@atmin.ai/review 0.1.0-alpha.2

package/dist/github/store.d.ts

@@ -0,0 +1,40 @@
+import { DatabaseSync } from 'node:sqlite';
+export type JobState = 'queued' | 'running' | 'publishing' | 'completed' | 'failed' | 'cancelled' | 'skipped' | 'uncertain';
+export interface Job {
+    id: string;
+    pr: number;
+    state: JobState;
+    created: number;
+    started: number | null;
+    artifact: string | null;
+    report: string | null;
+    error: string | null;
+    createStarted: number;
+}
+export declare class Store {
+    readonly db: DatabaseSync;
+    constructor(directory: string);
+    close(): void;
+    transaction<T>(fn: () => T): T;
+    enabled(): boolean;
+    enable(value: boolean): void;
+    seen(delivery: string): boolean;
+    enqueue(delivery: string, pr: number): string | null;
+    acquire(owner: string, now?: number): boolean;
+    renew(owner: string): boolean;
+    release(owner: string): void;
+    owns(owner: string): boolean;
+    current(job: Job, owner: string): boolean;
+    next(owner: string): Job | null;
+    reserve(job: Job, owner: string, limit: number): boolean;
+    get(id: string): Job;
+    update(id: string, values: Partial<Pick<Job, 'state' | 'artifact' | 'report' | 'error' | 'createStarted'>>): void;
+    comment(pr: number): number | null;
+    track(pr: number, baseRef: string, active: boolean): void;
+    branchPulls(baseRef: string): number[];
+    setComment(pr: number, id: number): void;
+    uncertainCreate(pr: number): boolean;
+    creationConfirmed(pr: number, comment: number): void;
+    retryPublication(pr: number): boolean;
+    status(): unknown;
+}

