@allocator-one/rcl 4.4.19

package/dist/telemetry/envelope.js

@@ -0,0 +1,288 @@
+import { createHash } from 'node:crypto';
+import { normalizeVerificationEvidence } from './verification.js';
+import { stableFindingKey } from '../consensus/finding-identity.js';
+import { reviewLane } from '../report/blocking-health.js';
+import { normalizeGeneratedText, scrubDeep, scrubIdentifier, scrubOptional, scrubSecrets, scrubText, stripFencedCode } from './scrub.js';
+const REVIEWER_ARTIFACT_MAX_BYTES = 25_000_000;
+const sha256Pattern = /^[0-9a-f]{64}$/;
+const uuidPattern = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+/**
+ * Builds the declaration for an already sealed private artifact. This never
+ * embeds its bytes in the ordinary run envelope or generic artifact list.
+ */
+export function declareReviewerRecovery(input) {
+    if (typeof input.artifact?.bytes !== 'string')
+        throw new Error('reviewer_recovery_invalid_bytes');
+    const bytes = Buffer.byteLength(input.artifact.bytes, 'utf8');
+    if (bytes > REVIEWER_ARTIFACT_MAX_BYTES || !sha256Pattern.test(input.artifact.digest) || sha256Hex(input.artifact.bytes) !== input.artifact.digest) {
+        throw new Error('reviewer_recovery_invalid_artifact');
+    }
+    const descriptor = input.descriptor;
+    if (descriptor.kind === 'original') {
+        if (input.source !== undefined)
+            throw new Error('reviewer_recovery_original_source');
+        return { version: 1, artifact_schema: 1, sha256: input.artifact.digest, bytes, descriptor };
+    }
+    const source = input.source;
+    if (!source || !uuidPattern.test(source.run_id) || !sha256Pattern.test(source.report_sha256) ||
+        !sha256Pattern.test(source.reviewer_artifact_sha256) || source.run_id !== descriptor.source.run_id ||
+        source.report_sha256 !== descriptor.source.report_sha256) {
+        throw new Error('reviewer_recovery_source_mismatch');
+    }
+    return { version: 1, artifact_schema: 1, sha256: input.artifact.digest, bytes, descriptor, source: { ...source } };
+}
+/** Wire limits mirrored from the server (section 7 "Limits"). */
+export const MAX_WARNINGS_PER_CALL = 50;
+export const MAX_PARSE_FAILURE_BYTES = 32_000;
+const MAX_PARSER_ERROR_SUMMARY = 500;
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes, 'utf8').digest('hex');
+}
+export function declareArtifacts(artifacts) {
+    const declared = [
+        { kind: 'report_json', sha256: sha256Hex(artifacts.report_json), bytes: Buffer.byteLength(artifacts.report_json, 'utf8') },
+    ];
+    if (artifacts.report_md !== undefined) {
+        declared.push({
+            kind: 'report_md',
+            sha256: sha256Hex(artifacts.report_md),
+            bytes: Buffer.byteLength(artifacts.report_md, 'utf8'),
+        });
+    }
+    return declared;
+}
+function findingRef(index) {
+    return `f${String(index + 1).padStart(3, '0')}`;
+}
+function wireFinding(finding, index, belowThreshold) {
+    const identity = finding.identity ?? stableFindingKey(finding);
+    const verification = normalizeVerificationEvidence(finding.gating?.verification);
+    return {
+        ref: findingRef(index),
+        identity_key: identity,
+        ...(finding.claimDescriptor !== undefined ? { claim_descriptor: finding.claimDescriptor } : {}),
+        file: scrubText(finding.file),
+        start_line: finding.startLine,
+        end_line: finding.endLine,
+        ...(finding.locationProvenance !== undefined ? {
+            location_provenance: {
+                version: finding.locationProvenance.version,
+                source: finding.locationProvenance.source,
+                reason: finding.locationProvenance.reason,
+                original_start_line: finding.locationProvenance.originalStartLine,
+                original_end_line: finding.locationProvenance.originalEndLine,
+            },
+        } : {}),
+        severity: finding.severity,
+        category: finding.category,
+        title: scrubText(finding.title, 500),
+        description: scrubText(finding.description),
+        ...(finding.suggestedFix !== undefined ? { suggested_fix: scrubText(finding.suggestedFix) } : {}),
+        consensus: scrubDeep(finding.consensus),
+        gating_reason: finding.gating?.reason ?? 'none',
+        ...(finding.gating?.verification?.verdict !== undefined
+            ? { verification_verdict: scrubText(finding.gating.verification.verdict) }
+            : {}),
+        ...(verification.model !== undefined ? { verification_model: verification.model } : {}),
+        ...(verification.note !== undefined ? { verification_note: verification.note } : {}),
+        below_threshold: belowThreshold,
+    };
+}
+/**
+ * A `parse_failed` call's error text defaults to the parser's own message
+ * — its first line, scrubbed — because the rest may be the model's raw
+ * answer echoing the prompt. Opting in sends that answer with fenced code
+ * removed, scrubbed and capped.
