@allocator-one/rcl 4.4.19

package/dist/telemetry/deliver.js

@@ -0,0 +1,662 @@
+import { cosmiconfig } from 'cosmiconfig';
+import { join } from 'path';
+import { SEARCH_PLACES } from '../config/loader.js';
+import { HarnessSchema } from '../config/schema.js';
+import { resolveDataDir } from '../config/data-dir.js';
+import { credentialHost, resolveHarnessCredential } from './credentials.js';
+import { declareReviewerRecovery, buildRunEnvelope } from './envelope.js';
+import { validateRunEnvelope } from './envelope-validation.js';
+import { Quarantine, QUARANTINE_DIR } from './quarantine.js';
+import { deliverable } from './events.js';
+import { ensureNoticeShown } from './notice.js';
+import { Outbox, OUTBOX_DIR } from './outbox.js';
+import { scrubText } from './scrub.js';
+import { describeOutcome, HarnessSink, validateEnvelopeTimeoutMs } from './sink.js';
+import { isReviewerArtifact } from '../report/reviewer-artifact.js';
+import { sha256Hex } from '../report/run-header.js';
+import { ReviewerDeliveryQueue } from './reviewer-delivery.js';
+import { parseAttestedExpiry, recoverAttestedDelivery } from './attested-retry.js';
+import { verifiedConsensusReportProblem } from './report-consistency.js';
+import { AttestedReviewerDelivery } from './attested-reviewer-delivery.js';
+/**
+ * Evidence delivery for a finished review and for the converge commands
+ * (epic IO-12475, section 8): resolve where the evidence goes, send it,
+ * spool what could not be sent, and say in one dim line what happened.
+ * Delivery never blocks a review on the network beyond its own timeouts,
+ * never changes the review's result, and never turns a local failure of its
+ * own (a read-only data dir, a torn file) into a failed review — only
+ * `--evidence-required` turns an unacknowledged delivery into an exit code.
+ */
+export const STARTUP_FLUSH_DEADLINE_MS = 5_000;
+export const EVIDENCE_REQUIRED_EXIT_CODE = 4;
+const ENV_OFF = new Set(['off', '0', 'false', 'no', 'none', 'disabled']);
+const LEVELS = new Set(['off', 'envelope', 'findings', 'full']);
+/**
+ * What `RCL_TELEMETRY` asks for: `off` (also `0`, `false`, `no`), a level
+ * name, or nothing when unset. A value that is set but not understood is a
+ * failed opt-out and reads as `off` — never as the default.
+ */
+export function envTelemetryLevel(env) {
+    const raw = (env['RCL_TELEMETRY'] ?? '').trim().toLowerCase();
+    if (raw === '')
+        return undefined;
+    if (ENV_OFF.has(raw))
+        return 'off';
+    return LEVELS.has(raw) ? raw : 'off';
+}
+/**
+ * Why `--evidence-required` cannot be honored, or undefined when it can:
+ * evidence cannot be required and withheld at the same time. The flag and
+ * the environment are known up front; the project config once loaded.
+ */
+export function evidenceRequirementConflict(opts, config, env) {
+    if (!opts.evidenceRequired)
+        return undefined;
+    if (opts.telemetry === false)
+        return '--evidence-required contradicts --no-telemetry: evidence cannot be required and withheld.';
+    if (envTelemetryLevel(env) === 'off')
+        return '--evidence-required contradicts RCL_TELEMETRY=off: evidence cannot be required and withheld.';
+    if (config?.harness?.telemetry === 'off') {
+        return '--evidence-required contradicts harness.telemetry: off in the project config: evidence cannot be required and withheld.';
+    }
+    return undefined;
+}
+/** `--no-telemetry` wins, then `RCL_TELEMETRY`, then `harness.telemetry`; default `full`. */
+export function resolveTelemetryLevel(config, flags, env) {
+    if (flags.noTelemetry)
+        return 'off';
+    return envTelemetryLevel(env) ?? config?.harness?.telemetry ?? 'full';
+}
+/**
+ * The `harness` section of the project's config file, read without the
+ * full loader (whose fleet degradation warns on stderr — noise no startup
+ * flush should print). A missing or unusable file reads as no settings;
+ * `configPath` (`--config`) names the file instead of searching from `cwd`,
+ * and one that cannot be read fails closed like an unparseable section.
