@allocator-one/rcl 4.4.19

package/dist/report/reviewer-evidence.js

@@ -0,0 +1,229 @@
+import { z } from 'zod';
+import { decodeSupplementalAsync, isSupplementalAsync } from './supplemental-async.js';
+import { decodeOriginalReport } from '../evidence/original-run/decode.js';
+import { decodeCapturedInputs } from '../dispatch/captured-inputs.js';
+import { decodeCheckpointProof, isCheckpointProof } from '../dispatch/checkpoint.js';
+import { decodeOriginalLaunch } from '../dispatch/original-launch.js';
+import { MAX_ARTIFACT_BYTES } from '../telemetry/envelope-validation.js';
+import { decodeRecoveryOperation } from '../dispatch/recovery-operation.js';
+import { originalRunReportSchema } from '../telemetry/recovery/source.js';
+import { reviewerEvidenceDescriptorSchema, reviewerEvidenceSourceSchema } from './reviewer-evidence-schema.js';
+export { reviewerEvidenceDescriptorSchema } from './reviewer-evidence-schema.js';
+import { sha256Hex, stableStringify } from './run-header.js';
+/** Shared artifact limit; the complete serialized report must fit, not merely its proof. */
+export const MAX_REVIEWER_REPORT_BYTES = MAX_ARTIFACT_BYTES;
+export const MAX_REVIEWER_LINEAGE_DEPTH = 32;
+const inspected = new WeakSet();
+function freeze(value) {
+    if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const item of Object.values(value))
+            freeze(item);
+        Object.freeze(value);
+    }
+    return value;
+}
+function bound(bytes) {
+    if (typeof bytes !== 'string' || Buffer.byteLength(bytes, 'utf8') > MAX_REVIEWER_REPORT_BYTES ||
+        Buffer.from(bytes, 'utf8').toString('utf8') !== bytes)
+        throw new Error('reviewer_report_invalid_bytes');
+}
+function capturedProof(proof) {
+    if (!isCheckpointProof(proof))
+        throw new Error('reviewer_checkpoint_not_validated');
+    const bytes = proof.bindings['captured-inputs'];
+    if (bytes === undefined)
+        throw new Error('reviewer_checkpoint_missing_capture');
+    return decodeCapturedInputs(bytes, proof.plan);
+}
+/** Validate local launch bindings without treating its historical deadline as a new launch. */
+function originalLaunch(proof, captured) {
+    const bytes = proof.bindings.launch;
+    if (bytes === undefined)
+        return undefined;
+    if (proof.bindings.source !== undefined || proof.bindings.operation !== undefined) {
+        throw new Error('reviewer_mixed_launch_bindings');
+    }
+    const launch = decodeOriginalLaunch(bytes);
+    if (launch.target !== proof.plan.target || launch.planDigest !== proof.plan.digest ||
+        launch.capturedInputsSha256 !== captured.digest)
+        throw new Error('reviewer_original_launch_mismatch');
+    return launch;
+}
+/** Compact descriptor derived from the existing sealed journal, never its own report hash. */
+export function describeReviewerEvidence(proof, supplementalAsync) {
+    const captured = capturedProof(proof), launch = originalLaunch(proof, captured);
+    if (captured.aggregation && !isSupplementalAsync(supplementalAsync))
+        throw new Error('reviewer_missing_async_snapshot');
+    if (supplementalAsync && (!isSupplementalAsync(supplementalAsync) || !captured.aggregation)) {
+        throw new Error('reviewer_missing_aggregation_snapshot');
+    }
+    const base = { version: 1, checkpoint_schema: 1, plan_sha256: proof.plan.digest,
+        checkpoint_sha256: proof.digest, captured_inputs_sha256: captured.digest,
+        policy: { version: 1, fraction: captured.policy.fraction },
+        ...(captured.aggregation ? { aggregation_sha256: captured.aggregation.digest, supplemental_async_sha256: supplementalAsync.digest } : {}) };
+    const sourceBytes = proof.bindings.source, operationBytes = proof.bindings.operation;
+    if (sourceBytes === undefined && operationBytes === undefined)
+        return freeze({ ...base, kind: 'original',
+            ...(launch ? { launch_sha256: sha256Hex(proof.bindings.launch) } : {}) });
+    if (sourceBytes === undefined || operationBytes === undefined)
+        throw new Error('reviewer_successor_missing_bindings');
+    const operation = decodeRecoveryOperation(operationBytes);
+    let source;
+    try {
+        source = reviewerEvidenceSourceSchema.parse(JSON.parse(sourceBytes));
+    }
+    catch {
+        throw new Error('reviewer_invalid_source_binding');
+    }
+    if (stableStringify(source) !== sourceBytes || operation.target !== proof.plan.target ||
+        operation.planDigest !== proof.plan.digest || operation.capturedInputsSha256 !== captured.digest ||
+        source.run_id !== operation.sourceRunId || source.report_sha256 !== operation.sourceReportSha256 ||
+        source.checkpoint_sha256 !== operation.sourceCheckpointSha256)
+        throw new Error('reviewer_source_operation_mismatch');
+    return freeze({ ...base, kind: 'supplemented', source, operation_id: operation.operationId });
+}
+/** Exact local source reference; persists in the successor's existing journal before paid work. */
+export function reviewerSourceBinding(source) {
+    if (!inspected.has(source))
+        throw new Error('reviewer_report_not_inspected');
+    return stableStringify({ run_id: source.runId, report_sha256: source.reportSha256, checkpoint_sha256: source.proof.digest });
+}
+/**
+ * Inspect immutable artifact, capture and target bindings. This is deliberately
+ * not an approval/admission API: callers must additionally validate the complete
+ * ancestry, aggregation/contribution projections, server receipt, producer
+ * authority, successful-seat health and the current native launch claim.