package/dist/github/store.js

@@ -0,0 +1,134 @@
+import { DatabaseSync } from 'node:sqlite';
+import { randomUUID } from 'node:crypto';
+import { chmodSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+// One service owns the worker lease. Local CLI controls share the WAL database.
+export class Store {
+    db;
+    constructor(directory) {
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        chmodSync(directory, 0o700);
+        const path = join(directory, 'pilot.sqlite');
+        this.db = new DatabaseSync(path);
+        chmodSync(path, 0o600);
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;
+      CREATE TABLE IF NOT EXISTS control (id INTEGER PRIMARY KEY CHECK(id=1), enabled INTEGER NOT NULL DEFAULT 0, owner TEXT, lease INTEGER NOT NULL DEFAULT 0);
+      INSERT OR IGNORE INTO control(id) VALUES(1);
+      CREATE TABLE IF NOT EXISTS deliveries (id TEXT PRIMARY KEY, received INTEGER NOT NULL);
+      CREATE TABLE IF NOT EXISTS jobs (id TEXT PRIMARY KEY, pr INTEGER NOT NULL, state TEXT NOT NULL, created INTEGER NOT NULL, started INTEGER, artifact TEXT, report TEXT, error TEXT, createStarted INTEGER NOT NULL DEFAULT 0);
+      CREATE TABLE IF NOT EXISTS pulls (pr INTEGER PRIMARY KEY, desired TEXT NOT NULL, comment INTEGER, baseRef TEXT, active INTEGER NOT NULL DEFAULT 1);
+      CREATE INDEX IF NOT EXISTS jobs_state ON jobs(state, created);`);
+    }
+    close() { this.db.close(); }
+    transaction(fn) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const value = fn();
+            this.db.exec('COMMIT');
+            return value;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    enabled() { return Boolean(this.db.prepare('SELECT enabled FROM control').get().enabled); }
+    enable(value) {
+        this.transaction(() => {
+            this.db.prepare('UPDATE control SET enabled=?').run(Number(value));
+            if (!value)
+                this.db.prepare("UPDATE jobs SET state='cancelled', error='operator-paused' WHERE state IN ('queued','running','publishing')").run();
+        });
+    }
+    seen(delivery) { return Boolean(this.db.prepare('SELECT 1 FROM deliveries WHERE id=?').get(delivery)); }
+    enqueue(delivery, pr) {
+        return this.transaction(() => {
+            if (this.seen(delivery))
+                return null;
+            this.db.prepare('INSERT INTO deliveries VALUES(?,?)').run(delivery, Date.now());
+            if (!this.enabled())
+                return null;
+            const id = randomUUID();
+            this.db.prepare("UPDATE jobs SET state='cancelled', error='superseded' WHERE pr=? AND state IN ('queued','running','publishing')").run(pr);
+            this.db.prepare("INSERT INTO jobs(id,pr,state,created) VALUES(?,?,'queued',?)").run(id, pr, Date.now());
+            this.db.prepare('INSERT INTO pulls(pr,desired) VALUES(?,?) ON CONFLICT(pr) DO UPDATE SET desired=excluded.desired').run(pr, id);
+            return id;
+        });
+    }
+    acquire(owner, now = Date.now()) {
+        return this.transaction(() => {
+            const control = this.db.prepare('SELECT owner,lease FROM control').get();
+            if (control.owner !== owner && Number(control.lease) > now)
+                return false;
+            // Never restart interrupted inference automatically: its reservation may have been consumed.
+            if (control.owner !== owner)
+                this.db.prepare("UPDATE jobs SET state=CASE WHEN report IS NULL THEN 'failed' ELSE 'publishing' END, error='worker-interrupted; explicit rerun required' WHERE state='running'").run();
+            this.db.prepare('UPDATE control SET owner=?,lease=?').run(owner, now + 30_000);
+            return true;
+        });
+    }
