@claudexor/orchestrator 1.0.1 → 2.1.2

package/dist/outcomeReducer.d.ts

@@ -0,0 +1,25 @@
+import { type DeliveryReceipt, type RunStatus } from "@claudexor/schema";
+export interface OrchestrateStepOutcome {
+    required: boolean;
+    executionStatus: "pending" | "running" | "done" | "skipped" | "blocked" | "failed";
+    terminalStatus: RunStatus | null;
+}
+export declare function isSuccessfulOrchestrateTerminal(status: RunStatus | null): boolean;
+/** Parent success is legal only when every required step has a successful terminal. */
+export declare function reduceOrchestrateOutcome(steps: readonly OrchestrateStepOutcome[]): RunStatus;
+/** Delivery receipts, not the requested autonomy, determine whether execution mutated state. */
+export declare function deliveryReceiptMutated(receipt: DeliveryReceipt): boolean;
+export interface ReferencedRunStatus {
+    status: RunStatus | null;
+    detail: string;
+    evidenceRefs: string[];
+}
+export declare function readRunStatus(repoRoot: string, runId: string): ReferencedRunStatus | null;
+export interface OrchestrateFailureDescriptor {
+    phase: "plan" | "executor";
+    category: "policy" | "internal" | "harness_error" | "budget";
+    safeMessage: string;
+    nextActions: string[];
+}
+export declare function orchestrateFailureFor(status: RunStatus): OrchestrateFailureDescriptor | null;
+//# sourceMappingURL=outcomeReducer.d.ts.map

package/dist/outcomeReducer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomeReducer.d.ts","sourceRoot":"","sources":["../src/outcomeReducer.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnF,cAAc,EAAE,SAAS,GAAG,IAAI,CAAC;CAClC;AAqCD,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAEjF;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAG5F;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAExE;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CA0BzF;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,eAAe,GAAG,QAAQ,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,4BAA4B,GAAG,IAAI,CA4C5F"}

package/dist/outcomeReducer.js

@@ -0,0 +1,121 @@
+import { join } from "node:path";
+import { ArtifactStore } from "@claudexor/artifact-store";
+import { RunStatus as RunStatusSchema, } from "@claudexor/schema";
+const PRECEDENCE = [
+    "failed",
+    "interrupted_unknown",
+    "blocked",
+    "cost_unverifiable",
+    "exhausted_overshoot",
+    "exhausted",
+    "not_converged",
+    "stuck_no_progress",
+    "cancelled",
+    "success",
+];
+function normalizedTerminal(step) {
+    if (!step.required)
+        return null;
+    if (step.executionStatus === "failed")
+        return "failed";
+    if (step.executionStatus === "blocked")
+        return "blocked";
+    if (step.executionStatus === "skipped") {
+        if (step.terminalStatus === "cancelled" ||
+            step.terminalStatus === "interrupted_unknown" ||
+            step.terminalStatus === "cost_unverifiable" ||
+            step.terminalStatus === "exhausted_overshoot" ||
+            step.terminalStatus === "exhausted")
+            return step.terminalStatus;
+        return "blocked";
+    }
+    if (step.executionStatus === "pending" || step.executionStatus === "running")
+        return "blocked";
+    if (step.terminalStatus === "no_op")
+        return "success";
+    if (step.terminalStatus === "ungated" || step.terminalStatus === "review_not_run")
+        return "blocked";
+    return step.terminalStatus ?? "blocked";
+}
+export function isSuccessfulOrchestrateTerminal(status) {
+    return status === "success" || status === "no_op";
+}
+/** Parent success is legal only when every required step has a successful terminal. */
+export function reduceOrchestrateOutcome(steps) {
+    const actual = steps.map(normalizedTerminal).filter((status) => !!status);
+    return PRECEDENCE.find((status) => actual.includes(status)) ?? "success";
+}
+/** Delivery receipts, not the requested autonomy, determine whether execution mutated state. */
+export function deliveryReceiptMutated(receipt) {
+    return receipt.treeMutated ?? (receipt.applied && receipt.mode !== "artifact_only");
+}
+export function readRunStatus(repoRoot, runId) {
+    const store = new ArtifactStore(repoRoot);
+    const paths = store.runPaths(runId);
+    const decision = store.readYaml(join(paths.arbitrationDir, "decision.yaml"));
+    const workProduct = store.readYaml(join(paths.finalDir, "work_product.yaml"));
+    if (!decision && !workProduct)
+        return null;
+    const status = RunStatusSchema.safeParse(decision?.status);
+    const details = [
+        decision?.status ? `decision=${decision.status}` : null,
+        workProduct?.meta?.["result_kind"]
+            ? `result_kind=${String(workProduct.meta["result_kind"])}`
+            : null,
+        workProduct?.meta?.["apply_state"]
+            ? `apply_state=${String(workProduct.meta["apply_state"])}`
+            : null,
+    ].filter((value) => !!value);
+    return {
+        status: status.success ? status.data : null,
+        detail: details.join(", ") || `run ${runId}: artifacts present`,
+        evidenceRefs: [
+            ...(decision ? [`run:${runId}/arbitration/decision.yaml`] : []),
+            ...(workProduct ? [`run:${runId}/final/work_product.yaml`] : []),
+        ],
+    };
+}
+export function orchestrateFailureFor(status) {
+    switch (status) {
+        case "blocked":
+            return {
+                phase: "executor",
+                category: "policy",
+                safeMessage: "orchestrate has required work that did not succeed (including skipped, ungated, missing-review, or risky steps); inspect the typed progress record",
+                nextActions: [
+                    "Inspect final/orchestration_progress.yaml",
+                    "Resolve or retry the blocked step",
+                ],
+            };
+        case "failed":
+        case "interrupted_unknown":
+            return {
+                phase: "executor",
+                category: "internal",
+                safeMessage: `orchestrate ended ${status}; inspect the typed progress record`,
+                nextActions: ["Inspect final/orchestration_progress.yaml", "Retry the failed step"],
+            };
+        case "not_converged":
+        case "stuck_no_progress":
+            return {
+                phase: "plan",
+                category: "harness_error",
+                safeMessage: status === "not_converged"
+                    ? "orchestrate produced no valid typed plan or a required child did not converge"
+                    : "orchestrate made no progress on a required step",
+                nextActions: ["Inspect orchestration artifacts", "Re-run orchestrate"],
+            };
+        case "cost_unverifiable":
+        case "exhausted_overshoot":
+        case "exhausted":
+            return {
+                phase: "executor",
+                category: "budget",
+                safeMessage: `orchestrate ended ${status}; inspect its budget and progress evidence`,
+                nextActions: ["Inspect final/orchestration_progress.yaml", "Adjust the budget and retry"],
+            };
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=outcomeReducer.js.map

