@delegance/claude-autopilot 5.2.2 → 6.2.2

package/dist/src/core/run-state/provider-readback.js

@@ -0,0 +1,426 @@
+// src/core/run-state/provider-readback.ts
+//
+// v6 Phase 6 — pluggable provider read-back layer.
+//
+// When the run-state engine resumes a run that has prior `phase.success` +
+// side-effects + persisted `externalRefs`, the replay decision (see
+// `replay-decision.ts`) is NOT pure — it MUST consult the platform of record
+// to confirm the ref is still live and in the expected state. e.g. for a
+// `github-pr` ref we ask `gh pr view <id> --json state` and inspect
+// open / closed / merged. For a `deploy` ref we ask the adapter's `status()`.
+//
+// This file is the seam: a `ProviderReadback` interface, a registry mapping
+// `ExternalRef.kind` to an implementation, and the built-in readbacks for
+// github / vercel / fly / render / supabase. Each readback FAILS CLOSED — any
+// throw or unrecognized response shape is recorded as
+// `existsOnPlatform: false, currentState: 'unknown'`. Callers (the replay
+// decision matrix) treat unknown-state as `needs-human` so we never quietly
+// overwrite or duplicate a side effect on a missing/stale ref.
+//
+// Spec: docs/specs/v6-run-state-engine.md "Idempotency rules + external
+// operation ledger (Codex CRITICAL #2)" — replay decision is "persisted refs
+// + a provider read-back check (e.g., 'is PR #123 still open?')".
+import { runSafe } from "../shell.js";
+// ---------------------------------------------------------------------------
+// Wrapping helper — guarantees the fail-closed contract regardless of impl.
+// ---------------------------------------------------------------------------
+/** Wrap a readback so that any throw collapses to the unknown-state result.
+ *  All built-in readbacks below opt into this; external implementations are
+ *  free to use it too. Centralizes the fail-closed invariant. */
+function failClosed(name, ref, fn) {
+    return fn().catch(() => unknownResult(ref, { readback: name, threw: true }));
+}
+/** Build a fail-closed result for a ref that the readback couldn't verify. */
+function unknownResult(ref, metadata) {
+    return {
+        refKind: ref.kind,
+        refId: ref.id,
+        existsOnPlatform: false,
+        currentState: 'unknown',
+        ...(metadata ? { metadata } : {}),
+    };
+}
+const defaultGhRunner = (args) => runSafe('gh', args, { timeout: 30000 });
+export function makeGithubReadback(opts = {}) {
+    const gh = opts.gh ?? defaultGhRunner;
+    return {
+        name: 'github',
+        handles: ['github-pr', 'github-comment', 'git-remote-push'],
+        verifyRef: (ref) => failClosed('github', ref, async () => {
+            if (ref.kind === 'github-pr')
+                return verifyGithubPr(gh, ref);
+            if (ref.kind === 'github-comment')
+                return verifyGithubComment(gh, ref);
+            if (ref.kind === 'git-remote-push')
+                return verifyGitRemotePush(gh, ref);
+            return unknownResult(ref, { readback: 'github', reason: 'unsupported-kind' });
+        }),
+    };
+}
+async function verifyGithubPr(gh, ref) {
+    // `gh pr view <id> --json state,url,title,merged` — single deterministic
+    // call. PR ID may be a bare number ("99") or a full URL.
+    const out = gh(['pr', 'view', ref.id, '--json', 'state,url,title,merged']);
+    if (out === null)
+        return unknownResult(ref, { readback: 'github-pr', reason: 'gh-cli-failed' });
+    let parsed;
+    try {
+        parsed = JSON.parse(out);
+    }
+    catch {
+        return unknownResult(ref, { readback: 'github-pr', reason: 'unparseable-json' });
+    }
+    // Map gh's state vocabulary onto ours. gh returns OPEN | CLOSED | MERGED.
+    // `merged: true` overrides — a closed-merged PR is "merged", not "closed".
+    let currentState;
+    if (parsed.merged === true || parsed.state === 'MERGED')
+        currentState = 'merged';
+    else if (parsed.state === 'OPEN')
+        currentState = 'open';
+    else if (parsed.state === 'CLOSED')
+        currentState = 'closed';
+    else
+        currentState = 'unknown';
+    return {
+        refKind: ref.kind,
+        refId: ref.id,
+        existsOnPlatform: true,
+        currentState,
+        metadata: {
+            readback: 'github-pr',
+            ...(parsed.url ? { url: parsed.url } : {}),
+            ...(parsed.title ? { title: parsed.title } : {}),
+            rawState: parsed.state,
+        },
+    };
+}
+async function verifyGithubComment(gh, ref) {
+    // gh doesn't have a clean per-comment-ID lookup — we use `gh api` against
+    // the issues comments endpoint. Comment IDs are integers; if the ref id is
+    // qualified as `<repo>:<id>` we split, else we rely on cwd's repo context.