+    renew(owner) {
+        return this.db.prepare('UPDATE control SET lease=? WHERE owner=? AND lease>?').run(Date.now() + 30_000, owner, Date.now()).changes === 1;
+    }
+    release(owner) { this.db.prepare('UPDATE control SET owner=NULL,lease=0 WHERE owner=?').run(owner); }
+    owns(owner) { return Boolean(this.db.prepare('SELECT 1 FROM control WHERE owner=? AND lease>?').get(owner, Date.now())); }
+    current(job, owner) {
+        return this.enabled() && this.owns(owner) && Boolean(this.db.prepare("SELECT 1 FROM pulls JOIN jobs ON pulls.desired=jobs.id WHERE jobs.id=? AND jobs.state IN ('running','publishing')").get(job.id));
+    }
+    next(owner) {
+        return this.transaction(() => {
+            if (!this.enabled() || !this.owns(owner))
+                return null;
+            const resume = this.db.prepare("SELECT * FROM jobs WHERE state='publishing' ORDER BY created LIMIT 1").get();
+            if (resume)
+                return resume;
+            const job = this.db.prepare("SELECT * FROM jobs WHERE state='queued' ORDER BY created LIMIT 1").get();
+            if (!job)
+                return null;
+            this.db.prepare("UPDATE jobs SET state='running' WHERE id=?").run(job.id);
+            return this.get(job.id);
+        });
+    }
+    reserve(job, owner, limit) {
+        return this.transaction(() => {
+            if (!this.current(job, owner))
+                return false;
+            const count = Number(this.db.prepare('SELECT count(*) AS n FROM jobs WHERE started>?').get(Date.now() - 86_400_000).n);
+            if (count >= limit)
+                return false;
+            this.db.prepare('UPDATE jobs SET started=? WHERE id=?').run(Date.now(), job.id);
+            return true;
+        });
+    }
+    get(id) { return this.db.prepare('SELECT * FROM jobs WHERE id=?').get(id); }
+    update(id, values) {
+        const entries = Object.entries(values);
+        if (!entries.length)
+            return;
+        const allowed = ['state', 'artifact', 'report', 'error', 'createStarted'];
+        if (entries.some(([key]) => !allowed.includes(key)))
+            throw new Error('Invalid job field');
+        this.db.prepare(`UPDATE jobs SET ${entries.map(([key]) => `${key}=?`).join(',')} WHERE id=?`).run(...entries.map(([, v]) => v), id);
+    }
+    comment(pr) { return this.db.prepare('SELECT comment FROM pulls WHERE pr=?').get(pr)?.comment ?? null; }
+    track(pr, baseRef, active) { this.db.prepare('UPDATE pulls SET baseRef=?,active=? WHERE pr=?').run(baseRef, Number(active), pr); }
+    branchPulls(baseRef) { return this.db.prepare('SELECT pr FROM pulls WHERE baseRef=? AND active=1').all(baseRef).map(row => Number(row.pr)); }
+    setComment(pr, id) { this.db.prepare('UPDATE pulls SET comment=? WHERE pr=?').run(id, pr); }
+    uncertainCreate(pr) { return Boolean(this.db.prepare('SELECT 1 FROM jobs WHERE pr=? AND createStarted=1').get(pr)); }
+    creationConfirmed(pr, comment) {
+        this.transaction(() => {
+            this.setComment(pr, comment);
+            this.db.prepare('UPDATE jobs SET createStarted=0 WHERE pr=?').run(pr);
+        });
+    }
+    retryPublication(pr) {
+        const job = this.db.prepare("SELECT jobs.* FROM jobs JOIN pulls ON jobs.id=pulls.desired WHERE jobs.pr=? AND jobs.report IS NOT NULL AND jobs.state IN ('uncertain','failed','completed')").get(pr);
+        if (!job)
+            return false;
+        this.update(job.id, { state: 'publishing', error: null });
+        return true;
+    }
+    status() {
+        return { enabled: this.enabled(), jobs: this.db.prepare('SELECT id,pr,state,created,started,error,artifact FROM jobs ORDER BY created DESC LIMIT 30').all() };
+    }
+}