+ */
+function callError(review, parseFailures) {
+    if (review.error === undefined)
+        return undefined;
+    if (review.status !== 'parse_failed')
+        return scrubText(review.error);
+    if (parseFailures)
+        return scrubText(stripFencedCode(review.error), MAX_PARSE_FAILURE_BYTES);
+    const firstLine = review.error.split(/\r?\n/, 1)[0] ?? '';
+    return scrubText(firstLine, MAX_PARSER_ERROR_SUMMARY);
+}
+function wireCall(review, run, parseFailures) {
+    const error = callError(review, parseFailures);
+    return {
+        model: scrubIdentifier(review.model),
+        role: scrubIdentifier(review.role),
+        provider: scrubIdentifier(review.provider),
+        lane: reviewLane(review, run.roster),
+        // Chunks are merged before the report is written; one call row stands
+        // for a reviewer's work on the whole diff.
+        chunk_index: 0,
+        status: review.status,
+        duration_ms: Math.max(0, Math.round(review.durationMs)),
+        ...(review.usage?.inputTokens !== undefined ? { input_tokens: review.usage.inputTokens } : {}),
+        ...(review.usage?.outputTokens !== undefined ? { output_tokens: review.usage.outputTokens } : {}),
+        ...(review.usage?.reasoningTokens !== undefined ? { reasoning_tokens: review.usage.reasoningTokens } : {}),
+        dropped_findings: review.droppedFindings ?? 0,
+        warnings: (review.warnings ?? []).slice(0, MAX_WARNINGS_PER_CALL).map((w) => scrubText(w)),
+        ...(error !== undefined ? { error } : {}),
+        async: review.async === true,
+    };
+}
+/**
+ * Build the envelope for a finished review. Requires the self-describing
+ * header (`result.run`, rcl ≥ 3.0). `envelope` level sends the header,
+ * stats and declarations only; `findings` and `full` add findings and legacy
+ * calls (artifacts are uploaded separately, only at `full`). Private reviewer
+ * recovery calls are derived server-side from the validated private artifact,
+ * never from merged report reviews or their inherited usage.
+ */
+export function buildRunEnvelope(result, artifacts, options) {
+    if (!result.run) {
+        throw new Error('A report without a run header cannot be delivered as evidence (rcl < 3.0 report).');
+    }
+    const run = scrubRunHeader(result.run);
+    const includeRows = options.level !== 'envelope';
+    const parseFailures = options.parseFailures === true;
+    const kept = result.findings.map((f, i) => wireFinding(f, i, false));
+    const below = (result.belowThresholdFindings ?? []).map((f, i) => wireFinding(f, kept.length + i, true));
+    return {
+        run,
+        findings: includeRows ? [...kept, ...below] : [],
+        calls: includeRows && options.reviewerRecovery === undefined
+            ? result.reviews.map((review) => wireCall(review, run, parseFailures)) : [],
+        stats: result.stats,
+        artifacts_declared: declareArtifacts(artifacts),
+        ...(options.reviewerRecovery === undefined ? {} : { reviewer_recovery: structuredClone(options.reviewerRecovery) }),
+        delivery: options.delivery,
+    };
+}
+/**
+ * Normalize only fresh reviewer prose before its first serialization. Keep
+ * identifiers, structural fields and already materialized descriptors intact.
+ * Recovery/envelope builders must not apply this to retained original bytes.
