@ashlr/hub 3.2.7 → 3.3.2

package/dist/core/fleet/post-merge-credit.d.ts

@@ -1,18 +1,125 @@
 /**
- * Positive post-merge learning authority.
+ * Post-merge learning evidence — report-only release protocol.
  *
- * A realized merge is an immutable operational fact, not proof that the change
- * remained beneficial. Only the future purpose-built release protocol may mint
- * this label. Existing merge receipts and observation-only stability witnesses
- * deliberately do not satisfy it.
+ * A realized merge is an immutable operational fact, not proof that the
+ * change remained beneficial. This module is the only prospective release
+ * boundary, but it mints no operational authority while the observation source
+ * remains adverse-only:
+ *
+ *   1. The proposal must carry an AUTHENTICATED realized-merge witness
+ *      (authenticatedRealizedMergeOf — binds to this exact proposal via a
+ *      local receipt HMAC or host reconciliation; shape alone is never
+ *      authority).
+ *   2. At least MIN_POST_MERGE_OBSERVATION_WINDOW_MS must have elapsed since
+ *      the merge was observed. The regression sentinel / outcome watcher
+ *      (outcome-watcher.ts) sweeps merged proposals on a 6h throttle with a
+ *      7-day follow-up window; 14 days gives ~2x that follow-up window and
+ *      dozens of scan cycles of headroom before we trust the silence.
+ *   3. The signed, observation-only post-merge-observations ledger
+ *      (post-merge-observations.ts) must contain NO adverse record
+ *      ('regressed' | 'reverted' | 'followed-up') for this exact
+ *      (repo, proposalId, mergeCommit) event, and the ledger must have read
+ *      back healthy/complete (a degraded read fails closed — we never treat
+ *      "couldn't check" as "checked clean").
+ *
+ * That ledger never records a positive "we checked, it's clean" row. Silence
+ * after a conservative window is diagnostic only, not positive confirmation;
+ * evaluation returns report-only and does not mint a label.
+ *
+ * HISTORICAL TOKEN SHAPE: the verifier remains fail-closed even for formerly
+ * valid HMAC-shaped values while operational release is disabled.
+ * isPostMergeCreditReleaseLabel() remains
+ * "structural recognition only" — matching the bare literal — for the
+ * existing defensive filters elsewhere that specifically reject the
+ * unauthenticated literal (e.g. skill-records.ts, decisions-ledger.ts).
  */
+import type { Proposal, SkillCard } from '../types.js';
+export { POST_MERGE_CREDIT_RELEASE_LABEL, isPostMergeCreditReleaseLabel, } from './post-merge-credit-label.js';
 export declare const POST_MERGE_CREDIT_POLICY_VERSION: "post-merge-credit-v1";
-export declare const POST_MERGE_CREDIT_RELEASE_LABEL: "post-merge-credit-release-v1";
-/** Structural recognition only; this string is not release authority. */
-export declare function isPostMergeCreditReleaseLabel(labelBasis: unknown): boolean;
 /**
- * No authenticated release verifier exists in this protocol version.
- * Deliberately return false even for the reserved label so raw ledgers,
- * injected dependencies, and caller-controlled metadata cannot mint credit.
+ * Minimum wall-clock time since the realized merge before credit MAY be
+ * released. See module doc for rationale (~2x the outcome-watcher follow-up
+ * window, dozens of throttled scan cycles of headroom).
+ */
+export declare const MIN_POST_MERGE_OBSERVATION_WINDOW_MS: number;
+/**
+ * Verify that `labelBasis` is a validly-signed post-merge-credit release
+ * token minted by evaluatePostMergeCreditRelease. Pure, synchronous
+ * (host-local key read only), never throws. Deliberately rejects the bare
+ * POST_MERGE_CREDIT_RELEASE_LABEL literal and any other string that is not a
+ * correctly-formed, correctly-signed token — so raw ledgers, injected
+ * dependencies, and caller-controlled metadata cannot mint credit.
