refactor(layers): contracts stop importing the evidence ledger

Three moves close the edges from the contract layer into runtime/evidence:

- The audit records the host emits beside a run (ReadinessAudit,
  OutcomeSample, DelegationAudit) move to contract/hostaudit, so event and
  trajectory carry them without the ledger that computes them.
  ClassifyEvidenceOrigin, which reads delegation text, stays in evidence as
  a function over the record.
- taskcontract and plancontract move from contract to runtime: only the
  agent and completion consume them, and both are built from evidence
  receipts rather than declaring data anything lower reads.
- evidence moves from runtime to safety. It imports nothing above the
  subsystem layer, and builtin tools and the trajectory recorder, both
  subsystems, depend on it.

layer-order drops from 18 to 5.

benchmarks/runtime-resume/observe.go

@@ -14,7 +14,7 @@ import (
 	"reasonix/internal/contract/agentgraph"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/runtime/agent"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/session/control"
 	"reasonix/internal/state/execjournal"
 	"reasonix/internal/state/store"

cmd/e2ebench/barrier.go

@@ -8,7 +8,7 @@ import (
 	"slices"
 	"strings"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // The terminal-barrier counterfactual: what a barrier at a child's first

cmd/e2ebench/trajectory.go

@@ -8,7 +8,7 @@ import (
 	"slices"
 	"strings"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // trajectorySummary is the harness-side digest of one run's trajectory file:

internal/assembly/boot/authority_boundary_test.go

@@ -8,7 +8,7 @@ import (
 
 	"reasonix/internal/base/testenv"
 	"reasonix/internal/ext/skill"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // Delivering a report and being believed by it are separate permissions. This

internal/assembly/boot/delegation_audit_effect_test.go

@@ -5,21 +5,21 @@ package boot
 // counters read "no delegation" for a run whose graph showed four members.
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"sync"
 	"testing"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
 )
 
 type delegationAuditSink struct {
 	mu     sync.Mutex
-	audits []evidence.DelegationAudit
+	audits []hostaudit.DelegationAudit
 }
 
 func (s *delegationAuditSink) Emit(event.Event) {}
 
-func (s *delegationAuditSink) RecordDelegationAudit(a evidence.DelegationAudit) {
+func (s *delegationAuditSink) RecordDelegationAudit(a hostaudit.DelegationAudit) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.audits = append(s.audits, a)

internal/assembly/boot/effect_browser_test.go

@@ -14,7 +14,7 @@ import (
 
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/safety/permission"
 )
 

internal/assembly/boot/effect_computer_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/safety/permission"
 )
 

internal/assembly/boot/review_obligation_test.go

@@ -16,7 +16,7 @@ import (
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/ext/skill"
 	"reasonix/internal/runtime/agent"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // What a worker owes when it finishes is declared by whoever defined it,

internal/assembly/boot/review_provenance_test.go

@@ -9,7 +9,7 @@ import (
 
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/ext/skill"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // Evidence that moves a durable decision has to be attributable to the run that

internal/contract/event/audit_forwarder.go

@@ -2,7 +2,7 @@ package event
 
 import (
 	"reasonix/internal/base/nilutil"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/contract/hostaudit"
 )
 
 // AuditForwarder forwards every optional sink capability to Inner. Embed it in
@@ -11,7 +11,7 @@ import (
 // capabilities at multiple wrappers even while their owning tests stayed green.
 type AuditForwarder struct{ Inner Sink }
 
-func (f AuditForwarder) RecordReadinessAudit(a evidence.ReadinessAudit) {
+func (f AuditForwarder) RecordReadinessAudit(a hostaudit.ReadinessAudit) {
 	RecordReadinessAudit(f.Inner, a)
 }
 
@@ -29,7 +29,7 @@ func (f AuditForwarder) RecordMemoryRecall(a MemoryRecallAudit) {
 	RecordMemoryRecall(f.Inner, a)
 }
 
-func (f AuditForwarder) RecordOutcomeProgress(s evidence.OutcomeSample) {
+func (f AuditForwarder) RecordOutcomeProgress(s hostaudit.OutcomeSample) {
 	RecordOutcomeProgress(f.Inner, s)
 }
 
@@ -37,7 +37,7 @@ func (f AuditForwarder) RecordProtocolRecovery(a ProtocolRecoveryAudit) {
 	RecordProtocolRecovery(f.Inner, a)
 }
 
-func (f AuditForwarder) RecordDelegationAudit(a evidence.DelegationAudit) {
+func (f AuditForwarder) RecordDelegationAudit(a hostaudit.DelegationAudit) {
 	RecordDelegationAudit(f.Inner, a)
 }
 
@@ -63,11 +63,11 @@ func (f AuditForwarder) RecordVerificationContractDrift(d VerificationContractDr
 
 // DelegationAuditSink receives one receipt per completed sub-agent run.
 type DelegationAuditSink interface {
-	RecordDelegationAudit(a evidence.DelegationAudit)
+	RecordDelegationAudit(a hostaudit.DelegationAudit)
 }
 
 // RecordDelegationAudit forwards a delegation receipt to sinks that opt in.
-func RecordDelegationAudit(s Sink, a evidence.DelegationAudit) {
+func RecordDelegationAudit(s Sink, a hostaudit.DelegationAudit) {
 	if nilutil.IsNil(s) {
 		return
 	}

internal/contract/event/coalesce.go

@@ -1,13 +1,13 @@
 package event
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"reflect"
 	"strings"
 	"sync"
 	"time"
 
 	"reasonix/internal/base/nilutil"
-	"reasonix/internal/runtime/evidence"
 )
 
 // coalesceMaxBytes bounds a merged delta so one event never carries an
@@ -139,14 +139,14 @@ func (c *coalescer) drainAndUnlock() {
 // Optional sink capabilities flush first so audits never overtake a buffered
 // delta, then forward to inner sinks that opt in.
 
-func (c *coalescer) RecordDelegationAudit(a evidence.DelegationAudit) {
+func (c *coalescer) RecordDelegationAudit(a hostaudit.DelegationAudit) {
 	c.mu.Lock()
 	c.enqueueFlushLocked()
 	c.drainAndUnlock()
 	RecordDelegationAudit(c.inner, a)
 }
 
-func (c *coalescer) RecordReadinessAudit(a evidence.ReadinessAudit) {
+func (c *coalescer) RecordReadinessAudit(a hostaudit.ReadinessAudit) {
 	c.mu.Lock()
 	c.enqueueFlushLocked()
 	c.drainAndUnlock()
@@ -202,7 +202,7 @@ func (c *coalescer) RecordCompletionReport(a CompletionReportAudit) {
 	RecordCompletionReport(c.inner, a)
 }
 
