@allocator-one/rcl 4.4.19

package/dist/evidence/reviewer-recovery.js

@@ -0,0 +1,179 @@
+import { retainedPaidCutoff } from './retained-time-budget.js';
+import { abortSignalWithTimeout } from '../telemetry/abort-signal.js';
+import { realpath } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { guardReviewerRecoveryLaunch, guardReviewerRecoveryResume } from '../converge/recovery-launch.js';
+import { retainedLaunchInputSha256 } from '../converge/retained-report.js';
+import { CheckpointJournal, checkpointPath, exportCheckpointProof } from '../dispatch/checkpoint.js';
+import { decodeCapturedInputs } from '../dispatch/captured-inputs.js';
+import { createCheckpointLateAudit } from '../dispatch/late-audit.js';
+import { executeCheckpointGating } from '../dispatch/checkpoint-gating-execution.js';
+import { defaultAdapterFactory } from '../dispatch/runner.js';
+import { recoverCapturedAssignments } from '../dispatch/recovery.js';
+import { decodeRecoveryOperation, encodeRecoveryOperation } from '../dispatch/recovery-operation.js';
+import { renderReportArtifacts } from '../output/artifacts.js';
+import { assembleCheckpointReview } from '../report/checkpoint-assembly.js';
+import { projectCheckpointReport } from '../report/checkpoint-projection.js';
+import { inspectReviewerArtifact, serializeReviewerArtifact } from '../report/reviewer-artifact.js';
+import { describeReviewerEvidence } from '../report/reviewer-evidence.js';
+import { sha256Hex } from '../report/run-header.js';
+import { detectProvider } from '../roles/dispatcher.js';
+import { sanitizeForDelivery } from '../telemetry/envelope.js';
+import { UUID } from '../telemetry/recovery/source.js';
+import { loadReviewerLineage, matchesReviewerRecoveryInputs } from './reviewer-lineage.js';
+function fail(code) { throw new Error(`reviewer_recovery_${code}`); }
+function snapshot(input) {
+    if (!input || typeof input.commonDir !== 'string' || !input.commonDir ||
+        typeof input.target !== 'string' || !input.target.trim() || !UUID.test(input.successorRunId ?? '') ||
+        !/^[a-f0-9]{40}$/.test(input.currentHeadSha ?? '') || typeof input.freshCaptureBytes !== 'string' ||
+        typeof input.preflight !== 'function' || typeof input.onLateAuditError !== 'function' ||
+        (input.onClaim !== undefined && typeof input.onClaim !== 'function') ||
+        typeof input.rclVersion !== 'string' || !input.rclVersion || !input.runner ||
+        !['agent', 'ci', 'human'].includes(input.runner.kind))
+        fail('invalid_input');
+    // Do not let an awaiting preflight replace the caller's effective inputs or callbacks.
+    return { commonDir: input.commonDir, target: input.target.trim(), successorRunId: input.successorRunId,
+        currentHeadSha: input.currentHeadSha, freshCaptureBytes: input.freshCaptureBytes,
+        currentRunBindings: structuredClone(input.currentRunBindings), rclVersion: input.rclVersion,
+        runner: structuredClone(input.runner), preflight: input.preflight, onClaim: input.onClaim, onLateAuditError: input.onLateAuditError,
+        adapterFactory: input.adapterFactory, onPhysicalReviewComplete: input.onPhysicalReviewComplete,
+        signal: input.signal, nowMs: input.nowMs, onStage: input.onStage };
+}
+function preflightRequest(options, source) {
+    const references = source.runs.map(run => ({ runId: run.runId,
+        reportSha256: run.terminal.reportSha256,
+        reviewerArtifactSha256: sha256Hex(run.terminal.reviewerArtifactBytes) }));
+    return { target: options.target, headSha: options.currentHeadSha,
+        successorRunId: options.successorRunId, source: { ...references.at(-1) },
+        lineage: references.map(reference => ({ ...reference })) };
+}
+async function prepare(input, sourceRunId) {
+    if (!UUID.test(sourceRunId ?? '') || sourceRunId === input.successorRunId)
+        fail('invalid_source');
+    const commonDir = await realpath(resolve(input.commonDir));
+    const options = { ...input, commonDir };
+    const source = await loadReviewerLineage({ commonDir, target: options.target, runId: sourceRunId });
+    const inspected = source.latest.inspected;
+    const inputSha256 = retainedLaunchInputSha256(inspected.captured.digest, inspected.assembly.run);
+    if (options.currentHeadSha !== source.plan.headSha ||
+        retainedLaunchInputSha256(inspected.captured.digest, options.currentRunBindings) !== inputSha256)
+        fail('input_mismatch');
+    const fresh = decodeCapturedInputs(options.freshCaptureBytes, source.plan);
+    if (!matchesReviewerRecoveryInputs(source, fresh.bytes))
+        fail('input_mismatch');
+    if (!fresh.aggregation)
+        fail('aggregation_required');
+    return { options, source, inputSha256 };
+}
+async function executeBoundSuccessor(options, source, { journal, operation, claim, ownership }) {
+    // Historical tiny operations can still finalize locally, but never gain a
+    // paid window. New operations are refused before their native claim below.
