@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/work-orders/application.js

@@ -2,66 +2,20 @@
 // derived from the record and the current file, and partial and abandoned as closures. Each command
 // that passes a gate asks the autonomy policy who may pass it; a person gate returns a continuation
 // the CLI completes only with the digest a person types in a terminal. It also routes the browser and
-// test-gate operations that share the work composition.
-import { createHash } from 'node:crypto';
-import { posix } from 'node:path';
-import { z } from 'zod';
-import { decide, policyWeakening, runningInCi } from '../autonomy.js';
+// test-gate operations that share the work composition. Decisions, grading and closure are owned by the
+// application-* modules beside it, on the shared steps application-context.ts binds.
 import { executeBrowserCommand } from '../browser/commands.js';
 import { evaluateUiGate } from '../browser/ui-gate.js';
+import { policyWeakening } from '../autonomy.js';
 import { errorCause, RefusalError } from '../environment/contract.js';
-import { runGate } from '../testing/gates.js';
-import { criteriaWeakening, scopeMatches, WORK_ORDER_ID, workOrderDigest } from './contract.js';
+import { describeWeakening, testWeakeningDigest } from '../testing/weakening.js';
+import { checksBindsField, contractAmendment, workOrderDigest } from './contract.js';
 import { isWorkApplicationComposition } from './composition.js';
-const id = z.string().regex(WORK_ORDER_ID);
-const note = z.string().trim().min(1).max(4_096).regex(/^[^\x00-\x08\x0b-\x1f\x7f]*$/);
-const relativeFile = z.string().max(4_096).regex(/^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._@+\-/]+$/);
-const Request = z.discriminatedUnion('operation', [
-    z.object({ operation: z.literal('work-status'), workOrderId: id.optional() }).strict(),
-    z.object({ operation: z.literal('work-accept'), workOrderId: id }).strict(),
-    z.object({ operation: z.literal('work-check'), workOrderId: id }).strict(),
-    z.object({ operation: z.literal('work-note'), workOrderId: id, text: note, question: z.boolean() }).strict(),
-    z.object({ operation: z.literal('work-answer'), workOrderId: id, question: z.number().int().min(1), text: note }).strict(),
-    z.object({ operation: z.literal('work-grade'), workOrderId: id, verdict: z.enum(['met', 'unmet']).optional(), note: note.optional() }).strict(),
-    z.object({ operation: z.literal('work-signoff'), workOrderId: id, close: z.enum(['done', 'partial', 'abandoned']), note: note.optional() }).strict(),
-    z.object({ operation: z.literal('work-recover'), workOrderId: id, apply: z.boolean() }).strict(),
-    z.object({ operation: z.literal('work-verify') }).strict(),
-    z.object({ operation: z.literal('grade-criteria'), criteriaFile: relativeFile }).strict(),
-    z.object({ operation: z.enum(['browser-drive', 'browser-screenshot']), role: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,63}$/).optional() }).strict(),
-    z.object({ operation: z.literal('test-run'), gate: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/), mode: z.enum(['canonical', 'full', 'staged']),
-        select: z.object({ kind: z.enum(['spec', 'file', 'test', 'route']), value: z.string().min(1).refine(value => Buffer.byteLength(value) <= 4_096 && !/[\x00-\x1f\x7f]/.test(value)) }).strict().optional() }).strict(),
-]);
-export function captureWorkApplicationRequest(value) {
-    const parsed = Request.safeParse(value);
-    return parsed.success ? parsed.data : undefined;
-}
-const refusal = (operation, reason) => ({ kind: 'refusal', operation, reason });
-const complete = (operation, value) => ({ kind: 'complete', operation, value });
-const unsatisfied = (operation, value, reason) => ({ kind: 'unsatisfied', operation, value, reason });
-const now = () => new Date().toISOString();
-// Agent-written text is shown to a person with its control and bidirectional-override characters
-// replaced, so it can neither drive their terminal nor read in an order other than the one recorded.
