@astrosheep/keiyaku 4.6.11 → 4.6.13

package/build/src/protocol/{audit.d.ts → delivery-preview.d.ts}

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import type { ContractState, SnapshotId } from "../core/facts/types.js";
+import type { ContractState } from "../core/facts/types.js";
 import type { DocumentDerivation, IntentOutcome, MutationOperationInput } from "./operations.js";
-export declare const auditReportSchema: z.ZodObject<{
+export declare const deliveryPreviewReportSchema: z.ZodObject<{
     candidate: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"blocked">;
         refusal: z.ZodUnion<readonly [z.ZodObject<{
@@ -34,20 +34,20 @@ export declare const auditReportSchema: z.ZodObject<{
                 "unrelated-histories": "unrelated-histories";
                 conflict: "conflict";
             }>;
-            targetHead: z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>;
+            targetHead: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>;
             conflictPaths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         }, z.core.$strict>, z.ZodTransform<{
             kind: "integration-failed";
             contractId: import("../core/facts/types.js").ContractId;
             reason: "not-based-on-target" | "unrelated-histories" | "conflict";
-            targetHead: SnapshotId;
+            targetHead: import("../core/facts/types.js").SnapshotId;
         } & {
             conflictPaths?: readonly string[];
         }, {
             kind: "integration-failed";
             contractId: import("../core/facts/types.js").ContractId;
             reason: "not-based-on-target" | "unrelated-histories" | "conflict";
-            targetHead: SnapshotId;
+            targetHead: import("../core/facts/types.js").SnapshotId;
             conflictPaths?: readonly string[] | undefined;
         }>>, z.ZodObject<{
             kind: z.ZodLiteral<"integration-unsupported">;
@@ -76,10 +76,10 @@ export declare const auditReportSchema: z.ZodObject<{
         }, z.core.$strict>;
         identity: z.ZodObject<{
             note: z.ZodOptional<z.ZodString>;
-            tenderSnapshot: z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>;
+            tenderSnapshot: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>;
             integration: z.ZodObject<{
-                predecessor: z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>;
-                snapshot: z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>;
+                predecessor: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>;
+                snapshot: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>;
                 changeId: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").ChangeId, string>>;
             }, z.core.$strict>;
             method: z.ZodLiteral<"squash">;
@@ -94,92 +94,49 @@ export declare const auditReportSchema: z.ZodObject<{
             paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         }, z.core.$strict>;
         diff: z.ZodOptional<z.ZodString>;
+        requirements: z.ZodObject<{
+            gates: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                gate: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").Gate, string>>;
+                current: z.ZodUnion<readonly [z.ZodObject<{
+                    kind: z.ZodLiteral<"missing">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"attested">;
+                    verdict: z.ZodEnum<{
+                        satisfied: "satisfied";
+                        unsatisfied: "unsatisfied";
+                    }>;
+                    at: z.ZodString;
+                    summary: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"stale">;
+                    priorVerdict: z.ZodEnum<{
+                        satisfied: "satisfied";
+                        unsatisfied: "unsatisfied";
+                    }>;
+                    reason: z.ZodOptional<z.ZodObject<{
+                        kind: z.ZodLiteral<"candidate-content-changed">;
+                        target: z.ZodOptional<z.ZodString>;
+                        previousChange: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").ChangeId, string>>;
+                        currentChange: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").ChangeId, string>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>]>;
+            }, z.core.$strict>>>;
+            unmetPrerequisites: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                contractId: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").ContractId, string>>;
+                state: z.ZodEnum<{
+                    abandoned: "abandoned";
+                    missing: "missing";
+                    active: "active";
+                }>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>;
     }, z.core.$strict>]>;
     verification: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"not-run">;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"undeclared">;
     }, z.core.$strict>, z.ZodObject<{
-        kind: z.ZodLiteral<"stopped">;
-        stop: z.ZodUnion<readonly [z.ZodObject<{
-            refusal: z.ZodUnion<readonly [z.ZodObject<{
-                kind: z.ZodEnum<{
-                    terminal: "terminal";
-                    "contract-missing": "contract-missing";
-                }>;
-                contractId: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").ContractId, string>>;
-            }, z.core.$strict>, z.ZodObject<{
-                kind: z.ZodLiteral<"verification-declaration-invalid">;
-                contractId: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").ContractId, string>>>;
-            }, z.core.$strict>]>;
-        }, z.core.$strict>, z.ZodObject<{
-            retry: z.ZodUnion<readonly [z.ZodObject<{