-func (c *coalescer) RecordOutcomeProgress(sample evidence.OutcomeSample) {
+func (c *coalescer) RecordOutcomeProgress(sample hostaudit.OutcomeSample) {
 	c.mu.Lock()
 	c.enqueueFlushLocked()
 	c.drainAndUnlock()

internal/contract/event/coalesce_test.go

@@ -1,12 +1,11 @@
 package event
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"strings"
 	"sync"
 	"testing"
 	"time"
-
-	"reasonix/internal/runtime/evidence"
 )
 
 type coalesceRecordSink struct {
@@ -24,7 +23,7 @@ func (s *coalesceRecordSink) Emit(e Event) {
 	s.events = append(s.events, e)
 }
 
-func (s *coalesceRecordSink) RecordReadinessAudit(evidence.ReadinessAudit) {
+func (s *coalesceRecordSink) RecordReadinessAudit(hostaudit.ReadinessAudit) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.readiness++
@@ -142,7 +141,7 @@ func TestCoalesceCapabilitiesFlushFirstAndForward(t *testing.T) {
 	c := Coalesce(inner, time.Hour)
 	c.Emit(Event{Kind: Text, Text: "lead"})
 	c.Emit(Event{Kind: Text, Text: "tail"})
-	c.(ReadinessAuditSink).RecordReadinessAudit(evidence.ReadinessAudit{})
+	c.(ReadinessAuditSink).RecordReadinessAudit(hostaudit.ReadinessAudit{})
 	c.(TurnCompletionSink).RecordTurnCompletion()
 	c.(ProtocolRecoveryAuditSink).RecordProtocolRecovery(ProtocolRecoveryAudit{})
 	c.(WorkspaceMutationSink).RecordWorkspaceMutation(WorkspaceMutation{Content: true})

internal/contract/event/event.go

@@ -13,11 +13,11 @@ package event
 
 import (
 	"encoding/json"
+	"reasonix/internal/contract/hostaudit"
 	"reasonix/internal/contract/pricing"
 
 	"reasonix/internal/contract/agentgraph"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
 )
 
 // Kind tags an Event. Read the field(s) documented for that kind.
@@ -593,7 +593,7 @@ type WorkspaceChangedPayload struct {
 // ReadinessAuditSink is an optional sink capability. Sinks that do not care
 // about readiness audit receipts can implement only Sink and will ignore them.
 type ReadinessAuditSink interface {
-	RecordReadinessAudit(evidence.ReadinessAudit)
+	RecordReadinessAudit(hostaudit.ReadinessAudit)
 }
 
 // TurnCompletionSink is an optional sink capability for synchronous controller

internal/contract/event/event_test.go

@@ -1,11 +1,11 @@
 package event
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"sync"
 	"testing"
 
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
 )
 
 // Kind constants
@@ -79,7 +79,7 @@ func TestSyncTreatsTypedNilSinkAsDiscard(t *testing.T) {
 }
 
 type readinessAuditRecorder struct {
-	events    []evidence.ReadinessAudit
+	events    []hostaudit.ReadinessAudit
 	recovery  []ProtocolRecoveryAudit
 	workspace []WorkspaceMutation
 	turns     int
@@ -87,7 +87,7 @@ type readinessAuditRecorder struct {
 
 func (r *readinessAuditRecorder) Emit(Event) {}
 
-func (r *readinessAuditRecorder) RecordReadinessAudit(a evidence.ReadinessAudit) {
+func (r *readinessAuditRecorder) RecordReadinessAudit(a hostaudit.ReadinessAudit) {
 	r.events = append(r.events, a)
 }
 
@@ -122,15 +122,15 @@ func TestSyncForwardsReadinessAuditReceipts(t *testing.T) {
 	rec := &readinessAuditRecorder{}
 	sink := Sync(rec)
 
-	RecordReadinessAudit(sink, evidence.ReadinessAudit{
-		Result:               evidence.ReadinessBlocked,
+	RecordReadinessAudit(sink, hostaudit.ReadinessAudit{
+		Result:               hostaudit.ReadinessBlocked,
 		MissingProjectChecks: 1,
 	})
 
 	if len(rec.events) != 1 {
 		t.Fatalf("readiness audit events = %d, want 1", len(rec.events))
 	}
-	if rec.events[0].Result != evidence.ReadinessBlocked || rec.events[0].MissingProjectChecks != 1 {
+	if rec.events[0].Result != hostaudit.ReadinessBlocked || rec.events[0].MissingProjectChecks != 1 {
 		t.Fatalf("readiness audit not forwarded through Sync: %+v", rec.events[0])
 	}
 }

internal/contract/event/record.go

@@ -2,7 +2,7 @@ package event
 
 import (
 	"reasonix/internal/base/nilutil"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/contract/hostaudit"
 )
 
 // Forwarding a turn's audit signals to sinks that opt into them. Each is a
@@ -21,7 +21,7 @@ func RecordTurnCompletion(s Sink) {
 }
 
 // RecordReadinessAudit forwards a readiness audit receipt to sinks that opt in.
-func RecordReadinessAudit(s Sink, a evidence.ReadinessAudit) {
+func RecordReadinessAudit(s Sink, a hostaudit.ReadinessAudit) {
 	if nilutil.IsNil(s) {
 		return
 	}
@@ -171,12 +171,12 @@ func RecordMemoryRecall(s Sink, a MemoryRecallAudit) {
 // scorer's per-round samples: counts only, never paths or commands. Shadow
 // means observed, not enforced — the novelty guard still decides behavior.
 type OutcomeProgressSink interface {
-	RecordOutcomeProgress(evidence.OutcomeSample)
+	RecordOutcomeProgress(hostaudit.OutcomeSample)
 }
 
 // RecordOutcomeProgress forwards a shadow outcome sample only to sinks that
 // explicitly opt in. Ordinary UI sinks receive nothing.
-func RecordOutcomeProgress(s Sink, sample evidence.OutcomeSample) {
+func RecordOutcomeProgress(s Sink, sample hostaudit.OutcomeSample) {
 	if nilutil.IsNil(s) {
 		return
 	}

internal/contract/event/sink_capabilities_test.go

@@ -1,11 +1,10 @@
 package event
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"reflect"
 	"testing"
 	"time"
-
-	"reasonix/internal/runtime/evidence"
 )
 
 // capturingSink implements every optional capability so a chain test can prove
@@ -17,10 +16,10 @@ type capturingSink struct {
 
 func (s *capturingSink) Emit(e Event) { s.events = append(s.events, e) }
 
-func (s *capturingSink) RecordDelegationAudit(evidence.DelegationAudit) {
+func (s *capturingSink) RecordDelegationAudit(hostaudit.DelegationAudit) {
 	s.recorded = append(s.recorded, "DelegationAudit")
 }
-func (s *capturingSink) RecordReadinessAudit(evidence.ReadinessAudit) {
+func (s *capturingSink) RecordReadinessAudit(hostaudit.ReadinessAudit) {
 	s.recorded = append(s.recorded, "ReadinessAudit")
 }
 func (s *capturingSink) RecordTurnCompletion() {
@@ -38,7 +37,7 @@ func (s *capturingSink) RecordCompletionReport(CompletionReportAudit) {
 func (s *capturingSink) RecordMemoryRecall(MemoryRecallAudit) {
 	s.recorded = append(s.recorded, "MemoryRecall")
 }
-func (s *capturingSink) RecordOutcomeProgress(evidence.OutcomeSample) {
+func (s *capturingSink) RecordOutcomeProgress(hostaudit.OutcomeSample) {
 	s.recorded = append(s.recorded, "OutcomeProgress")
 }
 func (s *capturingSink) RecordWorkspaceMutation(WorkspaceMutation) {
@@ -59,14 +58,14 @@ func (s *capturingSink) RecordVerificationContractDrift(VerificationContractDrif
 