package/dist/outcomeReducer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomeReducer.js","sourceRoot":"","sources":["../src/outcomeReducer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACL,SAAS,IAAI,eAAe,GAG7B,MAAM,mBAAmB,CAAC;AAQ3B,MAAM,UAAU,GAAyB;IACvC,QAAQ;IACR,qBAAqB;IACrB,SAAS;IACT,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;CACV,CAAC;AAEF,SAAS,kBAAkB,CAAC,IAA4B;IACtD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,eAAe,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACvD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,IACE,IAAI,CAAC,cAAc,KAAK,WAAW;YACnC,IAAI,CAAC,cAAc,KAAK,qBAAqB;YAC7C,IAAI,CAAC,cAAc,KAAK,mBAAmB;YAC3C,IAAI,CAAC,cAAc,KAAK,qBAAqB;YAC7C,IAAI,CAAC,cAAc,KAAK,WAAW;YAEnC,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/F,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAC/E,OAAO,SAAS,CAAC;IACnB,OAAO,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAwB;IACtE,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,CAAC;AACpD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,KAAwC;IAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAuB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC;AAC3E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,OAAwB;IAC7D,OAAO,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;AACtF,CAAC;AAQD,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAa;IAC3D,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAsB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAC1C,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QACvD,WAAW,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC;YAChC,CAAC,CAAC,eAAe,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;YAC1D,CAAC,CAAC,IAAI;QACR,WAAW,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC;YAChC,CAAC,CAAC,eAAe,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;YAC1D,CAAC,CAAC,IAAI;KACT,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,qBAAqB;QAC/D,YAAY,EAAE;YACZ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO;gBACL,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EACT,oJAAoJ;gBACtJ,WAAW,EAAE;oBACX,2CAA2C;oBAC3C,mCAAmC;iBACpC;aACF,CAAC;QACJ,KAAK,QAAQ,CAAC;QACd,KAAK,qBAAqB;YACxB,OAAO;gBACL,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,qBAAqB,MAAM,qCAAqC;gBAC7E,WAAW,EAAE,CAAC,2CAA2C,EAAE,uBAAuB,CAAC;aACpF,CAAC;QACJ,KAAK,eAAe,CAAC;QACrB,KAAK,mBAAmB;YACtB,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,eAAe;gBACzB,WAAW,EACT,MAAM,KAAK,eAAe;oBACxB,CAAC,CAAC,+EAA+E;oBACjF,CAAC,CAAC,iDAAiD;gBACvD,WAAW,EAAE,CAAC,iCAAiC,EAAE,oBAAoB,CAAC;aACvE,CAAC;QACJ,KAAK,mBAAmB,CAAC;QACzB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO;gBACL,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,qBAAqB,MAAM,4CAA4C;gBACpF,WAAW,EAAE,CAAC,2CAA2C,EAAE,6BAA6B,CAAC;aAC1F,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/policyFindings.d.ts

