@awak-app/simy-cli 0.1.0

package/src/orchestrator/execution-io.js

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+
+export const EXECUTION_IO_POLICY_VERSION = "execution_io_redaction.v1";
+
+const DEFAULT_TEXT_LIMIT = 24_000;
+const DEFAULT_LOG_LINE_LIMIT = 100;
+const DEFAULT_LOG_LINE_CHAR_LIMIT = 2_000;
+const DEFAULT_LOG_TOTAL_CHAR_LIMIT = 40_000;
+const REDACTED = "[REDACTED]";
+
+const PRIVATE_KEY_PATTERN =
+  /-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/g;
+const AUTHORIZATION_PATTERN = /(\bAuthorization\s*:\s*)(?:Bearer|Basic)\s+[^\s,;]+/gi;
+const URL_CREDENTIAL_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi;
+const SECRET_KEY =
+  "api[_-]?key|token|access[_-]?token|refresh[_-]?token|id[_-]?token|auth[_-]?token|session[_-]?(?:token|secret)|client[_-]?secret|secret(?:[_-]?(?:access[_-]?key|key))?|password|passwd|pwd|private[_-]?key|cookie|set-cookie";
+const QUOTED_SECRET_PATTERN = new RegExp(
+  `(["']?(?:${SECRET_KEY})["']?\\s*[:=]\\s*)(["'])(?:\\\\.|(?!\\2).)*\\2`,
+  "gi",
+);
+const UNQUOTED_SECRET_PATTERN = new RegExp(
+  `((?:${SECRET_KEY})\\s*[:=]\\s*)(?!${escapeRegExp(REDACTED)})[^\\s,;]+`,
+  "gi",
+);
+const KNOWN_TOKEN_PATTERN =
+  /\b(?:github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16})\b/g;
+const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+
+export function redactExecutionText(value, { maxChars = DEFAULT_TEXT_LIMIT } = {}) {
+  const original = typeof value === "string" ? value : "";
+  let text = original
+    .replace(PRIVATE_KEY_PATTERN, REDACTED)
+    .replace(AUTHORIZATION_PATTERN, `$1${REDACTED}`)
+    .replace(URL_CREDENTIAL_PATTERN, `$1${REDACTED}@`)
+    .replace(QUOTED_SECRET_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`)
+    .replace(UNQUOTED_SECRET_PATTERN, `$1${REDACTED}`)
+    .replace(KNOWN_TOKEN_PATTERN, REDACTED)
+    .replace(JWT_PATTERN, REDACTED);
+  const redacted = text !== original;
+  const truncated = text.length > maxChars;
+  if (truncated) text = `${text.slice(0, Math.max(0, maxChars - 14))}\n[TRUNCATED]`;
+  return { text, redacted, truncated };
+}
+
+export function redactExecutionLogs(
+  value,
+  {
+    maxLines = DEFAULT_LOG_LINE_LIMIT,
+    maxLineChars = DEFAULT_LOG_LINE_CHAR_LIMIT,
+    maxTotalChars = DEFAULT_LOG_TOTAL_CHAR_LIMIT,
+  } = {},
+) {
+  const source = Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+  const selected = source.slice(-maxLines);
+  let remaining = maxTotalChars;
+  let redacted = false;
+  let truncated = source.length > selected.length;
+  const lines = [];
+
+  for (let index = selected.length - 1; index >= 0 && remaining > 0; index -= 1) {
+    const result = redactExecutionText(selected[index], {
+      maxChars: Math.min(maxLineChars, remaining),
+    });
+    redacted ||= result.redacted;
+    truncated ||= result.truncated;
+    if (!result.text) continue;
+    lines.push(result.text);
+    remaining -= result.text.length;
+  }
+
+  lines.reverse();
+  if (lines.length < selected.length) truncated = true;
+  return { lines, redacted, truncated };
+}
+
+export function executionTextSha256(value) {
+  const text = typeof value === "string" ? value : "";
+  return text ? createHash("sha256").update(text).digest("hex") : null;
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/src/orchestrator/independent-audit.js

@@ -0,0 +1,83 @@
+import { bullets, cleanString, section } from "./shared.js";
+
+export function buildIndependentAuditInstruction(charter, attempt) {
+  return [
+    section(
+      "role",
+      "You are an independent PR auditor. You did not implement this change and must not edit files.",
+    ),
+    section(
+      "audit_target",
+      [
+        `Requirement: ${charter.requirement}`,
+        `Acceptance criteria:\n${bullets(charter.acceptance_criteria)}`,
+        `Risk level: ${charter.risk.level}`,
+        `Risk tags: ${charter.risk.tags.join(", ") || "none"}`,
