@b00dea/cockpit 0.0.0-stage → 0.1.0

package/dist/environment/observations.js

@@ -0,0 +1,344 @@
+import { RefusalError, ENVIRONMENT_CODES, isCanonicalTimestamp, snapshotEnvironmentObservation, } from './contract.js';
+import { exactKeys } from '../exact-keys.js';
+import { createHash } from 'node:crypto';
+import { observationDeclarations as claimDeclarations } from './claims.js';
+import { surfaceObservationDeclarations } from './generated-application/shared.js';
+import { observationDeclarations as envSchemaDeclarations } from './env-schema-observation.js';
+import { observationDeclarations as gitDeclarations } from './git-observation.js';
+import { observationDeclarations as hostDeclarations } from './host-observation.js';
+import { observationDeclarations as lifecycleStageDeclarations } from './lifecycle-stage.js';
+import { observationDeclarations as runtimeDeclarations, runtimeHealthObservationDeclarations } from './runtime.js';
+import { observationDeclarations as stateDeclarations } from './state.js';
+import { observationDeclarations as templateDeclarations } from './templates.js';
+import { STRUCTURED_INPUT_ENTRY_LIMIT } from '../schema.js';
+import { authenticateObservationPostureContext, POSTURE_REQUIREMENT_OWNER, } from './posture-observation.js';
+export { resolveObservationPostures, refreshObservationPostures } from './posture-observation.js';
+const compareCodeUnits = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+function boundedArray(value) {
+    return Array.isArray(value) && value.length <= STRUCTURED_INPUT_ENTRY_LIMIT ? value : undefined;
+}
+function validStage(value) {
+    if ((value.stage !== 'bootstrap' && value.stage !== 'steady') || (value.disposition !== 'required' && value.disposition !== 'not-applicable'))
+        return false;
+    const reason = value.disposition === 'not-applicable' ? value.reason : undefined;
+    if (value.disposition === 'required')
+        return exactKeys(value, ['stage', 'disposition']);
+    return exactKeys(value, ['stage', 'disposition', 'reason']) && typeof reason === 'string' && reason.length > 0 && !reason.includes('\0')
+        && Buffer.byteLength(reason, 'utf8') <= 1_024;
+}
+export const allObservationDeclarations = Object.freeze([
+    ...claimDeclarations,
+    ...envSchemaDeclarations,
+    ...gitDeclarations,
+    ...hostDeclarations,
+    ...lifecycleStageDeclarations,
+    ...runtimeDeclarations,
+    ...stateDeclarations,
+    ...templateDeclarations,
+    ...surfaceObservationDeclarations,
+    ...runtimeHealthObservationDeclarations,
+]);
+export function validateObservationDeclarations(declarations, requiredPostures = []) {
+    const declarationInputs = boundedArray(declarations);
+    const postureInputs = boundedArray(requiredPostures);
+    if (!declarationInputs || !postureInputs || postureInputs.some((posture) => typeof posture !== 'string')) {
+        return { kind: 'invalid', reason: 'observation declaration collection is malformed' };
+    }
+    const byId = new Set();
+    const byCode = new Set();
+    const owned = [];
+    for (let declarationIndex = 0; declarationIndex < declarationInputs.length; declarationIndex += 1) {
+        const declaration = declarationInputs[declarationIndex];
+        if (declaration === null || typeof declaration !== 'object' || !Array.isArray(declaration.postures) || !Array.isArray(declaration.stages)
+            || !declaration.stages.every(validStage))
+            return { kind: 'invalid', reason: 'observation declaration is malformed' };
+        if (typeof declaration.id !== 'string' || typeof declaration.owner !== 'string'
+            || !/^[a-z][a-z0-9-]*$/.test(declaration.id) || !/^[a-z][a-z0-9-]*$/.test(declaration.owner)
