@claudexor/orchestrator 3.8.0 → 3.8.2

package/dist/delegatedHome.d.ts

@@ -1,5 +1,4 @@
-import type { ConfinementHost } from "@claudexor/core";
-import type { AccessProfile, HarnessConfinement, WorkspaceEnvelope } from "@claudexor/schema";
+import type { AccessProfile, RecordedAppliedAttemptFacts as HistoricalAppliedAttemptFacts, WorkspaceEnvelope } from "@claudexor/schema";
 import type { WorkspaceManager } from "@claudexor/workspace";
 /** What one attempt's harness HOME actually resolved to, and whether it is scoped. */
 export interface ScopedHarnessHome {
@@ -9,78 +8,35 @@ export interface ScopedHarnessHome {
     isolated: boolean;
     /** The scoped home directory, or null when the attempt inherits the operator's. */
     homeDir: string | null;
-    /** The APPLIED OS boundary, or null when this attempt runs without one. */
-    confinement: HarnessConfinement | null;
-    /**
-     * Why this attempt got NO boundary, when it asked for one and the host had
-     * none. Null both when a boundary WAS applied and when none was ever asked
-     * for — an ordinary run is not "unconfined", it is out of scope, and the
-     * terminal gate below depends on being able to tell those apart.
-     */
-    confinementUnavailableReason: string | null;
+    /** Why no additional outer boundary applies; null for ordinary/non-mutating runs. */
+    outerBoundaryUnavailableReason: string | null;
 }
 /** Access profiles under which the harness can modify the filesystem. */
 export declare function isMutatingAccess(access: AccessProfile): boolean;
 /**
- * Whether this run's lanes should be told to stand their own sandbox down.
- *
- * Only a delegated run asks for an engine-provided boundary, and only a host
- * that can actually provide one earns the trade. Telling a harness to drop its
- * native sandbox where Claudexor will NOT replace it is a pure loss — strictly
- * worse than never having asked — so the two conditions are one expression
- * rather than a flag the caller passes and a check nobody makes.
- */
-export declare function externallyConfinedLane(delegated: boolean, host?: ConfinementHost): boolean;
-/** Roots the confinement is drawn against; overridable so tests never touch the real home. */
-export interface ConfinementRoots {
-    operatorHome: string;
-    runtimeRoot: string;
-    nativeStateRoot: string;
-}
-export declare function defaultConfinementRoots(): ConfinementRoots;
-/**
- * Decide the harness HOME and the OS boundary one attempt runs under.
+ * Decide the harness HOME one attempt runs under.
  *
  * Unchanged for ordinary runs: an ISOLATED envelope gets the envelope's scoped
  * home, while an IN-PLACE attempt deliberately inherits the operator's native
  * environment so a harness whose native session store hangs off `$HOME` can
  * resume its vendor conversation.
  *
- * A DELEGATED run (`execution.delegated`) is scoped either way, and that is a
- * BEHAVIORAL CHANGE against that deliberate design — live + agent is exactly
- * the configuration a delegated mutating subagent uses. It is taken knowingly:
- * the caller is a machine orchestrator that owns the workspace, and the
- * operator's real `$HOME` holds material no delegated harness may read, above
- * all `~/.claudexor/v3/daemon/token`, which grants the entire control API.
- *
- * THE SCOPED HOME IS NOT THE BOUNDARY. It redirects `~`-relative lookups and
- * nothing more; the token above is one absolute path away, and a live probe
- * read it out of an ordinary `workspace_write` agent run. So a delegated
- * MUTATING attempt additionally gets an OS-ENFORCED boundary
- * (`applyConfinement`), verified against a path it denies before the harness is
- * spawned. A delegated READ-ONLY attempt keeps the harness's own read-only
- * enforcement instead: confinement stands that enforcement down (macOS refuses
- * nested sandboxes), which would be a net loss where there is no shell to
- * confine.
- *
- * WHERE THE HOST HAS NO BOUNDARY the attempt still runs, and says so: the
- * reason travels onto the attempt record, into the child's prompt and into the
- * caller's result. A delegated run that refused on every platform Claudexor has
- * not implemented a mechanism for would be a macOS-only feature wearing a
- * general name.
+ * A DELEGATED run (`execution.delegated`) is scoped either way. The scoped HOME
+ * redirects native state and profile selection; it is deliberately not called
+ * a filesystem boundary. Mutating delegated attempts disclose that Claudexor
+ * adds no outer OS boundary and leave the selected harness's native access mode
+ * in effect.
  *
  * THE COST of the scoped home, stated plainly: an in-place delegated attempt
  * CANNOT resume a native vendor session whose store lives under the real `$HOME`
  * — cursor (`~/.cursor`) and opencode (XDG data under `$HOME`) lose resume.
  * codex and claude keep it: their native session stores are Claudexor-owned
- * directories that the adapter re-points on top of this env and that the
- * confinement carves back out, and the macOS login Keychain is reached through
+ * directories that the adapter re-points on top of this env, and the macOS login Keychain is reached through
  * the declared scoped-home bridge (INV-067), so subscription auth is unaffected.
  *
- * Never degrades silently: a delegated attempt whose scoped home is not on disk,
- * or whose boundary cannot be applied and proven, refuses.
+ * Never degrades silently: a delegated attempt whose scoped home is not on disk refuses.
  */
-export declare function scopedHarnessHome(wsm: WorkspaceManager, envelope: WorkspaceEnvelope, inPlaceEnvelope: boolean, delegated: boolean, access?: AccessProfile, roots?: ConfinementRoots, host?: ConfinementHost): ScopedHarnessHome;
+export declare function scopedHarnessHome(wsm: WorkspaceManager, envelope: WorkspaceEnvelope, inPlaceEnvelope: boolean, delegated: boolean, access?: AccessProfile): ScopedHarnessHome;
 /**
  * What the CHILD is told, when it is running without an OS boundary.
  *
@@ -90,19 +46,19 @@ export declare function scopedHarnessHome(wsm: WorkspaceManager, envelope: Works
  * fact, so it is stated to the model in plain words rather than left in an
  * artifact it never reads.
  */
-export declare function confinementNotice(home: ScopedHarnessHome | null | undefined): string | null;
+export declare function outerBoundaryNotice(home: ScopedHarnessHome | null | undefined): string | null;
 /**
  * What an attempt's harness process ACTUALLY ran under.
  *
  * One shape, written by the success path and the failure path alike. An attempt
  * that spawned a harness and then died still ran a process, and the caller of a
  * delegated run still needs to know what that process could reach — "it failed"
- * is not an answer to "was it confined".
+ * is not an answer to "what outer-boundary evidence applied".
  */
 export interface AppliedAttemptFacts {
     /**
      * ABSENT when the attempt died before its home was decided (`wsm.create` or
-     * `applyConfinement` threw). A literal `false` is a POSITIVE claim — this
+     * home selection failed). A literal `false` is a POSITIVE claim — this
      * child ran in the operator's own HOME — and an attempt that never reached
      * the decision made no such claim. Absence keeps it a gap in the record,
      * which is what `appliedEvidenceComplete` already refuses on.
@@ -134,28 +90,24 @@ export interface AppliedAttemptFacts {
  */
 export declare function appliedAttemptFacts(home: ScopedHarnessHome | null | undefined, access: AccessProfile, credentialProfileId: string | null): AppliedAttemptFacts;
 /**
- * Whether an attempt's record is auditable for a delegated MUTATING run.
+ * Whether an attempt's record is auditable for a delegated mutating run.
  *
  * The distinction this predicate exists to draw: evidence that is MISSING is
  * still a reason to refuse — an attempt that cannot say what it ran under is
  * indistinguishable from one that ran unconfined behind a green terminal.
- * Evidence that honestly says "no boundary here, and here is why" is COMPLETE;
- * the absence of a boundary is a fact about the host, not a gap in the record,
- * and refusing on it would make a delegated mutating run impossible wherever
- * Claudexor has not implemented a mechanism.
+ * Evidence that honestly says "no additional boundary, by design" is complete.
  *
  * A named mechanism is a claim, and only `verified_denied_path` discharges it —
  * so a record carrying the name without the proof is NOT complete, and neither
  * is one that claims a boundary and a reason for its absence at the same time.
  */
-export declare function appliedEvidenceComplete(facts: AppliedAttemptFacts | null | undefined): boolean;
+export declare function appliedEvidenceComplete(facts: AppliedAttemptFacts | HistoricalAppliedAttemptFacts | null | undefined): boolean;
 /**
- * The terminal gate, shared by every lane that assembles attempts.
+ * The terminal evidence gate, shared by every lane that assembles attempts.
  *
  * A delegated MUTATING run may only reach a terminal when EVERY attempt it ran
- * can state what it ran under. One lane checking and its twin not is how a
- * mutating child ends up unconfined behind a green run, so the rule lives here
- * and both callers spend it.
+ * can state what it ran under, including the deliberate absence of an outer
+ * boundary, so the rule lives here and both callers spend it.
  */
 export declare function assertDelegatedEvidence(delegated: boolean, access: AccessProfile, attempts: readonly {
     attemptId: string;