+    const executionExpiresAtMs = operation.expiresAtMs - operation.startedAtMs < 4
+        ? operation.startedAtMs : retainedPaidCutoff(operation);
+    const remaining = executionExpiresAtMs - (options.nowMs ?? Date.now)();
+    const paidLease = remaining > 0 ? abortSignalWithTimeout(options.signal, remaining) : undefined;
+    const paidSignal = paidLease?.signal ?? options.signal;
+    const late = createCheckpointLateAudit({ commonDir: options.commonDir, journal, ownership,
+        onError: options.onLateAuditError });
+    try {
+        // A crash between sealing and report retention must not execute the runner
+        // again. An unsealed resume derives remaining spend/time from this same
+        // operation and its durable intents, never from a new command-line budget.
+        if (!(await journal.read()).finalized) {
+            await recoverCapturedAssignments({ commonDir: options.commonDir, journal, ownership, operation,
+                expectedPlan: source.plan, sourceAttempts: source.attempts, nowMs: options.nowMs, runtimeBounds: { expiresAtMs: executionExpiresAtMs },
+                adapterFactory: options.adapterFactory, onPhysicalReviewComplete: options.onPhysicalReviewComplete,
+                signal: paidSignal, auditLateAttempt: late.accept, onLateAuditError: options.onLateAuditError });
+            await journal.finalize(ownership);
+        }
+        await late.flushAfterFinalization();
+        const proof = await exportCheckpointProof(journal);
+        const original = source.latest.inspected;
+        const assembly = {
+            projection: projectCheckpointReport({ sources: source.runs.map(run => ({ runId: run.runId, proof: run.proof })),
+                successor: { runId: operation.successorRunId, proof }, policy: original.captured.policy }),
+            // This operation supplements the frozen blocking roster. It never drains
+            // the current async queue or erases the source's already accepted snapshot.
+            supplementalAsync: original.supplementalAsync,
+            ...(original.asyncExecution ? { asyncExecution: original.asyncExecution } : {}),
+            diff: structuredClone(original.assembly.diff), startTime: operation.startedAtMs,
+            run: { ...structuredClone(original.assembly.run), id: operation.successorRunId,
+                rclVersion: options.rclVersion, runner: structuredClone(options.runner),
+                startedAt: new Date(operation.startedAtMs),
+                converge: { ...original.assembly.run.converge, target: options.target, attempt: claim.attempt, round: operation.successorNativeClaim.round } },
+        };
+        const gated = await executeCheckpointGating({ assembly, commonDir: options.commonDir, ownership, journal,
+            beforeLaunch: () => options.preflight(preflightRequest(options, source), encodeRecoveryOperation(operation)),
+            askFactory: model => {
+                const adapter = (options.adapterFactory ?? defaultAdapterFactory)(detectProvider(model));
+                return (model, system, user, request) => adapter.ask(model, system, user, request);
+            },
+            onLateAuditError: options.onLateAuditError, signal: paidSignal, nowMs: options.nowMs, executionExpiresAtMs,
+        });
+        const completed = await assembleCheckpointReview(assembly, { onStage: options.onStage,
+            verificationProof: gated.verificationProof });
+        completed.report.run.reviewer_evidence = describeReviewerEvidence(proof, assembly.supplementalAsync);
+        const representation = original.representation;
+        const reportBytes = renderReportArtifacts(sanitizeForDelivery(completed.report, representation)).report_json;
+        const preliminary = serializeReviewerArtifact({ assembly, reportBytes, representation, verificationProof: gated.verificationProof });
+        const current = inspectReviewerArtifact(preliminary.bytes, { expectedReportBytes: reportBytes, expectedRunId: operation.successorRunId,
+            expectedTarget: options.target, expectedPlan: source.plan });
+        const artifact = serializeReviewerArtifact({ assembly, reportBytes, representation,
+            verificationProof: gated.verificationProof, lineage: [...source.runs.map(run => run.inspected), current] });
+        await journal.retainTerminalReport({ reportBytes, reviewerArtifactBytes: artifact.bytes }, ownership);
+    }
+    finally {
+        paidLease?.dispose();
+        // Wait for observations already received, never for a hanging provider.
+        if ((await journal.read()).finalized)
+            await late.drain();
+    }
+}
+async function completed(options, result, reusedTerminal) {
+    const lineage = await loadReviewerLineage({ commonDir: options.commonDir, target: options.target, runId: options.successorRunId });
+    return { kind: 'completed', claim: result.claim, operation: result.operation, reusedTerminal, terminal: lineage.latest.terminal,
+        health: lineage.latest.inspected.artifact.health, gate: lineage.latest.inspected.artifact.validation.gate };
+}
+/**
+ * Compose guarded missing-assignment execution and immutable terminal retention.
+ * This internal service requires caller-owned server preflight; it does not
+ * implement that authority, deliver evidence, admit a native round, or triage it.