+            || !Object.values(ENVIRONMENT_CODES).includes(declaration.code)
+            || typeof declaration.isIssued !== 'function'
+            || (declaration.issuedAt !== undefined && typeof declaration.issuedAt !== 'function')
+            || declaration.postures.length === 0
+            || declaration.postures.some((posture) => typeof posture !== 'string' || !/^[a-z][a-z0-9-]*$/.test(posture))
+            || new Set(declaration.postures).size !== declaration.postures.length
+            || declaration.stages.length === 0) {
+            return { kind: 'invalid', reason: 'observation declaration is malformed' };
+        }
+        for (const stage of ['bootstrap', 'steady']) {
+            const count = declaration.stages.filter((entry) => entry.stage === stage).length;
+            if (count === 0)
+                return { kind: 'invalid', reason: `${declaration.id} does not declare lifecycle stage ${stage}` };
+            if (count > 1)
+                return { kind: 'invalid', reason: `${declaration.id} declares lifecycle stage ${stage} more than once` };
+        }
+        if (declaration.stages.length !== 2)
+            return { kind: 'invalid', reason: 'observation declaration is malformed' };
+        if (byId.has(declaration.id))
+            return { kind: 'invalid', reason: `duplicate observation declaration: ${declaration.id}` };
+        byId.add(declaration.id);
+        if (byCode.has(declaration.code))
+            return { kind: 'invalid', reason: `duplicate observation code: ${declaration.code}` };
+        byCode.add(declaration.code);
+        for (let postureIndex = 0; postureIndex < postureInputs.length; postureIndex += 1) {
+            const posture = postureInputs[postureIndex];
+            if (!declaration.postures.includes(posture)) {
+                return { kind: 'invalid', reason: `${declaration.id} does not declare posture ${posture}` };
+            }
+        }
+        owned.push(declaration);
+    }
+    return { kind: 'valid', declarations: owned.sort((left, right) => compareCodeUnits(left.id, right.id)) };
+}
+const productionDeclarations = validateObservationDeclarations(allObservationDeclarations);
+if (productionDeclarations.kind !== 'valid')
+    throw new RefusalError(productionDeclarations.reason);
+if (productionDeclarations.declarations.some(({ issuedAt }) => typeof issuedAt !== 'function')) {
+    throw new RefusalError('production observation declaration lacks issuance authority');
+}
+const validatedProductionDeclarations = productionDeclarations.declarations;
+const issuedPreflights = new WeakSet();
+// Rows whose evidence exists only while the stack's services run. Before the first `up`, and while
+// the stack sleeps, doctor and preflight still evaluate every other row; these are reported as not
+// applicable with the reason, because reporting them as missing evidence hid the rows that can fail
+// before bring-up behind an "unavailable" verdict.
+const RUNNING_STACK_ROWS = Object.freeze([
+    'running-checkout', 'runtime-availability', 'mount-posture', 'runtime-mount-materialization', 'runtime-port-family',
+]);
+// Rows and posture checks that describe a runtime; a cockpit that declares none has nothing for them to measure.
+const RUNTIME_ROWS = Object.freeze(['runtime-measurement', POSTURE_REQUIREMENT_OWNER]);
+for (const id of [...RUNNING_STACK_ROWS, ...RUNTIME_ROWS]) {
+    if (id !== POSTURE_REQUIREMENT_OWNER && !validatedProductionDeclarations.some((declaration) => declaration.id === id)) {
+        throw new RefusalError(`stopped-stack applicability names an undeclared observation: ${id}`);
+    }
+}
+/**
+ * Which rows cannot be observed when no stack runs, and why. The key is a declaration id, or the
+ * posture-requirement owner for the posture checks.