 // recordAll drives every optional capability once through s.
 func recordAll(s Sink) {
-	RecordDelegationAudit(s, evidence.DelegationAudit{})
-	RecordReadinessAudit(s, evidence.ReadinessAudit{})
+	RecordDelegationAudit(s, hostaudit.DelegationAudit{})
+	RecordReadinessAudit(s, hostaudit.ReadinessAudit{})
 	RecordTurnCompletion(s)
 	RecordProtocolRecovery(s, ProtocolRecoveryAudit{})
 	RecordContractShadow(s, ContractShadowAudit{})
 	RecordCompletionReport(s, CompletionReportAudit{})
 	RecordMemoryRecall(s, MemoryRecallAudit{})
-	RecordOutcomeProgress(s, evidence.OutcomeSample{})
+	RecordOutcomeProgress(s, hostaudit.OutcomeSample{})
 	RecordWorkspaceMutation(s, WorkspaceMutation{})
 	RecordRunBudget(s, RunBudgetSample{})
 	RecordProjectCheckProbe(s, ProjectCheckProbe{})

internal/contract/event/sync.go

@@ -1,10 +1,10 @@
 package event
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"sync"
 
 	"reasonix/internal/base/nilutil"
-	"reasonix/internal/runtime/evidence"
 )
 
 // Sync wraps a Sink so concurrent Emit calls are serialized. The base Sink
@@ -32,13 +32,13 @@ func (s *syncSink) Emit(e Event) {
 	s.inner.Emit(e)
 }
 
-func (s *syncSink) RecordDelegationAudit(a evidence.DelegationAudit) {
+func (s *syncSink) RecordDelegationAudit(a hostaudit.DelegationAudit) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	RecordDelegationAudit(s.inner, a)
 }
 
-func (s *syncSink) RecordReadinessAudit(a evidence.ReadinessAudit) {
+func (s *syncSink) RecordReadinessAudit(a hostaudit.ReadinessAudit) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if rs, ok := s.inner.(ReadinessAuditSink); ok {
@@ -102,7 +102,7 @@ func (s *syncSink) RecordCompletionReport(a CompletionReportAudit) {
 	}
 }
 
-func (s *syncSink) RecordOutcomeProgress(sample evidence.OutcomeSample) {
+func (s *syncSink) RecordOutcomeProgress(sample hostaudit.OutcomeSample) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if op, ok := s.inner.(OutcomeProgressSink); ok {

internal/contract/hostaudit/delegation_audit.go

@@ -1,4 +1,4 @@
-package evidence
+package hostaudit
 
 // DelegationAudit is one completed sub-agent run, recorded as structured data
 // so a benchmark can compare orchestration arms without scraping prose. It
@@ -28,24 +28,6 @@ type DelegationAudit struct {
 	DiscoveredPaths int
 }
 
-// ClassifyEvidenceOrigin scores one run against the text its parent wrote.
-// Discovery is judged against named files only: a child sent to a directory
-// still had to work out which file in it mattered. Counts only — a rate is a
-// ratio of sums across runs, and averaging per-run rates would weight a child
-// that read two files like one that read forty.
-func (a *DelegationAudit) ClassifyEvidenceOrigin(delegationText string, evidencePaths []string) {
-	scope, files := SplitNamedPaths(NamedPaths(delegationText))
-	a.ParentScopeHints = len(scope)
-	a.ParentNamedFiles = len(files)
-	a.EvidencePaths = len(evidencePaths)
-	a.DiscoveredPaths = 0
-	for _, p := range evidencePaths {
-		if !UnderNamedPath(files, p) {
-			a.DiscoveredPaths++
-		}
-	}
-}
-
 // FalseCompletion reports a child that claimed more than the host could back.
 // It is the count of refused criteria, not a comparison against a claimed
 // status the host never independently recorded.

internal/contract/hostaudit/doc.go

@@ -0,0 +1,5 @@
+// Package hostaudit holds the structured audit records the host emits beside a
+// run — readiness verdicts, per-round outcome samples, delegation audits — so
+// events, trajectories and metrics sinks can carry them without depending on
+// the evidence ledger that computes them.
+package hostaudit

internal/contract/hostaudit/outcome_sample.go

@@ -0,0 +1,34 @@
+package hostaudit
+
+// OutcomeSample decomposes one tool round's receipts by outcome: information
+// gathered (Exploration), verification attempts run, and verification-command
+// state transitions (Objective fail→pass, Regression pass→fail). Counts are
+// unit-weighted; policy weighting is an offline concern.
+type OutcomeSample struct {
+	Round        int
+	Exploration  int
+	Verification int
+	Objective    int
+	Regression   int
+	Churn        int
+	// LegacyGain is the live novelty scorer's verdict on the same receipts, so
+	// offline analysis can compare the two policies without replaying.
+	LegacyGain int
+	// Discriminating counts observations able to falsify the working
+	// hypothesis: verification commands, or commands exercising a mutated
+	// file — deliberately broader than delivery verification (repro scripts).
+	Discriminating int
+	// DebtAge counts consecutive rounds carrying an unverified mutation with
+	// no discriminating observation; 0 while no verification debt is open.
+	DebtAge int
+	// BlindMutations counts mutations since the last discriminating observation.
+	BlindMutations int
+	// Stall counts this round's checks that ran, failed, and had already
+	// failed: the third transition beside Objective and Regression, and the one
+	// the live scorer prices as motion instead of as standing still.
+	Stall int
+	// StallAge counts consecutive rounds one check has stayed failed, and
+	// StallMutations the change that landed against it without moving it.
+	StallAge       int
+	StallMutations int
+}

internal/contract/hostaudit/readiness_audit.go

@@ -1,4 +1,4 @@
-package evidence
+package hostaudit
 
 // ReadinessAuditResult classifies one host final-answer readiness audit receipt.
 type ReadinessAuditResult string

