{"format": "ta-amps.seed-pack.verbs.v1", "pack_id": "security-review", "status": "proposal_only", "tasks": [
{"queue": "conformance-seed-packs", "kind": "verb.verify_gate", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:security-review:check-scope:817b4f454b2bc8999f83f2788f88ed1f382c071a67a42c6947a9c6feafe577f1", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.verify_gate", "pack:security-review", "template:check-scope", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.verify_gate", "contract": "ta-amps.seed-verb-template.v1", "pack": "security-review", "pack_version": "0.1.0", "template_id": "security-review.check-scope", "title": "Check the review is authorized", "plain_summary": "Confirm the authorization covers this requester, target, commit and activities and has not expired, before any review work.", "outcome": "scope_confirmed, or blocked with the exact missing authorization.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "version": 1, "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"}], "slots": {"authorization": null, "repo_snapshot": null}, "params": {"output_store": "seedpack.security-review.outputs"}}, "slot_specs": {"authorization": {"category": "noun.seed_hypothesis", "required": true, "many": false, "description": "Pin of the authorization noun."}, "repo_snapshot": {"category": "noun.public_source", "required": true, "many": false, "description": "Pin of the local snapshot to review, shaped like repo-review's snapshot template."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.security-review.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["authorization", "repo_snapshot"], "properties": {"authorization": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "security-review.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "authorization_check", "template": {"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.scope-check", "version": 1, "value_sha256": "882f1c5caf1cbfc3527725cb80981048d9b9e8f43f9ef2c381dcbcd10e98337b"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["scope_confirmed", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["scope_confirmed", "no_change", "unknown", "blocked"], "outcome_meanings": {"scope_confirmed": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"scope_confirmed": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "fields-match", "check": "Target and commit in the authorization equal the snapshot's.", "method": "deterministic"}, {"id": "not-expired", "check": "expires_at is after the claim time.", "method": "deterministic"}, {"id": "activities-listed", "check": "allowed_activities names every activity later verbs will need.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Verify both pins.", "Compare requester, target and commit between the authorization and the snapshot.", "Return blocked if anything is missing, mismatched or expired. Never assume permission.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 300}, "execution": {"reasoning": "deterministic_tools", "model_use": "none", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "none", "detail": "None beyond reading the local copy. No requests to any deployed system."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["authorization", "repo_snapshot"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["authorization", "repo_snapshot"], "properties": {"authorization": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["scope_confirmed", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "ed81f61016fae6fad48fd3ff60c3ae35417c1c6127bce12500a377eb165d0749"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.scope-check", "target_category": "noun.eval_run", "note": "output authorization_check"}]}},
{"queue": "conformance-seed-packs", "kind": "verb.situate", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:security-review:threat-model:4664903e6ca0af5cc1ddc86cde8db4e65e32db6e6544caae1f2cd5937add57e6", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.situate", "pack:security-review", "template:threat-model", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.situate", "contract": "ta-amps.seed-verb-template.v1", "pack": "security-review", "pack_version": "0.1.0", "template_id": "security-review.threat-model", "title": "Sketch the threat model", "plain_summary": "List assets, entry points, trust boundaries and likely attackers, and choose the catalog areas to review first.", "outcome": "A threat model.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "version": 1, "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"}, {"store": "seedpack.security-review", "key": "security-review.v0.1.0.check-catalog", "version": 1, "value_sha256": "ef7bf66b06c36ab2843c163884dfa3b98ba92074cf6f3be1ea99827c49400807"}], "slots": {"authorization_check": null, "repo_snapshot": null}, "params": {"output_store": "seedpack.security-review.outputs"}}, "slot_specs": {"authorization_check": {"category": "noun.eval_run", "required": true, "many": false, "description": "Pin of the passing scope check."}, "repo_snapshot": {"category": "noun.public_source", "required": true, "many": false, "description": "Pin of the local snapshot."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.security-review.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 2, "maxItems": 2, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["authorization_check", "repo_snapshot"], "properties": {"authorization_check": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "security-review.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "threat_model", "template": {"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.threat-model", "version": 1, "value_sha256": "9913e78a4184f7d739abfb2fe865844bacb75bdfb51de29437d04b70b8a3989c"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["model_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["model_ready", "no_change", "unknown", "blocked"], "outcome_meanings": {"model_ready": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"model_ready": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "model-matches-template", "check": "The threat model validates against template.threat-model's schema.", "method": "deterministic"}, {"id": "areas-from-catalog", "check": "Every priority area is a catalog id.", "method": "deterministic"}, {"id": "plausible", "check": "Assets and attackers fit what the code actually does.", "method": "judgment"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Verify the pins and that the scope check passed.", "Cite the code location of every entry point.", "Pick priority areas from the catalog with a reason each.", "Review only code the requester owns or is explicitly authorized to review, from a local copy. Never scan, probe, exploit or load-test any running system, including the requester's own production.