToolResult(auditFinalState(args)));\n\n server.registerTool(\"rumbo-claim-evidence-admission\", {\n description: \"Admit factual claims only when canonical R1 evidence validates and binds the exact target subject/capability, exact claim digest, and exact value; fail closed on cross-target, superseded, or invalid evidence.\",\n inputSchema: z.object({\n target: z.string(),\n claims: z.string(),\n evidence: z.string(),\n negativeBindings: z.string().optional(),\n }),\n annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },\n }, async (args) => mcpToolResult(evaluateClaimEvidenceAdmission(args)));\n\n return server;\n}\n\nconst handler = createMcpHandler(buildServer);\nexport default async function fetch(req: Request) {\n try {\n if (req.method === \"POST\") {\n const body = await req.clone().json();\n const method = typeof body?.method === \"string\" ? body.method : \"unknown\";\n const tool = typeof body?.params?.name === \"string\" ? body.params.name : null;\n console.log(JSON.stringify({ event: \"rumbo_mcp_request\", version: \"1.3.13-rc1+valtown-adapter.2\", method, tool }));\n }\n } catch {\n console.log(JSON.stringify({ event: \"rumbo_mcp_request\", version: \"1.3.13-rc1+valtown-adapter.2\", method: \"unparsed\", tool: null }));\n }\n return handler.fetch(req);\n}\n",[163],"1c4f96b1-aa9c-4376-af70-0d26822e3ef2",["D",1789289006751],[28],"394e8755-58a0-4f05-b56d-143f7b00a89e","cea-verify-branch.ts","a5b285b4-af4d-11f1-b6ca-1607ee4eb77e",17,["D",1789288506916],4,"script","const EXPECTED = {\n 'claim-evidence-admission.mjs': 'f9690a36c4c20a6a112ec83b16ceffdf2455d13bcc52018a1cea937cbb0b5536',\n 'vendor/rumbo-core/src/canonical.js': 'f9bc4d5d2c5c84f1d0ca03a4361fa9cf9082ce46834c6e9f63c014d2c1a3e975',\n 'vendor/rumbo-core/src/evidence.js': 'e258ac6d0e76829c6823f7e5f8fb33312b9a111714ad75528d2ee98b9496fe1a',\n 'vendor/rumbo-core/src/revision.js': 'f0f8de12d4df2979e85924ffa460a47e0e0f328380e7ae79ffec66ec4fc241c7',\n 'vendor/rumbo-core/src/state.js': 'a0a654d528321e66397da57c02af8411726f065591028cdb7036e3ed7257525b',\n 'vendor/rumbo-core/src/supersession.js': 'ac9cd3674d74833c5b554ba94fe485947b4d59739e0ed72948a5cdab9ff795fa',\n 'vendor/rumbo-core/src/timestamp.js': '1c54cdc372f5c73a58847605303f3cf1c4e7c0b9204c8edeae1dfb3a94d6a338',\n 'main.ts': '3e3a5761c715c8d36de96e7529bd863165cefb9b2bf0b60b9837f759a2b2aa84',\n 'rumbo-semantic-core.mjs': '5b143075ff78cd2cb4b55af85e4e540a0cc16262e79ebfcab97152e19df36f47',\n} as const;\n\nconst enc = new TextEncoder();\nconst hex = (buf: ArrayBuffer) => Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, '0')).join('');\n\nasync function fingerprint(path: string) {\n const res = await fetch(new URL(`./${path}`, import.meta.url), { cache: 'no-store' });\n const text = await res.text();\n const bytes = enc.encode(text);\n return { status: res.status, bytes: bytes.length, sha256: hex(await crypto.subtle.digest('SHA-256', bytes)) };\n}\n\nasync function verify() {\n const observed: Record = {};\n const failures: string[] = [];\n for (const [path, expected] of Object.entries(EXPECTED)) {\n const fp = await fingerprint(path);\n observed[path] = fp;\n if (fp.status !== 200) failures.push(`${path}:HTTP_${fp.status}`);\n if (fp.sha256 !== expected) failures.push(`${path}:SHA256_MISMATCH`);\n }\n const result = { verdict: failures.length ? 