@codedology/code-forge 0.1.0

package/src/review/gate-check.mjs

@@ -0,0 +1,249 @@
+/**
+ * The block gate's review rows (plan §4.6 rows 2, 9 and 11; §4.9 `block waive`; §4.11; block B12b).
+ *
+ * `checkBlockReviews` refuses the block when:
+ *  - `unreviewed`: a changed or new file has NO `review.approved` row for its CURRENT content hash;
+ *  - `unsigned`:   the file's approvals for that hash exist but none carries a valid MAC;
+ *  - `rule_break`: a `rule_break` row names the block, or the coder transcript hits the forbidden
+ *    list (`scanTranscript`; a read of `~/.code-forge/runs/` — the signer key — is the named case);
+ *  - `late_unruled`: a `review.late_finding` has neither a signed `review.late_ruling` (the
+ *    block-close sweep's L3 ruling) nor a signed `review.waived` row;
+ *  - `review_cap`: a file stopped at `review_cap` has an open finding with no signed
+ *    `review.waived {by: human}` row — unless the file has a signed approval at its current hash
+ *    (the human fixed it by hand and it was reviewed);
+ *  - `unproven`:   a changed owned file of tier `high` (B20, Ricardo 2026-09-25) has no covering
+ *    red→green proof (`checkBlockProof`, below). Light-tier files need no proof row.
+ * Rulings and waivers only count when their MAC verifies AND name the finding's file exactly
+ * (`file` + `finding`; a finding id is scoped to one file, so a waiver of `F1` in `a.mjs` never
+ * clears `F1` in `b.mjs`); a late finding counts whether or not it is signed (fail closed).
+ *
+ * `block waive <id> <finding> --file <path> --reason <text>` (`waiveFinding`) writes a signed
+ * `review.waived` row with `by: human`. The orchestrator runs it only after the human said so in chat; the brief
+ * never mentions it; for a coder the argv is forbidden (`mergeForbidden()` always carries B12b's
+ * coder-only entries, `CODER_ONLY_FORBIDDEN` in `util/forbidden.mjs`).
+ */
+
+import { lstatSync } from 'node:fs';
+import path from 'node:path';
+import { mergeForbidden, scanTranscript } from '../util/forbidden.mjs';
+import { exec } from '../util/exec.mjs';
+import { readRun, writeSigned } from '../state/run.mjs';
+import { StateError } from '../state/paths.mjs';
+import { verifyRow } from '../state/signer.mjs';
+import { tierFor } from '../proof/tiers.mjs';
+import { DELETED_HASH, contentHash, gitChildEnv } from '../worker/ticket.mjs';
+
+/**
+ * @typedef {{code: 'unreviewed' | 'unsigned' | 'rule_break' | 'late_unruled' | 'review_cap' | 'unproven', file?: string, finding?: string, detail?: string}} Refusal
+ */
+
+/** @param {Record<string, any>} row @param {Buffer} key */
+const verified = (row, key) => verifyRow(row, key).ok;
+
+/**
+ * @param {{
+ *   block: string, runId: string, files: Array<{file: string, content_hash: string}>,
+ *   rows: Array<Record<string, any>>, key: Buffer, transcript?: string | null,
+ *   extraTokens?: string[], proofFiles: Array<{file: string, content_hash: string}>,
+ *   highPaths: ReadonlyArray<string>,
+ * }} opts `proofFiles` is the set the proof check reads — `--no-require-reviews` empties `files`
+ *   but never the proof check; `highPaths` is `proof.tiers.high.paths`. Both are REQUIRED: a
+ *   caller that leaves one out gets a TypeError, never a silent default that skips the proof.
+ *   `runId` is required too: the proof check matches its rows on this run only (fix round 4).
+ * @returns {{ok: boolean, refusals: Refusal[]}}
+ * @throws {TypeError} `runId`, `proofFiles` or `highPaths` undefined
+ */
+export function checkBlockReviews({ block, runId, files, rows, key, transcript = null, extraTokens = [], proofFiles, highPaths }) {
+  if (runId === undefined) throw new TypeError('checkBlockReviews: runId is required (the proof check matches rows on this run only)');
