@claudexor/orchestrator 1.0.1 → 2.1.2

package/dist/credential-profiles.js

@@ -0,0 +1,270 @@
+import { HarnessRunSpec as HarnessRunSpecSchema } from "@claudexor/schema";
+/**
+ * The ONE resolve owner for credential profiles (INV-135): explicit id →
+ * durable registry entry for exactly this harness. Unknown, disabled, or
+ * harness-mismatched ids throw a typed refusal — an explicit profile must
+ * never silently become the default credential ladder.
+ */
+export function resolveCredentialProfile(registry, wanted, harnessId) {
+    const match = registry.find((p) => p.profile_id === wanted && p.harness_id === harnessId);
+    if (!match) {
+        throw new Error(`credential profile "${wanted}" is not registered for harness "${harnessId}"`);
+    }
+    if (!match.enabled) {
+        throw new Error(`credential profile "${wanted}" (${harnessId}) is disabled`);
+    }
+    return match;
+}
+/**
+ * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
+ * profile's freshest snapshot windows against the policy threshold. Unknown
+ * usage is NOT a breach — rotation never triggers on missing data.
+ */
+export function profileHeadroomBreach(snapshots, harnessId, profileId, threshold) {
+    for (const snapshot of snapshots) {
+        // FRESH evidence only (release wave tier1 #3): a stale or unknown reading
+        // must never breach headroom, rotate a profile away, or fail selection.
+        if (snapshot.freshness !== "fresh")
+            continue;
+        if (snapshot.subject.harness !== harnessId)
+            continue;
+        if ((snapshot.subject.subject_id ?? null) !== profileId)
+            continue;
+        for (const constraint of snapshot.constraints) {
+            if (constraint.used_ratio !== null && constraint.used_ratio >= threshold) {
+                return {
+                    constraint_id: constraint.id,
+                    used_ratio: constraint.used_ratio,
+                    threshold,
+                    resets_at: constraint.resets_at,
+                };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * The next rotation target after `currentProfileId` (W5.4): policy order wins
+ * (`rotation_eligible`), else every enabled profile of the harness in registry
+ * order. The current profile and disabled/unknown ids never come back; a
+ * profile already over the headroom bound is skipped (rotating INTO a spent
+ * subscription is not a failover). Cross-subscription rotation of one vendor
+ * is allowed by owner decision — but rotation NEVER crosses credential kinds
+ * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
+ * the payment model mid-attempt, and the attempt's first-wins auth-route
+ * receipt (decided once before spawn) would misvalue metered usage as
+ * subscription entitlement, bypassing a finite cash cap.
+ */
+export function nextEligibleProfile(registry, harnessId, policy, current, snapshots, excluded = new Set()) {
+    const pool = registry.filter((p) => p.harness_id === harnessId && p.enabled);
+    const ordered = policy.rotation_eligible.length > 0
+        ? policy.rotation_eligible
+            .map((id) => pool.find((p) => p.profile_id === id))
+            .filter((p) => p !== undefined)
+        : pool;
+    for (const candidate of ordered) {
+        if (candidate.profile_id === current?.profile_id)
+            continue;
+        if (excluded.has(candidate.profile_id))
+            continue;
+        // Fail-CLOSED kind guard (round-17 hardening of the round-16 BLOCK): the
+        // kind comes from the TYPED current profile in hand — never re-found in
+        // a freshly reloaded pool, where a mid-flight disable/remove of the
+        // current profile would have silently dropped the cross-kind prohibition.
+        if (current !== null && candidate.credential_kind !== current.credential_kind)
+            continue;
+        // `current === null` is the DEFAULT subject (the vendor-native store): the
+        // same round-16 BLOCK applies — rotating the subscription default INTO an
+        // api_key profile would silently change the payment model mid-attempt.
+        if (current === null && candidate.credential_kind === "api_key")
+            continue;
+        if (profileHeadroomBreach(snapshots, harnessId, candidate.profile_id, policy.headroom_threshold))
+            continue;
+        return candidate;
+    }
+    return null;
+}
+/**
+ * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
+ * the attempt saw a TYPED vendor limit AND produced no deliverable and no
+ * workspace mutation — a partially-acted attempt never silently reruns.
+ */
+export function rotationRetryEligible(input) {
+    return input.sawTypedLimit && input.deliverableEmpty;
+}
+/**
+ * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
+ * freshest quota windows are checked against the policy threshold. A breach
+ * is always a typed event; `rotate` swaps to the next eligible profile with
+ * provenance, `ask`/`fail` proceed on the selected profile — the runtime
+ * `vendor_limit_rejected` evidence stays the terminating truth.
+ */
+export function preflightCredentialProfile(args) {
+    const { profile, harnessId, policy, registry, snapshots, emit } = args;
+    const breach = profileHeadroomBreach(snapshots, harnessId, profile.profile_id, policy.headroom_threshold);
+    if (!breach)
+        return profile;
+    emit("route.profile.headroom_exceeded", {
+        harness_id: harnessId,
+        profile_id: profile.profile_id,
+        action: policy.limit_action,
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        threshold: breach.threshold,
+        resets_at: breach.resets_at,
+    });
+    if (policy.limit_action === "fail") {
+        // The documented FAIL action fails (release wave tier1 #4): a FRESH breach
+        // under fail refuses before spawn with the evidence, instead of silently
+        // proceeding into a vendor rejection.
+        throw new Error(`credential profile "${profile.profile_id}" (${harnessId}) is over its headroom threshold ` +
