@claudexor/orchestrator 1.0.1

package/dist/finalVerifier.js

@@ -0,0 +1,110 @@
+/**
+ * FinalVerifier (INV-115): before a race winner becomes adoptable/
+ * applyable, its patch is applied onto a FRESH worktree at the winner's own
+ * base sha and the deterministic gates re-run there. This catches the class
+ * of "reviewed green in the candidate tree, broken against the real base"
+ * failures (stale envelope, gate side effects) with zero model spend.
+ * Deterministic-first: no model involvement; gates cost no USD, so the
+ * candidate ledger is trivially respected.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { FinalVerifyRecord } from "@claudexor/schema";
+import { gatesPassed, runGates } from "@claudexor/review";
+import { applyPatchProtected, branchDelete, worktreeAdd, worktreeRemove } from "@claudexor/workspace";
+import { newId, redactSecrets } from "@claudexor/util";
+/** FAIL-CLOSED verdict (INV-115): an attempted verify that did not PROVE
+ * applied_cleanly (false OR null/errored) or whose gates failed blocks the
+ * run. One owner — race and convergence consume the same rule. */
+export function finalVerifyBlocks(finalVerify) {
+    return (finalVerify !== null &&
+        finalVerify.attempted &&
+        (finalVerify.applied_cleanly !== true || finalVerify.gates_passed === false));
+}
+/** The persisted decision must AGREE with a blocked terminal: status/outcome
+ * blocked, human_review recommendation, and an evidence fact naming the cause.
+ * One owner for the race and convergence decision writes. */
+export function blockedDecisionOverride(evidenceFacts, finalVerify) {
+    const fact = finalVerifyBlocks(finalVerify)
+        ? finalVerify?.applied_cleanly !== true
+            ? `final verify failed: ${finalVerify?.reason ?? "patch did not survive a fresh tree at its base"}`
+            : "final verify failed: deterministic gates failed on the fresh verify tree"
+        : "reviewer escalated blocking NEEDS_HUMAN findings; a typed operator decision is required";
+    return {
+        status: "blocked",
+        outcome: "blocked",
+        apply_recommendation: "human_review",
+        evidence_facts: [...evidenceFacts, fact],
+    };
+}
+export async function finalVerifyPatch(execRoot, winner, specs, log) {
+    const started = Date.now();
+    const done = (fields) => FinalVerifyRecord.parse({
+        attempted: true,
+        base_sha: winner.baseSha ?? null,
+        duration_ms: Date.now() - started,
+        ...fields,
+    });
+    if (!winner.baseSha) {
+        // FAIL CLOSED: the in-place exemption is a CALLER-level decision (the
+        // orchestrator skips in-place turns before calling). An ENVELOPE patch
+        // reaching this point without a recorded base sha cannot be proven
+        // against a clean base — that blocks like any other verifier error,
+        // never silently bypasses INV-115.
+        return FinalVerifyRecord.parse({
+            attempted: true,
+            applied_cleanly: null,
+            reason: "no base sha recorded for the winner envelope; cannot verify against a clean base",
+            duration_ms: Date.now() - started,
+        });
+    }
+    const verifyBase = mkdtempSync(join(tmpdir(), "claudexor-verify-"));
+    const verifyTree = join(verifyBase, "tree");
+    const branch = `claudexor/verify-${newId("fv").slice(3)}`;
+    try {
+        await worktreeAdd(execRoot, verifyTree, branch, winner.baseSha);
+        const applied = await applyPatchProtected(verifyTree, winner.diff);
+        if (!applied.ok) {
+            return done({ applied_cleanly: false, reason: applied.detail ?? "apply failed on the verify tree" });
+        }
+        if (specs.length === 0) {
+            return done({ applied_cleanly: true, gates_passed: null, reason: "no deterministic gates configured" });
+        }
+        const gates = await runGates(specs, { cwd: verifyTree });
+        log.emit("gate.completed", {
+            attempt_id: "final-verify",
+            gates: gates.map((g) => ({ id: g.id, status: g.status, exit_code: g.exit_code, duration_ms: g.duration_ms })),
+            passed: gatesPassed(gates),
+        });
+        return done({
+            applied_cleanly: true,
+            gates_passed: gatesPassed(gates),
+            gates: gates.map((g) => ({ id: g.id, status: g.status })),
+        });
+    }
+    catch (err) {
+        return done({ applied_cleanly: null, reason: redactSecrets(err instanceof Error ? err.message : String(err)) });
+    }
+    finally {
+        try {
+            await worktreeRemove(execRoot, verifyTree);
+        }
+        catch {
+            /* best-effort */
+        }
+        try {
+            await branchDelete(execRoot, branch);
+        }
+        catch {
+            /* best-effort */
+        }
+        try {
+            rmSync(verifyBase, { recursive: true, force: true });
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+//# sourceMappingURL=finalVerifier.js.map