+ */
+export declare function hasReleasedPostMergeCredit(labelBasis: unknown): boolean;
+export type PostMergeCreditEligibilityReason = 'clean-window-elapsed' | 'no-authenticated-merge-witness' | 'invalid-merge-timestamp' | 'observation-window-not-elapsed' | 'observation-ledger-degraded' | 'adverse-outcome-observed' | 'report-only-no-positive-stability-witness' | 'signing-unavailable' | 'error';
+export interface PostMergeCreditEligibility {
+    eligible: boolean;
+    /** Signed token to persist as labelBasis when eligible; null otherwise. */
+    label: string | null;
+    reason: PostMergeCreditEligibilityReason;
+}
+/**
+ * Determine whether `proposal` has reportable post-merge evidence RIGHT NOW.
+ * Operational eligibility remains false until a positive stability witness
+ * exists. Fail-closed on every
+ * ambiguous path (missing witness, unparseable timestamp, window not yet
+ * elapsed, degraded/incomplete observation-ledger read, any adverse
+ * observation for this exact merge event, signing failure). Never throws.
+ *
+ * This function does NOT persist anything — see sweepPostMergeCreditReleases
+ * for the write-back that records a minted label to the decisions ledger.
+ */
+export declare function evaluatePostMergeCreditRelease(proposal: Proposal, opts?: {
+    nowMs?: number;
+}): PostMergeCreditEligibility;
+export interface PostMergeCreditSweepResult {
+    /** Applied proposals inspected this pass. */
+    scanned: number;
+    /** Proposals for which a new credit-release decision row was recorded. */
+    released: number;
+    /** Proposals inspected but not released this pass (not yet eligible, or a
+     *  transient error) — never a reason to trust the negative permanently. */
+    skipped: number;
+    /** False when the proposal or decisions source was incomplete/degraded, or
+     *  the candidate cap was hit — a hint the pass should be retried. */
+    sourceComplete: boolean;
+}
+/**
+ * Sweep applied proposals for post-merge diagnostics. No operational release
+ * row is recorded while positive stability witnesses are unavailable.
+ *
+ * The post-merge-observations ledger only records adverse outcomes. Closing
+ * the release path requires a positive, complete "swept clean" witness bound
+ * to the exact merge event; elapsed time and silence are insufficient.
+ *
+ * SCALING NOTE: unlike outcome-watcher.ts, this sweep has no persistent
+ * cursor — it re-scans applied proposals from the top of listProposalsDetailed
+ * every pass, bounded by MAX_SWEEP_CANDIDATES. At small-to-moderate applied-
+ * proposal counts this converges fine (already-released proposals are
+ * skipped instantly via the decisions-ledger dedup check, so the cap mostly
+ * matters for proposals still awaiting their window). At very large scale a
+ * persistent cursor (mirroring monitoring-cursor.ts) would be needed to
+ * guarantee every proposal eventually gets swept; out of scope here.
+ *
+ * Never throws.
+ */
+export declare function sweepPostMergeCreditReleases(opts?: {
+    nowMs?: number;
+    listProposals?: () => Proposal[];
+}): PostMergeCreditSweepResult;
+/**
+ * Sign a SkillCard that legitimately carries released post-merge credit.
+ *
+ * skill-attestation.ts's generic attestSkillCard() deliberately refuses any
+ * card for which hasReleasedPostMergeCredit(card.labelBasis) is true — its
+ * signature payload doesn't cover the credit-release claim, so it must not
+ * be the thing vouching for it. This module owns that proof, so it owns this
+ * signing boundary too: same crypto primitive (signSkillCardAttestation),
+ * same payload shape, so verifyAttestedSkillCard() on the read side still
+ * validates cards signed here — only the gating differs (this function signs
+ * ONLY when hasReleasedPostMergeCredit is true; attestSkillCard signs only
+ * when it is false).
+ *
+ * Never throws.
  */
-export declare function hasReleasedPostMergeCredit(_labelBasis: unknown): boolean;
+export declare function attestPostMergeCreditSkillCard(card: SkillCard): SkillCard | null;

package/dist/core/fleet/post-merge-credit.js

@@ -1,23 +1,362 @@
 /**
- * Positive post-merge learning authority.
+ * Post-merge learning evidence — report-only release protocol.