-                kind: z.ZodEnum<{
-                    exhausted: "exhausted";
-                    collision: "collision";
-                }>;
-            }, z.core.$strict>, z.ZodObject<{
-                kind: z.ZodLiteral<"publication-failed">;
-                diagnostic: z.ZodString;
-            }, z.core.$strict>]>;
-        }, z.core.$strict>, z.ZodUnion<readonly [z.ZodObject<{
-            stdout: z.ZodOptional<z.ZodString>;
-            stderr: z.ZodOptional<z.ZodString>;
-            truncated: z.ZodOptional<z.ZodLiteral<true>>;
-            failure: z.ZodEnum<{
-                cancelled: "cancelled";
-                "unknown-exit": "unknown-exit";
-            }>;
-        }, z.core.$strict>, z.ZodObject<{
-            stdout: z.ZodOptional<z.ZodString>;
-            stderr: z.ZodOptional<z.ZodString>;
-            truncated: z.ZodOptional<z.ZodLiteral<true>>;
-            failure: z.ZodEnum<{
-                "spawn-error": "spawn-error";
-                "candidate-unavailable": "candidate-unavailable";
-            }>;
-            diagnostic: z.ZodString;
-        }, z.core.$strict>, z.ZodObject<{
-            stdout: z.ZodOptional<z.ZodString>;
-            stderr: z.ZodOptional<z.ZodString>;
-            truncated: z.ZodOptional<z.ZodLiteral<true>>;
-            failure: z.ZodLiteral<"environment-failure">;
-            diagnostic: z.ZodString;
-        }, z.core.$strict>, z.ZodObject<{
-            stdout: z.ZodOptional<z.ZodString>;
-            stderr: z.ZodOptional<z.ZodString>;
-            truncated: z.ZodOptional<z.ZodLiteral<true>>;
-            failure: z.ZodLiteral<"environment-failure">;
-            name: z.ZodString;
-            detail: z.ZodUnion<readonly [z.ZodObject<{
-                kind: z.ZodLiteral<"exit">;
-                code: z.ZodNumber;
-                stdout: z.ZodString;
-                stderr: z.ZodString;
-                truncated: z.ZodBoolean;
-            }, z.core.$strict>, z.ZodObject<{
-                stdout: z.ZodOptional<z.ZodString>;
-                stderr: z.ZodOptional<z.ZodString>;
-                truncated: z.ZodOptional<z.ZodBoolean>;
-                kind: z.ZodLiteral<"timeout">;
-            }, z.core.$strict>, z.ZodObject<{
-                stdout: z.ZodOptional<z.ZodString>;
-                stderr: z.ZodOptional<z.ZodString>;
-                truncated: z.ZodOptional<z.ZodBoolean>;
-                kind: z.ZodLiteral<"unknown-exit">;
-            }, z.core.$strict>, z.ZodObject<{
-                kind: z.ZodLiteral<"spawn-error">;
-                diagnostic: z.ZodString;
-            }, z.core.$strict>]>;
-        }, z.core.$strict>]>]>;
-    }, z.core.$strict>, z.ZodObject<{
-        kind: z.ZodEnum<{
-            satisfied: "satisfied";
-            unsatisfied: "unsatisfied";
-        }>;
-        passed: z.ZodNumber;
-        total: z.ZodNumber;
-        summary: z.ZodOptional<z.ZodString>;
+        kind: z.ZodLiteral<"required">;
     }, z.core.$strict>, z.ZodObject<{
         entry: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").EntryUlid, string>>;
         verdict: z.ZodEnum<{
@@ -187,19 +144,27 @@ export declare const auditReportSchema: z.ZodObject<{
             unsatisfied: "unsatisfied";
         }>;
         summary: z.ZodOptional<z.ZodString>;
-        kind: z.ZodLiteral<"reused">;
+        kind: z.ZodLiteral<"recorded">;
     }, z.core.$strict>]>;
     target: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"not-observed">;
     }, z.core.$strict>, z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"placeable">;
         ref: z.ZodString;
-        head: z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>;
+        head: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>;
+        checkouts: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"followable">;
+            path: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"not-followable">;
+            path: z.ZodString;
+            diagnostic: z.ZodString;
+        }, z.core.$strict>]>>>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"moved">;
         ref: z.ZodString;
-        expected: z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>;
-        observed: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<SnapshotId, string>>>;
+        expected: z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>;
+        observed: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<import("../core/facts/types.js").SnapshotId, string>>>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"refused">;
         refusal: z.ZodObject<{
@@ -251,14 +216,14 @@ export declare const auditReportSchema: z.ZodObject<{
         }, z.core.$strict>]>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
-export type AuditReport = z.infer<typeof auditReportSchema>;
-type AuditOperationInput = MutationOperationInput & Readonly<{
-    deriveDocument?: (state: ContractState) => DocumentDerivation;
+export type DeliveryPreviewReport = z.infer<typeof deliveryPreviewReportSchema>;
+type DeliveryPreviewOperationInput = MutationOperationInput & Readonly<{
+    deriveDocument: (state: ContractState) => DocumentDerivation;
     requireBranchesToBeUpToDate?: boolean;
     includeDirty?: boolean;
     showDiff?: boolean;
     signal?: AbortSignal;
 }>;
-type AuditRefusal = import("../core/verbs/deliver.js").DeliverRefusal | import("../verification/declaration.js").VerificationDeclarationRefusal;
-export declare function auditOperation(input: AuditOperationInput): Promise<IntentOutcome<AuditReport, AuditRefusal>>;
+type PreviewRefusal = import("../core/verbs/deliver.js").DeliverRefusal | import("../verification/declaration.js").VerificationDeclarationRefusal;
+export declare function previewDeliveryOperation(input: DeliveryPreviewOperationInput): Promise<IntentOutcome<DeliveryPreviewReport, PreviewRefusal>>;
 export {};