+ */
+export function inspectReviewerEvidenceReport(reportBytes, expectedPlan, expectedPrTarget) {
+    bound(reportBytes);
+    const raw = decodeOriginalReport(reportBytes).value;
+    const report = originalRunReportSchema.safeParse(raw);
+    if (!report.success || !raw || typeof raw !== 'object')
+        throw new Error('reviewer_invalid_report');
+    const input = raw, rawRun = input.run;
+    const descriptor = reviewerEvidenceDescriptorSchema.safeParse(rawRun.reviewer_evidence);
+    const artifact = z.object({ checkpoint: z.string(), supplemental_async: z.string().optional() }).strict().safeParse(input.reviewerEvidence);
+    if (!descriptor.success || !artifact.success)
+        throw new Error('reviewer_report_missing_proof');
+    const proof = decodeCheckpointProof(artifact.data.checkpoint, expectedPlan);
+    const supplementalAsync = artifact.data.supplemental_async === undefined ? undefined : decodeSupplementalAsync(artifact.data.supplemental_async);
+    const actual = describeReviewerEvidence(proof, supplementalAsync);
+    if (stableStringify(actual) !== stableStringify(descriptor.data))
+        throw new Error('reviewer_descriptor_mismatch');
+    const captured = capturedProof(proof), run = report.data.run;
+    const target = assertReviewerRunBindings(run, proof, captured, expectedPrTarget);
+    const operation = actual.kind === 'supplemented' ? decodeRecoveryOperation(proof.bindings.operation) : undefined;
+    const launch = originalLaunch(proof, captured);
+    if (operation && operation.successorRunId !== run.id)
+        throw new Error('reviewer_report_successor_mismatch');
+    const result = freeze({ reportBytes, reportSha256: sha256Hex(reportBytes), runId: run.id, prTarget: target,
+        descriptor: actual, proof, captured, ...(operation ? { operation } : {}), ...(launch ? { launch } : {}),
+        ...(supplementalAsync ? { supplementalAsync } : {}),
+        ...(run.converge ? { nativeClaim: run.converge } : {}) });
+    inspected.add(result);
+    return result;
+}
+/** Check the original target and prepared inputs before aggregation can dispatch verification. */
+export function assertReviewerRunBindings(run, proof, captured, expectedPrTarget) {
+    if (!isCheckpointProof(proof) || proof.bindings['captured-inputs'] !== captured.bytes ||
+        captured.plan.digest !== proof.plan.digest)
+        throw new Error('reviewer_checkpoint_missing_capture');
+    const launch = originalLaunch(proof, captured);
+    if (launch && (run.id !== launch.runId || run.converge?.target !== launch.target ||
+        run.converge.attempt !== launch.originalNativeClaim.attempt || run.converge.round !== launch.originalNativeClaim.round)) {
+        throw new Error('reviewer_report_launch_mismatch');
+    }
+    const target = run.target.repo && run.target.pr_number ? `${run.target.repo.toLowerCase()}#${run.target.pr_number}` : undefined;
+    // Native convergence uses an opaque accounting key (for example rcl-105).
+    // Keep it distinct from the actual PR; neither key can replace the other.