'FAIL' : 'PASS', failures, observed, expected: EXPECTED };\n console.log(JSON.stringify(result));\n if (failures.length) throw new Error(`CEA_BRANCH_READBACK_FAIL:${failures.join(',')}`);\n return result;\n}\n\nconst branchVerification = await verify();\nconsole.log('CEA_BRANCH_VERIFY_RESULT=' + JSON.stringify(branchVerification));\nexport default branchVerification;\n",[173],"b0362b29-cf92-416c-bd5e-237d8bfafd0d","cea-drift-preflight.ts","1c752bb0-af4f-11f1-9214-1607ee4eb77e",19,["D",1789288973973],"const EXPECTED = {\n \"main.ts\": [3996, \"3e3a5761c715c8d36de96e7529bd863165cefb9b2bf0b60b9837f759a2b2aa84\"],\n \"rumbo-semantic-core.mjs\": [41135, \"5b143075ff78cd2cb4b55af85e4e540a0cc16262e79ebfcab97152e19df36f47\"],\n \"claim-evidence-admission.mjs\": [16766, \"f9690a36c4c20a6a112ec83b16ceffdf2455d13bcc52018a1cea937cbb0b5536\"],\n \"vendor/rumbo-core/src/canonical.js\": [2570, \"f9bc4d5d2c5c84f1d0ca03a4361fa9cf9082ce46834c6e9f63c014d2c1a3e975\"],\n \"vendor/rumbo-core/src/evidence.js\": [7048, \"e258ac6d0e76829c6823f7e5f8fb33312b9a111714ad75528d2ee98b9496fe1a\"],\n \"vendor/rumbo-core/src/revision.js\": [1177, \"f0f8de12d4df2979e85924ffa460a47e0e0f328380e7ae79ffec66ec4fc241c7\"],\n \"vendor/rumbo-core/src/state.js\": [516, \"a0a654d528321e66397da57c02af8411726f065591028cdb7036e3ed7257525b\"],\n \"vendor/rumbo-core/src/supersession.js\": [3577, \"ac9cd3674d74833c5b554ba94fe485947b4d59739e0ed72948a5cdab9ff795fa\"],\n \"vendor/rumbo-core/src/timestamp.js\": [1266, \"1c54cdc372f5c73a58847605303f3cf1c4e7c0b9204c8edeae1dfb3a94d6a338\"],\n} as const;\n\nconst enc = new TextEncoder();\nconst hex = (buf: ArrayBuffer) => Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\nasync function fingerprint(path: string) {\n const res = await fetch(new URL(`./${path}`, import.meta.url), { cache: \"no-store\" });\n const text = await res.text();\n const bytes = enc.encode(text);\n return { status: res.status, bytes: bytes.length, sha256: hex(await crypto.subtle.digest(\"SHA-256\", bytes)) };\n}\n\nconst observed: Record = {};\nconst failures: string[] = [];\nfor (const [path, [bytes, sha256]] of Object.entries(EXPECTED)) {\n const fp = await fingerprint(path);\n observed[path] = fp;\n if (fp.status !== 200) failures.push(`${path}:STATUS`);\n if (fp.bytes !== bytes) failures.push(`${path}:BYTES`);\n if (fp.sha256 !== sha256) failures.push(`${path}:SHA256`);\n}\nconst result = { schema: \"rumbo-drift-preflight/v1\", verdict: failures.length ? \"FAIL\" : \"PASS\", failures, observed, expected: EXPECTED };\nconsole.log(JSON.stringify(result));\nif (failures.length) throw new Error(`RUMBO_DRIFT_PREFLIGHT_FAIL:${failures.join(\",\")}`);\n",[182],"cedcf130-c9ee-43d3-89f0-a3c84d241fe1","README.md","01a099e2-134e-77a7-a880-198fa8a08983",["D",1789288125263],"# MCP server\n\nA minimal MCP server with one example tool (that gets the current time in a\ngiven timezone).\n\nRemix this val to create your own MCP server on Val\nTown—[**_just like the MCP Core Maintainer team!_**](https://blog.val.town/mcp-core-maintainers)\n\nThis MCP server (<50 LOC in [`main.ts`](./main.ts)) is live on\n[mcp-time.val.run](https://mcp-time.val.run) if you'd like to test it\n([playground.ai.cloudflare.com](https://playground.ai.cloudflare.com) is a great\nplace to test an MCP server quickly). It's built on the v2 TypeScript SDK,\ncompatible with “MCP 2.0” (technically, the\n[2026-07-28 spec](https://modelcontextprotocol.io/specification/2026-07-28)). It\nalso supports the legacy spec, for MCP clients that haven't