@avi770/testteam 2.0.0 → 3.2.0

package/dist/core/disaster-recovery/types.d.ts

@@ -0,0 +1,299 @@
+/**
+ * Disaster Recovery Simulator (#23) — module-local types.
+ *
+ * Agent #23 is the resilience orchestrator: it does NOT implement its own fault-injection
+ * primitives. Instead it composes outputs from engine agents #16, #44, #51, #52, #53, #78, #79
+ * and routes every actuation through the Actuation Safety Harness.
+ *
+ * Spec: blueprint/agents/23-disaster-recovery-simulator.md.
+ */
+/**
+ * Where the experiment runs. Staging is the default and autonomous; prod requires explicit opt-in
+ * AND a verified rollback path (enforced by the Harness and by `ExperimentRequest`).
+ *
+ * Mirrors core/harness/types.ts Environment but is intentionally re-declared here so this module
+ * has no import cycle with the Harness types.
+ */
+export type DREnvironment = 'staging' | 'prod';
+export type FaultKind = 'instance-kill' | 'latency-inject' | 'error-inject' | 'network-partition' | 'resource-exhaustion' | 'dependency-outage' | 'backup-restore' | 'region-failover' | 'zone-failover' | 'security-breach-simulation';
+/**
+ * Maps `FaultKind` to the engine-agent that owns that capability.
+ * Used by the simulator to select and invoke the correct engine adapter.
+ *
+ * Engine agents (#16, #44, #51, #52, #53, #78, #79) are registered here so
+ * callers submit declarative faults — NOT raw callbacks — and the simulator
+ * proves which engine agent ran.
+ */
+export declare const FAULT_KIND_ENGINE_MAP: Readonly<Record<FaultKind, number>>;
+/**
+ * The result returned by an engine-agent adapter after it executes its action.
+ * Contains the engine agent id (proving which agent ran) and an optional
+ * last-good-data timestamp for RPO computation.
+ */
+export interface EngineAdapterResult {
+    /**
+     * The numeric id of the engine agent responsible for this fault kind. This must be a REAL
+     * registered engine agent (asserted against the live agent registry by the test suite);
+     * in production the adapter wraps and invokes that agent.
+     */
+    readonly engineAgentId: number;
+    /**
+     * Millisecond timestamp of the last verified-good data snapshot BEFORE the fault was
+     * injected. Used to compute actual RPO. Must be ≤ the injection start — a future timestamp
+     * is rejected as an invalid signal (not silently clamped to a flattering RPO=0).
+     *
+     * If the engine adapter cannot determine this (no backup metadata available), leave
+     * undefined — the simulator leaves actualRpoMs/rpoMet undefined, never fabricated.
+     */
+    readonly lastGoodDataTimestampMs?: number;
+    /**
+     * Whether the RPO signal came from a VERIFIED source (a real backup-system probe) rather
+     * than a self-reported number. `rpoMet` is asserted only for a verified signal — an
+     * unverified RPO is shown for transparency but never counted as "met" (anti-gaming).
+     */
+    readonly rpoSignalVerified?: boolean;
+}
+/**
+ * The definition of "healthy" BEFORE and AFTER fault injection.
+ * The Wargamer refuses to start an experiment without one.
+ */
+export interface SteadyStateHypothesis {
+    /** Human-readable label for the probe output. */
+    readonly metric: string;
+    /**
+     * Callback invoked before injection (baseline) and after (recovery check).
+     * Returns a numeric observation; the hypothesis passes when `min <= value <= max`.
+     */
+    readonly probe: () => Promise<number>;
+    readonly min: number;
+    readonly max: number;
+}
+export interface SteadyStateResult {
+    readonly metric: string;
+    readonly value: number;
+    readonly passed: boolean;
+    readonly min: number;
+    readonly max: number;
+}
+/**
+ * A request to run one chaos / DR experiment. All fields that gate prod or destructive paths are
+ * Readonly; callers cannot smuggle a mutable opt-in flag after construction.
+ *
+ * The request is DECLARATIVE: callers specify `faultKind` and optionally `targetServiceId`.
+ * The simulator dispatches to the correct engine-agent adapter based on `faultKind`.
+ * Callers MUST NOT supply a raw `inject` callback for engine-dispatched faults; the simulator
+ * drives the engine agent. For test/dry-run scenarios an `injectOverride` may be supplied
+ * to substitute the engine adapter (used by the test suite to avoid running real agents).
+ */
+export interface ExperimentRequest {
+    /** Unique caller-assigned id (used for regression tracking). */
+    readonly id: string;
+    readonly faultKind: FaultKind;
+    readonly environment: DREnvironment;
+    readonly steadyState: SteadyStateHypothesis;
+    /**
+     * Minimum blast radius as a fraction of the resource population (0..1).
+     * Must be as small as possible (#3 improvement — smallest experiment first).
+     */
+    readonly blastRadiusFraction: number;
+    /**
+     * The service being targeted by this experiment. Required for `dependency-outage`