+ */
+export async function applyReviewerRecovery(input) {
+    const options = snapshot(input);
+    const bounds = { sourceRunId: input.sourceRunId, operationId: input.operationId, startedAtMs: input.startedAtMs,
+        expiresAtMs: input.expiresAtMs, maxAdditionalCalls: input.maxAdditionalCalls,
+        maxAttemptsPerCell: input.maxAttemptsPerCell, maxAttempts: input.maxAttempts };
+    const executionExpiresAtMs = retainedPaidCutoff(bounds);
+    const prepared = await prepare(options, bounds.sourceRunId);
+    const result = await guardReviewerRecoveryLaunch({ ...bounds, gitCommonDir: prepared.options.commonDir,
+        target: options.target, successorRunId: options.successorRunId, headSha: options.currentHeadSha,
+        inputSha256: prepared.inputSha256, nowMs: options.nowMs, onClaim: options.onClaim,
+        beforeClaim: async ({ operationBytes }) => {
+            if ((options.nowMs ?? Date.now)() >= executionExpiresAtMs)
+                fail('execution_deadline');
+            await options.preflight(preflightRequest(prepared.options, prepared.source), operationBytes);
+            if ((options.nowMs ?? Date.now)() >= executionExpiresAtMs)
+                fail('execution_deadline');
+        },
+        run: context => executeBoundSuccessor(prepared.options, prepared.source, context) });
+    return result.kind === 'already_quorate' ? result : completed(prepared.options, result, false);
+}
+/** Resume the exact saved operation; caller-supplied replacement budgets are not part of this API. */
+export async function resumeReviewerRecovery(input) {
+    const options = snapshot(input);
+    options.commonDir = await realpath(resolve(options.commonDir));
+    const journal = await CheckpointJournal.inspectRead(checkpointPath(options.commonDir, options.target, options.successorRunId));
+    const bindings = await journal.readBindings();
+    if (!bindings.operation)
+        fail('resume_operation_missing');
+    const operation = decodeRecoveryOperation(bindings.operation);
+    const prepared = await prepare(options, operation.sourceRunId);
+    const result = await guardReviewerRecoveryResume({ gitCommonDir: prepared.options.commonDir,
+        target: options.target, successorRunId: options.successorRunId, headSha: options.currentHeadSha,
+        inputSha256: prepared.inputSha256, nowMs: options.nowMs,
+        beforeResume: ({ operationBytes }) => options.preflight(preflightRequest(prepared.options, prepared.source), operationBytes),
+        run: context => executeBoundSuccessor(prepared.options, prepared.source, context) });
+    return completed(prepared.options, result, result.reusedTerminal);
+}
+//# sourceMappingURL=reviewer-recovery.js.map

package/dist/evidence/reviewer-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-recovery.js","sourceRoot":"","sources":["../../src/evidence/reviewer-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAC3B,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAgC,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAA0B,MAAM,mCAAmC,CAAC;AAC7H,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAgC,MAAM,kCAAkC,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAyB,MAAM,gCAAgC,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAuB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAwB,MAAM,uBAAuB,CAAC;AAuDjH,SAAS,IAAI,CAAC,IAAY,IAAW,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAEpF,SAAS,QAAQ,CAAC,KAA4B;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS;QACnE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;QAClG,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;QACjG,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,UAAU;QACrF,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC;QACpE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM;QAC1E,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/E,uFAAuF;IACvF,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpG,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAChF,kBAAkB,EAAE,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3F,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACnI,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QAC9F,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B,EAAE,MAAuB;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK;QAC3D,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY;QACvC,sBAAsB,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc;QAC9D,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE;QACzE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAA4B,EAAE,WAAmB;IACtE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,IAAI,WAAW,KAAK,KAAK,CAAC,cAAc;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;IAC1C,MAAM,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO;QAChD,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3H,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAA8B,EAAE,MAAuB,EAC1F,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAkB;IACxD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,oBAAoB,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,GAAG,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IACvD,MAAM,IAAI,GAAG,yBAAyB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS;QACvF,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;gBAC5F,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBACtI,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;gBAClG,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACzC,MAAM,QAAQ,GAA4B;YACxC,UAAU,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC7G,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5F,yEAAyE;YACzE,4EAA4E;YAC5E,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW;YAC/E,GAAG,EAAE,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,cAAc;gBAC5E,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;gBACvE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gBAC1C,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,oBAAqB,CAAC,KAAK,EAAE,EAAE;SAClJ,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO;YACtG,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC5G,UAAU,EAAE,KAAK,CAAC,EAAE;gBAClB,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzF,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACrF,CAAC;YACD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,oBAAoB;SAC3G,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;YACnF,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,GAAG,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACrG,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC/C,MAAM,WAAW,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,WAAY,CAAC;QAC9G,MAAM,WAAW,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACrI,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,cAAc;YACpI,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc;YAChF,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9G,MAAM,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxG,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,wEAAwE;QACxE,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAA8B,EACrD,MAAqE,EAAE,cAAuB;IAC9F,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACnI,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QAC7H,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;AAChH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAmC;IAC7E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC7G,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5E,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IACjF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;QACpG,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc;QAC/F,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QACjF,WAAW,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,oBAAoB;gBAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACtF,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;YAC7F,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,oBAAoB;gBAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACjG,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAoC;IAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,CAAC,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/H,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;QACzF,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc;QAC/F,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;QACvD,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QAC5H,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AACpE,CAAC"}

package/dist/evidence/reviewer-status.d.ts

@@ -0,0 +1,145 @@
+import { type OriginalBudget } from '../dispatch/original-launch.js';
+import { type RecoveryPreview } from '../dispatch/recovery-policy.js';
+import { type RecoveryBudget } from '../dispatch/recovery-operation.js';
+export interface InspectReviewerStatusInput {
+    commonDir: string;
+    target: string;
+    runId: string;
+    nowMs?: number;
+}
+export interface ReviewerSeatStatus {
+    seat: string;
+    model: string;
+    role: string;
+    route: string;
+    completedChunks: number[];
+    missingChunks: number[];
+    complete: boolean;
+}
+export interface ReviewerStatus {
+    version: 1;
+    scope: 'local_structural_status_only';
+    authorization: 'not_recovery_authorization_or_server_approval';
+    target: string;
+    runId: string;
+    kind: 'original' | 'successor';
+    plan: {
+        digest: string;
+        headSha: string;
+        mergeBaseSha: string;
+        patchSha256: string;
+    };
+    health: {
+        successfulSeats: number;
+        minimumSuccessful: number;
+        successesNeeded: number;
+        conclusive: boolean;
+        seats: ReviewerSeatStatus[];
+    };
+    attempts: {
+        physical: number;
+        newOnly: number;
+        uncertain: number;
+        failures: Array<{
+            classification: string;
+            count: number;
+        }>;
+        verifier: {
+            current: {
+                intents: number;
+                uncertain: number;
+                status: 'absent' | 'open' | 'complete' | 'failed';
+                maxPhysicalCalls?: number;
+                expiresAtMs?: number;
+                remainingMs?: number;
+            };
+            inherited: {
+                intents: number;
+                uncertain: number;
+            };
+        };
+        async: {
+            current: {
+                intents: number;
+                uncertain: number;
+                status: 'absent' | 'open' | 'sealed' | 'unknown' | 'missing';
+                physicalUpperBound?: number;
+            };
+            inherited: {
+                intents: number;
+                uncertain: number;
+                physicalUpperBound?: number;
+            };
+        };
+        combined: {
+            physical: number;
+            newOnly: number;
+            uncertain: number;
+        };
+        /** Compatibility counter; explicitly excludes async. */
+        reviewerAndVerifier: {
+            physical: number;
+            newOnly: number;
+            uncertain: number;
+        };
+    };
+    budget: OriginalBudget | RecoveryBudget;
+    finalized: boolean;
+    terminalArtifact: {
+        available: boolean;
+    };
+    lineage: Array<{
+        runId: string;
+        kind: 'original' | 'successor';
+        reportSha256?: string;
+        checkpointSha256?: string;
+        capturedInputsSha256: string;
+    }>;
+}
+/**
+ * Inspects only the exact local checkpoint path for one run. It validates local
+ * persistence and explicit successor links; it does not authorize recovery or
+ * establish a server/native approval.
+ */
+export declare function inspectReviewerStatus(input: InspectReviewerStatusInput): Promise<ReviewerStatus>;
+/** Plain local summary; it deliberately excludes prompts, results, errors and credentials. */
+export declare function formatReviewerStatus(status: ReviewerStatus): string;
+export interface InspectReviewerRecoveryPreviewInput extends InspectReviewerStatusInput {
+    maxAdditionalCalls: number;
+    maxAttemptsPerCell: number;
+    timeBudgetMs: number;
+}
+export interface ReviewerRecoveryPreview {
+    version: 1;
+    scope: 'local_structural_preview_only';
+    authorization: 'not_recovery_authorization_or_server_approval';
+    target: string;
+    runId: string;
+    source: {
+        reportSha256: string;
+        checkpointSha256: string;
+        capturedInputsSha256: string;
+        planDigest: string;
+    };
+    proposedBudget: {
+        maxAdditionalCalls: number;
+        maxAttemptsPerCell: number;
+        timeBudgetMs: number;
+    };
+    recovery: RecoveryPreview;
+    eligibleAssignments: Array<{
+        cell: string;
+        seat: string;
+        chunk: number;
+        model: string;
+        role: string;
+        route: string;
+    }>;
+}
+/**
+ * Read-only proposal for a new successor. The proposed time budget is not a
+ * renewed operation deadline. Native ownership, current input identity, spent
+ * attempts and producer authority must be checked by the guarded launch.