+ */
+export async function loadHarnessSettings(cwd, configPath) {
+    try {
+        const explorer = cosmiconfig('review-council', { searchPlaces: SEARCH_PLACES });
+        const found = configPath !== undefined ? await explorer.load(configPath) : await explorer.search(cwd);
+        if (!found || found.isEmpty || typeof found.config !== 'object' || found.config === null)
+            return undefined;
+        const harness = found.config.harness;
+        if (harness === undefined)
+            return {};
+        const parsed = HarnessSchema.safeParse(harness);
+        // A harness section that does not parse fails closed: an opt-out the
+        // user wrote next to a typo must still hold.
+        return parsed.success ? { harness: parsed.data } : { harness: { telemetry: 'off' } };
+    }
+    catch {
+        // A file that exists but cannot be read or parsed may hold an opt-out
+        // behind a syntax error: fail closed, as for an unparseable section.
+        return { harness: { telemetry: 'off' } };
+    }
+}
+export async function createTelemetryRuntime(options) {
+    if (options.envelopeTimeoutMs !== undefined)
+        validateEnvelopeTimeoutMs(options.envelopeTimeoutMs);
+    const env = options.env ?? process.env;
+    const cwd = options.cwd ?? process.cwd();
+    const dataDir = options.dataDir ?? resolveDataDir(env);
+    const config = options.config ?? (await loadHarnessSettings(cwd));
+    const level = resolveTelemetryLevel(config, { noTelemetry: options.noTelemetry }, env);
+    const runtime = {
+        level,
+        repoManaged: false,
+        parseFailures: config?.harness?.parseFailures === true,
+        outbox: new Outbox(join(dataDir, OUTBOX_DIR)),
+        quarantine: new Quarantine(join(dataDir, QUARANTINE_DIR)),
+        dataDir,
+        rclVersion: options.rclVersion,
+        stderr: options.stderr ?? ((line) => process.stderr.write(`${line}\n`)),
+    };
+    if (level === 'off')
+        return runtime;
+    if (options.credential) {
+        runtime.repoManaged = true;
+        runtime.credential = options.credential;
+        runtime.attested = options.credential.source === 'attest';
+        runtime.attestedExpiresAt = options.attestedExpiresAt;
+        runtime.sink = new HarnessSink({
+            credential: options.credential,
+            rclVersion: options.rclVersion,
+            ...(options.envelopeTimeoutMs !== undefined ? { envelopeTimeoutMs: options.envelopeTimeoutMs } : {}),
+            ...(options.attestedExpiresAt !== undefined ? { attestedExpiresAt: options.attestedExpiresAt } : {}),
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        });
+        return runtime;
+    }
+    const resolved = await resolveHarnessCredential({
+        env,
+        cwd,
+        ...(options.credentialsPath !== undefined ? { credentialsPath: options.credentialsPath } : {}),
+        ...(options.requireRepo !== undefined ? { requireRepo: options.requireRepo } : {}),
+    });
+    runtime.repoManaged = resolved.repoManaged;
+    if (!resolved.repoManaged && options.requireRepo !== false) {
+        // Not a Harness-managed repository: there is nowhere the evidence belongs.
+        return { ...runtime, level: 'off' };
+    }
+    if (resolved.note !== undefined)
+        runtime.note = resolved.note;
+    if (resolved.credential) {
+        runtime.credential = resolved.credential;
+        runtime.sink = new HarnessSink({
+            credential: resolved.credential,
+            rclVersion: options.rclVersion,
+            ...(options.envelopeTimeoutMs !== undefined ? { envelopeTimeoutMs: options.envelopeTimeoutMs } : {}),
+            ...(options.attestedExpiresAt !== undefined ? { attestedExpiresAt: options.attestedExpiresAt } : {}),
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        });
+    }
+    return runtime;
+}
+/**
+ * The consent notice precedes the first transmission from this machine to a
+ * host, whatever the transmission is — a run, a converge event, or a flush of
+ * something spooled earlier. A notice that cannot be recorded shows again
+ * next time; it is never a failure.
+ */
+// Persistence failures are absorbed inside `ensureNoticeShown` (shown, not
+// recorded — it shows again next time); anything that escapes means the
+// notice itself could not be written, and nothing is transmitted then.