+        `Base branch: ${charter.base_branch}`,
+        `Commit SHA: ${attempt.observed_evidence?.local?.head_sha || attempt.commit_sha || "unknown"}`,
+      ].join("\n"),
+    ),
+    section(
+      "audit_scope",
+      [
+        "Inspect the final diff and related code directly from the repository.",
+        "Look for unmet acceptance criteria, regressions, security issues, data and concurrency risks, missing tests, and unrelated changes.",
+        "Treat executor claims as untrusted until supported by repository evidence.",
+        "Do not modify files, commit, push, or update the pull request.",
+      ].join("\n"),
+    ),
+    section(
+      "result_contract",
+      [
+        "Finish with exactly one line beginning SIMY_AUDIT_JSON: followed by one JSON object.",
+        "Required keys: passed, summary, findings.",
+        "Each finding must contain code, severity, target, explanation, and repairability.",
+        "Use passed=false when a blocker or major finding remains, or when evidence is unavailable.",
+      ].join("\n"),
+    ),
+  ].join("\n\n");
+}
+
+export function buildIndependentAudit(execution) {
+  const result = execution?.result && typeof execution.result === "object" ? execution.result : {};
+  const valid =
+    execution?.exitCode === 0 &&
+    !execution?.error &&
+    typeof result.passed === "boolean" &&
+    Array.isArray(result.findings);
+  if (!valid) {
+    return {
+      passed: false,
+      summary: cleanString(execution?.error || result.summary) || "Independent audit did not return valid evidence.",
+      findings: [
+        {
+          code: "INDEPENDENT_AUDIT_UNAVAILABLE",
+          severity: "blocker",
+          target: "independent_audit",
+          explanation: "The independent auditor failed or returned an invalid structured result.",
+          repairability: "manual",
+        },
+      ],
+      requires_human: true,
+    };
+  }
+
+  const findings = result.findings
+    .filter((item) => item && typeof item === "object")
+    .map((item, index) => ({
+      code: cleanString(item.code) || `INDEPENDENT_AUDIT_${index + 1}`,
+      severity: cleanString(item.severity).toLowerCase() || "major",
+      target: cleanString(item.target) || "pull_request",
+      explanation: cleanString(item.explanation) || "Independent audit finding.",
+      repairability: item.repairability === "manual" ? "manual" : "auto",
+      auto_fix_hint: cleanString(item.auto_fix_hint) || null,
+    }));
+  const blocking = findings.some((item) => ["blocker", "major"].includes(item.severity));
+  const requiresHuman = findings.some((item) => item.repairability === "manual");
+  return {
+    passed: result.passed === true && !blocking && !requiresHuman,
+    summary: cleanString(result.summary) || "Independent audit completed.",
+    findings,
+    requires_human: requiresHuman,
+  };
+}

package/src/orchestrator/index.js

@@ -0,0 +1,5 @@
+export { createCodingLoopSnapshot, newRunId } from "./contract.js";
+export { collectPrEvidence } from "./evidence.js";
+export { buildIndependentAuditInstruction } from "./independent-audit.js";
+export { recheckPrReadiness, runCodingLoop } from "./loop.js";
+export { parseStructuredMarker, parseStructuredResult } from "./result.js";

package/src/orchestrator/instruction.js

@@ -0,0 +1,123 @@
+import { bullets, looksLikeUiTask, section } from "./shared.js";
+
+export function buildCodingInstruction(
+  charter,
+  { attemptNumber, previousAttempt = null, previousFindings = [], promptInterventions = [] },
+) {
+  const sections = [
+    section("role", "You are the local coding executor for a SIMY coding loop."),
+    section(
+      "requirement_charter",
+      [
+        `Requirement: ${charter.requirement}`,
+        `Repository: ${charter.repository}`,
+        `Required PR base branch: ${charter.base_branch}`,
+        `Risk level: ${charter.risk.level}`,