+     * experiments so SPOF detection can correlate a failure to a specific serviceId
+     * in the SPOF map. Optional (but recommended) for other fault kinds.
+     */
+    readonly targetServiceId?: string;
+    /**
+     * Required for EVERY prod experiment and every destructive experiment.
+     * The Harness will deny without a verified rollback path.
+     */
+    readonly rollback?: {
+        readonly description: string;
+        readonly verified: boolean;
+    };
+    /**
+     * Explicit human opt-in for prod chaos (#13 improvement).
+     * Without this flag a prod request is rejected BEFORE it reaches the Harness.
+     */
+    readonly prodOptIn?: true;
+    /**
+     * Engine-adapter override for testing. When present, the simulator calls this
+     * instead of the real engine-agent adapter. MUST return a valid `EngineAdapterResult`
+     * (including `engineAgentId` matching the expected engine for `faultKind`).
+     * Not used in production — real engine adapters are invoked via `faultKind` dispatch.
+     * ENFORCED: a `prod` request carrying `injectOverride` is rejected (blocked) before the
+     * adapter is resolved — see `runExperiment`'s prod gate. This is staging/test only.
+     */
+    readonly injectOverride?: () => Promise<EngineAdapterResult>;
+    /**
+     * Recovery action to run after observation (e.g. restore a backup via #44).
+     * Returns an optional RPO signal: `lastGoodDataTimestampMs` is the epoch-ms
+     * timestamp of the last good data snapshot BEFORE injection. If the recover
+     * callback cannot determine the last good data, return an empty object `{}`.
+     * The simulator uses this to compute actual RPO independently of RTO.
+     */
+    readonly recover?: () => Promise<{
+        readonly lastGoodDataTimestampMs?: number;
+        /** Whether the RPO signal is from a verified source (see EngineAdapterResult.rpoSignalVerified). */
+        readonly rpoSignalVerified?: boolean;
+    }>;
+    /**
+     * RTO target in milliseconds for backup-restore drills (#4 improvement; default 15 min).
+     * Only meaningful for `backup-restore` / `region-failover` / `zone-failover`.
+     */
+    readonly rtoTargetMs?: number;
+    /**
+     * RPO target in milliseconds (#4 improvement; default 5 min).
+     */
+    readonly rpoTargetMs?: number;
+}
+/**
+ * A token that flags the system as being in an active incident or freeze window.
+ * The simulator rejects ANY experiment start when an active token exists (#19 improvement).
+ */
+export interface IncidentToken {
+    readonly id: string;
+    readonly reason: string;
+    readonly startedAtMs: number;
+}
+/**
+ * A seeded SPOF entry — the simulator verifies that running a dependency-outage drill
+ * for the service surfaces it as a failure. Discovery is confirmed when the experiment
+ * outcome includes a finding targeting `serviceId`.
+ */
+export interface SpofEntry {
+    readonly serviceId: string;
+    readonly description: string;
+    /** Other services that depend on this one; used to estimate blast radius. */
+    readonly dependents: readonly string[];
+}
+/**
+ * A past incident whose chaos reproduction test has been catalogued for regression.
+ * Every entry in the library is replayed on subsequent game-day runs.
+ */
+export interface HypothesisLibraryEntry {
+    /** Matches the `id` of the original `ExperimentRequest`. */
+    readonly experimentId: string;
+    readonly incidentRef: string;
+    /** ISO timestamp when this entry was catalogued. */
+    readonly cataloguedAt: string;
+    /** Snapshot of the steady-state hypothesis parameters for deterministic replay. */
+    readonly steadyState: {
+        readonly metric: string;
+        readonly min: number;
+        readonly max: number;
+    };
+}
+export type ExperimentStatus = 'passed' | 'aborted' | 'blocked' | 'failed';
+export interface RtoRpoMeasurement {
+    /** Actual measured recovery time (ms). */
+    readonly actualRtoMs: number;
+    /**
+     * Data-loss window observed (ms); derived from the recovery callback's
+     * `lastGoodDataTimestampMs` signal vs. the injection start time.
+     * Undefined when no RPO signal is available from the engine adapter.
+     */
+    readonly actualRpoMs: number | undefined;
+    readonly rtoTargetMs: number;
+    readonly rpoTargetMs: number;
+    readonly rtoMet: boolean;
+    /** Whether the RPO signal came from a verified source. `rpoMet` is asserted only when true. */
+    readonly rpoVerified: boolean;
+    /**
+     * Whether RPO was met. Undefined when no RPO signal was available OR the signal was
+     * unverified/self-reported. Never fabricated (anti-gaming).
+     */
+    readonly rpoMet: boolean | undefined;
+}
+/**
+ * Full result of one experiment run.
+ * Transparency (#Improvement 3/4): exact math is preserved so reviewers can audit the decision.
+ */