+ */
+export function stoppedStackApplicability(input) {
+    const rows = new Map(RUNNING_STACK_ROWS.map((id) => [id, `${id} is observed only while the stack runs; run up, then rerun this command to check it`]));
+    if (!input.runtimeDeclared) {
+        for (const id of [...RUNNING_STACK_ROWS, ...RUNTIME_ROWS])
+            rows.set(id, 'this cockpit declares no runtime, so there is nothing for it to measure');
+    }
+    return rows;
+}
+function jsonEqual(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function hasObservedPresence(value) {
+    if (value === null || value === '')
+        return false;
+    if (Array.isArray(value))
+        return value.length > 0;
+    return typeof value !== 'object' || Object.keys(value).length > 0;
+}
+export function observationSatisfiesExpectation(observation) {
+    if (observation.observed.state !== 'available')
+        return false;
+    const measured = observation.observed.value;
+    const expectation = observation.expectation;
+    if (expectation.kind === 'present')
+        return hasObservedPresence(measured);
+    if (expectation.kind === 'equal')
+        return jsonEqual(measured, expectation.value);
+    if (expectation.kind === 'one-of')
+        return expectation.values.some((value) => jsonEqual(measured, value));
+    return typeof measured === 'number' && Number.isSafeInteger(measured)
+        && (expectation.kind === 'minimum' ? measured >= expectation.value : measured <= expectation.value);
+}
+function boundedJson(value) {
+    const text = JSON.stringify(value);
+    return text.length > 120 ? `${text.slice(0, 117)}...` : text;
+}
+// The diagnostic message is this reason, so a bare "does not satisfy" left a human to dig the
+// measured value (such as a dirty-file count) out of the JSON result before acting on it.
+function mismatchDetail(measured, expectation) {
+    if (expectation.kind === 'minimum')
+        return `measured ${boundedJson(measured)} (expected at least ${expectation.value})`;
+    if (expectation.kind === 'maximum')
+        return `measured ${boundedJson(measured)} (expected at most ${expectation.value})`;
+    if (expectation.kind !== 'equal')
+        return undefined;
+    const expected = expectation.value;
+    const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+    if (!isRecord(measured) || !isRecord(expected))
+        return `measured ${boundedJson(measured)} (expected ${boundedJson(expected)})`;
+    const fields = [...new Set([...Object.keys(expected), ...Object.keys(measured)])]
+        .filter((key) => !jsonEqual(measured[key] ?? null, expected[key] ?? null));
+    if (fields.length === 0)
+        return undefined;
+    const shown = fields.slice(0, 8).map((key) => `${key} is ${boundedJson(measured[key] ?? null)} (expected ${boundedJson(expected[key] ?? null)})`);
+    return fields.length > shown.length ? `${shown.join(', ')}, and ${fields.length - shown.length} more` : shown.join(', ');
+}
+function reasonFor(observation, verdict) {
+    if (observation.applicability.state === 'not-applicable')
+        return observation.applicability.reason;
+    if (observation.observed.state !== 'available')
+        return observation.observed.reason;
+    if (observation.freshness.state !== 'current')
+        return observation.freshness.reason;
+    if (verdict === 'pass')
+        return 'expectation satisfied';
+    const detail = mismatchDetail(observation.observed.value, observation.expectation);
+    return detail ? `observed value does not satisfy the expectation: ${detail}` : 'observed value does not satisfy the expectation';
+}
+function evaluate(observation) {
+    let verdict;
+    if (observation.applicability.state === 'not-applicable')
+        verdict = 'not-applicable';
+    else if (observation.observed.state === 'unavailable')
+        verdict = 'unavailable';
+    else if (observation.freshness.state !== 'current')
+        verdict = 'fail';
+    else if (observation.observed.state === 'failed')
+        verdict = 'fail';
+    else
+        verdict = observationSatisfiesExpectation(observation) ? 'pass' : 'fail';
+    return {
+        code: observation.code,
+        owner: observation.owner,
+        stackId: observation.stackId,
+        source: observation.source,