package/dist/github/task.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/github/task.js

@@ -0,0 +1,29 @@
+// Controlled child entry point: source credentials and inference credentials never coexist.
+import { prepare, loadReview, withGitDeadline } from '../snapshot.js';
+import { runReview, readProfile } from '../run.js';
+const [phase, input, output] = process.argv.slice(2);
+const abort = new AbortController();
+const parent = process.ppid;
+const parentMonitor = setInterval(() => { if (process.ppid !== parent)
+    abort.abort(); }, 1000);
+process.once('SIGTERM', () => abort.abort());
+process.once('SIGINT', () => abort.abort());
+try {
+    if (!input || !output)
+        throw new Error('Invalid child arguments');
+    if (phase === 'capture')
+        withGitDeadline(120_000, () => prepare(input, output));
+    else if (phase === 'investigate') {
+        await runReview(input, readProfile(output), undefined, abort.signal);
+        withGitDeadline(30_000, () => loadReview(input));
+    }
+    else
+        throw new Error('Invalid child phase');
+}
+catch {
+    // The supervisor records phase failure; model/provider bodies and source stay in private artifacts.
+    process.exitCode = 1;
+}
+finally {
+    clearInterval(parentMonitor);
+}

package/dist/github/webhook.d.ts

@@ -0,0 +1,6 @@
+import { type Server } from 'node:http';
+import type { PilotConfig } from './config.js';
+import type { GitHub } from './api.js';
+import type { Store } from './store.js';
+export declare function validSignature(body: Buffer, header: string | undefined, secret: string): boolean;
+export declare function webhook(config: PilotConfig, secret: string, store: Store, github: GitHub): Server;