+    const planPrTarget = /^[^/\s]+\/[^/#\s]+#[1-9]\d*$/.test(proof.plan.target)
+        ? proof.plan.target.toLowerCase() : undefined;
+    if (!target || (planPrTarget !== undefined ? target !== planPrTarget : run.converge?.target !== proof.plan.target) ||
+        expectedPrTarget !== undefined && target !== expectedPrTarget.toLowerCase() || run.target.head_sha !== proof.plan.headSha ||
+        run.target.diff_sha256 !== proof.plan.patchSha256 || run.config_sha256 !== proof.plan.configSha256 ||
+        run.converge && run.converge.target !== proof.plan.target)
+        throw new Error('reviewer_report_target_mismatch');
+    // base_sha is an observed upstream tip, not the captured effective merge base.
+    // expectedPlan supplies the independently refreshed material-input comparison.
+    const roster = run.roster.filter(seat => seat.lane === 'blocking' || seat.lane === 'secondary')
+        .map(seat => ({ model: seat.model, role: seat.role, route: seat.provider,
+        ...(proof.plan.version === 2 ? { lane: seat.lane } : {}) }));
+    if (stableStringify(roster) !== stableStringify(proof.plan.roster.map(({ model, role, route, lane }) => ({ model, role, route,
+        ...(proof.plan.version === 2 ? { lane } : {}) })))) {
+        throw new Error('reviewer_report_roster_mismatch');
+    }
+    if (captured.async) {
+        const asyncRoster = run.roster.filter(row => row.lane === 'async');
+        const expected = proof.plan.chunks.flatMap(chunk => asyncRoster.map(row => ({ chunk: chunk.index, model: row.model, role: row.role, provider: row.provider }))).slice(0, 8);
+        const actual = captured.async.calls.map(({ ref }) => ({ chunk: ref.chunk, model: ref.model, role: ref.role, provider: ref.provider }));
+        if (stableStringify(actual) !== stableStringify(expected))
+            throw new Error('reviewer_report_async_roster_mismatch');
+    }
+    if ((run.spec?.sha256 ?? sha256Hex('')) !== proof.plan.specSha256)
+        throw new Error('reviewer_report_spec_mismatch');
+    const context = JSON.parse(captured.contextBytes);
+    if (stableStringify(run.context_files) !== stableStringify(context.map(doc => ({ path: doc.label, sha256: doc.sha256 })))) {
+        throw new Error('reviewer_report_context_mismatch');
+    }
+    return target;
+}
+/** Validates a report-shaped chain. The caller separately establishes how each pair was inspected. */
+function validateChain(reports) {
+    if (reports.length === 0 || reports.length > MAX_REVIEWER_LINEAGE_DEPTH)
+        throw new Error('reviewer_lineage_depth');
+    const runIds = new Set(), operationIds = new Set();
+    let previous;
+    for (const report of reports) {
+        const id = report.runId.toLowerCase();
+        if (runIds.has(id))
+            throw new Error('reviewer_lineage_duplicate_run');
+        runIds.add(id);
+        if (!previous) {
+            if (report.descriptor.kind !== 'original')
+                throw new Error('reviewer_lineage_missing_origin');
+        }
+        else {
+            if (report.descriptor.kind !== 'supplemented' || !report.operation)
+                throw new Error('reviewer_lineage_missing_source');
+            if (report.asyncExecution?.bytes !== previous.asyncExecution?.bytes || report.asyncExecution?.digest !== previous.asyncExecution?.digest)
+                throw new Error('reviewer_lineage_async_execution_mismatch');
+            if (report.supplementalAsync?.digest !== previous.supplementalAsync?.digest)
+                throw new Error('reviewer_lineage_async_mismatch');
+            if (report.prTarget !== previous.prTarget)
+                throw new Error('reviewer_lineage_target_mismatch');
+            const source = report.descriptor.source, operation = report.operation;
+            if (source.run_id !== previous.runId || source.report_sha256 !== previous.reportSha256 || source.checkpoint_sha256 !== previous.proof.digest ||
+                report.proof.plan.digest !== previous.proof.plan.digest || report.captured.digest !== previous.captured.digest) {
+                throw new Error('reviewer_lineage_source_mismatch');
+            }
+            const root = reports[0];
+            if (operation.originalNativeClaim.attempt !== root.nativeClaim?.attempt ||
+                operation.originalNativeClaim.round !== root.nativeClaim?.round ||
+                !operation.successorNativeClaim ||
+                operation.successorNativeClaim.attempt !== report.nativeClaim?.attempt ||
+                operation.successorNativeClaim.round !== report.nativeClaim?.round)
+                throw new Error('reviewer_lineage_native_claim_mismatch');
+            if (operationIds.has(operation.operationId.toLowerCase()))
+                throw new Error('reviewer_lineage_duplicate_operation');
+            operationIds.add(operation.operationId.toLowerCase());
+        }
+        previous = report;
+    }
+    return Object.freeze([...reports]);
+}
+/** Runtime inline-inspection provenance only; never producer/server authority. */
+export function isInspectedReviewerReport(value) {
+    return typeof value === 'object' && value !== null && inspected.has(value);
+}
+/** Validate oldest-to-newest immutable report evidence. */
+export function validateReviewerReportChain(reports) {
+    for (const report of reports)
+        if (!inspected.has(report))
+            throw new Error('reviewer_report_not_inspected');
+    return validateChain(reports);
+}
+/** Validate separately retained private artifact pairs without fabricating inline evidence. */
+export function validateInspectedReviewerArtifactChain(reports) {
+    return Object.freeze([...validateChain(reports)]);
+}
+//# sourceMappingURL=reviewer-evidence.js.map