package/dist/finalVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalVerifier.js","sourceRoot":"","sources":["../src/finalVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtG,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWvD;;kEAEkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,WAAqC;IACrE,OAAO,CACL,WAAW,KAAK,IAAI;QACpB,WAAW,CAAC,SAAS;QACrB,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,IAAI,WAAW,CAAC,YAAY,KAAK,KAAK,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED;;6DAE6D;AAC7D,MAAM,UAAU,uBAAuB,CACrC,aAAuB,EACvB,WAAqC;IAOrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,WAAW,EAAE,eAAe,KAAK,IAAI;YACrC,CAAC,CAAC,wBAAwB,WAAW,EAAE,MAAM,IAAI,gDAAgD,EAAE;YACnG,CAAC,CAAC,0EAA0E;QAC9E,CAAC,CAAC,yFAAyF,CAAC;IAC9F,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,SAAS;QAClB,oBAAoB,EAAE,cAAc;QACpC,cAAc,EAAE,CAAC,GAAG,aAAa,EAAE,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,MAAwB,EACxB,KAAiB,EACjB,GAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAqB,EAAE,CAClE,iBAAiB,CAAC,KAAK,CAAC;QACtB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAChC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QACjC,GAAG,MAAM;KACV,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,mCAAmC;QACnC,OAAO,iBAAiB,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,IAAI;YACrB,MAAM,EAAE,kFAAkF;YAC1F,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,oBAAoB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,iCAAiC,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACzB,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7G,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;YACV,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC;YAChC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./orchestrator.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export * from "./orchestrator.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/interaction.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Per-attempt interaction channel. Emits the typed lifecycle events
+ * (`interaction.requested` / `interaction.answered` / `interaction.timeout`)
+ * around the caller-provided answer surface, enforcing the wait budget so a
+ * run can never hang forever on an unanswered question. Undefined when the
+ * caller provides no surface — the adapter then runs non-interactive.
+ *
+ * Capability gate: the channel is OFFERED only to routes whose manifest
+ * declares `interactive` — a non-interactive harness never gets a surface it
+ * cannot raise questions through.
+ */
+import type { InteractionChannel } from "@claudexor/core";
+import type { InteractionAnswerSet } from "@claudexor/schema";
+import type { EventLog } from "@claudexor/event-log";
+import type { PendingInteractionContext } from "./orchestrator.js";
+export interface InteractionChannelWiring {
+    onInteraction?: (ctx: PendingInteractionContext) => Promise<InteractionAnswerSet | null>;
+    interactionTimeoutMs?: number;
+    signal?: AbortSignal;
+}
+export declare function interactionChannelFor(input: InteractionChannelWiring, log: EventLog, runId: string, taskId: string, attemptId: string, harnessId: string, supportsInteractive: boolean, defaultTimeoutMs: number): InteractionChannel | undefined;
+//# sourceMappingURL=interaction.d.ts.map

package/dist/interaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.d.ts","sourceRoot":"","sources":["../src/interaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAsB,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,yBAAyB,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACzF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,EAC/B,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,OAAO,EAC5B,gBAAgB,EAAE,MAAM,GACvB,kBAAkB,GAAG,SAAS,CA4GhC"}