+ */
+export function normalizeGeneratedReport(result) {
+    const text = normalizeGeneratedText;
+    const finding = (f) => ({
+        ...f, title: text(f.title), description: text(f.description),
+        ...(f.suggestedFix !== undefined ? { suggestedFix: text(f.suggestedFix) } : {}),
+    });
+    const consensusFinding = (f) => ({
+        ...finding(f),
+        consensus: {
+            ...f.consensus,
+            ...(f.consensus.disputeDetails !== undefined ? { disputeDetails: text(f.consensus.disputeDetails) } : {}),
+            ...(f.consensus.positions ? { positions: f.consensus.positions.map(p => ({ ...p, title: text(p.title), excerpt: text(p.excerpt) })) } : {}),
+        },
+        ...(typeof f.gating?.verification?.note === 'string' ? { gating: { ...f.gating,
+                verification: { ...f.gating.verification, note: text(f.gating.verification.note) },
+            } } : {}),
+    });
+    return {
+        ...result,
+        findings: result.findings.map(consensusFinding),
+        ...(result.belowThresholdFindings ? { belowThresholdFindings: result.belowThresholdFindings.map(consensusFinding) } : {}),
+        reviews: result.reviews.map(r => ({ ...r, findings: r.findings.map(finding),
+            ...(r.error !== undefined ? { error: text(r.error) } : {}),
+            ...(r.warnings ? { warnings: r.warnings.map(text) } : {}),
+        })),
+    };
+}
+/**
+ * The report as it may leave the machine: every free-text field scrubbed
+ * and a `parse_failed` call's error reduced to the parser message unless
+ * `parseFailures` opts in (fenced code removed, capped). The artifacts are
+ * rendered from this view — and written to `--json-file` / `--markdown`
+ * from it too — so what the server stores is exactly what was written, and
+ * neither contains a raw model answer or a key quoted from the diff.
+ */
+export function sanitizeForDelivery(result, options = {}) {
+    const parseFailures = options.parseFailures === true;
+    // Checkpoint proofs contain exact prompts and raw outcomes. They belong only
+    // in the explicitly private evidence artifact: scrubbing would break their
+    // hashes, while the ordinary top-level spread would disclose them unchanged.
+    const { reviewerEvidence: _privateEvidence, ...ordinaryResult } = result;
+    const finding = (f) => ({
+        ...f,
+        ...(f.locationProvenance !== undefined ? { locationProvenance: scrubLocationProvenance(f.locationProvenance) } : {}),
+        file: scrubText(f.file),
+        title: scrubText(f.title, 500),
+        description: scrubText(f.description),
+        ...(f.suggestedFix !== undefined ? { suggestedFix: scrubText(f.suggestedFix) } : {}),
+        consensus: scrubDeep(f.consensus),
+        ...(f.gating !== undefined ? {
+            gating: {
+                ...scrubDeep(f.gating),
+                ...(f.gating.verification !== undefined ? {
+                    verification: {
+                        verdict: scrubText(f.gating.verification.verdict),
+                        ...normalizeVerificationEvidence(f.gating.verification),
+                    },
+                } : {}),
+            },
+        } : {}),
+    });
+    const review = (r) => {
+        const error = callError(r, parseFailures);
+        const { error: _dropped, ...rest } = r;
+        return {
+            ...rest,
+            model: scrubIdentifier(r.model),
+            role: scrubIdentifier(r.role),
+            provider: scrubIdentifier(r.provider),
+            findings: r.findings.map((f) => ({
+                ...f,
+                ...(f.locationProvenance !== undefined ? { locationProvenance: scrubLocationProvenance(f.locationProvenance) } : {}),
+                file: scrubText(f.file),
+                title: scrubText(f.title, 500),
+                description: scrubText(f.description),
+                ...(f.suggestedFix !== undefined ? { suggestedFix: scrubText(f.suggestedFix) } : {}),
+            })),
+            ...(r.warnings ? { warnings: r.warnings.map((w) => scrubText(w)) } : {}),
+            ...(error !== undefined ? { error } : {}),
+        };
+    };
+    return {
+        ...ordinaryResult,
+        ...(result.run ? { run: scrubRunHeader(result.run) } : {}),
+        reviews: result.reviews.map(review),
+        findings: result.findings.map(finding),
+        ...(result.belowThresholdFindings ? { belowThresholdFindings: result.belowThresholdFindings.map(finding) } : {}),
+    };
+}
+function scrubLocationProvenance(provenance) {
+    return scrubDeep({
+        version: provenance.version,
+        source: provenance.source,
+        reason: provenance.reason,
+        originalStartLine: provenance.originalStartLine,
+        originalEndLine: provenance.originalEndLine,
+    });
+}
+/**
+ * The header is allow-listed when built, but every string in it — target
+ * URLs and refs, roster values, context-file paths, runner claims — came
+ * from the environment or the repository, so all of them pass the scrubber
+ * (hex digests and UUIDs survive it); the runner claims are capped as well.