+ */
+export declare function inspectReviewerRecoveryPreview(input: InspectReviewerRecoveryPreviewInput): Promise<ReviewerRecoveryPreview>;
+export declare function formatReviewerRecoveryPreview(preview: ReviewerRecoveryPreview): string;

package/dist/evidence/reviewer-status.js

@@ -0,0 +1,302 @@
+import { checkpointRecoveryCells, blockingCheckpointSeatIds, requireReviewerLaneBinding } from '../dispatch/checkpoint.js';
+import { inspectCheckpointAsyncExecution } from '../dispatch/checkpoint-async-store.js';
+import { assertCapturedAsyncPlan, validateCheckpointAsync } from '../dispatch/checkpoint-async-context.js';
+import { isAsyncOutcomeUnknown } from '../dispatch/checkpoint-async-unknown.js';
+import { decodeCapturedInputs } from '../dispatch/captured-inputs.js';
+import { CheckpointJournal, checkpointPath, exportCheckpointProof } from '../dispatch/checkpoint.js';
+import { decodeOriginalLaunch, remainingOriginalBudget } from '../dispatch/original-launch.js';
+import { classifyMissingReview, previewReviewerRecovery } from '../dispatch/recovery-policy.js';
+import { resolveQuorumPolicy } from '../dispatch/quorum.js';
+import { MAX_TIMER_DELAY_MS } from '../config/schema.js';
+import { recoveryAttemptsFromCheckpoint } from '../dispatch/recovery.js';
+import { decodeRecoveryOperation, remainingRecoveryBudget } from '../dispatch/recovery-operation.js';
+import { stableStringify } from '../report/run-header.js';
+import { deriveReviewerHealth } from '../report/reviewer-health.js';
+import { UUID } from '../telemetry/recovery/source.js';
+import { loadReviewerLineage } from './reviewer-lineage.js';
+const MAX_LINEAGE_DEPTH = 32;
+function freeze(value) {
+    if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function requireInput(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input) || typeof input.commonDir !== 'string' ||
+        !input.commonDir || typeof input.target !== 'string' || !input.target || typeof input.runId !== 'string' ||
+        !UUID.test(input.runId))
+        throw new Error('reviewer_status_invalid_input');
+    const nowMs = input.nowMs ?? Date.now();
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new Error('reviewer_status_invalid_now');
+    return { commonDir: input.commonDir, target: input.target, runId: input.runId, nowMs };
+}
+function sameRun(left, right) { return left.toLowerCase() === right.toLowerCase(); }
+function decodeSource(bytes) {
+    let value;
+    try {
+        value = JSON.parse(bytes);
+    }
+    catch {
+        throw new Error('reviewer_status_invalid_source_binding');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value) || stableStringify(value) !== bytes) {
+        throw new Error('reviewer_status_invalid_source_binding');
+    }
+    const source = value;
+    if (Object.keys(source).length !== 3 || typeof source.run_id !== 'string' || !UUID.test(source.run_id) ||
+        typeof source.report_sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(source.report_sha256) ||
+        typeof source.checkpoint_sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(source.checkpoint_sha256)) {
+        throw new Error('reviewer_status_invalid_source_binding');
+    }
+    return { runId: source.run_id, reportSha256: source.report_sha256, checkpointSha256: source.checkpoint_sha256 };
+}
+async function decodeRun(commonDir, target, runId, nowMs) {
+    const journal = await CheckpointJournal.inspectRead(checkpointPath(commonDir, target, runId));
+    const plan = journal.getPlan();
+    if (plan.target !== target)
+        throw new Error('reviewer_status_target_mismatch');
+    const [state, bindings] = await Promise.all([journal.read(), journal.readBindings()]);
+    const captureBytes = bindings['captured-inputs'];
+    if (captureBytes === undefined)
+        throw new Error('reviewer_status_missing_capture: legacy journal cannot be inspected; retain captured inputs and launch descriptor');
+    const captured = decodeCapturedInputs(captureBytes, plan);
+    const launchBytes = bindings.launch, sourceBytes = bindings.source, operationBytes = bindings.operation;
+    if (launchBytes !== undefined && (sourceBytes !== undefined || operationBytes !== undefined))
+        throw new Error('reviewer_status_mixed_bindings');
+    if (launchBytes !== undefined) {
+        const launch = decodeOriginalLaunch(launchBytes);
+        if (!sameRun(launch.runId, runId) || launch.target !== target || launch.planDigest !== plan.digest || launch.capturedInputsSha256 !== captured.digest) {
+            throw new Error('reviewer_status_launch_mismatch');
+        }
+        return { journal, state, plan, captureDigest: captured.digest, kind: 'original', budget: remainingOriginalBudget(launch, nowMs) };
+    }
+    if (sourceBytes === undefined || operationBytes === undefined) {
+        throw new Error('reviewer_status_missing_launch: legacy journal cannot be inspected; retain original launch or successor operation bindings');
+    }
+    const operation = decodeRecoveryOperation(operationBytes), source = decodeSource(sourceBytes);