package/dist/report/reviewer-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-evidence.js","sourceRoot":"","sources":["../../src/report/reviewer-evidence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAA0B,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAA+B,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAmD,MAAM,2BAA2B,CAAC;AACtI,OAAO,EAAE,oBAAoB,EAAuB,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAA0B,MAAM,mCAAmC,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAgE,MAAM,+BAA+B,CAAC;AAC7K,OAAO,EAAE,gCAAgC,EAAmC,MAAM,+BAA+B,CAAC;AAClH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAE7E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;AAkBxC,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,yBAAyB;QAC3F,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChF,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,KAAsB,EAAE,QAAgC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QAChF,MAAM,CAAC,oBAAoB,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACxG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB,CAAC,KAAsB,EAAE,iBAAqC;IACpG,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACxH,IAAI,iBAAiB,IAAI,CAAC,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,iBAAiB,EAAE,CAAU,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;QAC/F,iBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM;QACxE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,yBAAyB,EAAE,iBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/I,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrF,IAAI,WAAW,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU;YACtG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,WAAW,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACtH,MAAM,SAAS,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC1D,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;IAC7D,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QACnF,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,oBAAoB,KAAK,QAAQ,CAAC,MAAM;QAChG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,kBAAkB;QAChG,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvH,OAAO,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACnE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7E,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EAAE,YAAmC,EAAE,gBAAyB;IAEnF,KAAK,CAAC,WAAW,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,GAA8B,EAAE,MAAM,GAAG,KAAK,CAAC,GAA8B,CAAC;IAC5F,MAAM,UAAU,GAAG,gCAAgC,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5I,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjJ,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,SAAS,IAAI,SAAS,CAAC,cAAc,KAAK,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM;QACxG,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,yBAAyB,CACvC,GAAiI,EACjI,KAAsB,EAAE,QAAgC,EAAE,gBAAyB;IAEnF,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,KAAK;QACnF,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM;QAC9E,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,mBAAmB,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1H,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChI,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,YAAY,GAAG,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QACzE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChH,gBAAgB,KAAK,SAAS,IAAI,MAAM,KAAK,gBAAgB,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO;QACzH,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY;QAClG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAChH,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;SAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ;QACtE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;QAC3H,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CACxE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACvI,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACpH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAA6C,CAAC;IAC9F,IAAI,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,SAAS,aAAa,CAAoC,OAAqB;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,0BAA0B;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,EAAE,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACnE,IAAI,QAA6C,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvH,IAAI,MAAM,CAAC,cAAc,EAAE,KAAK,KAAK,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,MAAM,KAAK,QAAQ,CAAC,cAAc,EAAE,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvM,IAAI,MAAM,CAAC,iBAAiB,EAAE,MAAM,KAAK,QAAQ,CAAC,iBAAiB,EAAE,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAChI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACtE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;gBAC1I,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACjH,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YACzB,IAAI,SAAS,CAAC,mBAAmB,CAAC,OAAO,KAAK,IAAI,CAAC,WAAW,EAAE,OAAO;gBACrE,SAAS,CAAC,mBAAmB,CAAC,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,KAAK;gBAC/D,CAAC,SAAS,CAAC,oBAAoB;gBAC/B,SAAS,CAAC,oBAAoB,CAAC,OAAO,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO;gBACtE,SAAS,CAAC,oBAAoB,CAAC,KAAK,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAChI,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACnH,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,2BAA2B,CAAC,OAA2C;IACrF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC3G,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sCAAsC,CAAoC,OAAqB;IAC7G,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/report/reviewer-health.d.ts

@@ -0,0 +1,62 @@
+import type { ModelReview } from '../consensus/types.js';
+import { type QuorumPolicy } from '../dispatch/quorum.js';
+/** Structural view of every original synchronous assignment and its frozen lane. */
+export interface ReviewerHealthPlan {
+    version: 1 | 2;
+    roster: Array<{
+        seat: string;
+        model: string;
+        role: string;
+        route: string;
+        lane?: 'blocking' | 'secondary';
+    }>;
+    chunks: Array<{
+        index: number;
+        total: number;
+        digest: string;
+    }>;
+    cells: Array<{
+        id: string;
+        seat: string;
+        chunk: number;
+        model: string;
+        role: string;
+        route: string;
+        chunkDigest: string;
+    }>;
+}
+/** One selected, durably accepted outcome per original cell, retained or new. */
+export interface SelectedReviewerResult {
+    cell: string;
+    review: ModelReview;
+}
+declare const validatedReviewerHealth: unique symbol;
+/**
+ * An immutable local projection, not a substitute for persisted source proof.