package/build/src/protocol/delivery-preview.js

@@ -0,0 +1,167 @@
+import { z } from "zod";
+import { deliverDataSchema, deliveryPreparationRefusalSchema, changeIdSchema, verdictSchema, entryUlidSchema, contractIdSchema, gateReportSchema, recordedIntegrationSnapshots, } from "./operations.js";
+import { previewTargetAnswerSchema, adjudicatePreviewTarget } from "../git/target-placement.js";
+import { verificationReuseSchema, currentVerifiedAttestation } from "./intent.js";
+import { deliveryDiffScopeSchema, readDeliveryDiff, readDeliveryScope } from "../git/integration.js";
+import { observeGitForAdmissionAt } from "../git/observe.js";
+import { activeContract, documentIsCurrent } from "../core/facts/observation.js";
+import { gateReports } from "../core/facts/gate.js";
+import { unmetPrerequisites } from "../core/verbs/placement.js";
+import { observeTargetLag, contractTargetLagSchema, worktreeWorkspaceSchema } from "../git/workspace.js";
+import { readManagedWorktreeAppointment } from "../workspace-place.js";
+import { accepted } from "./outcome.js";
+import { prepareDelivery } from "./deliver.js";
+export const deliveryPreviewReportSchema = z
+    .object({
+    candidate: z.union([
+        z.object({ kind: z.literal("blocked"), refusal: deliveryPreparationRefusalSchema }).strict(),
+        z
+            .object({
+            kind: z.literal("ready"),
+            workspace: worktreeWorkspaceSchema,
+            identity: deliverDataSchema,
+            scope: deliveryDiffScopeSchema,
+            diff: z.string().optional(),
+            requirements: z
+                .object({
+                gates: z.array(gateReportSchema).readonly(),
+                unmetPrerequisites: z
+                    .array(z
+                    .object({
+                    contractId: contractIdSchema,
+                    state: z.enum(["missing", "active", "abandoned"]),
+                })
+                    .strict())
+                    .readonly(),
+            })
+                .strict(),
+        })
+            .strict(),
+    ]),
+    verification: z.union([
+        z.object({ kind: z.literal("not-run") }).strict(),
+        z.object({ kind: z.literal("undeclared") }).strict(),
+        z.object({ kind: z.literal("required") }).strict(),
+        verificationReuseSchema.extend({ kind: z.literal("recorded") }).strict(),
+    ]),
+    target: z.union([z.object({ kind: z.literal("not-observed") }).strict(), previewTargetAnswerSchema]),
+    targetLag: contractTargetLagSchema.optional(),
+    delivery: z
+        .object({
+        changeId: changeIdSchema,
+        relation: z.enum(["identical", "differs"]),
+        verification: z.union([
+            z.object({ kind: z.enum(["undeclared", "unrecorded"]) }).strict(),
+            z.object({ kind: z.literal("recorded"), verdict: verdictSchema, fact: entryUlidSchema }).strict(),
+        ]),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+function deliveryRelation(state, candidate, declaration) {
+    const recorded = state.delivery?.data.integration.changeId;
+    if (recorded === undefined)
+        return undefined;
+    const verification = declaration === null ? undefined : currentVerifiedAttestation(state);
+    return {
+        changeId: recorded,
+        relation: recorded === candidate.integration.changeId ? "identical" : "differs",
+        verification: declaration === null
+            ? { kind: "undeclared" }
+            : verification === undefined
+                ? { kind: "unrecorded" }
+                : { kind: "recorded", verdict: verification.verdict, fact: verification.entry },
+    };
+}
+function verificationAnswer(prospective, declaration) {
+    if (declaration === null)
+        return { kind: "undeclared" };
+    const evidence = currentVerifiedAttestation(prospective);
+    return evidence === undefined ? { kind: "required" } : { kind: "recorded", ...evidence };
+}
+async function readyCandidate(repository, candidate, workspace, requirements, showDiff) {
+    const { predecessor, snapshot } = candidate.integration;