+  if (proofFiles === undefined) throw new TypeError('checkBlockReviews: proofFiles is required (the changed owned files the proof check reads)');
+  if (highPaths === undefined) throw new TypeError('checkBlockReviews: highPaths is required (proof.tiers.high.paths)');
+  const mine = rows.filter((r) => r?.block === block && (runId === undefined || r.run === undefined || r.run === runId));
+  /** @type {Refusal[]} */
+  const refusals = [];
+  const approvedFor = (/** @type {string} */ file, /** @type {string} */ hash) => mine.filter((r) => r.event === 'review.approved' && r.file === file && r.content_hash === hash);
+  const hashOf = new Map(files.map((f) => [f.file, f.content_hash]));
+
+  for (const { file, content_hash } of files) {
+    const approvals = approvedFor(file, content_hash);
+    if (approvals.length === 0) refusals.push({ code: 'unreviewed', file, detail: `no review.approved row for ${file} at its current content` });
+    else if (!approvals.some((r) => verified(r, key))) refusals.push({ code: 'unsigned', file, detail: `the review.approved row for ${file} has no valid MAC` });
+  }
+
+  for (const r of mine.filter((row) => row.event === 'rule_break')) refusals.push({ code: 'rule_break', detail: `rule_break row: ${String(r.id ?? r.rule ?? 'unnamed')}` });
+  if (typeof transcript === 'string' && transcript.length > 0) {
+    for (const hit of scanTranscript(transcript, mergeForbidden(extraTokens))) refusals.push({ code: 'rule_break', detail: `transcript line ${hit.line}: ${hit.id}` });
+  }
+
+  const signedOf = (/** @type {string} */ event) => mine.filter((r) => r.event === event && verified(r, key));
+  const waivers = signedOf('review.waived').filter((r) => r.by === 'human');
+  const rulings = signedOf('review.late_ruling');
+  const matches = (/** @type {Record<string, any>} */ r, /** @type {string} */ file, /** @type {string} */ finding) => r.finding === finding && r.file === file;
+  const waived = (/** @type {string} */ file, /** @type {string} */ finding) => waivers.some((r) => matches(r, file, finding));
+
+  for (const late of mine.filter((r) => r.event === 'review.late_finding')) {
+    if (rulings.some((r) => matches(r, late.file, late.finding)) || waived(late.file, late.finding)) continue;
+    refusals.push({ code: 'late_unruled', file: late.file, finding: late.finding, detail: `late finding ${late.finding} in ${late.file} has no ruling` });
+  }
+
+  for (const cap of mine.filter((r) => r.event === 'review.cap')) {
+    const hash = hashOf.get(cap.file);
+    if (hash !== undefined && approvedFor(cap.file, hash).some((r) => verified(r, key))) continue;
+    for (const finding of Array.isArray(cap.open) ? cap.open : []) {
+      if (!waived(cap.file, finding)) refusals.push({ code: 'review_cap', file: cap.file, finding, detail: `${cap.file} stopped at review_cap; finding ${finding} is open and not waived` });
+    }
+  }
+  for (const r of checkBlockProof({ runId, files: proofFiles, rows: mine, key, highPaths })) {
+    if (!waived(/** @type {string} */ (r.file), PROOF_FINDING)) refusals.push(r);
+  }
+  return { ok: refusals.length === 0, refusals };
+}
+
+/** The finding id a human waives to clear an `unproven` file: `block waive <id> proof --file <path>`. */
+export const PROOF_FINDING = 'proof';
+
+/**
+ * The file's proof tier at close, from the same inputs `proof tier` uses (§7.1): the config's
+ * `proof.tiers.high.paths`, the highest `risk` any row of the block recorded for the file (the
+ * worker's `review.plan` rows), and `security_sensitive: true` on any such row. The MAC is checked
+ * FIRST and fails closed: when ANY row naming the file does not verify — with or without a `risk`
+ * field — the file counts as risk 3.
+ * @param {{file: string, rows: Array<Record<string, any>>, key: Buffer, highPaths: ReadonlyArray<string>}} opts
+ * @returns {import('../proof/tiers.mjs').Tier}