+async function noticeBefore(runtime, scope = 'ordinary') {
+    if (!runtime.credential)
+        return;
+    await ensureNoticeShown(credentialHost(runtime.credential), runtime.dataDir, runtime.stderr, scope);
+}
+/** Flush the outbox through the runtime's sink, the notice shown first. */
+export async function flushOutbox(runtime, options = {}) {
+    if (!runtime.sink)
+        throw new Error('No Harness credential to flush with.');
+    await noticeBefore(runtime);
+    const started = performance.now();
+    const ordinary = await runtime.outbox.flush(runtime.sink, options);
+    if (runtime.level !== 'full' || runtime.attested)
+        return ordinary;
+    const remaining = options.deadlineMs === undefined ? undefined : Math.max(0, options.deadlineMs - (performance.now() - started));
+    const privateResult = await new ReviewerDeliveryQueue(runtime.dataDir).flush(runtime.sink, { ...options, deadlineMs: remaining }, () => noticeBefore(runtime, 'private-reviewers'));
+    return { ...ordinary, delivered: [...ordinary.delivered, ...privateResult.delivered], remaining: [...ordinary.remaining, ...privateResult.remaining],
+        failed: [...ordinary.failed, ...privateResult.failed], dropped: [...ordinary.dropped, ...privateResult.dropped],
+        ...(ordinary.stopped || privateResult.stopped ? { stopped: ordinary.stopped ?? privateResult.stopped } : {}) };
+}
+/** Bounded: an offline machine must never stall a command. Fail-soft. */
+export async function flushOutboxAtStart(runtime, deadlineMs = STARTUP_FLUSH_DEADLINE_MS) {
+    if (!runtime.sink)
+        return;
+    try {
+        // One listing, inside the deadline: flush scans the outbox itself.
+        const summary = await flushOutbox(runtime, { deadlineMs });
+        if (summary.delivered.length > 0) {
+            runtime.stderr(`Delivered ${summary.delivered.length} spooled evidence entr${summary.delivered.length === 1 ? 'y' : 'ies'} to ${credentialHost(runtime.credential)}.`);
+        }
+    }
+    catch (err) {
+        // The outbox is a convenience; a broken data dir must not stop the
+        // command — but a spooled entry that never leaves deserves a trace.
+        runtime.stderr(`Outbox flush skipped: ${scrubText(String(err), 200)}`);
+    }
+}
+function exitFor(status, evidenceRequired) {
+    return evidenceRequired && status !== 'recorded' ? EVIDENCE_REQUIRED_EXIT_CODE : 0;
+}
+function localFailure(err) {
+    return scrubText(err instanceof Error ? err.message : String(err), 300);
+}
+/** The wire builder defaults an absent finding label to `none`; inspect the immutable report first. */
+export function verifiedConsensusDiagnostics(result) {
+    if (result.run?.gating?.mode !== 'verified-consensus')
+        return [];
+    const diagnostics = [];
+    const reasons = new Set(['consensus', 'critical', 'verified', 'none']);
+    let hasVerificationEvidence = false;
+    for (const [group, findings] of [
+        ['findings', result.findings],
+        ['belowThresholdFindings', result.belowThresholdFindings ?? []],
+    ]) {
+        findings.forEach((finding, index) => {
+            if (finding.gating?.verification !== undefined)
+                hasVerificationEvidence = true;
+            if (!reasons.has(finding.gating?.reason ?? '')) {
+                diagnostics.push({ path: `${group}.${index}.gating.reason`, message: 'Verified-consensus finding is missing a valid gating label' });
+            }
+        });
+    }
+    if (hasVerificationEvidence && result.stats?.verification == null) {
+        diagnostics.unshift({ path: 'stats.verification', message: 'Verified-consensus report is missing verification stats for annotated candidates' });
+    }
+    return diagnostics.slice(0, 20);
+}
+/** Only a proof-derived private artifact may explain intentionally unlabeled strict-fallback bytes. */
+function authenticatedStrictFallback(input) {
+    const artifact = input.reviewerArtifact, gate = artifact?.validation.gate;
+    if (!artifact || !isReviewerArtifact(artifact) || artifact.gatingDisposition !== 'strict_fallback' ||
+        artifact.reportSha256 !== sha256Hex(input.artifacts.report_json) || gate === undefined ||
+        gate.validation !== 'deterministic' || gate.reportedCiExitCode === 0 ||
+        gate.reportedCiExitCode !== gate.conservativeCiExitCode || gate.annotations.length !== 0 ||
+        gate.unresolvedFindingIdentities.length !== 0 ||