package/dist/delegatedHome.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegatedHome.d.ts","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOvD,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,sGAAsG;IACtG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAE1F;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,uBAAuB,IAAI,gBAAgB,CAM1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,OAAO,EAClB,MAAM,GAAE,aAAiC,EACzC,KAAK,GAAE,gBAA4C,EACnD,IAAI,CAAC,EAAE,eAAe,GACrB,iBAAiB,CAoCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAU3F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,aAAa,CAAC;IAC9B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,aAAa,EACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,mBAAmB,CAWrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAM9F;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACxE,IAAI,CAON"}
+{"version":3,"file":"delegatedHome.d.ts","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,2BAA2B,IAAI,6BAA6B,EAC5D,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,sGAAsG;IACtG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,OAAO,EAClB,MAAM,GAAE,aAAiC,GACxC,iBAAiB,CAsBnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQ7F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,aAAa,CAAC;IAC9B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,aAAa,EACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,mBAAmB,CAWrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,GAAG,6BAA6B,GAAG,IAAI,GAAG,SAAS,GAC5E,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACxE,IAAI,CAON"}

package/dist/delegatedHome.js

@@ -1,101 +1,51 @@
 import { existsSync } from "node:fs";
-import { applyConfinement, confinementBoundaryAvailable, DelegatedEvidenceIncompleteError, DelegatedHomeUnavailableError, } from "@claudexor/core";
-import { confinementBoundaryProven } from "@claudexor/schema";
-import { claudexorOwnedRoot, nativeHarnessStateRoot, userHomeDir } from "@claudexor/util";
+import { DelegatedEvidenceIncompleteError, DelegatedHomeUnavailableError } from "@claudexor/core";
+import { confinementBoundaryProven, DELIBERATE_NO_OUTER_BOUNDARY_REASON } from "@claudexor/schema";
 /** Access profiles under which the harness can modify the filesystem. */
 export function isMutatingAccess(access) {
     return access !== "readonly";
 }
 /**
- * Whether this run's lanes should be told to stand their own sandbox down.
- *
- * Only a delegated run asks for an engine-provided boundary, and only a host
- * that can actually provide one earns the trade. Telling a harness to drop its
- * native sandbox where Claudexor will NOT replace it is a pure loss — strictly
- * worse than never having asked — so the two conditions are one expression
- * rather than a flag the caller passes and a check nobody makes.
- */
-export function externallyConfinedLane(delegated, host) {
-    return delegated && confinementBoundaryAvailable(host).available;
-}
-export function defaultConfinementRoots() {
-    return {
-        operatorHome: userHomeDir(),
-        runtimeRoot: claudexorOwnedRoot(),
-        nativeStateRoot: nativeHarnessStateRoot(),
-    };
-}
-/**
- * Decide the harness HOME and the OS boundary one attempt runs under.
+ * Decide the harness HOME one attempt runs under.
  *
  * Unchanged for ordinary runs: an ISOLATED envelope gets the envelope's scoped
  * home, while an IN-PLACE attempt deliberately inherits the operator's native
  * environment so a harness whose native session store hangs off `$HOME` can
  * resume its vendor conversation.
  *
- * A DELEGATED run (`execution.delegated`) is scoped either way, and that is a
- * BEHAVIORAL CHANGE against that deliberate design — live + agent is exactly
- * the configuration a delegated mutating subagent uses. It is taken knowingly:
- * the caller is a machine orchestrator that owns the workspace, and the
- * operator's real `$HOME` holds material no delegated harness may read, above
- * all `~/.claudexor/v3/daemon/token`, which grants the entire control API.
- *
- * THE SCOPED HOME IS NOT THE BOUNDARY. It redirects `~`-relative lookups and
- * nothing more; the token above is one absolute path away, and a live probe
- * read it out of an ordinary `workspace_write` agent run. So a delegated
- * MUTATING attempt additionally gets an OS-ENFORCED boundary
- * (`applyConfinement`), verified against a path it denies before the harness is
- * spawned. A delegated READ-ONLY attempt keeps the harness's own read-only
- * enforcement instead: confinement stands that enforcement down (macOS refuses
- * nested sandboxes), which would be a net loss where there is no shell to
- * confine.
- *
- * WHERE THE HOST HAS NO BOUNDARY the attempt still runs, and says so: the
- * reason travels onto the attempt record, into the child's prompt and into the
- * caller's result. A delegated run that refused on every platform Claudexor has
- * not implemented a mechanism for would be a macOS-only feature wearing a
- * general name.
+ * A DELEGATED run (`execution.delegated`) is scoped either way. The scoped HOME
+ * redirects native state and profile selection; it is deliberately not called
+ * a filesystem boundary. Mutating delegated attempts disclose that Claudexor
+ * adds no outer OS boundary and leave the selected harness's native access mode
+ * in effect.
  *
  * THE COST of the scoped home, stated plainly: an in-place delegated attempt
  * CANNOT resume a native vendor session whose store lives under the real `$HOME`
  * — cursor (`~/.cursor`) and opencode (XDG data under `$HOME`) lose resume.
  * codex and claude keep it: their native session stores are Claudexor-owned
- * directories that the adapter re-points on top of this env and that the
- * confinement carves back out, and the macOS login Keychain is reached through
+ * directories that the adapter re-points on top of this env, and the macOS login Keychain is reached through
  * the declared scoped-home bridge (INV-067), so subscription auth is unaffected.
  *
- * Never degrades silently: a delegated attempt whose scoped home is not on disk,
- * or whose boundary cannot be applied and proven, refuses.
+ * Never degrades silently: a delegated attempt whose scoped home is not on disk refuses.
  */