upgraded yet.",[189],"afafe617-e640-4826-a0a3-4f9fcd0f58f5","vendor","39e8cbae-af4d-11f1-9167-1607ee4eb77e",2,["D",1789288164382],"directory",[195],"pulls","branches",9,"forks","envVars",{"_209":61,"_211":61},"connections",{"_209":61,"_210":61},"count","unfilledCount","emptyCount",{"_42":194,"_32":195,"_30":196,"_147":-5,"_40":41,"_39":197,"_149":125,"_37":310,"_13":61,"_33":199,"_34":-5,"_24":25,"_152":-5,"_229":311,"_27":312},{"_42":305,"_32":258,"_30":301,"_147":196,"_40":41,"_39":306,"_149":125,"_37":307,"_13":61,"_33":199,"_34":-5,"_24":25,"_152":-5,"_229":308,"_27":309},{"_42":300,"_32":259,"_30":253,"_147":301,"_40":41,"_39":177,"_149":125,"_37":302,"_13":61,"_33":199,"_34":-5,"_24":25,"_152":-5,"_229":303,"_27":304},{"_42":292,"_32":293,"_30":294,"_147":253,"_40":41,"_39":295,"_149":125,"_37":296,"_13":61,"_33":178,"_34":297,"_24":25,"_152":-5,"_229":298,"_27":299},{"_42":284,"_32":285,"_30":286,"_147":253,"_40":41,"_39":287,"_149":125,"_37":288,"_13":61,"_33":178,"_34":289,"_24":25,"_152":-5,"_229":290,"_27":291},{"_42":276,"_32":277,"_30":278,"_147":253,"_40":41,"_39":279,"_149":125,"_37":280,"_13":61,"_33":178,"_34":281,"_24":25,"_152":-5,"_229":282,"_27":283},{"_42":268,"_32":269,"_30":270,"_147":253,"_40":41,"_39":271,"_149":125,"_37":272,"_13":61,"_33":178,"_34":273,"_24":25,"_152":-5,"_229":274,"_27":275},{"_42":260,"_32":261,"_30":262,"_147":253,"_40":41,"_39":263,"_149":125,"_37":264,"_13":61,"_33":178,"_34":265,"_24":25,"_152":-5,"_229":266,"_27":267},{"_42":250,"_32":251,"_30":252,"_147":253,"_40":41,"_39":203,"_149":125,"_37":254,"_13":61,"_33":178,"_34":255,"_24":25,"_152":-5,"_229":256,"_27":257},{"_42":188,"_32":189,"_30":190,"_147":-5,"_40":41,"_39":148,"_149":125,"_37":247,"_13":61,"_33":20,"_34":192,"_24":25,"_152":-5,"_229":248,"_27":249},{"_42":181,"_32":182,"_30":183,"_147":-5,"_40":41,"_39":184,"_149":25,"_37":244,"_13":61,"_33":178,"_34":186,"_24":25,"_152":-5,"_229":245,"_27":246},{"_42":172,"_32":173,"_30":174,"_147":-5,"_40":41,"_39":175,"_149":25,"_37":241,"_13":177,"_33":178,"_34":179,"_24":25,"_152":-5,"_229":242,"_27":243},{"_42":169,"_32":28,"_30":31,"_147":-5,"_40":41,"_39":14,"_149":125,"_37":238,"_13":148,"_33":20,"_34":36,"_24":25,"_152":-5,"_229":239,"_27":240},{"_42":162,"_32":163,"_30":164,"_147":-5,"_40":41,"_39":90,"_149":25,"_37":235,"_13":148,"_33":166,"_34":167,"_24":25,"_152":-5,"_229":236,"_27":237},{"_42":154,"_32":155,"_30":156,"_147":-5,"_40":41,"_39":157,"_149":25,"_37":232,"_13":148,"_33":159,"_34":160,"_24":25,"_152":-5,"_229":233,"_27":234},{"_42":144,"_32":145,"_30":146,"_147":-5,"_40":41,"_39":148,"_149":125,"_37":228,"_13":61,"_33":20,"_34":151,"_24":25,"_152":-5,"_229":230,"_27":231},["D",1789288125263],"children",[],[145],["D",1789288929058],[],[155],["D",1789288399505],[],[163],["D",1789289006751],[],[28],["D",1789288506916],[],[173],["D",1789288973973],[],[182],["D",1789288125263],[],[189],"a06ad266-07d5-402d-8844-62151b568265","timestamp.js","805a58b4-af4d-11f1-bf4e-1607ee4eb77e","463c5be6-af4d-11f1-af77-1607ee4eb77e",["D",1789288282557],"const ISO_INSTANT = /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(?:\\.(\\d{1,9}))?(Z|([+-])(\\d{2}):(\\d{2}))$/;\n\nfunction leapYear(year) {\n return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);\n}\n\nfunction daysInMonth(year, month) {\n const days = [31, leapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n return days[month - 1] || 0;\n}\n\nexport function normalizeIsoTimestamp(value, code = 'INVALID_TIMESTAMP') {\n if (typeof value !