+        input.result.run?.ci_exit_code !== gate.reportedCiExitCode || input.result.stats?.verification != null)
+        return false;
+    return [...input.result.findings, ...(input.result.belowThresholdFindings ?? [])]
+        .every(finding => finding.gating === undefined);
+}
+function verifiedConsensusEnvelopeDiagnostics(input, envelope) {
+    const strictFallback = authenticatedStrictFallback(input);
+    const diagnostics = strictFallback ? [] : verifiedConsensusDiagnostics(input.result);
+    if (diagnostics.length > 0 || envelope.run.gating?.mode !== 'verified-consensus')
+        return diagnostics;
+    try {
+        const report = JSON.parse(input.artifacts.report_json);
+        const problem = verifiedConsensusReportProblem(report, envelope, input.artifacts.report_json, input.result, { allowUnlabeledStrictFallback: strictFallback });
+        if (problem)
+            diagnostics.push({ path: 'report_json', message: problem });
+    }
+    catch {
+        diagnostics.push({ path: 'report_json', message: 'report_json malformed; verified-consensus source cannot be checked' });
+    }
+    return diagnostics;
+}
+async function retainRun(runtime, input, envelope, diagnostics, acknowledged = false) {
+    return (runtime.quarantine ?? new Quarantine(join(runtime.dataDir, QUARANTINE_DIR))).retain({
+        runId: input.result.run?.id ?? '', artifacts: input.artifacts, envelope,
+        events: (input.events ?? []).filter(deliverable), requestedMode: runtime.attested ? 'attested' : 'asserted',
+        acknowledged, diagnostics: [...(input.outputDiagnostics ?? []), ...diagnostics],
+    });
+}
+function retentionLine(retention, runId) {
+    return retention.status === 'complete'
+        ? `original evidence retained; inspect with rcl telemetry rejected --run ${runId}`
+        : `could not preserve a complete recovery copy (${retention.error})`;
+}
+/**
+ * POST the envelope, PUT the artifacts (at `full`), POST any events; spool
+ * whatever the server could not take because it was unreachable. Local
+ * failures (notice file, outbox) are reported, never thrown.
+ */
+export async function deliverRun(runtime, input) {
+    if (input.reviewerArtifact || input.result.run?.reviewer_evidence)
+        return deliverReviewerRun(runtime, input);
+    const outcome = await deliverCompletedRun(runtime, input);
+    if (input.outputDiagnostics?.length && !outcome.retention && runtime.level !== 'off' && runtime.repoManaged && input.result.run) {
+        const envelope = buildRunEnvelope(input.result, input.artifacts, {
+            level: runtime.level, delivery: { mode: 'direct' }, parseFailures: runtime.parseFailures,
+        });
+        const retention = await retainRun(runtime, input, envelope, [], outcome.status === 'recorded');
+        return { ...outcome, runId: input.result.run.id, retention,
+            line: `${outcome.line}; ${retentionLine(retention, input.result.run.id)}` };
+    }
+    return outcome;
+}
+/** Private delivery remains distinct from ordinary telemetry and its lossy outbox. */
+async function deliverReviewerRun(runtime, input) {
+    const runId = input.result.run?.id, required = input.evidenceRequired === true;
+    const finish = (status, spooled, line) => ({ status, spooled, line, runId, exitCode: exitFor(status, required) });
+    if (runtime.level === 'off' || !runtime.repoManaged)
+        return finish('off', false, required ? 'Private reviewer evidence retained locally; telemetry is off' : '');
+    if (!runId || !input.reviewerArtifact || !input.result.run?.reviewer_evidence || runtime.level !== 'full' ||
+        !runtime.sink || !runtime.credential || input.events?.length ||
+        (runtime.attested ? !(input.attestedReviewer instanceof AttestedReviewerDelivery) ||
+            !input.attestedReviewer.matchesRuntime(runtime.credential, runtime.attestedExpiresAt) : input.attestedReviewer !== undefined)) {
+        return finish('rejected', false, 'Private reviewer delivery requires complete retained evidence, full telemetry and a supported current owner credential');
+    }
+    let envelope;
+    try {
+        const declaration = declareReviewerRecovery({ artifact: input.reviewerArtifact, descriptor: input.result.run.reviewer_evidence,
+            ...(input.reviewerSource === undefined ? {} : { source: input.reviewerSource }) });