internal/frontend/cli/delegation_metrics_test.go

@@ -1,22 +1,23 @@
 package cli
 
 import (
+	"reasonix/internal/contract/hostaudit"
 	"testing"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // The instrument must be able to say, from one run, whether delegation
 // produced verified work or just more tokens.
 func TestDelegationMetricsAggregateAcrossChildren(t *testing.T) {
 	s := &metricsSink{}
-	s.RecordDelegationAudit(evidence.DelegationAudit{
+	s.RecordDelegationAudit(hostaudit.DelegationAudit{
 		Depth: 1, ToolCalls: 6, Mutations: 2,
 		MutationPaths:     []string{"api/handler.go", "api/handler_test.go"},
 		HasReport:         true,
 		AdjudicatedStatus: string(evidence.CompletionComplete),
 	})
-	s.RecordDelegationAudit(evidence.DelegationAudit{
+	s.RecordDelegationAudit(hostaudit.DelegationAudit{
 		Depth: 2, ToolCalls: 4, Mutations: 1,
 		MutationPaths:     []string{"api/handler.go"},
 		ClaimViolations:   1,
@@ -24,7 +25,7 @@ func TestDelegationMetricsAggregateAcrossChildren(t *testing.T) {
 		AdjudicatedStatus: string(evidence.CompletionPartial),
 		Downgrades:        2,
 	})
-	s.RecordDelegationAudit(evidence.DelegationAudit{Depth: 1, ToolCalls: 3})
+	s.RecordDelegationAudit(hostaudit.DelegationAudit{Depth: 1, ToolCalls: 3})
 
 	m := s.m
 	if m.SubagentRuns != 3 || m.SubagentNestedRuns != 1 {
@@ -55,10 +56,10 @@ func TestDelegationMetricsAggregateAcrossChildren(t *testing.T) {
 // swept twenty. Summing here is what makes the published rate that ratio.
 func TestDelegationMetricsSumEvidenceOriginForARatioOfTotals(t *testing.T) {
 	s := &metricsSink{}
-	s.RecordDelegationAudit(evidence.DelegationAudit{
+	s.RecordDelegationAudit(hostaudit.DelegationAudit{
 		Depth: 1, ParentNamedFiles: 1, EvidencePaths: 20, DiscoveredPaths: 19,
 	})
-	s.RecordDelegationAudit(evidence.DelegationAudit{
+	s.RecordDelegationAudit(hostaudit.DelegationAudit{
 		Depth: 1, ParentNamedFiles: 2, EvidencePaths: 1, DiscoveredPaths: 0,
 	})
 

internal/frontend/cli/run_metrics.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"maps"
 	"os"
+	"reasonix/internal/contract/hostaudit"
 	"reasonix/internal/contract/pricing"
 	"slices"
 	"strings"
@@ -13,7 +14,6 @@ import (
 	"reasonix/internal/base/fileutil"
 	"reasonix/internal/contract/agentgraph"
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
 )
 
 // SourceUsage is one Usage origin's share of a run. Steps counts every billed
@@ -465,7 +465,7 @@ func (s *metricsSink) recordToolResult(t event.Tool) {
 }
 
 // RecordDelegationAudit folds one finished child run into the arm totals.
-func (s *metricsSink) RecordDelegationAudit(a evidence.DelegationAudit) {
+func (s *metricsSink) RecordDelegationAudit(a hostaudit.DelegationAudit) {
 	if s == nil {
 		return
 	}
@@ -504,7 +504,7 @@ func (s *metricsSink) RecordDelegationAudit(a evidence.DelegationAudit) {
 	}
 }
 
-func (s *metricsSink) RecordReadinessAudit(a evidence.ReadinessAudit) {
+func (s *metricsSink) RecordReadinessAudit(a hostaudit.ReadinessAudit) {
 	if s == nil {
 		return
 	}
@@ -513,11 +513,11 @@ func (s *metricsSink) RecordReadinessAudit(a evidence.ReadinessAudit) {
 	defer s.mu.Unlock()
 	s.m.ReadinessChecks++
 	switch a.Result {
-	case evidence.ReadinessAllowed:
+	case hostaudit.ReadinessAllowed:
 		s.m.ReadinessAllowed++
-	case evidence.ReadinessBlocked:
+	case hostaudit.ReadinessBlocked:
 		s.m.ReadinessBlocks++
-	case evidence.ReadinessErrored:
+	case hostaudit.ReadinessErrored:
 		s.m.ReadinessErrors++
 	}
 	if a.Recovered {

internal/frontend/cli/run_metrics_test.go

@@ -4,12 +4,12 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"reasonix/internal/contract/hostaudit"
 	"testing"
 
 	"reasonix/internal/base/testenv"
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
 )
 
 func TestMetricsSinkForwardsEachEventOnce(t *testing.T) {
@@ -40,8 +40,8 @@ func TestMetricsSinkUsesProviderCacheWriteCost(t *testing.T) {
 func TestMetricsSinkAccumulatesReadinessAudit(t *testing.T) {
 	s := &metricsSink{inner: event.Discard}
 
-	s.RecordReadinessAudit(evidence.ReadinessAudit{
-		Result:                    evidence.ReadinessBlocked,
+	s.RecordReadinessAudit(hostaudit.ReadinessAudit{
+		Result:                    hostaudit.ReadinessBlocked,
 		MissingProjectChecks:      2,
 		IncompleteTodos:           3,
 		MissingAcceptanceCriteria: 1,
@@ -51,12 +51,12 @@ func TestMetricsSinkAccumulatesReadinessAudit(t *testing.T) {
 		MissingSignoff:            1,
 		MissingMutation:           1,
 	})
-	s.RecordReadinessAudit(evidence.ReadinessAudit{
-		Result:    evidence.ReadinessAllowed,
+	s.RecordReadinessAudit(hostaudit.ReadinessAudit{
+		Result:    hostaudit.ReadinessAllowed,
 		Recovered: true,
 	})
-	s.RecordReadinessAudit(evidence.ReadinessAudit{
-		Result: evidence.ReadinessErrored,
+	s.RecordReadinessAudit(hostaudit.ReadinessAudit{
+		Result: hostaudit.ReadinessErrored,
 	})
 
 	if s.m.ReadinessChecks != 3 {

internal/frontend/doctor/quality.go

@@ -9,7 +9,7 @@ import (
 	"reasonix/internal/contract/config"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/runtime/agent"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/usagereport"
 )
 

internal/platform/telemetry/sink_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"reasonix/internal/contract/hostaudit"
 	"slices"
 	"strings"
 	"testing"
@@ -12,7 +13,6 @@ import (
 	"reasonix/internal/base/testenv"
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
 )
 
 type readinessSink struct {
@@ -22,7 +22,7 @@ type readinessSink struct {
 }
 
 func (s *readinessSink) Emit(event.Event) { s.events++ }
-func (s *readinessSink) RecordReadinessAudit(evidence.ReadinessAudit) {
+func (s *readinessSink) RecordReadinessAudit(hostaudit.ReadinessAudit) {
 	s.audits++
 }
 func (s *readinessSink) RecordProtocolRecovery(event.ProtocolRecoveryAudit) {
@@ -55,7 +55,7 @@ func TestSinkWritesOnlyWhitelistedContentFreeCounters(t *testing.T) {
 	sink.Emit(event.Event{Kind: event.TurnDone, Err: &provider.APIError{
 		Provider: secret, Status: 429, Body: secret, TraceID: secret,
 	}})
-	event.RecordReadinessAudit(sink, evidence.ReadinessAudit{})
+	event.RecordReadinessAudit(sink, hostaudit.ReadinessAudit{})
 