package/dist/interaction.js

@@ -0,0 +1,117 @@
+import { nowIso } from "@claudexor/util";
+export function interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, supportsInteractive, defaultTimeoutMs) {
+    if (!supportsInteractive)
+        return undefined;
+    const handler = input.onInteraction;
+    if (!handler)
+        return undefined;
+    const timeoutMs = input.interactionTimeoutMs ?? defaultTimeoutMs;
+    // Waiting on a human is legitimate stream silence: the inactivity watchdog
+    // consults this count and re-arms instead of killing the "wedged" harness.
+    let pending = 0;
+    return {
+        pendingCount: () => pending,
+        request: async (request) => {
+            const requestedAt = nowIso();
+            const timeoutAt = new Date(Date.now() + timeoutMs).toISOString();
+            pending += 1;
+            try {
+                // Invoke the answer surface BEFORE announcing the event: handlers
+                // register the pending question synchronously (daemon
+                // InteractionRegistry), so any subscriber that reacts to
+                // interaction.requested — `claudexor follow` checks pendingInteractions
+                // before prompting — finds the registry already populated. The reverse
+                // order would make that guarantee depend on event-loop timing.
+                // The handler is invoked SYNCHRONOUSLY (the registry-population contract
+                // below depends on it); only its failure handling is normalized — a
+                // synchronous throw becomes the same null-answer path as an async one.
+                let answersPromise;
+                try {
+                    answersPromise = Promise.resolve(handler({
+                        runId,
+                        taskId,
+                        attemptId,
+                        harnessId,
+                        request,
+                        requestedAt,
+                        timeoutAt,
+                    })).catch(() => null);
+                }
+                catch {
+                    answersPromise = Promise.resolve(null);
+                }
+                log.emit("interaction.requested", {
+                    interaction_id: request.interaction_id,
+                    attempt_id: attemptId,
+                    harness_id: harnessId,
+                    source_tool: request.source_tool,
+                    questions: request.questions,
+                    requested_at: requestedAt,
+                    timeout_at: timeoutAt,
+                });
+                let timer;
+                let onAbort;
+                const startedWaiting = Date.now();
+                const answers = await Promise.race([
+                    answersPromise,
+                    new Promise((resolve) => {
+                        timer = setTimeout(() => resolve(null), timeoutMs);
+                        timer.unref?.();
+                    }),
+                    // A cancelled run must release the interaction wait IMMEDIATELY —
+                    // the abort already kills the harness process, and sitting out the
+                    // remaining timeout would park a dead run in waiting_on_user.
+                    new Promise((resolve) => {
+                        if (!input.signal)
+                            return;
+                        if (input.signal.aborted)
+                            return resolve(null);
+                        onAbort = () => resolve(null);
+                        input.signal.addEventListener("abort", onAbort, { once: true });
+                    }),
+                ]);
+                if (timer)
+                    clearTimeout(timer);
+                if (onAbort)
+                    input.signal?.removeEventListener("abort", onAbort);
+                if (answers && answers.answers.length > 0) {
+                    log.emit("interaction.answered", {
+                        interaction_id: request.interaction_id,
+                        attempt_id: attemptId,
+                        harness_id: harnessId,
+                        answer_count: answers.answers.length,
+                    });
+                    return answers;
+                }
+                log.emit("interaction.timeout", {
+                    interaction_id: request.interaction_id,
+                    attempt_id: attemptId,
+                    harness_id: harnessId,
+                    waited_ms: Date.now() - startedWaiting,
+                    ...(input.signal?.aborted ? { reason: "cancelled" } : {}),
+                });
+                // Late-answer honesty: the run already declined this
+                // interaction; an answer arriving AFTER the timeout must be visibly
+                // DISCARDED, not silently swallowed (the user typed it in good faith).
+                void answersPromise.then((late) => {
+                    if (late && late.answers.length > 0) {
+                        log.emit("interaction.answer_discarded", {
+                            interaction_id: request.interaction_id,
+                            attempt_id: attemptId,
+                            harness_id: harnessId,
+                            answer_count: late.answers.length,
+                            reason: input.signal?.aborted ? "run_cancelled" : "timed_out",
+                        });
+                    }
+                });
+                return null;
+            }
+            finally {
+                // ALWAYS release the suspension: a synchronous handler throw or a
+                // log.emit failure must not leave the watchdog suspended forever.
+                pending -= 1;
+            }
+        },
+    };
+}
+//# sourceMappingURL=interaction.js.map