  *
- * A realized merge is an immutable operational fact, not proof that the change
- * remained beneficial. Only the future purpose-built release protocol may mint
- * this label. Existing merge receipts and observation-only stability witnesses
- * deliberately do not satisfy it.
+ * A realized merge is an immutable operational fact, not proof that the
+ * change remained beneficial. This module is the only prospective release
+ * boundary, but it mints no operational authority while the observation source
+ * remains adverse-only:
+ *
+ *   1. The proposal must carry an AUTHENTICATED realized-merge witness
+ *      (authenticatedRealizedMergeOf — binds to this exact proposal via a
+ *      local receipt HMAC or host reconciliation; shape alone is never
+ *      authority).
+ *   2. At least MIN_POST_MERGE_OBSERVATION_WINDOW_MS must have elapsed since
+ *      the merge was observed. The regression sentinel / outcome watcher
+ *      (outcome-watcher.ts) sweeps merged proposals on a 6h throttle with a
+ *      7-day follow-up window; 14 days gives ~2x that follow-up window and
+ *      dozens of scan cycles of headroom before we trust the silence.
+ *   3. The signed, observation-only post-merge-observations ledger
+ *      (post-merge-observations.ts) must contain NO adverse record
+ *      ('regressed' | 'reverted' | 'followed-up') for this exact
+ *      (repo, proposalId, mergeCommit) event, and the ledger must have read
+ *      back healthy/complete (a degraded read fails closed — we never treat
+ *      "couldn't check" as "checked clean").
+ *
+ * That ledger never records a positive "we checked, it's clean" row. Silence
+ * after a conservative window is diagnostic only, not positive confirmation;
+ * evaluation returns report-only and does not mint a label.
+ *
+ * HISTORICAL TOKEN SHAPE: the verifier remains fail-closed even for formerly
+ * valid HMAC-shaped values while operational release is disabled.
+ * isPostMergeCreditReleaseLabel() remains
+ * "structural recognition only" — matching the bare literal — for the
+ * existing defensive filters elsewhere that specifically reject the
+ * unauthenticated literal (e.g. skill-records.ts, decisions-ledger.ts).
  */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { resolve } from 'node:path';
+import { loadOrCreateKey, signSkillCardAttestation } from '../foundry/provenance.js';
+import { authenticatedRealizedMergeOf } from '../inbox/realized-merge.js';
+import { listProposalsDetailed } from '../inbox/store.js';
+import { causalMetadataFromProposal } from '../learning/causal.js';
+import { readDecisions, recordDecision } from './decisions-ledger.js';
+import { postMergeObservationEventId, readPostMergeObservations } from './post-merge-observations.js';
+import { skillCardContentHash } from './skill-attestation.js';
+import { POST_MERGE_CREDIT_RELEASE_LABEL } from './post-merge-credit-label.js';
+export { POST_MERGE_CREDIT_RELEASE_LABEL, isPostMergeCreditReleaseLabel, } from './post-merge-credit-label.js';
+// ---------------------------------------------------------------------------
+// Structural constants
+// ---------------------------------------------------------------------------
 export const POST_MERGE_CREDIT_POLICY_VERSION = 'post-merge-credit-v1';
-export const POST_MERGE_CREDIT_RELEASE_LABEL = 'post-merge-credit-release-v1';
-/** Structural recognition only; this string is not release authority. */
-export function isPostMergeCreditReleaseLabel(labelBasis) {
-    return labelBasis === POST_MERGE_CREDIT_RELEASE_LABEL;
+/**
+ * Operational release remains disabled until a positive, complete stability
+ * witness exists. The current adverse-only ledger supports reporting, not
+ * authority to steer routing or promote reusable skills.
+ */
+const POST_MERGE_CREDIT_OPERATIONAL_RELEASE = false;
+/**
+ * Minimum wall-clock time since the realized merge before credit MAY be
+ * released. See module doc for rationale (~2x the outcome-watcher follow-up
+ * window, dozens of throttled scan cycles of headroom).
