@duckmind/dm-darwin-x64 0.66.5 → 0.66.7

package/extensions/dm-lens/dist/clients/tool-agreement.js

@@ -0,0 +1,640 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { BoundedFifoMap } from "./bounded-cache.js";
+import { load as loadYaml } from "./deps/js-yaml.js";
+import { findNearestMarkerRoot, toPosix } from "./path-utils.js";
+import { getDegradationLedgerGeneration } from "./degradation-ledger.js";
+import { hasBlackConfig, hasClangFormatConfig, hasCljfmtConfig, hasCmakeFormatConfig, hasCsharpierConfig, hasDetektConfig, hasFantomasConfig, hasGoogleJavaFormatConfig, hasGradleKtlintPlugin, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasMarkdownlintConfig, hasMixFormatConfig, hasOcamlformatConfig, hasOrmoluConfig, hasPhpCsFixerConfig, hasRubocopConfig, hasRuffConfig, hasSqlfluffConfig, hasStandardrbConfig, hasStyluaConfig, hasSwiftformatConfig, hasTaploConfig, hasTerraformConfig } from "./tool-policy.js";
+const NODE_PACKAGES = {
+  biome: "@biomejs/biome",
+  eslint: "eslint",
+  markdownlint: "markdownlint-cli2",
+  oxfmt: "oxfmt",
+  oxlint: "oxlint",
+  prettier: "prettier",
+  stylelint: "stylelint"
+};
+const NODE_LOCKFILE_PRECEDENCE = [
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+];
+export const NODE_LOCKFILE_MAX_BYTES = 16 * 1024 * 1024;
+export const TOOL_AGREEMENT_POLICIES = {
+  biome: { bucket: "node-lockfile", withoutEvidence: "decline" },
+  eslint: { bucket: "node-lockfile", withoutEvidence: "decline" },
+  markdownlint: {
+    bucket: "node-lockfile",
+    withoutEvidence: "decline",
+    check: hasMarkdownlintConfig
+  },
+  oxfmt: { bucket: "node-lockfile", withoutEvidence: "decline" },
+  oxlint: { bucket: "node-lockfile", withoutEvidence: "decline" },
+  prettier: { bucket: "node-lockfile", withoutEvidence: "decline" },
+  stylelint: { bucket: "node-lockfile", withoutEvidence: "decline" },
+  ruff: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasRuffConfig
+  },
+  black: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasBlackConfig
+  },
+  sqlfluff: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasSqlfluffConfig
+  },
+  rubocop: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasRubocopConfig
+  },
+  standardrb: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasStandardrbConfig
+  },
+  ktlint: { bucket: "standalone-cli", withoutEvidence: "decline" },
+  typstyle: { bucket: "standalone-cli", withoutEvidence: "decline" },
+  ktfmt: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasKtfmtConfig
+  },
+  "rust-clippy": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["Cargo.toml"])
+  },
+  "dart-analyze": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["pubspec.yaml"])
+  },
+  "golangci-lint": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasGolangciConfig
+  },
+  detekt: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasDetektConfig
+  },
+  gofmt: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["go.mod"])
+  },
+  rustfmt: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["Cargo.toml"])
+  },
+  zig: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["build.zig"])
+  },
+  dart: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["pubspec.yaml"])
+  },
+  shfmt: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, [".editorconfig"])
+  },
+  nixfmt: { bucket: "project-config", withoutEvidence: "decline" },
+  mix: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasMixFormatConfig
+  },
+  ocamlformat: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasOcamlformatConfig
+  },
+  "clang-format": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasClangFormatConfig
+  },
+  gleam: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["gleam.toml"])
+  },
+  terraform: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasTerraformConfig
+  },
+  "terragrunt-hcl": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["terragrunt.hcl", "terragrunt.hcl.json"])
+  },
+  "php-cs-fixer": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasPhpCsFixerConfig
+  },
+  csharpier: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasCsharpierConfig
+  },
+  fantomas: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasFantomasConfig
+  },
+  swiftformat: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasSwiftformatConfig
+  },
+  stylua: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasStyluaConfig
+  },
+  ormolu: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasOrmoluConfig
+  },