package/dist/interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.js","sourceRoot":"","sources":["../src/interaction.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AASzC,MAAM,UAAU,qBAAqB,CACnC,KAA+B,EAC/B,GAAa,EACb,KAAa,EACb,MAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,mBAA4B,EAC5B,gBAAwB;IAExB,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,IAAI,gBAAgB,CAAC;IACjE,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO;QACL,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO;QAC3B,OAAO,EAAE,KAAK,EAAE,OAA2B,EAAwC,EAAE;YACnF,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,kEAAkE;gBAClE,sDAAsD;gBACtD,yDAAyD;gBACzD,wEAAwE;gBACxE,uEAAuE;gBACvE,+DAA+D;gBAC/D,yEAAyE;gBACzE,oEAAoE;gBACpE,uEAAuE;gBACvE,IAAI,cAAoD,CAAC;gBACzD,IAAI,CAAC;oBACH,cAAc,GAAG,OAAO,CAAC,OAAO,CAC9B,OAAO,CAAC;wBACN,KAAK;wBACL,MAAM;wBACN,SAAS;wBACT,SAAS;wBACT,OAAO;wBACP,WAAW;wBACX,SAAS;qBACV,CAAC,CACH,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzC,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;oBACrB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;gBACH,IAAI,KAAiC,CAAC;gBACtC,IAAI,OAAiC,CAAC;gBACtC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjC,cAAc;oBACd,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;wBACnD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;oBAClB,CAAC,CAAC;oBACF,kEAAkE;oBAClE,mEAAmE;oBACnE,8DAA8D;oBAC9D,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAC5B,IAAI,CAAC,KAAK,CAAC,MAAM;4BAAE,OAAO;wBAC1B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC/C,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC9B,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClE,CAAC,CAAC;iBACH,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,IAAI,OAAO;oBAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjE,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;wBAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,UAAU,EAAE,SAAS;wBACrB,UAAU,EAAE,SAAS;wBACrB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;qBACrC,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;oBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;oBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;oBACtC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D,CAAC,CAAC;gBACH,qDAAqD;gBACrD,oEAAoE;gBACpE,uEAAuE;gBACvE,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBAChC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE;4BACvC,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,UAAU,EAAE,SAAS;4BACrB,UAAU,EAAE,SAAS;4BACrB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;4BACjC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW;yBAC9D,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,kEAAkE;gBAClE,kEAAkE;gBAClE,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/modelGovernance.d.ts

@@ -0,0 +1,22 @@
+/**
+ * STRICT run-preflight model gate (INV-104): every route that resolved an
+ * explicit model (per-run map or per-harness settings default) must pass its
+ * harness's model truth source — the live `models()` inventory when the
+ * adapter has one, else the manifest `known_models` list. A violation throws
+ * a typed error BEFORE any vendor CLI spawns; the orchestrator surfaces it
+ * through the routing-failure path, so failure.yaml names harness, model, and
+ * truth source. Fallback models get the same gate: a downgrade target that
+ * cannot run is a config bug better caught before the run than mid-run.
+ */
+import type { HarnessAdapter } from "@claudexor/core";
+export interface ModelGovernedRoute {
+    adapter: HarnessAdapter;
+    /** Manifest model truth source (used when the adapter has no live models()). */
+    knownModels: readonly string[];
+    settings: {
+        defaultModel: string | null;
+        fallbackModel: string | null;
+    } | null;
+}
+export declare function assertRouteModelsAllowed(routes: readonly ModelGovernedRoute[], models: Record<string, string> | undefined, cwd: string): Promise<void>;
+//# sourceMappingURL=modelGovernance.d.ts.map

package/dist/modelGovernance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelGovernance.d.ts","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,gFAAgF;IAChF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAChF;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/modelGovernance.js