+ * Readers of serialized reports must validate their proof and derive it again.
+ */
+export interface ReviewerHealth {
+    readonly [validatedReviewerHealth]: true;
+    readonly version: 1;
+    readonly policy: QuorumPolicy;
+    readonly successfulSeats: readonly string[];
+    readonly incompleteSeats: readonly string[];
+    readonly conclusive: boolean;
+}
+/** Refuse caller-invented counts, thresholds, and deserialized projections. */
+export declare function assertReviewerHealth(value: unknown): asserts value is ReviewerHealth;
+/**
+ * Derive health from complete original seat/chunk identities, never result count.
+ * The caller first verifies checkpoint provenance, original plan identity and
+ * selected outcome bytes. This pure projection checks matrix completeness and
+ * outcome attribution; it cannot establish provider truth or source authority.
+ * Async/verifier rows remain outside this synchronous plan and must not be passed.
+ * Policy version/fraction are explicit; legacy waiting configuration is not used.
+ */
+export declare function deriveReviewerCoverage(plan: ReviewerHealthPlan, selectedResults: readonly SelectedReviewerResult[], policy: Pick<QuorumPolicy, 'version' | 'fraction'>): {
+    health: ReviewerHealth;
+    completeSeats: readonly string[];
+};
+/** Blocking quorum is separate from the complete synchronous contribution set. */
+export declare function deriveReviewerHealth(plan: ReviewerHealthPlan, selectedResults: readonly SelectedReviewerResult[], policy: Pick<QuorumPolicy, 'version' | 'fraction'>): ReviewerHealth;
+export {};

package/dist/report/reviewer-health.js

@@ -0,0 +1,105 @@
+import { hasSuccessfulQuorum, resolveQuorumPolicy } from '../dispatch/quorum.js';
+const validated = new WeakSet();
+const statuses = new Set(['success', 'timeout', 'error', 'parse_failed', 'canceled']);
+function text(value) {
+    return typeof value === 'string' && value.trim().length > 0 && !/[\0\r\n]/.test(value);
+}
+/** Refuse caller-invented counts, thresholds, and deserialized projections. */
+export function assertReviewerHealth(value) {
+    if (value === null || typeof value !== 'object' || !validated.has(value)) {
+        throw new Error('Reviewer health must be derived from a validated original matrix');
+    }
+}
+/**
+ * Derive health from complete original seat/chunk identities, never result count.
+ * The caller first verifies checkpoint provenance, original plan identity and
+ * selected outcome bytes. This pure projection checks matrix completeness and
+ * outcome attribution; it cannot establish provider truth or source authority.
+ * Async/verifier rows remain outside this synchronous plan and must not be passed.
+ * Policy version/fraction are explicit; legacy waiting configuration is not used.