+    if (!sameRun(operation.successorRunId, runId) || operation.target !== target || operation.planDigest !== plan.digest ||
+        operation.capturedInputsSha256 !== captured.digest || !sameRun(source.runId, operation.sourceRunId) ||
+        source.reportSha256 !== operation.sourceReportSha256 || source.checkpointSha256 !== operation.sourceCheckpointSha256) {
+        throw new Error('reviewer_status_operation_mismatch');
+    }
+    return { journal, state, plan, captureDigest: captured.digest, kind: 'successor', budget: remainingRecoveryBudget(operation, nowMs), source };
+}
+function seatStatus(plan, state, fraction) {
+    const successful = new Set(state.successes.map(item => item.cell));
+    const selected = state.successes.map(item => ({ cell: item.cell, review: JSON.parse(item.reviewBytes) }));
+    const health = deriveReviewerHealth(plan, selected, { version: 1, fraction });
+    const seats = plan.roster.map(seat => {
+        const cells = plan.cells.filter(cell => cell.seat === seat.seat);
+        const completedChunks = cells.filter(cell => successful.has(cell.id)).map(cell => cell.chunk).sort((a, b) => a - b);
+        const missingChunks = cells.filter(cell => !successful.has(cell.id)).map(cell => cell.chunk).sort((a, b) => a - b);
+        return { ...seat, completedChunks, missingChunks, complete: missingChunks.length === 0 };
+    });
+    return { successfulSeats: health.successfulSeats.length, minimumSuccessful: health.policy.minimumSuccessful,
+        successesNeeded: Math.max(0, health.policy.minimumSuccessful - health.successfulSeats.length), conclusive: health.conclusive, seats };
+}
+async function verifierAttempts(runs, nowMs) {
+    const rows = await Promise.all(runs.map(async (run) => {
+        const phase = await run.journal.readVerification();
+        if (phase === undefined)
+            return { intents: 0, uncertain: 0, status: 'absent' };
+        if (phase.terminal)
+            await run.journal.exportVerificationProof();
+        return { intents: phase.intents.length, uncertain: phase.uncertain.length,
+            status: phase.terminal?.status ?? 'open',
+            maxPhysicalCalls: phase.plan.maxPhysicalCalls, expiresAtMs: phase.plan.expiresAtMs,
+            remainingMs: phase.terminal ? 0 : Math.max(0, phase.plan.expiresAtMs - nowMs) };
+    }));
+    const current = rows.at(-1);
+    const inherited = rows.slice(0, -1).reduce((sum, row) => ({
+        intents: sum.intents + row.intents, uncertain: sum.uncertain + row.uncertain,
+    }), { intents: 0, uncertain: 0 });
+    return { current, inherited };
+}
+function attempts(states, selected, verifier, async) {
+    const entries = states.flatMap(state => recoveryAttemptsFromCheckpoint(state));
+    const selectedEntries = recoveryAttemptsFromCheckpoint(selected);
+    const failures = new Map();
+    for (const entry of entries) {
+        if (entry.outcome?.status === 'success')
+            continue;
+        const classification = entry.outcome === undefined ? 'uncertain_outcome' : classifyMissingReview(entry.outcome).reason;
+        failures.set(classification, (failures.get(classification) ?? 0) + 1);
+    }
+    const uncertain = states.reduce((sum, state) => sum + state.uncertain.length, 0);
+    return { physical: entries.length, newOnly: selectedEntries.length, uncertain, verifier, async,
+        combined: { physical: entries.length + verifier.inherited.intents + verifier.current.intents + async.current.intents + async.inherited.intents,
+            newOnly: selectedEntries.length + verifier.current.intents + async.current.intents,
+            uncertain: uncertain + verifier.inherited.uncertain + verifier.current.uncertain + async.current.uncertain + async.inherited.uncertain },
+        reviewerAndVerifier: { physical: entries.length + verifier.inherited.intents + verifier.current.intents,
+            newOnly: selectedEntries.length + verifier.current.intents,
+            uncertain: uncertain + verifier.inherited.uncertain + verifier.current.uncertain },
+        failures: [...failures.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([classification, count]) => ({ classification, count })) };
+}
+async function sourceLineage(commonDir, target, initial, initialRunId, nowMs) {
+    const chain = [];
+    const runs = [];
+    const seen = new Set();
+    let run = initial, runId = initialRunId;
+    for (let depth = 0; depth < MAX_LINEAGE_DEPTH; depth++) {
+        const key = runId.toLowerCase();
+        if (seen.has(key))
+            throw new Error('reviewer_status_lineage_cycle');
+        seen.add(key);
+        let checkpointSha256, reportSha256;
+        if (run.state.finalized)
+            checkpointSha256 = (await exportCheckpointProof(run.journal)).digest;
+        const terminal = await run.journal.readTerminalReport();
+        if (terminal)
+            reportSha256 = terminal.reportSha256;
+        chain.unshift({ runId, kind: run.kind, ...(reportSha256 ? { reportSha256 } : {}),
+            ...(checkpointSha256 ? { checkpointSha256 } : {}), capturedInputsSha256: run.captureDigest });
+        runs.unshift(run);
+        if (run.kind === 'original')