-export function scopedHarnessHome(wsm, envelope, inPlaceEnvelope, delegated, access = "workspace_write", roots = defaultConfinementRoots(), host) {
+export function scopedHarnessHome(wsm, envelope, inPlaceEnvelope, delegated, access = "workspace_write") {
     if (inPlaceEnvelope && !delegated) {
         return {
             isolated: false,
             homeDir: null,
-            confinement: null,
-            confinementUnavailableReason: null,
+            outerBoundaryUnavailableReason: null,
         };
     }
     const env = wsm.envFor(envelope);
     const homeDir = env["HOME"];
     if (delegated && (!homeDir || !existsSync(homeDir))) {
-        throw new DelegatedHomeUnavailableError(`delegated run cannot be confined: the scoped harness home for attempt ${envelope.attempt_id} is missing (${homeDir || "unset"})`);
+        throw new DelegatedHomeUnavailableError(`delegated run cannot start: the scoped harness home for attempt ${envelope.attempt_id} is missing (${homeDir || "unset"})`);
     }
-    const outcome = delegated && isMutatingAccess(access)
-        ? applyConfinement({
-            operatorHome: roots.operatorHome,
-            runtimeRoot: roots.runtimeRoot,
-            nativeStateRoot: roots.nativeStateRoot,
-            scopedHome: homeDir,
-            worktree: envelope.worktree_path,
-        }, host)
-        : { confinement: null, unavailableReason: null };
     return {
         env,
         isolated: true,
         homeDir: homeDir ?? null,
-        confinement: outcome.confinement,
-        confinementUnavailableReason: outcome.unavailableReason,
+        outerBoundaryUnavailableReason: delegated && isMutatingAccess(access) ? DELIBERATE_NO_OUTER_BOUNDARY_REASON : null,
     };
 }
 /**
@@ -107,16 +57,14 @@ export function scopedHarnessHome(wsm, envelope, inPlaceEnvelope, delegated, acc
  * fact, so it is stated to the model in plain words rather than left in an
  * artifact it never reads.
  */
-export function confinementNotice(home) {
-    const reason = home?.confinementUnavailableReason;
+export function outerBoundaryNotice(home) {
+    const reason = home?.outerBoundaryUnavailableReason;
     if (!reason)
         return null;
     return [
-        "Engine disclosure — NO OS-ENFORCED BOUNDARY: this delegated run was asked to put your",
-        `process inside a kernel-enforced filesystem boundary and could not: ${reason}.`,
-        "Nothing outside this notice stops you from reading or writing any path this user account",
-        "can reach. Confine yourself to the worktree you were given and the HOME you were given,",
-        "and do not read the operator's credential stores or Claudexor's own runtime directory.",
+        `Engine disclosure: ${reason}`,
+        "The scoped HOME selects native state and credentials; it is not containment. Stay within",
+        "the execution workspace and do not access unrelated operator or Claudexor state.",
     ].join("\n");
 }
 /**
@@ -132,22 +80,19 @@ export function appliedAttemptFacts(home, access, credentialProfileId) {
         harness_home_dir: home?.homeDir ?? null,
         access_applied: access,
         credential_profile_applied: credentialProfileId,
-        confinement_mechanism: home?.confinement?.mechanism ?? null,
-        confinement_profile_digest: home?.confinement?.profile_digest ?? null,
-        confinement_verified_denied_path: home?.confinement?.verified_denied_path ?? null,
-        confinement_unavailable_reason: home?.confinementUnavailableReason ?? null,
+        confinement_mechanism: null,
+        confinement_profile_digest: null,
+        confinement_verified_denied_path: null,
+        confinement_unavailable_reason: home?.outerBoundaryUnavailableReason ?? null,
     };
 }
 /**
- * Whether an attempt's record is auditable for a delegated MUTATING run.
+ * Whether an attempt's record is auditable for a delegated mutating run.
  *
  * The distinction this predicate exists to draw: evidence that is MISSING is
  * still a reason to refuse — an attempt that cannot say what it ran under is
  * indistinguishable from one that ran unconfined behind a green terminal.
- * Evidence that honestly says "no boundary here, and here is why" is COMPLETE;
- * the absence of a boundary is a fact about the host, not a gap in the record,
- * and refusing on it would make a delegated mutating run impossible wherever
- * Claudexor has not implemented a mechanism.
+ * Evidence that honestly says "no additional boundary, by design" is complete.
  *
  * A named mechanism is a claim, and only `verified_denied_path` discharges it —
  * so a record carrying the name without the proof is NOT complete, and neither
@@ -162,12 +107,11 @@ export function appliedEvidenceComplete(facts) {
     return Boolean(facts.confinement_unavailable_reason);
 }
 /**
- * The terminal gate, shared by every lane that assembles attempts.
+ * The terminal evidence gate, shared by every lane that assembles attempts.
  *
  * A delegated MUTATING run may only reach a terminal when EVERY attempt it ran
- * can state what it ran under. One lane checking and its twin not is how a
- * mutating child ends up unconfined behind a green run, so the rule lives here
- * and both callers spend it.
+ * can state what it ran under, including the deliberate absence of an outer
+ * boundary, so the rule lives here and both callers spend it.
  */
 export function assertDelegatedEvidence(delegated, access, attempts) {
     if (!delegated || !isMutatingAccess(access))
@@ -175,6 +119,6 @@ export function assertDelegatedEvidence(delegated, access, attempts) {
     const unauditable = attempts.filter((attempt) => !appliedEvidenceComplete(attempt.applied));
     if (unauditable.length === 0)
         return;
-    throw new DelegatedEvidenceIncompleteError(`delegated mutating run cannot terminalize: ${unauditable.length} attempt(s) state neither a proven confinement nor a reason there was none (${unauditable.map((attempt) => attempt.attemptId).join(", ")})`);
+    throw new DelegatedEvidenceIncompleteError(`delegated mutating run cannot terminalize: ${unauditable.length} attempt(s) state neither a historical proven boundary nor the deliberate no-outer-boundary reason (${unauditable.map((attempt) => attempt.attemptId).join(", ")})`);
 }
 //# sourceMappingURL=delegatedHome.js.map