+        envelope = buildRunEnvelope(input.result, input.artifacts, { level: 'full', delivery: { mode: 'direct' }, parseFailures: runtime.parseFailures, reviewerRecovery: declaration });
+    }
+    catch {
+        return finish('rejected', false, 'Private reviewer delivery refused locally; original checkpoint evidence is unchanged');
+    }
+    if (verifiedConsensusEnvelopeDiagnostics(input, envelope).length > 0) {
+        return finish('rejected', false, 'Private reviewer delivery refused locally: verified-consensus report mismatch');
+    }
+    const queue = new ReviewerDeliveryQueue(runtime.dataDir);
+    try {
+        await noticeBefore(runtime, 'private-reviewers');
+        if (runtime.attested) {
+            await input.attestedReviewer.deliver({ envelope, artifacts: input.artifacts, artifact: input.reviewerArtifact });
+            return finish('recorded', false, 'Private evidence and embedded JSON read back; ordinary artifact PUT receipts verified; no native admission implied');
+        }
+        await queue.deliver({ sink: runtime.sink, envelope, artifacts: input.artifacts, artifact: input.reviewerArtifact });
+        return finish('recorded', false, 'Reviewer evidence and ordinary reports recorded and read back; no native admission implied');
+    }
+    catch {
+        if (runtime.attested)
+            return finish('rejected', false, 'Attested private delivery incomplete; nothing spooled and original checkpoint evidence is unchanged');
+        const retained = await queue.isRetained(runId);
+        return finish(retained ? 'spooled' : 'rejected', retained, retained ? 'Private reviewer delivery incomplete; exact bytes retained for an owner-checked telemetry flush' : 'Private reviewer delivery refused locally; original checkpoint evidence is unchanged');
+    }
+}
+async function deliverCompletedRun(runtime, input) {
+    const evidenceRequired = input.evidenceRequired === true;
+    // A runtime built for the outbox commands (`requireRepo: false`) may carry
+    // a level and a sink outside a Harness-managed repository; new evidence
+    // still never leaves one.
+    if (runtime.level === 'off' || !runtime.repoManaged) {
+        return {
+            status: 'off',
+            line: evidenceRequired ? 'Evidence not sent: telemetry is off, or this repository is not Harness-managed' : '',
+            spooled: false,
+            exitCode: exitFor('off', evidenceRequired),
+        };
+    }
+    const runId = input.result.run?.id;
+    if (runId === undefined) {
+        return {
+            status: 'skipped',
+            line: 'Evidence not sent: the report has no run header',
+            spooled: false,
+            exitCode: exitFor('skipped', evidenceRequired),
+        };
+    }
+    let envelope;
+    try {
+        envelope = buildRunEnvelope(input.result, input.artifacts, {
+            level: runtime.level, delivery: { mode: 'direct' }, parseFailures: runtime.parseFailures,
+        });
+    }
+    catch {
+        const retention = await retainRun(runtime, input, undefined, [{ path: 'envelope', message: 'Could not build a complete evidence envelope' }]);
+        return { status: 'rejected', runId, spooled: false, failureDisposition: 'local-invalid', retention, exitCode: exitFor('rejected', evidenceRequired),
+            line: `Evidence refused locally: invalid envelope; ${retentionLine(retention, runId)}` };
+    }
+    const diagnostics = validateRunEnvelope(envelope, input.artifacts);
+    diagnostics.push(...verifiedConsensusEnvelopeDiagnostics(input, envelope));
+    if (diagnostics.length > 0) {
+        const retention = await retainRun(runtime, input, envelope, diagnostics);
+        return { status: 'rejected', runId, spooled: false, failureDisposition: 'local-invalid', retention, exitCode: exitFor('rejected', evidenceRequired),
+            line: `Evidence refused locally (${diagnostics[0].path}: ${diagnostics[0].message}); ${retentionLine(retention, runId)}` };
+    }
+    const events = (input.events ?? []).filter(deliverable);
+    const artifactsToSend = runtime.level === 'full'
+        ? {
+            report_json: input.artifacts.report_json,
+            ...(input.artifacts.report_md !== undefined ? { report_md: input.artifacts.report_md } : {}),
+        }
+        : {};
+    if (!runtime.sink || !runtime.credential) {
+        // No credential to send with. When the caller insists on evidence, the
+        // run still goes to the outbox so a later login + flush can deliver it.
