@blxzer/pactile 0.6.0-beta.2 → 0.6.0-beta.4

package/dist/pactile/review/escalation-contract.d.ts

@@ -0,0 +1,115 @@
+import { resolvePiReviewEvidenceV1 } from "./evidence.js";
+import type { ReviewDecision } from "./contract.js";
+export interface PreparedPiReviewEscalationV1 {
+    schemaVersion: 1;
+    source: "pactile-pi-review-escalation-v1";
+    status: "prepared";
+    requestId: string;
+    target: "codex";
+    taskId: string;
+    reviewId: string;
+    piRunId: string;
+    escalationId: string;
+    runId: string;
+    candidateSnapshotId: string;
+    candidateFingerprint: string;
+    reviewArtifactRef: string;
+    reviewArtifactSha256: string;
+    reviewContentFingerprint: string;
+    basis: "hard-rule" | "jev-recommended";
+    jevAdviceRef: string | null;
+    jevAdviceSha256: string | null;
+    reasons: string[];
+    summary: string;
+    preparedFingerprint: string;
+    preparedAt: string;
+    sentAt: null;
+    responseRef: null;
+}
+export interface ReadPiReviewEscalationV1 {
+    ref: string;
+    request: PreparedPiReviewEscalationV1;
+    reviewArtifact: Record<string, unknown>;
+    taskDir: string;
+}
+export interface CodexEscalationReviewResolutionV1 {
+    schemaVersion: 1;
+    source: "pactile-codex-escalation-review-resolution-v1";
+    escalationId: string;
+    preparedRequestRef: string;
+    preparedFingerprint: string;
+    piReviewArtifactRef: string;
+    piReviewArtifactSha256: string;
+    piReviewContentFingerprint: string;
+    sourceTaskId: string;
+    runId: string;
+    candidateSnapshotId: string;
+    candidateFingerprint: string;
+    sendRequestId: string;
+    sendRequestFingerprint: string;
+    sendRequestRef: string;
+    sendReceiptRef: string;
+    replyTaskId: string;
+    readRequestId: string;
+    readRequestFingerprint: string;
+    readRequestRef: string;
+    readReceiptRef: string;
+    responseTurnId: string;
+    responseBodySha256: string;
+    codexReviewer: string;
+    codexReviewId: string;
+    decision: ReviewDecision;
+    review: Record<string, unknown>;
+    evidenceVerification: ReturnType<typeof resolvePiReviewEvidenceV1>;
+    contentFingerprint: string;
+}
+export interface CodexEscalationReviewReplyV1 {
+    contractVersion: 1;
+    source: "pactile-codex-escalation-review-v1";
+    binding: {
+        taskId: string;
+        runId: string;
+        candidateSnapshotId: string;
+        candidateFingerprint: string;
+        escalationId: string;
+        piRunId: string;
+        reviewId: string;
+        reviewArtifactRef: string;
+        reviewArtifactSha256: string;
+        reviewContentFingerprint: string;
+    };
+    reviewer: {
+        hostId: string;
+        threadId: string;
+        role: "review";
+        independent: true;
+    };
+    review: unknown;
+}
+export declare const PI_REVIEW_ESCALATION_REPLY_CONTRACT: {
+    readonly contractVersion: 1;
+    readonly source: "pactile-codex-escalation-review-v1";
+    readonly binding: readonly ["taskId", "runId", "candidateSnapshotId", "candidateFingerprint", "escalationId", "piRunId", "reviewId", "reviewArtifactRef", "reviewArtifactSha256", "reviewContentFingerprint"];
+    readonly reviewer: readonly ["hostId", "threadId", "role", "independent"];
+    readonly review: readonly ["contractVersion", "runId", "candidateSnapshotId", "candidateFingerprint", "verdict", "coverage", "findings", "blockers", "unresolvedQuestions", "concernResolutions", "evidenceRefs", "acceptanceEvidence"];
+};
+export declare const uuidPattern: RegExp;
+export declare const escalationIdPattern: RegExp;
+export declare const fingerprintPattern: RegExp;
+export declare function sameStrings(left: readonly string[], right: readonly string[]): boolean;
+export declare function requireStringField(value: Record<string, unknown>, field: string, label: string): string;
+export declare function sha256(value: string | Buffer): string;
+export declare function objectValue(value: unknown, label: string): Record<string, unknown>;
+export declare function exactKeys(value: Record<string, unknown>, keys: readonly string[], label: string): void;
+export declare function safeExistingArtifactFile(taskDir: string, ref: string): string;
+export declare function parseJsonObject(bytes: Buffer, label: string): Record<string, unknown>;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function preparedKeys(): string[];
+export declare function legacyPreparedKeys(): string[];
+export declare function preparedSummaryFromPiReview(review: Record<string, unknown>, reasons: readonly string[]): string;