package/dist/delegatedHome.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegatedHome.js","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAsB1F,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAkB,EAAE,IAAsB;IAC/E,OAAO,SAAS,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AASD,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,YAAY,EAAE,WAAW,EAAE;QAC3B,WAAW,EAAE,kBAAkB,EAAE;QACjC,eAAe,EAAE,sBAAsB,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,QAA2B,EAC3B,eAAwB,EACxB,SAAkB,EAClB,MAAM,GAAkB,iBAAiB,EACzC,KAAK,GAAqB,uBAAuB,EAAE,EACnD,IAAsB;IAEtB,IAAI,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;YACjB,4BAA4B,EAAE,IAAI;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,6BAA6B,CACrC,yEAAyE,QAAQ,CAAC,UAAU,gBAAgB,OAAO,IAAI,OAAO,GAAG,CAClI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,gBAAgB,CACd;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,OAAiB;YAC7B,QAAQ,EAAE,QAAQ,CAAC,aAAa;SACjC,EACD,IAAI,CACL;QACH,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,4BAA4B,EAAE,OAAO,CAAC,iBAAiB;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA0C;IAC1E,MAAM,MAAM,GAAG,IAAI,EAAE,4BAA4B,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,uFAAuF;QACvF,uEAAuE,MAAM,GAAG;QAChF,0FAA0F;QAC1F,yFAAyF;QACzF,wFAAwF;KACzF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAqCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0C,EAC1C,MAAqB,EACrB,mBAAkC;IAElC,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,gBAAgB,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;QACvC,cAAc,EAAE,MAAM;QACtB,0BAA0B,EAAE,mBAAmB;QAC/C,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,IAAI,IAAI;QAC3D,0BAA0B,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,IAAI,IAAI;QACrE,gCAAgC,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,IAAI,IAAI;QACjF,8BAA8B,EAAE,IAAI,EAAE,4BAA4B,IAAI,IAAI;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6C;IACnF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAkB,EAClB,MAAqB,EACrB,QAAyE;IAEzE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,gCAAgC,CACxC,8CAA8C,WAAW,CAAC,MAAM,+EAA+E,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7M,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delegatedHome.js","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAMlG,OAAO,EAAE,yBAAyB,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAenG,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,QAA2B,EAC3B,eAAwB,EACxB,SAAkB,EAClB,MAAM,GAAkB,iBAAiB;IAEzC,IAAI,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,8BAA8B,EAAE,IAAI;SACrC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,6BAA6B,CACrC,mEAAmE,QAAQ,CAAC,UAAU,gBAAgB,OAAO,IAAI,OAAO,GAAG,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,8BAA8B,EAC5B,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI;KACrF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0C;IAC5E,MAAM,MAAM,GAAG,IAAI,EAAE,8BAA8B,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,sBAAsB,MAAM,EAAE;QAC9B,0FAA0F;QAC1F,kFAAkF;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAqCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0C,EAC1C,MAAqB,EACrB,mBAAkC;IAElC,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,gBAAgB,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;QACvC,cAAc,EAAE,MAAM;QACtB,0BAA0B,EAAE,mBAAmB;QAC/C,qBAAqB,EAAE,IAAI;QAC3B,0BAA0B,EAAE,IAAI;QAChC,gCAAgC,EAAE,IAAI;QACtC,8BAA8B,EAAE,IAAI,EAAE,8BAA8B,IAAI,IAAI;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA6E;IAE7E,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAkB,EAClB,MAAqB,EACrB,QAAyE;IAEzE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,gCAAgC,CACxC,8CAA8C,WAAW,CAAC,MAAM,uGAAuG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrO,CAAC;AACJ,CAAC"}