+        verdict,
+        reason: reasonFor(observation, verdict),
+        remedy: observation.remedy,
+        observedAt: observation.observed.observedAt,
+        ...(observation.observed.state === 'available' ? { measured: observation.observed.value } : {}),
+        expected: observation.expectation,
+    };
+}
+function declaredApplicability(declaration, authority, stage, unobservable) {
+    const posture = declaration.postures.find((value) => authority.postures.includes(value));
+    if (!posture) {
+        return { state: 'not-applicable', posture: authority.postures.join('+'), reason: `${declaration.id} does not apply to the resolved posture` };
+    }
+    const disposition = declaration.stages.find((entry) => entry.stage === stage);
+    if (disposition.disposition !== 'required')
+        return { state: 'not-applicable', posture, reason: disposition.reason };
+    const reason = unobservable.get(declaration.id);
+    return reason === undefined ? { state: 'required', posture } : { state: 'not-applicable', posture, reason };
+}
+function missingObservation(declaration, authority, stage, unobservable) {
+    return {
+        code: declaration.code,
+        owner: declaration.owner,
+        stackId: authority.stackId,
+        source: declaration.id,
+        observed: { state: 'unavailable', reason: `${declaration.id} evidence is missing`, observedAt: authority.evaluatedAt },
+        expectation: { kind: 'present' },
+        applicability: declaredApplicability(declaration, authority, stage, unobservable),
+        freshness: { state: 'missing', reason: `${declaration.id} has no current observation` },
+        remedy: `provide a current ${declaration.id} observation`,
+    };
+}
+/**
+ * `unobservable` comes from {@link stoppedStackApplicability}: rows no producer can observe in the
+ * stack's current state, reported as not applicable with its reason instead of as missing.
+ */
+function evaluatePreflight(values, context, unobservable = new Map()) {
+    const observations = [];
+    const observationInputs = boundedArray(values);
+    if (!observationInputs)
+        throw new RefusalError('preflight observations must be a bounded dense array');
+    const { evaluationInstant, authorities, stages, checks: postureChecks } = authenticateObservationPostureContext(context);
+    if (authorities.size * validatedProductionDeclarations.length > STRUCTURED_INPUT_ENTRY_LIMIT) {
+        throw new RefusalError('preflight aggregate exceeds its bounded declaration capacity');
+    }
+    const suppliedKeys = new Set();
+    for (const value of observationInputs) {
+        const snapshot = snapshotEnvironmentObservation(value);
+        if (snapshot === undefined)
+            throw new RefusalError('environment observation is malformed');
+        const declaration = validatedProductionDeclarations.find(({ owner, code }) => owner === snapshot.owner && code === snapshot.code);
+        if (!declaration)
+            throw new RefusalError('environment observation has no declared producer authority');
+        if (!declaration.isIssued(value))
+            throw new RefusalError('environment observation is not producer-issued');
+        const producerIssuedAt = declaration.issuedAt?.(value);
+        if (producerIssuedAt === undefined)
+            throw new RefusalError('environment observation lacks producer issuance authority');
+        const key = `${snapshot.stackId}\0${snapshot.owner}\0${snapshot.code}`;
+        if (suppliedKeys.has(key))
+            throw new RefusalError('preflight contains duplicate mechanism evidence');
+        suppliedKeys.add(key);
+        const authority = authorities.get(snapshot.stackId);
+        if (!authority)
+            throw new RefusalError('environment observation has no resolved posture authority');
+        const applicability = declaredApplicability(declaration, authority, stages.get(authority.stackId), unobservable);
+        const observedTime = Date.parse(snapshot.observed.observedAt);
+        const freshness = observedTime < Date.parse(authority.evaluatedAt)
+            || observedTime > Date.parse(authority.validThrough)
+            || observedTime > evaluationInstant
+            || observedTime > producerIssuedAt