+            `(${breach.constraint_id} at ${Math.round(breach.used_ratio * 100)}% >= ${Math.round(breach.threshold * 100)}%; ` +
+            `limit_action=fail${breach.resets_at ? `; resets ${breach.resets_at}` : ""})`);
+    }
+    if (policy.limit_action !== "rotate")
+        return profile;
+    const next = nextEligibleProfile(registry, harnessId, policy, profile, snapshots);
+    if (!next)
+        return profile;
+    emit("route.profile.rotated", {
+        harness_id: harnessId,
+        from_profile_id: profile.profile_id,
+        to_profile_id: next.profile_id,
+        reason: "profile_headroom_preflight",
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        resets_at: breach.resets_at,
+    });
+    return next;
+}
+/**
+ * Default-subject start selection (INV-135, owner scope "auto-balance"): when
+ * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
+ * fresh quota window is at/over the headroom bound, pick the first eligible
+ * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
+ * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
+ * (the profile engine's fail action governs PINNED profiles only — throwing
+ * here would brick every default user at 90% quota). Unknown or stale usage
+ * never rotates.
+ */
+export function preflightDefaultSubject(args) {
+    const { harnessId, policy, registry, snapshots, emit } = args;
+    if (policy.limit_action !== "rotate")
+        return null;
+    const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
+    if (!breach)
+        return null;
+    emit("route.profile.headroom_exceeded", {
+        harness_id: harnessId,
+        profile_id: null,
+        action: policy.limit_action,
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        threshold: breach.threshold,
+        resets_at: breach.resets_at,
+    });
+    const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots);
+    if (!next)
+        return null;
+    emit("route.profile.rotated", {
+        harness_id: harnessId,
+        from_profile_id: null,
+        to_profile_id: next.profile_id,
+        reason: "profile_headroom_preflight",
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        resets_at: breach.resets_at,
+    });
+    return next;
+}
+/**
+ * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
+ * on the typed predicate under a `rotate` policy, marks the current profile
+ * tried (at most once per attempt each), and returns the next target with
+ * provenance already emitted — or null when the attempt must fail as-is.
+ * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
+ * proves the attempt's pre-spawn route was vendor_native (a metered default
+ * hitting a limit is a budget fact, not a subscription to fail over from).
+ */
+export function planReactiveRotation(args) {
+    if (!rotationRetryEligible(args))
+        return null;
+    if (args.policy.limit_action !== "rotate")
+        return null;
+    if (args.currentProfile === null && args.defaultRouteWasVendorNative !== true)
+        return null;
+    if (args.currentProfile)
+        args.triedProfiles.add(args.currentProfile.profile_id);
+    const next = nextEligibleProfile(args.registry, args.harnessId, args.policy, args.currentProfile, args.snapshots, args.triedProfiles);
+    if (!next)
+        return null;
+    args.emit("route.profile.rotated", {
+        harness_id: args.harnessId,
+        attempt_id: args.attemptId,
+        from_profile_id: args.currentProfile?.profile_id ?? null,
+        to_profile_id: next.profile_id,
+        reason: "vendor_limit_rejected",
+        retry_delay_ms: args.lastLimit?.retryDelayMs ?? null,
+        resets_at: args.lastLimit?.resetsAt ?? null,
+    });
+    return next;
+}
+/**
+ * INV-135 at the engine boundary: a cached vendor session resumes ONLY under
+ * exactly the profile it was recorded with (null-default equality included) —
+ * regardless of what the caller's map claims. Preflight rotation changing the
+ * profile therefore starts fresh.
+ */
+export function resumeSessionForProfile(cached, profile) {
+    if (!cached)
+        return null;
+    return (cached.profileId ?? null) === (profile?.profile_id ?? null) ? cached.sessionId : null;
+}
+/**
+ * Record a harness-emitted native session id for future thread resume; the
+ * observer never fails the run. profileId is the adapter's per-event stamp —
+ * the EFFECTIVE profile (rotation makes it differ from the requested id).
+ */
+export function observeNativeSessionEvent(input, harnessId, ev) {
+    if (!input?.onSessionObserved || ev.type !== "started")
+        return;
+    const nid = ev.payload?.["native_session_id"];
+    if (typeof nid === "string" && nid.length > 0) {
+        try {
+            input.onSessionObserved(harnessId, nid, ev.observed_model ?? null, ev.credential_profile_id ?? null);
+        }
+        catch {
+            /* observer errors must never fail the run */
+        }
+    }
+}
+/**
+ * Shared reactive-failover step for BOTH lanes: given the attempt's typed
+ * evidence, plan a rotation and rebuild the spec on a NEW vendor session
+ * under the next profile — or return null when the attempt must fail as-is.
+ */
+export function rotateSpecOnTypedLimit(args) {
+    const rotation = planReactiveRotation({
+        currentProfile: args.spec.credential_profile ?? null,
+        defaultRouteWasVendorNative: args.defaultRouteWasVendorNative,
+        harnessId: args.harnessId,
+        attemptId: args.attemptId,
+        policy: args.policy,
+        registry: args.registry,
+        snapshots: args.snapshots,
+        triedProfiles: args.triedProfiles,
+        sawTypedLimit: args.sawTypedLimit,
+        deliverableEmpty: args.deliverableEmpty,
+        lastLimit: args.lastLimit,
+        emit: args.emit,
+    });
+    if (!rotation)
+        return null;
+    return HarnessRunSpecSchema.parse({
+        ...args.spec,
+        session_id: args.newSessionId(),
+        credential_profile: rotation,
+        resume_session_id: null,
+    });
+}
+//# sourceMappingURL=credential-profiles.js.map