+        `Design summary: ${charter.design_review.summary || "not required"}`,
+        `Design approved by: ${charter.design_review.approved_by || "not required"}`,
+        `Attempt: ${attemptNumber}/${charter.max_attempts}`,
+        `Local evidence root: ${charter.ui_evidence_root || "not required"}`,
+      ].join("\n"),
+    ),
+    section("acceptance_criteria", bullets(charter.acceptance_criteria)),
+    section("expected_tests", bullets(charter.expected_tests)),
+    section("must_not", bullets(charter.must_not)),
+  ];
+
+  if (previousAttempt || previousFindings.length > 0) {
+    sections.push(
+      section(
+        "previous_attempt_feedback",
+        [
+          previousAttempt ? `Previous attempt summary: ${previousAttempt.summary || "missing"}` : "",
+          previousAttempt ? `Previous PR: ${previousAttempt.pr_url || "missing"}` : "",
+          "Findings to repair:",
+          bullets(
+            previousFindings.map(
+              (finding) =>
+                `${finding.code}: ${finding.auto_fix_hint || finding.explanation || finding.title}`,
+            ),
+          ),
+        ]
+          .filter(Boolean)
+          .join("\n"),
+      ),
+    );
+  }
+
+  if (promptInterventions.length > 0) {
+    sections.push(
+      section(
+        "simy_interventions",
+        promptInterventions.map((item) => `${item.title}: ${item.prompt}`).join("\n\n"),
+      ),
+    );
+  }
+
+  sections.push(
+    section(
+      "execution_contract",
+      [
+        "Read the repository instructions and current git state before editing.",
+        "Preserve user changes and keep the diff scoped to the requirement.",
+        "Run relevant tests, inspect the final diff, commit, push, and create or update a PR.",
+        `The PR must target ${charter.base_branch}.`,
+        "Do not commit screenshots, videos, logs, secrets, or SIMY result files.",
+      ].join("\n"),
+    ),
+    section(
+      "result_contract",
+      [
+        "Finish with exactly one line beginning SIMY_RESULT_JSON: followed by one JSON object.",
+        "Required keys: outcome_kind, summary, branch_name, commit_sha, commit_message_headline, pr_url, pr_number, pr_title, pr_base_branch, tests_run, tests_passed, ui_evidence_path, unrelated_changes_detected, secret_scan_passed, changed_files, residual_risks.",
+        "Use null for unavailable scalar values and [] for unavailable arrays. Do not claim evidence that was not observed.",
+      ].join("\n"),
+    ),
+  );
+  return sections.join("\n\n");
+}
+
+export function buildPromptInterventions(charter, { attemptNumber, previousFindings }) {
+  const now = new Date().toISOString();
+  const rows = [
+    {
+      trigger: "purpose_lock",
+      title: "Purpose lock",
+      prompt: "Keep every edit tied to the original requirement and state any assumption explicitly.",
+      evidence_required: ["changed_files", "completion_evidence"],
+    },
+    {
+      trigger: "release_management",
+      title: "Release management",
+      prompt: "Record the branch, commit, tests, and pull request while preserving repository release rules.",
+      evidence_required: ["git_status", "pr_url", "commit_sha", "tests_run"],
+    },
+    {
+      trigger: "completion_self_audit",
+      title: "Completion self-audit",
+      prompt: "Inspect the final diff and report residual risks without claiming unobserved success.",
+      evidence_required: ["self_audit", "residual_risks"],
+    },
+  ];
+  if (looksLikeUiTask(charter.requirement)) {
+    rows.push({
+      trigger: "browser_verification",
+      title: "Browser verification",
+      prompt: "Open the local UI, exercise the changed flow, check console/network errors, and capture local evidence.",
+      evidence_required: ["opened_url", "operation_result", "screenshot"],
+    });
+  }
+  if (previousFindings.length > 0) {
+    rows.push({
+      trigger: "repair_focus",
+      title: "Repair focus",