+ */
+function scrubRunHeader(run) {
+    const scrubbed = scrubDeep(run);
+    return {
+        ...scrubbed,
+        // Roster values are configured identifiers, not prose: a long mixed-case
+        // model id must survive, so those three fields take the identifier
+        // scrubber over the original values; everything else on a seat keeps
+        // the deep-scrubbed form.
+        roster: scrubbed.roster.map((seat, i) => ({
+            ...seat,
+            model: scrubIdentifier(run.roster[i].model),
+            role: scrubIdentifier(run.roster[i].role),
+            provider: scrubIdentifier(run.roster[i].provider),
+        })),
+        runner: {
+            ...scrubbed.runner,
+            ...(run.runner.agent !== undefined ? { agent: scrubText(run.runner.agent, 200) } : {}),
+            ...(run.runner.host !== undefined ? { host: scrubText(run.runner.host, 64) } : {}),
+            ...(run.runner.ci_run_id !== undefined ? { ci_run_id: scrubSecrets(run.runner.ci_run_id).slice(0, 200) } : {}),
+        },
+    };
+}
+export { scrubOptional };
+//# sourceMappingURL=envelope.js.map

package/dist/telemetry/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/telemetry/envelope.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA6DzI,MAAM,2BAA2B,GAAG,UAAU,CAAC;AAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,WAAW,GAAG,gDAAgD,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAoC;IAC1E,IAAI,OAAO,KAAK,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,KAAK,GAAG,2BAA2B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnJ,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACrF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAC1F,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC,MAAM;QAClG,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;AACrH,CAAC;AAsED,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAwB;IACvD,MAAM,QAAQ,GAA0B;QACtC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;KAC3H,CAAC;IACF,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,OAAyB,EAAE,KAAa,EAAE,cAAuB;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjF,OAAO;QACL,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC;QACtB,YAAY,EAAE,QAAQ;QACtB,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC;YAC7C,mBAAmB,EAAE;gBACnB,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,OAAO;gBAC3C,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM;gBACzC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM;gBACzC,mBAAmB,EAAE,OAAO,CAAC,kBAAkB,CAAC,iBAAiB;gBACjE,iBAAiB,EAAE,OAAO,CAAC,kBAAkB,CAAC,eAAe;aAC9D;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACpC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;QACvC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM;QAC/C,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,eAAe,EAAE,cAAc;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,MAAmB,EAAE,aAAsB;IAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,aAAa;QAAE,OAAO,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO,SAAS,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,MAAmB,EAAE,GAAc,EAAE,aAAsB;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1C,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACpC,sEAAsE;QACtE,2CAA2C;QAC3C,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,gBAAgB,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC;QAC7C,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1F,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,SAAwB,EACxB,OAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,GAAG,GAAc,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC;IAErD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzG,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAChD,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS;YAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7E,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,kBAAkB,EAAE,gBAAgB,CAAC,SAAS,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnH,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC;IACpC,MAAM,OAAO,GAAG,CAAoB,CAAI,EAAK,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5D,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,CAAC,CAAmB,EAAoB,EAAE,CAAC,CAAC;QACnE,GAAG,OAAO,CAAC,CAAC,CAAC;QACb,SAAS,EAAE;YACT,GAAG,CAAC,CAAC,SAAS;YACd,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5I;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM;gBAC5E,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;aACnF,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACV,CAAC,CAAC;IACH,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzH,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,UAAuC,EAAE;IACjG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC;IACrD,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,GAAG,MAAuD,CAAC;IAC1H,MAAM,OAAO,GAAG,CAAC,CAAmB,EAAoB,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC;QACJ,GAAG,CAAC,CAAC,