-const shown = (value) => value.replace(/[\x00-\x09\x0b-\x1f\x7f-\x9f‪-‮⁦-⁩]/g, '�');
-const TERMINAL = new Set(['done', 'partial', 'abandoned']);
-const CLOSURE = Object.freeze({ independent: 'graded', checks: 'checks-passed', self: 'self-reported' });
-function displayState(row, attemptCap) {
-    if (!row.record)
-        return row.order ? 'draft' : 'invalid';
-    if (TERMINAL.has(row.record.state))
-        return row.record.state;
-    if (!row.order || row.digest !== row.record.accepted.digest)
-        return 'stale';
-    if (openQuestions(row.record).length || row.record.attempts >= attemptCap)
-        return 'blocked';
-    return row.record.state;
-}
-function openQuestions(record) {
-    return record.notes.flatMap((row, index) => row.kind === 'question' && !record.notes.some(answer => answer.answers === index + 1) ? [index + 1] : []);
-}
-const pendingCi = (record) => [
-    ...record.accepted.by === 'ci' ? ['accept'] : [], ...record.amendments.filter(row => row.by === 'ci').map(() => 'amend'),
-    ...record.notes.filter(row => row.kind === 'answer' && row.by === 'ci').map(() => 'answer'), ...record.closure?.by === 'ci' ? ['signoff'] : [],
-];
+import { captureWorkApplicationRequest, complete, displayState, now, openQuestions, refusal, TERMINAL, unsatisfied, workContext } from './application-context.js';
+import { pendingCi, signoff, verify } from './application-closure.js';
+import { decideOrder, DECISIONS_UNDECLARED, relatedDecisions, unresolvedDecisions } from './application-decisions.js';
+import { gradeCriteriaFile, gradeOrder, testRun } from './application-grading.js';
+export { captureWorkApplicationRequest } from './application-context.js';
 export async function runWorkApplication(request, composition) {
     const captured = captureWorkApplicationRequest(request);
     if (!captured)
@@ -72,21 +26,10 @@ export async function runWorkApplication(request, composition) {
     try {
         if (captured.operation === 'browser-drive' || captured.operation === 'browser-screenshot') {
             const kind = captured.operation === 'browser-screenshot' ? 'screenshot' : 'drive';
-            const result = await executeBrowserCommand(await composition.browser(kind, captured.role));
-            if (result.kind === 'refusal')
-                return refusal(operation, result.reason);
-            if (result.kind === 'complete') {
-                const gate = evaluateUiGate({ activating: kind, receipts: [result.receipt] });
-                if (gate.kind === 'refusal')
-                    return refusal(operation, gate.reason);
-            }
-            return complete(operation, result);
-        }
-        if (captured.operation === 'test-run') {
-            const prepared = await composition.gate(captured);
-            const run = await runGate(prepared.registry, prepared.request, prepared.dependencies);
-            return run.satisfiesGate ? complete(operation, run) : unsatisfied(operation, run, `${run.verdict}: ${run.reasons.join('; ') || 'declared gate was not satisfied'}`);
+            return browserOutcome(captured.operation, await executeBrowserCommand(await composition.browser(kind, captured.role, captured.route)), captured.failOnFindings === true);
         }
+        if (captured.operation === 'test-run')
+            return await testRun(captured, composition);
         // A policy weakened in cockpit.toml since the last sync is not in force until a person accepts it there.
         const recorded = await composition.recordedPolicy();
         const weakened = recorded ? policyWeakening(recorded, composition.policy) : [];
@@ -100,87 +43,48 @@ export async function runWorkApplication(request, composition) {
         return refusal(operation, errorCause(error));
     }
 }
+// Findings are evidence for the agent and the grader to weigh, so they fail the command only for a criterion that demands a clean route.
+export function browserOutcome(operation, result, failOnFindings) {
+    if (result.kind === 'refusal')
+        return refusal(operation, result.reason);
+    const gate = evaluateUiGate({ activating: operation === 'browser-screenshot' ? 'screenshot' : 'drive', receipts: [result.receipt] });
+    if (gate.kind === 'refusal')
+        return refusal(operation, gate.reason);
+    if (failOnFindings && result.receipt.verdict === 'findings')
+        return unsatisfied(operation, result, browserFindingsReason(result.receipt));
+    return complete(operation, result);
+}
+function browserFindingsReason(receipt) {
+    return receipt.surfaces.flatMap(row => {
+        const found = row.diagnostics;
+        if (!found || row.verdict !== 'findings')
+            return [];
+        const parts = [[found.consoleErrors, 'console error'], [found.pageErrors, 'uncaught page error'], [found.failedRequests, 'failed request']]
+            .flatMap(([count, noun]) => count ? [`${count} ${noun}${count === 1 ? '' : 's'}`] : []);
+        return [`${row.name}: ${parts.join(', ')}`];
+    }).join('; ');
+}
 async function work(request, composition) {
-    const { policy, store } = composition;
-    const operation = request.operation;
-    const observe = async (orderId) => {
-        const [parsed, record] = await Promise.all([composition.readOrder(orderId), store.read(orderId)]);
-        if (!parsed.ok)
-            return { id: orderId, problems: parsed.problems, ...(record ? { record } : {}) };
-        // A source that cannot be read leaves this order without a digest, and so stale, not the whole listing refused.
-        let sources;
-        try {
-            sources = await composition.sourceDigests(parsed.value);
-        }
-        catch (error) {
-            if (!(error instanceof RefusalError))
-                throw error;
-            return { id: orderId, order: parsed.value, problems: [`a cited source cannot be read: ${error.message}`], ...(record ? { record } : {}) };
-        }
-        const base = record?.accepted.base ?? await composition.heads();
-        return { id: orderId, order: parsed.value, problems: [], ...(record ? { record } : {}), digest: workOrderDigest(parsed.value, sources, base) };
-    };
-    const wip = async () => (await store.list()).filter(record => !TERMINAL.has(record.state)).length;
-    // Who passed a gate: the agent; a person, after typing the digest of exactly what they were shown;
-    // or CI, which locally records the step as awaiting the `work verify` job and passes it there.