@@ -0,0 +1,18 @@
+import type { ProtectedPathApproval, ReviewFinding } from "@claudexor/schema";
+/**
+ * Deterministic policy findings from the typed diff (no LLM, no regex over
+ * prose): protected-path changes and critical-risk diffs escalate NEEDS_HUMAN;
+ * a high-risk diff without a cross-family panel escalates as well. Each
+ * finding cites the matched files as evidence (BIBLE: evidence beats summaries).
+ */
+export declare function policyFindings(run: {
+    diff: string;
+}, reviewVerified: boolean, protectedPaths?: string[], autoProtectedPaths?: string[], protectedPathApprovals?: ProtectedPathApproval[], denyPaths?: string[]): {
+    findings: ReviewFinding[];
+    risk: {
+        level: string;
+        reasons: string[];
+        changedFiles: number;
+    };
+};
+//# sourceMappingURL=policyFindings.d.ts.map

package/dist/policyFindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyFindings.d.ts","sourceRoot":"","sources":["../src/policyFindings.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAI9E;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACrB,cAAc,EAAE,OAAO,EACvB,cAAc,GAAE,MAAM,EAAO,EAC7B,kBAAkB,GAAE,MAAM,EAAO,EACjC,sBAAsB,GAAE,qBAAqB,EAAO,EACpD,SAAS,GAAE,MAAM,EAAO,GACvB;IACD,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE,CAyKA"}