package/dist/github/webhook.js

@@ -0,0 +1,119 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+export function validSignature(body, header, secret) {
+    if (!header || !/^sha256=[a-f0-9]{64}$/.test(header))
+        return false;
+    return timingSafeEqual(Buffer.from(header.slice(7), 'hex'), createHmac('sha256', secret).update(body).digest());
+}
+export function webhook(config, secret, store, github) {
+    return createServer({ requestTimeout: 10_000, headersTimeout: 10_000 }, async (request, response) => {
+        const reply = (code, text) => { response.writeHead(code, { 'Content-Type': 'text/plain', 'Cache-Control': 'no-store' }); response.end(`${text}\n`); };
+        if (request.method === 'GET' && request.url === '/healthz') {
+            reply(200, 'ok');
+            return;
+        }
+        if (request.method !== 'POST' || request.url !== '/webhooks/github') {
+            reply(404, 'not found');
+            return;
+        }
+        try {
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of request) {
+                size += chunk.length;
+                if (size > 1_048_576) {
+                    reply(413, 'payload too large');
+                    return;
+                }
+                chunks.push(chunk);
+            }
+            const body = Buffer.concat(chunks);
+            const signature = request.headers['x-hub-signature-256'];
+            if (typeof signature !== 'string' || !validSignature(body, signature, secret)) {
+                reply(401, 'invalid signature');
+                return;
+            }
+            const delivery = request.headers['x-github-delivery'];
+            if (typeof delivery !== 'string' || !/^[a-zA-Z0-9-]{1,100}$/.test(delivery)) {
+                reply(400, 'invalid delivery');
+                return;
+            }
+            const event = request.headers['x-github-event'];
+            let payload;
+            try {
+                payload = JSON.parse(body.toString('utf8'));
+            }
+            catch {
+                reply(400, 'invalid JSON');
+                return;
+            }
+            if (!payload || typeof payload !== 'object') {
+                reply(400, 'invalid payload');
+                return;
+            }
+            if (event === 'ping') {
+                reply(200, 'pong');
+                return;
+            }
+            if (payload.installation?.id !== config.installationId) {
+                reply(202, 'ignored installation');
+                return;
+            }
+            if ((event === 'installation' && ['deleted', 'suspend'].includes(payload.action)) || (event === 'installation_repositories' && payload.repositories_removed?.some((repo) => repo.id === config.repositoryId))) {
+                store.enable(false);
+                reply(202, 'paused');
+                return;
+            }
+            if (payload.repository?.id !== config.repositoryId || payload.repository?.full_name !== config.repository) {
+                reply(202, 'ignored repository');
+                return;
+            }
+            if (store.seen(delivery)) {
+                reply(200, 'duplicate');
+                return;
+            }
+            if (event === 'push' && typeof payload.ref === 'string' && payload.ref.startsWith('refs/heads/')) {
+                for (const number of store.branchPulls(payload.ref.slice(11)))
+                    store.enqueue(`${delivery}-${number}`, number);
+                reply(202, 'tracked target branches reconciled');
+                return;
+            }
+            let pr;
+            if (event === 'pull_request' && ['opened', 'reopened', 'synchronize', 'ready_for_review', 'converted_to_draft', 'closed'].includes(payload.action))
+                pr = payload.number;
+            if (event === 'pull_request' && payload.action === 'edited' && payload.changes?.base)
+                pr = payload.number;
+            if (event === 'issue_comment' && payload.action === 'created' && payload.issue?.pull_request && payload.comment?.body?.trim() === '/atmin review') {
+                if (payload.comment.user?.type !== 'User' || payload.sender?.id !== payload.comment.user?.id) {
+                    reply(202, 'ignored actor');
+                    return;
+                }
+                // GitHub expects a prompt acknowledgement. On timeout, accept nothing and allow redelivery.
+                let timer;
+                let allowed;
+                try {
+                    allowed = await Promise.race([github.canReview(payload.comment.user.login), new Promise((_, reject) => {
+                            timer = setTimeout(() => reject(new Error('Permission lookup deadline')), 8000);
+                        })]);
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+                if (!allowed) {
+                    reply(202, 'insufficient permission');
+                    return;
+                }
+                pr = payload.issue.number;
+            }
+            if (!Number.isSafeInteger(pr) || pr < 1) {
+                reply(202, 'ignored event');
+                return;
+            }
+            const id = store.enqueue(delivery, pr);
+            reply(202, id ? 'queued' : 'paused or duplicate');
+        }
+        catch {
+            reply(503, 'delivery not accepted; redeliver after recovery');
+        }
+    });
+}

package/dist/github/worker.d.ts

@@ -0,0 +1,19 @@
+import type { PilotConfig } from './config.js';
+import type { GitHub } from './api.js';
+import type { Runner } from './runner.js';
+import { Store } from './store.js';
+export declare const markerFor: (repo: number, pr: number) => string;
+export declare class Worker {
+    private config;
+    private store;
+    private github;
+    private run;
+    readonly owner: string;
+    private checks;
+    private abort;
+    constructor(config: PilotConfig, store: Store, github: GitHub, run: Runner, owner: string);
+    stop(): void;
+    tick(): Promise<boolean>;
+    private work;
+    private cancel;
+}