+  taplo: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasTaploConfig
+  },
+  "google-java-format": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasGoogleJavaFormatConfig
+  },
+  cljfmt: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasCljfmtConfig
+  },
+  "cmake-format": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: hasCmakeFormatConfig
+  },
+  "psscriptanalyzer-format": {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, [
+      "PSScriptAnalyzerSettings.psd1",
+      "ScriptAnalyzerSettings.psd1"
+    ])
+  },
+  cue: {
+    bucket: "project-config",
+    withoutEvidence: "decline",
+    check: (cwd) => hasMarker(cwd, ["cue.mod"])
+  }
+};
+function hasMarker(cwd, markers) {
+  return findNearestMarkerRoot(cwd, markers, {
+    boundaries: [".git", ".hg", ".svn"]
+  }) !== null;
+}
+function readJson(filePath) {
+  if (!fs.existsSync(filePath))
+    return { kind: "missing" };
+  try {
+    const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    return value && typeof value === "object" ? { kind: "value", value } : { kind: "unparseable" };
+  } catch (error) {
+    return {
+      kind: error instanceof SyntaxError ? "unparseable" : "unreadable"
+    };
+  }
+}
+function declaredRange(pkg, name) {
+  for (const field of [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies"
+  ]) {
+    const deps = pkg[field];
+    if (deps && typeof deps === "object") {
+      const range = deps[name];
+      if (typeof range === "string")
+        return range;
+    }
+  }
+  return;
+}
+function parseCoreVersion(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!match)
+    return;
+  const parts = match.slice(1).map(Number);
+  if (parts.some((part) => !Number.isSafeInteger(part)))
+    return;
+  return parts;
+}
+function exactOrSimpleRangeMatches(range, version) {
+  const clean = range.trim().replace(/^v/, "");
+  const actual = parseCoreVersion(version);
+  if (!actual)
+    return { matches: false, unsupported: version.includes("+") };
+  if (/^\d+\.\d+\.\d+$/.test(clean))
+    return { matches: clean === version, unsupported: false };
+  const caret = clean.match(/^\^(\d+)\.(\d+)\.(\d+)$/);
+  if (caret) {
+    const [major, minor, patch] = caret.slice(1).map(Number);
+    return {
+      matches: actual[0] === major && (major !== 0 || actual[1] === minor) && (major !== 0 || minor !== 0 || actual[2] === patch) && (actual[1] > minor || actual[1] === minor && actual[2] >= patch),
+      unsupported: false
+    };
+  }
+  const tilde = clean.match(/^~(\d+)\.(\d+)\.(\d+)$/);
+  if (tilde) {
+    const [major, minor, patch] = tilde.slice(1).map(Number);
+    return {
+      matches: actual[0] === major && actual[1] === minor && actual[2] >= patch,
+      unsupported: false
+    };
+  }
+  return { matches: false, unsupported: true };
+}
+function pnpmEvidence(doc, packageName, importerKey) {
+  if (doc && typeof doc === "object" && !Array.isArray(doc)) {
+    const docRecord = doc;
+    const importers = docRecord.importers;
+    if (importers && typeof importers === "object" && !Array.isArray(importers)) {
+      const importer = importers[importerKey];
+      if (importer && typeof importer === "object") {
+        for (const field of ["dependencies", "devDependencies"]) {
+          const deps = importer[field];
+          if (deps && typeof deps === "object") {
+            const entry = deps[packageName];
+            if (entry && typeof entry === "object") {
+              return {
+                kind: "resolved",
+                version: entry.version
+              };
+            }
+          }
+        }
+      }
+      return { kind: "resolved", version: undefined };
+    }
+    let sawTopLevelMaps = false;
+    let v6version;
+    let v6found = false;
+    for (const field of ["dependencies", "devDependencies"]) {
+      const deps = docRecord[field];
+      if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+        sawTopLevelMaps = true;
+        const entry = deps[packageName];
+        if (entry && typeof entry === "object") {
+          v6version = entry.version;
+          v6found = true;
+          break;
+        }
+      }
+    }
+    if (v6found || sawTopLevelMaps) {
+      return { kind: "resolved", version: v6found ? v6version : undefined };
+    }
+  }
+  return { kind: "unsupported-shape" };
+}
+function decideNodeVersionAgreement(tool, packageName, range, version, supplier) {
+  const comparison = typeof version === "string" ? exactOrSimpleRangeMatches(range, version) : { matches: false, unsupported: false };