+        const reason = runtime.note ?? 'no Harness credential';
+        if (!evidenceRequired) {
+            return { status: 'skipped', line: `Evidence not sent: ${reason}`, runId, spooled: false, exitCode: 0 };
+        }
+        const retention = await retainRun(runtime, input, envelope, [{ path: 'delivery', message: reason }]);
+        try {
+            await runtime.outbox.spoolRun({ runId, envelope, artifacts: artifactsToSend, events });
+            return {
+                status: 'spooled',
+                retention,
+                line: `Evidence spooled (${reason}); run rcl telemetry flush once a credential is available; ${retentionLine(retention, runId)}`,
+                runId,
+                spooled: true,
+                exitCode: EVIDENCE_REQUIRED_EXIT_CODE,
+            };
+        }
+        catch (err) {
+            return {
+                status: 'skipped',
+                retention,
+                line: `Evidence not sent: ${reason}; could not spool it either (${localFailure(err)}); ${retentionLine(retention, runId)}`,
+                runId,
+                spooled: false,
+                exitCode: EVIDENCE_REQUIRED_EXIT_CODE,
+            };
+        }
+    }
+    const host = credentialHost(runtime.credential);
+    await noticeBefore(runtime);
+    // Hold one immutable serialization for the first POST and every bounded
+    // attested replay; no retry rebuilds the envelope or run identity.
+    const serializedEnvelope = JSON.stringify(envelope);
+    const deliveryDiagnostics = [];
+    const preparedPost = runtime.sink.preparePostRun(envelope, serializedEnvelope);
+    let posted = preparedPost.kind === 'ready' ? await preparedPost.post() : preparedPost;
+    if (posted.kind === 'unavailable' && runtime.attested && runtime.attestedExpiresAt !== undefined) {
+        deliveryDiagnostics.push({ path: 'delivery.initial_transport', message: posted.reason });
+        // Recovery stops on refusal; keep organization disablement distinct in the delivery result.
+        if (parseAttestedExpiry(runtime.attestedExpiresAt) === undefined) {
+            posted = { kind: 'rejected', httpStatus: 0, error: 'attested_recovery_invalid_expiry', message: 'attested expiry must be a valid ISO timestamp' };
+        }
+        else {
+            const recovered = await recoverAttestedDelivery({
+                runId, payload: serializedEnvelope, expiresAt: runtime.attestedExpiresAt, receiptFirst: true, initialAttempts: 1,
+                post: async (payload, signal) => {
+                    if (payload !== serializedEnvelope || preparedPost.kind !== 'ready')
+                        return { kind: 'rejected' };
+                    const outcome = await preparedPost.post({ signal });
+                    if (outcome.kind === 'ok')
+                        return { kind: 'recorded', value: outcome.value };
+                    if (outcome.kind === 'conflict')
+                        return { kind: 'conflict' };
+                    if (outcome.kind === 'disabled')
+                        return { kind: 'disabled', value: outcome };
+                    if (outcome.kind === 'rejected')
+                        return { kind: 'rejected' };
+                    return { kind: 'unavailable' };
+                }, receipt: async (_runId, signal) => preparedPost.kind === 'ready' ? preparedPost.receipt({ signal }) : Promise.resolve({ kind: 'rejected' }),
+            });
+            if (recovered.kind === 'recorded' && recovered.value !== undefined)
+                posted = { kind: 'ok', httpStatus: 200, value: recovered.value };
+            else if (recovered.kind === 'recorded')
+                posted = { kind: 'rejected', httpStatus: 0, error: 'attested_recovery_missing_receipt', message: 'recorded recovery did not provide a receipt' };
+            else if (recovered.kind === 'conflict')
+                posted = { kind: 'conflict', message: 'attested recovery found a conflicting run' };
+            else if (recovered.kind === 'disabled')
+                posted = recovered.value;
+            else if (recovered.kind === 'rejected' || recovered.kind === 'receipt_rejected')
+                posted = { kind: 'rejected', httpStatus: 0, error: 'attested_recovery_refused', message: recovered.kind };
+            else
+                posted = { kind: 'unavailable', reason: `attested_recovery_${recovered.kind}` };
+        }
+    }
+    switch (posted.kind) {
+        case 'unavailable': {
+            const retention = await retainRun(runtime, input, envelope, [...deliveryDiagnostics, { path: 'delivery', message: describeOutcome(posted) }]);
+            if (runtime.attested) {
+                // The run-bound credential ends with the workflow run; a flush later
+                // would have to use another credential and record an asserted run.