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 1200}, "execution": {"reasoning": "authorized_worker", "model_use": "worker_allowance", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "none", "detail": "None beyond reading the local copy. No requests to any deployed system."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["authorization_check", "repo_snapshot"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 2, "maxItems": 2, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["authorization_check", "repo_snapshot"], "properties": {"authorization_check": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["model_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "d9d533431f460a1025b00017e6998299ebb4a6030184399a5878020c6f1e6e95"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.check-catalog", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.threat-model", "target_category": "noun.seed_hypothesis", "note": "output threat_model"}], "follows_templates": ["security-review.check-scope"]}},
{"queue": "conformance-seed-packs", "kind": "verb.solve_draft", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:security-review:review-code:1802b5b76e1a135a44ce740994a81a0f5a3cd09ac0de65a0018f65441aa1c2e4", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.solve_draft", "pack:security-review", "template:review-code", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.solve_draft", "contract": "ta-amps.seed-verb-template.v1", "pack": "security-review", "pack_version": "0.1.0", "template_id": "security-review.review-code", "title": "Review one area of the code", "plain_summary": "Review the code for one catalog area and write findings with locations, severity, confidence and fixes.", "outcome": "Findings for the area, or no_change when the area holds up.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "version": 1, "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"}, {"store": "seedpack.security-review", "key": "security-review.v0.1.0.check-catalog", "version": 1, "value_sha256": "ef7bf66b06c36ab2843c163884dfa3b98ba92074cf6f3be1ea99827c49400807"}, {"store": "seedpack.security-review", "key": "security-review.v0.1.0.severity-rubric", "version": 1, "value_sha256": "33ccfb1307e37b6491a72007ec80cfef70da599c20cafd8491c73fd0f2774041"}], "slots": {"threat_model": null, "repo_snapshot": null}, "params": {"area": null, "output_store": "seedpack.security-review.outputs"}}, "slot_specs": {"threat_model": {"category": "noun.seed_hypothesis", "required": true, "many": false, "description": "Pin of the threat model."}, "repo_snapshot": {"category": "noun.public_source", "required": true, "many": false, "description": "Pin of the local snapshot."}}, "param_specs": {"area": {"description": "The one catalog area this attempt reviews.", "schema": {"type": "string", "enum": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}, "required": true}, "output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.security-review.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 3, "maxItems": 3, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["threat_model", "repo_snapshot"], "properties": {"threat_model": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["area", "output_store"], "properties": {"area": {"type": "string", "enum": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}, "output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "security-review.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "findings", "template": {"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.finding", "version": 1, "value_sha256": "edf1b85b8e8f24aadbe6c0ba682ae551910a99ad43f01b05b92518baca299cd7"}, "max": 12}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["findings_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 12, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["findings_ready", "no_change", "unknown", "blocked"], "outcome_meanings": {"findings_ready": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"findings_ready": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "findings-match-template", "check": "Every finding validates against template.finding's schema.", "method": "deterministic"}, {"id": "rubric-checks", "check": "Every finding passes the severity rubric's deterministic checks.", "method": "deterministic"}, {"id": "area-only", "check": "Every finding's area equals the area parameter.", "method": "deterministic"}, {"id": "severity-justified", "check": "Severity follows the rubric's definitions.", "method": "judgment"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Verify the pins. Read code only for this area.", "Run the severity rubric's deterministic checks on every finding before writing it.", "Mark a finding reasoned_not_reproduced unless a later reproduction confirms it.", "Review only code the requester owns or is explicitly authorized to review, from a local copy. Never scan, probe, exploit or load-test any running system, including the requester's own production.", "Report where a secret is, never its value. Never try a found credential.", "Findings go only to the requester. Disclosure to anyone else is the owner's separate decision.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 2400, "max_findings": 12}, "execution": {"reasoning": "authorized_worker", "model_use": "worker_allowance", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "none", "detail": "None beyond reading the local copy. No requests to any deployed system."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["threat_model", "repo_snapshot"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 3, "maxItems": 3, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["threat_model", "repo_snapshot"], "properties": {"threat_model": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["area", "output_store"], "properties": {"area": {"type": "string", "enum": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}, "output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["findings_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 12, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "b6b46a8b701e13b497e42538b53ec03efb23bf73808c5ae618ee11519aabec02"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.check-catalog", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.severity-rubric", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.finding", "target_category": "noun.seed_hypothesis", "note": "output findings"}], "follows_templates": ["security-review.threat-model"]}},