+ */
+export const MIN_POST_MERGE_OBSERVATION_WINDOW_MS = 14 * 24 * 60 * 60 * 1000;
+/** Domain-separated HMAC payload prefix for minted credit tokens. */
+const CREDIT_TOKEN_DOMAIN = 'ashlr:post-merge-credit-release:v1';
+/**
+ * Both segments are truncated to 24 hex chars (96 bits each) — plenty for
+ * MAC-forgery infeasibility and event-identifier collision-resistance at
+ * fleet scale, and DELIBERATELY short for two independent reasons discovered
+ * empirically (see test/post-merge-credit-release.test.ts):
+ *   1. decisions-ledger.ts's generic secret-scrubber (util/scrub.ts) redacts
+ *      any bare 64+ char hex run as a likely API key/hash — a 64-char segment
+ *      would be silently corrupted the moment it passed through
+ *      recordDecision().
+ *   2. recordDecision() -> sanitizeDecisionEntry() unconditionally ends with
+ *      normalizeDecisionLearningFields() (learning/causal.ts), which re-runs
+ *      causalMetadata() and applies boundedText(labelBasis, 80) — ANY
+ *      labelBasis over 80 chars is silently truncated, with no way to opt
+ *      out from a caller outside that module. The full token
+ *      ("post-merge-credit-release-v1:" (30 chars) + eventRef + ':' + mac)
+ *      must fit in 80 chars total, so each hex segment is capped at 24
+ *      (30 + 24 + 1 + 24 = 79).
+ * Neither constraint is owned by this module; 24 hex chars satisfies both
+ * with margin.
+ */
+const CREDIT_REF_HEX_CHARS = 24;
+/** `post-merge-credit-release-v1:<event-ref-hex32>:<hmac-hex32>` */
+const CREDIT_TOKEN_RE = new RegExp(`^post-merge-credit-release-v1:([a-f0-9]{${CREDIT_REF_HEX_CHARS}}):([a-f0-9]{${CREDIT_REF_HEX_CHARS}})$`);
+/** Truncate a full sha256 eventId to the reference used inside the token. */
+function creditEventRef(eventId) {
+    return eventId.slice(0, CREDIT_REF_HEX_CHARS);
+}
+function computeCreditMac(eventRef) {
+    try {
+        return createHmac('sha256', loadOrCreateKey())
+            .update(`${CREDIT_TOKEN_DOMAIN}:${eventRef}`)
+            .digest('hex')
+            .slice(0, CREDIT_REF_HEX_CHARS);
+    }
+    catch {
+        return null;
+    }
+}
+function equalHex(left, right) {
+    try {
+        const a = Buffer.from(left, 'hex');
+        const b = Buffer.from(right, 'hex');
+        return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify that `labelBasis` is a validly-signed post-merge-credit release
+ * token minted by evaluatePostMergeCreditRelease. Pure, synchronous
+ * (host-local key read only), never throws. Deliberately rejects the bare
+ * POST_MERGE_CREDIT_RELEASE_LABEL literal and any other string that is not a
+ * correctly-formed, correctly-signed token — so raw ledgers, injected
+ * dependencies, and caller-controlled metadata cannot mint credit.
+ */
+export function hasReleasedPostMergeCredit(labelBasis) {
+    try {
+        if (!POST_MERGE_CREDIT_OPERATIONAL_RELEASE)
+            return false;
+        if (typeof labelBasis !== 'string')
+            return false;
+        const match = CREDIT_TOKEN_RE.exec(labelBasis);
+        if (!match)
+            return false;
+        const eventRef = match[1];
+        const mac = match[2];
+        const expected = computeCreditMac(eventRef);
+        if (!expected)
+            return false;
+        return equalHex(mac, expected);
+    }
+    catch {
+        return false;
+    }
 }
 /**
- * No authenticated release verifier exists in this protocol version.
- * Deliberately return false even for the reserved label so raw ledgers,
- * injected dependencies, and caller-controlled metadata cannot mint credit.
+ * Determine whether `proposal` has reportable post-merge evidence RIGHT NOW.
+ * Operational eligibility remains false until a positive stability witness
+ * exists. Fail-closed on every
+ * ambiguous path (missing witness, unparseable timestamp, window not yet
+ * elapsed, degraded/incomplete observation-ledger read, any adverse
+ * observation for this exact merge event, signing failure). Never throws.