package/dist/credential-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profiles.js","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAsC,EACtC,MAAc,EACd,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,oCAAoC,SAAS,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,MAAM,SAAS,eAAe,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmC,EACnC,SAAiB,EACjB,SAAwB,EACxB,SAAiB;IAEjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;YAAE,SAAS;QAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBACzE,OAAO;oBACL,aAAa,EAAE,UAAU,CAAC,EAAE;oBAC5B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,SAAS;oBACT,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAsC,EACtC,SAAiB,EACjB,MAAqB,EACrB,OAAyE,EACzE,SAAmC,EACnC,WAAgC,IAAI,GAAG,EAAE;IAEzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,OAAO,GACX,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,iBAAiB;aACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;aAClD,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO,EAAE,UAAU;YAAE,SAAS;QAC3D,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,SAAS;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;YAAE,SAAS;QACxF,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,SAAS;QAC1E,IACE,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC;YAE5F,SAAS;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,gBAAgB,CAAC;AACvD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAO1C;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,EACT,SAAS,EACT,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,kBAAkB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACnC,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,UAAU,MAAM,SAAS,mCAAmC;YACzF,IAAI,MAAM,CAAC,aAAa,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK;YACjH,oBAAoB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1B,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,OAAO,CAAC,UAAU;QACnC,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAapC;IACC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,IAAI,CAAC,cAAc;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,mBAAmB,CAC9B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;QACjC,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI;QACxD,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,uBAAuB;QAC/B,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,IAAI,IAAI;QACpD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,IAAI;KAC5C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmE,EACnE,OAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KASa,EACb,SAAiB,EACjB,EAAgB;IAEhB,IAAI,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,CAAC,iBAAiB,CACrB,SAAS,EACT,GAAG,EACH,EAAE,CAAC,cAAc,IAAI,IAAI,EACzB,EAAE,CAAC,qBAAqB,IAAI,IAAI,CACjC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAgBtC;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI;QACpD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,GAAG,IAAI,CAAC,IAAI;QACZ,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC/B,kBAAkB,EAAE,QAAQ;QAC5B,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/diffReview.d.ts