+    let endpoint;
+    if (ref.id.includes(':')) {
+        const [repo, commentId] = ref.id.split(':', 2);
+        endpoint = `/repos/${repo}/issues/comments/${commentId}`;
+    }
+    else {
+        endpoint = `/repos/{owner}/{repo}/issues/comments/${ref.id}`;
+    }
+    const out = gh(['api', endpoint]);
+    if (out === null) {
+        // gh api returns non-zero on 404. Treat as does-not-exist (which is
+        // distinct from unknown — a deleted comment is meaningful: replay would
+        // create a new comment, so the prior ref is no longer authoritative).
+        return {
+            refKind: ref.kind,
+            refId: ref.id,
+            existsOnPlatform: false,
+            currentState: 'closed',
+            metadata: { readback: 'github-comment', reason: 'gh-api-failed-or-404' },
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(out);
+    }
+    catch {
+        return unknownResult(ref, { readback: 'github-comment', reason: 'unparseable-json' });
+    }
+    return {
+        refKind: ref.kind,
+        refId: ref.id,
+        existsOnPlatform: typeof parsed.id === 'number',
+        currentState: typeof parsed.id === 'number' ? 'open' : 'unknown',
+        metadata: {
+            readback: 'github-comment',
+            ...(parsed.html_url ? { url: parsed.html_url } : {}),
+        },
+    };
+}
+async function verifyGitRemotePush(gh, ref) {
+    // For a git-remote-push ref the id is the commit SHA. We confirm it exists
+    // on the remote by asking gh for the commit. Treat "not found" as
+    // does-not-exist (rebased away), distinct from unknown (auth/network).
+    // gh api format: /repos/{owner}/{repo}/commits/<sha>.
+    const out = gh(['api', `/repos/{owner}/{repo}/commits/${ref.id}`]);
+    if (out === null) {
+        return {
+            refKind: ref.kind,
+            refId: ref.id,
+            existsOnPlatform: false,
+            currentState: 'closed',
+            metadata: { readback: 'git-remote-push', reason: 'gh-api-failed-or-404' },
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(out);
+    }
+    catch {
+        return unknownResult(ref, { readback: 'git-remote-push', reason: 'unparseable-json' });
+    }
+    return {
+        refKind: ref.kind,
+        refId: ref.id,
+        existsOnPlatform: typeof parsed.sha === 'string',
+        currentState: typeof parsed.sha === 'string' ? 'live' : 'unknown',
+        metadata: {
+            readback: 'git-remote-push',
+            ...(parsed.html_url ? { url: parsed.html_url } : {}),
+        },
+    };
+}
+let deployAdapterResolver = null;
+/** Register a resolver that maps a provider name (e.g. "vercel") to a
+ *  status-fetcher. The CLI wires this from `src/adapters/deploy/index.ts`
+ *  during boot; tests inject mocks directly. */
+export function registerDeployAdapterResolver(resolver) {
+    deployAdapterResolver = resolver;
+}
+/** Reset the registered resolver. Test-only seam. */
+export function __resetDeployAdapterResolver() {
+    deployAdapterResolver = null;
+}
+export function makeDeployReadback(name, providers) {
+    return {
+        name,
+        handles: ['deploy', 'rollback-target'],
+        providers,
+        verifyRef: (ref) => failClosed(name, ref, async () => {
+            const provider = ref.provider ?? null;
+            if (!provider || !providers.includes(provider)) {
+                return unknownResult(ref, {
+                    readback: name,
+                    reason: 'provider-mismatch',
+                    refProvider: provider,
+                });
+            }
+            if (!deployAdapterResolver) {
+                return unknownResult(ref, {
+                    readback: name,
+                    reason: 'no-adapter-resolver-registered',
+                });
+            }
+            const fetcher = deployAdapterResolver(provider);
+            if (!fetcher) {
+                return unknownResult(ref, {
+                    readback: name,
+                    reason: 'adapter-not-resolvable',
+                    provider,
+                });
+            }
+            const r = await fetcher.status({ deployId: ref.id });
+            // Map adapter status → ReadbackState. The adapter contract returns
+            // 'pass'|'fail'|'in-progress'|'fail_rolled_back'|'fail_rollback_failed'.