-    const gated = async (gate, decider, lines, verb, apply) => {
-        const decision = decide(decider, composition.env);
-        if (decision === 'proceed')
-            return apply(decider === 'ci' ? 'ci' : 'agent');
-        if (decision === 'ci-only')
-            return apply('ci');
-        const digest = createHash('sha256').update(JSON.stringify({ gate, lines })).digest('hex');
-        let used = false;
-        return { kind: 'human-needed', operation, continuation: { digest,
-                prompt: [...lines.map(shown), `[work.gates] ${gate} = person. To ${verb} exactly this, type ${verb} ${digest}`].join('\n'),
-                decide: async (answer) => {
-                    if (used)
-                        return refusal(operation, `this prompt was already answered; rerun work ${operation.slice('work-'.length)}`);
-                    used = true;
-                    return answer.trim() === `${verb} ${digest}` ? apply('person') : refusal(operation, `Nothing was recorded: the person did not type ${verb} ${digest}`);
-                } } };
-    };
-    const current = async (orderId) => {
-        const row = await observe(orderId);
-        if (!row.record)
-            throw new RefusalError(`${orderId} is not accepted yet; run npx --no cockpit work accept --config <your cockpit.toml> --work-order ${orderId}`);
-        const state = displayState(row, composition.caps.attempts);
-        if (TERMINAL.has(row.record.state))
-            throw new RefusalError(`${orderId} is closed (${row.record.state})`);
-        if (state === 'stale')
-            throw new RefusalError(`${orderId} changed since it was accepted${row.problems.length ? ` and does not parse: ${row.problems.join('; ')}` : ''}; `
-                + `run npx --no cockpit work accept --config <your cockpit.toml> --work-order ${orderId} to accept the change`);
-        if (state === 'blocked')
-            throw new RefusalError(openQuestions(row.record).length
-                ? `${orderId} has open question ${openQuestions(row.record).join(', ')}; it is answered with work answer`
-                : `${orderId} reached the attempt cap (${composition.caps.attempts}); record the root cause with work note, then a person closes it with work signoff --partial or --abandon, or amends the contract`);
-        return { row, record: row.record, order: row.order };
-    };
-    const runChecks = async (order) => {
-        const results = [];
-        // Checks share the product's state, so they run in the order the contract lists them.
-        for (const criterion of order.criteria)
-            if (criterion.check)
-                results.push(await composition.runCheck(criterion.id, criterion.check));
-        for (const gate of order.gates)
-            results.push(await composition.runCheck(`gate:${gate}`, { gate }));
-        return results;
-    };
+    const context = workContext(composition, request.operation);
+    const { operation, policy, store, observe, wip, gated, current, runChecks } = context;
     if (request.operation === 'work-status') {
         const ids = request.workOrderId ? [request.workOrderId] : [...new Set([...await composition.orderIds(), ...(await store.list()).map(row => row.id)])].sort();
         const rows = await Promise.all(ids.map(observe));
         const closed = new Set(rows.filter(row => row.record?.state === 'done').map(row => row.id));
         return complete(operation, {
             grading: policy.grading, gates: policy.gates, wip: { open: await wip(), cap: composition.caps.wip },
-            orders: rows.map(row => ({
+            orders: await Promise.all(rows.map(async (row) => ({
                 id: row.id, state: displayState(row, composition.caps.attempts),
                 ...row.record?.closure ? { closedAs: row.record.closure.how, closedBy: row.record.closure.by } : {},
                 ...row.record ? { attempts: row.record.attempts, acceptedBy: row.record.accepted.by, openQuestions: openQuestions(row.record),
+                    acknowledgements: row.record.acknowledgements.map(({ by, note, findings }) => ({ by, note, findings })),
                     awaitingCi: pendingCi(row.record), ...row.record.grade ? { grade: { mode: row.record.grade.mode, passed: row.record.grade.passed,
                             criteria: row.record.grade.criteria, outOfScope: row.record.grade.outOfScope, ...row.record.grade.evaluator ? { evaluator: row.record.grade.evaluator } : {} } } : {} } : {},
                 ...row.order ? { waitingOn: row.order.depends_on.filter(dependency => !closed.has(dependency)) } : {},
+                ...row.record && !TERMINAL.has(row.record.state) ? { openDecisions: await unresolvedDecisions(row.record, composition) } : {},
+                ...row.order && !TERMINAL.has(row.record?.state ?? 'accepted') ? await relatedDecisions(context, row.order) : {},
                 ...row.problems.length ? { problems: row.problems } : {},
-            })),
+            }))),
         });
     }
     if (request.operation === 'work-accept') {
@@ -200,8 +104,8 @@ async function work(request, composition) {