+ */
+export function closeTier({ file, rows, key, highPaths }) {
+  let risk = 0;
+  let securitySensitive = false;
+  for (const r of rows) {
+    if (r?.file !== file) continue;
+    if (!verified(r, key)) {
+      risk = 3;
+      continue;
+    }
+    if (typeof r.risk === 'number' && Number.isFinite(r.risk)) risk = Math.max(risk, Math.min(3, Math.max(0, r.risk)));
+    if (r.security_sensitive === true) securitySensitive = true;
+  }
+  return tierFor({ file, risk, securitySensitive, highPaths: [...highPaths] }).tier;
+}
+
+/**
+ * B20 (Ricardo 2026-09-25): every changed owned file of tier `high` needs a covering red→green
+ * proof, checked PER FILE. A file is covered by a `proof` row of this run and block (`rows` must
+ * already be the block's rows) with `step: 'red-green'`, `proven: true`, `red_kind: 'assertion'`,
+ * whose MAC verifies and whose `covers` list (written by `proof red-green`: the sources the
+ * `revert` mechanism put back to base, or the test file itself for `assertion-deletion`) names
+ * that file. A deleted file has nothing a test can exercise and is skipped (its review row is
+ * still required). Light-tier files need nothing.
+ * @param {{runId: string, files: Array<{file: string, content_hash: string}>, rows: Array<Record<string, any>>, key: Buffer, highPaths: ReadonlyArray<string>}} opts
+ *   `runId` and `highPaths` are required: a proof row counts only when `r.run === runId` (a row
+ *   of another run, or with no `run`, never covers anything), and there is no "no high path" default.
+ * @returns {Refusal[]} one `unproven` refusal per uncovered high-tier file.
+ * @throws {TypeError} `runId` or `highPaths` undefined
+ */
+export function checkBlockProof({ runId, files, rows, key, highPaths }) {
+  if (runId === undefined) throw new TypeError('checkBlockProof: runId is required (a proof row counts only for its own run)');
+  if (highPaths === undefined) throw new TypeError('checkBlockProof: highPaths is required (proof.tiers.high.paths)');
+  const high = files.filter((f) => f.content_hash !== DELETED_HASH && closeTier({ file: f.file, rows, key, highPaths }) === 'high');
+  if (high.length === 0) return [];
+  const proofs = rows.filter(
+    (r) =>
+      r?.event === 'proof' &&
+      r.step === 'red-green' &&
+      r.proven === true &&
+      r.red_kind === 'assertion' &&
+      r.run === runId &&
+      Array.isArray(r.covers) &&
+      verified(r, key),
+  );
+  return high
+    .filter(({ file }) => !proofs.some((r) => r.covers.includes(file)))
+    .map(({ file }) => ({ code: /** @type {const} */ ('unproven'), file, detail: `${file} is high tier and has no proven red→green row covering it` }));
+}
+
+/**
+ * A file as the gate names it: a repo-relative POSIX path with `./` segments dropped. This is the
+ * ONE normalization of the block file set and of a proof row's `covers` (B20), so a path written
+ * by `proof red-green` compares equal to the gate's changed-file path. An absolute path, a `..`
+ * escape, a backslash or a NUL is refused.
+ * @param {string} raw @returns {string}
+ * @throws {StateError} `bad-path`
+ */
+export function repoRelativePath(raw) {
+  if (typeof raw !== 'string' || raw.length === 0 || path.posix.isAbsolute(raw) || raw.includes('\\') || raw.includes('\0')) {
+    throw new StateError('bad-path', 'a block file must be a repo-relative POSIX path');
+  }
+  const normalized = path.posix.normalize(raw);
+  if (normalized === '.' || normalized === '..' || normalized.startsWith('../')) throw new StateError('bad-path', 'a block file must stay inside the repository');
+  return normalized;
+}
+
+/**
+ * The block's file set (§4.1): changed tracked files since `base` (deletions included, hashed
+ * `DELETED_HASH`) ∪ untracked files, filtered to `owned` (exact paths; a glob owned entry matches through `matchOwned`), each with its content hash.
+ * Every path goes through `repoRelativePath`.
+ * @param {{repoRoot: string, base: string, owned: string[], matchOwned?: (file: string) => boolean}} opts
+ * @returns {Promise<Array<{file: string, content_hash: string}>>}
+ */
+export async function blockFileSet({ repoRoot, base, owned, matchOwned }) {
+  if (typeof base !== 'string' || !/^[0-9a-f]{7,64}$/.test(base)) throw new StateError('bad-ref', 'the block base must be a commit id');
+  const env = gitChildEnv();
+  const changed = await exec(['git', 'diff', '--name-only', '-z', '--no-renames', base, '--'], { cwd: repoRoot, env, timeoutMs: 30000 });
+  const untracked = await exec(['git', 'ls-files', '-z', '--others', '--exclude-standard'], { cwd: repoRoot, env, timeoutMs: 30000 });
+  if (changed.result !== 'ok' || untracked.result !== 'ok') throw new StateError('git-failed', 'git could not list the block file set');
+  const all = new Set(
+    [...changed.stdout.split('\0'), ...untracked.stdout.split('\0')].filter((f) => f.length > 0).map((f) => repoRelativePath(f)),
+  );
+  const isOwned = matchOwned ?? ((/** @type {string} */ f) => owned.includes(f));
+  return [...all]
+    .filter((f) => isOwned(f))
+    .sort()
+    .map((file) => ({ file, content_hash: isOnDisk(repoRoot, file) ? contentHash(repoRoot, file) : DELETED_HASH }));
+}
+
+/**
+ * A deleted owned file (its directory may be gone too) is a change that needs review; its hash is
+ * `DELETED_HASH`, never a read of a path that is not there.
+ * @param {string} repoRoot @param {string} file @returns {boolean}
+ */
+function isOnDisk(repoRoot, file) {
+  try {
+    lstatSync(path.join(repoRoot, file));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * A `closeBlock` extra check (B8's `extraChecks` seam): refusals joined into one reason.
+ * @param {() => Promise<Parameters<typeof checkBlockReviews>[0]>} load
+ * @returns {() => Promise<{ok: boolean, reason?: string}>}
+ */
+export function reviewGateCheck(load) {
+  return async () => {
+    const result = checkBlockReviews(await load());
+    if (result.ok) return { ok: true };
+    return { ok: false, reason: result.refusals.map((r) => `${r.code}${r.file ? ` ${r.file}` : ''}${r.finding ? ` ${r.finding}` : ''}`).join('; ') };
+  };
+}
+
+/**
+ * `block waive` — a signed `review.waived` row, `by: human`, scoped to ONE file (`file` is
+ * required: the gate matches a waiver by `file` + `finding`). The block must exist in the run.
+ * @param {{runId: string, id: string, finding: string, reason: string, file: string, writeRow: (row: Record<string, any>) => Promise<unknown>}} opts
+ * @returns {Promise<Record<string, any>>} the signed row.
+ */
+export async function waiveFinding({ runId, id, finding, reason, file, writeRow }) {
+  if (typeof finding !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$/.test(finding)) throw new StateError('usage', 'a finding id is required (letters, digits, . _ : -)');
+  if (typeof reason !== 'string' || reason.trim().length === 0) throw new StateError('usage', 'block waive needs --reason');
+  if (typeof file !== 'string' || file.length === 0) throw new StateError('usage', 'block waive needs --file <path>');
+  if (path.isAbsolute(file) || file.split('/').includes('..') || file.startsWith('./')) throw new StateError('usage', '--file must be repo-root-relative');
+  const record = await readRun(runId);
+  if (!record.blocks?.[id]) throw new StateError('unknown_block', `block ${id} is not in run ${runId}`);
+  const row = { event: 'review.waived', block: id, file, finding, reason: reason.trim(), by: 'human' };
+  let written = null;
+  await writeSigned(runId, async (signed) => {
+    written = signed;
+    return writeRow(signed);
+  }, row);
+  return /** @type {Record<string, any>} */ (written);
+}