+export interface PiReviewConcern {
+    concernId: string;
+    kind: "finding" | "blocker" | "question";
+}
+export declare function piReviewConcerns(review: Record<string, unknown>): PiReviewConcern[];
+//# sourceMappingURL=escalation-contract.d.ts.map

package/dist/pactile/review/escalation-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalation-contract.d.ts","sourceRoot":"","sources":["../../../src/pactile/review/escalation-contract.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,CAAC,CAAC;IACjB,MAAM,EAAE,iCAAiC,CAAC;IAC1C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,wBAAwB,EAAE,MAAM,CAAC;IACjC,KAAK,EAAE,WAAW,GAAG,iBAAiB,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,IAAI,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,4BAA4B,CAAC;IACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iCAAiC;IAChD,aAAa,EAAE,CAAC,CAAC;IACjB,MAAM,EAAE,+CAA+C,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B,EAAE,MAAM,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,oBAAoB,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;IACnE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,oCAAoC,CAAC;IAC7C,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,MAAM,CAAC;QAC5B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,wBAAwB,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,QAAQ,CAAC;QACf,WAAW,EAAE,IAAI,CAAC;KACnB,CAAC;IACF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,mCAAmC;;;;;;CA8BtC,CAAC;AAEX,eAAO,MAAM,WAAW,QAC2C,CAAC;AACpE,eAAO,MAAM,mBAAmB,QACmD,CAAC;AACpF,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AAEnD,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEtF;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,MAAM,CAMR;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKlF;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,MAAM,GACZ,IAAI,CAMN;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAqB7E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMrF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,YAAY,IAAI,MAAM,EAAE,CASvC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAI7C;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,CAkBR;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;CAC1C;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,eAAe,EAAE,CA0BnB"}

package/dist/pactile/review/escalation-contract.js

@@ -0,0 +1,151 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+export const PI_REVIEW_ESCALATION_REPLY_CONTRACT = {
+    contractVersion: 1,
+    source: "pactile-codex-escalation-review-v1",
+    binding: [
+        "taskId",
+        "runId",
+        "candidateSnapshotId",
+        "candidateFingerprint",
+        "escalationId",
+        "piRunId",
+        "reviewId",
+        "reviewArtifactRef",
+        "reviewArtifactSha256",
+        "reviewContentFingerprint",
+    ],
+    reviewer: ["hostId", "threadId", "role", "independent"],
+    review: [
+        "contractVersion",
+        "runId",
+        "candidateSnapshotId",
+        "candidateFingerprint",
+        "verdict",
+        "coverage",
+        "findings",
+        "blockers",
+        "unresolvedQuestions",
+        "concernResolutions",
+        "evidenceRefs",
+        "acceptanceEvidence",
+    ],
+};
+export const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export const escalationIdPattern = /^pi-escalation:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+export const fingerprintPattern = /^[a-f0-9]{64}$/;
+export function sameStrings(left, right) {
+    return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+}
+export function requireStringField(value, field, label) {
+    const result = value[field];
+    if (typeof result !== "string" || !result) {
+        throw new Error(`${label} has no ${field}`);
+    }
+    return result;
+}
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function objectValue(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${label} must be a JSON object`);
+    }
+    return value;
+}
+export function exactKeys(value, keys, label) {
+    const expected = [...keys].sort();
+    const actual = Object.keys(value).sort();
+    if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        throw new Error(`${label} has an unsupported shape`);
+    }
+}
+export function safeExistingArtifactFile(taskDir, ref) {
+    const task = fs.realpathSync(taskDir);
+    if (!ref || path.isAbsolute(ref) || ref.includes("\0")) {
+        throw new Error("Pi Review artifact path is invalid");
+    }
+    const file = path.resolve(task, ref);