+    const scope = await readDeliveryScope(repository, predecessor, snapshot, showDiff);
+    const diff = showDiff ? await readDeliveryDiff(repository, predecessor, snapshot) : undefined;
+    return {
+        kind: "ready",
+        workspace,
+        identity: candidate,
+        scope,
+        requirements,
+        ...(diff === undefined || diff === null ? {} : { diff }),
+    };
+}
+async function targetAnswer(repository, state, candidate) {
+    const target = state.coordinates.target;
+    if (target === undefined)
+        return { kind: "not-observed" };
+    return await adjudicatePreviewTarget(repository, {
+        contractId: state.id,
+        coordinates: { ...state.coordinates, target },
+        predecessor: candidate.integration.predecessor,
+        candidate: candidate.integration.snapshot,
+    });
+}
+function blockedPreview(refusal) {
+    return {
+        candidate: { kind: "blocked", refusal },
+        verification: { kind: "not-run" },
+        target: { kind: "not-observed" },
+    };
+}
+export async function previewDeliveryOperation(input) {
+    input.signal?.throwIfAborted();
+    const observed = await observeGitForAdmissionAt(input.scope, input.channel, [input.contractId]);
+    const state = activeContract(observed.decision, input.contractId);
+    if ("kind" in state)
+        return { kind: "refused", refusal: state };
+    const derivation = input.deriveDocument(state);
+    if (!documentIsCurrent(state, derivation.document)) {
+        return { kind: "refused", refusal: { kind: "document-moved", contractId: input.contractId } };
+    }
+    if (derivation.verification.kind === "refused")
+        return { kind: "refused", refusal: derivation.verification.refusal };
+    const appointment = await readManagedWorktreeAppointment(input.scope, state.id);
+    if (appointment.kind === "failed")
+        throw new Error(appointment.diagnostic);
+    if (appointment.kind === "unappointed") {
+        return accepted(state, [], blockedPreview({ kind: "worktree-missing", contractId: state.id }));
+    }
+    const prepared = await prepareDelivery(input.scope, {
+        contractId: state.id,
+        coordinates: state.coordinates,
+        recordedIntegrations: recordedIntegrationSnapshots(observed.journals.get(state.id)?.entries ?? []),
+        appointment,
+    }, {
+        title: derivation.title,
+        document: derivation.bytes,
+        ...(input.actor === undefined ? {} : { actor: input.actor }),
+        requireBranchesToBeUpToDate: input.requireBranchesToBeUpToDate ?? false,
+        includeDirty: input.includeDirty ?? false,
+    });
+    if (prepared.kind === "refused")
+        return accepted(state, [], blockedPreview(prepared.refusal));
+    // Supply prospective keys to the generic currentness owner, never a fabricated delivery fact.
+    const prospective = { ...state, currentIntegration: prepared.data.integration };
+    const candidate = await readyCandidate(input.scope, prepared.data, { kind: "worktree", path: appointment.path }, {
+        gates: gateReports(prospective).reports,
+        unmetPrerequisites: unmetPrerequisites(state.terms.after, observed.decision),
+    }, input.showDiff === true);
+    input.progress?.recordDeliveryPreview(state.id, { candidate });
+    const verification = verificationAnswer(prospective, derivation.verification.data);
+    const delivery = deliveryRelation(state, prepared.data, derivation.verification.data);
+    input.progress?.recordDeliveryPreview(state.id, { verification, ...(delivery === undefined ? {} : { delivery }) });
+    const target = await targetAnswer(input.scope, state, prepared.data);
+    input.progress?.recordDeliveryPreview(state.id, { target });
+    const targetLag = target.kind === "placeable" ? await observeTargetLag(input.scope, appointment.path, target.head) : undefined;
+    const value = {
+        candidate,
+        verification,
+        target,
+        ...(targetLag === undefined ? {} : { targetLag }),
+        ...(delivery === undefined ? {} : { delivery }),
+    };
+    return accepted(state, [], value);
+}