+export interface ExperimentResult {
+    readonly experimentId: string;
+    readonly faultKind: FaultKind;
+    readonly environment: DREnvironment;
+    readonly status: ExperimentStatus;
+    /** Reason the experiment was blocked or aborted (absent when status is 'passed'/'failed'). */
+    readonly blockReason?: string;
+    /** Baseline steady-state taken before injection. */
+    readonly baselineCheck: SteadyStateResult;
+    /** Steady-state check taken during injection (the auto-abort gate). */
+    readonly midCheck?: SteadyStateResult;
+    /** Post-recovery steady-state check. */
+    readonly recoveryCheck?: SteadyStateResult;
+    /** Present for backup-restore / failover drills. */
+    readonly rtoRpo?: RtoRpoMeasurement;
+    readonly startedAtMs: number;
+    readonly completedAtMs: number;
+    /** Wall-clock duration of the full experiment in milliseconds. */
+    readonly durationMs: number;
+    /**
+     * The service targeted by this experiment (mirrors `ExperimentRequest.targetServiceId`).
+     * Used by SPOF detection to correlate a failure to a specific SPOF map entry.
+     */
+    readonly targetServiceId?: string;
+    /**
+     * The engine agent id that was invoked to perform fault injection.
+     * Proves genuine engine-agent reuse — undefined only for blocked experiments
+     * where injection never reached the dispatch stage.
+     */
+    readonly engineAgentId?: number;
+    /** Error captured when the injection or recovery callback threw unexpectedly. */
+    readonly capturedError?: string;
+}
+/**
+ * Aggregate resilience score across a game-day run. Range 0..100.
+ * Score = (passed / total) * 100, rounded to the nearest integer (never rounded up).
+ * Not gameable: each experiment is equal-weighted; there is no partial credit.
+ */
+export interface ResilienceScore {
+    readonly total: number;
+    readonly passed: number;
+    readonly aborted: number;
+    readonly blocked: number;
+    readonly failed: number;
+    /** Integer 0..100, floor (never rounded up per Avi's QA standard). */
+    readonly score: number;
+}
+/**
+ * A game-day is an ordered list of experiments run in sequence against a shared Harness.
+ * Results and resilience score are emitted at the end (#5 improvement).
+ */
+export interface GameDayRun {
+    readonly runId: string;
+    readonly startedAtMs: number;
+    readonly completedAtMs: number;
+    readonly results: readonly ExperimentResult[];
+    readonly score: ResilienceScore;
+    /** SPOFs confirmed discovered during this run. */
+    readonly confirmedSpofs: readonly string[];
+    /** Regression experiments that passed (no regression). */
+    readonly regressionPassed: readonly string[];
+    /** Regression experiments that failed (regression detected). */
+    readonly regressionFailed: readonly string[];
+}
+/**
+ * When a fault was injected but the steady-state probe DID NOT detect degradation while an
+ * external signal confirms degradation occurred, an observability gap is raised.
+ */
+export interface ObservabilityGap {
+    readonly experimentId: string;
+    readonly description: string;
+    /** Recommended monitoring fix. */
+    readonly suggestedFix: string;
+}
+/**
+ * A simulator-level audit entry. One record per experiment attempt (blocked experiments are also
+ * audited — the absence of an attempt is never silent).
+ */
+export interface DRAuditRecord {
+    readonly at: string;
+    readonly experimentId: string;
+    readonly faultKind: FaultKind;
+    readonly environment: DREnvironment;
+    readonly status: ExperimentStatus;
+    readonly reason: string;
+    /** Engine agent invoked (undefined if injection was never reached). */
+    readonly engineAgentId?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/disaster-recovery/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../core/disaster-recovery/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,CAAC;AAM/C,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,4BAA4B,CAAC;AAMjC;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAWrE,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAMD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IACjF;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;QAC/B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;QAC1C,oGAAoG;QACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;KACtC,CAAC,CAAC;IACH;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAMD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAMD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/F;AAMD,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,SAAS,GACT,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,wCAAwC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C,oDAAoD;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAMD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAMD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC"}