== 'string') throw new Error(code);\n const match = ISO_INSTANT.exec(value);\n if (!match) throw new Error(code);\n\n const year = Number(match[1]);\n const month = Number(match[2]);\n const day = Number(match[3]);\n const hour = Number(match[4]);\n const minute = Number(match[5]);\n const second = Number(match[6]);\n const offsetHour = match[10] === undefined ? 0 : Number(match[10]);\n const offsetMinute = match[11] === undefined ? 0 : Number(match[11]);\n\n if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) throw new Error(code);\n if (hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59) throw new Error(code);\n const parsed = Date.parse(value);\n if (!Number.isFinite(parsed)) throw new Error(code);\n return new Date(parsed).toISOString();\n}\n",[],[195,258,259,251],"rumbo-core","src","dceb7bdd-5a40-4389-8431-0ac3c8a89814","supersession.js","9641ee94-af4d-11f1-bf08-1607ee4eb77e",11,["D",1789288319207],"import { stableValue } from './canonical.js';\nimport { validateEvidence } from './evidence.js';\n\nfunction sortRecords(records) {\n return [...records].sort((a, b) => a.evidenceId.localeCompare(b.evidenceId));\n}\n\nfunction sortLinks(links) {\n return [...links].sort((a, b) => `${a.from}\\u0000${a.to}\\u0000${a.reason}`.localeCompare(`${b.from}\\u0000${b.to}\\u0000${b.reason}`));\n}\n\nfunction uniqueCycles(cycles) {\n const seen = new Set();\n const out = [];\n for (const cycle of cycles) {\n const normalized = [...new Set(cycle)].sort();\n const key = normalized.join('\\u0000');\n if (!seen.has(key)) {\n seen.add(key);\n out.push(normalized);\n }\n }\n return out.sort((a, b) => a.join('\\u0000').localeCompare(b.join('\\u0000')));\n}\n\nexport function resolveSupersession(records) {\n if (!Array.isArray(records)) throw new Error('INVALID_SUPERSESSION_RECORDS');\n const canonicalRecords = records.map((record) => {\n let canonical;\n try { canonical = stableValue(record); } catch { throw new Error('INVALID_EVIDENCE_RECORD'); }\n if (!canonical || typeof canonical !== 'object' || Array.isArray(canonical)) throw new Error('INVALID_EVIDENCE_RECORD');\n return canonical;\n });\n const byId = new Map();\n for (const record of canonicalRecords) {\n const id = String(record?.evidenceId || '');\n if (!id) throw new Error('INVALID_EVIDENCE_ID');\n if (byId.has(id)) throw new Error(`DUPLICATE_EVIDENCE_ID: ${id}`);\n byId.set(id, record);\n }\n\n const valid = new Map();\n const invalidLinks = [];\n for (const [id, record] of byId) {\n if (validateEvidence(record).ok) valid.set(id, record);\n else {\n for (const target of Array.isArray(record?.supersedes) ? record.supersedes : []) {\n if (byId.has(target) && validateEvidence(byId.get(target)).ok) {\n invalidLinks.push({ from: id, to: target, reason: 'INVALID_SUPERSEDER' });\n }\n }\n }\n }\n\n const edges = new Map();\n for (const [id, record] of valid) {\n const targets = [];\n for (const target of record.supersedes) {\n if (!byId.has(target)) {\n invalidLinks.push({ from: id, to: target, reason: 'MISSING_TARGET' });\n continue;\n }\n if (!valid.has(target)) {\n invalidLinks.push({ from: id, to: target, reason: 'INVALID_TARGET' });\n continue;\n }\n targets.push(target);\n }\n edges.set(id, targets.sort());\n }\n\n const cycles = [];\n const state = new Map();\n const stack = [];\n function visit(id) {\n const