@@ -0,0 +1,33 @@
+import { HarnessUnavailableError, validateModel } from "@claudexor/core";
+export async function assertRouteModelsAllowed(routes, models, cwd) {
+    const checked = new Set();
+    for (const routed of routes) {
+        const id = routed.adapter.id;
+        if (checked.has(id))
+            continue;
+        checked.add(id);
+        const resolved = models?.[id] ?? routed.settings?.defaultModel ?? null;
+        const candidates = [
+            { role: "model", model: resolved },
+            { role: "fallback_model", model: routed.settings?.fallbackModel ?? null },
+        ].filter((c) => Boolean(c.model));
+        if (candidates.length === 0)
+            continue;
+        let truth;
+        if (typeof routed.adapter.models === "function") {
+            const inventory = await routed.adapter.models({ cwd });
+            truth = { list: inventory.map((m) => m.id), source: "api" };
+        }
+        else {
+            truth = { list: routed.knownModels, source: "manifest" };
+        }
+        for (const { role, model } of candidates) {
+            const check = validateModel(model, truth.list, truth.source);
+            if (check.status !== "ok") {
+                throw new HarnessUnavailableError(`harness '${id}' refused ${role} '${model}' (truth source: ${truth.source}): ${check.message}; ` +
+                    `run \`claudexor models --harness ${id}\``);
+            }
+        }
+    }
+}
+//# sourceMappingURL=modelGovernance.js.map

package/dist/modelGovernance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelGovernance.js","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AASzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqC,EACrC,MAA0C,EAC1C,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;QACvE,MAAM,UAAU,GAAG;YACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE;SAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,IAAI,KAA8D,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAC/B,YAAY,EAAE,aAAa,IAAI,KAAK,KAAK,oBAAoB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,IAAI;oBAC9F,oCAAoC,EAAE,IAAI,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/orchestratePlanner.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Prompt framing for the orchestrate PLANNER (plan-only). The tool belt comes
+ * from the typed OrchestrateContract — the prompt never invents actions the
+ * executor will not honor.
+ */
+import type { OrchestrateContract as OrchestrateContractT, OrchestratePlan as OrchestratePlanT } from "@claudexor/schema";
+export declare function buildOrchestratePlannerPrompt(goal: string, pool: string[], crossFamily: boolean, contract: OrchestrateContractT): string;
+export declare function extractOrchestratePlan(report: string): {
+    plan: OrchestratePlanT | null;
+    error: string;
+};
+//# sourceMappingURL=orchestratePlanner.d.ts.map

package/dist/orchestratePlanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestratePlanner.d.ts","sourceRoot":"","sources":["../src/orchestratePlanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,eAAe,IAAI,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQ1H,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,OAAO,EACpB,QAAQ,EAAE,oBAAoB,GAC7B,MAAM,CA4BR;AAuBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2BvG"}