package/dist/policyFindings.js

@@ -0,0 +1,166 @@
+import { matchAny } from "@claudexor/context";
+import { classifyRisk, DEFAULT_REQUIRE_HUMAN_PATHS, requireHuman, reviewDepthForRisk, } from "@claudexor/policy";
+import { summarizeDiffPaths as diffStats } from "@claudexor/core";
+import { ReviewFinding as ReviewFindingSchema } from "@claudexor/schema";
+import { newId } from "@claudexor/util";
+/**
+ * Deterministic policy findings from the typed diff (no LLM, no regex over
+ * prose): protected-path changes and critical-risk diffs escalate NEEDS_HUMAN;
+ * a high-risk diff without a cross-family panel escalates as well. Each
+ * finding cites the matched files as evidence (BIBLE: evidence beats summaries).
+ */
+export function policyFindings(run, reviewVerified, protectedPaths = [], autoProtectedPaths = [], protectedPathApprovals = [], denyPaths = []) {
+    const stats = diffStats(run.diff);
+    // Path policy gates match stats.touchedPaths — the one owner of "what the
+    // diff touches" (core diff.ts, G1 class); a gate matching a narrower
+    // projection is an EXPLICIT decision, never an accident. deny_paths: ANY
+    // touch of a denied glob is a violation — create, modify, delete, or
+    // either end of a rename. Contract protected_paths: creating a NEW file
+    // under a protected glob (or renaming into it) is tamper exactly like
+    // editing an existing one. Same matcher as every other path policy
+    // (INV-122).
+    const denyViolation = requireHuman(stats.touchedPaths, denyPaths);
+    const approvalPatterns = protectedPathApprovals.map((approval) => approval.path);
+    // AUTO-protected (gate/test files) deliberately matches existingPaths
+    // only: creating a new test/package file is the normal create/test-
+    // authoring flow, not tamper (pinned by test) — only touching an EXISTING
+    // gate input escalates.
+    const unapprovedAutoProtectedPaths = stats.existingPaths.filter((path) => !matchAny(path, approvalPatterns));
+    const specProtectedOnly = requireHuman(stats.touchedPaths, protectedPaths);
+    const autoProtectedOnly = requireHuman(unapprovedAutoProtectedPaths, autoProtectedPaths);
+    const protectedOnly = {
+        required: specProtectedOnly.required || autoProtectedOnly.required,
+        reasons: [...new Set([...specProtectedOnly.reasons, ...autoProtectedOnly.reasons])],
+        matchedPaths: [
+            ...new Set([...specProtectedOnly.matchedPaths, ...autoProtectedOnly.matchedPaths]),
+        ],
+    };
+    // classifyRisk's built-in pattern sets (sensitive resources, critical/high
+    // paths) are themselves a human-approval gate, so they match the TOUCHED
+    // set like every other path policy — `git mv .env config/settings.txt`
+    // must stay critical, and no other gate would recover it (G1 class,
+    // security commit 4e9e2270). Its file COUNT is a separate fact: renames
+    // touch two paths but change one file.
+    const risk = classifyRisk({
+        changedPaths: stats.touchedPaths,
+        fileCount: stats.paths.length,
+        additions: stats.additions,
+        deletions: stats.deletions,
+        protectedPaths: protectedOnly.matchedPaths,
+    });
+    const findings = [];
+    const reviewer = {
+        harness_id: "policy",
+        requested_model: null,
+        requested_effort: null,
+        observed_model: null,
+        route_proof_status: "verified",
+    };
+    const evidenceFor = (reasons) => ({
+        files: stats.touchedPaths
+            .filter((p) => reasons.some((r) => r.includes(p)))
+            .map((path) => ({ path, lines: null })),
+    });
+    // Structured matched-path evidence (never reconstructed from prose).
+    const evidenceFromPaths = (paths) => ({
+        files: paths.map((path) => ({ path, lines: null })),
+    });
+    const denyReasons = denyViolation.matchedPaths.map((path) => `candidate touched denied path ${path}`);
+    const reportedRisk = protectedOnly.required || denyViolation.required
+        ? {
+            level: "critical",
+            reasons: [
+                ...new Set([
+                    ...risk.reasons,
+                    ...protectedOnly.reasons,
+                    ...(denyViolation.required ? denyReasons : []),
+                ]),
+            ],
+            matchedPaths: [
+                ...new Set([
+                    ...risk.matchedPaths,
+                    ...protectedOnly.matchedPaths,
+                    ...denyViolation.matchedPaths,
+                ]),
+            ],
+        }
+        : risk;
+    if (denyViolation.required) {
+        // Authoritative post-diff deny gate: a BLOCK finding keeps the patch
+        // undelivered (blocked); only an operator accept_risk decision may still
+        // deliver it (INV-111 — the human is the final authority).
+        findings.push(ReviewFindingSchema.parse({
+            id: newId("find"),
+            severity: "BLOCK",
+            category: "security",
+            claim: `candidate touched denied path(s) (deny_paths): ${denyViolation.matchedPaths.join(", ")}`,
+            evidence: evidenceFromPaths(denyViolation.matchedPaths),
+            reviewer,
+            status: "accepted",
+        }));
+    }
+    if (protectedOnly.required) {
+        findings.push(ReviewFindingSchema.parse({
+            id: newId("find"),
+            severity: "BLOCK",
+            category: "test_gap",
+            claim: `candidate changed protected path(s): ${protectedOnly.matchedPaths.join(", ")}`,
+            evidence: evidenceFromPaths(protectedOnly.matchedPaths),
+            reviewer,
+            status: "accepted",
+        }));
+    }
+    const builtInHuman = requireHuman(stats.touchedPaths, DEFAULT_REQUIRE_HUMAN_PATHS);
+    const human = {
+        required: builtInHuman.required || protectedOnly.required,
+        reasons: [...new Set([...builtInHuman.reasons, ...protectedOnly.reasons])],
+        matchedPaths: [...new Set([...builtInHuman.matchedPaths, ...protectedOnly.matchedPaths])],
+    };
+    if (human.required) {
+        findings.push(ReviewFindingSchema.parse({
+            id: newId("find"),
+            severity: "NEEDS_HUMAN",
+            category: "security",
+            claim: `protected-path change requires human approval: ${human.reasons.join("; ")}`,
+            evidence: evidenceFromPaths(human.matchedPaths),
+            reviewer,
+            status: "accepted",
+        }));
+    }
+    const depth = reviewDepthForRisk(reportedRisk.level);
+    if (depth.humanApproval) {
+        findings.push(ReviewFindingSchema.parse({
+            id: newId("find"),
+            severity: "NEEDS_HUMAN",
+            category: "security",
+            claim: `critical-risk diff requires human approval: ${reportedRisk.reasons.join("; ")}`,
+            evidence: reportedRisk.matchedPaths.length > 0
+                ? evidenceFromPaths(reportedRisk.matchedPaths)
+                : evidenceFor(reportedRisk.reasons),
+            reviewer,
+            status: "accepted",
+        }));
+    }
+    else if (depth.crossFamily && !reviewVerified) {
+        findings.push(ReviewFindingSchema.parse({
+            id: newId("find"),
+            severity: "NEEDS_HUMAN",
+            category: "architecture",
+            claim: `high-risk diff requires a cross-family review panel (>=2 provider families), which is not available: ${reportedRisk.reasons.join("; ")}`,
+            evidence: reportedRisk.matchedPaths.length > 0
+                ? evidenceFromPaths(reportedRisk.matchedPaths)
+                : evidenceFor(reportedRisk.reasons),
+            reviewer,
+            status: "accepted",
+        }));
+    }
+    return {
+        findings,
+        risk: {
+            level: reportedRisk.level,
+            reasons: reportedRisk.reasons,
+            changedFiles: stats.paths.length,
+        },
+    };
+}
+//# sourceMappingURL=policyFindings.js.map