+      prompt: "Fix only the reported gate failures, then rerun the affected verification.",
+      evidence_required: ["fixed_finding_codes", "rerun_report"],
+    });
+  }
+  return rows.map((row) => ({
+    id: `${charter.id}-${row.trigger}-${attemptNumber}`,
+    ...row,
+    created_at: now,
+  }));
+}

package/src/orchestrator/loop.js

@@ -0,0 +1,341 @@
+import { auditAttempt, evaluatePrReadiness } from "./audit.js";
+import {
+  buildIndependentAudit,
+  buildIndependentAuditInstruction,
+} from "./independent-audit.js";
+import { buildCodingInstruction, buildPromptInterventions } from "./instruction.js";
+import { buildAttempt } from "./result.js";
+import { appendEvent, publish } from "./shared.js";
+
+export async function runCodingLoop({
+  snapshot,
+  executeAttempt,
+  executeIndependentAudit,
+  collectEvidence,
+  onUpdate,
+}) {
+  appendEvent(snapshot, "risk_classifying", "PR risk classification completed.", {
+    risk: snapshot.charter.risk,
+  });
+  await publish(snapshot, "risk_classifying", onUpdate);
+
+  const charterFindings = validateCharter(snapshot.charter);
+  if (charterFindings.length > 0) {
+    snapshot.final_audit = humanGate(
+      "Requirements or design review must be completed before implementation.",
+      charterFindings,
+    );
+    appendEvent(snapshot, "waiting_human", "Requirements require human clarification.", {
+      finding_codes: charterFindings.map((finding) => finding.code),
+    });
+    await publish(snapshot, "waiting_human", onUpdate);
+    return snapshot;
+  }
+
+  appendEvent(snapshot, "chartering", "Requirement charter created locally.", {
+    charter_id: snapshot.charter.id,
+    base_branch: snapshot.charter.base_branch,
+    risk_level: snapshot.charter.risk.level,
+  });
+  await publish(snapshot, "chartering", onUpdate);
+
+  let previousFindings = [];
+  for (
+    let attemptNumber = 1;
+    attemptNumber <= snapshot.charter.max_attempts;
+    attemptNumber += 1
+  ) {
+    const promptInterventions = buildPromptInterventions(snapshot.charter, {
+      attemptNumber,
+      previousFindings,
+    });
+    const instruction = buildCodingInstruction(snapshot.charter, {
+      attemptNumber,
+      previousAttempt: snapshot.attempts.at(-1) ?? null,
+      previousFindings,
+      promptInterventions,
+    });
+
+    appendEvent(snapshot, "dispatching", `Dispatching local coding attempt ${attemptNumber}.`, {
+      backend: snapshot.charter.backend,
+      attempt_number: attemptNumber,
+      instruction,
+    });
+    await publish(snapshot, "dispatching", onUpdate);
+
+    appendEvent(snapshot, "coding", `${snapshot.charter.backend} is executing locally.`, {
+      backend: snapshot.charter.backend,
+      attempt_number: attemptNumber,
+      instruction,
+    });
+    await publish(snapshot, "coding", onUpdate);
+
+    const execution = await safeExecution(() =>
+      executeAttempt({
+        attemptNumber,
+        backend: snapshot.charter.backend,
+        instruction,
+        charter: snapshot.charter,
+      }),
+    );
+    const attempt = buildAttempt({
+      attemptNumber,
+      charter: snapshot.charter,
+      instruction,
+      promptInterventions,
+      execution,
+    });
+
+    appendEvent(snapshot, "collecting_evidence", `Collecting attempt ${attemptNumber} evidence.`, {
+      attempt_number: attemptNumber,
+    });
+    await publish(snapshot, "collecting_evidence", onUpdate);
+    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+
+    appendEvent(snapshot, "auditing", `Verifying local evidence for attempt ${attemptNumber}.`, {
+      attempt_number: attemptNumber,
+      outcome_kind: attempt.outcome_kind,
+    });
+    await publish(snapshot, "auditing", onUpdate);
+    attempt.audit = await auditAttempt(snapshot.charter, attempt);
+    attempt.implementation_gate = attempt.audit.implementation_gate;
+    snapshot.attempts.push(attempt);
+
+    if (!attempt.audit.passed) {