+    const relative = path.relative(task, file);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw new Error("Pi Review artifact path escapes the Task directory");
+    }
+    const realFile = fs.realpathSync(file);
+    const realRelative = path.relative(task, realFile);
+    if (!realRelative ||
+        realRelative.startsWith("..") ||
+        path.isAbsolute(realRelative) ||
+        !fs.statSync(realFile).isFile()) {
+        throw new Error("Pi Review artifact does not resolve to a Task file");
+    }
+    return realFile;
+}
+export function parseJsonObject(bytes, label) {
+    try {
+        return objectValue(JSON.parse(bytes.toString("utf8")), label);
+    }
+    catch {
+        throw new Error(`${label} is not valid JSON`);
+    }
+}
+export function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+export function preparedKeys() {
+    return [
+        "schemaVersion", "source", "status", "requestId", "target", "taskId",
+        "reviewId", "piRunId", "escalationId", "runId", "candidateSnapshotId",
+        "candidateFingerprint", "reviewArtifactRef", "reviewArtifactSha256",
+        "reviewContentFingerprint", "basis", "jevAdviceRef", "jevAdviceSha256",
+        "reasons", "summary", "preparedFingerprint",
+        "preparedAt", "sentAt", "responseRef",
+    ];
+}
+export function legacyPreparedKeys() {
+    return preparedKeys().filter((key) => key !== "basis" && key !== "jevAdviceRef" && key !== "jevAdviceSha256");
+}
+export function preparedSummaryFromPiReview(review, reasons) {
+    if (!Array.isArray(review["findings"]) || !Array.isArray(review["unresolvedQuestions"])) {
+        throw new Error("Pi Review artifact has no bounded findings and questions");
+    }
+    return [
+        `Review verdict: ${String(review["verdict"])}`,
+        `Run: ${requireStringField(review, "runId", "Pi Review artifact")}`,
+        `Candidate: ${requireStringField(review, "candidateSnapshotId", "Pi Review artifact")} (${requireStringField(review, "candidateFingerprint", "Pi Review artifact")})`,
+        `Escalation reasons: ${reasons.join(", ")}`,
+        ...review["findings"].map((value) => {
+            const finding = objectValue(value, "Pi Review finding");
+            return `Finding ${requireStringField(finding, "id", "Pi Review finding")} [${requireStringField(finding, "severity", "Pi Review finding")}]: ${requireStringField(finding, "summary", "Pi Review finding")}`;
+        }),
+        ...review["unresolvedQuestions"].map((value) => {
+            const question = objectValue(value, "Pi Review question");
+            return `Question ${requireStringField(question, "id", "Pi Review question")}: ${requireStringField(question, "question", "Pi Review question")}`;
+        }),
+    ].join("\n");
+}
+export function piReviewConcerns(review) {
+    const concerns = [];
+    const add = (field, kind) => {
+        const values = review[field];
+        if (!Array.isArray(values)) {
+            throw new Error(`Pi Review artifact has no ${field} array`);
+        }
+        for (const value of values) {
+            const item = objectValue(value, `Pi Review ${kind}`);
+            const sourceId = requireStringField(item, "id", `Pi Review ${kind}`);
+            concerns.push({
+                concernId: `pi-${kind}-${sha256(sourceId).slice(0, 24)}`,
+                kind,
+            });
+        }
+    };
+    add("findings", "finding");
+    add("blockers", "blocker");
+    add("unresolvedQuestions", "question");
+    if (new Set(concerns.map((item) => item.concernId)).size !== concerns.length) {
+        throw new Error("Pi Review concerns do not have unique stable identifiers");
+    }
+    return concerns;
+}
+//# sourceMappingURL=escalation-contract.js.map

package/dist/pactile/review/escalation-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalation-contract.js","sourceRoot":"","sources":["../../../src/pactile/review/escalation-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA8F7B,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,eAAe,EAAE,CAAC;IAClB,MAAM,EAAE,oCAAoC;IAC5C,OAAO,EAAE;QACP,QAAQ;QACR,OAAO;QACP,qBAAqB;QACrB,sBAAsB;QACtB,cAAc;QACd,SAAS;QACT,UAAU;QACV,mBAAmB;QACnB,sBAAsB;QACtB,0BAA0B;KAC3B;IACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;IACvD,MAAM,EAAE;QACN,iBAAiB;QACjB,OAAO;QACP,qBAAqB;QACrB,sBAAsB;QACtB,SAAS;QACT,UAAU;QACV,UAAU;QACV,UAAU;QACV,qBAAqB;QACrB,oBAAoB;QACpB,cAAc;QACd,oBAAoB;KACrB;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,WAAW,GACtB,iEAAiE,CAAC;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAC9B,iFAAiF,CAAC;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,KAAwB;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA8B,EAC9B,KAAa,EACb,KAAa;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAsB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,KAAa;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,KAA8B,EAC9B,IAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,GAAW;IACnE,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,IACE,CAAC,YAAY;QACb,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC7B,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ;QACpE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB;QACrE,sBAAsB,EAAE,mBAAmB,EAAE,sBAAsB;QACnE,0BAA0B,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB;QACtE,SAAS,EAAE,SAAS,EAAE,qBAAqB;QAC3C,YAAY,EAAE,QAAQ,EAAE,aAAa;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,YAAY,EAAE,CAAC,MAAM,CAC1B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,iBAAiB,CAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAA+B,EAC/B,OAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,mBAAmB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;QAC9C,QAAQ,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,EAAE;QACnE,cAAc,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,KAAK,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,GAAG;QACrK,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAClC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACxD,OAAO,WAAW,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,mBAAmB,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC/M,CAAC,CAAC;QACF,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YAC1D,OAAO,YAAY,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,CAAC;QACnJ,CAAC,CAAC;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAOD,MAAM,UAAU,gBAAgB,CAC9B,MAA+B;IAE/B,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,CACV,KAAa,EACb,IAAwC,EAClC,EAAE;QACR,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,QAAQ,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;gBACxD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3B,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3B,GAAG,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/pactile/review/escalation-finalize.d.ts

@@ -0,0 +1,14 @@
+import type { ReviewDecision } from "./contract.js";
+/** Consume the bound native Codex send/read receipts and record a new Kernel Review. */
+export declare function recordCodexEscalationReviewV1(input: {
+    root: string;
+    sourceTask: string;
+    escalationId: string;
+    sendRequestId: string;
+    readRequestId: string;
+}): {
+    reviewId: string;
+    decision: ReviewDecision;
+    resolutionRef: string;
+};
+//# sourceMappingURL=escalation-finalize.d.ts.map

package/dist/pactile/review/escalation-finalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalation-finalize.d.ts","sourceRoot":"","sources":["../../../src/pactile/review/escalation-finalize.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAIxE"}

package/dist/pactile/review/escalation-finalize.js

@@ -0,0 +1,319 @@
+import fs from "node:fs";
+import path from "node:path";
+import { readTaskKernel, recordTaskReview } from "../../core/task/index.js";
+import { resolveTaskDir } from "../task/session.js";
+import { resolvePiReviewEvidenceV1 } from "./evidence.js";
+import { assertCurrentPiReviewEscalationV1, readPiReviewEscalationV1 } from "./escalation-artifacts.js";
+import { exactKeys, objectValue, parseJsonObject, requireStringField, safeExistingArtifactFile, sameStrings, sha256 } from "./escalation-contract.js";
+import { safeArtifactFile } from "./escalation-artifacts.js";
+import { assertBoundCodexReviewThread, readCodexBridgeEvidence, readCodexEscalationSendV1, writeImmutableEvidenceCopy } from "./escalation-transport.js";
+import { validateCodexReplyEnvelope } from "./escalation-reply.js";
+import { withProjectSchedulerMutex } from "../scheduler/project-lease-store.js";
+/** Consume the bound native Codex send/read receipts and record a new Kernel Review. */
+export function recordCodexEscalationReviewV1(input) {
+    return withProjectSchedulerMutex(input.root, () => recordCodexEscalationReviewUnlocked(input));
+}
+function recordCodexEscalationReviewUnlocked(input) {
+    const prepared = readPiReviewEscalationV1(input.root, input.sourceTask, input.escalationId);
+    const current = assertCurrentPiReviewEscalationV1(input.root, input.sourceTask, prepared);
+    const request = prepared.request;
+    const send = readCodexBridgeEvidence(current.taskDir, input.sendRequestId, "Codex escalation send");