package/dist/orchestratePlanner.js

@@ -0,0 +1,91 @@
+import { OrchestratePlan as OrchestratePlanSchema } from "@claudexor/schema";
+import { redactSecrets } from "@claudexor/util";
+function safeErrorMessage(err) {
+    return redactSecrets(err instanceof Error ? err.message : String(err));
+}
+export function buildOrchestratePlannerPrompt(goal, pool, crossFamily, contract) {
+    return [
+        `You are the Claudexor orchestration planner. Plan — do not implement.`,
+        ``,
+        `## Goal`,
+        goal,
+        ``,
+        `## Available harness pool (doctor-verified)`,
+        pool.length > 0
+            ? pool.map((id) => `- ${id}`).join("\n")
+            : "- (none verified; plan must say what setup is needed)",
+        crossFamily
+            ? `Cross-family race and cross-family review ARE available (2+ harnesses).`
+            : `Only single-route execution is available (fewer than 2 verified harnesses).`,
+        ``,
+        `## Tool belt (the ONLY actions your plan may use)`,
+        ...contract.tool_belt.map((t) => `- ${t}`),
+        ``,
+        `## Required output`,
+        `1. A concise markdown orchestration plan (numbered steps; each step names ONE tool and its arguments).`,
+        '2. A fenced ```json block: {"tool_calls": [ … ]}. Each call puts the tool name AND its arguments at the TOP LEVEL — there is NO nested "args" object. Per-tool shapes (use only belt tools):',
+        '   - start_run: {"tool":"start_run","prompt":"…","mode":"agent","harness":"<optional id>","why":"…"}',
+        '   - race:      {"tool":"race","prompt":"…","n":2,"why":"…"}',
+        '   - review:    {"tool":"review","run_id":"<id>","why":"…"}',
+        '   - status:    {"tool":"status","run_id":"<id>","why":"…"}',
+        '   - apply:     {"tool":"apply","run_id":"<id>","mode":"apply","why":"…"}',
+        `Keep the plan minimal and budget-aware. Do not propose tools outside the belt.`,
+    ].join("\n");
+}
+/**
+ * Extract + validate the planner's typed plan from its markdown report (the
+ * fenced ```json block the orchestrate prompt requires). Structured-output
+ * parsing, not governance: validity is decided by the OrchestratePlan schema.
+ */
+/** Schema-constrained routes emit explicit `null` for OPTIONAL FIELDS (the
+ * strict-mode nullable recipe); Zod `.optional()` rejects null, so those are
+ * stripped before parsing — translational, never inventing values. Null
+ * ARRAY ELEMENTS are NOT part of that recipe: they are a malformed plan and
+ * must FAIL the Zod parse loudly (no silent truncation). */
+function stripNulls(value) {
+    if (Array.isArray(value))
+        return value.map(stripNulls);
+    if (!value || typeof value !== "object")
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (v === null)
+            continue;
+        out[k] = stripNulls(v);
+    }
+    return out;
+}
+export function extractOrchestratePlan(report) {
+    // STRUCTURED-FIRST: a schema-constrained route emits the plan as the
+    // bare final message — try the whole report as JSON before fence-hunting.
+    const bare = report.trim();
+    if (bare.startsWith("{") && bare.endsWith("}")) {
+        try {
+            const parsed = OrchestratePlanSchema.safeParse(stripNulls(JSON.parse(bare)));
+            if (parsed.success)
+                return { plan: parsed.data, error: "" };
+        }
+        catch {
+            /* not bare JSON — fall through to fenced parsing */
+        }
+    }
+    const fence = /```json\s*\n([\s\S]*?)\n```/g;
+    let lastBlock = null;
+    for (const match of report.matchAll(fence))
+        lastBlock = match[1] ?? null;
+    if (!lastBlock)
+        return { plan: null, error: "no fenced json block found in the planner report" };
+    try {
+        const parsed = OrchestratePlanSchema.safeParse(stripNulls(JSON.parse(lastBlock)));
+        if (!parsed.success)
+            return {
+                plan: null,
+                error: `plan block failed schema validation: ${parsed.error.issues[0]?.message ?? "invalid"}`,
+            };
+        return { plan: parsed.data, error: "" };
+    }
+    catch (err) {
+        return { plan: null, error: `plan block is not valid JSON: ${safeErrorMessage(err)}` };
+    }
+}
+//# sourceMappingURL=orchestratePlanner.js.map

package/dist/orchestratePlanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestratePlanner.js","sourceRoot":"","sources":["../src/orchestratePlanner.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,IAAI,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,SAAS,gBAAgB,CAAC,GAAY;IACpC,OAAO,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,IAAc,EACd,WAAoB,EACpB,QAA8B;IAE9B,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,SAAS;QACT,IAAI;QACJ,EAAE;QACF,6CAA6C;QAC7C,IAAI,CAAC,MAAM,GAAG,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACxC,CAAC,CAAC,uDAAuD;QAC3D,WAAW;YACT,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,6EAA6E;QACjF,EAAE;QACF,mDAAmD;QACnD,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,EAAE;QACF,oBAAoB;QACpB,wGAAwG;QACxG,8LAA8L;QAC9L,sGAAsG;QACtG,8DAA8D;QAC9D,6DAA6D;QAC7D,6DAA6D;QAC7D,2EAA2E;QAC3E,gFAAgF;KACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH;;;;4DAI4D;AAC5D,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,8BAA8B,CAAC;IAC7C,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,wCAAwC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,SAAS,EAAE;aAC9F,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,iCAAiC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACzF,CAAC;AACH,CAAC"}