+ *
+ * This function does NOT persist anything — see sweepPostMergeCreditReleases
+ * for the write-back that records a minted label to the decisions ledger.
+ */
+export function evaluatePostMergeCreditRelease(proposal, opts = {}) {
+    try {
+        if (!proposal || typeof proposal.id !== 'string' || proposal.id.length === 0) {
+            return { eligible: false, label: null, reason: 'no-authenticated-merge-witness' };
+        }
+        const evidence = authenticatedRealizedMergeOf(proposal);
+        if (!evidence || typeof proposal.repo !== 'string' || proposal.repo.length === 0) {
+            return { eligible: false, label: null, reason: 'no-authenticated-merge-witness' };
+        }
+        const observedAtIso = evidence.source === 'github-host'
+            ? evidence.reconciliation.observedAt
+            : evidence.observedAt;
+        const mergedAtMs = Date.parse(observedAtIso);
+        if (!Number.isFinite(mergedAtMs)) {
+            return { eligible: false, label: null, reason: 'invalid-merge-timestamp' };
+        }
+        const nowMs = opts.nowMs ?? Date.now();
+        if (nowMs < mergedAtMs || nowMs - mergedAtMs < MIN_POST_MERGE_OBSERVATION_WINDOW_MS) {
+            return { eligible: false, label: null, reason: 'observation-window-not-elapsed' };
+        }
+        let repoAbs;
+        try {
+            repoAbs = resolve(proposal.repo);
+        }
+        catch {
+            return { eligible: false, label: null, reason: 'no-authenticated-merge-witness' };
+        }
+        const eventId = postMergeObservationEventId({
+            repo: repoAbs,
+            proposalId: proposal.id,
+            mergeCommit: evidence.mergeCommitOid.toLowerCase(),
+        });
+        // Adverse-only ledger: absence of a row is the only "clean" signal it can
+        // ever give us. A degraded/incomplete read must NOT be treated as clean.
+        const read = readPostMergeObservations({ requireComplete: true });
+        if (read.sourceState === 'degraded' || !read.complete) {
+            return { eligible: false, label: null, reason: 'observation-ledger-degraded' };
+        }
+        if (read.observations.some((observation) => observation.eventId === eventId)) {
+            return { eligible: false, label: null, reason: 'adverse-outcome-observed' };
+        }
+        // Silence in an adverse-only ledger is useful diagnostic evidence, but it
+        // is not positive proof that this exact merge was observed stable. Keep
+        // the entire release path report-only until such a witness exists.
+        if (!POST_MERGE_CREDIT_OPERATIONAL_RELEASE) {
+            return {
+                eligible: false,
+                label: null,
+                reason: 'report-only-no-positive-stability-witness',
+            };
+        }
+        const eventRef = creditEventRef(eventId);
+        const mac = computeCreditMac(eventRef);
+        if (!mac)
+            return { eligible: false, label: null, reason: 'signing-unavailable' };
+        return {
+            eligible: true,
+            label: `${POST_MERGE_CREDIT_RELEASE_LABEL}:${eventRef}:${mac}`,
+            reason: 'clean-window-elapsed',
+        };
+    }
+    catch {
+        return { eligible: false, label: null, reason: 'error' };
+    }
+}
+// ---------------------------------------------------------------------------
+// sweepPostMergeCreditReleases — periodic write-back
+// ---------------------------------------------------------------------------
+/**
+ * Bound on candidates inspected per sweep pass — mirrors outcome-watcher.ts's
+ * own bounding so a large backlog degrades gracefully instead of blocking.
+ */
+const MAX_SWEEP_CANDIDATES = 200;
+/**
+ * Sweep applied proposals for post-merge diagnostics. No operational release
+ * row is recorded while positive stability witnesses are unavailable.
+ *
+ * The post-merge-observations ledger only records adverse outcomes. Closing
+ * the release path requires a positive, complete "swept clean" witness bound
+ * to the exact merge event; elapsed time and silence are insufficient.