package/dist/diffReview.d.ts

@@ -38,10 +38,11 @@ export interface DiffReviewResult {
     reviewCashUsd: number;
     reviewValuationUsd: number;
     reviewUnknownUsd: number;
+    ignoredSettings: string[];
     artifactsDir: string;
 }
 export interface DiffReviewDeps {
-    resolveReviewers: (repoRoot: string, authPreference?: AuthPreference) => Promise<ReviewerSpec[]>;
+    resolveReviewers: (repoRoot: string, authPreference?: AuthPreference, onIgnoredSetting?: (detail: string) => void) => Promise<ReviewerSpec[]>;
     reviewScoped: (input: Omit<Parameters<typeof reviewCandidate>[0], "env">) => ReturnType<typeof reviewCandidate>;
     execRootOf: (repoRoot: string) => string;
     envInheritance: (repoRoot: string) => "mirror_native" | "clean";

package/dist/diffReview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diffReview.d.ts","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIhG,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;+EAG2E;IAC3E,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACpC,WAAW,EAAE,OAAO,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjG,YAAY,EAAE,CACZ,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KACtD,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,eAAe,GAAG,OAAO,CAAC;CACjE;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA4F3B"}
+{"version":3,"file":"diffReview.d.ts","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIhG,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;+EAG2E;IAC3E,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACpC,WAAW,EAAE,OAAO,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,cAAc,EAC/B,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KACxC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7B,YAAY,EAAE,CACZ,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KACtD,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,eAAe,GAAG,OAAO,CAAC;CACjE;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAuG3B"}