                 if (existing)
                     throw new RefusalError(`${order.id} was accepted while this prompt was open; rerun work status`);
                 const record = { format: 'cockpit-work-order/v1', id: order.id, state: 'accepted',
-                    accepted: { at: now(), by, digest, order, sources, base }, amendments: [], attempts: 0, notes: [] };
-                return { record, value: complete(operation, { id: order.id, state: 'accepted', by, digest, ...by === 'ci' ? { awaitingCi: ['accept'] } : {} }) };
+                    accepted: { at: now(), by, digest, order, sources, base }, amendments: [], acknowledgements: [], attempts: 0, notes: [] };
+                return { record, value: complete(operation, { id: order.id, state: 'accepted', by, digest, ...by === 'ci' ? { awaitingCi: ['accept'] } : {}, ...await relatedDecisions(context, order) }) };
             }));
         }
         const record = row.record;
@@ -209,19 +113,27 @@ async function work(request, composition) {
             return refusal(operation, `${order.id} is closed (${record.state}); write a new order for further work`);
         if (row.digest === record.accepted.digest)
             return refusal(operation, `${order.id} is already accepted and unchanged since`);
-        const weakened = criteriaWeakening(record.accepted.order, order);
-        // Removing or rewriting an accepted criterion moves the bar the work is held to, which an agent never certifies.
-        const decider = weakened.length && policy.gates.amend === 'agent' ? 'person' : policy.gates.amend;
+        const { removed: weakened, review } = contractAmendment(record.accepted.order, order);
+        // Removing a criterion or gate lowers the bar in every reading, so an agent never certifies it. A rewrite may
+        // only clarify: where a model grades, the next grade judges it; under checks nothing could, so a person does.
+        // So does the amendment after a grade that found the agent's earlier ones lowered the bar.
+        const unjudgeable = policy.grading === 'checks' ? review.filter(row => checksBindsField(row.field)) : [];
+        const failedReview = record.amendmentsFailedReview;
+        const decider = policy.gates.amend === 'agent' && (weakened.length || unjudgeable.length || failedReview) ? 'person' : policy.gates.amend;
         const sources = await composition.sourceDigests(order);
         const digest = workOrderDigest(order, sources, record.accepted.base);
         return gated('amend', decider, [`Amend ${order.id} (digest ${record.accepted.digest} -> ${digest})`,
-            ...weakened.length ? [`This weakens the accepted contract: ${weakened.join('; ')}`] : [], ...shownOrder], 'amend', async (by) => store.update(order.id, async (existing) => {
+            ...weakened.length ? [`This weakens the accepted contract: ${weakened.join('; ')}`] : [],
+            ...failedReview ? [`A grade found the agent's earlier amendments lower the bar: ${failedReview.note}`] : [],
+            ...review.map(row => `Changed ${row.field}: "${row.before}" -> "${row.after}"`), ...shownOrder], 'amend', async (by) => store.update(order.id, async (existing) => {
             if (!existing || existing.accepted.digest !== record.accepted.digest)
                 throw new RefusalError(`${order.id} changed while this prompt was open; rerun work accept`);
             const next = { ...existing, state: 'accepted', attempts: 0, checks: undefined, grade: undefined,
+                ...by === 'agent' ? {} : { amendmentsFailedReview: undefined },
                 accepted: { at: now(), by, digest, order, sources, base: existing.accepted.base },
-                amendments: [...existing.amendments, { at: now(), by, from: existing.accepted.digest, to: digest, weakened: [...weakened] }] };
-            return { record: next, value: complete(operation, { id: order.id, state: 'accepted', by, digest, amended: true, weakened }) };
+                amendments: [...existing.amendments, { at: now(), by, from: existing.accepted.digest, to: digest, weakened: [...weakened], review: [...review] }] };
+            return { record: next, value: complete(operation, { id: order.id, state: 'accepted', by, digest, amended: true, weakened,
+                    ...by === 'agent' && review.length && policy.grading !== 'checks' ? { judgedAtGrade: review.map(row => row.field) } : {}, ...await relatedDecisions(context, order) }) };
         }));
     }
     if (request.operation === 'work-check') {
@@ -240,6 +152,8 @@ async function work(request, composition) {
         return passed ? complete(operation, value) : unsatisfied(operation, value, `${results.filter(row => !row.passed).map(row => `${row.criterion}: ${row.outcome}`).join('; ')}`);
     }
     if (request.operation === 'work-note') {
+        if (request.kind === 'decision' && !composition.docs?.decisions)
+            return refusal(operation, DECISIONS_UNDECLARED);
         await current(request.workOrderId).catch(async (error) => {
             // A note on a stale or blocked order is how its cause gets recorded, so only a closed or unaccepted one refuses.