+                return {
+                    status: 'error',
+                    retention,
+                    runId,
+                    spooled: false,
+                    line: `Evidence not recorded (Harness unreachable: ${posted.reason}); nothing spooled — an attested run does not outlive its workflow run; ${retentionLine(retention, runId)}`,
+                    exitCode: exitFor('error', evidenceRequired),
+                };
+            }
+            try {
+                const spooled = await runtime.outbox.spoolRun({ runId, envelope, artifacts: artifactsToSend, events });
+                const dropped = spooled.artifactsDropped.length > 0 ? ' — artifacts not spooled: outbox over its cap' : '';
+                return {
+                    status: 'spooled',
+                    retention,
+                    runId,
+                    spooled: true,
+                    line: `Evidence spooled (Harness unreachable: ${posted.reason}); run rcl telemetry flush${dropped}; ${retentionLine(retention, runId)}`,
+                    exitCode: exitFor('spooled', evidenceRequired),
+                };
+            }
+            catch (err) {
+                return {
+                    status: 'error',
+                    retention,
+                    runId,
+                    spooled: false,
+                    line: `Evidence not sent (Harness unreachable: ${posted.reason}) and could not be spooled: ${localFailure(err)}; ${retentionLine(retention, runId)}`,
+                    exitCode: exitFor('error', evidenceRequired),
+                };
+            }
+        }
+        case 'disabled': {
+            const retention = deliveryDiagnostics.length > 0
+                ? await retainRun(runtime, input, envelope, [...deliveryDiagnostics, { path: 'delivery', message: describeOutcome(posted) }])
+                : undefined;
+            return {
+                status: 'disabled',
+                ...(retention ? { retention } : {}),
+                runId,
+                spooled: false,
+                line: `Evidence not sent: ${host} has not enabled review evidence for this organization${retention ? `; ${retentionLine(retention, runId)}` : ''}`,
+                exitCode: exitFor('disabled', evidenceRequired),
+            };
+        }
+        case 'conflict': {
+            const retention = await retainRun(runtime, input, envelope, [...deliveryDiagnostics, { path: 'delivery', message: describeOutcome(posted) }]);
+            return {
+                status: 'conflict',
+                retention,
+                runId,
+                spooled: false,
+                line: `Evidence conflict: ${host} already holds run ${runId} with a different report; nothing recorded; ${retentionLine(retention, runId)}`,
+                exitCode: exitFor('conflict', evidenceRequired),
+            };
+        }
+        case 'rejected': {
+            const retention = await retainRun(runtime, input, envelope, [...deliveryDiagnostics, { path: 'delivery', message: describeOutcome(posted) }]);
+            return {
+                status: 'rejected',
+                retention,
+                runId,
+                spooled: false,
+                line: `Evidence refused by ${host} (${describeOutcome(posted)}); nothing spooled; ${retentionLine(retention, runId)}`,
+                exitCode: exitFor('rejected', evidenceRequired),
+            };
+        }
+        case 'ok':
+            break;
+    }
+    const receipt = posted.value;
+    const notes = [];
+    const pendingArtifacts = {};
+    let unreachable = false;
+    let artifactsRefused = 0;
+    for (const [kind, bytes] of Object.entries(artifactsToSend)) {
+        if (!receipt.artifacts_expected.includes(kind))
+            continue;
+        if (unreachable) {
+            // The server went away mid-delivery: spool the rest instead of
+            // waiting out one timeout per artifact.
+            pendingArtifacts[kind] = bytes;
+            continue;
+        }
+        const outcome = await runtime.sink.putArtifact(runId, kind, bytes);
+        if (outcome.kind === 'ok')
+            continue;
+        if (outcome.kind === 'disabled') {
+            notes.push('artifacts capped by the organization');
+            artifactsRefused += 1;
+            break;
+        }
+        if (outcome.kind === 'unavailable') {
+            unreachable = true;
+            pendingArtifacts[kind] = bytes;
+            continue;
+        }
+        // A refusal is final — retrying the same bytes cannot help — so it is
+        // not spooled; under --evidence-required it makes the evidence incomplete.