package/dist/diffReview.js

@@ -10,7 +10,7 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { HarnessUnavailableError, runCapture, runCaptureRaw } from "@claudexor/core";
 import { revalidateFindings } from "@claudexor/review";
 import { verifySealedEvidencePacket, writeEvidencePacket } from "@claudexor/context";
-import { containsSecretLikeToken, redactSecrets } from "@claudexor/util";
+import { containsSecretLikeToken, ensureDir, redactSecrets, writeJson } from "@claudexor/util";
 export async function runDiffReview(input, deps) {
     if (input.frozen && input.diff !== undefined) {
         throw new Error("reviewDiff: frozen review consumes DIFF.patch from the sealed packet");
@@ -36,7 +36,12 @@ export async function runDiffReview(input, deps) {
             throw new Error(`reviewDiff: ${label} contains a secret-like token; refusing review (remove the secret first)`);
         }
     }
-    const reviewers = await deps.resolveReviewers(input.repoRoot, input.authPreference);
+    const ignoredSettings = [];
+    const reviewers = await deps.resolveReviewers(input.repoRoot, input.authPreference, (detail) => {
+        if (!ignoredSettings.includes(detail))
+            ignoredSettings.push(detail);
+        input.onReviewerEvent?.({ type: "review.preflight", ignored_settings: [detail] });
+    });
     if (reviewers.length === 0) {
         throw new HarnessUnavailableError("no eligible reviewers (doctor-OK, review-capable) are available");
     }
@@ -78,6 +83,12 @@ export async function runDiffReview(input, deps) {
             ? (event) => input.onReviewerEvent?.({ ...event })
             : undefined,
     });
+    if (ignoredSettings.length > 0) {
+        ensureDir(artifactsDir);
+        writeJson(join(artifactsDir, "ignored-settings.json"), {
+            ignored_settings: ignoredSettings,
+        });
+    }
     if (input.frozen) {
         await verifyFrozenReviewPacket(input.repoRoot, input.frozen, false);
     }
@@ -95,6 +106,7 @@ export async function runDiffReview(input, deps) {
         reviewCashUsd: result.reviewCashUsd,
         reviewValuationUsd: result.reviewValuationUsd,
         reviewUnknownUsd: result.reviewUnknownUsd,
+        ignoredSettings,
         artifactsDir,
     };
 }

package/dist/diffReview.js.map

@@ -1 +1 @@
-{"version":3,"file":"diffReview.js","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAA2C,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAiDzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAsB,EACtB,IAAoB;IAEpB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QACpE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9C,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,4CAA4C;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,CAAC,MAAM,EAAE,IAAI,CAAC;QACd,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACtB,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC;KACpC,EAAE,CAAC;QACX,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,0EAA0E,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,OAAQ,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,OAAQ,EAAE,WAAW,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,mBAAmB,CAAC,WAAW,EAAE;YAC/B,UAAU,EAAE,aAAa,CACvB,KAAK,CAAC,UAAU,IAAI,oDAAoD,CACzE;YACD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B;YACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;QACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa;QACjE,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,gBAAgB,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5C,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,cAAc,EAAE;oBACd,YAAY,EAAE,KAAK,CAAC,MAAO,CAAC,YAAY;oBACxC,aAAa,EAAE,KAAK,CAAC,MAAO,CAAC,aAAa;oBAC1C,oBAAoB,EAAE,MAAM,CAAC,cAAc;iBAC5C;gBACD,GAAG,CAAC,KAAK,CAAC,MAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,SAAS;QACT,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;YACpC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;YAClD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE;QACzD,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,WAAW;KACZ,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,YAAY;KACb,CAAC;AACJ,CAAC;AAQD,KAAK,UAAU,wBAAwB,CACrC,aAAqB,EACrB,MAA6B,EAC7B,qBAA8B;IAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,qBAAqB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,YAAY,SAAS,SAAS,GAAG,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,aAAa,SAAS,UAAU,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,sBAAsB,EAAE,MAAM,CAAC,oBAAoB;KACpD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE;QACxC,MAAM;QACN,UAAU;QACV,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,EAAE;KAC5C,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"diffReview.js","sourceRoot":"","sources":["../src/diffReview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAA2C,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAsD/F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAsB,EACtB,IAAoB;IAEpB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QACpE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9C,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,4CAA4C;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,CAAC,MAAM,EAAE,IAAI,CAAC;QACd,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACtB,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC;KACpC,EAAE,CAAC;QACX,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,0EAA0E,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7F,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,OAAQ,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,OAAQ,EAAE,WAAW,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,mBAAmB,CAAC,WAAW,EAAE;YAC/B,UAAU,EAAE,aAAa,CACvB,KAAK,CAAC,UAAU,IAAI,oDAAoD,CACzE;YACD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B;YACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;QACrC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa;QACjE,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,gBAAgB,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5C,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,cAAc,EAAE;oBACd,YAAY,EAAE,KAAK,CAAC,MAAO,CAAC,YAAY;oBACxC,aAAa,EAAE,KAAK,CAAC,MAAO,CAAC,aAAa;oBAC1C,oBAAoB,EAAE,MAAM,CAAC,cAAc;iBAC5C;gBACD,GAAG,CAAC,KAAK,CAAC,MAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,SAAS;QACT,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;YACpC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;YAClD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,EAAE;YACrD,gBAAgB,EAAE,eAAe;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE;QACzD,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,WAAW;KACZ,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,eAAe;QACf,YAAY;KACb,CAAC;AACJ,CAAC;AAQD,KAAK,UAAU,wBAAwB,CACrC,aAAqB,EACrB,MAA6B,EAC7B,qBAA8B;IAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,qBAAqB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,YAAY,SAAS,SAAS,GAAG,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,aAAa,SAAS,UAAU,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,sBAAsB,EAAE,MAAM,CAAC,oBAAoB;KACpD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE;QACxC,MAAM;QACN,UAAU;QACV,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,EAAE;KAC5C,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7F,CAAC"}