             const record = await store.read(request.workOrderId);
@@ -249,10 +163,13 @@ async function work(request, composition) {
         const index = await store.update(request.workOrderId, async (existing) => {
             if (!existing)
                 throw new RefusalError(`${request.workOrderId} is not accepted`);
-            return { record: { ...existing, notes: [...existing.notes, { at: now(), by: 'agent', kind: request.question ? 'question' : 'note', text: request.text }] }, value: existing.notes.length + 1 };
+            return { record: { ...existing, notes: [...existing.notes, { at: now(), by: 'agent', kind: request.kind, text: request.text }] }, value: existing.notes.length + 1 };
         });
-        return complete(operation, { id: request.workOrderId, note: index, ...request.question ? { question: index, state: 'blocked' } : {} });
+        return complete(operation, { id: request.workOrderId, note: index, ...request.kind === 'question' ? { question: index, state: 'blocked' } : {},
+            ...request.kind === 'decision' ? { decision: index, resolveWith: `npx --no cockpit work decide --config <your cockpit.toml> --work-order ${request.workOrderId} --decision ${index} --record` } : {} });
     }
+    if (request.operation === 'work-decide')
+        return decideOrder(request, context);
     if (request.operation === 'work-answer') {
         const record = await store.read(request.workOrderId);
         if (!record || TERMINAL.has(record.state))
@@ -267,117 +184,40 @@ async function work(request, composition) {
                 value: complete(operation, { id: request.workOrderId, answered: request.question, by }) };
         }));
     }
-    if (request.operation === 'work-grade') {
+    if (request.operation === 'work-grade')
+        return gradeOrder(request, context);
+    if (request.operation === 'work-acknowledge') {
         const { order, record } = await current(request.workOrderId);
-        if (policy.grading === 'self' ? !request.verdict || !request.note : request.verdict !== undefined || request.note !== undefined) {
-            return refusal(operation, policy.grading === 'self' ? '[work] grading = "self": pass --verdict met|unmet and --note <what you checked>'
-                : `--verdict and --note apply only under [work] grading = "self"; this cockpit grades with ${policy.grading}`);
-        }
-        let verdicts;
-        let evaluator;
-        const unchecked = order.criteria.filter(criterion => !criterion.check).map(criterion => criterion.id);
-        if (policy.grading === 'checks' && unchecked.length)
-            return refusal(operation, `[work] grading = "checks" closes an order only when cockpit ran a check for every criterion; ${unchecked.join(', ')} declare none`);
-        // Checks and scope bind in every mode, so an agent's own `met` covers neither a failed check nor a
-        // change outside scope. Changes are read after the checks, so files a check writes count too.
-        const checks = await runChecks(order);
-        const changes = await composition.changes(record.accepted.base);
-        const outOfScope = changes.map(change => change.path).filter(path => !scopeMatches(order.scope, path));
-        if (policy.grading === 'self') {
-            verdicts = order.criteria.map(criterion => ({ id: criterion.id, verdict: request.verdict, note: request.note }));
-        }
-        else if (policy.grading === 'checks') {
-            verdicts = order.criteria.map(criterion => {
-                const result = checks.find(row => row.criterion === criterion.id);
-                return { id: criterion.id, verdict: result.passed ? 'met' : 'unmet', note: `cockpit ran the check: ${result.outcome}` };
-            });
-        }
-        else {
-            const graded = await composition.evaluate({ objective: order.objective, criteria: order.criteria, nonGoals: order.non_goals, scope: order.scope, checks, changes, outOfScope });
-            if ('refusal' in graded)
-                return refusal(operation, `${graded.refusal.code}: ${graded.refusal.message}; ${graded.refusal.fix}`);
-            verdicts = graded.criteria;
-            evaluator = { tool: graded.evaluator.tool, fallbacks: graded.evaluator.fallbacks.map(row => ({ ...row })) };
-        }
-        const passed = verdicts.every(row => row.verdict === 'met') && checks.every(row => row.passed) && outOfScope.length === 0;
-        const grade = { at: now(), digest: record.accepted.digest, mode: policy.grading, passed,
-            criteria: [...verdicts], outOfScope: [...outOfScope], ...evaluator ? { evaluator } : {}, ...request.note ? { note: request.note } : {} };
-        await store.update(order.id, async (existing) => {
+        const weak = await composition.testWeakening(record.accepted.base);
+        if (!weak.findings.length)
+            return refusal(operation, `${order.id} weakens no tests since its base, so there is nothing to acknowledge`);
+        const digest = testWeakeningDigest(weak.findings);
+        if (record.acknowledgements.some(row => row.digest === digest))
+            return refusal(operation, `this weakening of ${order.id} is already acknowledged; run work grade`);
+        const rows = weak.findings.map(describeWeakening);
+        return gated('acknowledge', policy.gates.acknowledge, [`Acknowledge that ${order.id} weakens tests since its base (test files from ${weak.patterns.source}):`,
+            ...rows.map(row => `  ${row}`), 'Reason given:', `  ${request.note}`], 'acknowledge', async (by) => store.update(order.id, async (existing) => {