+            ? { state: 'stale', reason: 'observation timestamp does not match the evaluation boundary' }
+            : snapshot.freshness.state === 'current' ? { state: 'current' } : snapshot.freshness;
+        const expectation = snapshot.code === ENVIRONMENT_CODES.CONFIG_STALE
+            ? { kind: 'equal', value: authority.revision }
+            : snapshot.expectation;
+        const owned = snapshotEnvironmentObservation({ ...snapshot, applicability, freshness, expectation });
+        if (!owned)
+            throw new RefusalError('environment observation applicability could not be derived');
+        observations.push(owned);
+    }
+    const stackIds = [...authorities.keys()].sort(compareCodeUnits);
+    const missing = [];
+    for (const stackId of stackIds) {
+        const authority = authorities.get(stackId);
+        for (const declaration of validatedProductionDeclarations) {
+            const key = `${stackId}\0${declaration.owner}\0${declaration.code}`;
+            if (!suppliedKeys.has(key))
+                missing.push([declaration, authority]);
+        }
+    }
+    for (const [declaration, authority] of missing)
+        observations.push(missingObservation(declaration, authority, stages.get(authority.stackId), unobservable));
+    const postureReason = unobservable.get(POSTURE_REQUIREMENT_OWNER);
+    const checks = [...observations
+            .sort((left, right) => compareCodeUnits(`${left.stackId}\0${left.code}\0${left.owner}\0${left.source}`, `${right.stackId}\0${right.code}\0${right.owner}\0${right.source}`))
+            .map(evaluate), ...postureReason === undefined ? postureChecks
+            : postureChecks.map((check) => ({ ...check, verdict: 'not-applicable', reason: postureReason }))]
+        .sort((left, right) => compareCodeUnits(`${left.stackId}\0${left.code}\0${left.owner}\0${left.source}`, `${right.stackId}\0${right.code}\0${right.owner}\0${right.source}`));
+    const verdict = stackIds.length === 0 && checks.length === 0 ? 'unavailable'
+        : checks.some((check) => check.verdict === 'fail')
+            ? 'fail'
+            : checks.some((check) => check.verdict === 'unavailable') ? 'unavailable' : 'pass';
+    const revisionEntries = [...authorities.values()]
+        .map((authority) => `${authority.stackId}\0${authority.revision}`)
+        .sort(compareCodeUnits);
+    const distinctRevisions = new Set([...authorities.values()].map((authority) => authority.revision));
+    const revision = distinctRevisions.size === 1
+        ? [...distinctRevisions][0]
+        : createHash('sha256').update(revisionEntries.join('\0')).digest('hex');
+    const result = { verdict, revision, checks };
+    issuedPreflights.add(result);
+    return result;
+}
+function evidenceValue(value) {
+    return value === undefined ? 'unavailable' : JSON.stringify(value);
+}
+export function projectDoctor(preflight) {
+    if (!issuedPreflights.has(preflight))
+        throw new RefusalError('preflight evaluation is not authentic');
+    return {
+        verdict: preflight.verdict,
+        checks: preflight.checks.map((check) => ({
+            ...check,
+            evidence: `source=${check.source} observedAt=${check.observedAt} measured=${evidenceValue(check.measured)} expected=${JSON.stringify(check.expected)}`,
+        })),
+    };
+}
+export function aggregateObservations(groups, context, unobservable) {
+    const groupInputs = boundedArray(groups);
+    if (!groupInputs)
+        throw new RefusalError('observation groups must be a bounded dense array');
+    const values = [];
+    for (const group of groupInputs) {
+        const observations = boundedArray(group);
+        if (!observations || values.length + observations.length > STRUCTURED_INPUT_ENTRY_LIMIT) {
+            throw new RefusalError('observation groups must be a bounded dense array within the shared boundary');
+        }
+        for (const observation of observations)
+            values.push(observation);
+    }
+    return evaluatePreflight(values, context, unobservable);
+}

package/dist/environment/operator-application.d.ts

@@ -0,0 +1,50 @@
+import { type EffectivePolicy, type PolicyWeakening } from '../autonomy.js';
+import { type Diagnostic } from './contract.js';