mark = state.get(id) || 0;\n if (mark === 2) return;\n if (mark === 1) {\n const start = stack.indexOf(id);\n cycles.push(stack.slice(start));\n return;\n }\n state.set(id, 1);\n stack.push(id);\n for (const target of edges.get(id) || []) visit(target);\n stack.pop();\n state.set(id, 2);\n }\n for (const id of [...valid.keys()].sort()) visit(id);\n\n const normalizedCycles = uniqueCycles(cycles);\n const cycleNodes = new Set(normalizedCycles.flat());\n const supersededIds = new Set();\n for (const [from, targets] of edges) {\n if (cycleNodes.has(from)) continue;\n for (const target of targets) {\n if (!cycleNodes.has(target)) supersededIds.add(target);\n }\n }\n\n const active = [];\n const superseded = [];\n for (const [id, record] of valid) {\n if (cycleNodes.has(id)) continue;\n if (supersededIds.has(id)) superseded.push(record);\n else active.push(record);\n }\n\n return {\n active: sortRecords(active),\n superseded: sortRecords(superseded),\n invalidLinks: sortLinks(invalidLinks),\n cycles: normalizedCycles\n };\n}\n",[],[195,258,259,261],"becd0fa3-0d8b-437a-a692-2ac7b8858212","state.js","764b275e-af4d-11f1-9730-1607ee4eb77e",7,["D",1789288265698],"export const STATE_EVIDENCE_VERSION = 'rumbo-state-evidence/r1';\n\nexport const DATA_CLASSIFICATIONS = Object.freeze([\n 'CANONICAL',\n 'OBSERVED',\n 'DERIVED',\n 'CACHED',\n 'NOT_PROVEN'\n]);\n\nexport const OPERATIONAL_STATES = Object.freeze([\n 'CURRENT',\n 'STALE',\n 'SUPERSEDED',\n 'CONFLICT',\n 'BLOCKED',\n 'NOT_PROVEN'\n]);\n\nexport function isDataClassification(value) {\n return DATA_CLASSIFICATIONS.includes(value);\n}\n\nexport function isOperationalState(value) {\n return OPERATIONAL_STATES.includes(value);\n}\n",[],[195,258,259,269],"3efc3bd0-b05f-4324-9bef-621f23dae57e","revision.js","7b1297d6-af4d-11f1-9522-1607ee4eb77e",8,["D",1789288273685],"import { stableJson, stableValue } from './canonical.js';\n\nexport function normalizeRevision(binding) {\n let canonical;\n try {\n canonical = stableValue(binding);\n } catch {\n throw new Error('INVALID_REVISION');\n }\n if (!canonical || typeof canonical !== 'object' || Array.isArray(canonical)) {\n throw new Error('INVALID_REVISION');\n }\n const keys = Object.keys(canonical);\n if (keys.some((key) => !['kind', 'value', 'scope'].includes(key))) throw new Error('INVALID_REVISION');\n\n const kind = typeof canonical.kind === 'string' ? canonical.kind.trim() : '';\n const value = typeof canonical.value === 'string' ? canonical.value.trim() : '';\n if (!kind || !value) throw new Error('INVALID_REVISION');\n\n const normalized = { kind, value };\n if ('scope' in canonical) {\n const scope = typeof canonical.scope === 'string' ? canonical.scope.trim() : '';\n if (!scope) throw new Error('INVALID_REVISION');\n normalized.scope = scope;\n }\n return normalized;\n}\nexport function revisionMatches(expected, observed) {\n try {\n return stableJson(normalizeRevision(expected)) === stableJson(normalizeRevision(observed));\n } catch {\n return false;\n }\n}\n",[],[195,258,259,277],"a3aad07a-4603-4162-8fc9-4cf7826230e6","evidence.js","8d7e928a-af4d-11f1-b810-1607ee4eb77e",10,["D",1789288304627],"import { stableJson, stableValue, sha256Canonical } from './canonical.js';\nimport { isDataClassification } from './state.js';\nimport { normalizeRevision } from './revision.js';\nimport { normalizeIsoTimestamp } from './timestamp.js';\n\nexport const EVIDENCE_SCHEMA = 'rumbo-state-evidence/r1/evidence';\n\nfunction nonEmptyString(value, code) {\n if (typeof value !