 	entries, err := os.ReadDir(filepath.Join(home, pendingDirName))
 	if err != nil || len(entries) != 1 {

internal/runtime/agent/ablation_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"reasonix/internal/contract/ablation"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestEvidenceAblationStandsDownTheReadinessGate(t *testing.T) {

internal/runtime/agent/agent.go

@@ -18,15 +18,15 @@ import (
 	"reasonix/internal/contract/ablation"
 	"reasonix/internal/contract/agentpreset"
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/plancontract"
 	"reasonix/internal/contract/planmode"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/ext/extension/dispatch"
 	"reasonix/internal/runtime/capability"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/jobs"
+	"reasonix/internal/runtime/plancontract"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/safety/sandbox"
 	"reasonix/internal/state/checkpoint"
 	"reasonix/internal/state/instruction"

internal/runtime/agent/agent_options.go

@@ -7,8 +7,8 @@ import (
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/ext/extension/dispatch"
 	"reasonix/internal/runtime/capability"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/jobs"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/safety/sandbox"
 	"reasonix/internal/state/checkpoint"
 	"reasonix/internal/state/instruction"

internal/runtime/agent/await_user.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"strings"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // AwaitUserTool declares that an open task list cannot advance without the

internal/runtime/agent/await_user_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func awaitCtx(todos []evidence.TodoItem, interactive bool) context.Context {

internal/runtime/agent/baseline_criteria.go

@@ -14,7 +14,7 @@ import (
 
 	"reasonix/internal/base/diff"
 	"reasonix/internal/base/fileutil"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // captureRewrittenCriteria files what a criterion said before this edit. It runs

internal/runtime/agent/baseline_criteria_test.go

@@ -10,7 +10,7 @@ import (
 
 	"reasonix/internal/base/diff"
 	"reasonix/internal/base/testenv"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 const (

internal/runtime/agent/baseline_evaluate.go

@@ -12,7 +12,7 @@ import (
 	"path/filepath"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // baselineBackend names the capability that produced a result, so a claim never

internal/runtime/agent/baseline_evaluate_test.go

@@ -8,7 +8,7 @@ import (
 	"time"
 
 	"reasonix/internal/base/testenv"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // A real module, a real toolchain run: the criterion the task began under is

internal/runtime/agent/canonical_todo_test.go

@@ -6,7 +6,7 @@ import (
 
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestFinalReadinessFallsBackToCanonicalTodos(t *testing.T) {

internal/runtime/agent/capability_gate.go

@@ -10,7 +10,7 @@ import (
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/ext/skill"
 	"reasonix/internal/runtime/capability"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // capabilityGateState is one user turn's gate memory, scoped to the same turn

internal/runtime/agent/capability_gate_test.go

@@ -7,8 +7,8 @@ import (
 
 	"reasonix/internal/contract/agentpreset"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 )
 
 // Every production turn freezes a TaskPolicy before the first request, so the

internal/runtime/agent/command_class.go

@@ -9,7 +9,7 @@ import (
 
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // The static tables will never know every tool, and each one that falls through

internal/runtime/agent/compact_coverage.go

@@ -10,7 +10,7 @@ import (
 
 	"reasonix/internal/base/shellparse"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // Acceptance used to ask a digest one question: is it smaller? A digest that

internal/runtime/agent/compact_coverage_test.go

@@ -11,7 +11,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // coverageTools answers from the shipped registry rather than a copy of it, so

internal/runtime/agent/compact_index.go

@@ -10,7 +10,7 @@ import (
 
 	"reasonix/internal/contract/ablation"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // A digest carries what the fold changed and what failed; everything else

internal/runtime/agent/complete_step_e2e_test.go

@@ -12,7 +12,7 @@ import (
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/runtime/agent/testutil"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 
 	_ "reasonix/internal/tools/builtin"
 )

internal/runtime/agent/complete_subtask.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // CompleteSubtaskTool is visible only inside sub-agent registries. It ends a

internal/runtime/agent/complete_subtask_test.go

@@ -10,7 +10,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func submitCompleteSubtask(t *testing.T, led *evidence.Ledger, args string) string {

internal/runtime/agent/completion_receipt_test.go

@@ -5,7 +5,7 @@ import (
 
 	"reasonix/internal/contract/event"
 	"reasonix/internal/runtime/completion"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestReceiptCarriesWhatProseDoesNot(t *testing.T) {

internal/runtime/agent/completion_shadow.go

@@ -2,8 +2,8 @@ package agent
 
 import (
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/taskcontract"
 	"reasonix/internal/runtime/completion"
+	"reasonix/internal/runtime/taskcontract"
 )
 
 // completionReportAudit reduces a completion report to its content-free

internal/runtime/agent/completion_shadow_test.go

@@ -6,7 +6,7 @@ import (
 
 	"reasonix/internal/contract/event"
 	"reasonix/internal/runtime/completion"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func shadowReport(input string, receipts ...evidence.Receipt) (event.ContractShadowAudit, event.CompletionReportAudit) {

internal/runtime/agent/conclude_blocked.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"strings"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // ConcludeBlockedTool is the execution turn's honest exit. The host otherwise

internal/runtime/agent/conclude_blocked_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"reasonix/internal/contract/taskcontract"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/taskcontract"
+	"reasonix/internal/safety/evidence"
 )
 
 func blockedCtx(ledger *evidence.Ledger) context.Context {

internal/runtime/agent/contract_shadow.go

@@ -6,10 +6,10 @@ import (
 	"strings"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/plancontract"
-	"reasonix/internal/contract/taskcontract"
 	"reasonix/internal/runtime/completion"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/plancontract"
+	"reasonix/internal/runtime/taskcontract"
+	"reasonix/internal/safety/evidence"
 )
 
 // buildShadowContract replays a finished turn's receipts into a task

internal/runtime/agent/contract_shadow_test.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"testing"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestBuildShadowContractReplaysTheTurn(t *testing.T) {

internal/runtime/agent/coordinator.go

@@ -10,10 +10,10 @@ import (
 
 	"reasonix/internal/base/nilutil"
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/plancontract"
 	"reasonix/internal/contract/planmode"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
+	"reasonix/internal/runtime/plancontract"
 	"reasonix/internal/safety/sandbox"
 )
 

internal/runtime/agent/criterion_proof_test.go

@@ -5,9 +5,9 @@ import (
 	"reasonix/internal/state/sessionstore"
 	"testing"
 