+            let currentState;
+            switch (r.status) {
+                case 'pass':
+                    currentState = 'live';
+                    break;
+                case 'fail':
+                case 'fail_rollback_failed':
+                    currentState = 'failed';
+                    break;
+                case 'fail_rolled_back':
+                    currentState = 'rolled-back';
+                    break;
+                case 'in-progress':
+                    currentState = 'open';
+                    break;
+                default:
+                    currentState = 'unknown';
+            }
+            return {
+                refKind: ref.kind,
+                refId: ref.id,
+                existsOnPlatform: true,
+                currentState,
+                metadata: {
+                    readback: name,
+                    provider,
+                    rawStatus: r.status,
+                    ...(r.deployUrl ? { deployUrl: r.deployUrl } : {}),
+                },
+            };
+        }),
+    };
+}
+let migrationStateFetcher = null;
+/** Register the migration-state fetcher used by the supabase readback.
+ *  CLI boot wires this; tests inject directly. */
+export function registerMigrationStateFetcher(fetcher) {
+    migrationStateFetcher = fetcher;
+}
+export function __resetMigrationStateFetcher() {
+    migrationStateFetcher = null;
+}
+let migrationBatchFetcher = null;
+/** Register the `migration-batch` fetcher. The CLI boot wires this from the
+ *  per-skill adapter; tests inject mocks directly. */
+export function registerMigrationBatchFetcher(fetcher) {
+    migrationBatchFetcher = fetcher;
+}
+export function __resetMigrationBatchFetcher() {
+    migrationBatchFetcher = null;
+}
+export function makeSupabaseReadback() {
+    return {
+        name: 'supabase',
+        handles: ['migration-version', 'migration-batch'],
+        verifyRef: (ref) => failClosed('supabase', ref, async () => {
+            if (ref.kind === 'migration-batch')
+                return verifyMigrationBatch(ref);
+            // migration-version
+            if (!migrationStateFetcher) {
+                return unknownResult(ref, {
+                    readback: 'supabase',
+                    reason: 'no-migration-state-fetcher-registered',
+                });
+            }
+            const result = await migrationStateFetcher.fetch(ref.id);
+            if (!result) {
+                return unknownResult(ref, {
+                    readback: 'supabase',
+                    reason: 'migration-state-fetch-failed-or-not-found',
+                });
+            }
+            return {
+                refKind: ref.kind,
+                refId: ref.id,
+                existsOnPlatform: true,
+                currentState: result.applied ? 'live' : 'open',
+                metadata: {
+                    readback: 'supabase',
+                    applied: result.applied,
+                    ...(result.appliedAt ? { appliedAt: result.appliedAt } : {}),
+                },
+            };
+        }),
+    };
+}
+async function verifyMigrationBatch(ref) {
+    if (!migrationBatchFetcher) {
+        return unknownResult(ref, {
+            readback: 'supabase',
+            reason: 'no-migration-batch-fetcher-registered',
+        });
+    }
+    const result = await migrationBatchFetcher.fetch(ref.id);
+    if (!result) {
+        return unknownResult(ref, {
+            readback: 'supabase',
+            reason: 'migration-batch-fetch-failed-or-not-found',
+        });
+    }
+    if (result.planned.length === 0) {
+        // A planned-empty batch is degenerate — no work to verify against. Treat
+        // it as merged (skip-already-applied) rather than unknown so a batch ref
+        // emitted before the dispatcher discovered "nothing to do" doesn't
+        // wedge the resume preflight on needs-human. The post-effect ref set is
+        // also empty in this case, so the orchestrator's "all post-effect refs
+        // merged/live" check naturally short-circuits to skip.
+        return {
+            refKind: ref.kind,
+            refId: ref.id,
+            existsOnPlatform: true,
+            currentState: 'merged',
+            metadata: {
+                readback: 'supabase',
+                plannedCount: 0,
+                appliedCount: 0,
+                erroredCount: 0,
+            },
+        };
+    }
+    let appliedCount = 0;
+    let pendingCount = 0;
+    let erroredCount = 0;
+    for (const item of result.planned) {
+        if (item.state === 'applied')
+            appliedCount++;
+        else if (item.state === 'pending')
+            pendingCount++;
+        else if (item.state === 'errored')
+            erroredCount++;
+    }
+    let currentState;
+    if (erroredCount > 0)
+        currentState = 'failed';
+    else if (pendingCount === 0)
+        currentState = 'merged';
+    else
+        currentState = 'open';
+    return {
+        refKind: ref.kind,
+        refId: ref.id,
+        existsOnPlatform: true,
+        currentState,
+        metadata: {
+            readback: 'supabase',
+            plannedCount: result.planned.length,
+            appliedCount,
+            pendingCount,
+            erroredCount,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Registry — first-match-wins lookup keyed on ExternalRefKind.