package/src/review/lenses/A.md

@@ -0,0 +1,22 @@
+# Lens: A (correctness and edge cases)
+
+You are reviewer A. Another reviewer covers contracts and security; you cover CORRECTNESS.
+You work blind: you do not see the other reviewer's answer.
+
+## What to look for
+
+- Every branch of the changed code: is each one reachable and right?
+- Boundaries: empty, zero, one, many, maximum; off-by-one in loops, slices and ranges.
+- Error paths: what happens when a call fails, a file is missing, input is malformed.
+- State: ordering, concurrency, partial writes, values that can be stale.
+- Arithmetic and units: rounding, overflow, bytes versus characters, time zones.
+
+## Rules for every answer
+
+- Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- You have no tools and no project files. The packet is everything you get.
+- `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
+- Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).
+- Every finding names `file`, `line_start`, `line_end` (line numbers of the CURRENT file, as numbered in the context), `severity` (`critical` = wrong behaviour, data loss, security; `warning` = a real defect that is not critical; `nit` = style or preference), a short `category`, the `claim`, the `evidence` you read in the packet, and the `fix`. Each of `claim`, `evidence`, `fix` ≤ 300 chars.
+- `passed` is true only when you found no `critical` and no `warning`.
+- Do not invent a problem to look thorough. An empty `findings` list is a valid answer.

package/src/review/lenses/B.md

@@ -0,0 +1,23 @@
+# Lens: B (contracts, project rules, security)
+
+You are reviewer B. Another reviewer covers correctness; you cover CONTRACTS, RULES and SECURITY.
+You work blind: you do not see the other reviewer's answer.
+
+## What to look for
+
+- Contracts: the shape and meaning of every input and output the change touches; callers that
+  would break; a changed default.
+- Project rules: every rule in the packet's rules digest that the change could violate.
+- Security: secrets in code, logs or messages; shell strings instead of argument arrays; paths
+  that can escape a root (`..`, absolute, symlinks); missing authorization; unsafe defaults.
+- Facts: a flag, path or API the change relies on that the facts excerpt contradicts.
+
+## Rules for every answer
+
+- Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- You have no tools and no project files. The packet is everything you get.
+- `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
+- Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).
+- Every finding names `file`, `line_start`, `line_end` (line numbers of the CURRENT file, as numbered in the context), `severity` (`critical` = wrong behaviour, data loss, security; `warning` = a real defect that is not critical; `nit` = style or preference), a short `category`, the `claim`, the `evidence` you read in the packet, and the `fix`. Each of `claim`, `evidence`, `fix` ≤ 300 chars.
+- `passed` is true only when you found no `critical` and no `warning`.
+- Do not invent a problem to look thorough. An empty `findings` list is a valid answer.

package/src/review/lenses/full.md

@@ -0,0 +1,23 @@
+# Lens: full
+
+You are a code reviewer doing a FULL review of one changed file.
+
+## What to look for
+
+- Correctness: every changed branch, boundary and error path; inputs the code does not guard.
+- Contracts: what callers and callees expect (types, return shapes, units, null/empty cases).
+- Tests: whether the change is tested where the diff shows tests; a test that cannot fail.
+- Security: secrets, injection (shell strings, unescaped input), paths that escape a root, unsafe defaults.
+- Project rules given in the packet's rules digest.
+
+Report each real defect once, at the lines where it lives.
+
+## Rules for every answer
+
+- Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- You have no tools and no project files. The packet is everything you get.
+- `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
+- Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).
+- Every finding names `file`, `line_start`, `line_end` (line numbers of the CURRENT file, as numbered in the context), `severity` (`critical` = wrong behaviour, data loss, security; `warning` = a real defect that is not critical; `nit` = style or preference), a short `category`, the `claim`, the `evidence` you read in the packet, and the `fix`. Each of `claim`, `evidence`, `fix` ≤ 300 chars.
+- `passed` is true only when you found no `critical` and no `warning`.
+- Do not invent a problem to look thorough. An empty `findings` list is a valid answer.