package/dist/policyFindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyFindings.js","sourceRoot":"","sources":["../src/policyFindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,YAAY,EACZ,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,IAAI,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAqB,EACrB,cAAuB,EACvB,iBAA2B,EAAE,EAC7B,qBAA+B,EAAE,EACjC,yBAAkD,EAAE,EACpD,YAAsB,EAAE;IAKxB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,aAAa;IACb,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjF,sEAAsE;IACtE,oEAAoE;IACpE,0EAA0E;IAC1E,wBAAwB;IACxB,MAAM,4BAA4B,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAC5C,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,YAAY,CAAC,4BAA4B,EAAE,kBAAkB,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ;QAClE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACnF,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;SACnF;KACF,CAAC;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,aAAa,CAAC,YAAY;KAC3C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,QAAQ;QACpB,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,kBAAkB,EAAE,UAAmB;KACxC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,OAAiB,EAAE,EAAE,CAAC,CAAC;QAC1C,KAAK,EAAE,KAAK,CAAC,YAAY;aACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAC1C,CAAC,CAAC;IACH,qEAAqE;IACrE,MAAM,iBAAiB,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,CAAC;QAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,GAAG,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,iCAAiC,IAAI,EAAE,CAClD,CAAC;IACF,MAAM,YAAY,GAChB,aAAa,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ;QAC9C,CAAC,CAAC;YACE,KAAK,EAAE,UAAmB;YAC1B,OAAO,EAAE;gBACP,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,IAAI,CAAC,OAAO;oBACf,GAAG,aAAa,CAAC,OAAO;oBACxB,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/C,CAAC;aACH;YACD,YAAY,EAAE;gBACZ,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,IAAI,CAAC,YAAY;oBACpB,GAAG,aAAa,CAAC,YAAY;oBAC7B,GAAG,aAAa,CAAC,YAAY;iBAC9B,CAAC;aACH;SACF;QACH,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC3B,qEAAqE;QACrE,yEAAyE;QACzE,2DAA2D;QAC3D,QAAQ,CAAC,IAAI,CACX,mBAAmB,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,kDAAkD,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChG,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC;YACvD,QAAQ;YACR,MAAM,EAAE,UAAU;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CACX,mBAAmB,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,wCAAwC,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtF,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,YAAY,CAAC;YACvD,QAAQ;YACR,MAAM,EAAE,UAAU;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG;QACZ,QAAQ,EAAE,YAAY,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ;QACzD,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,YAAY,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;KAC1F,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CACX,mBAAmB,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,kDAAkD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACnF,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC;YAC/C,QAAQ;YACR,MAAM,EAAE,UAAU;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,YAAY,CAAC,KAAc,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,mBAAmB,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,+CAA+C,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvF,QAAQ,EACN,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC9C,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC;YACvC,QAAQ;YACR,MAAM,EAAE,UAAU;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,mBAAmB,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,wGAAwG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChJ,QAAQ,EACN,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC9C,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC;YACvC,QAAQ;YACR,MAAM,EAAE,UAAU;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ;QACR,IAAI,EAAE;YACJ,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;SACjC;KACF,CAAC;AACJ,CAAC"}

package/dist/requestRequirements.d.ts

@@ -0,0 +1,38 @@
+import type { AccessProfile, Attachment, AttachmentInputClass, ExternalContextPolicy, ImplementationTransport, Intent, RequestRequirementResolution } from "@claudexor/schema";
+import { HarnessUnavailableError } from "@claudexor/core";
+export interface BrowserLaneRequirementInput {
+    harnessId: string;
+    requested: boolean;
+    manifestCapable: boolean;
+    webPolicy: ExternalContextPolicy;
+    access: AccessProfile;
+}
+export declare class RequestRequirementsError extends HarnessUnavailableError {
+    readonly resolutions: RequestRequirementResolution[];
+    readonly code = "browser_unavailable";
+    constructor(message: string, resolutions: RequestRequirementResolution[]);
+}
+/** One preflight owner for requested-vs-effective lane capability truth. */
+export declare class RequestRequirementsResolver {
+    /** Patch producers only read; the engine owns materialization and delivery. */
+    adapterAccess(intent: Intent, implementationTransport: ImplementationTransport, requestedAccess: AccessProfile): AccessProfile;
+    assertConvergenceWorkspace(inPlace: boolean, routes: {
+        implementationTransport: ImplementationTransport;
+    }[]): void;
+    attachmentRefusal(harnessId: string, attachments: Attachment[], declarations: AttachmentInputClass[]): string | null;
+    browserSpec(resolution: RequestRequirementResolution, outputDir: string): {
+        output_dir: string;
+        headless: boolean;
+    } | null;
+    resolveBrowser(input: BrowserLaneRequirementInput): RequestRequirementResolution;
+    /**
+     * Per-lane deny-path enforcement receipt. No pinned adapter supports native
+     * pre-write path deny today (claude needs >=2.1.208), so an eligible lane
+     * does not exist and the engine's post-diff policy gate is the authoritative
+     * enforcement — the receipt discloses exactly that (`postdiff_only`), never
+     * implying OS/native containment that is not there.
+     */
+    resolveDenyPaths(harnessId: string, requested: boolean): RequestRequirementResolution;
+    requireEffectiveBrowser(requested: boolean, resolutions: RequestRequirementResolution[]): void;
+}
+//# sourceMappingURL=requestRequirements.d.ts.map