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpH,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACvB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;QAC9B,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QACrC,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE;gBACN,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBACtB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC;oBACxC,YAAY,EAAE;wBACZ,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAkC;wBAClF,GAAG,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;qBACxD;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,CAAc,EAAe,EAAE;QAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/B,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7B,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YACrC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,CAAC;gBACJ,GAAG,CAAC,CAAC,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpH,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;gBAC9B,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;gBACrC,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrF,CAAC,CAAC;YACH,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,GAAG,cAAc;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,UAA8B;IAC7D,OAAO,SAAS,CAAC;QACf,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,QAAQ;QACX,yEAAyE;QACzE,mEAAmE;QACnE,qEAAqE;QACrE,0BAA0B;QAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,GAAG,IAAI;YACP,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;YAC5C,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;YAC1C,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,EAAE;YACN,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/G;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/telemetry/events.d.ts

@@ -0,0 +1,68 @@
+import type { ClaimDescriptor, MatchRationale } from '../consensus/claim-identity.js';
+import { type ReportIdentityMapping } from '../converge/run-state.js';
+/**
+ * Converge events (epic IO-12475, section 5.4): the rcl-converge commands
+ * report what they did, each event carrying its own client id so a retried
+ * batch never records anything twice. Round-bound kinds name the run of
+ * their round — the server resolves the repository and PR from that run,
+ * never from the client-defined converge target, which travels only as a
+ * label.
+ */
+export type ConvergeEventKind = 'attempt_claimed' | 'cap_changed' | 'round_processed' | 'verdicts_recorded' | 'finding_identity_corrected' | 'finding_claim_split' | 'finding_obligation_transferred' | 'finding_claim_disposition' | 'resolution' | 'loss';
+/** Kinds the server refuses without `run_id` (and `round`). */
+export declare const RUN_BOUND_KINDS: ReadonlySet<ConvergeEventKind>;
+export interface WireEvent {
+    id: string;
+    kind: ConvergeEventKind;
+    converge_target?: string;
+    run_id?: string;
+    round?: number;
+    attempt?: number;
+    payload: Record<string, unknown>;
+    occurred_at: string;
+}
+export interface EventInput {
+    kind: ConvergeEventKind;
+    convergeTarget?: string;
+    runId?: string;
+    round?: number;
+    attempt?: number;
+    payload?: Record<string, unknown>;
+    now?: Date;
+}
+/** One classified sighting of a round, as `round_processed` reports it (RCL-47). */
+export interface RoundIdentity {
+    /** The finding's own key as the report carries it — what the server stored for the finding. */
+    identity_key: string;
+    /** The canonical native identity `converge-report` assigned or matched. */
+    matched_identity: string;
+    status: 'new' | 'repeat' | 'suppressed' | 'regating';
+    suppress_reason?: string;
+    version?: 1;
+    finding_ref?: string;
+    report_json_sha256?: string;
+    claim_descriptor?: ClaimDescriptor;
+    match_rationale?: MatchRationale;
+    /** Pending obligation as captured when this immutable sighting was classified. */
+    pending_round?: number | null;
+}
+/**
+ * The per-finding classification of a round for the `round_processed`
+ * payload: the server applies a standing verdict to a sighting whose key
+ * moved with the code only when it knows which identity rcl matched it to
+ * (IO-12601). A finding without an identity in the report (pre-3.0) is
+ * reported under the matched identity itself. Identical mappings share one
+ * entry; conflicting mappings cannot be represented by the key-only protocol.
+ */
+export declare function roundIdentities(findings: readonly ReportIdentityMapping[]): RoundIdentity[];
+/**
+ * Build one event. Ids are minted here and travel with the event into the
+ * outbox, so a spooled retry re-sends the same id.
+ */
+export declare function buildEvent(input: EventInput): WireEvent;
+/**
+ * Whether the server can take this event: a run-bound kind without the run
+ * id of its round (a pre-3.0 report, or a round the state never recorded)
+ * would be refused, so it is not worth sending.