+        artifactsRefused += 1;
+        notes.push(`${kind} refused: ${describeOutcome(outcome)}`);
+    }
+    let pendingEvents = [];
+    if (events.length > 0) {
+        if (unreachable) {
+            pendingEvents = events;
+        }
+        else {
+            const outcome = await runtime.sink.postEvents(events);
+            if (outcome.kind === 'unavailable')
+                pendingEvents = events;
+            else if (outcome.kind === 'rejected' || outcome.kind === 'conflict')
+                notes.push(`events refused: ${describeOutcome(outcome)}`);
+        }
+    }
+    let spooled = false;
+    if (runtime.attested && (Object.keys(pendingArtifacts).length > 0 || pendingEvents.length > 0)) {
+        notes.push('Harness became unreachable mid-delivery; nothing spooled — an attested run does not outlive its workflow run');
+    }
+    else if (Object.keys(pendingArtifacts).length > 0 || pendingEvents.length > 0) {
+        const parts = [
+            Object.keys(pendingArtifacts).length > 0 ? 'artifacts' : undefined,
+            pendingEvents.length > 0 ? 'events' : undefined,
+        ].filter((p) => p !== undefined);
+        try {
+            const result = await runtime.outbox.spoolRun({
+                runId,
+                envelope,
+                artifacts: pendingArtifacts,
+                events: pendingEvents,
+                envelopeDelivered: true,
+                runUrl: receipt.url,
+            });
+            const kept = Object.keys(pendingArtifacts).filter((kind) => !result.artifactsDropped.includes(kind));
+            spooled = kept.length > 0 || pendingEvents.length > 0;
+            const retained = [kept.length > 0 ? 'artifacts' : undefined, pendingEvents.length > 0 ? 'events' : undefined].filter((p) => p !== undefined);
+            if (retained.length > 0)
+                notes.push(`${retained.join(' and ')} spooled; run rcl telemetry flush`);
+            if (result.artifactsDropped.length > 0) {
+                notes.push(`${result.artifactsDropped.join(', ')} not spooled: outbox over its cap`);
+            }
+        }
+        catch (err) {
+            notes.push(`${parts.join(' and ')} not delivered and could not be spooled: ${localFailure(err)}`);
+        }
+    }
+    // Recording the envelope does not acknowledge artifacts the server expected
+    // but subsequently refused, including an organization cap changed mid-flight.
+    const artifactsOutstanding = Object.keys(pendingArtifacts).length + artifactsRefused;
+    const retention = artifactsOutstanding > 0 || pendingEvents.length > 0
+        ? await retainRun(runtime, input, envelope, [...deliveryDiagnostics, { path: 'delivery', message: notes.join('; ') }], true)
+        : undefined;
+    if (retention)
+        notes.push(retentionLine(retention, runId));
+    return {
+        status: 'recorded',
+        runId,
+        url: receipt.url,
+        spooled,
+        ...(retention ? { retention } : {}),
+        line: `Evidence recorded: ${receipt.url}${notes.length > 0 ? ` (${notes.join('; ')})` : ''}`,
+        exitCode: evidenceRequired && artifactsOutstanding > 0 ? EVIDENCE_REQUIRED_EXIT_CODE : 0,
+    };
+}
+/**
+ * Converge commands report their events through the same sink, fail-soft:
+ * unreachable spools, anything else is noted and dropped.
+ */
+export async function emitConvergeEvents(runtime, events) {
+    if (runtime.level === 'off' || !runtime.sink || !runtime.repoManaged)
+        return 'skipped';
+    const sendable = events.filter(deliverable);
+    if (sendable.length === 0)
+        return 'skipped';
+    await noticeBefore(runtime);
+    const outcome = await runtime.sink.postEvents(sendable);
+    switch (outcome.kind) {
+        case 'ok':
+            return 'sent';
+        case 'unavailable':
+            try {
+                await runtime.outbox.spoolEvents(sendable);
+                return 'spooled';
+            }
+            catch {
+                return 'refused';
+            }
+        case 'disabled':
+            return 'skipped';
+        case 'conflict':
+        case 'rejected':
+            runtime.stderr(`Converge events refused by ${runtime.credential ? credentialHost(runtime.credential) : 'Harness'}: ${describeOutcome(outcome)}`);
+            return 'refused';
+    }
+}
+/** Keep transport uncertainty conservative, while distinguishing proven pre-network rejection. */
+export function guardedDeliveryState(delivery) {
+    return { deliveryPending: delivery.spooled || delivery.exitCode !== 0,
+        ...(delivery.exitCode !== 0 && delivery.failureDisposition ? { deliveryFailure: delivery.failureDisposition } : {}) };
+}
+//# sourceMappingURL=deliver.js.map