package/dist/requestRequirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestRequirements.d.ts","sourceRoot":"","sources":["../src/requestRequirements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,MAAM,EACN,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,qBAAqB,CAAC;IACjC,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,qBAAa,wBAAyB,SAAQ,uBAAuB;IAKjE,QAAQ,CAAC,WAAW,EAAE,4BAA4B,EAAE;IAJtD,QAAQ,CAAC,IAAI,yBAAyB;gBAGpC,OAAO,EAAE,MAAM,EACN,WAAW,EAAE,4BAA4B,EAAE;CAIvD;AAED,4EAA4E;AAC5E,qBAAa,2BAA2B;IACtC,+EAA+E;IAC/E,aAAa,CACX,MAAM,EAAE,MAAM,EACd,uBAAuB,EAAE,uBAAuB,EAChD,eAAe,EAAE,aAAa,GAC7B,aAAa;IAOhB,0BAA0B,CACxB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE;QAAE,uBAAuB,EAAE,uBAAuB,CAAA;KAAE,EAAE,GAC7D,IAAI;IAQP,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,UAAU,EAAE,EACzB,YAAY,EAAE,oBAAoB,EAAE,GACnC,MAAM,GAAG,IAAI;IAmBhB,WAAW,CACT,UAAU,EAAE,4BAA4B,EACxC,SAAS,EAAE,MAAM,GAChB;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAInD,cAAc,CAAC,KAAK,EAAE,2BAA2B,GAAG,4BAA4B;IA6DhF;;;;;;OAMG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,4BAA4B;IAYrF,uBAAuB,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,4BAA4B,EAAE,GAAG,IAAI;CAU/F"}