@@ -1,11 +1,19 @@
 import type { AuthPreference, ProviderFamily, ReviewFinding } from "@claudexor/schema";
 import { type ReviewerSpec, type reviewCandidate } from "@claudexor/review";
+export interface FrozenDiffReviewInput {
+    evidenceDir: string;
+    artifactsDir: string;
+    candidateSha: string;
+    candidateTree: string;
+    packetManifestSha256: string;
+}
 export interface DiffReviewInput {
     repoRoot: string;
-    diff: string;
+    diff?: string;
     userIntent?: string;
     tests?: string;
     decidedTradeoffs?: string;
+    frozen?: FrozenDiffReviewInput;
     authPreference?: AuthPreference;
     signal?: AbortSignal;
     onReviewerEvent?: (event: {

package/dist/diffReview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diffReview.d.ts","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIhG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACpC,WAAW,EAAE,OAAO,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjG,YAAY,EAAE,CACZ,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KACtD,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,eAAe,GAAG,OAAO,CAAC;CACjE;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuD3G"}
+{"version":3,"file":"diffReview.d.ts","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIhG,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACpC,WAAW,EAAE,OAAO,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjG,YAAY,EAAE,CACZ,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KACtD,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,eAAe,GAAG,OAAO,CAAC;CACjE;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAwF3B"}