+import type { ResetCommandInput } from './application/lifecycle-context.js';
+import type { GeneratedEnvironmentCommandInput, GeneratedEnvironmentSyncInput, GeneratedStaleRemovalApproval, GeneratedStaleRemovalApprovalRequest } from './generated-application/shared.js';
+export interface OperatorAdmission {
+    readonly interactive: boolean;
+    readonly json: boolean;
+    readonly ci: string | undefined;
+    readonly terminal: boolean;
+    readonly apply?: boolean;
+}
+/** The autonomy policy a gated command reads, or the refusal that it could not be read. */
+export type OperatorPolicy = Readonly<{
+    current: EffectivePolicy;
+    recorded?: EffectivePolicy;
+    record: () => Promise<void>;
+}>;
+export interface OperatorCommandOutcome {
+    readonly status: number;
+    readonly diagnostics: readonly Diagnostic[];
+    readonly result: unknown;
+}
+export interface OperatorSession {
+    readonly preview: OperatorCommandOutcome;
+    decide(decision: 'approve' | 'decline'): Promise<OperatorCommandOutcome>;
+}
+export interface ResetOperatorApplicationAdapters {
+    readonly preview: (input: ResetCommandInput) => Promise<OperatorCommandOutcome>;
+    readonly begin: (input: ResetCommandInput) => Promise<OperatorSession | OperatorCommandOutcome>;
+    readonly confirm: (preview: OperatorCommandOutcome) => Promise<boolean>;
+    readonly policy: (configPath: string) => Promise<OperatorPolicy | OperatorCommandOutcome>;
+}
+export type GeneratedEnvironmentSyncHandlerInput = GeneratedEnvironmentSyncInput & Readonly<{
+    authorizeStaleRemoval?: (request: GeneratedStaleRemovalApprovalRequest) => Promise<GeneratedStaleRemovalApproval | undefined>;
+}>;
+export interface SyncOperatorApplicationAdapters {
+    readonly synchronize: (input: GeneratedEnvironmentSyncHandlerInput) => Promise<OperatorCommandOutcome>;
+    readonly confirmStaleRemoval: (request: GeneratedStaleRemovalApprovalRequest) => Promise<string | undefined>;
+    readonly policy: (configPath: string) => Promise<OperatorPolicy | OperatorCommandOutcome>;
+    readonly confirmPolicyWeakening: (request: Readonly<{
+        weakened: readonly PolicyWeakening[];
+        digest: string;
+    }>) => Promise<string | undefined>;
+}
+/** The production policy adapter: cockpit.toml's policy now, the recorded one, and how to record the current one. */
+export declare function loadOperatorPolicy(configPath: string): Promise<OperatorPolicy | OperatorCommandOutcome>;
+export declare function runResetOperatorApplication(input: ResetCommandInput, admission: OperatorAdmission, adapters: ResetOperatorApplicationAdapters): Promise<OperatorCommandOutcome>;
+export declare function runSyncOperatorApplication(input: GeneratedEnvironmentCommandInput & Readonly<{
+    dryRun?: boolean;
+}>, admission: OperatorAdmission, adapters: SyncOperatorApplicationAdapters): Promise<OperatorCommandOutcome>;

package/dist/environment/operator-application.js

@@ -0,0 +1,155 @@
+import { decide, policyWeakening, policyWeakeningDiagnostic, weakeningDigest, writeRecordedPolicy } from '../autonomy.js';
+import { loadAutonomyPolicy } from '../config/load.js';
+import { ENVIRONMENT_CODES } from './contract.js';
+import { EXIT_CODES } from '../invocation.js';
+import { refusalOutcome as refusal } from '../refusal.js';
+const isPolicy = (value) => 'current' in value;
+/** The production policy adapter: cockpit.toml's policy now, the recorded one, and how to record the current one. */
+export async function loadOperatorPolicy(configPath) {
+    const loaded = await loadAutonomyPolicy(configPath);
+    if ('refusal' in loaded)
+        return { status: 2, result: null, diagnostics: [loaded.refusal] };
+    return { current: loaded.current, ...loaded.recorded ? { recorded: loaded.recorded } : {}, record: () => writeRecordedPolicy(loaded.root, loaded.current) };
+}
+/** Why `decider` does not let this run pass the decision, as the refusal a command returns, or undefined when it does. */
+function autonomyRefusal(field, decider, admission) {
+    const decision = decide(decider, { CI: admission.ci });
+    if (decision === 'proceed')
+        return undefined;
+    // Each code is a literal so the diagnostic inventory reads its fix beside it.