+// ---------------------------------------------------------------------------
+/** Default built-in registry. Order matters: first readback whose `handles`
+ *  contains the ref kind wins. Callers may swap individual entries via
+ *  `setProviderReadbacks` (test-only seam). */
+function buildDefaultRegistry() {
+    return [
+        makeGithubReadback(),
+        makeDeployReadback('vercel', ['vercel']),
+        makeDeployReadback('fly', ['fly']),
+        makeDeployReadback('render', ['render']),
+        makeSupabaseReadback(),
+    ];
+}
+let providerReadbacks = buildDefaultRegistry();
+/** Live registry — exposed as a getter so tests / callers can introspect. */
+export function getProviderReadbacks() {
+    return providerReadbacks;
+}
+/** Replace the registry (test seam). Pass null to reset to defaults. */
+export function setProviderReadbacks(list) {
+    providerReadbacks = list === null ? buildDefaultRegistry() : list;
+}
+/** Look up the readback that handles a given ref. Two-pass match: first try
+ *  a strict (kind + provider) match so multiple readbacks sharing a kind
+ *  (vercel/fly/render all on `deploy`) don't shadow each other; then fall
+ *  back to a kind-only match for readbacks that don't declare a provider
+ *  allowlist (e.g. the github readback handles `github-pr` regardless of
+ *  ref.provider). Returns null if no registered readback claims this ref —
+ *  caller treats null as "no readback available, route to needs-human".
+ *
+ *  Bugbot MEDIUM (PR #91): without provider-aware matching, the first deploy
+ *  readback registered (vercel) won every `deploy`/`rollback-target` lookup
+ *  and the fly/render readbacks were dead code. */
+export function readbackForRef(ref) {
+    if (ref.provider) {
+        for (const rb of providerReadbacks) {
+            if (rb.handles.includes(ref.kind) && rb.providers?.includes(ref.provider))
+                return rb;
+        }
+    }
+    for (const rb of providerReadbacks) {
+        if (rb.handles.includes(ref.kind) && !rb.providers)
+            return rb;
+    }
+    return null;
+}
+/** Verify a list of refs in parallel. Returns one ReadbackResult per ref.
+ *  Refs without a registered readback get an unknown-state result so the
+ *  decision matrix can attribute the gap. Order is preserved. */
+export async function verifyRefs(refs) {
+    return Promise.all(refs.map(async (ref) => {
+        const rb = readbackForRef(ref);
+        if (!rb)
+            return unknownResult(ref, { reason: 'no-readback-registered' });
+        return rb.verifyRef(ref);
+    }));
+}
+//# sourceMappingURL=provider-readback.js.map

package/dist/src/core/run-state/replay-decision.d.ts

@@ -0,0 +1,69 @@
+import type { ExternalRef } from './types.ts';
+import type { ReadbackResult } from './provider-readback.ts';
+/** Decision the engine should take when replaying / resuming a phase. */
+export type ReplayDecisionKind = 
+/** Run the phase body. Default for fresh attempts and post-failure retries. */
+'retry'
+/** Don't run; treat as already-done. Engine returns prior output / snapshot. */
+ | 'skip-already-applied'
+/** Don't run; can't safely decide. Engine emits phase.needs-human + throws. */
+ | 'needs-human'
+/** Don't run; explicit user/CI signal to give up. Engine throws abort code. */
+ | 'abort';
+export interface ReplayDecision {
+    decision: ReplayDecisionKind;
+    /** Single-line human-readable explanation. Embedded into needs-human events
+     *  and surface in `runs resume` output. */
+    reason: string;
+    /** External refs the decision considered. Echoed back so CI/humans can
+     *  inspect them without re-reading the events log. */
+    refsConsulted: ExternalRef[];
+    /** Per-ref readback results. Empty array when the decision was made
+     *  without consulting readbacks (e.g. retry on no-prior-success). */
+    readbacksConsulted: ReadbackResult[];
+}
+/** Inputs to `decideReplay`. All fields required so callers can't accidentally
+ *  drop a signal. Keep in lockstep with runPhase's gating logic. */
+export interface ReplayDecisionInput {
+    /** Phase name — for the reason string only; no behavior depends on it. */
+    phaseName: string;
+    /** True iff prior `phase.success` event exists for this phaseIdx. */
+    hasPriorSuccess: boolean;
+    /** Total attempts recorded in state.json for this phaseIdx (failed +
+     *  succeeded). Used only for the `reason` string when there's no prior
+     *  success but priorAttempts > 0 — distinguishes "first attempt" from
+     *  "post-failure retry" so users running `runs resume` get an accurate
+     *  description. No behavior depends on this; it's a presentation field.