package/dist/diffReview.js

@@ -5,21 +5,29 @@
  * resolution, evidence packaging, revalidation, and typed results; the CLI
  * verb stays a thin surface.
  */
-import { join } from "node:path";
-import { HarnessUnavailableError } from "@claudexor/core";
+import { existsSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { HarnessUnavailableError, runCapture, runCaptureRaw } from "@claudexor/core";
 import { revalidateFindings } from "@claudexor/review";
-import { writeEvidencePacket } from "@claudexor/context";
+import { verifySealedEvidencePacket, writeEvidencePacket } from "@claudexor/context";
 import { containsSecretLikeToken, redactSecrets } from "@claudexor/util";
 export async function runDiffReview(input, deps) {
-    if (!input.diff.trim()) {
+    if (input.frozen && input.diff !== undefined) {
+        throw new Error("reviewDiff: frozen review consumes DIFF.patch from the sealed packet");
+    }
+    if (!input.frozen && !input.diff?.trim()) {
         throw new Error("reviewDiff: the diff is empty — nothing to review");
     }
+    const frozen = input.frozen
+        ? await verifyFrozenReviewPacket(input.repoRoot, input.frozen, true)
+        : undefined;
+    const diff = frozen?.diff ?? input.diff ?? "";
     // INV-062: raw secrets must never become review artifacts. The fence lives
     // HERE so every caller (CLI verb, commit gate, future surfaces) is covered
     // before any evidence write or reviewer call — and it covers EVERY
     // artifact-bound string, not just the diff.
     for (const [label, text] of [
-        ["diff", input.diff],
+        ["diff", diff],
         ["userIntent", input.userIntent],
         ["tests", input.tests],
         ["decidedTradeoffs", input.decidedTradeoffs],
@@ -33,25 +41,45 @@ export async function runDiffReview(input, deps) {
         throw new HarnessUnavailableError("no eligible reviewers (doctor-OK, review-capable) are available");
     }
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const baseDir = join(deps.execRootOf(input.repoRoot), ".claudexor", "reviews", `diff-${stamp}`);
-    const evidenceDir = join(baseDir, "evidence");
-    writeEvidencePacket(evidenceDir, {
-        userIntent: redactSecrets(input.userIntent ?? "Review this staged diff for defects before commit."),
-        diff: input.diff,
-        tests: input.tests ?? "(no test evidence supplied)",
-        decidedTradeoffs: input.decidedTradeoffs,
-    });
+    const baseDir = input.frozen
+        ? undefined
+        : join(deps.execRootOf(input.repoRoot), ".claudexor", "reviews", `diff-${stamp}`);
+    const evidenceDir = frozen?.evidenceDir ?? join(baseDir, "evidence");
+    const artifactsDir = input.frozen?.artifactsDir ?? join(baseDir, "reviewers");
+    if (!input.frozen) {
+        writeEvidencePacket(evidenceDir, {
+            userIntent: redactSecrets(input.userIntent ?? "Review this staged diff for defects before commit."),
+            diff,
+            tests: input.tests ?? "(no test evidence supplied)",
+            decidedTradeoffs: input.decidedTradeoffs,
+        });
+    }
     const result = await deps.reviewScoped({
-        candidateLabel: "Staged diff",
-        diff: input.diff,
+        candidateLabel: input.frozen ? "Frozen candidate" : "Staged diff",
+        diff,
         evidenceDir,
-        artifactsDir: join(baseDir, "reviewers"),
+        artifactsDir,
+        evidenceReadOnly: input.frozen !== undefined,
+        ...(frozen
+            ? {
+                frozenIdentity: {
+                    candidateSha: input.frozen.candidateSha,
+                    candidateTree: input.frozen.candidateTree,
+                    packetManifestSha256: frozen.manifestSha256,
+                },
+            }
+            : {}),
         cwd: input.repoRoot,
         reviewers,
         envInheritance: deps.envInheritance(input.repoRoot),