-	"reasonix/internal/contract/plancontract"
-	"reasonix/internal/contract/taskcontract"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/plancontract"
+	"reasonix/internal/runtime/taskcontract"
+	"reasonix/internal/safety/evidence"
 )
 
 func completeStepReceipt(t *testing.T, criterionID, kind, command string) evidence.Receipt {

internal/runtime/agent/delegation_origin_test.go

@@ -3,25 +3,25 @@ package agent
 import (
 	"context"
 	"encoding/json"
+	"reasonix/internal/contract/hostaudit"
 	"testing"
 
 	"reasonix/internal/base/testenv"
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 )
 
 type originProbe struct {
 	event.Sink
-	got []evidence.DelegationAudit
+	got []hostaudit.DelegationAudit
 }
 
-func (p *originProbe) RecordDelegationAudit(a evidence.DelegationAudit) { p.got = append(p.got, a) }
+func (p *originProbe) RecordDelegationAudit(a hostaudit.DelegationAudit) { p.got = append(p.got, a) }
 
 // runDelegationForOrigin spawns one real child through TaskTool that reads
 // src/parser.go and src/scanner.go, and returns the audit the sink received.
-func runDelegationForOrigin(t *testing.T, prompt string) evidence.DelegationAudit {
+func runDelegationForOrigin(t *testing.T, prompt string) hostaudit.DelegationAudit {
 	t.Helper()
 	probe := &originProbe{Sink: event.Discard}
 	reg := tool.NewRegistry()

internal/runtime/agent/delegation_proxy_test.go

@@ -3,6 +3,7 @@ package agent
 import (
 	"context"
 	"encoding/json"
+	"reasonix/internal/contract/hostaudit"
 	"testing"
 
 	"reasonix/internal/base/testenv"
@@ -11,7 +12,6 @@ import (
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/ext/plugin"
 	"reasonix/internal/runtime/capability"
-	"reasonix/internal/runtime/evidence"
 )
 
 // A capability-proxied call must still produce the delegation receipt: the
@@ -20,10 +20,10 @@ import (
 // violations and criterion downgrades unrecorded, not just a counter at zero.
 type proxyProbe struct {
 	event.Sink
-	got []evidence.DelegationAudit
+	got []hostaudit.DelegationAudit
 }
 
-func (p *proxyProbe) RecordDelegationAudit(a evidence.DelegationAudit) { p.got = append(p.got, a) }
+func (p *proxyProbe) RecordDelegationAudit(a hostaudit.DelegationAudit) { p.got = append(p.got, a) }
 
 func TestDelegationAuditSurvivesCapabilityProxy(t *testing.T) {
 	probe := &proxyProbe{Sink: event.Discard}

internal/runtime/agent/delivery_hardening_test.go

@@ -15,7 +15,7 @@ import (
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/runtime/capability"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // fakeReadFileTool is a minimal read-only tool whose successful calls produce

internal/runtime/agent/delivery_scope_test.go

@@ -11,7 +11,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestDeliveryExecutionScopeDoesNotChangeProviderRequestBytes(t *testing.T) {

internal/runtime/agent/evidence_flow_test.go

@@ -3,6 +3,7 @@ package agent
 import (
 	"context"
 	"errors"
+	"reasonix/internal/contract/hostaudit"
 	"reasonix/internal/state/sessionstore"
 	"reflect"
 	"slices"
@@ -12,7 +13,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/instruction"
 )
 
@@ -102,12 +103,12 @@ func sessionHasUserMessageContaining(s *sessionstore.Session, needle string) boo
 }
 
 type readinessAuditSink struct {
-	events []evidence.ReadinessAudit
+	events []hostaudit.ReadinessAudit
 }
 
 func (s *readinessAuditSink) Emit(event.Event) {}
 
-func (s *readinessAuditSink) RecordReadinessAudit(a evidence.ReadinessAudit) {
+func (s *readinessAuditSink) RecordReadinessAudit(a hostaudit.ReadinessAudit) {
 	s.events = append(s.events, a)
 }
 
@@ -227,13 +228,13 @@ func TestDeliveryProfileRequiresReviewBeforeFinalAnswer(t *testing.T) {
 	}
 	// The debt here is inspection of what the turn changed, not a structured
 	// review report — a distinction the single review counter could not make.
-	if len(sink.events) != 1 || sink.events[0].Result != evidence.ReadinessErrored || sink.events[0].MissingPathInspection == 0 {
+	if len(sink.events) != 1 || sink.events[0].Result != hostaudit.ReadinessErrored || sink.events[0].MissingPathInspection == 0 {
 		t.Fatalf("readiness audits = %+v, want one errored audit owing changed-path inspection", sink.events)
 	}
 	if err := a.Run(ctx, "finish the goal"); err != nil {
 		t.Fatalf("follow-up Run: %v", err)
 	}
-	if len(sink.events) != 2 || sink.events[len(sink.events)-1].Result != evidence.ReadinessAllowed {
+	if len(sink.events) != 2 || sink.events[len(sink.events)-1].Result != hostaudit.ReadinessAllowed {
 		t.Fatalf("readiness audits = %+v, want a final allowed audit", sink.events)
 	}
 }
@@ -575,14 +576,14 @@ func TestFinalReadinessAuditRecordsBlockAndRecovery(t *testing.T) {
 		t.Fatalf("readiness audit events = %d, want 1: %+v", len(sink.events), sink.events)
 	}
 	blocked := sink.events[0]
-	if blocked.Result != evidence.ReadinessErrored || blocked.MissingProjectChecks != 1 {
+	if blocked.Result != hostaudit.ReadinessErrored || blocked.MissingProjectChecks != 1 {
 		t.Fatalf("blocked audit = %+v, want missing project check command", blocked)
 	}
 	if err := a.Run(ctx, "finish"); err != nil {
 		t.Fatalf("verified Run: %v", err)
 	}
 	recovered := sink.events[len(sink.events)-1]
-	if recovered.Result != evidence.ReadinessAllowed || !recovered.Recovered {
+	if recovered.Result != hostaudit.ReadinessAllowed || !recovered.Recovered {
 		t.Fatalf("recovery audit = %+v, want allowed recovered", recovered)
 	}
 }
@@ -754,7 +755,7 @@ func TestFinalReadinessAuditRecordsTerminalError(t *testing.T) {
 		t.Fatalf("readiness audit events = %d, want 1 (no retries): %+v", len(sink.events), sink.events)
 	}
 	last := sink.events[len(sink.events)-1]
-	if last.Result != evidence.ReadinessErrored || last.IncompleteTodos == 0 {
+	if last.Result != hostaudit.ReadinessErrored || last.IncompleteTodos == 0 {
 		t.Fatalf("terminal audit = %+v, want errored with incomplete todos", last)
 	}
 }

internal/runtime/agent/execute_batch.go

@@ -9,7 +9,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/safety/permission"
 )
 

internal/runtime/agent/execute_one.go

@@ -9,7 +9,7 @@ import (
 	"reasonix/internal/contract/planmode"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/safety/permission"
 	"reasonix/internal/state/checkpoint"
 	"reasonix/internal/tools/shellrun"

internal/runtime/agent/failure_diagnosis_test.go

@@ -10,9 +10,9 @@ import (
 
 	"reasonix/internal/base/testenv"
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/plancontract"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
+	"reasonix/internal/runtime/plancontract"
 )
 