             if (!existing || existing.accepted.digest !== record.accepted.digest)
-                throw new RefusalError(`${order.id} changed while it was graded; rerun work grade`);
-            return { record: { ...existing, state: passed ? 'graded' : 'accepted', attempts: existing.attempts + (passed ? 0 : 1), grade,
-                    ...checks.length ? { checks: { at: now(), digest: record.accepted.digest, results: [...checks] } } : {} }, value: undefined };
-        });
-        const value = { id: order.id, state: passed ? 'graded' : 'accepted', mode: policy.grading, criteria: verdicts, checks, outOfScope, ...evaluator ? { evaluator } : {} };
-        if (passed)
-            return complete(operation, value);
-        return unsatisfied(operation, value, [...verdicts.filter(row => row.verdict !== 'met').map(row => `${row.id} ${row.verdict}: ${row.note}`),
-            ...checks.filter(row => !row.passed).map(row => `check ${row.criterion}: ${row.outcome}`),
-            ...outOfScope.length ? [`changed outside scope: ${outOfScope.join(', ')}`] : []].join('; '));
-    }
-    if (request.operation === 'work-signoff') {
-        const record = await store.read(request.workOrderId);
-        if (!record)
-            return refusal(operation, `${request.workOrderId} is not accepted`);
-        if (TERMINAL.has(record.state))
-            return refusal(operation, `${request.workOrderId} is already closed (${record.state})`);
-        let how;
-        if (request.close === 'done') {
-            const { order } = await current(request.workOrderId);
-            if (record.state !== 'graded' || !record.grade?.passed || record.grade.digest !== record.accepted.digest) {
-                return refusal(operation, `${order.id} is ${record.state}, not graded; run npx --no cockpit work grade --config <your cockpit.toml> --work-order ${order.id}`);
+                throw new RefusalError(`${order.id} changed while this prompt was open; rerun work acknowledge`);
+            if (testWeakeningDigest((await composition.testWeakening(existing.accepted.base)).findings) !== digest) {
+                throw new RefusalError(`the test changes of ${order.id} changed while this prompt was open; rerun work acknowledge`);
             }
-            const open = await Promise.all(order.depends_on.map(async (dependency) => (await store.read(dependency))?.state === 'done' ? undefined : dependency));
-            if (open.some(Boolean))
-                return refusal(operation, `${order.id} depends on ${open.filter(Boolean).join(', ')}, which ${open.filter(Boolean).length === 1 ? 'is' : 'are'} not done`);
-            how = CLOSURE[record.grade.mode];
-        }
-        else {
-            if (!request.note)
-                return refusal(operation, `closing ${request.workOrderId} as ${request.close} needs --note saying what was and was not done`);
-            how = request.close;
-        }
-        return gated('signoff', policy.gates.signoff, [`Close ${request.workOrderId} as ${request.close} (${how})`, ...request.note ? [`Note: ${request.note}`] : [],
-            ...record.grade ? record.grade.criteria.map(row => `${row.id}: ${row.verdict} — ${row.note}`) : []], 'signoff', async (by) => store.update(request.workOrderId, async (existing) => {
-            if (!existing || existing.state !== record.state || existing.accepted.digest !== record.accepted.digest)
-                throw new RefusalError(`${request.workOrderId} changed while this prompt was open`);
-            const state = request.close;
-            return { record: { ...existing, state, closure: { at: now(), by, how, ...request.note ? { note: request.note } : {} } },
-                value: complete(operation, { id: request.workOrderId, state, closedAs: how, by }) };
+            return { record: { ...existing, acknowledgements: [...existing.acknowledgements, { at: now(), by, digest, findings: rows, note: request.note }] },
+                value: complete(operation, { id: order.id, acknowledged: rows, by, digest }) };
         }));
     }
-    if (request.operation === 'work-recover')
-        return complete(operation, await store.recover(request.workOrderId, request.apply));
-    if (request.operation === 'work-verify') {
-        const problems = [];
-        const awaiting = [];
-        for (const record of await store.list()) {
-            const row = await observe(record.id);
-            if (!TERMINAL.has(record.state) && row.digest !== record.accepted.digest)
-                problems.push(`${record.id} changed since it was accepted; accept the change or revert it`);
-            if (record.state === 'done' && (!record.grade?.passed || record.grade.digest !== record.accepted.digest || !record.closure))
-                problems.push(`${record.id} is done without a passing grade of its accepted contract`);
-            awaiting.push(...pendingCi(record).map(step => `${record.id} ${step}`));
-        }
-        const ci = runningInCi(composition.env);
-        const value = { ci, problems, ...ci ? { confirmed: awaiting } : { awaitingCi: awaiting } };
-        return problems.length ? unsatisfied(operation, value, problems.join('; ')) : complete(operation, value);
+    if (request.operation === 'work-signoff')
+        return signoff(request, context);
+    if (request.operation === 'work-recover') {
+        // A pid probe sees only this machine's processes, so the command looks where it cannot first: the
+        // lock's host and the containers cockpit labels. Applied, it removes nothing it has not shown gone.