== 'string' || !value.trim()) throw new Error(code);\n return value.trim();\n}\n\nfunction assertPlainObject(value, code) {\n if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(code);\n const proto = Object.getPrototypeOf(value);\n if (proto !== Object.prototype && proto !== null) throw new Error(code);\n}\n\nfunction rejectUnknownKeys(value, allowed, code) {\n for (const key of Object.keys(value)) {\n if (!allowed.includes(key)) throw new Error(code);\n }\n}\n\nconst SECRET_SUFFIXES = ['password', 'passwd', 'secret', 'token', 'apikey', 'privatekey', 'credential', 'credentials'];\n\nfunction secretKey(key) {\n const normalized = String(key).toLowerCase().replace(/[^a-z0-9]/g, '');\n return normalized === 'authorization' || normalized === 'proxyauthorization'\n || SECRET_SUFFIXES.some((suffix) => normalized.endsWith(suffix));\n}\n\nfunction secretString(value) {\n return /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/i.test(value)\n || /\\b(?:Bearer|Basic)\\s+[A-Za-z0-9+/_=.-]{3,}/i.test(value)\n || /[a-z][a-z0-9+.-]*:\\/\\/[^/\\s:@]+:[^@\\s/]+@/i.test(value)\n || /[?&](?:access[_-]?token|refresh[_-]?token|api[_-]?key|token|secret|password|client[_-]?secret)=[^&#\\s]+/i.test(value)\n || /\\bsk-(?:proj-)?[A-Za-z0-9_-]{8,}/i.test(value)\n || /\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{8,}/i.test(value);\n}\n\nfunction assertNoSecretMaterial(value, path = 'evidence') {\n if (typeof value === 'string') {\n if (secretString(value)) throw new Error(`SECRET_MATERIAL_FORBIDDEN: ${path}`);\n return;\n }\n if (Array.isArray(value)) {\n value.forEach((entry, index) => assertNoSecretMaterial(entry, `${path}[${index}]`));\n return;\n }\n if (value && typeof value === 'object') {\n for (const [key, child] of Object.entries(value)) {\n if (secretKey(key)) throw new Error(`SECRET_MATERIAL_FORBIDDEN: ${path}.${key}`);\n assertNoSecretMaterial(child, `${path}.${key}`);\n }\n }\n}\n\nexport function normalizeSource(source) {\n let canonical;\n try { canonical = stableValue(source); } catch { throw new Error('INVALID_SOURCE'); }\n assertPlainObject(canonical, 'INVALID_SOURCE');\n rejectUnknownKeys(canonical, ['kind', 'id', 'locator'], 'INVALID_SOURCE');\n const normalized = {\n kind: nonEmptyString(canonical.kind, 'INVALID_SOURCE'),\n id: nonEmptyString(canonical.id, 'INVALID_SOURCE')\n };\n if ('locator' in canonical) normalized.locator = nonEmptyString(canonical.locator, 'INVALID_SOURCE');\n assertNoSecretMaterial(normalized, 'source');\n return normalized;\n}\n\nexport function normalizeSubject(subject) {\n let canonical;\n try { canonical = stableValue(subject); } catch { throw new Error('INVALID_SUBJECT'); }\n assertPlainObject(canonical, 'INVALID_SUBJECT');\n rejectUnknownKeys(canonical, ['kind', 'id', 'claim'], 'INVALID_SUBJECT');\n return {\n kind: nonEmptyString(canonical.kind, 'INVALID_SUBJECT'),\n id: nonEmptyString(canonical.id, 'INVALID_SUBJECT'),\n claim: nonEmptyString(canonical.claim, 'INVALID_SUBJECT')\n };\n}\n\nfunction normalizeActor(actor) {\n if (typeof actor === 'string') return nonEmptyString(actor, 'INVALID_ACTOR');\n assertPlainObject(actor, 'INVALID_ACTOR');\n return stableValue(actor);\n}\n\nfunction normalizeMetadata(metadata = {}) {\n assertPlainObject(metadata, 'INVALID_METADATA');\n return stableValue(metadata);\n}\n\nfunction normalizeSupersedes(value, evidenceId) {\n if (!Array.isArray(value)) throw new Error('INVALID_SUPERSEDES');\n const normalized = value.map((entry) => nonEmptyString(entry, 'INVALID_SUPERSEDES'));\n if (new Set(normalized).size !