package/dist/core/disaster-recovery/types.js

@@ -0,0 +1,33 @@
+/**
+ * Disaster Recovery Simulator (#23) — module-local types.
+ *
+ * Agent #23 is the resilience orchestrator: it does NOT implement its own fault-injection
+ * primitives. Instead it composes outputs from engine agents #16, #44, #51, #52, #53, #78, #79
+ * and routes every actuation through the Actuation Safety Harness.
+ *
+ * Spec: blueprint/agents/23-disaster-recovery-simulator.md.
+ */
+// ---------------------------------------------------------------------------
+// Engine-agent dispatch — declarative fault specification
+// ---------------------------------------------------------------------------
+/**
+ * Maps `FaultKind` to the engine-agent that owns that capability.
+ * Used by the simulator to select and invoke the correct engine adapter.
+ *
+ * Engine agents (#16, #44, #51, #52, #53, #78, #79) are registered here so
+ * callers submit declarative faults — NOT raw callbacks — and the simulator
+ * proves which engine agent ran.
+ */
+export const FAULT_KIND_ENGINE_MAP = {
+    'instance-kill': 16, // ChaosAgent
+    'latency-inject': 16, // ChaosAgent
+    'error-inject': 51, // ErrorRecoveryTesterAgent
+    'network-partition': 52, // OfflineModeTesterAgent
+    'resource-exhaustion': 78, // StressTestingAgent
+    'dependency-outage': 53, // GracefulDegradationTesterAgent
+    'backup-restore': 44, // BackupRecoveryTesterAgent
+    'region-failover': 79, // EnduranceTestingAgent
+    'zone-failover': 79, // EnduranceTestingAgent
+    'security-breach-simulation': 16, // ChaosAgent (coordinates #8 purple-team)
+};
+//# sourceMappingURL=types.js.map