package/build/src/protocol/progress.d.ts

@@ -118,7 +118,7 @@ export interface ProtocolProgress {
     recordPlacementPhysical(contractId: ContractId, report: ReconcileResult): void;
     recordVerification(contractId: ContractId, snapshot: SnapshotId | undefined, result: VerificationResidue): void;
     recordStop(stop: ExecutionStop): void;
-    recordAudit(contractId: ContractId, report: Partial<import("./audit.js").AuditReport>): void;
+    recordDeliveryPreview(contractId: ContractId, report: Partial<import("./delivery-preview.js").DeliveryPreviewReport>): void;
     /** Current candidate conclusions, retained before the next await can fail. */
     recordCandidate(contractId: ContractId, evidence: CompletionEvidence): void;
     /** The candidate's completion base, retained before an optional scope read can fail. */

package/build/src/runtime/proc/run.js

@@ -197,12 +197,18 @@ async function executeProcess(input, timeoutMs, consumeStdout, spawnProcess = sp
     const terminationFailure = new Promise((resolve) => {
         reportTerminationFailure = (error) => resolve({ kind: "termination-error", error });
     });
+    const terminate = () => {
+        if (termination === undefined) {
+            termination = terminateOwnedProcess(child);
+            void termination.catch(reportTerminationFailure);
+        }
+        return termination;
+    };
     const requestStop = (reason) => {
         if (stop !== undefined)
             return;
         stop = reason;
-        termination = terminateOwnedProcess(child);
-        void termination.catch(reportTerminationFailure);
+        void terminate();
     };
     const failStream = (error) => {
         if (streamError !== undefined)
@@ -235,16 +241,28 @@ async function executeProcess(input, timeoutMs, consumeStdout, spawnProcess = sp
     const cancel = () => requestStop("cancelled");
     input.signal?.addEventListener("abort", cancel, { once: true });
     const timeout = timeoutMs === undefined ? undefined : setTimeout(() => requestStop("timeout"), timeoutMs);
+    const retire = () => {
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+        input.signal?.removeEventListener("abort", cancel);
+        void terminate();
+    };
+    // Descendants can retain the output pipes after leader exit, so cleanup must
+    // start at exit rather than waiting for close. Close still drains the output.
+    child.once("exit", retire);
     const terminal = await waitForProcessEnd(child, terminationFailure);
     if (timeout !== undefined)
         clearTimeout(timeout);
     input.signal?.removeEventListener("abort", cancel);
+    child.removeListener("exit", retire);
     if (terminal.kind === "termination-error")
         throw terminal.error;
-    await termination;
+    await terminate();
     output.finish();
-    const pid = child.pid ?? null;
     const capture = capturedOutput(stdout.result(), stderr.result(), consumeStdout !== undefined);
+    return processConsumption(terminal, capture, child.pid ?? null, streamError, stop);
+}
+function processConsumption(terminal, capture, pid, streamError, stop) {
     if (terminal.kind === "spawn-error") {
         return { outcome: { kind: "spawn-error", diagnostic: terminal.error.message, ...capture }, pid };
     }

package/build/src/verification/execution.d.ts

@@ -1,6 +1,6 @@
 import type { ContractId, SnapshotId } from "../core/facts/types.js";
 import { type HookFailure } from "../git/hooks.js";
-import type { MaterializedScratchCandidate, WorktreeLeak } from "../git/scratch.js";
+import { type MaterializedScratchCandidate, type WorktreeLeak } from "../git/scratch.js";
 import type { GitRepository } from "../git/process.js";
 import type { Settings } from "../settings.js";
 import type { VerificationObservation } from "./observation.js";