+  if (typeof version !== "string" || !comparison.matches) {
+    const reasonCode = typeof version === "string" && comparison.unsupported ? "evidence-unsupported" : typeof version === "string" && version.includes("+") ? "evidence-unsupported" : "evidence-unparseable";
+    const reason = typeof version === "string" && comparison.unsupported ? `the project declares ${packageName}@${range} in package.json, but the lockfile shape ${packageName}@${version} in ${supplier} or its range is unsupported; tool agreement cannot be established` : typeof version === "string" && parseCoreVersion(version) ? `the project declares ${packageName}@${range} in package.json, but the lockfile resolves ${packageName}@${version} in ${supplier}; agreement disagrees` : `the project declares ${packageName}@${range} in package.json, but ${supplier} does not establish its resolved version; tool agreement cannot be established`;
+    return {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason,
+      reasonCode
+    };
+  }
+  return { decision: "established", lockfile: supplier };
+}
+function readLockfileBounded(filePath) {
+  let fd;
+  try {
+    fd = fs.openSync(filePath, "r");
+    const buffer = Buffer.allocUnsafe(Math.min(fs.fstatSync(fd).size, NODE_LOCKFILE_MAX_BYTES) + 1);
+    let total = 0;
+    while (total < buffer.length) {
+      const read = fs.readSync(fd, buffer, total, buffer.length - total, null);
+      if (read === 0)
+        break;
+      total += read;
+    }
+    return total > NODE_LOCKFILE_MAX_BYTES ? { kind: "too-large" } : { kind: "text", text: buffer.toString("utf8", 0, total) };
+  } catch {
+    return { kind: "unreadable" };
+  } finally {
+    if (fd !== undefined) {
+      try {
+        fs.closeSync(fd);
+      } catch {}
+    }
+  }
+}
+function lockfileReadDecline(tool, lockfile, read) {
+  return read.kind === "too-large" ? {
+    decision: "decline",
+    subject: `node:${tool}`,
+    reason: `the project ${lockfile} exceeds the ${NODE_LOCKFILE_MAX_BYTES}-byte lockfile read bound; tool agreement cannot be established`,
+    reasonCode: "evidence-too-large"
+  } : {
+    decision: "decline",
+    subject: `node:${tool}`,
+    reason: `the project ${lockfile} is unreadable; tool agreement cannot be established`,
+    reasonCode: "evidence-unreadable"
+  };
+}
+function stripPnpmPeerSuffix(version) {
+  const core = /^\d+\.\d+\.\d+/.exec(version)?.[0];
+  if (!core || core.length === version.length)
+    return version;
+  let depth = 0;
+  for (let i = core.length;i < version.length; i += 1) {
+    const char = version[i];
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      if (depth === 0 || version[i - 1] === "(")
+        return version;
+      depth -= 1;
+    } else if (depth === 0) {
+      return version;
+    }
+  }
+  return depth === 0 ? core : version;
+}
+function pnpmAgreement(tool, packageName, range, root, lockDir) {
+  const filePath = path.join(lockDir, "pnpm-lock.yaml");
+  const read = readLockfileBounded(filePath);
+  if (read.kind !== "text") {
+    return lockfileReadDecline(tool, "pnpm-lock.yaml", read);
+  }
+  let doc;
+  try {
+    doc = loadYaml(read.text);
+  } catch {
+    return {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason: "the project pnpm-lock.yaml is unparseable; tool agreement cannot be established",
+      reasonCode: "evidence-unparseable"
+    };
+  }
+  const importerKey = lockDir === path.resolve(root) ? "." : toPosix(path.relative(lockDir, root));
+  const evidence = pnpmEvidence(doc, packageName, importerKey);
+  if (evidence.kind === "unsupported-shape") {
+    return {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason: "the project pnpm-lock.yaml has an unsupported lockfile shape; tool agreement cannot be established",
+      reasonCode: "evidence-unsupported"
+    };
+  }
+  return decideNodeVersionAgreement(tool, packageName, range, typeof evidence.version === "string" ? stripPnpmPeerSuffix(evidence.version) : evidence.version, "pnpm-lock.yaml");
+}
+function yarnV1Blocks(text, packageName) {
+  const found = [];
+  for (const block of text.split(/\n[ \t]*\n/)) {
+    const lines = block.split(`
+`);
+    const header = (lines[0] ?? "").trim();
+    if (!header.endsWith(":"))
+      continue;
+    const prefix = `${packageName}@`;
+    const descriptors = [];
+    for (const rawPart of header.slice(0, -1).split(",")) {
+      const part = rawPart.trim().replace(/^"|"$/g, "").trim();