+     *  Defaults to 0 when omitted (Bugbot LOW PR #91 fold-in). */
+    priorAttempts?: number;
+    /** Mirrors RunPhase.idempotent declared at registration. */
+    idempotent: boolean;
+    /** Mirrors RunPhase.hasSideEffects declared at registration. */
+    hasSideEffects: boolean;
+    /** All externalRefs persisted for this phaseIdx across prior attempts. */
+    externalRefs: ExternalRef[];
+    /** Readback results, one per externalRef in the same order. May be empty
+     *  when the caller is doing pure-state lookup (CLI `runs resume`) — in
+     *  that case any side-effect-phase prior success collapses to needs-human
+     *  because we have no live confirmation. */
+    readbacks: ReadbackResult[];
+    /** When true the user/CI explicitly asked to override needs-human. The
+     *  engine emits a `replay.override` event; this function flips the
+     *  decision to retry regardless of state. */
+    forceReplay: boolean;
+}
+/** Decide what to do with a (re-)attempt of a phase. Pure; safe to call
+ *  during CLI lookup AND inside runPhase. The decision matrix mirrors the
+ *  spec's per-phase replay table:
+ *
+ *    | prior success | idempotent | sideEffects | refs       | readback all valid | -> decision |
+ *    | no            | -          | -           | -          | -                  | retry       |
+ *    | yes           | yes        | -           | -          | -                  | skip        |
+ *    | yes           | no         | no          | -          | -                  | skip        |
+ *    | yes           | no         | yes         | empty      | -                  | needs-human |
+ *    | yes           | no         | yes         | non-empty  | all valid          | skip        |
+ *    | yes           | no         | yes         | non-empty  | any missing/stale  | needs-human |
+ *
+ *  forceReplay = true overrides everything → retry. */
+export declare function decideReplay(input: ReplayDecisionInput): ReplayDecision;
+//# sourceMappingURL=replay-decision.d.ts.map

package/dist/src/core/run-state/replay-decision.js

@@ -0,0 +1,144 @@
+// src/core/run-state/replay-decision.ts
+//
+// v6 Phase 6 — pure decision function for "should this phase replay?".
+//
+// Inputs are the persisted facts of a prior phase attempt (success count,
+// idempotent / hasSideEffects declarations, externalRefs) plus the live
+// readback results from `provider-readback.ts`. Output is one of four
+// decisions, plus the refs + readbacks the decision was based on so callers
+// can surface them in `phase.needs-human` events for human triage.
+//
+// This file is deliberately pure: it does NOT execute readbacks itself
+// (caller passes them in), it does NOT consult disk, it does NOT throw on
+// any input shape. Easy to unit-test exhaustively against the spec's
+// per-phase replay table.
+//
+// Spec: docs/specs/v6-run-state-engine.md "Idempotency rules + external
+// operation ledger (Codex CRITICAL #2)" — the replay matrix.
+/** Decide what to do with a (re-)attempt of a phase. Pure; safe to call
+ *  during CLI lookup AND inside runPhase. The decision matrix mirrors the
+ *  spec's per-phase replay table:
+ *
+ *    | prior success | idempotent | sideEffects | refs       | readback all valid | -> decision |
+ *    | no            | -          | -           | -          | -                  | retry       |
+ *    | yes           | yes        | -           | -          | -                  | skip        |
+ *    | yes           | no         | no          | -          | -                  | skip        |
+ *    | yes           | no         | yes         | empty      | -                  | needs-human |
+ *    | yes           | no         | yes         | non-empty  | all valid          | skip        |
+ *    | yes           | no         | yes         | non-empty  | any missing/stale  | needs-human |
+ *
+ *  forceReplay = true overrides everything → retry. */
+export function decideReplay(input) {
+    const refsConsulted = [...input.externalRefs];
+    const readbacksConsulted = [...input.readbacks];
+    // Override path — caller already gated this on user/CI consent. Engine
+    // emits replay.override on this branch.