+        const recovered = await store.recover(request.workOrderId, request.apply, composition.containers);
+        if (!request.apply || recovered.lock === 'none' || recovered.lock === 'removed')
+            return complete(operation, recovered);
+        return refusal(operation, `the lock on ${request.workOrderId} was left in place: its holder ${recovered.lock === 'live' ? 'is still running' : 'cannot be shown gone'} `
+            + `(${recovered.checked?.join('; ')}); wait for it to finish, or stop it on the host that holds it, then rerun work recover --apply`);
     }
-    // grade-criteria: the quick path, an independent grade of uncommitted work with no order and no record.
-    const parsed = await composition.readCriteriaFile(request.criteriaFile);
-    if (!parsed.ok)
-        return refusal(operation, `${request.criteriaFile} is not a criteria file: ${parsed.problems.join('; ')}`);
-    const file = parsed.value;
-    const checks = await runChecks(file);
-    // The criteria file is the request, not part of the change it grades.
-    const changes = (await composition.changes(await composition.heads())).filter(change => change.path !== posix.normalize(request.criteriaFile));
-    const outOfScope = file.scope.length ? changes.map(change => change.path).filter(path => !scopeMatches(file.scope, path)) : [];
-    const subject = { ...file.objective ? { objective: file.objective } : {}, criteria: file.criteria, nonGoals: [], scope: file.scope, checks, changes, outOfScope };
-    const graded = await composition.evaluate(subject);
-    if ('refusal' in graded)
-        return refusal(operation, `${graded.refusal.code}: ${graded.refusal.message}; ${graded.refusal.fix}`);
-    const passed = graded.criteria.every(row => row.verdict === 'met') && checks.every(row => row.passed) && outOfScope.length === 0;
-    const value = { criteria: graded.criteria, checks, outOfScope, evaluator: graded.evaluator };
-    return passed ? complete(operation, value) : unsatisfied(operation, value, graded.criteria.filter(row => row.verdict !== 'met').map(row => `${row.id} ${row.verdict}: ${row.note}`)
-        .concat(checks.filter(row => !row.passed).map(row => `check ${row.criterion}: ${row.outcome}`), outOfScope.length ? [`changed outside scope: ${outOfScope.join(', ')}`] : []).join('; '));
+    if (request.operation === 'work-verify')
+        return verify(context);
+    return gradeCriteriaFile(request, context);
 }

package/dist/work-orders/composition.d.ts

@@ -1,52 +1,12 @@
 import { type EvaluatorTool } from '../schema.js';
-import type { ConsumedWorkEnvironmentConfig } from '../config/load.js';
 import { type EffectivePolicy } from '../autonomy.js';
-import { type EvaluatorChain } from '../grading/evaluate.js';
 import { type ChangedFile, type GradingSubject, type Verdict } from '../grading/grade.js';
-import { type BrowserCommandInput, type BrowserCommandKind, type BrowserRoutePolicy } from '../browser/commands.js';
-import { type BrowserRuntimeProjection } from '../browser/runtime.js';
-import { type BrowserProjectClient } from '../browser/surfaces.js';
-import type { EnvironmentSnapshot, RuntimeEvidence } from '../environment/evidence.js';
+import { type BrowserCommandInput, type BrowserCommandKind } from '../browser/commands.js';
+import { type RepositoryWeakening, type TestFilePatterns } from '../testing/weakening.js';
 import { type GateDependencies, type GateRegistry, type GateRequest } from '../testing/gates.js';
 import { parseCriteriaFile, type ParsedFile, type WorkOrder, type WorkOrderCheck } from './contract.js';
-import { type CheckResult, type WorkStore } from './store.js';
-export type WorkEnvironmentApplicationConfig = ConsumedWorkEnvironmentConfig;
-type BrowserAuthority = Readonly<{
-    runtime: BrowserRuntimeProjection;
-    client: BrowserProjectClient;
-    policy: BrowserRoutePolicy;
-    state?: BrowserCommandInput['state'];
-}>;
-type EvaluatorAuthority = Readonly<{
-    path?: string;
-    bytes: string;
-    sha256: string;
-    restriction: 'instructed';
-    executableDirectories?: readonly string[];
-    chain: EvaluatorChain;
-    environment?: Readonly<Record<string, string | undefined>>;
-}>;
-export interface WorkApplicationAuthorities {
-    readonly browser?: BrowserAuthority;
-    readonly resolveBrowser?: () => Promise<BrowserAuthority>;
-    readonly testing?: Readonly<{
-        registry: GateRegistry;