+ */
+export function deriveReviewerCoverage(plan, selectedResults, policy) {
+    if (policy?.version !== 1 || typeof policy.fraction !== 'number') {
+        throw new Error('Invalid reviewer health policy version or fraction');
+    }
+    if ((plan?.version !== 1 && plan?.version !== 2) || !Array.isArray(plan.roster) || !Array.isArray(plan.chunks) ||
+        !Array.isArray(plan.cells) || !Array.isArray(selectedResults) || plan.chunks.length === 0) {
+        throw new Error('Invalid frozen reviewer matrix');
+    }
+    const roster = new Map();
+    for (const seat of plan.roster) {
+        if (!seat || !text(seat.seat) || !text(seat.model) || !text(seat.role) || !text(seat.route)) {
+            throw new Error('Invalid frozen reviewer seat');
+        }
+        if (plan.version === 2 ? seat.lane !== 'blocking' && seat.lane !== 'secondary' : seat.lane !== undefined) {
+            throw new Error('Invalid frozen reviewer lane binding');
+        }
+        if (roster.has(seat.seat))
+            throw new Error('Duplicate frozen reviewer seat');
+        roster.set(seat.seat, seat);
+    }
+    const blocking = [...roster.values()].filter(seat => plan.version === 1 || seat.lane === 'blocking');
+    const resolved = resolveQuorumPolicy(blocking.length, policy.fraction);
+    const chunks = new Map();
+    for (const chunk of plan.chunks) {
+        if (!chunk || !Number.isSafeInteger(chunk.index) || chunk.index < 0 || chunk.index >= plan.chunks.length ||
+            chunk.total !== plan.chunks.length || !/^[a-f0-9]{64}$/.test(chunk.digest) || chunks.has(chunk.index)) {
+            throw new Error('Invalid or duplicate frozen reviewer chunk');
+        }
+        chunks.set(chunk.index, chunk.digest);
+    }
+    const expectedCount = roster.size * chunks.size;
+    if (!Number.isSafeInteger(expectedCount) || plan.cells.length !== expectedCount) {
+        throw new Error('Incomplete frozen reviewer matrix');
+    }
+    const cells = new Map();
+    const pairs = new Set();
+    for (const cell of plan.cells) {
+        const seat = cell && roster.get(cell.seat);
+        if (!cell || !text(cell.id) || !seat || !chunks.has(cell.chunk) || cell.chunkDigest !== chunks.get(cell.chunk) ||
+            cell.model !== seat.model || cell.role !== seat.role || cell.route !== seat.route) {
+            throw new Error('Invalid frozen reviewer cell binding');
+        }
+        const pair = JSON.stringify([cell.seat, cell.chunk]);
+        if (cells.has(cell.id) || pairs.has(pair))
+            throw new Error('Duplicate frozen reviewer cell');
+        cells.set(cell.id, cell);
+        pairs.add(pair);
+    }
+    const selected = new Set();
+    const successes = new Map();
+    for (const result of selectedResults) {
+        const cell = result && cells.get(result.cell);
+        const review = result?.review;
+        if (!cell || !review || review.model !== cell.model || review.role !== cell.role || review.provider !== cell.route ||
+            review.async !== undefined && review.async !== false || !statuses.has(review.status) ||
+            !Array.isArray(review.findings) || !Number.isFinite(review.durationMs) || review.durationMs < 0) {
+            throw new Error('Invalid selected reviewer result binding, lane or outcome');
+        }
+        if (selected.has(result.cell))
+            throw new Error('Duplicate selected reviewer cell');
+        selected.add(result.cell);
+        if (review.status === 'success')
+            successes.set(cell.seat, (successes.get(cell.seat) ?? 0) + 1);
+    }
+    const successfulSeats = [];
+    const incompleteSeats = [];
+    const completeSeats = [...roster.keys()].filter(seat => successes.get(seat) === chunks.size);
+    for (const { seat } of blocking) {
+        (successes.get(seat) === chunks.size ? successfulSeats : incompleteSeats).push(seat);
+    }
+    const health = Object.freeze({
+        version: 1,
+        policy: Object.freeze(resolved),
+        successfulSeats: Object.freeze(successfulSeats),
+        incompleteSeats: Object.freeze(incompleteSeats),
+        conclusive: hasSuccessfulQuorum(resolved, successfulSeats.length),
+    });
+    validated.add(health);
+    return Object.freeze({ health, completeSeats: Object.freeze(completeSeats) });
+}
+/** Blocking quorum is separate from the complete synchronous contribution set. */
+export function deriveReviewerHealth(plan, selectedResults, policy) {
+    return deriveReviewerCoverage(plan, selectedResults, policy).health;
+}
+//# sourceMappingURL=reviewer-health.js.map

package/dist/report/reviewer-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-health.js","sourceRoot":"","sources":["../../src/report/reviewer-health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAqB,MAAM,uBAAuB,CAAC;AA+BpG,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;AACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAwB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAE7G,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAwB,EACxB,eAAkD,EAClD,MAAkD;IAElD,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5G,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YACtG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+C,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5G,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC7F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK;YAChH,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YACpF,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnF,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7F,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,CAAU;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC/C,UAAU,EAAE,mBAAmB,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC;KAClE,CAAmB,CAAC;IACrB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,IAAwB,EAAE,eAAkD,EAC/G,MAAkD;IAClD,OAAO,sBAAsB,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC"}

package/dist/report/run-header.d.ts

@@ -0,0 +1,219 @@
+import type { RecoverySource } from './recovery-source.js';
+import type { Config } from '../config/schema.js';
+import type { ResolvedGatingConfig } from '../consensus/gating.js';
+import type { Diff, FileChange } from '../resolver/types.js';
+import type { ReviewAssignment } from '../roles/types.js';
+import type { ReviewerEvidenceDescriptor } from './reviewer-evidence.js';
+/**
+ * The self-describing report header (evidence ledger, epic IO-12475
+ * section 5.1). Written INSIDE the report JSON as `ReviewResult.run`, so a
+ * report on disk says which commit it reviewed, with which roster and
+ * settings, without any network behavior. Field names are the wire contract
+ * Harness ingests, hence snake_case here while the rest of the report keeps
+ * its camelCase history.