+ *
+ * SCALING NOTE: unlike outcome-watcher.ts, this sweep has no persistent
+ * cursor — it re-scans applied proposals from the top of listProposalsDetailed
+ * every pass, bounded by MAX_SWEEP_CANDIDATES. At small-to-moderate applied-
+ * proposal counts this converges fine (already-released proposals are
+ * skipped instantly via the decisions-ledger dedup check, so the cap mostly
+ * matters for proposals still awaiting their window). At very large scale a
+ * persistent cursor (mirroring monitoring-cursor.ts) would be needed to
+ * guarantee every proposal eventually gets swept; out of scope here.
+ *
+ * Never throws.
+ */
+export function sweepPostMergeCreditReleases(opts = {}) {
+    const result = {
+        scanned: 0, released: 0, skipped: 0, sourceComplete: true,
+    };
+    try {
+        const nowMs = opts.nowMs ?? Date.now();
+        let proposals;
+        if (typeof opts.listProposals === 'function') {
+            try {
+                proposals = opts.listProposals();
+            }
+            catch {
+                proposals = [];
+            }
+        }
+        else {
+            const read = listProposalsDetailed({ status: 'applied', requireComplete: true });
+            if (!read.complete || read.sourceState === 'degraded') {
+                result.sourceComplete = false;
+                return result;
+            }
+            proposals = read.proposals;
+        }
+        let inspected = 0;
+        for (const proposal of proposals) {
+            if (proposal.status !== 'applied')
+                continue;
+            if (inspected >= MAX_SWEEP_CANDIDATES) {
+                result.sourceComplete = false;
+                break;
+            }
+            inspected++;
+            result.scanned++;
+            try {
+                const existing = readDecisions({ proposalId: proposal.id, requireComplete: true });
+                const existingQuality = existing.sourceQuality;
+                if (existingQuality && (existingQuality.sourceState === 'degraded' || existingQuality.complete === false)) {
+                    result.skipped++;
+                    result.sourceComplete = false;
+                    continue;
+                }
+                const alreadyReleased = existing.some((entry) => entry.action === 'merged' && hasReleasedPostMergeCredit(entry.labelBasis));
+                if (alreadyReleased)
+                    continue;
+                const eligibility = evaluatePostMergeCreditRelease(proposal, { nowMs });
+                if (!eligibility.eligible || !eligibility.label) {
+                    result.skipped++;
+                    continue;
+                }
+                const ts = new Date(nowMs).toISOString();
+                recordDecision({
+                    ts,
+                    proposalId: proposal.id,
+                    // NOTE: labelBasis is intentionally NOT routed through
+                    // causalMetadataFromProposal's `input.labelBasis` — causalMetadata()
+                    // (learning/causal.ts) applies boundedText(value, 80) to that field,
+                    // which would silently truncate our signed token (>80 chars) into
+                    // an unverifiable fragment. Set it directly below instead, after the
+                    // spread, so the full token survives.
+                    ...causalMetadataFromProposal(proposal, { ts, learningSource: 'outcome-record' }),
+                    action: 'merged',
+                    verdict: 'applied',
+                    labelBasis: eligibility.label,
+                    repo: proposal.repo ?? '',
+                    engine: proposal.engineModel ?? '',
+                    model: '',
+                });
+                result.released++;
+            }
+            catch {
+                result.skipped++;
+            }
+        }
+        return result;
+    }
+    catch {
+        return result;
+    }
+}
+// ---------------------------------------------------------------------------
+// attestPostMergeCreditSkillCard — dedicated signing boundary
+// ---------------------------------------------------------------------------
+/**
+ * Sign a SkillCard that legitimately carries released post-merge credit.
+ *
+ * skill-attestation.ts's generic attestSkillCard() deliberately refuses any
+ * card for which hasReleasedPostMergeCredit(card.labelBasis) is true — its
+ * signature payload doesn't cover the credit-release claim, so it must not
+ * be the thing vouching for it. This module owns that proof, so it owns this
+ * signing boundary too: same crypto primitive (signSkillCardAttestation),
+ * same payload shape, so verifyAttestedSkillCard() on the read side still
+ * validates cards signed here — only the gating differs (this function signs
+ * ONLY when hasReleasedPostMergeCredit is true; attestSkillCard signs only
+ * when it is false).