         signal: input.signal,
-        onReviewerEvent: input.onReviewerEvent ? (event) => input.onReviewerEvent?.({ ...event }) : undefined,
+        onReviewerEvent: input.onReviewerEvent
+            ? (event) => input.onReviewerEvent?.({ ...event })
+            : undefined,
     });
+    if (input.frozen) {
+        await verifyFrozenReviewPacket(input.repoRoot, input.frozen, false);
+    }
     const findings = await revalidateFindings(result.findings, {
         candidateRoot: input.repoRoot,
         evidenceDir,
@@ -63,7 +91,75 @@ export async function runDiffReview(input, deps) {
         distinctProviders: result.distinctProviders,
         routeProofs: result.routeProofs,
         reviewSpendUsd: result.reviewSpendUsd,
-        artifactsDir: join(baseDir, "reviewers"),
+        artifactsDir,
+    };
+}
+async function verifyFrozenReviewPacket(repoRootInput, frozen, artifactsMustNotExist) {
+    const repoRoot = realpathSync(repoRootInput);
+    const evidenceDir = realpathSync(frozen.evidenceDir);
+    const artifactsDir = resolve(frozen.artifactsDir);
+    if (artifactsMustNotExist && existsSync(artifactsDir)) {
+        throw new Error("reviewDiff: reviewer artifacts directory already exists");
+    }
+    if (isWithin(repoRoot, evidenceDir)) {
+        throw new Error("reviewDiff: frozen evidence directory must be outside the candidate tree");
+    }
+    if (isWithin(repoRoot, artifactsDir)) {
+        throw new Error("reviewDiff: reviewer artifacts directory must be outside the candidate tree");
+    }
+    if (isWithin(evidenceDir, artifactsDir) || isWithin(artifactsDir, evidenceDir)) {
+        throw new Error("reviewDiff: sealed evidence and reviewer artifacts directories must not overlap");
+    }
+    const [actualSha, actualTree, status] = await Promise.all([
+        git(repoRoot, ["rev-parse", "HEAD"]),
+        git(repoRoot, ["rev-parse", "HEAD^{tree}"]),
+        git(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]),
+    ]);
+    if (actualSha !== frozen.candidateSha) {
+        throw new Error(`reviewDiff: candidate SHA mismatch (expected ${frozen.candidateSha}, got ${actualSha})`);
+    }
+    if (actualTree !== frozen.candidateTree) {
+        throw new Error(`reviewDiff: candidate tree mismatch (expected ${frozen.candidateTree}, got ${actualTree})`);
+    }
+    if (status !== "") {
+        throw new Error("reviewDiff: frozen candidate worktree is dirty or stale");
+    }
+    const packet = verifySealedEvidencePacket({
+        evidenceDir,
+        candidateSha: frozen.candidateSha,
+        candidateTree: frozen.candidateTree,
+        expectedManifestSha256: frozen.packetManifestSha256,
+    });
+    const actualDiff = await gitRaw(repoRoot, [
+        "diff",
+        "--binary",
+        `${packet.baseSha}..${frozen.candidateSha}`,
+    ]);
+    if (packet.diff !== actualDiff) {
+        throw new Error("reviewDiff: sealed DIFF.patch does not match base..candidate");
+    }
+    return {
+        evidenceDir: packet.evidenceDir,
+        diff: packet.diff,
+        manifestSha256: packet.manifestSha256,
     };
 }
+async function git(cwd, args) {
+    const result = await runCapture("git", args, { cwd });
+    if (result.code !== 0) {
+        throw new Error(`reviewDiff: git ${args.join(" ")} failed: ${(result.stderr || result.stdout).trim()}`);
+    }
+    return result.stdout.trim();
+}
+async function gitRaw(cwd, args) {
+    const result = await runCaptureRaw("git", args, { cwd });
+    if (result.code !== 0) {
+        throw new Error(`reviewDiff: git ${args.join(" ")} failed: ${(result.stderr || result.stdout).trim()}`);
+    }
+    return result.stdout;
+}
+function isWithin(root, candidate) {
+    const path = relative(root, candidate);
+    return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+}
 //# sourceMappingURL=diffReview.js.map