package/dist/core/disaster-recovery/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../core/disaster-recovery/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+BH,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwC;IACxE,eAAe,EAAe,EAAE,EAAE,aAAa;IAC/C,gBAAgB,EAAc,EAAE,EAAE,aAAa;IAC/C,cAAc,EAAgB,EAAE,EAAE,2BAA2B;IAC7D,mBAAmB,EAAW,EAAE,EAAE,yBAAyB;IAC3D,qBAAqB,EAAS,EAAE,EAAE,qBAAqB;IACvD,mBAAmB,EAAW,EAAE,EAAE,iCAAiC;IACnE,gBAAgB,EAAc,EAAE,EAAE,4BAA4B;IAC9D,iBAAiB,EAAa,EAAE,EAAE,wBAAwB;IAC1D,eAAe,EAAe,EAAE,EAAE,wBAAwB;IAC1D,4BAA4B,EAAE,EAAE,EAAE,0CAA0C;CAC7E,CAAC"}

package/dist/core/escalation/heal-or-ask.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Calibrated heal-vs-ask (Phase 3.4 core) — decides auto-fix vs pause-and-ask. First-do-no-harm:
+ * anything complex OR risky always pauses, regardless of confidence; otherwise auto-heal only when
+ * confidence clears the (Calibration-tightened) bar — so an overconfident agent asks MORE, not less.
+ * Spec: blueprint/agents/01-testteam-bot.md ("Calibrated heal-vs-ask", Calibration loop 14).
+ */
+import type { Calibrator } from '../governance/index.js';
+import type { EscalationRoute, FindingContext } from './types.js';
+export interface HealOrAskOptions {
+    /** Confidence bar for auto-heal on a simple, safe finding (default 0.8). */
+    readonly threshold?: number;
+    /** If supplied, tightens the bar when the agent has been overconfident. */
+    readonly calibrator?: Calibrator;
+}
+export interface HealOrAskResult {
+    readonly route: EscalationRoute;
+    readonly reason: string;
+}
+export declare function decideHealOrAsk(ctx: FindingContext, options?: HealOrAskOptions): HealOrAskResult;
+//# sourceMappingURL=heal-or-ask.d.ts.map

package/dist/core/escalation/heal-or-ask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heal-or-ask.d.ts","sourceRoot":"","sources":["../../../core/escalation/heal-or-ask.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAahG"}

package/dist/core/escalation/heal-or-ask.js

@@ -0,0 +1,19 @@
+/** An out-of-range/NaN bar fails SAFE: 1 (auto-heal becomes hardest), never < 0 (auto-heal-all). */
+function safeBar(n) {
+    return Number.isFinite(n) && n >= 0 && n <= 1 ? n : 1;
+}
+export function decideHealOrAsk(ctx, options) {
+    if (ctx.complexity === 'complex') {
+        return { route: 'pause-and-ask', reason: 'complex finding — pause and ask' };
+    }
+    if (ctx.risky) {
+        return { route: 'pause-and-ask', reason: 'risky/irreversible — pause and ask' };
+    }
+    const base = safeBar(options?.threshold ?? 0.8);
+    const bar = options?.calibrator ? safeBar(options.calibrator.suggestThreshold(base)) : base;
+    if (ctx.confidence >= bar) {
+        return { route: 'auto-heal', reason: `confidence ${ctx.confidence} >= ${bar} — auto-heal` };
+    }
+    return { route: 'pause-and-ask', reason: `confidence ${ctx.confidence} < ${bar} — pause and ask` };
+}
+//# sourceMappingURL=heal-or-ask.js.map