+ *
+ * Every field is allow-listed by construction: the builder receives exactly
+ * the values it records and never sees `process.env` or a config object it
+ * would echo verbatim (the config becomes a digest; the GitHub token is
+ * excluded from even that).
+ */
+export type TargetKind = 'pr' | 'patch' | 'staged' | 'working_tree' | 'plan';
+export type RosterLane = 'blocking' | 'secondary' | 'async' | 'verification';
+export type RunnerKind = 'agent' | 'ci' | 'human';
+export type SpecSource = 'flag' | 'repo_file' | `harness_issue:${string}`;
+export interface RosterEntry {
+    model: string;
+    role: string;
+    provider: string;
+    lane: RosterLane;
+}
+export interface RunTarget {
+    kind: TargetKind;
+    repo?: string;
+    pr_number?: number;
+    url?: string;
+    head_sha?: string;
+    base_sha?: string;
+    head_ref?: string;
+    base_ref?: string;
+    /** SHA-256 over the canonical file/patch serialization (see diffDigest). */
+    diff_sha256: string;
+    files: number;
+    additions: number;
+    deletions: number;
+}
+export interface RunnerClaim {
+    kind: RunnerKind;
+    agent?: string;
+    ci_run_id?: string;
+    host?: string;
+}
+export interface ConvergeContext {
+    /** Versioned local predecessor commitment, present only on recovered-v3 production.
+     * It cannot confer attestation; ordinary admission verifies it under target ownership. */
+    recovery_source?: RecoverySource;
+    target: string;
+    round?: number;
+    attempt?: number;
+    cycleId?: string;
+}
+export interface RunHeader {
+    /** Client UUIDv7 — the idempotency key for delivery retries. */
+    id: string;
+    rcl_version: string;
+    command: 'review' | 'review-plan';
+    target: RunTarget;
+    roster: RosterEntry[];
+    config_sha256: string;
+    thresholds: {
+        min_consensus_score: number;
+        min_confidence: number;
+        dedupe_line_window: number;
+        jaccard_threshold: number;
+    };
+    gating: {
+        mode: ResolvedGatingConfig['mode'];
+        bound_classification_protocol?: 1;
+        min_models: number;
+        verification_model?: string;
+        verification_reasoning_effort?: ResolvedGatingConfig['verificationReasoningEffort'];
+        verification_timeout_ms: number;
+        verification_pass_timeout_ms?: number;
+    };
+    spec?: {
+        source: SpecSource;
+        sha256: string;
+    };
+    context_files: Array<{
+        path: string;
+        sha256: string;
+    }>;
+    /** review-plan only: the effective focus mode, which shapes the prompts. */
+    plan?: {
+        focus: string;
+    };
+    /** Best-effort environment claim; the credential's user is the authority. */
+    runner: RunnerClaim;
+    started_at: string;
+    finished_at: string;
+    duration_ms: number;
+    /** Computed even without --ci so the gate verdict is recorded uniformly. */
+    ci_exit_code: number;
+    converge?: Omit<ConvergeContext, 'cycleId'>;
+    cycle_id?: string;
+    /** `backfill` for recovered history (`rcl telemetry backfill`); absent means live. */
+    provenance?: 'live' | 'backfill';
+    /** Original immutable modern report, only on a non-gating historical import. */
+    historical_source?: {
+        original_run_id: string;
+        report_sha256: string;
+    };
+    /** Compact binding only; raw prompts and results stay in the private artifact. */
+    reviewer_evidence?: ReviewerEvidenceDescriptor;
+}
+export interface ResolvedThresholds {
+    minConsensusScore: number;
+    minConfidence: number;
+    dedupeLineWindow: number;
+    jaccardThreshold: number;
+}
+export interface RunHeaderInput {
+    cycleId?: string;
+    id?: string;
+    rclVersion: string;
+    command: RunHeader['command'];
+    target: {
+        kind: TargetKind;
+        repo?: string;
+        prNumber?: number;
+        url?: string;
+        headSha?: string;
+        baseSha?: string;
+        headRef?: string;
+        baseRef?: string;
+    };
+    diff: Diff;
+    roster: RosterEntry[];
+    config: Config;
+    thresholds: ResolvedThresholds;
+    gating: ResolvedGatingConfig;
+    spec?: {
+        source: SpecSource;
+        sha256: string;
+    };
+    contextFiles?: Array<{
+        path: string;
+        sha256: string;
+    }>;
+    plan?: {
+        focus: string;
+    };
+    runner: RunnerClaim;
+    startedAt: Date;
+    finishedAt: Date;
+    ciExitCode: number;
+    converge?: ConvergeContext;
+}
+export declare function sha256Hex(data: string | Buffer): string;
+/**
+ * JSON with object keys sorted at every level, so digests ignore key order.