package/dist/diffReview.js.map

@@ -1 +1 @@
-{"version":3,"file":"diffReview.js","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAA2C,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAgCzE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB,EAAE,IAAoB;IAC9E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,4CAA4C;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACtB,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC;KACpC,EAAE,CAAC;QACX,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,0EAA0E,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,iEAAiE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,CAAC,WAAW,EAAE;QAC/B,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,IAAI,oDAAoD,CAAC;QACnG,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B;QACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;QACrC,cAAc,EAAE,aAAa;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;QACxC,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,SAAS;QACT,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KACtG,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE;QACzD,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,WAAW;KACZ,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diffReview.js","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAA2C,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAyCzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAsB,EACtB,IAAoB;IAEpB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QACpE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9C,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,4CAA4C;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,CAAC,MAAM,EAAE,IAAI,CAAC;QACd,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACtB,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC;KACpC,EAAE,CAAC;QACX,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,0EAA0E,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,OAAQ,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,OAAQ,EAAE,WAAW,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,mBAAmB,CAAC,WAAW,EAAE;YAC/B,UAAU,EAAE,aAAa,CACvB,KAAK,CAAC,UAAU,IAAI,oDAAoD,CACzE;YACD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B;YACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;QACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa;QACjE,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,gBAAgB,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5C,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,cAAc,EAAE;oBACd,YAAY,EAAE,KAAK,CAAC,MAAO,CAAC,YAAY;oBACxC,aAAa,EAAE,KAAK,CAAC,MAAO,CAAC,aAAa;oBAC1C,oBAAoB,EAAE,MAAM,CAAC,cAAc;iBAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,SAAS;QACT,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;YACpC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;YAClD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE;QACzD,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,WAAW;KACZ,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY;KACb,CAAC;AACJ,CAAC;AAQD,KAAK,UAAU,wBAAwB,CACrC,aAAqB,EACrB,MAA6B,EAC7B,qBAA8B;IAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,qBAAqB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,YAAY,SAAS,SAAS,GAAG,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,aAAa,SAAS,UAAU,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,sBAAsB,EAAE,MAAM,CAAC,oBAAoB;KACpD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE;QACxC,MAAM;QACN,UAAU;QACV,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,EAAE;KAC5C,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7F,CAAC"}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./orchestrator.js";
+export * from "./requestRequirements.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC"}

package/dist/index.js

@@ -1,2 +1,3 @@
 export * from "./orchestrator.js";
+export * from "./requestRequirements.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC"}

package/dist/modelGovernance.d.ts

@@ -9,10 +9,15 @@
  * cannot run is a config bug better caught before the run than mid-run.
  */
 import type { HarnessAdapter } from "@claudexor/core";
+import { type KnownModelEntry } from "@claudexor/schema";
 export interface ModelGovernedRoute {
     adapter: HarnessAdapter;
     /** Manifest model truth source (used when the adapter has no live models()). */
-    knownModels: readonly string[];
+    knownModels: readonly KnownModelEntry[];
+    /** Pre-spawn credential-route estimate: route-annotated manifest models are
+     * filtered by it, and stay EXCLUDED when it is null (fail-closed — a
+     * route-scoped model never passes the gate on an undecidable route). */
+    authRouteEstimate: "local_session" | "api_key" | null;
     settings: {
         defaultModel: string | null;
         fallbackModel: string | null;

package/dist/modelGovernance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelGovernance.d.ts","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,gFAAgF;IAChF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAChF;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CA6Bf"}
+{"version":3,"file":"modelGovernance.d.ts","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,gFAAgF;IAChF,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC;;4EAEwE;IACxE,iBAAiB,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACtD,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAChF;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAkCf"}

package/dist/modelGovernance.js

@@ -1,4 +1,5 @@
 import { HarnessUnavailableError, validateModel } from "@claudexor/core";
+import { knownModelIdsForRoute } from "@claudexor/schema";
 export async function assertRouteModelsAllowed(routes, models, cwd) {
     const checked = new Set();
     for (const routed of routes) {
@@ -19,12 +20,17 @@ export async function assertRouteModelsAllowed(routes, models, cwd) {
             truth = { list: inventory.map((m) => m.id), source: "api" };
         }
         else {
-            truth = { list: routed.knownModels, source: "manifest" };
+            // Route-aware manifest truth (INV-104 x INV-061): route-annotated models
+            // count only on their routes; an undecidable route excludes them.
+            truth = {
+                list: knownModelIdsForRoute(routed.knownModels, routed.authRouteEstimate),
+                source: "manifest",
+            };
         }
         for (const { role, model } of candidates) {
             const check = validateModel(model, truth.list, truth.source);
             if (check.status !== "ok") {
-                throw new HarnessUnavailableError(`harness '${id}' refused ${role} '${model}' (truth source: ${truth.source}): ${check.message}; ` +
+                throw new HarnessUnavailableError(`harness '${id}' refused ${role} '${model}' (truth source: ${truth.source}${truth.source === "manifest" ? `, route: ${routed.authRouteEstimate ?? "undecided"}` : ""}): ${check.message}; ` +
                     `run \`claudexor models --harness ${id}\``);
             }
         }