package/dist/core/escalation/heal-or-ask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heal-or-ask.js","sourceRoot":"","sources":["../../../core/escalation/heal-or-ask.ts"],"names":[],"mappings":"AAqBA,oGAAoG;AACpG,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAmB,EAAE,OAA0B;IAC7E,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,UAAU,OAAO,GAAG,cAAc,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,UAAU,MAAM,GAAG,kBAAkB,EAAE,CAAC;AACrG,CAAC"}

package/dist/core/escalation/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Pause-and-ask escalation (#1's defining UX) — public surface (Phase 3.4 core).
+ * Calibrated heal-vs-ask + the inline PauseGate (ask -> resume-on-answer) over the Harness gate.
+ * Spec: blueprint/agents/01-testteam-bot.md.
+ */
+export type { EscalationRoute, FindingContext, AnswerDecision, PendingQuestion, HumanAnswer, } from './types.js';
+export { decideHealOrAsk, type HealOrAskOptions, type HealOrAskResult } from './heal-or-ask.js';
+export { PauseGate, type AskInput } from './pause-gate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/escalation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../core/escalation/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC"}

package/dist/core/escalation/index.js

@@ -0,0 +1,3 @@
+export { decideHealOrAsk } from './heal-or-ask.js';
+export { PauseGate } from './pause-gate.js';
+//# sourceMappingURL=index.js.map

package/dist/core/escalation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../core/escalation/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAA+C,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAiB,MAAM,cAAc,CAAC"}

package/dist/core/escalation/pause-gate.d.ts

@@ -0,0 +1,48 @@
+/**
+ * PauseGate (Phase 3.4 core) — the inline pause-and-ask mechanism. An agent calls `ask(...)` and
+ * suspends on the returned promise until the human `answer(...)`s (resume). The Cockpit/WebSocket
+ * layer just forwards questions out (via `subscribe`) and answers back in — a thin adapter over
+ * this. Fully testable without any UI (the test plays the human). Spec: 01-testteam-bot.md.
+ */
+import type { AnswerDecision, HumanAnswer, PendingQuestion } from './types.js';
+export interface AskInput {
+    readonly agentId: number;
+    readonly title: string;
+    readonly detail: string;
+    readonly proposedAction?: string;
+}
+export declare class PauseGate {
+    private readonly waiters;
+    private readonly answered;
+    private listener?;
+    private seq;
+    private readonly now;
+    /** Terminal flag: once cancelAll closes the gate, future ask()s resolve immediately as reject. */
+    private closed;
+    private closedReason?;
+    constructor(options?: {
+        readonly clock?: () => number;
+    });
+    /** The Cockpit/WebSocket layer subscribes to forward questions to the human. */
+    subscribe(listener: (question: PendingQuestion) => void): void;
+    get pending(): readonly PendingQuestion[];
+    get answeredLog(): readonly HumanAnswer[];
+    /** Pause here until the human answers. The returned promise resolves on `answer`/`cancel`. */
+    ask(input: AskInput): Promise<HumanAnswer>;
+    /** The human answers inline — resumes the paused agent. Returns false on an unknown id. */
+    answer(questionId: string, decision: AnswerDecision, note?: string): boolean;
+    /** Unblock a paused agent without a real decision (shutdown/timeout) — resolves as a reject. */
+    cancel(questionId: string, reason: string): boolean;
+    /**
+     * Unblock EVERY paused asker — e.g. the run's client disconnected, so no human will answer.
+     * Each pending question resolves as a reject so the awaiting agents unwind and the run can
+     * finish + clean up (without this, a disconnect-mid-pause leaks the suspended agent + socket).
+     *
+     * This also CLOSES the gate terminally: any ask() that arrives AFTER this point (e.g. a later
+     * finding in the same fix-loop pass) resolves immediately as a reject rather than registering a
+     * waiter no one will answer. cancelAll is wired to a one-shot disconnect event, so without the
+     * terminal close a second-or-later asker would hang the run permanently.
+     */
+    cancelAll(reason: string): void;
+}
+//# sourceMappingURL=pause-gate.d.ts.map