package/build/src/verification/execution.js

@@ -1,4 +1,5 @@
 import { runHookCommands, worktreeHooksFrom } from "../git/hooks.js";
+import { ScratchMaterializationError } from "../git/scratch.js";
 import { runProcess } from "../runtime/proc/run.js";
 const SUMMARY_BYTES = 32 * 1024;
 export function capturedOutput(value) {
@@ -129,10 +130,11 @@ async function materializeScratch(input) {
             state: "finished",
             outcome: input.signal?.aborted ? "cancelled" : "failed",
         });
-        if (input.signal?.aborted)
-            return { outcome: { kind: "cancelled" } };
         return {
-            outcome: { kind: "candidate-unavailable", diagnostic: error instanceof Error ? error.message : String(error) },
+            outcome: input.signal?.aborted
+                ? { kind: "cancelled" }
+                : { kind: "candidate-unavailable", diagnostic: error instanceof Error ? error.message : String(error) },
+            ...(error instanceof ScratchMaterializationError ? { leak: error.leak } : {}),
         };
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrosheep/keiyaku",
-  "version": "4.6.11",
+  "version": "4.6.13",
   "workspaces": [
     "plugins/square",
     "plugins/paseo/forwarder"
@@ -64,14 +64,16 @@
     "@earendil-works/pi-coding-agent": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^1.0.0",
+    "@earendil-works/pi-coding-agent": "^1.4.0",
     "@getpaseo/plugin": "0.11.2",
+    "@getpaseo/server": "0.11.2",
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^25.0.0",
     "@types/ws": "^8.18.2",
     "@typescript-eslint/parser": "^8.66.0",
     "eslint": "^9.39.5",
     "knip": "^6.31.0",
+    "pino": "^10.4.0",
     "prettier": "3.6.2",
     "tsx": "^4.20.0",
     "typescript": "^5.9.0"
@@ -84,6 +86,7 @@
     "@getpaseo/client": "0.11.2",
     "@getpaseo/protocol": "0.11.2",
     "@opencode/client": "2.0.20",
+    "@opencode/schema": "2.0.20",
     "cross-spawn": "^7.0.6",
     "diff": "^8.0.4",
     "undici": "8.10.2",

package/skills/keiyaku/SKILL.md

@@ -36,7 +36,9 @@ selects the Contract repository; it never retargets that World. `call
 cwd). Without it, the call uses the invocation cwd; `--contract` associates a
 Contract without selecting an execution directory.
 
-`deliver`, `review`, and `audit` may take time after their leading admission.
+`deliver` and `review` may take time after their leading admission.
+`deliver --dry-run` only observes the prospective candidate, standing evidence,
+and target followability; it never runs Verification or hooks or admits work.
 Their witnessed progress is ephemeral stderr output; stdout remains one final
 text or JSON result. Ctrl-C asks the owned operation to stop and waits for its
 truthful final receipt, so it is not evidence that an already admitted action

package/skills/keiyaku-babysit/SKILL.md

@@ -54,7 +54,7 @@ does not move without you.
 | Silent wedge: initial answer empty and worktree clean | Inspect status and history, then send one steering `tell`. If the worker remains unresponsive, `kill` and call a new Akuma; an empty answer alone is not proof the Contract failed. |
 | Verdict record refused with `not-allowed` | Read the worker's analysis in history. Record the verdict yourself if you did not deliver the candidate, or call a new Reviewer with the grant from `keiyaku-workflow` and have it inspect current work and record a fresh verdict. The refused request wrote no Contract testimony. |
 | Review stale after changed candidate tender | Normal content-currentness result. Give the same Reviewer the changed diff and current terms with `tell`; have it re-examine and record current testimony. A target move alone does not stale review. |
-| Target moved under the appointed worktree | Have the Deliverer inspect target movement and merge the target branch (main when selected) in that worktree when required; resolve conflicts there, then audit again. Do not resolve against a stale integration preview. |
+| Target moved under the appointed worktree | Have the Deliverer inspect target movement and merge the target branch (main when selected) in that worktree when required; resolve conflicts there, then run `deliver --dry-run` again. Do not resolve against a stale integration preview. |
 | Typed refusal names its rule | Fix the named input or physical condition, then retry from a fresh observation. Do not repeat the same request blindly. |
 