+    const sendRequest = send.request;
+    const sendReceipt = send.receipt;
+    const sourceTaskRef = path.relative(input.root, current.taskDir).replaceAll("\\", "/");
+    const latestSend = readCodexEscalationSendV1({
+        root: input.root,
+        sourceTask: input.sourceTask,
+        escalationId: input.escalationId,
+        sendRequestId: input.sendRequestId,
+    });
+    const codexReviewId = `codex-review-${request.piRunId}`;
+    const priorCodexReview = current.kernel.reviews.find((item) => item.id === codexReviewId);
+    if (sendRequest["task"] !== sourceTaskRef ||
+        sendRequest["task_id"] !== request.taskId ||
+        sendRequest["task_kernel_kind"] !== "task-kernel-v2" ||
+        (sendRequest["kernel_revision"] !== current.kernel.revision &&
+            !(priorCodexReview && current.kernel.revision === Number(sendRequest["kernel_revision"]) + 1)) ||
+        sendRequest["run_id"] !== request.runId ||
+        sendRequest["candidate_snapshot_id"] !== request.candidateSnapshotId ||
+        sendRequest["candidate_fingerprint"] !== request.candidateFingerprint ||
+        sendRequest["tool"] !== "send_message_to_thread" ||
+        sendRequest["role"] !== "review" ||
+        sendRequest["escalation_id"] !== input.escalationId ||
+        sendRequest["escalation_source_task"] !== sourceTaskRef ||
+        sendRequest["escalation_source_task_id"] !== request.taskId ||
+        sendRequest["escalation_prepared_request_ref"] !== prepared.ref ||
+        sendRequest["escalation_prepared_fingerprint"] !== request.preparedFingerprint ||
+        typeof sendRequest["to_task"] !== "string" ||
+        typeof sendRequest["to_task_id"] !== "string" ||
+        typeof sendRequest["thread_id"] !== "string" ||
+        typeof sendRequest["host_id"] !== "string" ||
+        sendReceipt["request_id"] !== input.sendRequestId ||
+        latestSend.requestFingerprint !== sendRequest["request_fingerprint"] ||
+        latestSend.receiptSha256 !== sha256(send.receiptBytes) ||
+        sendReceipt["task_id"] !== request.taskId ||
+        sendReceipt["run_id"] !== request.runId ||
+        sendReceipt["candidate_snapshot_id"] !== request.candidateSnapshotId ||
+        sendReceipt["candidate_fingerprint"] !== request.candidateFingerprint ||
+        sendReceipt["to_task_id"] !== sendRequest["to_task_id"] ||
+        sendReceipt["escalation_id"] !== input.escalationId ||
+        sendReceipt["evidence_level"] !== "desktop-native" ||
+        sendReceipt["outcome"] !== "ok" ||
+        sendReceipt["tool"] !== "send_message_to_thread" ||
+        sendReceipt["thread_id"] !== sendRequest["thread_id"] ||
+        sendReceipt["host_id"] !== sendRequest["host_id"] ||
+        sendReceipt["contract_stale"] !== false ||
+        sendReceipt["kernel_revision_at_receipt"] !== sendRequest["kernel_revision"] ||
+        sendReceipt["destination_kernel_revision_at_receipt"] !== sendRequest["to_kernel_revision"]) {
+        throw new Error("Codex escalation send request or native receipt is stale or misbound");
+    }
+    const replyTask = String(sendRequest["to_task"]);
+    const replyTaskDir = resolveTaskDir(input.root, replyTask);
+    if (!fs.statSync(replyTaskDir, { throwIfNoEntry: false })?.isDirectory()) {
+        throw new Error("Codex escalation reply Task is missing");
+    }
+    const replyTaskPath = fs.realpathSync(replyTaskDir);
+    const read = readCodexBridgeEvidence(replyTaskPath, input.readRequestId, "Codex escalation reply read");
+    const readRequest = read.request;
+    const readReceipt = read.receipt;
+    const replyTaskRef = path.relative(input.root, replyTaskPath).replaceAll("\\", "/");
+    const targetRead = readTaskKernel({ root: input.root, taskDir: replyTaskPath, cwd: input.root });
+    if (targetRead.kind !== "task-kernel-v2") {
+        throw new Error("Codex escalation reply requires its bound V2 Review Task");
+    }
+    const targetKernel = targetRead.kernel;
+    const targetRun = targetKernel.runs.at(-1);
+    const targetCandidate = targetRun?.candidateSnapshot;
+    if (targetKernel.identity.taskId !== sendRequest["to_task_id"] ||
+        !["verify", "integrate"].includes(targetKernel.phase) ||
+        targetKernel.revision !== sendRequest["to_kernel_revision"] ||
+        targetRun?.state !== "completed" ||
+        !targetCandidate ||
+        targetRun.id !== sendRequest["to_run_id"] ||
+        targetCandidate.id !== sendRequest["to_candidate_snapshot_id"] ||
+        targetCandidate.fingerprint !== sendRequest["to_candidate_fingerprint"]) {