package/dist/core/escalation/pause-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pause-gate.d.ts","sourceRoot":"","sources":["../../../core/escalation/pause-gate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO5E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,CAAsC;IACvD,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,kGAAkG;IAClG,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAAC,CAAS;gBAElB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAIvD,gFAAgF;IAChF,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,IAAI;IAI9D,IAAI,OAAO,IAAI,SAAS,eAAe,EAAE,CAExC;IAED,IAAI,WAAW,IAAI,SAAS,WAAW,EAAE,CAExC;IAED,8FAA8F;IAC9F,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IAkC1C,2FAA2F;IAC3F,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAe5E,gGAAgG;IAChG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAInD;;;;;;;;;OASG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAOhC"}

package/dist/core/escalation/pause-gate.js

@@ -0,0 +1,96 @@
+export class PauseGate {
+    waiters = new Map();
+    answered = [];
+    listener;
+    seq = 0;
+    now;
+    /** Terminal flag: once cancelAll closes the gate, future ask()s resolve immediately as reject. */
+    closed = false;
+    closedReason;
+    constructor(options) {
+        this.now = options?.clock ?? (() => Date.now());
+    }
+    /** The Cockpit/WebSocket layer subscribes to forward questions to the human. */
+    subscribe(listener) {
+        this.listener = listener;
+    }
+    get pending() {
+        return [...this.waiters.values()].map((w) => w.question);
+    }
+    get answeredLog() {
+        return this.answered.slice();
+    }
+    /** Pause here until the human answers. The returned promise resolves on `answer`/`cancel`. */
+    ask(input) {
+        const id = `q${this.seq++}`;
+        // If the gate is already closed (e.g. the client disconnected and cancelAll fired), there is
+        // no human to answer — resolve IMMEDIATELY as a reject instead of registering a waiter that
+        // nothing would ever resolve. Without this, an asker that pauses AFTER the one-shot disconnect
+        // (e.g. the 2nd of several code-bug findings in a fix-loop) would hang the run forever and leak
+        // the agent + socket + run registry entry.
+        if (this.closed) {
+            return Promise.resolve({
+                questionId: id,
+                decision: 'reject',
+                answeredAtMs: this.now(),
+                note: `gate closed: ${this.closedReason ?? 'unavailable'}`,
+            });
+        }
+        const question = {
+            id,
+            agentId: input.agentId,
+            title: input.title,
+            detail: input.detail,
+            askedAtMs: this.now(),
+            ...(input.proposedAction !== undefined ? { proposedAction: input.proposedAction } : {}),
+        };
+        return new Promise((resolve) => {
+            this.waiters.set(id, { question, resolve });
+            try {
+                this.listener?.(question);
+            }
+            catch {
+                // The listener (Cockpit/WebSocket) is a best-effort observer; its failure must not break
+                // the gate or lose the paused agent — the question stays pending until answered.
+            }
+        });
+    }
+    /** The human answers inline — resumes the paused agent. Returns false on an unknown id. */
+    answer(questionId, decision, note) {
+        const waiter = this.waiters.get(questionId);
+        if (!waiter)
+            return false;
+        this.waiters.delete(questionId);
+        const answer = {
+            questionId,
+            decision,
+            answeredAtMs: this.now(),
+            ...(note !== undefined ? { note } : {}),
+        };
+        this.answered.push(answer);
+        waiter.resolve(answer);
+        return true;
+    }
+    /** Unblock a paused agent without a real decision (shutdown/timeout) — resolves as a reject. */
+    cancel(questionId, reason) {
+        return this.answer(questionId, 'reject', `cancelled: ${reason}`);
+    }
+    /**
+     * Unblock EVERY paused asker — e.g. the run's client disconnected, so no human will answer.
+     * Each pending question resolves as a reject so the awaiting agents unwind and the run can
+     * finish + clean up (without this, a disconnect-mid-pause leaks the suspended agent + socket).
+     *
+     * This also CLOSES the gate terminally: any ask() that arrives AFTER this point (e.g. a later
+     * finding in the same fix-loop pass) resolves immediately as a reject rather than registering a
+     * waiter no one will answer. cancelAll is wired to a one-shot disconnect event, so without the
+     * terminal close a second-or-later asker would hang the run permanently.
+     */
+    cancelAll(reason) {
+        this.closed = true;
+        this.closedReason = reason;
+        for (const questionId of [...this.waiters.keys()]) {
+            this.cancel(questionId, reason);
+        }
+    }
+}
+//# sourceMappingURL=pause-gate.js.map

