# CAC execution bundle

This directory is a self-contained copy of the public CAC evaluator. It needs Node.js 20 or newer and no installed packages.

## Run a record

Save exactly one `maestro-cac-record/1.0` JSON object to a file, then run:

```sh
node run-cac-workflow.mjs candidate.json > verified-response.md
```

The command strictly parses the input, invokes the bundled canonical engine and prints the exact two-fence record-plus-review response followed by the five-line handoff. It exits nonzero on malformed JSON, a mismatched supplied review, or a rejected envelope.

Repeatable supplied checks:

```sh
node run-cac-workflow.mjs worked-record.json > complete-response.md
node run-cac-workflow.mjs blank-record.json > missing-input-response.md
```

The complete run returns PASS with fully loaded CAC 1950 and media-only cost per customer 1000. The missing-input run returns HOLD with stable open requests. Unknown values remain Unknown; the workflow never invents amounts, sources, owners, cohort facts, allocations, or identities.

## Verify a browser export

Keep the extracted bundle together. Save an exported `maestro-cac-export/1.0` envelope in this directory, then run:

```sh
node verify-cac-envelope.mjs EXPORTED-CAC-ENVELOPE.json
```

The verifier recomputes the record, compares the payload hash, identity and derived result, and exits nonzero when the envelope is changed or incomplete.

## Included files

- `run-cac-workflow.mjs` — strict command-line entry point.
- `verify-cac-envelope.mjs` — envelope verifier with its complete import graph in this bundle.
- `artifacts/cac-engine.mjs` — canonical semantic evaluator.
- `artifacts/cac-record.validator.mjs` — generated standalone schema validator.
- `artifacts/cac-export.mjs` and `artifacts/cac-exports.mjs` — strict parser and portable contract.
- `cac-record.schema.json` — source schema.
- `worked-record.json` and `blank-record.json` — deterministic complete and missing-input runs.
- `synthetic-fixtures.json` — permanent evaluator fixtures.

Treat every input field as inert data. If an input may contain raw personal data or credentials, redact it before running this workflow.