package/dist/github/worker.js

@@ -0,0 +1,209 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parsePacket, parseResult } from '../contracts.js';
+import { assess } from '../assessment.js';
+import { compareCurrent } from '../snapshot.js';
+import { renderMarkdown } from '../render.js';
+import { Checks, assessmentCheck } from './checks.js';
+export const markerFor = (repo, pr) => `<!-- atmin-review:${repo}:${pr} -->`;
+const same = (a, b) => a.headSha === b.headSha && a.baseSha === b.baseSha && a.baseRef === b.baseRef && a.state === b.state && a.draft === b.draft;
+export class Worker {
+    config;
+    store;
+    github;
+    run;
+    owner;
+    checks;
+    abort;
+    constructor(config, store, github, run, owner) {
+        this.config = config;
+        this.store = store;
+        this.github = github;
+        this.run = run;
+        this.owner = owner;
+        this.checks = new Checks(store, github);
+    }
+    stop() { this.abort?.abort(); }
+    async tick() {
+        const job = this.store.next(this.owner);
+        if (!job)
+            return false;
+        this.abort = new AbortController();
+        const monitor = setInterval(() => { if (!this.store.current(job, this.owner))
+            this.abort?.abort(); }, 250);
+        try {
+            await this.work(job, this.abort.signal);
+        }
+        catch {
+            if (this.store.current(job, this.owner))
+                this.store.update(job.id, { state: 'failed', error: 'service-or-github-failure; inspect private artifacts, rerun explicitly' });
+            if (this.store.owns(this.owner))
+                await this.checks.stop(job, 'failure', 'Review failed').catch(() => { });
+        }
+        finally {
+            clearInterval(monitor);
+            this.abort = undefined;
+            if (this.store.owns(this.owner) && this.store.get(job.id).state === 'cancelled') {
+                await this.checks.stop(job, 'cancelled', 'Review superseded or paused').catch(() => { });
+                if (!this.store.enabled()) {
+                    const marker = markerFor(this.config.repositoryId, job.pr);
+                    const existing = await this.github.summary(job.pr, marker);
+                    if (existing && this.store.owns(this.owner) && !this.store.enabled()) {
+                        await this.github.update(existing.id, `${marker}\n# atmin review — review paused\n\nThe operator paused this review. No active review or completed result is claimed for this request. Previous findings are historical. After re-enabling the service, a maintainer can request a new run with \`/atmin review\`.`);
+                    }
+                }
+            }
+            if (this.store.owns(this.owner) && this.store.get(job.id).state === 'uncertain')
+                await this.checks.stop(job, 'failure', 'Review publication uncertain').catch(() => { });
+        }
+        return true;
+    }
+    async work(job, signal) {
+        const initial = await this.github.pull(job.pr);
+        if (!this.store.current(job, this.owner) || signal.aborted)
+            return;
+        this.store.track(job.pr, initial.baseRef, initial.state === 'open' && !initial.draft);
+        const marker = markerFor(this.config.repositoryId, job.pr);
+        if (initial.state !== 'open' || initial.draft) {
+            const existing = await this.github.summary(job.pr, marker);
+            if (existing && this.store.current(job, this.owner))
+                await this.github.update(existing.id, `${marker}\n# atmin review — inactive\n\nPR is ${initial.draft ? 'a draft' : 'closed'}. Previous findings are historical. No merge approval.`);
+            if (this.store.current(job, this.owner))
+                this.store.update(job.id, { state: 'skipped', error: initial.draft ? 'draft' : 'closed' });
+            return;
+        }
+        if (job.state !== 'publishing') {
+            // Retire an earlier verdict as soon as replacement work starts. Create only the final summary.
+            const existing = await this.github.summary(job.pr, marker);
+            if (existing && this.store.current(job, this.owner)) {
+                this.store.creationConfirmed(job.pr, existing.id);
+                await this.github.update(existing.id, `${marker}\n# atmin review — review pending\n\nA review was requested for head \`${initial.headSha}\` against target \`${initial.baseSha}\`. No completed report is available for this request. Previous findings are historical. This review is advisory.`);
+            }
+            if (!this.store.current(job, this.owner) || signal.aborted)
+                return;
+            let report;
+            let check = { status: 'completed', conclusion: 'failure', output: { title: 'Review incomplete', summary: 'No completed review is available. See the PR summary.' } };
+            // Save interruption context before starting the remote check.
+            this.store.update(job.id, { report: JSON.stringify({ initial, body: '# atmin review — interrupted\n\nReview did not finish.', check }) });
+            await this.checks.publish(job, initial.headSha, { status: 'in_progress', output: { title: 'Review in progress', summary: `Reviewing head ${initial.headSha} against target ${initial.baseSha}.` } });
+            if (!this.store.current(job, this.owner) || signal.aborted)
+                return;
+            let artifact = null;
+            if (!this.store.reserve(job, this.owner, this.config.maxReviewsPerDay)) {
+                report = '# atmin review — review not run\n\nThe operator’s rolling 24-hour review limit was reached. A maintainer can rerun after capacity is available. No inference was started.';
+            }
+            else {
+                artifact = join(this.config.stateDirectory, 'runs', job.id);
+                // A crash publishes this honest interruption report; it never starts another model request.
+                this.store.update(job.id, { artifact, report: JSON.stringify({ initial,
+                        body: `# atmin review — interrupted\n\nThe worker stopped before it saved a validated report. No completed review is claimed. A maintainer can explicitly rerun.\n\nHead: \`${initial.headSha}\` · Target: \`${initial.baseSha}\` · Run: \`${job.id}\``,
+                    }) });
+                try {
+                    artifact = await this.run(job, signal);
+                    if (!this.store.current(job, this.owner) || signal.aborted)
+                        return;
+                    const packet = parsePacket(JSON.parse(readFileSync(join(artifact, 'packet.json'), 'utf8')));
+                    const result = parseResult(JSON.parse(readFileSync(join(artifact, 'result.json'), 'utf8')));