{"queue": "conformance-seed-packs", "kind": "verb.verify_gate", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:security-review:reproduce-locally:92a935efc7074e60264bdbdf82ef65d9230869533999f6669f699ec85caa05ad", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.verify_gate", "pack:security-review", "template:reproduce-locally", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.verify_gate", "contract": "ta-amps.seed-verb-template.v1", "pack": "security-review", "pack_version": "0.1.0", "template_id": "security-review.reproduce-locally", "title": "Reproduce a finding locally", "plain_summary": "Build the pinned commit in a sandbox with synthetic data and no credentials, and try to reproduce one finding.", "outcome": "A reproduction record: reproduced, not reproduced or inconclusive.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "version": 1, "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"}], "slots": {"finding": null, "authorization_check": null, "repo_snapshot": null}, "params": {"output_store": "seedpack.security-review.outputs"}}, "slot_specs": {"finding": {"category": "noun.seed_hypothesis", "required": true, "many": false, "description": "Pin of the finding."}, "authorization_check": {"category": "noun.eval_run", "required": true, "many": false, "description": "Pin of the passing scope check."}, "repo_snapshot": {"category": "noun.public_source", "required": true, "many": false, "description": "Pin of the local snapshot."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.security-review.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["finding", "authorization_check", "repo_snapshot"], "properties": {"finding": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "authorization_check": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "security-review.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "reproduction", "template": {"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.reproduction", "version": 1, "value_sha256": "2564a7dfea1b77e206ea34115ce8a53474a83adcbf66724cf416e6cca3a49030"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["reproduction_recorded", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["reproduction_recorded", "no_change", "unknown", "blocked"], "outcome_meanings": {"reproduction_recorded": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"reproduction_recorded": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "record-matches-template", "check": "The reproduction validates against template.reproduction's schema.", "method": "deterministic"}, {"id": "local-only", "check": "Every address in the steps is localhost, 127.0.0.1, ::1 or example.invalid.", "method": "deterministic"}, {"id": "no-credentials", "check": "The environment states that no real credential was present.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Confirm reproduce_in_sandbox is an allowed activity; otherwise return blocked.", "Run only inside the sandbox against services the sandbox starts, with synthetic users and data.", "Record each step and the result; store artifacts by digest.", "Review only code the requester owns or is explicitly authorized to review, from a local copy. Never scan, probe, exploit or load-test any running system, including the requester's own production.", "Report where a secret is, never its value. Never try a found credential.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "an isolated sandbox without credentials", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 2400}, "execution": {"reasoning": "authorized_worker", "model_use": "worker_allowance", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "local_only", "detail": "Only services the sandbox itself starts."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["finding", "authorization_check", "repo_snapshot"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["finding", "authorization_check", "repo_snapshot"], "properties": {"finding": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "authorization_check": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["reproduction_recorded", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "93c2cf5828dd9d7406b7affd50bb5a6e4161a4fbde31104ed33f6f90ab8d752e"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.reproduction", "target_category": "noun.eval_run", "note": "output reproduction"}], "follows_templates": ["security-review.review-code"]}},
{"queue": "conformance-seed-packs", "kind": "verb.solve_draft", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:security-review:propose-fix:6bdd845c67c82d60f57f1f41280a7a7a8a27e63df4bb706f23dbc915ab023b70", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.solve_draft", "pack:security-review", "template:propose-fix", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.solve_draft", "contract": "ta-amps.seed-verb-template.v1", "pack": "security-review", "pack_version": "0.1.0", "template_id": "security-review.propose-fix", "title": "Propose a tested fix", "plain_summary": "Write the smallest patch that fixes a confirmed finding plus a test that fails before and passes after, without pushing anything.", "outcome": "A fix noun pinned by patch digest, or no_change when the fix belongs to the owner's design decision.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "version": 1, "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"}], "slots": {"finding": null, "reproduction": null, "repo_snapshot": null}, "params": {"output_store": "seedpack.security-review.outputs"}}, "slot_specs": {"finding": {"category": "noun.seed_hypothesis", "required": true, "many": false, "description": "Pin of the finding."}, "reproduction": {"category": "noun.eval_run", "required": false, "many": false, "description": "Pin of its reproduction."}, "repo_snapshot": {"category": "noun.public_source", "required": true, "many": false, "description": "Pin of the local snapshot."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.security-review.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["finding", "repo_snapshot"], "properties": {"finding": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "reproduction": {"type": ["object", "null"], "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "security-review.