+    return decision === 'person'
+        ? { status: 2, result: null, diagnostics: [{ severity: 'error', target: field,
+                    code: 'AUTONOMY_PERSON_REQUIRED',
+                    message: `[autonomy] ${field} = "person" in cockpit.toml: this run cannot take the decision without a person`,
+                    fix: 'a person runs the same command with --interactive in a terminal outside CI, or a person changes the field in cockpit.toml and accepts the change at sync' }] }
+        : { status: 2, result: null, diagnostics: [{ severity: 'error', target: field,
+                    code: 'AUTONOMY_CI_ONLY',
+                    message: `[autonomy] ${field} = "ci" in cockpit.toml: this decision is taken only in CI, behind the reviewers of its protected environment`,
+                    fix: 'push the change and let the CI job run the command, or have a person change the field in cockpit.toml and accept the change at sync' }] };
+}
+// A weakening the last sync did not accept is not in force: the command it would let through
+// refuses, as sync does, until a person accepts it there or the change is reverted.
+function weakeningRefusal(weakened, unchanged, result = null) {
+    const diagnostic = policyWeakeningDiagnostic(weakened);
+    return { status: 2, result, diagnostics: [{ ...diagnostic, message: `${diagnostic.message}; ${unchanged}` }] };
+}
+export async function runResetOperatorApplication(input, admission, adapters) {
+    if (!admission.interactive && admission.apply) {
+        const policy = await adapters.policy(input.configPath);
+        if (!isPolicy(policy))
+            return policy;
+        const weakened = policy.recorded ? policyWeakening(policy.recorded, policy.current).filter(row => row.field === 'autonomy.reset') : [];
+        if (weakened.length)
+            return weakeningRefusal(weakened, 'nothing was reset');
+        const refused = autonomyRefusal('reset', policy.current.autonomy.reset, admission);
+        if (refused)
+            return refused;
+        const opened = await adapters.begin(input);
+        return 'decide' in opened ? opened.decide('approve') : opened;
+    }
+    if (!admission.interactive)
+        return adapters.preview(input);
+    if (admission.json || admission.ci && admission.ci.length > 0) {
+        return refusal(ENVIRONMENT_CODES.RESET_CONFIRMATION_MISMATCH, 'interactive reset requires a human terminal outside CI and JSON modes', 'reset');
+    }
+    if (!admission.terminal) {
+        return refusal(ENVIRONMENT_CODES.RESET_CONFIRMATION_MISMATCH, 'interactive reset requires terminal input', 'reset');
+    }
+    const opened = await adapters.begin(input);
+    if (!('decide' in opened))
+        return opened;
+    const approved = await adapters.confirm(opened.preview);
+    if (approved)
+        return opened.decide('approve');
+    await opened.decide('decline');
+    return { status: EXIT_CODES.cancelled, diagnostics: [], result: null };
+}
+function staleRemovalRefusal(message) {
+    return refusal('GENERATED_STALE_APPROVAL_REQUIRED', message, 'generated-environment');
+}
+function previewedStaleRemoval(outcome) {
+    if (outcome.status !== 0 || !outcome.result || typeof outcome.result !== 'object')
+        return { state: 'invalid' };
+    const result = outcome.result;
+    if (result.dryRun !== true)
+        return { state: 'invalid' };
+    if (!Object.hasOwn(result, 'staleRemoval'))
+        return { state: 'none' };
+    const candidate = result.staleRemoval;
+    if (!candidate || typeof candidate !== 'object')
+        return { state: 'invalid' };
+    const request = candidate;
+    if (request.format !== 'cockpit-stale-removal-request/v1'
+        || typeof request.cockpitId !== 'string' || request.cockpitId.length === 0
+        || typeof request.generation !== 'string' || request.generation.length === 0
+        || typeof request.sourceSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(request.sourceSha256)
+        || typeof request.digest !== 'string' || !/^[a-f0-9]{64}$/.test(request.digest)
+        || !Array.isArray(request.entries) || request.entries.length === 0)
+        return { state: 'invalid' };
+    return { state: 'stale', request: candidate };
+}
+// The one place sync's decision lives: who may write, whether a weakened policy was accepted, and
+// whether stale generated files go without a person. A dry run writes nothing and passes untouched.