+    if (input.forceReplay) {
+        return {
+            decision: 'retry',
+            reason: `forceReplay override: ${input.phaseName} will re-execute despite prior state`,
+            refsConsulted,
+            readbacksConsulted,
+        };
+    }
+    // No prior success → fresh attempt or post-failure retry. Always safe.
+    if (!input.hasPriorSuccess) {
+        const priorAttempts = input.priorAttempts ?? 0;
+        const reason = priorAttempts > 0
+            ? `${input.phaseName} previous attempt(s) failed (${priorAttempts}) — retry safe`
+            : `${input.phaseName} has no prior success — first attempt`;
+        return {
+            decision: 'retry',
+            reason,
+            refsConsulted,
+            readbacksConsulted: [],
+        };
+    }
+    // Prior success + declared idempotent → safe to short-circuit. The phase
+    // contract promises the prior output is durable / retrievable.
+    if (input.idempotent) {
+        return {
+            decision: 'skip-already-applied',
+            reason: `${input.phaseName} previously succeeded and is idempotent — replay short-circuits`,
+            refsConsulted,
+            readbacksConsulted: [],
+        };
+    }
+    // Prior success + no side effects → still safe to skip. The phase
+    // produced no observable platform state; replay would just re-do the
+    // identical no-side-effect work.
+    if (!input.hasSideEffects) {
+        return {
+            decision: 'skip-already-applied',
+            reason: `${input.phaseName} previously succeeded with no side effects — skip-already-applied`,
+            refsConsulted,
+            readbacksConsulted: [],
+        };
+    }
+    // Prior success + side effects + no refs → we can't reach the platform of
+    // record to confirm anything. Bubble to a human; the spec is explicit
+    // that missing refs always route to needs-human.
+    if (input.externalRefs.length === 0) {
+        return {
+            decision: 'needs-human',
+            reason: `${input.phaseName} previously succeeded with side effects but recorded no externalRefs — cannot verify, needs human review`,
+            refsConsulted,
+            readbacksConsulted: [],
+        };
+    }
+    // Prior success + side effects + refs but no readbacks supplied (CLI
+    // lookup mode): we must NOT silently skip. Surface as needs-human so the
+    // CLI prediction matches what runPhase will do under live conditions.
+    if (input.readbacks.length === 0) {
+        return {
+            decision: 'needs-human',
+            reason: `${input.phaseName} previously succeeded with side effects; no live readback was performed — needs human review (or pass --force-replay)`,
+            refsConsulted,
+            readbacksConsulted: [],
+        };
+    }
+    // Refs + readbacks both present — adjudicate per readback validity.
+    const stale = readbacksConsulted.filter(rb => !isReadbackValid(rb));
+    if (stale.length > 0) {
+        const summary = stale
+            .map(rb => `${rb.refKind}=${rb.refId} state=${rb.currentState}`)
+            .join(', ');
+        return {
+            decision: 'needs-human',
+            reason: `${input.phaseName} previously succeeded but ${stale.length} ref(s) are stale or missing on the platform: ${summary}`,
+            refsConsulted,
+            readbacksConsulted,
+        };
+    }
+    return {
+        decision: 'skip-already-applied',
+        reason: `${input.phaseName} previously succeeded; all ${readbacksConsulted.length} platform ref(s) verified live — skip-already-applied`,
+        refsConsulted,
+        readbacksConsulted,
+    };
+}
+/** A readback is "valid" — i.e. authorizes a skip-already-applied — when the
+ *  platform confirms the ref still exists AND its current state is one of
+ *  the "still represents the prior side effect" set. The deny-set:
+ *  - 'closed' / 'rolled-back' / 'failed' → side effect was reverted;
+ *    replaying would create a new artifact.
+ *  - 'unknown' → fail-closed; we can't make a confident assertion.
+ *  Anything else (open / merged / live) is treated as "ref still represents
+ *  the prior side effect" — replay would be a duplicate. */
+function isReadbackValid(rb) {
+    if (!rb.existsOnPlatform)
+        return false;
+    switch (rb.currentState) {
+        case 'open':
+        case 'merged':
+        case 'live':
+            return true;
+        case 'closed':
+        case 'rolled-back':
+        case 'failed':
+        case 'unknown':
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=replay-decision.js.map