+        throw new Error("Codex escalation reply Task Run or candidate is stale");
+    }
+    const threadId = requireStringField(sendRequest, "thread_id", "Codex escalation send request");
+    const hostId = requireStringField(sendRequest, "host_id", "Codex escalation send request");
+    assertBoundCodexReviewThread(replyTaskPath, replyTaskRef, targetKernel.identity.taskId, threadId, hostId);
+    if (readRequest["task"] !== replyTaskRef ||
+        readRequest["task_id"] !== targetKernel.identity.taskId ||
+        readRequest["task_kernel_kind"] !== "task-kernel-v2" ||
+        readRequest["kernel_revision"] !== targetKernel.revision ||
+        readRequest["run_id"] !== targetRun.id ||
+        readRequest["candidate_snapshot_id"] !== targetCandidate.id ||
+        readRequest["candidate_fingerprint"] !== targetCandidate.fingerprint ||
+        readRequest["tool"] !== "read_thread" ||
+        readRequest["role"] !== "review" ||
+        readRequest["thread_id"] !== threadId ||
+        readRequest["host_id"] !== hostId ||
+        readRequest["reply_to_escalation_id"] !== input.escalationId ||
+        readRequest["escalation_source_task"] !== sourceTaskRef ||
+        readRequest["escalation_source_task_id"] !== request.taskId ||
+        readRequest["escalation_prepared_request_ref"] !== prepared.ref ||
+        readRequest["escalation_prepared_fingerprint"] !== request.preparedFingerprint ||
+        readRequest["escalation_send_request_id"] !== input.sendRequestId ||
+        readRequest["escalation_send_request_fingerprint"] !== latestSend.requestFingerprint ||
+        readRequest["escalation_send_receipt_sha256"] !== latestSend.receiptSha256 ||
+        readRequest["escalation_send_receipt_recorded_at"] !== latestSend.receiptRecordedAt ||
+        readReceipt["request_id"] !== input.readRequestId ||
+        readReceipt["task_id"] !== targetKernel.identity.taskId ||
+        readReceipt["run_id"] !== targetRun.id ||
+        readReceipt["candidate_snapshot_id"] !== targetCandidate.id ||
+        readReceipt["candidate_fingerprint"] !== targetCandidate.fingerprint ||
+        readReceipt["reply_to_escalation_id"] !== input.escalationId ||
+        readReceipt["escalation_send_request_id"] !== input.sendRequestId ||
+        readReceipt["escalation_send_request_fingerprint"] !== latestSend.requestFingerprint ||
+        readReceipt["escalation_send_receipt_sha256"] !== latestSend.receiptSha256 ||
+        readReceipt["escalation_send_receipt_recorded_at"] !== latestSend.receiptRecordedAt ||
+        readReceipt["evidence_level"] !== "desktop-native" ||
+        readReceipt["outcome"] !== "ok" ||
+        readReceipt["tool"] !== "read_thread" ||
+        readReceipt["status"] !== "completed" ||
+        readReceipt["thread_id"] !== threadId ||
+        readReceipt["host_id"] !== hostId ||
+        readReceipt["contract_stale"] !== false ||
+        readReceipt["kernel_revision_at_receipt"] !== readRequest["kernel_revision"] ||
+        !Number.isFinite(Date.parse(String(readRequest["created_at"]))) ||
+        !Number.isFinite(Date.parse(String(readReceipt["recorded_at"]))) ||
+        Date.parse(String(readRequest["created_at"])) < Date.parse(latestSend.receiptRecordedAt) ||
+        Date.parse(String(readReceipt["recorded_at"])) < Date.parse(latestSend.receiptRecordedAt) ||
+        readReceipt["reply_evidence"] === null ||
+        typeof readReceipt["reply_evidence"] !== "object") {
+        throw new Error("Codex escalation reply request or native receipt is stale or misbound");
+    }
+    const replyEvidence = objectValue(readReceipt["reply_evidence"], "Codex native read reply evidence");
+    exactKeys(replyEvidence, ["reply_to_escalation_id", "response_turn_id", "body", "body_sha256"], "Codex native read reply evidence");
+    const responseTurnId = requireStringField(replyEvidence, "response_turn_id", "Codex native read reply evidence");
+    const responseBody = requireStringField(replyEvidence, "body", "Codex native read reply evidence");
+    const responseBodySha256 = requireStringField(replyEvidence, "body_sha256", "Codex native read reply evidence");
+    if (replyEvidence["reply_to_escalation_id"] !== input.escalationId ||
+        sha256(responseBody) !== responseBodySha256) {
+        throw new Error("Codex native read reply evidence hash or escalation correlation is invalid");
+    }
+    const parsedReply = validateCodexReplyEnvelope(responseBody, request, prepared.reviewArtifact, { hostId, threadId }, current.kernel.definition.acceptanceCriteria.map((item) => item.id));