+ *
+ * Never throws.
  */
-export function hasReleasedPostMergeCredit(_labelBasis) {
-    return false;
+export function attestPostMergeCreditSkillCard(card) {
+    try {
+        if (!hasReleasedPostMergeCredit(card.labelBasis))
+            return null;
+        const diffHash = card.verification?.diffHash;
+        if (!card.proposalId || !diffHash)
+            return null;
+        const contentHash = skillCardContentHash(card);
+        const attestation = signSkillCardAttestation({
+            contentHash,
+            skillId: card.skillId,
+            revision: card.revision,
+            proposalId: card.proposalId,
+            diffHash,
+        });
+        return attestation ? { ...card, contentHash, attestation } : null;
+    }
+    catch {
+        return null;
+    }
 }
 //# sourceMappingURL=post-merge-credit.js.map

package/dist/core/fleet/post-merge-credit.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-merge-credit.js","sourceRoot":"","sources":["../../../src/core/fleet/post-merge-credit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAAuC,CAAC;AAEvF,yEAAyE;AACzE,MAAM,UAAU,6BAA6B,CAAC,UAAmB;IAC/D,OAAO,UAAU,KAAK,+BAA+B,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAoB;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"post-merge-credit.js","sourceRoot":"","sources":["../../../src/core/fleet/post-merge-credit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AAEtC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAA+B,CAAC;AAChF;;;;GAIG;AACH,MAAM,qCAAqC,GAAG,KAAc,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7E,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,oEAAoE;AACpE,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,2CAA2C,oBAAoB,gBAAgB,oBAAoB,KAAK,CACzG,CAAC;AAEF,6EAA6E;AAC7E,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;aAC3C,MAAM,CAAC,GAAG,mBAAmB,IAAI,QAAQ,EAAE,CAAC;aAC5C,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAmB;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,qCAAqC;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAwBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAkB,EAClB,OAA2B,EAAE;IAE7B,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,KAAK,aAAa;YACrD,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU;YACpC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,UAAU,IAAI,KAAK,GAAG,UAAU,GAAG,oCAAoC,EAAE,CAAC;YACpF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACpF,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE;SACnD,CAAC,CAAC;QAEH,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,IAAI,GAAG,yBAAyB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9E,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,qCAAqC,EAAE,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,2CAA2C;aACpD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACjF,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,GAAG,+BAA+B,IAAI,QAAQ,IAAI,GAAG,EAAE;YAC9D,MAAM,EAAE,sBAAsB;SAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAejC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA6D,EAAE;IAE/D,MAAM,MAAM,GAA+B;QACzC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI;KAC1D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvC,IAAI,SAAqB,CAAC;QAC1B,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC9B,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC5C,IAAI,SAAS,IAAI,oBAAoB,EAAE,CAAC;gBACtC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC9B,MAAM;YACR,CAAC;YACD,SAAS,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnF,MAAM,eAAe,GAAI,QAEvB,CAAC,aAAa,CAAC;gBACjB,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,WAAW,KAAK,UAAU,IAAI,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;oBAC1G,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CACrF,CAAC;gBACF,IAAI,eAAe;oBAAE,SAAS;gBAE9B,MAAM,WAAW,GAAG,8BAA8B,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACxE,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;oBAChD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,SAAS;gBACX,CAAC;gBAED,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzC,cAAc,CAAC;oBACb,EAAE;oBACF,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,uDAAuD;oBACvD,qEAAqE;oBACrE,qEAAqE;oBACrE,kEAAkE;oBAClE,qEAAqE;oBACrE,sCAAsC;oBACtC,GAAG,0BAA0B,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;oBACjF,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,WAAW,CAAC,KAAK;oBAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE;oBACzB,MAAM,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;oBAClC,KAAK,EAAE,EAAE;iBAC8B,CAAC,CAAC;gBAC3C,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAe;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,wBAAwB,CAAC;YAC3C,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/fleet/self-improve.d.ts

@@ -10,8 +10,8 @@
  *    policy file.
  *  - FIRE-AND-FORGET: learnFromRejection() never throws, never awaits
  *    anything on the critical path. All I/O is wrapped in try/catch.