 // The reply is model output, so it is parsed as untrusted input: anything that

internal/runtime/agent/final_readiness.go

@@ -3,14 +3,15 @@ package agent
 import (
 	"fmt"
 	"path/filepath"
+	"reasonix/internal/contract/hostaudit"
 	"slices"
 	"strconv"
 	"strings"
 
 	"reasonix/internal/contract/ablation"
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/instruction"
 )
 
@@ -70,8 +71,8 @@ func (c finalReadinessCheck) missingIDs() []string {
 	return missing
 }
 
-func (c finalReadinessCheck) audit(result evidence.ReadinessAuditResult, recovered bool) evidence.ReadinessAudit {
-	return evidence.ReadinessAudit{
+func (c finalReadinessCheck) audit(result hostaudit.ReadinessAuditResult, recovered bool) hostaudit.ReadinessAudit {
+	return hostaudit.ReadinessAudit{
 		Result:                    result,
 		Recovered:                 recovered,
 		MissingProjectChecks:      c.missingProjectChecks,

internal/runtime/agent/final_readiness_test.go

@@ -7,8 +7,8 @@ import (
 
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/instruction"
 )
 

internal/runtime/agent/final_rejection_test.go

@@ -5,9 +5,9 @@ import (
 	"strings"
 	"testing"
 
-	"reasonix/internal/contract/plancontract"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/plancontract"
+	"reasonix/internal/safety/evidence"
 )
 
 func rejectionAgent(t *testing.T, plan *plancontract.Plan) *Agent {

internal/runtime/agent/fleet.go

@@ -14,8 +14,8 @@ import (
 	"reasonix/internal/contract/ablation"
 	"reasonix/internal/contract/agentgraph"
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/jobs"
+	"reasonix/internal/safety/evidence"
 )
 
 const (

internal/runtime/agent/live_contract_test.go

@@ -5,9 +5,9 @@ import (
 	"testing"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/taskcontract"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/taskcontract"
+	"reasonix/internal/safety/evidence"
 )
 
 func liveContractAgent(t *testing.T, sink event.Sink) *Agent {

internal/runtime/agent/obligation_notice.go

@@ -7,7 +7,7 @@ package agent
 import (
 	"strings"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // withObligationDelta appends what this call did to the host's debts. A call

internal/runtime/agent/outcome_shadow.go

@@ -2,9 +2,10 @@ package agent
 
 import (
 	"fmt"
+	"reasonix/internal/contract/hostaudit"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // stallNoticeAge is when a check that will not move becomes worth saying out
@@ -35,7 +36,7 @@ func (a *Agent) observeOutcomeShadow(cancelled bool, receiptMark int) {
 // can cross the threshold — the age stands still through the edits in between —
 // so this fires on that one round, and a different check getting stuck later
 // starts a streak that has to climb again.
-func (a *Agent) noticeStalledVerification(sample evidence.OutcomeSample) {
+func (a *Agent) noticeStalledVerification(sample hostaudit.OutcomeSample) {
 	if sample.Stall == 0 || sample.StallAge != stallNoticeAge {
 		return
 	}

internal/runtime/agent/outcome_shadow_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // Measuring the stall is worth nothing unless it reaches a person, and it has

internal/runtime/agent/path_effect.go

@@ -11,7 +11,7 @@ import (
 	"reasonix/internal/base/diff"
 	"reasonix/internal/base/fileutil"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/checkpoint"
 )
 

internal/runtime/agent/path_effect_scan_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func scanTree(t *testing.T, files int) string {

internal/runtime/agent/path_effect_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 
 	"reasonix/internal/base/testenv"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestObservationNamesWhatAnOpaqueCommandTouched(t *testing.T) {

internal/runtime/agent/plan_contract.go

@@ -5,9 +5,9 @@ import (
 	"encoding/json"
 	"path/filepath"
 
-	"reasonix/internal/contract/plancontract"
-	"reasonix/internal/contract/taskcontract"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/plancontract"
+	"reasonix/internal/runtime/taskcontract"
+	"reasonix/internal/safety/evidence"
 )
 
 // SetPlanContract records the approved plan this turn executes, or clears it

internal/runtime/agent/plan_contract_test.go

@@ -6,10 +6,10 @@ import (
 	"testing"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/contract/plancontract"
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/contract/taskcontract"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/plancontract"
+	"reasonix/internal/runtime/taskcontract"
+	"reasonix/internal/safety/evidence"
 )
 
 func contractPlan() plancontract.Plan {

internal/runtime/agent/plan_submission.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"sync"
 
-	"reasonix/internal/contract/plancontract"
+	"reasonix/internal/runtime/plancontract"
 )
 
 // PlanSubmission is where submit_plan leaves an accepted plan for the host that

internal/runtime/agent/plan_transition_diff.go

@@ -1,8 +1,8 @@
 package agent
 
 import (
-	"reasonix/internal/contract/plancontract"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/runtime/plancontract"
+	"reasonix/internal/safety/evidence"
 )
 
 // planTransitionDiff summarises a task-list rewrite by pairing steps on their

internal/runtime/agent/plan_transition_diff_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func todoList(items ...[2]string) []evidence.TodoItem {

internal/runtime/agent/planmode_test.go

@@ -11,7 +11,7 @@ import (
 	"reasonix/internal/contract/planmode"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 type planSafeTool struct {

internal/runtime/agent/profile_spec.go

@@ -8,7 +8,7 @@ import (
 	"reasonix/internal/contract/agentgraph"
 	"reasonix/internal/contract/tool"
 	"reasonix/internal/ext/skill"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // ProfileDefinition is the delegation-facing narrowing of a stored Skill: what

internal/runtime/agent/project_check_probe.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"reasonix/internal/contract/event"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // probeProjectChecks compares the gate's project-check derivation against the

internal/runtime/agent/project_check_probe_test.go

@@ -7,7 +7,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/instruction"
 )
 

internal/runtime/agent/readiness_proof_test.go

@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 	"reasonix/internal/state/instruction"
 )
 

internal/runtime/agent/recovery_gate.go

@@ -8,7 +8,7 @@ import (
 	"sync/atomic"
 
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // recoveryIdentity is who this agent is to the shared gate: the labels a

internal/runtime/agent/recovery_gate_test.go

@@ -12,7 +12,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 type recordingRecoveryGate struct {

internal/runtime/agent/render_readiness_test.go

@@ -13,8 +13,8 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 )
 
 func renderWrite(path string) evidence.Receipt {

internal/runtime/agent/review_authority_test.go

@@ -9,8 +9,8 @@ import (
 
 	"reasonix/internal/contract/agentpreset"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 )
 