package/dist/orchestrator-credentials.d.ts

@@ -7,13 +7,23 @@
  * (account-resolution.ts). No run/lane state lives here — only per-decision
  * reads over the host's config and deps.
  */
-import type { CredentialProfile, CredentialUnusableObservation, HarnessRunSpec, QuotaAbsence, QuotaSnapshot } from "@claudexor/schema";
+import type { AuthPreference, CredentialProfile, CredentialUnusableObservation, HarnessRunSpec, QuotaAbsence, QuotaSnapshot } from "@claudexor/schema";
 import type { loadConfig } from "@claudexor/config";
 import type { AdapterRegistry, HarnessAdapter } from "@claudexor/core";
 import type { EventLog } from "@claudexor/event-log";
 import { type ProfilePolicy, type VendorQuotaObservations } from "./credential-profiles.js";
 import type { TransientFailureObservation } from "./transientClassify.js";
 import type { RunInput } from "./orchestrator.js";
+/** Model-first reviewer account resolution input, without a fabricated RunInput. */
+export interface ReviewerProfileResolutionInput {
+    repoRoot: string;
+    harnessId: string;
+    model: string | null;
+    authPreference: AuthPreference;
+    credentialProfileId: string | null;
+    excludedProfileIds?: ReadonlySet<string>;
+}
+export declare function reviewerProfileResolver(credentials: OrchestratorCredentials, repoRoot: string): (input: Omit<ReviewerProfileResolutionInput, "repoRoot">) => Promise<CredentialProfile | null>;
 /** The slice of the Orchestrator this cluster reads; accessor functions so the
  * host can defer to deps assigned after this field initializes. */
 export interface CredentialResolutionHost {
@@ -87,7 +97,8 @@ export declare class OrchestratorCredentials {
             expires_at: string;
         }[];
     };
-    /** Thin wrapper over the ONE account-resolution owner (account-resolution.ts). */
+    /** Resolve one reviewer slot through the ordinary account-pool owner. */
+    preflightReviewerProfile(input: ReviewerProfileResolutionInput): Promise<CredentialProfile | null>;
     preflightProfile(input: RunInput, harnessId: string, model: string | null, log: EventLog | undefined, defaultRoute: "local_session" | "api_key" | null): Promise<CredentialProfile | null>;
 }
 //# sourceMappingURL=orchestrator-credentials.d.ts.map

package/dist/orchestrator-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator-credentials.d.ts","sourceRoot":"","sources":["../src/orchestrator-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,cAAc,EACd,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;mEACmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACxD,QAAQ,IAAI,eAAe,CAAC;IAC5B,cAAc,IAAI,SAAS,aAAa,EAAE,CAAC;IAC3C,aAAa,IAAI,SAAS,YAAY,EAAE,CAAC;IACzC,kBAAkB,IAAI,SAAS,6BAA6B,EAAE,CAAC;IAC/D,wBAAwB,CAAC,GAAG,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACnE,wBAAwB,CACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GACxC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc;AACvB;wDACwD;AACxD,UAAU,EAAE,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;AAC/E,0EAA0E;AAC1E,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,cAAc,CAMhB;AAED,qBAAa,uBAAuB;IAItB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IAEzD,YAA6B,IAAI,EAAE,wBAAwB,EAAI;IAE/D,8EAA8E;IAC9E,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErE;IAED,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;IAED;;8EAE0E;IAC1E,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKtE;IAED,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAmBrF;IAED;;;;yEAIqE;IACrE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,GAAG,IAAI,CAQvF;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,CAKhE;IAED;;;0DAGsD;IACtD,uBAAuB,IAAI,uBAAuB,CAKjD;IAED;;sDAEkD;IAC5C,0BAA0B,CAC9B,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,EACzC,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAa9B;IAED;4EACwE;IACxE,oBAAoB,CAClB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,SAAS,2BAA2B,EAAE;QAGhD,mBAAmB;QASnB,YAAY;;;;;;;;;;MAEf;IAED,kFAAkF;IAC5E,gBAAgB,CACpB,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,GAC/C,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6BnC;CACF"}
+{"version":3,"file":"orchestrator-credentials.d.ts","sourceRoot":"","sources":["../src/orchestrator-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,6BAA6B,EAC7B,cAAc,EACd,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,oFAAoF;AACpF,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,uBAAuB,EACpC,QAAQ,EAAE,MAAM,GACf,CAAC,KAAK,EAAE,IAAI,CAAC,8BAA8B,EAAE,UAAU,CAAC,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAEhG;AAED;mEACmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACxD,QAAQ,IAAI,eAAe,CAAC;IAC5B,cAAc,IAAI,SAAS,aAAa,EAAE,CAAC;IAC3C,aAAa,IAAI,SAAS,YAAY,EAAE,CAAC;IACzC,kBAAkB,IAAI,SAAS,6BAA6B,EAAE,CAAC;IAC/D,wBAAwB,CAAC,GAAG,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACnE,wBAAwB,CACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GACxC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc;AACvB;wDACwD;AACxD,UAAU,EAAE,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;AAC/E,0EAA0E;AAC1E,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,cAAc,CAMhB;AAED,qBAAa,uBAAuB;IAItB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IAEzD,YAA6B,IAAI,EAAE,wBAAwB,EAAI;IAE/D,8EAA8E;IAC9E,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErE;IAED,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;IAED;;8EAE0E;IAC1E,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKtE;IAED,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAmBrF;IAED;;;;yEAIqE;IACrE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,GAAG,IAAI,CAQvF;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,CAKhE;IAED;;;0DAGsD;IACtD,uBAAuB,IAAI,uBAAuB,CAKjD;IAED;;sDAEkD;IAC5C,0BAA0B,CAC9B,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,EACzC,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAa9B;IAED;4EACwE;IACxE,oBAAoB,CAClB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,SAAS,2BAA2B,EAAE;QAGhD,mBAAmB;QASnB,YAAY;;;;;;;;;;MAEf;IAED,yEAAyE;IACnE,wBAAwB,CAC5B,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAuEnC;IAEK,gBAAgB,CACpB,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,GAC/C,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6BnC;CACF"}