-        dependencies: GateDependencies;
-        runtime?: () => Promise<Readonly<{
-            stack: NonNullable<GateRequest['stack']>;
-            evidence?: Readonly<{
-                snapshot: EnvironmentSnapshot;
-                capture: () => Promise<RuntimeEvidence>;
-            }>;
-        }>>;
-    }>;
-    readonly evaluator?: EvaluatorAuthority;
-    readonly resolveEvaluator?: () => Promise<EvaluatorAuthority>;
-    readonly executableDirectories?: readonly string[];
-    readonly declaredEnvironment?: Readonly<Record<string, string>>;
-    readonly env: Readonly<Record<string, string | undefined>>;
-}
-export type GradingResult = Readonly<{
+import { type CheckResult, type ContainerEvidence, type WorkStore } from './store.js';
+type GradingResult = Readonly<{
     criteria: readonly Verdict[];
     evaluator: Readonly<{
         tool: string;
@@ -78,16 +38,43 @@ export interface WorkApplicationComposition {
     readonly sourceDigests: (order: Pick<WorkOrder, 'criteria'>) => Promise<Readonly<Record<string, string>>>;
     readonly heads: () => Promise<Readonly<Record<string, string>>>;
     readonly runCheck: (criterion: string, check: WorkOrderCheck) => Promise<CheckResult>;
-    readonly changes: (base: Readonly<Record<string, string>>) => Promise<readonly ChangedFile[]>;
     readonly evaluate: (subject: GradingSubject) => Promise<GradingResult>;
-    readonly browser: (kind: BrowserCommandKind, role?: string) => Promise<BrowserCommandInput>;
+    /** Test weakening in each checkout since `base`, over the files this cockpit treats as tests. */
+    readonly testWeakening: (base: Readonly<Record<string, string>>) => Promise<TestWeakeningObservation>;
+    /** What changed in each checkout since `base` (committed, staged, unstaged and untracked, each with its diff), and its test weakening, from one listing of untracked files. */
+    readonly review: (base: Readonly<Record<string, string>>) => Promise<Readonly<{
+        changes: readonly ChangedFile[];
+        weakening: TestWeakeningObservation;
+    }>>;
+    readonly browser: (kind: BrowserCommandKind, role?: string, route?: string) => Promise<BrowserCommandInput>;
+    /** The [docs] table as declared; absent when the cockpit declares none. */
+    readonly docs?: Readonly<{
+        decisions?: string;
+        decisionsIndex?: string;
+    }>;
+    /** Each Markdown file in [docs] decisions, by reference, with its text; empty when the directory does not exist yet. */
+    readonly decisionRecords: () => Promise<ReadonlyMap<string, string>>;
+    /** A decision record's or the index's text, or undefined when the file does not exist. */
+    readonly readDocsFile: (reference: string) => Promise<string | undefined>;
+    /** Writes each record, a new one exclusively and an existing one replaced, then appends `indexLine` to [docs] decisions_index. */
+    readonly writeDecisionRecords: (writes: readonly Readonly<{
+        reference: string;
+        text: string;
+        create: boolean;
+    }>[], indexLine?: string) => Promise<void>;
     readonly gate: (request: WorkApplicationGateRequest) => Promise<Readonly<{
         registry: GateRegistry;
         request: GateRequest;
         dependencies: GateDependencies;
     }>>;
+    /** The containers cockpit labels on this machine's local Docker daemon, where a lock's holder may run unseen by a pid probe. */
+    readonly containers: () => Promise<ContainerEvidence>;
 }
-export interface WorkApplicationGateRequest {
+type TestWeakeningObservation = Readonly<{
+    patterns: TestFilePatterns;
+    findings: readonly RepositoryWeakening[];
+}>;
+interface WorkApplicationGateRequest {
     readonly operation: 'test-run';
     readonly gate: string;
     readonly mode: 'canonical' | 'full' | 'staged';
@@ -96,18 +83,8 @@ export interface WorkApplicationGateRequest {
         value: string;
     }>;
 }
-export type VerificationObservation = Readonly<{
-    kind: 'executed';
-    exitCode: number;
-    stdout: string;
-    stderr: string;
-    truncated: boolean;
-}> | Readonly<{
-    kind: 'error' | 'unavailable';
-    reason: string;
-}>;
 export declare function isWorkApplicationComposition(value: unknown): value is WorkApplicationComposition;
-export type ConfiguredWorkApplicationCompositionResult = Readonly<{
+type ConfiguredWorkApplicationCompositionResult = Readonly<{
     kind: 'complete';
     composition: WorkApplicationComposition;
 }> | Readonly<{