package/dist/requestRequirements.js

@@ -0,0 +1,127 @@
+import { HarnessUnavailableError } from "@claudexor/core";
+export class RequestRequirementsError extends HarnessUnavailableError {
+    resolutions;
+    code = "browser_unavailable";
+    constructor(message, resolutions) {
+        super(message);
+        this.resolutions = resolutions;
+    }
+}
+/** One preflight owner for requested-vs-effective lane capability truth. */
+export class RequestRequirementsResolver {
+    /** Patch producers only read; the engine owns materialization and delivery. */
+    adapterAccess(intent, implementationTransport, requestedAccess) {
+        return implementationTransport === "git_patch_envelope" &&
+            (intent === "implement" || intent === "synthesize")
+            ? "readonly"
+            : requestedAccess;
+    }
+    assertConvergenceWorkspace(inPlace, routes) {
+        if (inPlace && routes.some((route) => route.implementationTransport === "git_patch_envelope")) {
+            throw new HarnessUnavailableError("in-place convergence is unavailable for git_patch_envelope adapters; use an isolated run or a single agent attempt");
+        }
+    }
+    attachmentRefusal(harnessId, attachments, declarations) {
+        for (const attachment of attachments) {
+            const declaration = declarations.find((candidate) => candidate.kind === attachment.kind && candidate.mime_types.includes(attachment.mime));
+            if (!declaration)
+                return `${harnessId} cannot receive every mandatory attachment: ${attachment.kind} ${attachment.mime} is unsupported; choose a compatible harness pool or remove the attachment`;
+            if (attachment.size_bytes > declaration.max_bytes)
+                return `${harnessId} cannot receive every mandatory attachment: ${attachment.name || attachment.resource_id} is ${attachment.size_bytes} bytes (max ${declaration.max_bytes} for ${attachment.mime}); choose a compatible harness pool or remove the attachment`;
+            const count = attachments.filter((item) => item.kind === declaration.kind && declaration.mime_types.includes(item.mime)).length;
+            if (count > declaration.max_count)
+                return `${harnessId} cannot receive every mandatory attachment: ${count} ${declaration.kind} attachments exceed max_count ${declaration.max_count}; choose a compatible harness pool or remove the attachment`;
+        }
+        return null;
+    }
+    browserSpec(resolution, outputDir) {
+        return resolution.effective ? { output_dir: outputDir, headless: false } : null;
+    }
+    resolveBrowser(input) {
+        const eligible = input.manifestCapable;
+        if (!input.requested) {
+            return {
+                capability: "browser",
+                harness_id: input.harnessId,
+                eligible,
+                requested: false,
+                effective: false,
+                reason: "not_requested",
+                evidence_refs: ["request.browser"],
+            };
+        }
+        if (!eligible) {
+            return {
+                capability: "browser",
+                harness_id: input.harnessId,
+                eligible: false,
+                requested: true,
+                effective: false,
+                reason: "manifest_unsupported",
+                evidence_refs: ["manifest.capabilities.browser_tool"],
+            };
+        }
+        if (input.webPolicy === "off") {
+            return {
+                capability: "browser",
+                harness_id: input.harnessId,
+                eligible: true,
+                requested: true,
+                effective: false,
+                reason: "web_policy_off",
+                evidence_refs: ["request.external_context_policy"],
+            };
+        }
+        if (input.access !== "full" && input.access !== "external_sandbox_full") {
+            return {
+                capability: "browser",
+                harness_id: input.harnessId,
+                eligible: true,
+                requested: true,
+                effective: false,
+                reason: "access_profile_incompatible",
+                evidence_refs: ["task.access.effective_profile"],
+            };
+        }
+        return {
+            capability: "browser",
+            harness_id: input.harnessId,
+            eligible: true,
+            requested: true,
+            effective: true,
+            reason: "effective",
+            evidence_refs: [
+                "manifest.capabilities.browser_tool",
+                "request.external_context_policy",
+                "task.access.effective_profile",
+            ],
+        };
+    }
+    /**
+     * Per-lane deny-path enforcement receipt. No pinned adapter supports native
+     * pre-write path deny today (claude needs >=2.1.208), so an eligible lane
+     * does not exist and the engine's post-diff policy gate is the authoritative
+     * enforcement — the receipt discloses exactly that (`postdiff_only`), never
+     * implying OS/native containment that is not there.
+     */
+    resolveDenyPaths(harnessId, requested) {
+        return {
+            capability: "path_deny",
+            harness_id: harnessId,
+            eligible: false,
+            requested,
+            effective: false,
+            reason: requested ? "postdiff_only" : "not_requested",
+            evidence_refs: ["request.deny_paths"],
+        };
+    }
+    requireEffectiveBrowser(requested, resolutions) {
+        if (!requested || resolutions.some((resolution) => resolution.effective))
+            return;
+        const detail = resolutions
+            .map((resolution) => `${resolution.harness_id}: ${resolution.reason}`)
+            .join("; ");
+        throw new RequestRequirementsError(`browser was requested but no selected harness lane can receive it${detail ? ` (${detail})` : ""}; choose a browser-capable lane with web enabled and full access`, resolutions);
+    }
+}
+//# sourceMappingURL=requestRequirements.js.map