+ */
+export declare function deliverable(event: WireEvent): boolean;

package/dist/telemetry/events.js

@@ -0,0 +1,79 @@
+import { uuidv7 } from '../report/uuid.js';
+import { validateReportIdentityMappings } from '../converge/run-state.js';
+import { scrubDeep, scrubIdentifier } from './scrub.js';
+/** Kinds the server refuses without `run_id` (and `round`). */
+export const RUN_BOUND_KINDS = new Set([
+    'round_processed',
+    'verdicts_recorded',
+    'finding_identity_corrected',
+    'finding_claim_split',
+    'finding_obligation_transferred',
+    'finding_claim_disposition',
+    'resolution',
+]);
+/**
+ * The per-finding classification of a round for the `round_processed`
+ * payload: the server applies a standing verdict to a sighting whose key
+ * moved with the code only when it knows which identity rcl matched it to
+ * (IO-12601). A finding without an identity in the report (pre-3.0) is
+ * reported under the matched identity itself. Identical mappings share one
+ * entry; conflicting mappings cannot be represented by the key-only protocol.
+ */
+export function roundIdentities(findings) {
+    validateReportIdentityMappings(findings);
+    const seen = new Set();
+    const out = [];
+    for (const f of findings) {
+        // An absent or blank report key (a pre-3.0 report) falls back to the matched identity.
+        const key = f.finding.identity?.trim() || f.identity;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({
+            identity_key: key,
+            matched_identity: f.identity,
+            status: f.status,
+            ...(f.suppressReason ? { suppress_reason: f.suppressReason } : {}),
+        });
+    }
+    return out;
+}
+/**
+ * Build one event. Ids are minted here and travel with the event into the
+ * outbox, so a spooled retry re-sends the same id.
+ */
+export function buildEvent(input) {
+    const now = input.now ?? new Date();
+    return {
+        id: uuidv7(now.getTime()),
+        kind: input.kind,
+        // The target is a slug the loop chose; it still passes the key scrubber.
+        ...(input.convergeTarget !== undefined ? { converge_target: scrubIdentifier(input.convergeTarget) } : {}),
+        ...(input.runId !== undefined ? { run_id: input.runId } : {}),
+        ...(input.round !== undefined ? { round: input.round } : {}),
+        ...(input.attempt !== undefined ? { attempt: input.attempt } : {}),
+        payload: scrubDeep(input.payload ?? {}),
+        occurred_at: now.toISOString(),
+    };
+}
+/**
+ * Whether the server can take this event: a run-bound kind without the run
+ * id of its round (a pre-3.0 report, or a round the state never recorded)
+ * would be refused, so it is not worth sending.
+ */
+export function deliverable(event) {
+    const counter = (n) => n === undefined || (Number.isSafeInteger(n) && n >= 1);
+    if (!counter(event.round) || !counter(event.attempt))
+        return false;
+    // A run id that is not a UUID would be refused by the server and could
+    // poison the batch it travels in.
+    if (event.run_id !== undefined && !UUID.test(event.run_id))
+        return false;
+    if (event.kind === 'attempt_claimed')
+        return event.attempt !== undefined;
+    if (!RUN_BOUND_KINDS.has(event.kind))
+        return true;
+    return event.run_id !== undefined && event.round !== undefined;
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+//# sourceMappingURL=events.js.map

package/dist/telemetry/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/telemetry/events.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAA8B,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAuBxD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAmC,IAAI,GAAG,CAAC;IACrE,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;IAC5B,qBAAqB;IACrB,gCAAgC;IAChC,2BAA2B;IAC3B,YAAY;CACb,CAAC,CAAC;AAwCH;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA0C;IAE1C,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,uFAAuF;QACvF,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC;QACrD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC;YACP,YAAY,EAAE,GAAG;YACjB,gBAAgB,EAAE,CAAC,CAAC,QAAQ;YAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,yEAAyE;QACzE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,OAAO,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,uEAAuE;IACvE,kCAAkC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;IACzE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;AACjE,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC"}

package/dist/telemetry/notice.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The individual consent notice (epic IO-12475, section 8.7): the first
+ * delivery from a machine to a given Harness host prints what is sent and
+ * where; `<data dir>/telemetry-notice` records that it was shown. The
+ * org-level switch is the organizational consent; this is the personal one.