package/dist/orchestrator-credentials.js

@@ -1,7 +1,10 @@
-import { credentialProfilePolicyProblem, credentialProfilePolicyState } from "@claudexor/core";
+import { HarnessUnavailableError, credentialProfilePolicyProblem, credentialProfilePolicyState, } from "@claudexor/core";
 import { PoolRouteFlags, resolveAccountForRun } from "./account-resolution.js";
 import { currentSubjectProber, readyProfilesForRotation } from "./credential-differential.js";
-import { resolveCredentialProfile, } from "./credential-profiles.js";
+import { resolveCredentialProfile, probeCredentialProfileStatus, profileStatusAdmits, vendorVerifiedProfileStatus, } from "./credential-profiles.js";
+export function reviewerProfileResolver(credentials, repoRoot) {
+    return (input) => credentials.preflightReviewerProfile({ repoRoot, ...input });
+}
 /**
  * INV-137: a mid-attempt credential rotation must move the spec's LANE home
  * with it. The lane env is keyed by the RESOLVED profile, so a rotated spec
@@ -131,7 +134,65 @@ export class OrchestratorCredentials {
             liveUnusable: this.host.credentialUnusable(),
         };
     }
-    /** Thin wrapper over the ONE account-resolution owner (account-resolution.ts). */
+    /** Resolve one reviewer slot through the ordinary account-pool owner. */
+    async preflightReviewerProfile(input) {
+        const adapter = this.host.registry().get(input.harnessId);
+        const registry = this.host.config(input.repoRoot)?.global.credential_profiles ?? [];
+        const profileCardinality = credentialProfilePolicyState({ adapter, registry });
+        if (profileCardinality.ambiguous)
+            throw credentialProfilePolicyProblem(profileCardinality, "credential_profile_ambiguous");
+        let pinnedProfile = null;
+        if (input.credentialProfileId) {
+            try {
+                pinnedProfile = resolveCredentialProfile(registry, input.credentialProfileId, input.harnessId);
+            }
+            catch (error) {
+                throw new HarnessUnavailableError(error instanceof Error ? error.message : String(error));
+            }
+        }
+        if (input.credentialProfileId && !pinnedProfile) {
+            throw new HarnessUnavailableError(`reviewer credential profile "${input.credentialProfileId}" is unknown, disabled, or belongs to another harness (${input.harnessId})`);
+        }
+        const quota = this.vendorQuotaObservations();
+        // The reviewer preflight must prove an explicit pin before any model
+        // inventory call. The ordinary resolver intentionally keeps this probe
+        // optional for legacy run admission; this caller opts into the stricter
+        // reviewer contract without changing ordinary runs.
+        if (pinnedProfile) {
+            const status = vendorVerifiedProfileStatus(await probeCredentialProfileStatus(pinnedProfile, adapter?.probeCredentialProfile?.bind(adapter)), quota);
+            if (!profileStatusAdmits(pinnedProfile, status)) {
+                throw new HarnessUnavailableError(`reviewer credential profile "${pinnedProfile.profile_id}" (${input.harnessId}) is not ready: ${status.detail ?? `${status.availability}/${status.verification}`}`);
+            }
+        }
+        const defaultRoute = input.authPreference === "api_key"
+            ? "api_key"
+            : input.authPreference === "subscription"
+                ? "local_session"
+                : null;
+        return resolveAccountForRun({
+            harnessId: input.harnessId,
+            registry,
+            policy: this.profilePolicy(input.repoRoot, input.harnessId),
+            profileCardinality,
+            snapshots: this.host.quotaSnapshots(),
+            quota,
+            unusable: this.host.credentialUnusable(),
+            probe: adapter?.probeCredentialProfile?.bind(adapter),
+            pinnedProfile,
+            excludedProfileIds: input.excludedProfileIds,
+            boundProfileId: null,
+            threadId: null,
+            model: input.model,
+            defaultRoute,
+            nativeCredentialsDisabled: this.nativeCredentialsDisabled(input.repoRoot, input.harnessId),
+            authPreference: input.authPreference,
+            // Reviewer resolution has no ordinary RunInput identity to retain. The
+            // selected profile is returned directly; explicit api_key remains in the
+            // auth preference and therefore needs no pool flag.
+            notePoolApiKeyRoute: () => { },
+            emit: () => { },
+        });
+    }
     async preflightProfile(input, harnessId, model, log, defaultRoute) {
         const adapter = this.host.registry().get(harnessId);
         const registry = this.host.config(input.repoRoot)?.global.credential_profiles ?? [];