 // reviewLedgerWithRead is a run that has read one file and nothing else, which

internal/runtime/agent/review_grant_testutil_test.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"encoding/json"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // reviewGrant is the grant a host issues to a worker contracted for one kind:

internal/runtime/agent/review_report.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // ReviewReportGrant is what the host bound one report tool to before its

internal/runtime/agent/review_unavailable_test.go

@@ -10,7 +10,7 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 func TestReviewUnavailableErrorIsPartialPath(t *testing.T) {

internal/runtime/agent/run_loop.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"math/rand/v2"
+	"reasonix/internal/contract/hostaudit"
 	"reasonix/internal/state/sessionstore"
 	"strings"
 	"sync/atomic"
@@ -15,9 +16,9 @@ import (
 	"reasonix/internal/contract/planmode"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 	"reasonix/internal/runtime/jobs"
 	"reasonix/internal/runtime/taskpolicy"
+	"reasonix/internal/safety/evidence"
 )
 
 // streamedTurn is one provider completion collected by stream. Keeping the
@@ -578,7 +579,7 @@ func (a *Agent) handleFinalResponse(ctx context.Context, state *turnRuntime, tex
 		// what happens next. In Goal mode the FSM auto-continues under budget
 		// with the missing list as the next turn; plain Delivery turns surface
 		// the recovery card for an explicit user continuation.
-		event.RecordReadinessAudit(a.svc.sink, readiness.audit(evidence.ReadinessErrored, false))
+		event.RecordReadinessAudit(a.svc.sink, readiness.audit(hostaudit.ReadinessErrored, false))
 		a.pending.deliveryRecovery = true
 		// The blocked turn is the one whose summary matters most — it is where
 		// a rewritten check or an unverified mutation is still outstanding —
@@ -615,7 +616,7 @@ func (a *Agent) handleFinalResponse(ctx context.Context, state *turnRuntime, tex
 		return true, nil
 	}
 	if readiness.applies {
-		event.RecordReadinessAudit(a.svc.sink, readiness.audit(evidence.ReadinessAllowed, a.turn.readinessRecovered))
+		event.RecordReadinessAudit(a.svc.sink, readiness.audit(hostaudit.ReadinessAllowed, a.turn.readinessRecovered))
 	}
 	a.emitTurnShadows(a.turn.turnInput, false)
 	if !a.closeSteerIntakeIfIdle() {

internal/runtime/agent/runaway_outcome_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"reasonix/internal/contract/hostaudit"
 	"reasonix/internal/state/sessionstore"
 	"sync/atomic"
 	"testing"
@@ -11,7 +12,6 @@ import (
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/provider"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
 )
 
 type scriptedTool struct {
@@ -63,7 +63,7 @@ func (p *seriesProvider) Stream(context.Context, provider.Request) (<-chan provi
 	return ch, nil
 }
 
-func outcomeSeries(t *testing.T, calls []scriptedCall) []evidence.OutcomeSample {
+func outcomeSeries(t *testing.T, calls []scriptedCall) []hostaudit.OutcomeSample {
 	t.Helper()
 	sink := &outcomeSeriesSink{}
 	reg := tool.NewRegistry()
@@ -78,10 +78,10 @@ func outcomeSeries(t *testing.T, calls []scriptedCall) []evidence.OutcomeSample
 	return sink.samples
 }
 
-type outcomeSeriesSink struct{ samples []evidence.OutcomeSample }
+type outcomeSeriesSink struct{ samples []hostaudit.OutcomeSample }
 
 func (s *outcomeSeriesSink) Emit(event.Event) {}
-func (s *outcomeSeriesSink) RecordOutcomeProgress(sample evidence.OutcomeSample) {
+func (s *outcomeSeriesSink) RecordOutcomeProgress(sample hostaudit.OutcomeSample) {
 	s.samples = append(s.samples, sample)
 }
 

internal/runtime/agent/scope_escape_test.go

@@ -5,8 +5,8 @@ import (
 	"reasonix/internal/state/sessionstore"
 	"testing"
 
-	"reasonix/internal/contract/plancontract"
 	"reasonix/internal/contract/tool"
+	"reasonix/internal/runtime/plancontract"
 )
 
 func scopedAgent(t *testing.T, plan *plancontract.Plan) *Agent {

internal/runtime/agent/sessionstate.go

@@ -6,7 +6,7 @@ import (
 	"sync/atomic"
 
 	"reasonix/internal/contract/provider"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // sessionRuntime is the host state one conversation owns. Its lifetime sits

internal/runtime/agent/shell_shape_gates.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"context"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // applyShellShapeGates holds the deterministic command-shape contract: shapes a

internal/runtime/agent/shell_verification.go

@@ -6,7 +6,7 @@ import (
 
 	"reasonix/internal/base/shellparse"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // shellVerificationVerdict reads a verification's outcome off what the host

internal/runtime/agent/shown_paths.go

@@ -4,7 +4,7 @@ import (
 	"os"
 	"slices"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // witnessFileLimit bounds how much of a file the host will read to build a

internal/runtime/agent/shown_paths_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"reasonix/internal/base/testenv"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 const witnessBefore = "package tally\n\nfunc Sum(xs []int) int {\n\ttotal := 0\n\treturn total\n}\n"

internal/runtime/agent/silent_exit.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"strings"
 
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // silentExitIsAnAnswer reports whether a non-zero exit reported something rather

internal/runtime/agent/subagent_report.go

@@ -3,11 +3,12 @@ package agent
 import (
 	"context"
 	"fmt"
+	"reasonix/internal/contract/hostaudit"
 	"strings"
 
 	"reasonix/internal/contract/event"
 	"reasonix/internal/contract/tool"
-	"reasonix/internal/runtime/evidence"
+	"reasonix/internal/safety/evidence"
 )
 
 // hostReceiptsMaxItems bounds each rendered line so a long child run cannot
@@ -100,7 +101,7 @@ func composeSubagentAnswer(ctx context.Context, answer string, sub *Agent, claim
 // the parent-authored task before host framing, which is what makes the
 // evidence-origin split a host record rather than a claim.
 func recordDelegationAudit(ctx context.Context, summary evidence.ChildEvidenceSummary, claims WritePathSet, report evidence.CompletionReport, reasons []string, hasReport bool, delegationText string) {
-	audit := evidence.DelegationAudit{
+	audit := hostaudit.DelegationAudit{
 		Depth:           SubagentDepth(ctx),
 		ToolCalls:       len(summary.Receipts),
 		MutationPaths:   summary.MutationPaths(),
@@ -109,7 +110,7 @@ func recordDelegationAudit(ctx context.Context, summary evidence.ChildEvidenceSu
 		Downgrades:      len(reasons),
 	}
 	audit.Mutations = len(audit.MutationPaths)
-	audit.ClassifyEvidenceOrigin(delegationText, summary.EvidencePaths())
+	evidence.ClassifyEvidenceOrigin(&audit, delegationText, summary.EvidencePaths())
 	if hasReport {
 		audit.AdjudicatedStatus = string(report.Status)
 	}