== normalized.length) throw new Error('DUPLICATE_SUPERSEDES');\n if (normalized.includes(evidenceId)) throw new Error('SELF_SUPERSESSION');\n return normalized;\n}\n\nfunction normalizeBody(input) {\n assertPlainObject(input, 'INVALID_EVIDENCE');\n stableValue(input);\n rejectUnknownKeys(input, ['schema', 'evidenceId', 'observedAt', 'actor', 'action', 'source', 'subject', 'before', 'after', 'sourceRevision', 'classification', 'supersedes', 'metadata'], 'INVALID_EVIDENCE');\n if ('schema' in input && input.schema !== EVIDENCE_SCHEMA) throw new Error('INVALID_EVIDENCE_SCHEMA');\n const evidenceId = nonEmptyString(input.evidenceId, 'INVALID_EVIDENCE_ID');\n if (!isDataClassification(input.classification)) throw new Error('INVALID_CLASSIFICATION');\n const normalized = {\n schema: EVIDENCE_SCHEMA,\n evidenceId,\n observedAt: normalizeIsoTimestamp(input.observedAt, 'INVALID_EVIDENCE_TIMESTAMP'),\n actor: normalizeActor(input.actor),\n action: nonEmptyString(input.action, 'INVALID_ACTION'),\n source: normalizeSource(input.source),\n subject: normalizeSubject(input.subject),\n before: stableValue(input.before),\n after: stableValue(input.after),\n sourceRevision: input.sourceRevision === null ? null : normalizeRevision(input.sourceRevision),\n classification: input.classification,\n supersedes: normalizeSupersedes(input.supersedes === undefined ? [] : input.supersedes, evidenceId),\n metadata: normalizeMetadata(input.metadata === undefined ? {} : input.metadata)\n };\n assertNoSecretMaterial(normalized);\n return normalized;\n}\n\nfunction deepFreeze(value) {\n if (value && typeof value === 'object' && !Object.isFrozen(value)) {\n for (const child of Object.values(value)) deepFreeze(child);\n Object.freeze(value);\n }\n return value;\n}\n\nexport function createEvidence(input) {\n const body = normalizeBody(input);\n return deepFreeze({ ...body, evidenceSha256: sha256Canonical(body) });\n}\n\nfunction bodyFromRecord(record) {\n const { evidenceSha256: _hash, ...body } = record;\n return body;\n}\n\nexport function verifyEvidenceHash(record) {\n try {\n const canonical = stableValue(record);\n assertPlainObject(canonical, 'INVALID_EVIDENCE');\n if (!/^[a-f0-9]{64}$/.test(String(canonical.evidenceSha256 || ''))) return false;\n return sha256Canonical(bodyFromRecord(canonical)) === canonical.evidenceSha256;\n } catch {\n return false;\n }\n}\n\nexport function validateEvidence(record) {\n try {\n const canonical = stableValue(record);\n assertPlainObject(canonical, 'INVALID_EVIDENCE');\n if (canonical.schema !== EVIDENCE_SCHEMA) return { ok: false, reason: 'INVALID_EVIDENCE_SCHEMA' };\n const body = bodyFromRecord(canonical);\n const normalized = normalizeBody(body);\n if (stableJson(normalized) !== stableJson(body)) return { ok: false, reason: 'NON_CANONICAL_EVIDENCE' };\n if (!verifyEvidenceHash(canonical)) return { ok: false, reason: 'EVIDENCE_HASH_MISMATCH' };\n return { ok: true };\n } catch (error) {\n return { ok: false, reason: String(error?.message || 'INVALID_EVIDENCE') };\n }\n}\nexport { resolveSupersession } from './supersession.js';\n",[],[195,258,259,285],"510d8bdb-6795-4850-b3ba-783f08753c6e","canonical.js","721a22ac-af4d-11f1-b93c-1607ee4eb77e",6,["D",1789288258672],"import { createHash } from 'node:crypto';\n\nfunction isPlainObject(value) {\n if (value === null || typeof value !