+    const reviewerId = `codex-reviewer:${sha256(`${hostId}\0${threadId}`).slice(0, 32)}`;
+    const runHost = current.run.host;
+    if (reviewerId === current.run.startedBy ||
+        reviewerId === current.run.authorization.approvedBy ||
+        (runHost?.hostId === hostId && runHost.threadId === threadId) ||
+        runHost?.sessionId === threadId) {
+        throw new Error("Codex escalation reviewer is not independent from the Run executor or approver");
+    }
+    const evidenceRefs = parsedReply.content.allEvidenceRefs;
+    if (!evidenceRefs.length) {
+        throw new Error("Codex escalation Review must report byte-verifiable evidence references");
+    }
+    const candidateRoot = current.run.workspace?.canonicalPath ?? input.root;
+    const evidenceVerification = resolvePiReviewEvidenceV1({
+        root: input.root,
+        taskDir: current.taskDir,
+        candidateRoot,
+        run: current.run,
+        references: evidenceRefs,
+    });
+    const verifiedRefs = evidenceVerification.items.map((item) => item.ref);
+    if (!sameStrings(evidenceRefs, verifiedRefs)) {
+        throw new Error("Codex escalation Review evidence references do not match byte-verified candidate and Run evidence");
+    }
+    const sourceCopies = {
+        sendRequestRef: `pi-bridge/escalations/transport/send-request-${input.sendRequestId}.json`,
+        sendReceiptRef: `pi-bridge/escalations/transport/send-receipt-${input.sendRequestId}.json`,
+        readRequestRef: `pi-bridge/escalations/transport/read-request-${input.readRequestId}.json`,
+        readReceiptRef: `pi-bridge/escalations/transport/read-receipt-${input.readRequestId}.json`,
+    };
+    writeImmutableEvidenceCopy(current.taskDir, send.requestBytes, sourceCopies.sendRequestRef);
+    writeImmutableEvidenceCopy(current.taskDir, send.receiptBytes, sourceCopies.sendReceiptRef);
+    writeImmutableEvidenceCopy(current.taskDir, read.requestBytes, sourceCopies.readRequestRef);
+    writeImmutableEvidenceCopy(current.taskDir, read.receiptBytes, sourceCopies.readReceiptRef);
+    const resolutionCore = {
+        schemaVersion: 1,
+        source: "pactile-codex-escalation-review-resolution-v1",
+        escalationId: request.escalationId,
+        preparedRequestRef: prepared.ref,
+        preparedFingerprint: request.preparedFingerprint,
+        piReviewArtifactRef: request.reviewArtifactRef,
+        piReviewArtifactSha256: request.reviewArtifactSha256,
+        piReviewContentFingerprint: request.reviewContentFingerprint,
+        sourceTaskId: request.taskId,
+        runId: request.runId,
+        candidateSnapshotId: request.candidateSnapshotId,
+        candidateFingerprint: request.candidateFingerprint,
+        sendRequestId: input.sendRequestId,
+        sendRequestFingerprint: String(sendRequest["request_fingerprint"]),
+        ...sourceCopies,
+        replyTaskId: targetKernel.identity.taskId,
+        readRequestId: input.readRequestId,
+        readRequestFingerprint: String(readRequest["request_fingerprint"]),
+        responseTurnId,
+        responseBodySha256,
+        codexReviewer: reviewerId,
+        codexReviewId,
+        decision: parsedReply.content.verdict,
+        review: parsedReply.rawReview,
+        evidenceVerification,
+    };
+    const resolution = {
+        ...resolutionCore,
+        contentFingerprint: sha256(JSON.stringify(resolutionCore)),
+    };
+    const resolutionRef = `pi-bridge/escalations/replies/${codexReviewId}.json`;
+    const resolutionFile = safeArtifactFile(current.taskDir, resolutionRef);
+    if (fs.existsSync(resolutionFile)) {
+        const existingBytes = fs.readFileSync(safeExistingArtifactFile(current.taskDir, resolutionRef));
+        const existing = parseJsonObject(existingBytes, "Codex escalation Review resolution");
+        const existingCore = { ...existing };
+        delete existingCore["contentFingerprint"];
+        const existingVerification = objectValue(existingCore["evidenceVerification"], "stored Codex escalation evidence verification");
+        const freshVerification = objectValue(evidenceVerification, "current Codex escalation evidence verification");
+        if (existing.contentFingerprint !== sha256(JSON.stringify(existingCore)) ||
+            JSON.stringify({ ...existingCore, evidenceVerification: { ...existingVerification, observedAt: null } }) !==
+                JSON.stringify({ ...resolutionCore, evidenceVerification: { ...freshVerification, observedAt: null } })) {
+            throw new Error("A different Codex escalation Review resolution is already stored");
+        }
+    }
+    else {
+        fs.writeFileSync(resolutionFile, `${JSON.stringify(resolution, null, 2)}\n`, {
+            encoding: "utf8",
+            flag: "wx",
+            mode: 0o600,
+        });
+    }
+    const reviewEvidenceRefs = [
+        ...new Set([
+            ...evidenceRefs,
+            ...current.review.evidenceRefs,
+            ...Object.values(current.review.acceptanceEvidence).flat(),
+            request.reviewArtifactRef,
+            prepared.ref,
+            ...Object.values(sourceCopies),
+            resolutionRef,
+        ]),
+    ];
+    const unresolvedBlockers = [
+        ...parsedReply.content.blockers.map((blocker) => `${blocker.id}: ${blocker.summary}`),
+        ...parsedReply.content.unresolvedQuestions.map((question) => `${question.id}: ${question.question}`),
+        ...parsedReply.content.concernResolutions
+            .filter((resolution) => resolution.disposition === "still-blocking")
+            .map((resolution) => `${resolution.concernId}: ${resolution.rationale}`),
+    ];
+    if (priorCodexReview) {
+        if (priorCodexReview.runId !== request.runId ||
+            priorCodexReview.candidateSnapshotId !== request.candidateSnapshotId ||
+            priorCodexReview.candidateFingerprint !== request.candidateFingerprint ||
+            priorCodexReview.reviewer !== reviewerId ||
+            priorCodexReview.decision !== parsedReply.content.verdict ||
+            JSON.stringify(priorCodexReview.evidenceRefs) !== JSON.stringify(reviewEvidenceRefs) ||
+            JSON.stringify(priorCodexReview.acceptanceEvidence) !== JSON.stringify(parsedReply.content.acceptanceEvidence) ||
+            JSON.stringify(priorCodexReview.unresolvedBlockers) !== JSON.stringify(unresolvedBlockers)) {
+            throw new Error("A different Codex escalation Kernel Review already exists");
+        }
+        if (current.kernel.reviews.at(-1)?.id !== codexReviewId) {
+            throw new Error("Codex escalation Kernel Review is no longer the latest Review");
+        }
+        const finalGuard = assertCurrentPiReviewEscalationV1(input.root, input.sourceTask, prepared);
+        if (finalGuard.kernel.revision !== current.kernel.revision ||
+            finalGuard.run.id !== current.run.id ||
+            finalGuard.review.id !== current.review.id) {
+            throw new Error("Pi Review changed before the Codex escalation Review readback");
+        }
+        return { reviewId: codexReviewId, decision: parsedReply.content.verdict, resolutionRef };
+    }
+    const finalGuard = assertCurrentPiReviewEscalationV1(input.root, input.sourceTask, prepared);
+    if (finalGuard.kernel.revision !== current.kernel.revision ||
+        finalGuard.run.id !== current.run.id ||
+        finalGuard.review.id !== current.review.id) {
+        throw new Error("Pi Review changed before the Codex escalation Kernel Review write");
+    }
+    const mutation = recordTaskReview({
+        root: input.root,
+        taskDir: current.taskDir,
+        expectedRevision: finalGuard.kernel.revision,
+        reviewId: codexReviewId,
+        runId: request.runId,
+        candidateSnapshotId: request.candidateSnapshotId,
+        candidateFingerprint: request.candidateFingerprint,
+        reviewer: reviewerId,
+        decision: parsedReply.content.verdict,
+        evidenceRefs: reviewEvidenceRefs,
+        acceptanceEvidence: parsedReply.content.acceptanceEvidence,
+        unresolvedBlockers,
+        measurementRef: resolutionRef,
+        actor: reviewerId,
+        idempotencyKey: `codex-escalation-review:${request.piRunId}`,
+        cwd: input.root,
+    });
+    const persisted = mutation.kernel.reviews.find((item) => item.id === codexReviewId);
+    if (!persisted || mutation.kernel.reviews.at(-1)?.id !== codexReviewId) {
+        throw new Error("Kernel did not read back the new Codex escalation Review as latest");
+    }
+    const readback = readTaskKernel({ root: input.root, taskDir: current.taskDir, cwd: input.root });
+    if (readback.kind !== "task-kernel-v2" ||
+        readback.kernel.reviews.at(-1)?.id !== codexReviewId ||
+        readback.kernel.reviews.at(-1)?.decision !== parsedReply.content.verdict) {
+        throw new Error("Kernel Codex Review is not readable after atomic persistence");
+    }
+    return { reviewId: codexReviewId, decision: parsedReply.content.verdict, resolutionRef };
+}
+//# sourceMappingURL=escalation-finalize.js.map