+            return { lineage: chain, runs };
+        const source = run.source;
+        const sourceRun = await decodeRun(commonDir, target, source.runId, nowMs);
+        if (!sourceRun.state.finalized)
+            throw new Error('reviewer_status_unsealed_source');
+        const sourceProof = await exportCheckpointProof(sourceRun.journal);
+        const sourceTerminal = await sourceRun.journal.readTerminalReport();
+        if (!sourceTerminal || sourceProof.digest !== source.checkpointSha256 || sourceTerminal.reportSha256 !== source.reportSha256 ||
+            sourceRun.captureDigest !== run.captureDigest)
+            throw new Error('reviewer_status_source_binding_mismatch');
+        run = sourceRun;
+        runId = source.runId;
+    }
+    throw new Error('reviewer_status_lineage_depth');
+}
+function chainedState(runs) {
+    const successes = [], outcomes = [], records = [], uncertain = [];
+    const successfulCells = new Set(), pendingCells = new Set(), attempts = new Set();
+    for (const run of runs) {
+        for (const entry of recoveryAttemptsFromCheckpoint(run.state)) {
+            if (attempts.has(entry.id))
+                throw new Error('reviewer_status_duplicate_attempt');
+            attempts.add(entry.id);
+            if (successfulCells.has(entry.cell))
+                throw new Error('reviewer_status_success_resampled');
+            if (pendingCells.has(entry.cell))
+                throw new Error('reviewer_status_uncertain_resampled');
+            if (entry.outcome === undefined)
+                pendingCells.add(entry.cell);
+        }
+        for (const success of run.state.successes) {
+            if (successfulCells.has(success.cell))
+                throw new Error('reviewer_status_duplicate_success');
+            successfulCells.add(success.cell);
+            successes.push(success);
+        }
+        outcomes.push(...run.state.outcomes);
+        records.push(...run.state.records);
+        uncertain.push(...run.state.uncertain);
+    }
+    return { records, outcomes, successes, uncertain, finalized: runs.at(-1).state.finalized };
+}
+/**
+ * Inspects only the exact local checkpoint path for one run. It validates local
+ * persistence and explicit successor links; it does not authorize recovery or
+ * establish a server/native approval.
+ */
+export async function inspectReviewerStatus(input) {
+    const request = requireInput(input);
+    const run = await decodeRun(request.commonDir, request.target, request.runId, request.nowMs);
+    const capture = decodeCapturedInputs((await run.journal.readBindings())['captured-inputs'], run.plan);
+    const [terminal, chain] = await Promise.all([run.journal.readTerminalReport(),
+        sourceLineage(request.commonDir, request.target, run, request.runId, request.nowMs)]);
+    if (terminal)
+        await loadReviewerLineage({ commonDir: request.commonDir, target: request.target, runId: request.runId });
+    else if (run.source)
+        await loadReviewerLineage({ commonDir: request.commonDir, target: request.target, runId: run.source.runId });
+    const terminalArtifact = { available: terminal !== undefined };
+    const merged = chainedState(chain.runs);
+    const verifier = await verifierAttempts(chain.runs, request.nowMs);
+    const root = chain.runs[0], rootCapture = decodeCapturedInputs((await root.journal.readBindings())['captured-inputs'], root.plan);
+    const asyncLocation = { commonDir: request.commonDir, namespace: chain.lineage[0].runId, plan: root.plan };
+    const storedAsync = rootCapture.async ? await inspectCheckpointAsyncExecution(asyncLocation) : undefined;
+    const decodedAsync = storedAsync?.kind === 'unknown'
+        ? validateCheckpointAsync(await exportCheckpointProof(root.journal), storedAsync.proof) : undefined;
+    if (storedAsync?.kind === 'phase')
+        assertCapturedAsyncPlan(storedAsync.phase.plan, rootCapture);
+    const asyncRoot = decodedAsync && isAsyncOutcomeUnknown(decodedAsync)
+        ? { intents: 0, uncertain: 0, status: 'unknown', physicalUpperBound: decodedAsync.physicalCallUpperBound }
+        : storedAsync?.kind === 'phase' ? { intents: storedAsync.phase.state.intents.length,
+            uncertain: storedAsync.phase.state.uncertain.length,
+            status: storedAsync.phase.state.cutoffMs === undefined ? 'open' : 'sealed' }
+            : rootCapture.async && root.state.finalized
+                ? { intents: 0, uncertain: 0, status: 'missing', physicalUpperBound: rootCapture.async.maxPhysicalCalls }
+                : { intents: 0, uncertain: 0, status: 'absent' };
+    const async = run.kind === 'original' ? { current: asyncRoot, inherited: { intents: 0, uncertain: 0 } }
+        : { current: { intents: 0, uncertain: 0, status: 'absent' }, inherited: { intents: asyncRoot.intents,
+                uncertain: asyncRoot.uncertain, ...('physicalUpperBound' in asyncRoot ? { physicalUpperBound: asyncRoot.physicalUpperBound } : {}) } };
+    const health = seatStatus(run.plan, merged, capture.policy.fraction);
+    return freeze({ version: 1, scope: 'local_structural_status_only',