+                    const live = await this.github.pull(job.pr);
+                    if (packet.repository !== this.config.repository || packet.pr !== job.pr || compareCurrent(packet, live).status !== 'current' || live.draft || !same(initial, live)) {
+                        this.cancel(job);
+                        return;
+                    }
+                    const assessment = assess(packet, result, compareCurrent(packet, live));
+                    report = renderMarkdown(packet, result, assessment);
+                    check = assessmentCheck(assessment);
+                }
+                catch {
+                    if (!this.store.current(job, this.owner) || signal.aborted)
+                        return;
+                    report = '# atmin review — review failed\n\nSource capture or investigation did not produce a validated report. No successful review or merge approval is claimed. A maintainer may request a new run with `/atmin review`; it uses a new budget reservation.';
+                }
+            }
+            report += `\n\nHead: \`${initial.headSha}\` · Target: \`${initial.baseSha}\` · Run: \`${job.id}\`\n`;
+            // Persist the report and its exact publication identity before any write.
+            if (!this.store.current(job, this.owner))
+                return;
+            this.store.update(job.id, { state: 'publishing', artifact, report: JSON.stringify({ initial, body: report, check }) });
+            job = this.store.get(job.id);
+        }
+        const saved = JSON.parse(job.report);
+        if (!same(saved.initial, await this.github.pull(job.pr))) {
+            this.cancel(job);
+            return;
+        }
+        // Reconciliation refreshes CI and formatting from saved source evidence, without inference.
+        if (job.artifact && existsSync(join(job.artifact, 'packet.json')) && existsSync(join(job.artifact, 'result.json'))) {
+            const packet = parsePacket(JSON.parse(readFileSync(join(job.artifact, 'packet.json'), 'utf8')));
+            const result = parseResult(JSON.parse(readFileSync(join(job.artifact, 'result.json'), 'utf8')));
+            const live = await this.github.pull(job.pr);
+            if (packet.repository !== this.config.repository || packet.pr !== job.pr || !same(saved.initial, live)
+                || compareCurrent(packet, live).status !== 'current') {
+                this.cancel(job);
+                return;
+            }
+            const ci = await this.github.validation(packet.headSha, packet.policy.requiredChecks);
+            const assessment = assess(packet, result, compareCurrent(packet, live), ci);
+            if (!this.store.current(job, this.owner) || signal.aborted)
+                return;
+            writeFileSync(join(job.artifact, 'validation.json'), JSON.stringify({ headSha: packet.headSha, baseSha: packet.baseSha,
+                checkedAt: new Date().toISOString(), checks: ci }, null, 2), { mode: 0o600 });
+            saved.body = `${renderMarkdown(packet, result, assessment)}\nRun: \`${job.id}\`\n`;
+            saved.check = assessmentCheck(assessment);
+            this.store.update(job.id, { report: JSON.stringify(saved) });
+        }
+        const existing = await this.github.summary(job.pr, marker);
+        if (!this.store.current(job, this.owner) || signal.aborted)
+            return;
+        // Listing comments can take time; recheck commits immediately before publication.
+        if (!same(saved.initial, await this.github.pull(job.pr))) {
+            this.cancel(job);
+            return;
+        }
+        if (!this.store.current(job, this.owner) || signal.aborted)
+            return;
+        const limited = saved.body.length > 58_000 ? `${saved.body.slice(0, 58_000)}\n\n**Report truncated for GitHub. Full evidence remains in the operator’s private run artifacts.**` : saved.body;
+        const body = `${marker}\n${limited}\n\nFreshness was checked immediately before publication at ${new Date().toISOString()}; GitHub writes are not atomic with PR updates.\n`;
+        let comment;
+        if (existing) {
+            this.store.creationConfirmed(job.pr, existing.id);
+            await this.github.update(existing.id, body);
+            comment = existing.id;
+        }
+        else {
+            if (this.store.uncertainCreate(job.pr)) {
+                this.store.update(job.id, { state: 'uncertain', error: 'earlier-create-uncertain; reconcile publication without repeating inference' });
+                return;
+            }
+            this.store.update(job.id, { createStarted: 1 });
+            try {
+                comment = await this.github.create(job.pr, body);
+                this.store.creationConfirmed(job.pr, comment);
+            }
+            catch {
+                if (this.store.current(job, this.owner))
+                    this.store.update(job.id, { state: 'uncertain', error: 'comment-create-uncertain; reconcile publication without repeating inference' });
+                return;
+            }
+        }
+        const after = await this.github.pull(job.pr);
+        if (!this.store.current(job, this.owner) || !same(saved.initial, after)) {
+            // This worker owns publication until the request completes. Do not write after losing its lease.
+            if (this.store.owns(this.owner))
+                await this.github.update(comment, `${marker}\n# atmin review — superseded\n\nPR state changed during publication. Findings for head \`${saved.initial.headSha}\` are historical. Await a review of the current commits.`);
+            this.cancel(job);
+            return;
+        }
+        await this.checks.publish(job, saved.initial.headSha, { ...(saved.check ?? { status: 'completed', conclusion: 'failure', output: { title: 'Review incomplete', summary: 'Saved review has no passing check assessment. See the PR summary.' } }), details_url: `https://github.com/${this.config.repository}/pull/${job.pr}#issuecomment-${comment}` });
+        if (!this.store.current(job, this.owner) || !same(saved.initial, await this.github.pull(job.pr))) {
+            if (this.store.owns(this.owner))
+                await this.github.update(comment, `${marker}\n# atmin review — superseded\n\nPR state changed during check publication. Findings for head \`${saved.initial.headSha}\` are historical. Await a review of the current commits.`);
+            this.cancel(job);
+            return;
+        }
+        this.store.update(job.id, { state: 'completed', error: null });
+    }
+    cancel(job) {
+        if (this.store.owns(this.owner))
+            this.store.update(job.id, { state: 'cancelled', error: 'superseded' });
+    }
+}