package/dist/core/escalation/pause-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pause-gate.js","sourceRoot":"","sources":["../../../core/escalation/pause-gate.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,SAAS;IACH,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,QAAQ,GAAkB,EAAE,CAAC;IACtC,QAAQ,CAAuC;IAC/C,GAAG,GAAG,CAAC,CAAC;IACC,GAAG,CAAe;IACnC,kGAAkG;IAC1F,MAAM,GAAG,KAAK,CAAC;IACf,YAAY,CAAU;IAE9B,YAAY,OAA2C;QACrD,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,gFAAgF;IAChF,SAAS,CAAC,QAA6C;QACrD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,8FAA8F;IAC9F,GAAG,CAAC,KAAe;QACjB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5B,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,gGAAgG;QAChG,2CAA2C;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;gBACxB,IAAI,EAAE,gBAAgB,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAoB;YAChC,EAAE;YACF,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;QACF,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;YAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,yFAAyF;gBACzF,iFAAiF;YACnF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,MAAM,CAAC,UAAkB,EAAE,QAAwB,EAAE,IAAa;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,MAAM,GAAgB;YAC1B,UAAU;YACV,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,UAAkB,EAAE,MAAc;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}

package/dist/core/escalation/types.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Pause-and-ask escalation (#1's defining UX) — shared types (Phase 3.4 core).
+ * #1 fixes the simple autonomously and PAUSES TO ASK on the complex/low-confidence/risky — inline,
+ * resuming on the human's answer, with the fix gated through the Harness. This is the testable
+ * core; the WebSocket + Cockpit Decisions panel is a thin adapter over it.
+ * Spec: blueprint/agents/01-testteam-bot.md ("Pause-and-ask = its defining UX").
+ */
+export type EscalationRoute = 'auto-heal' | 'pause-and-ask';
+export interface FindingContext {
+    readonly agentId: number;
+    readonly title: string;
+    /** 0..1 calibrated confidence in the proposed auto-fix. */
+    readonly confidence: number;
+    readonly complexity: 'simple' | 'complex';
+    /** Touches prod / irreversible. */
+    readonly risky: boolean;
+}
+export type AnswerDecision = 'approve' | 'reject' | 'modify';
+export interface PendingQuestion {
+    readonly id: string;
+    readonly agentId: number;
+    readonly title: string;
+    readonly detail: string;
+    readonly proposedAction?: string;
+    readonly askedAtMs: number;
+}
+export interface HumanAnswer {
+    readonly questionId: string;
+    readonly decision: AnswerDecision;
+    readonly note?: string;
+    readonly answeredAtMs: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/escalation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../core/escalation/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,eAAe,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/core/escalation/types.js

@@ -0,0 +1,9 @@
+/**
+ * Pause-and-ask escalation (#1's defining UX) — shared types (Phase 3.4 core).
+ * #1 fixes the simple autonomously and PAUSES TO ASK on the complex/low-confidence/risky — inline,
+ * resuming on the human's answer, with the fix gated through the Harness. This is the testable
+ * core; the WebSocket + Cockpit Decisions panel is a thin adapter over it.
+ * Spec: blueprint/agents/01-testteam-bot.md ("Pause-and-ask = its defining UX").
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/escalation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../core/escalation/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}