+        authorization: 'not_recovery_authorization_or_server_approval', target: request.target, runId: request.runId,
+        kind: run.kind, plan: { digest: run.plan.digest, headSha: run.plan.headSha, mergeBaseSha: run.plan.mergeBaseSha, patchSha256: run.plan.patchSha256 },
+        health, attempts: attempts(chain.runs.map(item => item.state), run.state, verifier, async), budget: run.budget, finalized: run.state.finalized, terminalArtifact, lineage: chain.lineage });
+}
+/** Plain local summary; it deliberately excludes prompts, results, errors and credentials. */
+export function formatReviewerStatus(status) {
+    const currentAsync = status.attempts.async.current;
+    const async = currentAsync.status === 'unknown'
+        ? `original async outcome unknown (up to ${currentAsync.physicalUpperBound} calls)`
+        : currentAsync.status === 'missing'
+            ? `original async evidence missing (captured upper bound ${currentAsync.physicalUpperBound} calls)`
+            : `${currentAsync.intents} current async calls (${currentAsync.uncertain} uncertain)`;
+    const inheritedAsync = status.attempts.async.inherited.physicalUpperBound === undefined ? ''
+        : `; inherited async outcome unknown (up to ${status.attempts.async.inherited.physicalUpperBound} calls reserved)`;
+    return `${status.target} run ${status.runId}: ${status.health.successfulSeats}/${status.health.minimumSuccessful} complete seats; ` +
+        `${status.attempts.physical} reviewer calls (${status.attempts.uncertain} uncertain); ` +
+        `${status.attempts.verifier.current.intents} current verifier calls; ` +
+        `${async}${inheritedAsync}; ` +
+        `${status.attempts.combined.physical} combined physical intents, ${status.attempts.combined.newOnly} current; ` +
+        `${status.finalized ? 'finalized' : 'open'}; terminal artifact ${status.terminalArtifact.available ? 'available' : 'unavailable'}.`;
+}
+/**
+ * Read-only proposal for a new successor. The proposed time budget is not a
+ * renewed operation deadline. Native ownership, current input identity, spent
+ * attempts and producer authority must be checked by the guarded launch.
+ */
+export async function inspectReviewerRecoveryPreview(input) {
+    const request = requireInput(input);
+    const proposedBudget = { maxAdditionalCalls: input.maxAdditionalCalls, maxAttemptsPerCell: input.maxAttemptsPerCell, timeBudgetMs: input.timeBudgetMs };
+    if (![proposedBudget.maxAdditionalCalls, proposedBudget.maxAttemptsPerCell].every(value => Number.isSafeInteger(value) && value >= 1 && value <= 1_000_000) ||
+        !Number.isSafeInteger(proposedBudget.timeBudgetMs) || proposedBudget.timeBudgetMs < 1 || proposedBudget.timeBudgetMs > MAX_TIMER_DELAY_MS) {
+        throw new Error('reviewer_preview_invalid_budget');
+    }
+    const chain = await loadReviewerLineage({ commonDir: request.commonDir, target: request.target, runId: request.runId });
+    const run = chain.latest;
+    requireReviewerLaneBinding(run.plan);
+    const inspected = run.inspected;
+    const proof = run.proof;
+    const merged = chainedState(chain.runs);
+    const attempts = chain.attempts;
+    const policy = resolveQuorumPolicy(blockingCheckpointSeatIds(run.plan).length, inspected.captured.policy.fraction);
+    const recovery = previewReviewerRecovery(checkpointRecoveryCells(run.plan), attempts, policy, {
+        ...proposedBudget, additionalCallsUsed: 0, remainingMs: proposedBudget.timeBudgetMs,
+    });
+    const health = seatStatus(run.plan, merged, inspected.captured.policy.fraction);
+    if (health.successfulSeats !== inspected.artifact.health.successfulSeats.length || health.minimumSuccessful !== inspected.artifact.health.policy.minimumSuccessful ||
+        health.conclusive !== inspected.artifact.health.conclusive)
+        throw new Error('reviewer_preview_health_mismatch');
+    return freeze({ version: 1, scope: 'local_structural_preview_only', authorization: 'not_recovery_authorization_or_server_approval',
+        target: request.target, runId: request.runId,
+        source: { reportSha256: run.terminal.reportSha256, checkpointSha256: proof.digest, capturedInputsSha256: run.captured.digest, planDigest: run.plan.digest },
+        proposedBudget, recovery,
+        eligibleAssignments: recovery.eligibleCallIndices.map(index => {
+            const cell = run.plan.cells[index];
+            return { cell: cell.id, seat: cell.seat, chunk: cell.chunk, model: cell.model, role: cell.role, route: cell.route };
+        }),
+    });
+}
+export function formatReviewerRecoveryPreview(preview) {
+    return `${preview.target} run ${preview.runId}: ${preview.recovery.successfulSeats}/${preview.recovery.policy.minimumSuccessful} complete seats; ` +
+        `${preview.recovery.successesNeeded} still needed; ${preview.eligibleAssignments.length} eligible missing chunks; ` +
+        `${preview.recovery.blockedCells.length} blocked chunks; next: ${preview.recovery.nextAction}. ` +
+        'Read-only proposal; a guarded launch must revalidate source, accounting and authority.';
+}
+//# sourceMappingURL=reviewer-status.js.map