- *  - GATED: every code path checks cfg.foundry?.selfImprove !== false
- *    (default ON). When the flag is explicitly false the function returns
+ *  - GATED: every code path checks cfg.foundry?.selfImprove === true
+ *    (default OFF). Unless the flag is explicitly true the function returns
  *    immediately — byte-identical to having no call at all.
  *  - ADDITIVE: the genome entry is informational grounding for future runs.
  *    It is NOT an execution directive; it does not alter the merge gate,
@@ -23,7 +23,7 @@
  *  - TELEMETRY: a usage counter is appended to the decisions ledger under
  *    action 'self-improve:written' for observability (no PII, no secrets).
  */
-import type { AshlrConfig, GenomeEntry } from '../types.js';
+import type { AshlrConfig, DecisionEntry, GenomeEntry } from '../types.js';
 /** Hard cap on total characters injected from anti-playbook entries per run. */
 export declare const ANTI_PLAYBOOK_INJECT_CAP = 800;
 type RejectionVerdict = 'review' | 'noise' | 'harmful';
@@ -42,7 +42,7 @@ export declare function deriveLesson(verdict: RejectionVerdict, _reasoning: stri
  *   2. A decisions-ledger entry for telemetry/observability.
  *
  * NEVER THROWS. NEVER BLOCKS (all I/O is synchronous JSONL append behind
- * try/catch). Gated on cfg.foundry?.selfImprove !== false.
+ * try/catch). Gated on cfg.foundry?.selfImprove === true.
  *
  * @param proposalId  The proposal id (for ledger correlation).
  * @param proposalTitle  Legacy compatibility input; deliberately discarded.
@@ -50,7 +50,40 @@ export declare function deriveLesson(verdict: RejectionVerdict, _reasoning: stri
  * @param reasoning  Legacy compatibility input; deliberately discarded.
  * @param cfg  Fleet config.
  */
-export declare function learnFromRejection(proposalId: string, proposalTitle: string, verdict: string, reasoning: string, cfg: AshlrConfig): void;
+export declare function learnFromRejection(proposalId: string, proposalTitle: string, verdict: string, reasoning: string, cfg: AshlrConfig): boolean;
+export interface RejectionLearningSweepResult {
+    /** Distinct proposals with a rejection-shaped judge verdict inspected. */
+    scanned: number;
+    /** Proposals for which learnFromRejection actually wrote a lesson. */
+    written: number;
+    /** Proposals inspected but skipped (already written, or a transient error). */
+    skipped: number;
+    /** False when the decisions source was incomplete/degraded, or the
+     *  candidate cap was hit — a hint the pass should be retried. */
+    sourceComplete: boolean;
+}
+/**
+ * Sweep the decisions ledger for considered judged rejection verdicts (review
+ * | noise | harmful with their matching judgeReasonCode) and call
+ * learnFromRejection() for each one that hasn't already produced a lesson.
+ *
+ * learnFromRejection's ONLY prior caller was automerge-pass.ts, reached
+ * exclusively from inside the auto-merge pass (cfg.foundry.autoMerge.enabled
+ * === true). With auto-merge off — the default — a judge verdict could still
+ * be recorded (manual `ashlr judge`, a shadow/observe-only judge pass, etc.)
+ * but the fleet never learned from it. This sweep reads the SAME
+ * decisions-ledger 'judged' rows regardless of what produced them, so a
+ * rejected or failed run teaches the fleet whether or not auto-merge is on.
+ *
+ * Idempotent: a proposalId that already has a 'self-improve:written'
+ * telemetry row is skipped. Bounded, fail-open-on-nothing-to-do,
+ * fail-closed-on-source-degradation (sourceComplete:false signals "retry
+ * later", never treated as "nothing to learn"). Never throws.
+ */
+export declare function sweepRejectionLearning(cfg: AshlrConfig, opts?: {
+    sinceMs?: number;
+    listDecisions?: () => DecisionEntry[];
+}): RejectionLearningSweepResult;
 /**
  * Filter a list of genome entries to anti-playbook entries suitable for
  * inject-time grounding. Applies: