@calliopelabs/cli 3.5.4 → 3.7.0

package/docs/improvement-cycles.md

@@ -0,0 +1,304 @@
+# Bounded improvement cycles
+
+Version-4 [supervised runs](continuous-supervision.md) record each final `retry`,
+`replan` or `decompose` decision as an improvement cycle. The controller optimizes
+for the reviewed principle (`speed`, `robustness`, `stability`, `security`,
+`performance` or `cost`), reviews executor evidence, and receives the latest four
+cycles' measured outcomes. A reviewer, when configured, owns the final decision;
+its controller draft is not a second improvement.
+
+## Host capability discovery
+
+`calliope improve host-capabilities --contract-version 1 --json` returns the
+additive version-1 `improvement.host-capabilities` contract. It inventories the
+native execution, review-request, task-outcome and source-change interfaces with
+their independent versions. Discovery uses CLI JSON; operations use the native
+library APIs described below. This declaration does not create remote RPC methods.
+Unknown requested versions and run/approval/mutation selectors are refused.
+
+`implementation` identifies the installed package version, artifact form and
+build metadata status. Source metadata records the build's Git commit and dirty
+state when available; builds outside their own source repository retain `null`.
+The query never runs Git in the caller's project. Missing, malformed or mismatched
+metadata cannot establish source identity. Even clean metadata is self-reported:
+verify npm integrity and publisher provenance, or standalone release checksums
+and binary attestations, against the same release tag and source commit before
+trusting it. The query explicitly reports `external-attestation-required`.
+
+Legacy execution discovery remains unchanged:
+
+`calliope improve capabilities --json` returns a version-1 `improvement` envelope
+whose action is `capabilities` and whose data kind is `improvement.capabilities`.
+The data contract is version 2; its `hostAdmission` field advertises the native
+`expectedExecutionRevision` option for propose/run and binding to the controller's
+own committed reset event. Version-1 declarations do not promise this admission
+contract. The outer CLI response envelope remains version 1.
+This read-only query does not select a project/run, call a model, import feedback,
+or grant execution authority. Run selectors, approval hashes and mutation flags
+are rejected for this action. Hosts must negotiate this declaration instead of
+inferring learning support from the package version or command names.
+
+The current declaration advertises native recursive task-strategy improvement,
+history schema versions, operation effects, exact-proposal approval, inherited
+limits and withdrawal semantics. External feedback import, cross-run learned
+strategy selection and model training are explicitly unavailable. Project brain
+memory remains a separate interface. A supported operation still requires the
+exact native run's current state and policy; this declaration is not evidence
+that an installed run can execute it. Unknown contract versions are not compatible
+by implication. This is the capability-discovery part of #413, not a completed
+external feedback or reinforcement-learning interface.
+
+## Host review requests
+
+The separately negotiated `improvementReviewCapabilities()` API (version 1,
+`improvement.review-capabilities`) advertises `requestImprovementReview`,
+`inspectImprovementReviews` and `dismissImprovementReview`. It is request-only;
+existing version-2 execution capabilities are unchanged. Hosts must negotiate
+this API separately before exposing a model request tool. Hosts supply the model-tool and human-review UI adapters. This API increment
+does not add a CLI subcommand.
+
+Requests carry version 1, `action` (`propose`, `run`, `rollback`), the exact
+`executionRevision`, `cycleId` and `proposalHash` (both null for `propose`), and a
+nonempty untrusted `reason` of at most 1,024 characters. Recording requires an
+inactive approved supervised run and native policy/confirmation. It calls no
+model, starts no worker, approves no proposal, and changes neither task state nor
+budget. Run/withdrawal requests bind the native proposal hash; a new proposal
+request needs retained task outcomes and remaining original controller time and
+round capacity. Withdrawal requests can outlive the original deadline.
+
+Version-9 events append to the existing private execution journal. Each request
+is bound to the immediately preceding revision. Only one request can be current;
+identical retries after a lost acknowledgement return that same request ID after
+rechecking policy and run approval. A competing changed request fails. Native
+ownership, revision and revocation checks run again before commit. At most 64
+requests are retained per run, within the existing journal byte/event bounds.
+Replay independently validates requests and never derives execution authority
+from them. Older readers that do not support event version 9 must refuse these
+journals; do not downgrade a run's owner after recording a request.
+
+Inspection projects `pending`, `expired`, `stale` or `dismissed` from native
+events. Any later execution/control event makes the old request stale, not
+approved or completed. Human execution must use a fresh native inspection and
+the existing proposal/run/withdrawal APIs with their normal review and policy.
+Dismissal requires the exact current request ID/revision and a separate native
+confirmation; it retains all history and does not withdraw the strategy. The
+request reason remains untrusted display data, never an instruction or reward.
+
+## Controls
+
+```sh
+calliope improve history --run RUN_ID --json
+calliope improve propose --run RUN_ID --allow-mutations --json
+calliope improve run CYCLE_ID --run RUN_ID --approve PROPOSAL_HASH --allow-mutations --json
+calliope improve rollback CYCLE_ID --run RUN_ID --allow-mutations --json
+```
+
+The REPL exposes the same arguments under `/improve`. Without a subcommand it
+shows history; without `--run` it inspects the latest run in the active project.
+Headless mutations require `--allow-mutations` or an approval callback, and still
+pass project policy. REPL approvals use the existing scope preview and audit log.
+
+`propose` reviews an inactive supervised run's retained outcomes, or returns its
+existing pending proposal without another model call. Explicit recovery of a
+halted controller retains its original rounds, task attempts, reservations and
+deadline. It starts no workers and applies no proposed changes. It needs recorded
+outcomes and remaining controller authority; a completed run or a `continue` or
+`stop` decision can produce no improvement proposal. Inspect that decision before
+resuming ordinary execution.
+
+A recorded proposal hold survives restart. `run` requires its exact review hash;
+ordinary `run resume` cannot bypass that hold. Approval is recorded in the same
+execution journal before application, and checked again under coordinator
+ownership. All subsequent decisions remain subject to the original reviewed
+supervision policy. To inspect and retire a strategy, stop the coordinator first.
+
+Native hosts can pass `expectedExecutionRevision` to `proposeImprovement` and
+`runImprovement`. It must match the execution revision from their reviewed
+inspection. Malformed, missing-history and stale bindings are refused before
+execution approval. The coordinator rechecks after asynchronous authorization,
+under its ownership lease and inside the journal append lock before starting
+work. The execution permission request includes that bound `executionRevision`.
+An explicit controller reset advances the binding only to its own committed
+reset event; another writer's revision is never silently adopted. Existing
+callers that omit the option bind to the history inspected by the improvement
+action. This host API does not add a CLI flag; hosts negotiate the version-2 data
+contract before relying on it. It does not authorize execution, change proposal hashes, or replenish
+the original budget or deadline.
+
+`rollback` **withdraws the execution strategy**. For a replan it restores the
+previous unwithdrawn applied strategy; for decomposition it stops the admitted
+child agents and their descendants. It stops controller continuation and preserves
+the task graph, allocations, attempts, checks, candidate worktrees and artifacts.
+It does not apply an inverse patch to source: this loop edits isolated candidates,
+and never automatically applies them to the source checkout. Inspect the retained
+base commit and patch artifacts to compare or recover a candidate. A different
+pending decision must be resolved before withdrawing an older cycle. Withdrawing
+an expired cycle is allowed because it reduces authority; it cannot revive the
+clock or refund spend.
+
+## Evidence and schema
+
+History is a deterministic projection of the existing private, hash-chained
+journals, not a second mutable database. Legacy histories and cycles retain
+`version: 1`; runs with [request attribution](request-attribution.md) use version 2
+and identify the observed budget revision. Cycles whose review events carry
+sanitized [provider-health evidence](provider-health.md) use version 3 and retain
+the controller snapshot plus the reviewer snapshot when that separate role is
+configured. This records the aggregate operational evidence available to each
+decision without importing credentials, endpoint strings, provider text or new
+execution authority. Each cycle's immutable ID is its final decision event ID. It
+includes:
+
+- Trigger event IDs/hashes, principle, proposed hypothesis/change/metric.
+- Parent decomposition and previous attempt links, target tasks, original run
+  deadline and limits, scoped worker/controller/reviewer accounts and ancestors.
+- Review hold, explicit approval, application and withdrawal event references;
+  original plan approval and separate production approval (`not-approved`).
+- Baseline and direct next-attempt outcomes, checks, artifact hashes, observed
+  duration/tool results, unresolved risks, isolation image and rollback references.
+- Original manifest hash and the inspected execution revision.
+- Controller and optional reviewer provider-health snapshots, their observation
+  times, relevant-event counts and history hashes.
+
+Inspection validates journal ancestry, current artifact read permissions, retained
+artifact bytes and the pinned worktree base. Evidence reads are bounded to 64 MiB
+per inspection; histories retain the execution store's existing event/size bounds.
+No inspection calls a model or replays a tool. Recorded run replay reproduces the
+same cycles without execution. Keep history private: task evidence can contain
+project information even though API keys are not part of the cycle contract.
+
+A cycle measures its **direct next attempts**. If a decomposed child fails and a
+nested replan fixes it, the parent cycle retains that first failed result and the
+nested cycle records the verified retry. This preserves the failure instead of
+retroactively claiming every experiment succeeded. `verified` means the recorded
+targets completed their acceptance process, not that every optimization claim was
+proved. Human acceptance remains distinguishable by its source event.
+
+## Measurements and limitations
+
+| Measurement | Definition | Comparison requirement |
+|---|---|---|
+| `acceptance-check-pass-rate` | Passed recorded acceptance checks / all recorded checks | Same tasks and check definitions |
+| `attempt-duration` | Sum of task-start to task-finish event durations, milliseconds | Same complete task population |
+| `tool-failure-rate` | Failed completed tool calls / completed tool calls | Same complete task population |
+| `provider-accounted-cost` | Accounted provider charges for the recorded worker attempts, integer nano-dollars | Same complete task population, bound request provenance and fully settled usage |
+
+Missing measurements are `null`, never zero. New task populations and changed
+check definitions are explicitly non-comparable. These observations do not prove
+causality or provide an automatic security/performance certification. Requested
+metrics remain proposed even when checks pass. The duration is summed task time,
+not workflow wall time; acceptance checks are not the individual assertions inside
+a test process. The cost measurement excludes planning and controller/reviewer
+overhead, and is not whole-goal cost per successful task or an invoice. Those
+roles retain separate request attribution in run diagnostics. Unknown or pending
+requests retain their conservative charge, but prevent a comparable cost delta.
+Legacy/missing bindings yield unavailable costs rather than fabricated zeroes;
+the shared run/project ledgers continue enforcing their original reservations.
+
+For linked goals, [whole-goal metrics](goal-accounting.md) separately include
+planning and review overhead and inspect final artifacts before reporting cost
+per verified task. This total is not a comparable before/after cycle metric.
+
+The HUD adds the latest cycle's status, comparable check rate and comparable
+worker-attempt cost. Explicit Brain run ingestion cites the budget revision and
+stores a separate snapshot when accounting changes; hypotheses remain proposed.
+Headless output
+uses `version: 1`, `type: improvement` for results and `type: improvement.event`
+for streamed execution events; enclosed events keep their own schema version.
+Execution exit codes remain 0 success, 4 partial, 3 policy denial, 130 cancellation
+and 1 failure; malformed command arguments exit 2. History is local-only JSON and
+can be redirected for diagnostics. There is no import of execution authority.
+
+## Safety and recovery
+
+The loop cannot edit permissions, expand budgets/depth/count, reset deadlines,
+erase evidence, publish, merge, deploy or send external messages. Every file/tool
+mutation uses the shared runtime gates; child admission rechecks inherited scope
+and grants. All coding attempts use retained Git worktrees and reviewed isolated
+verification. Unknown requests retain their reservation, and interrupted calls
+require explicit recovery. A cancelled or denied experiment keeps its partial
+results; a new run is not an automatic escape from its allowance.
+
+This implements recursive, evidence-driven **task strategy improvement**. It does
+not automatically patch Calliope itself or promote knowledge to accepted fact.
+The [project Brain](project-brain.md) can explicitly ingest verified run evidence;
+improvement hypotheses remain proposed. [Opt-in agent retrieval](agent-knowledge.md)
+lets planners and workers read that knowledge within their inherited source scopes.
+
+## Reviewed source proposals
+
+The native `sourceChangeCapabilities`, `previewSourceChange`,
+`proposeSourceChange`, `inspectSourceChange` and `listSourceChanges` APIs let a host offer verified
+source changes for human review. A source-owned skill or interface uses the Git
+repository that owns its files. Installed skills keep their separate installation
+and trust lifecycle.
+
+The selection binds the original run, execution revision, verified cycle, task
+and executor-collected patch hash. Preview checks the original approval, task
+write scope, pinned source commit and repository-local author. It returns the
+patch, affected paths and a review hash without creating Git objects or refs.
+Creating a proposal requires the exact `orchestration_source_proposal` permission
+and rechecks those inputs under the execution lease.
+
+The writer creates one commit and one local branch under
+`refs/heads/calliope-proposals/<run>/<review hash>` using a temporary private
+index. It leaves the source checkout/index and execution journal unchanged.
+Immutable intent and candidate records support retry after cancellation or a lost
+response; repeated publication recovers the same branch instead of overwriting
+it. Inspection reports `prepared` when the branch is absent and `proposed` when
+the exact recorded commit is present. Absence alone does not establish whether
+someone previously removed the branch. A moved branch is a conflict.
+Listing retains original review identities across restart and source HEAD changes;
+it reads the same native intent/candidate records and checks each branch.
+
+This API does not install skills, merge, push, release or invoke a model. A host
+must explicitly support the separate versioned source-change capability before
+offering the action. Desktop integration and platform qualification are separate
+from native API validation.
+
+## Ordinary task evidence
+
+`taskOutcomeCapabilities()` and `inspectTaskOutcome(project, runId, selection,
+options)` expose the same native evidence for an ordinary task outside an
+improvement cycle. Select `{taskId, attempt, executionRevision}` from an inactive
+run. The reader replays the journal at that attempt's start, retains its task,
+agent and strategy configuration hash, and revalidates each artifact's bytes
+under the native read policy. It refuses active ownership, stale selections and
+changed or missing evidence. In particular, a historical live project file that
+a later retry overwrote cannot be freshly verified; retained run artifacts allow
+independent inspection of both attempts.
+
+The returned `{value, hash}` separates executor status from native human task
+acceptance, includes original event/check/artifact references, and attributes
+charges to the exact start event using the reservation ledger. Missing or
+unsettled costs remain `null`; reservations are not reported as settled cost.
+Duration, tool calls and failures are recorded observations. An interrupted
+attempt without a finish remains unknown. The accounting snapshot carries its
+own ledger revision and may advance independently of the execution journal.
+
+This read-only API performs no inference, artifact execution, ledger writes,
+user assessment, feedback import or reward assignment. A host may separately
+propose a human assessment for memory review; doing so does not change the
+executor evidence. Ordinary-task UI and memory feedback require their own host
+qualification.
+
+## Native validation
+
+The [native Brain-loop receipt](docs/evidence/native-brain-loop-smoke.json) records a
+Fable planner/controller and a Haiku worker on a public clamp fixture. All 12 paid
+requests used the native provider after live discovery. Planning recovered from
+one output cutoff within its original allowance. After exact-plan review, the
+worker submitted a deliberately unchanged baseline, the real Docker check failed,
+the controller replanned, and a one-line repair passed the same unchanged tests.
+The live HUD showed both agents, attempts, controller rounds and remaining budgets.
+
+Planner and worker Brain reads left its journal unchanged. A fresh process resumed
+and replayed the completed run without model calls or execution/budget changes.
+Explicit run ingestion then preserved both failed and passed checks as observations
+and the improvement hypothesis as proposed knowledge. All artifact hashes were
+verified, and the source checkout remained unchanged.
+
+The probe retained $3.068752 of conservative reservations, including the cutoff,
+within a $5 cap. This demonstrates one staged repair cycle; it does not establish
+general coding reliability, causal improvement, or native nested decomposition.
+Provider conformance and signing remain separate release gates.

package/docs/migration-assessment.md

@@ -0,0 +1,113 @@
+# Read-only migration assessment
+
+`calliope migration assess --repository /path/to/clone --request request.json --json`
+produces a feasibility report, rulebook and work manifest from a pinned source
+inventory and supplied pilot evidence. It does not run scripts, invoke Docker,
+start workers, create a workflow, write project artifacts or propose brain changes.
+Save the returned JSON through the project's authorized artifact owner when wanted.
+
+`migration assessment-schema` returns the request/report JSON Schemas.
+`migration review-assessment --request request.json` validates the request and
+returns its digest without reading a repository. Schemas describe structure;
+runtime validation also checks normalized paths, ownership and cross-references.
+The assessment CLI exits 0 when it produced a report, including `investigate` or
+`do-not-migrate`. Read `recommendation`; exit 0 is not a migration approval.
+
+## Request and inventory
+
+The versioned request records:
+
+- Source commit and authorized literal read paths, target adapter/stack/runtime.
+- Port, redesign or incremental-upgrade intent, motivation, compatibility
+  obligations, deployment constraints and success criteria.
+- USD budget in integer micros, duration limit and maximum concurrency.
+- The rulebook's exact commit/path/blob, unique source/target unit ownership,
+  explicit source-file dependencies, risk and rationale, and reasoned exclusions.
+- Up to 16 pilot plan/report pairs with separately evidenced implementation,
+  verification and review measurements. Measurements bind the exact report digest.
+
+One request is bounded to 2 MiB, 128 units, 128 exclusions and 64 read prefixes.
+All repository reads use the existing bounded committed inventory. The repository
+is canonicalized before asynchronous work; moving a path alias cannot redirect
+later reads. Evidence pins outside the selected read scope are reported without
+reading them. Hosts must supply a scope already authorized for the user/task.
+
+Every selected source file must be owned by a unit or explicitly excluded. Original
+tests, build configuration, manifests and lockfiles remain listed in the rulebook.
+The assessment identifies unsupported adapter/runtime/unit shapes, unavailable
+sources, uncovered code, external dependencies, declared package cycles and unit
+cycles. Unit dependencies must include declared local-package ordering. This is
+declaration analysis, not an import parser or proof of dynamic dependency coverage.
+
+The current adapter supports self-contained `.mjs` to `.mts` CLI ports on the pinned
+Node 24 runtime. A redesign or incremental upgrade requires a different plan;
+passing old CLI cases does not make it a structure-preserving port. Unsupported
+scope yields `do-not-migrate` **for this plan and adapter**, not a general claim
+that the selected technology or a migration is unsuitable.
+
+## Evidence and independent host review
+
+Each pilot goes through [saved evidence review](migration-verification.md#review-saved-observations).
+The assessment then checks every source, candidate, negative-control and rules pin
+against actual committed blobs. Self-consistent JSON with invented Git pins is not
+enough. Changed source, rules, runtime, cases or pilot accounting require a new
+assessment and review. Missing or nonpassing baselines, known-failure checks or
+candidate observations remain findings, regardless of a host's acceptance.
+
+Library hosts call `assessMigration(repository, request, { signal, implementation, review })`.
+`implementation` contains `kitSha256` and `verifierSha256`, supplied by the trusted
+host from its installed kit artifact and the verifier that produced the pilot
+evidence. These exact identities join the logical versions in the report, review
+digest and unit bindings. Missing identities prevent `go`; request JSON cannot
+supply them as authority. The host must check these hashes against its own
+installation and evidence-producer records, not blindly copy a client's claims.
+The optional `review` callback is trusted host code, never deserialized request
+data. It receives the canonical repository, request, inventory digest, findings
+and a digest binding that exact review context. The host must verify evidence
+provenance, behavioral/compatibility coverage, risk classification, representative
+pilot selection and measurement receipts through its owning records. It returns
+`{ decision: 'accepted' | 'rejected', receipt: 'opaque-review-reference' }`.
+
+Callbacks get a detached copy and cannot rewrite the assessment's inputs or
+findings. A rejection, invalid receipt, unavailable review or absent host callback
+prevents `go`. The standalone CLI deliberately has no flag that turns an authored
+JSON report into independent review authority; it can still complete a read-only
+assessment and return the work to investigate. A future native host adapter must
+resolve review receipts through its existing authenticated owner.
+
+`go` means the supported, pinned plan has no unresolved assessment findings and
+its pilot evidence/coverage has been accepted by that host. It does not mean all
+manifest units were migrated or verified. Every unit remains `planned`. Neither
+the output digest nor an opaque review reference is portable authentication or
+execution permission. A workflow owner must validate current bindings and its own
+authority before dispatch; merely loading this report must never start work.
+
+## Measured ranges and work artifacts
+
+Every populated risk group, including high-risk units, requires a passing pilot,
+with representativeness checked by the host. The manifest shows coverage by risk
+group; one passing example does not establish coverage of every unit. A measurement
+records total pilot cost, work time (implementation plus verification), independent
+review time and an accounting evidence ID. Zero billed cost is valid for an
+evidenced local fixture; missing measurements are not represented as zero.
+
+Only accepted, fully qualified evidence produces estimates. Cost bounds multiply
+the observed pilot minimum/maximum by the exact manifest unit count. Lower time
+uses concurrency and dependency depth, then serial review; upper time assumes
+serial work and review. These are explicit extrapolation assumptions, not
+statistical confidence intervals. Unmeasured deployment, external data migration
+and operating costs are excluded. A lower bound over budget yields
+`do-not-migrate`; an overlapping range yields `investigate`.
+
+The manifest has stable source-path unit IDs, deterministic dependency ordering
+or cycle components, exact source blobs, per-unit binding digests and pilot
+references. Binding digests conservatively include the complete assessment inputs,
+including source/config/rules, logical revisions and exact kit/verifier hashes. A changed plan
+requires re-review; this version does not claim minimal per-unit invalidation or
+resume reconciliation. Execution must honor the pinned worker package artifact.
+
+The evidence storage plan names a project-relative directory, assessment/rulebook/
+manifest files and per-unit pin, verification, accounting and review artifacts.
+`written: false` makes its status explicit. Native Astrolift project/agent bindings,
+artifact persistence, conversational setup, reviewed compatibility exceptions,
+rule-update replay and resumable execution remain separate host integration work.

package/docs/migration-example-plan.json

@@ -0,0 +1,88 @@
+{
+  "format": "calliope.migration.verification-plan/v1",
+  "adapter": "javascript-to-typescript-cli/v1",
+  "verifier": "byte-parity-v1",
+  "runtime": {
+    "image": "sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205",
+    "node": "v24.22.1"
+  },
+  "source": {
+    "revision": "54bdcbfa6e40806cd709736e448bd50c453799ea",
+    "path": "source.mjs",
+    "object": "b96c6972d5a4bfc7e1c52fea78ba340ff24b97c5"
+  },
+  "negative": {
+    "revision": "54bdcbfa6e40806cd709736e448bd50c453799ea",
+    "path": "negative.mts",
+    "object": "0d6091a5c5d47ed8b4c97b7f74f296853fcc09a0"
+  },
+  "rules": {
+    "revision": "54bdcbfa6e40806cd709736e448bd50c453799ea",
+    "path": "RULES.md",
+    "object": "ece25894441e04857adea069e792b6f622fb2e7b"
+  },
+  "cases": [
+    {
+      "id": "positive",
+      "argument": "[1,2,3]",
+      "expected": {
+        "exitCode": 0,
+        "stdout": "{\"sum\":6,\"count\":3}\n",
+        "stderr": ""
+      }
+    },
+    {
+      "id": "empty",
+      "argument": "[]",
+      "expected": {
+        "exitCode": 0,
+        "stdout": "{\"sum\":0,\"count\":0}\n",
+        "stderr": ""
+      }
+    },
+    {
+      "id": "negative-values",
+      "argument": "[-2,5]",
+      "expected": {
+        "exitCode": 0,
+        "stdout": "{\"sum\":3,\"count\":2}\n",
+        "stderr": ""
+      }
+    },
+    {
+      "id": "invalid-type",
+      "argument": "[\"1\"]",
+      "expected": {
+        "exitCode": 2,
+        "stdout": "",
+        "stderr": "Expected an array of safe integers.\n"
+      }
+    },
+    {
+      "id": "invalid-json",
+      "argument": "not-json",
+      "expected": {
+        "exitCode": 2,
+        "stdout": "",
+        "stderr": "Invalid JSON.\n"
+      }
+    }
+  ],
+  "negativeControl": {
+    "caseId": "positive",
+    "expected": {
+      "exitCode": 0,
+      "stdout": "{\"sum\":9,\"count\":3}\n",
+      "stderr": ""
+    }
+  },
+  "limits": {
+    "commandTimeoutMs": 10000,
+    "totalMs": 120000
+  },
+  "candidate": {
+    "revision": "f4732441c67d285f5005ac0afb25d412c2d74f93",
+    "path": "candidate.mts",
+    "object": "4b551e05cce761a68a30a20207c47add9a9f4eff"
+  }
+}