+ */
+export declare const NOTICE_FILE = "telemetry-notice";
+export type NoticeScope = 'ordinary' | 'private-reviewers';
+export declare function noticeText(host: string, scope?: NoticeScope): string;
+/**
+ * Print the notice for `host` unless this machine has shown it before.
+ * Returns whether it was printed. Failures to persist the record are
+ * swallowed: a read-only data dir must not stop a review.
+ */
+export declare function ensureNoticeShown(host: string, dataDir: string, write: (text: string) => void, scope?: NoticeScope): Promise<boolean>;

package/dist/telemetry/notice.js

@@ -0,0 +1,67 @@
+import { mkdir, readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+/**
+ * The individual consent notice (epic IO-12475, section 8.7): the first
+ * delivery from a machine to a given Harness host prints what is sent and
+ * where; `<data dir>/telemetry-notice` records that it was shown. The
+ * org-level switch is the organizational consent; this is the personal one.
+ */
+export const NOTICE_FILE = 'telemetry-notice';
+async function readRecord(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf8'));
+        const shown = parsed?.shown;
+        if (typeof shown === 'object' && shown !== null && !Array.isArray(shown)) {
+            const clean = {};
+            for (const [host, at] of Object.entries(shown)) {
+                if (typeof at === 'string')
+                    clean[host] = at;
+            }
+            return { shown: clean };
+        }
+    }
+    catch {
+        // Missing or malformed reads as "never shown".
+    }
+    return { shown: {} };
+}
+export function noticeText(host, scope = 'ordinary') {
+    if (scope === 'private-reviewers')
+        return [
+            `Private reviewer evidence will be sent to ${host}, separately from ordinary review reports.`,
+            'It includes exact captured prompts and raw reviewer results. Access is limited to the',
+            'original owner or an explicitly authorized recovery run. These private bytes are not',
+            'ordinary public artifacts. Disable transmission with --no-telemetry or harness.telemetry: off.',
+            'This private evidence notice shows once per host, separately from ordinary telemetry.',
+        ].join('\n');
+    return [
+        `Review Council now records evidence of this review on ${host}: the run header (commit, roster,`,
+        'settings digests), consensus findings and reviewer call statistics, plus the JSON and Markdown',
+        'reports as written. Never sent: API keys, tokens, prompts or raw model answers (with `harness.parseFailures`',
+        'on, a parse-failed answer travels with code blocks and key-shaped strings removed). Switch it off with',
+        '`harness.telemetry: off` in .rclrc, `--no-telemetry`, or RCL_TELEMETRY=off. This notice shows once per host.',
+    ].join('\n');
+}
+/**
+ * Print the notice for `host` unless this machine has shown it before.
+ * Returns whether it was printed. Failures to persist the record are
+ * swallowed: a read-only data dir must not stop a review.
+ */
+export async function ensureNoticeShown(host, dataDir, write, scope = 'ordinary') {
+    const path = join(dataDir, NOTICE_FILE);
+    const record = await readRecord(path);
+    const key = scope === 'ordinary' ? host : `private-reviewers:${host}`;
+    if (record.shown[key] !== undefined)
+        return false;
+    write(noticeText(host, scope));
+    record.shown[key] = new Date().toISOString();
+    try {
+        await mkdir(dataDir, { recursive: true, mode: 0o700 });
+        await writeFile(path, JSON.stringify(record, null, 2), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // Shown, not recorded — it will show again next time, which is the safe side.
+    }
+    return true;
+}
+//# sourceMappingURL=notice.js.map

package/dist/telemetry/notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice.js","sourceRoot":"","sources":["../../src/telemetry/notice.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAO9C,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAI,MAAqC,EAAE,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,QAAqB,UAAU;IACtE,IAAI,KAAK,KAAK,mBAAmB;QAAE,OAAO;YACxC,6CAA6C,IAAI,4CAA4C;YAC7F,uFAAuF;YACvF,sFAAsF;YACtF,gGAAgG;YAChG,uFAAuF;SACxF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACL,yDAAyD,IAAI,mCAAmC;QAChG,gGAAgG;QAChG,8GAA8G;QAC9G,wGAAwG;QACxG,8GAA8G;KAC/G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,OAAe,EACf,KAA6B,EAC7B,QAAqB,UAAU;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}