== 'object') return false;\n const proto = Object.getPrototypeOf(value);\n return proto === Object.prototype || proto === null;\n}\n\nfunction assertDataProperty(object, key) {\n const descriptor = Object.getOwnPropertyDescriptor(object, key);\n if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {\n throw new Error('INVALID_CANONICAL_VALUE: NON_DATA_PROPERTY');\n }\n return descriptor.value;\n}\n\nfunction stableArray(value, seen, visit) {\n if (Object.getOwnPropertySymbols(value).length) {\n throw new Error('INVALID_CANONICAL_VALUE: SYMBOL_KEY');\n }\n const names = Object.getOwnPropertyNames(value).filter((key) => key !== 'length');\n if (names.length !== value.length) throw new Error('INVALID_CANONICAL_VALUE: SPARSE_OR_EXTENDED_ARRAY');\n const output = [];\n for (let index = 0; index < value.length; index += 1) {\n if (!Object.hasOwn(value, index)) throw new Error('INVALID_CANONICAL_VALUE: SPARSE_ARRAY');\n output.push(visit(assertDataProperty(value, String(index)), seen));\n }\n return output;\n}\nfunction stableObject(value, seen, visit) {\n if (Object.getOwnPropertySymbols(value).length) {\n throw new Error('INVALID_CANONICAL_VALUE: SYMBOL_KEY');\n }\n const names = Object.getOwnPropertyNames(value).sort();\n const entries = names.map((key) => [key, visit(assertDataProperty(value, key), seen)]);\n return Object.fromEntries(entries);\n}\n\nfunction visitCanonical(value, seen) {\n if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;\n if (typeof value === 'number') {\n if (!Number.isFinite(value)) throw new Error('INVALID_CANONICAL_VALUE: NON_FINITE_NUMBER');\n return value;\n }\n if (typeof value !== 'object') throw new Error(`INVALID_CANONICAL_VALUE: ${typeof value}`);\n if (seen.has(value)) throw new Error('CANONICAL_CYCLE');\n if (!Array.isArray(value) && !isPlainObject(value)) {\n throw new Error('INVALID_CANONICAL_VALUE: NON_PLAIN_OBJECT');\n }\n\n seen.add(value);\n try {\n return Array.isArray(value)\n ? stableArray(value, seen, visitCanonical)\n : stableObject(value, seen, visitCanonical);\n } finally {\n seen.delete(value);\n }\n}\nexport function stableValue(value) {\n return visitCanonical(value, new Set());\n}\n\nexport function stableJson(value) {\n return JSON.stringify(stableValue(value));\n}\n\nexport function sha256Canonical(value) {\n return createHash('sha256').update(stableJson(value), 'utf8').digest('hex');\n}\n",[],[195,258,259,293],"c047e875-9380-4a6e-ba13-17a1a58d32c8","3f1cbed2-af4d-11f1-b738-1607ee4eb77e",["D",1789288185079],[215,216,217,218,219,220],[195,258,259],"9e4c0e43-55ba-460c-904e-5310a696afbd",3,["D",1789288173056],[214],[195,258],["D",1789288164382],[213],[195],["D",1788582330391],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":54,"_102":103,"_104":25},{"_13":84,"_32":85,"_42":41,"_86":43,"_87":88,"_89":90,"_91":49,"_92":43,"_93":63,"_94":44,"_95":96},"ctx",{"_77":-5,"_127":350,"_351":352,"_353":354,"_355":25,"_356":25,"_357":25,"_358":125,"_359":-5,"_360":-7,"_361":-7,"_362":61,"_363":25,"_364":25,"_365":-5,"_366":25,"_367":25,"_368":25,"_369":-5},"ENV",{"_321":322,"_323":324,"_325":133,"_326":327,"_328":329,"_330":331,"_332":333,"_334":335,"_336":337,"_338":339,"_340":341,"_342":343,"_344":345,"_346":347,"_348":349},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v20