+ * Values JSON cannot express (undefined, functions, symbols) serialize as
+ * `null` — the same as `JSON.stringify` does for them inside arrays — so the
+ * result is always a string and never the bare `undefined` JSON.stringify
+ * returns for a top-level non-value.
+ */
+export declare function stableStringify(value: unknown): string;
+export declare function guardedInputSha256(value: Record<string, unknown>): string;
+/**
+ * Digest of what the council actually read: every file's name, status,
+ * previous name and patch, sorted by filename so the value is independent of
+ * listing order. The serialization is JSON — every field delimited and
+ * escaped — so two distinct diffs cannot collide by sharing a separator
+ * character in a filename or patch line. Uniform across PR, patch, git and
+ * plan modes (PR mode has no raw diff).
+ */
+export declare function diffDigest(files: readonly FileChange[]): string;
+/** Config fields that are credentials: never part of any digest. */
+export declare const EXCLUDED_CONFIG_FIELDS: readonly ["githubToken", "harness"];
+/**
+ * The config fields the digest covers — an explicit allow-list. Every key of
+ * `ConfigSchema` must appear either here or in `EXCLUDED_CONFIG_FIELDS`: the
+ * exhaustiveness assertion below turns a new field into a compile error until
+ * someone decides which list it belongs to, so a new setting can neither be
+ * silently dropped from the digest nor a new credential silently hashed.
+ */
+export declare const DIGESTED_CONFIG_FIELDS: readonly ["models", "secondaryModels", "asyncModels", "roles", "reviewers", "customRoles", "thresholds", "gating", "output", "timeout", "asyncTimeout", "quorumFraction", "maxRetries", "concurrency", "providerConcurrency", "reasoningEffort", "context", "spec", "focus"];
+/** Canonical allow-listed, resolved config fields (never a credential). */
+export declare function configIdentity(config: Config): string;
+/** Digest shared by report headers, launch identity and original-policy proof. */
+export declare function configDigest(config: Config): string;
+/** A dispatched seat's lane: the council's own models block, the others are secondary. */
+export declare function assignmentLane(model: string, coreModels: readonly string[], explicit?: boolean): 'blocking' | 'secondary';
+export declare function buildRoster(input: {
+    assignments: readonly ReviewAssignment[];
+    asyncAssignments: readonly ReviewAssignment[];
+    /** The blocking council's own models (`config.models`); others are secondary. */
+    coreModels: readonly string[];
+    /** Explicit --reviewer pairs are exact manual control: all blocking. */
+    explicit?: boolean;
+    gating: ResolvedGatingConfig;
+}): RosterEntry[];
+export declare function detectRunner(env: Readonly<Record<string, string | undefined>>, hostname: string): RunnerClaim;
+export declare function parseSpecSource(value: string): SpecSource;
+/** A full Git object id: SHA-1 (40 hex) or SHA-256 repositories (64 hex). */
+export declare const FULL_OBJECT_ID: RegExp;
+/** Exact-head binding needs the full object id; abbreviations are ambiguous. */
+export declare function validateSha(value: string, flag: string): string;
+/**
+ * The converge loop's context for this round. Flags win over the
+ * `RCL_CONVERGE_*` environment the rcl-converge skill exports; without a
+ * target there is no converge context at all.
+ */
+export declare function resolveConvergeContext(flags: {
+    convergeTarget?: string;
+    round?: string;
+    attempt?: string;
+}, env: Readonly<Record<string, string | undefined>>): ConvergeContext | undefined;
+/** One human-readable phrase for status lines and the Markdown header. */
+export declare function describeRunTarget(target: RunTarget): string;
+export declare function buildRunHeader(input: RunHeaderInput): RunHeader;