package/dist/modelGovernance.js.map

@@ -1 +1 @@
-{"version":3,"file":"modelGovernance.js","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AASzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqC,EACrC,MAA0C,EAC1C,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;QACvE,MAAM,UAAU,GAAG;YACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE;SAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,IAAI,KAA8D,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAC/B,YAAY,EAAE,aAAa,IAAI,KAAK,KAAK,oBAAoB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,IAAI;oBAC9F,oCAAoC,EAAE,IAAI,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"modelGovernance.js","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,mBAAmB,CAAC;AAahF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqC,EACrC,MAA0C,EAC1C,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;QACvE,MAAM,UAAU,GAAG;YACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE;SAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,IAAI,KAA8D,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,kEAAkE;YAClE,KAAK,GAAG;gBACN,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC;gBACzE,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAC/B,YAAY,EAAE,aAAa,IAAI,KAAK,KAAK,oBAAoB,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,OAAO,IAAI;oBACzL,oCAAoC,EAAE,IAAI,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/orchestrateExecutor.d.ts

@@ -0,0 +1,43 @@
+import type { ArtifactStore } from "@claudexor/artifact-store";
+import type { EventLog } from "@claudexor/event-log";
+import type { BudgetLedger } from "@claudexor/budget";
+import { type DeliveryReceipt, type OrchestrateAutonomy, type OrchestratePlan, type OrchestratePlanCall, type OrchestrateStepStatus, type RunStatus } from "@claudexor/schema";
+export interface OrchestrateSafeStepResult {
+    status: OrchestrateStepStatus;
+    terminalStatus: RunStatus | null;
+    terminalSource: "subrun" | "review" | "executor";
+    evidenceRefs: string[];
+    runId: string | null;
+    detail: string | null;
+    spendUsd?: number | null;
+}
+export interface OrchestrateApplyStepResult {
+    ok: boolean;
+    runId: string;
+    detail: string;
+    receipt: DeliveryReceipt | null;
+}
+interface ExecuteOrchestratePlanInput {
+    plan: OrchestratePlan;
+    autonomy: OrchestrateAutonomy;
+    maxToolCalls: number | null;
+    ledger: BudgetLedger;
+    signal?: AbortSignal;
+    store: ArtifactStore;
+    paths: ReturnType<ArtifactStore["runPaths"]>;
+    log: EventLog;
+    executeSafeStep(call: OrchestratePlanCall): Promise<OrchestrateSafeStepResult>;
+    executeApplyStep(call: Extract<OrchestratePlanCall, {
+        tool: "apply";
+    }>): Promise<OrchestrateApplyStepResult>;
+}
+export interface OrchestrateExecutionResult {
+    terminal: RunStatus;
+    note: string;
+    readOnly: boolean;
+    receiptRefs: string[];
+}
+/** Ordered executor; terminal truth is delegated to the exhaustive outcome reducer. */
+export declare function executeOrchestratePlan(input: ExecuteOrchestratePlanInput): Promise<OrchestrateExecutionResult>;
+export {};
+//# sourceMappingURL=orchestrateExecutor.d.ts.map

package/dist/orchestrateExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrateExecutor.d.ts","sourceRoot":"","sources":["../src/orchestrateExecutor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAExB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAO3B,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,SAAS,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IACjD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAED,UAAU,2BAA2B;IACnC,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7C,GAAG,EAAE,QAAQ,CAAC;IACd,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/E,gBAAgB,CACd,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,GACpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAuMrC"}