+export async function runSyncOperatorApplication(input, admission, adapters) {
+    if (input.dryRun === true)
+        return adapters.synchronize(input);
+    if (admission.interactive && (admission.json || admission.ci && admission.ci.length > 0)) {
+        return staleRemovalRefusal('interactive sync requires a human terminal outside CI and JSON modes');
+    }
+    if (admission.interactive && !admission.terminal)
+        return staleRemovalRefusal('interactive sync requires terminal input');
+    const policy = await adapters.policy(input.configPath);
+    if (!isPolicy(policy))
+        return policy;
+    // A person's sync is the person's decision; only a sync gated on ci is refused outside CI here, and
+    // the guard keeps an agent's sync from running unless [autonomy] sync is agent.
+    if (policy.current.autonomy.sync === 'ci') {
+        const refused = autonomyRefusal('sync', 'ci', admission);
+        if (refused)
+            return refused;
+    }
+    const weakened = policy.recorded ? policyWeakening(policy.recorded, policy.current) : [];
+    if (weakened.length) {
+        const digest = weakeningDigest(policy.recorded, policy.current);
+        if (!admission.interactive)
+            return weakeningRefusal(weakened, 'nothing was written', { weakened, digest });
+        if (await adapters.confirmPolicyWeakening({ weakened, digest }) !== digest) {
+            return refusal('POLICY_WEAKENING_UNCONFIRMED', 'the typed digest did not match the policy weakening shown; nothing was written', 'autonomy');
+        }
+    }
+    // Stale removal an agent may take is approved for exactly the entries this sync computes.
+    const staleByPolicy = decide(policy.current.autonomy.stale_delete, { CI: admission.ci }) === 'proceed';
+    const approveAll = async (request) => ({ format: 'cockpit-stale-removal-approval/v1', digest: request.digest });
+    let outcome;
+    if (!admission.interactive || staleByPolicy) {
+        outcome = await adapters.synchronize({ ...input, ...staleByPolicy ? { authorizeStaleRemoval: approveAll } : {} });
+    }
+    else {
+        const preview = await adapters.synchronize({ ...input, dryRun: true });
+        if (preview.status !== 0)
+            return preview;
+        const inspected = previewedStaleRemoval(preview);
+        if (inspected.state === 'invalid') {
+            return refusal('CLI_INTERNAL_ERROR', 'interactive sync received an invalid dry-run result', 'sync');
+        }
+        if (inspected.state === 'none')
+            outcome = await adapters.synchronize(input);
+        else {
+            const typedDigest = await adapters.confirmStaleRemoval(inspected.request);
+            if (typedDigest !== inspected.request.digest) {
+                return staleRemovalRefusal('the typed stale-removal digest did not match the exact preview');
+            }
+            const previewBytes = JSON.stringify(inspected.request);
+            outcome = await adapters.synchronize({
+                ...input,
+                authorizeStaleRemoval: async (request) => request.digest === inspected.request.digest
+                    && JSON.stringify(request) === previewBytes
+                    ? { format: 'cockpit-stale-removal-approval/v1', digest: request.digest }
+                    : undefined,
+            });
+        }
+    }
+    if (outcome.status === 0)
+        await policy.record();
+    return outcome;
+}