+      snapshot.final_audit = attempt.audit;
+      const terminal = await handleFailedAudit({
+        snapshot,
+        attempt,
+        attemptNumber,
+        findings: attempt.audit.findings,
+        requiresHuman: attempt.audit.requires_human,
+        onUpdate,
+      });
+      if (terminal) return snapshot;
+      previousFindings = attempt.audit.findings;
+      continue;
+    }
+
+    appendEvent(snapshot, "independent_auditing", "Starting an independent AI audit.", {
+      attempt_number: attemptNumber,
+      backend: snapshot.charter.audit_backend,
+    });
+    await publish(snapshot, "independent_auditing", onUpdate);
+    const auditInstruction = buildIndependentAuditInstruction(snapshot.charter, attempt);
+    const auditExecution = await safeExecution(() =>
+      executeIndependentAudit({
+        attemptNumber,
+        backend: snapshot.charter.audit_backend,
+        instruction: auditInstruction,
+        charter: snapshot.charter,
+        attempt,
+      }),
+    );
+    attempt.independent_audit = buildIndependentAudit(auditExecution);
+
+    // Re-collect after the read-only auditor to catch any mutated HEAD or working tree.
+    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.audit = await auditAttempt(snapshot.charter, attempt);
+    attempt.implementation_gate = attempt.audit.implementation_gate;
+
+    const independentFindings = attempt.independent_audit.findings || [];
+    if (!attempt.audit.passed || !attempt.independent_audit.passed) {
+      const findings = [...attempt.audit.findings, ...independentFindings];
+      snapshot.final_audit = aggregateAudit(attempt, false, findings);
+      const terminal = await handleFailedAudit({
+        snapshot,
+        attempt,
+        attemptNumber,
+        findings,
+        requiresHuman:
+          attempt.audit.requires_human || attempt.independent_audit.requires_human,
+        onUpdate,
+      });
+      if (terminal) return snapshot;
+      previousFindings = findings;
+      continue;
+    }
+
+    snapshot.implementation_gate_passed = true;
+    attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
+    attempt.pr_gate = attempt.pr_readiness;
+    snapshot.final_audit = aggregateAudit(
+      attempt,
+      attempt.pr_readiness.ready,
+      attempt.independent_audit.findings || [],
+    );
+    snapshot.done_gate_passed = attempt.pr_readiness.ready;
+    appendEvent(snapshot, attempt.pr_readiness.state, attempt.pr_readiness.summary, {
+      attempt_number: attemptNumber,
+      pr_url: attempt.pr_url,
+      pending_reasons: attempt.pr_readiness.pending_reasons,
+    });
+    await publish(snapshot, attempt.pr_readiness.state, onUpdate);
+    return snapshot;
+  }
+
+  return snapshot;
+}
+
+export async function recheckPrReadiness({ snapshot, collectEvidence, onUpdate }) {
+  const attempt = snapshot.attempts.at(-1);
+  if (!attempt || !attempt.audit?.passed || !attempt.independent_audit?.passed) return snapshot;
+  appendEvent(snapshot, "checking_pr", "Refreshing GitHub review and CI evidence.", {
+    attempt_number: attempt.attempt_number,
+  });
+  await publish(snapshot, "checking_pr", onUpdate);
+  attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+  attempt.audit = await auditAttempt(snapshot.charter, attempt);
+  snapshot.implementation_gate_passed = attempt.audit.passed;
+  attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
+  attempt.pr_gate = attempt.pr_readiness;
+  snapshot.done_gate_passed = attempt.pr_readiness.ready;
+  snapshot.final_audit = aggregateAudit(
+    attempt,
+    attempt.pr_readiness.ready,
+    attempt.independent_audit.findings || [],
+  );
+  appendEvent(snapshot, attempt.pr_readiness.state, attempt.pr_readiness.summary, {
+    pr_url: attempt.pr_url,
+    pending_reasons: attempt.pr_readiness.pending_reasons,
+  });
+  await publish(snapshot, attempt.pr_readiness.state, onUpdate);
+  return snapshot;