 ## What Babysitting Never Owns

package/skills/keiyaku-bind/SKILL.md

@@ -157,8 +157,9 @@ commands; `5m` is the normal baseline.
 Verification runs only when the Contract selects the `verified` gate, against
 the exact integration snapshot in a clean disposable worktree for that attempt.
 `deliver` reuses current satisfied evidence or runs the declarations; unsatisfied
-results and runtime stops prevent placement. `audit` runs declarations for a
-prospective candidate. Without `verified`, no verb runs Verification and the
+results and runtime stops prevent placement. `deliver --dry-run` only observes
+standing evidence for a prospective candidate; it never executes declarations.
+Without `verified`, no verb runs Verification and the
 section is inert document text. `reviewed` independently requires review
 evidence. Selected gates are checked at placement.
 

package/skills/keiyaku-workflow/SKILL.md

@@ -69,12 +69,13 @@ Each act changes a different part of the world:
   `reconcile` retries workspace realization.
 - **Work:** Changes and commits belong in the appointed worktree. Another
   lane's claim can move the target beneath it. Check target movement before
-  audit; when it matters, merge the target branch (main when selected) in the
-  worktree and resolve conflicts there before auditing.
-- **Audit:** Previews the candidate and target without tendering or claiming.
-  With `verified` selected, Verification runs for the captured subject and can
-  record an attestation. Without that gate, the section is inert text and no
-  verb runs Verification. A stopped run records no new verdict.
+  delivery preview; when it matters, merge the target branch (main when selected)
+  in the worktree and resolve conflicts there before previewing again.
+- **Delivery preview:** Use `deliver --dry-run` to observe the candidate, existing
+  Verification evidence and target followability without tendering or claiming.
+  It never runs Verification or hooks, admits testimony, or reconciles. Missing
+  or stale evidence means Verification is still required; an existing failure
+  remains unsatisfied. Preparation is not a promise of successful delivery.
 - **Deliver:** Captures a tender and integration against the observed target;
   journal gains a delivered candidate. Ready prerequisites and gates trigger
   placement and claim in this invocation; otherwise the candidate waits.
@@ -88,7 +89,7 @@ Each act changes a different part of the world:
   and abandoned Contracts cannot be reopened.
 
 Placement judges declared gates, not the producer's identity. Review does not
-replace Verification; audit never requests placement. Read the final receipt
+replace Verification; delivery preview never requests placement. Read the final receipt
 for stops and reconciliation lag after an admitted act.
 
 ## 5. Handing A Role To An Akuma
@@ -101,7 +102,7 @@ authority.
 | Role | Grant at birth | Return |
 | --- | --- | --- |
 | Holder | The actions the delegated loop will perform; include `contract.review` when this holder will review. Commission with the `kei`, current Arc when one exists, appointed worktree, and holder duties. | Acceptance or abandonment, with receipts. |
-| Deliverer | The ordinary baseline: every Debt mutation, Contract audit and delivery, and Akuma management. `keiyaku -C <repo> call worker --alias @deliverer --contract <kei/...> --workdir <appointed-path> -` | The delivery receipt. |
+| Deliverer | The ordinary baseline: every Debt mutation, Contract delivery, and Akuma management. Preview is unkeyed. `keiyaku -C <repo> call worker --alias @deliverer --contract <kei/...> --workdir <appointed-path> -` | The delivery receipt. |
 | Reviewer | `--allowed contract.review`: `keiyaku -C <repo> call review-akuma --alias @reviewer --contract <kei/...> --workdir <appointed-path> --allowed contract.review -` | The verdict receipt. Without the grant, `not-allowed` refuses and no verdict is recorded. |
 
 An Archetype's explicit allowed set replaces the ordinary baseline; check

package/build/src/cli/render/audit.d.ts

@@ -1,7 +0,0 @@
-import type { AuditOutcome } from "../../index.js";
-import { type TextRenderContext } from "./terminal.js";
-type AcceptedAudit = Extract<AuditOutcome, {
-    kind: "accepted";
-}>;
-export declare function renderAcceptedAudit(result: AcceptedAudit, context?: TextRenderContext): string;
-export {};