package/dist/requestRequirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestRequirements.js","sourceRoot":"","sources":["../src/requestRequirements.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAU1D,MAAM,OAAO,wBAAyB,SAAQ,uBAAuB;IAKxD;IAJF,IAAI,GAAG,qBAAqB,CAAC;IAEtC,YACE,OAAe,EACN,WAA2C;QAEpD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,gBAAW,GAAX,WAAW,CAAgC;IAGtD,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,2BAA2B;IACtC,+EAA+E;IAC/E,aAAa,CACX,MAAc,EACd,uBAAgD,EAChD,eAA8B;QAE9B,OAAO,uBAAuB,KAAK,oBAAoB;YACrD,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,YAAY,CAAC;YACnD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,eAAe,CAAC;IACtB,CAAC;IAED,0BAA0B,CACxB,OAAgB,EAChB,MAA8D;QAE9D,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,uBAAuB,KAAK,oBAAoB,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,uBAAuB,CAC/B,oHAAoH,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB,CACf,SAAiB,EACjB,WAAyB,EACzB,YAAoC;QAEpC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CACvF,CAAC;YACF,IAAI,CAAC,WAAW;gBACd,OAAO,GAAG,SAAS,+CAA+C,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,4EAA4E,CAAC;YACnL,IAAI,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,SAAS;gBAC/C,OAAO,GAAG,SAAS,+CAA+C,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,WAAW,OAAO,UAAU,CAAC,UAAU,eAAe,WAAW,CAAC,SAAS,QAAQ,UAAU,CAAC,IAAI,8DAA8D,CAAC;YACnQ,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACvF,CAAC,MAAM,CAAC;YACT,IAAI,KAAK,GAAG,WAAW,CAAC,SAAS;gBAC/B,OAAO,GAAG,SAAS,+CAA+C,KAAK,IAAI,WAAW,CAAC,IAAI,iCAAiC,WAAW,CAAC,SAAS,6DAA6D,CAAC;QACnN,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CACT,UAAwC,EACxC,SAAiB;QAEjB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;IAED,cAAc,CAAC,KAAkC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,QAAQ;gBACR,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,eAAe;gBACvB,aAAa,EAAE,CAAC,iBAAiB,CAAC;aACnC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,sBAAsB;gBAC9B,aAAa,EAAE,CAAC,oCAAoC,CAAC;aACtD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,aAAa,EAAE,CAAC,iCAAiC,CAAC;aACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YACxE,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,CAAC,+BAA+B,CAAC;aACjD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,WAAW;YACnB,aAAa,EAAE;gBACb,oCAAoC;gBACpC,iCAAiC;gBACjC,+BAA+B;aAChC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,SAAiB,EAAE,SAAkB;QACpD,OAAO;YACL,UAAU,EAAE,WAAW;YACvB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,KAAK;YACf,SAAS;YACT,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;YACrD,aAAa,EAAE,CAAC,oBAAoB,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,SAAkB,EAAE,WAA2C;QACrF,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QACjF,MAAM,MAAM,GAAG,WAAW;aACvB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;aACrE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,wBAAwB,CAChC,oEAAoE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,kEAAkE,EAClK,WAAW,CACZ,CAAC;IACJ,CAAC;CACF"}

package/dist/reviewerPanel.d.ts

@@ -8,7 +8,7 @@
  * HarnessUnavailableError; the orchestrator turns them into review_preflight
  * failure ARTIFACTS after run-dir creation, before candidates spend money.
  */
-import type { AuthPreference, ControlReviewerPanelEntry } from "@claudexor/schema";
+import type { AuthPreference, ControlReviewerPanelEntry, EffortHint, ProviderFamily } from "@claudexor/schema";
 import type { HarnessAdapter } from "@claudexor/core";
 import type { ReviewerSpec } from "@claudexor/review";
 interface PanelHarnessSettings {
@@ -22,5 +22,19 @@ export interface ReviewerPanelDeps {
     authPreferenceFor: (harnessId: string) => AuthPreference;
 }
 export declare function resolveExplicitReviewerPanel(deps: ReviewerPanelDeps, panel: ControlReviewerPanelEntry[]): Promise<ReviewerSpec[]>;
+export interface AutoReviewerPanelOverrides {
+    reviewerModels?: Partial<Record<ProviderFamily, string>>;
+    reviewerEfforts?: Partial<Record<ProviderFamily, EffortHint>>;
+}
+/**
+ * Auto reviewer-panel selection (no owner-configured panel): pick up to two
+ * doctor-ok, readonly-review-capable harnesses from DISTINCT provider
+ * families. Eligibility consumes a point-probe in the same scoped read-only
+ * env shape the reviewers later run with, and the STRICT model truth gate
+ * applies to any per-family/default model override — a doomed reviewer model
+ * is refused here, never forwarded to die as an opaque native error
+ * mid-review.
+ */
+export declare function resolveAutoReviewerPanel(deps: ReviewerPanelDeps, overrides?: AutoReviewerPanelOverrides): Promise<ReviewerSpec[]>;
 export {};
 //# sourceMappingURL=reviewerPanel.d.ts.map

package/dist/reviewerPanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reviewerPanel.d.ts","sourceRoot":"","sources":["../src/reviewerPanel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAU,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,UAAU,oBAAoB;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAClE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,cAAc,CAAC;CAC1D;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,yBAAyB,EAAE,GACjC,OAAO,CAAC,YAAY,EAAE,CAAC,CAiJzB"}
+{"version":3,"file":"reviewerPanel.d.ts","sourceRoot":"","sources":["../src/reviewerPanel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EAGd,yBAAyB,EACzB,UAAU,EAEV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,UAAU,oBAAoB;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAClE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,cAAc,CAAC;CAC1D;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,yBAAyB,EAAE,GACjC,OAAO,CAAC,YAAY,EAAE,CAAC,CAyJzB;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,iBAAiB,EACvB,SAAS,GAAE,0BAA+B,GACzC,OAAO,CAAC,YAAY,EAAE,CAAC,CAqEzB"}