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "fix", "template": {"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.fix", "version": 1, "value_sha256": "474827b32af3a1d429ef4ba18ede918bdfa2477ea2a571cbb7129acce86b3474"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["fix_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["fix_ready", "no_change", "unknown", "blocked"], "outcome_meanings": {"fix_ready": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"fix_ready": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "fix-matches-template", "check": "The fix validates against template.fix's schema.", "method": "deterministic"}, {"id": "test-fails-then-passes", "check": "The added test failed before the patch and passed after it.", "method": "deterministic"}, {"id": "suite-passes", "check": "tests_passed is true from an actual sandbox run.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Write a test that fails on the pinned commit, then the smallest patch that makes it pass.", "Run the existing test suite in the sandbox. Never weaken another control.", "Store the patch by digest. Do not push, merge or open a pull request.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 2400}, "execution": {"reasoning": "authorized_worker", "model_use": "worker_allowance", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "none", "detail": "None beyond reading the local copy. No requests to any deployed system."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["finding", "repo_snapshot"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["finding", "repo_snapshot"], "properties": {"finding": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "reproduction": {"type": ["object", "null"], "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "repo_snapshot": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["fix_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "f83f49d28863c330fa831ef8de050cb94b338af96271d11ae75d0668d01be9ee"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.fix", "target_category": "noun.code_node", "note": "output fix"}], "follows_templates": ["security-review.reproduce-locally"]}},
{"queue": "conformance-seed-packs", "kind": "verb.verify_gate", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:security-review:review-findings:426cd0dde086f7ccbb43325527945202dfd0e5f853ec058bcbe3bea1048703d3", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.verify_gate", "pack:security-review", "template:review-findings", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.verify_gate", "contract": "ta-amps.seed-verb-template.v1", "pack": "security-review", "pack_version": "0.1.0", "template_id": "security-review.review-findings", "title": "Independently review the findings", "plain_summary": "A different worker reruns the rubric checks and decides whether each finding is upheld, downgraded or rejected.", "outcome": "A review with a verdict.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.security-review", "key": "security-review.v0.1.0.severity-rubric", "version": 1, "value_sha256": "33ccfb1307e37b6491a72007ec80cfef70da599c20cafd8491c73fd0f2774041"}, {"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "version": 1, "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"}], "slots": {"findings": [], "reproductions": []}, "params": {"output_store": "seedpack.security-review.outputs"}}, "slot_specs": {"findings": {"category": "noun.seed_hypothesis", "required": true, "many": true, "description": "Pins of the findings."}, "reproductions": {"category": "noun.eval_run", "required": false, "many": true, "description": "Pins of reproductions."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.security-review.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 2, "maxItems": 2, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["findings"], "properties": {"findings": {"type": "array", "minItems": 1, "maxItems": 60, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "reproductions": {"type": "array", "minItems": 0, "maxItems": 60, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "security-review.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "review", "template": {"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.review", "version": 1, "value_sha256": "f93046fc13a3b0a7880bea4727fb9d1a800a88606cf4f3fb110c12a1706aa297"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["review_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["review_ready", "no_change", "unknown", "blocked"], "outcome_meanings": {"review_ready": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"review_ready": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "review-matches-template", "check": "The review validates against template.review's schema.", "method": "deterministic"}, {"id": "distinct-reviewer", "check": "The reviewing key differs from the keys that wrote the findings.", "method": "deterministic"}, {"id": "scope-enforced", "check": "Any finding whose reproduction touched a non-local address is rejected.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Confirm you wrote none of the findings; otherwise return blocked.", "Rerun every deterministic check.", "Downgrade confidence for findings without reproduction; reject findings that break the scope rules.", "Findings go only to the requester. Disclosure to anyone else is the owner's separate decision.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 1800}, "execution": {"reasoning": "authorized_worker", "model_use": "worker_allowance", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "none", "detail": "None beyond reading the local copy. No requests to any deployed system."}, "external_effects": "none"}, "review": {"required": "distinct_reviewer", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["findings"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 2, "maxItems": 2, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["findings"], "properties": {"findings": {"type": "array", "minItems": 1, "maxItems": 60, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "reproductions": {"type": "array", "minItems": 0, "maxItems": 60, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["review_ready", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "689dfd66c6508de355dca807089df7a663555636cf1f60df9c0a1e5a1b868c34"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.severity-rubric", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.review", "target_category": "noun.eval_run", "note": "output review"}], "follows_templates": ["security-review.propose-fix"]}}
]}