package/src/review/lenses/judge.md

@@ -0,0 +1,21 @@
+# Lens: judge
+
+You are the judge. Two independent reviewers (A and B) reviewed the same change blind. You get
+their two answers, the list of hunk headers, and the diff only when the packet includes it.
+
+## Your job
+
+- Decide which findings are real. A finding both reviewers raised is `agreement: both`; one
+  only A raised is `A-only`; one only B raised is `B-only`. Set `agreement` on every finding you keep.
+- Drop a finding whose evidence does not support its claim. Merge duplicates into one finding.
+- Keep the reviewers' `file`, `line_start`, `line_end` unless they contradict each other; then
+  keep the narrower range.
+- Your `findings` list is final: nothing you drop is fixed, everything you keep is.
+- `passed` is true only when you keep no `critical` and no `warning`.
+
+## Rules for every answer
+
+- Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- You have no tools and no project files. The packet is everything you get.
+- `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order.
+- Answer with ONE JSON object that matches the answer schema.

package/src/review/lenses/quick.md

@@ -0,0 +1,21 @@
+# Lens: quick
+
+You are a code reviewer doing a QUICK pass on one small, low-risk change.
+
+## What to look for
+
+- Obvious bugs in the changed lines: wrong condition, wrong variable, off-by-one, a missing `await`, an unhandled error path.
+- A change that plainly does not do what its own code and names say.
+- Anything that leaks a secret or writes outside the paths the change is about.
+
+Skip style, naming and structure unless it hides a bug. Keep `findings` short.
+
+## Rules for every answer
+
+- Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- You have no tools and no project files. The packet is everything you get.
+- `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order. A review whose `reviewed_hunks` does not match is discarded.
+- Answer with ONE JSON object that matches the answer schema: `passed`, `summary` (≤ 300 chars), `reviewed_hunks`, `findings[]`, and `needs_file[]` (empty when you need nothing).
+- Every finding names `file`, `line_start`, `line_end` (line numbers of the CURRENT file, as numbered in the context), `severity` (`critical` = wrong behaviour, data loss, security; `warning` = a real defect that is not critical; `nit` = style or preference), a short `category`, the `claim`, the `evidence` you read in the packet, and the `fix`. Each of `claim`, `evidence`, `fix` ≤ 300 chars.
+- `passed` is true only when you found no `critical` and no `warning`.
+- Do not invent a problem to look thorough. An empty `findings` list is a valid answer.

package/src/review/lenses/recheck.md

@@ -0,0 +1,23 @@
+# Lens: recheck
+
+The packet is a fix; say per finding whether it is resolved; report a new problem only if it is inside the shown hunks.
+
+You get the open findings (by `id`) from the previous round and the FIX HUNKS: only the lines
+that changed since that round, each with a window of the current file around it.
+
+## Your job
+
+- For every open finding, add one entry to `resolved`: `{id, resolved: true|false, why}`
+  (`why` ≤ 200 chars). `resolved: true` only when the shown lines fix the problem without
+  introducing a new one.
+- A new problem goes in `findings` ONLY when its `line_start..line_end` lies inside a shown fix
+  hunk. Anything outside the hunks is not yours to report in this round.
+- `passed` is true only when every open finding is resolved and you raised no new `critical`
+  or `warning`.
+
+## Rules for every answer
+
+- Judge only what is in the packet; if you need a file you cannot see, return it in `needs_file` instead of guessing.
+- You have no tools and no project files. The packet is everything you get.
+- `reviewed_hunks`: copy every `@@ … @@` hunk header listed under "hunks" in the packet, exactly and in the same order.
+- Answer with ONE JSON object that matches the answer schema.