+}
+
+function validateCharter(charter) {
+  const findings = [];
+  if (charter.risk.requires_design_review && charter.acceptance_criteria_source !== "explicit") {
+    findings.push({
+      code: "EXPLICIT_ACCEPTANCE_CRITERIA_REQUIRED",
+      severity: "blocker",
+      target: "acceptance_criteria",
+      explanation: "High-risk work requires explicit acceptance criteria.",
+      repairability: "manual",
+    });
+  }
+  if (charter.design_review.required && charter.design_review.status !== "approved") {
+    findings.push({
+      code: "DESIGN_REVIEW_REQUIRED",
+      severity: "blocker",
+      target: "design_review",
+      explanation:
+        "High-risk work requires a design summary, approval owner, and review evidence before implementation.",
+      repairability: "manual",
+    });
+  }
+  if (charter.risk.requires_design_review && charter.required_checks.length === 0) {
+    findings.push({
+      code: "REQUIRED_CI_CHECKS_MISSING",
+      severity: "blocker",
+      target: "required_checks",
+      explanation: "High-risk work requires explicit CI and security check names.",
+      repairability: "manual",
+    });
+  }
+  return findings;
+}
+
+async function safeExecution(callback) {
+  try {
+    return await callback();
+  } catch (error) {
+    return {
+      exitCode: null,
+      logs: [],
+      result: {},
+      error: error instanceof Error ? error.message : "Local executor failed.",
+    };
+  }
+}
+
+async function safeEvidence(collector, attempt) {
+  if (!collector) return unavailableEvidence("Evidence collector is not configured.");
+  try {
+    return await collector(attempt);
+  } catch (error) {
+    return unavailableEvidence(
+      error instanceof Error ? error.message : "Evidence collection failed.",
+    );
+  }
+}
+
+function unavailableEvidence(error) {
+  return {
+    collected_at: new Date().toISOString(),
+    local: {
+      available: false,
+      working_tree_clean: false,
+      changed_files: [],
+      status_lines: [],
+      errors: [error],
+    },
+    github: {
+      available: false,
+      checks: [],
+      checks_present: false,
+      checks_passing: false,
+      required_checks_present: false,
+      error,
+    },
+  };
+}
+
+async function handleFailedAudit({
+  snapshot,
+  attempt,
+  attemptNumber,
+  findings,
+  requiresHuman,
+  onUpdate,
+}) {
+  snapshot.charter.thread_state.failure_count += 1;
+  if (requiresHuman) {
+    appendEvent(snapshot, "waiting_human", "PR audit requires human input.", {
+      finding_codes: findings.map((finding) => finding.code),
+    });
+    await publish(snapshot, "waiting_human", onUpdate);
+    return true;
+  }
+  if (attemptNumber < snapshot.charter.max_attempts) {
+    appendEvent(snapshot, "re_instructing", "PR audit produced a repair instruction.", {
+      attempt_number: attemptNumber,
+      finding_codes: findings.map((finding) => finding.code),
+    });
+    await publish(snapshot, "re_instructing", onUpdate);
+    return false;
+  }
+  appendEvent(snapshot, "blocked", "Coding loop exhausted its attempt budget.", {
+    finding_codes: findings.map((finding) => finding.code),
+  });
+  await publish(snapshot, "blocked", onUpdate);
+  return true;
+}
+
+function aggregateAudit(attempt, passed, findings) {
+  return {
+    passed,
+    summary: attempt.pr_readiness?.summary || "PR lifecycle audit completed.",
+    findings,
+    auto_repairable: false,
+    requires_human: !passed,
+    implementation_gate: attempt.implementation_gate,
+    independent_audit: attempt.independent_audit,
+    pr_gate: attempt.pr_readiness || null,
+    release_gate: null,
+  };
+}
+
+function humanGate(summary, findings) {
+  return {
+    passed: false,
+    summary,
+    findings,
+    auto_repairable: false,
+    requires_human: true,
+    implementation_gate: null,
+    independent_audit: null,
+    pr_gate: null,
+    release_gate: null,
+  };
+}