+      if (part.startsWith(prefix) && !part.slice(prefix.length).includes(":")) {
+        descriptors.push(part);
+      }
+    }
+    if (descriptors.length === 0)
+      continue;
+    let version;
+    for (const line of lines.slice(1)) {
+      const match = /^\s*version\s+"([^"]*)"/.exec(line);
+      if (match) {
+        version = match[1];
+        break;
+      }
+    }
+    found.push({ descriptors, version });
+  }
+  return found;
+}
+function yarnBerryEntries(doc, packageName) {
+  if (!doc || typeof doc !== "object" || Array.isArray(doc))
+    return;
+  const docRecord = doc;
+  if (!docRecord.__metadata || typeof docRecord.__metadata !== "object")
+    return;
+  const found = [];
+  const marker = "@npm:";
+  for (const [key, entry] of Object.entries(docRecord)) {
+    const unquoted = key.replace(/^"|"$/g, "");
+    const at = unquoted.lastIndexOf(marker);
+    if (at < 0)
+      continue;
+    if (unquoted.slice(0, at) !== packageName)
+      continue;
+    const version = entry && typeof entry === "object" ? entry.version : undefined;
+    found.push({ descriptors: [unquoted.slice(at + marker.length)], version });
+  }
+  return found;
+}
+function selectNodeCandidate(candidates, range) {
+  for (const candidate of candidates) {
+    if (candidate.descriptors.some((descriptor) => descriptor === range)) {
+      return typeof candidate.version === "string" ? candidate.version : undefined;
+    }
+  }
+  const first = candidates.length > 0 ? candidates[0]?.version : undefined;
+  return typeof first === "string" ? first : undefined;
+}
+function yarnAgreement(tool, packageName, range, filePath) {
+  const read = readLockfileBounded(filePath);
+  if (read.kind !== "text")
+    return lockfileReadDecline(tool, "yarn.lock", read);
+  const raw = read.text.replace(/\r\n?/g, `
+`);
+  let doc;
+  let yamlOk = true;
+  try {
+    doc = loadYaml(raw);
+  } catch {
+    yamlOk = false;
+  }
+  if (yamlOk) {
+    const berry = yarnBerryEntries(doc, packageName);
+    if (berry) {
+      return decideNodeVersionAgreement(tool, packageName, range, selectNodeCandidate(berry, range), "yarn.lock");
+    }
+  }
+  const v1 = yarnV1Blocks(raw, packageName);
+  if (v1.length > 0) {
+    return decideNodeVersionAgreement(tool, packageName, range, selectNodeCandidate(v1, range), "yarn.lock");
+  }
+  if (!yamlOk) {
+    return {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason: "the project yarn.lock is unparseable; tool agreement cannot be established",
+      reasonCode: "evidence-unparseable"
+    };
+  }
+  return {
+    decision: "decline",
+    subject: `node:${tool}`,
+    reason: "the project yarn.lock has an unsupported lockfile shape; tool agreement cannot be established",
+    reasonCode: "evidence-unsupported"
+  };
+}
+function nodeAgreement(tool, root) {
+  const packageName = NODE_PACKAGES[tool];
+  if (!packageName)
+    return;
+  const pkg = readJson(path.join(root, "package.json"));
+  if (pkg.kind === "unreadable" || pkg.kind === "unparseable") {
+    return {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason: `the project package.json is ${pkg.kind}; tool agreement cannot be established`,
+      reasonCode: `evidence-${pkg.kind}`
+    };
+  }
+  const range = pkg.kind === "value" ? declaredRange(pkg.value, packageName) : undefined;
+  if (!range)
+    return;
+  const lockDir = findNearestMarkerRoot(root, [...NODE_LOCKFILE_PRECEDENCE], {
+    boundaries: [".git", ".hg", ".svn"]
+  });
+  if (!lockDir) {
+    return {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason: `the project declares ${packageName}@${range} in package.json, but no lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock) establishes its resolved version; tool agreement cannot be established`,
+      reasonCode: "evidence-absent"
+    };
+  }
+  const supplier = fs.existsSync(path.join(lockDir, "package-lock.json")) ? "package-lock.json" : fs.existsSync(path.join(lockDir, "pnpm-lock.yaml")) ? "pnpm-lock.yaml" : "yarn.lock";
+  if (supplier === "package-lock.json") {
+    const lock = readJson(path.join(lockDir, "package-lock.json"));
+    if (lock.kind === "unreadable" || lock.kind === "unparseable") {
+      return {
+        decision: "decline",
+        subject: `node:${tool}`,
+        reason: `the project package-lock.json is ${lock.kind}; tool agreement cannot be established`,
+        reasonCode: `evidence-${lock.kind}`
+      };
+    }
+    const packages = lock.kind === "value" ? lock.value.packages : undefined;
+    const entry = packages && typeof packages === "object" ? packages[`node_modules/${packageName}`] : undefined;
+    const version = entry && typeof entry === "object" ? entry.version : undefined;
+    const comparison = typeof version === "string" ? exactOrSimpleRangeMatches(range, version) : { matches: false, unsupported: false };
+    if (typeof version !== "string" || !comparison.matches) {
+      const reasonCode = typeof version === "string" && comparison.unsupported ? "evidence-unsupported" : typeof version === "string" && version.includes("+") ? "evidence-unsupported" : "evidence-unparseable";
+      const reason = typeof version === "string" && comparison.unsupported ? `the project declares ${packageName}@${range}, but the lockfile shape ${packageName}@${version} or its range is unsupported; tool agreement cannot be established` : typeof version === "string" && parseCoreVersion(version) ? `the project declares ${packageName}@${range} in package.json, but the lockfile resolves ${packageName}@${version} in package-lock.json; agreement disagrees` : `the project declares ${packageName}@${range} in package.json, but package-lock.json does not establish its resolved version; tool agreement cannot be established`;
+      return {
+        decision: "decline",
+        subject: `node:${tool}`,
+        reason,
+        reasonCode
+      };
+    }
+    return { decision: "established", lockfile: supplier };
+  }
+  if (supplier === "pnpm-lock.yaml") {
+    return pnpmAgreement(tool, packageName, range, root, lockDir);
+  }
+  return yarnAgreement(tool, packageName, range, path.join(lockDir, "yarn.lock"));
+}
+export function establishToolAgreement(tool, cwd) {
+  const key = `${getDegradationLedgerGeneration()}\x00${path.resolve(cwd)}\x00${tool}`;
+  const cached = agreementCache.get(key);
+  if (cached)
+    return cached;
+  agreementResolutionCount += 1;
+  const policy = TOOL_AGREEMENT_POLICIES[tool];
+  if (!policy) {
+    const agreement = {
+      decision: "decline",
+      subject: `tool:${tool}`,
+      reason: "the autonomous writer is not registered with a project-evidence policy; tool agreement cannot be established",
+      reasonCode: "evidence-unsupported"
+    };
+    agreementCache.set(key, agreement);
+    return agreement;
+  }
+  let agreement = { decision: "established" };
+  if (tool === "ktlint") {
+    const ownership = hasGradleKtlintPlugin(cwd);
+    if (ownership.kind === "owned" || hasKtlintConfig(cwd)) {
+      agreement = {
+        decision: "decline",
+        subject: "kotlin:gradle-ktlint",
+        reason: "the project resolves ktlint through Gradle, so CLI agreement cannot be established from project data",
+        reasonCode: "evidence-unsupported"
+      };
+    } else if (ownership.kind === "indeterminate") {
+      agreement = {
+        decision: "decline",
+        subject: "kotlin:gradle-ktlint",
+        reason: "Gradle ownership evidence is unreadable or exceeded its scan budget; tool agreement cannot be established",
+        reasonCode: "evidence-unreadable"
+      };
+    }
+  }
+  if (agreement.decision === "established" && policy.bucket === "node-lockfile") {
+    const root = findNearestMarkerRoot(cwd, ["package.json"], {
+      boundaries: [".git", ".hg", ".svn"]
+    });
+    const node = root ? nodeAgreement(tool, root) : undefined;
+    agreement = node ?? {
+      decision: "decline",
+      subject: `node:${tool}`,
+      reason: "the project has no package declaration and lockfile evidence for this tool",
+      reasonCode: "evidence-absent"
+    };
+  } else if (agreement.decision === "established" && policy.bucket === "project-config" && (!policy.check || !policy.check(cwd))) {
+    agreement = {
+      decision: "decline",
+      subject: `project:${tool}`,
+      reason: "the project has no readable configuration or manifest evidence selecting this tool",
+      reasonCode: "evidence-absent"
+    };
+  }
+  if (agreement.decision === "established" && !policy.bucket) {
+    agreement = {
+      decision: "decline",
+      subject: `tool:${tool}`,
+      reason: "the tool evidence bucket is unsupported",
+      reasonCode: "evidence-unsupported"
+    };
+  }
+  agreementCache.set(key, agreement);
+  return agreement;
+}
+const agreementCache = new BoundedFifoMap(512);
+let agreementResolutionCount = 0;
+export function _getAgreementResolutionCountForTests() {
+  return agreementResolutionCount;
+}