@dzhechkov/harness-core 0.5.0 → 0.5.2

package/dist/score.js

@@ -39,8 +39,19 @@ function evidenceLine(text, re) {
  * heuristic table). A line whose match is preceded by a negation word is skipped. Heuristic — but
  * the failure mode flips from a silent false pass to a visible miss the shown evidence exposes.
  */
+// The DEFAULT vocabulary — verbs and determiners that deny the sentence they sit in.
 const NEGATION_RE = /\b(no|not|never|without|wasn'?t|isn'?t)\b/i;
-function evidenceLinePositive(text, re) {
+/**
+ * The default vocabulary plus the negative QUANTIFIERS. Opt-in per site, because a quantifier
+ * negates a NOUN, not the claim: "None of the mutants survived; discrimination §42 is proven by the
+ * red run" is idiomatic POSITIVE evidence that the wide list silently discarded (QE B-F2 —
+ * negating-the-mutants is not negating-the-proof). It is passed only where a red test demanded it:
+ * "Nothing was MEASURED in this round" scored as proof of measurement, because the word boundary in
+ * `\bno\b` does NOT match "Nothing". Hedges like "skipped" stay out of both lists — they routinely
+ * appear inside genuine evidence lines.
+ */
+const NEGATION_QUANTIFIED_RE = /\b(no|not|never|without|nothing|none|neither|nor|nobody|wasn'?t|isn'?t)\b/i;
+function evidenceLinePositive(text, re, negationRe = NEGATION_RE) {
     for (const line of text.split('\n')) {
         if (!re.test(line))
             continue;
@@ -48,7 +59,7 @@ function evidenceLinePositive(text, re) {
         // before-the-match check missed it. The trade is deliberate: a genuine line that happens to
         // contain a negation is SKIPPED (a visible miss the evidence exposes) rather than a negated
         // line being ACCEPTED (a silent false pass).
-        if (NEGATION_RE.test(line))
+        if (negationRe.test(line))
             continue;
         return line.trim().slice(0, 140);
     }
@@ -77,10 +88,19 @@ export function scoreRun(slug, artifacts) {
         add('adr-confirmation', 'ADR present, property → named test', 'absent', 'no 03_adr/*.md artifact');
     }
     else {
-        const conf = evidenceLine(adrText, /^##+\s*Confirmation/i);
-        add('adr-confirmation', 'ADR present, property → named test', conf !== null ? 'pass' : 'partial', conf ?? 'ADR exists but has no Confirmation section — the load-bearing property names no test');
+        // POSITIVE (QE B-F2 reversed my first call, which exempted this site as "structural"). The
+        // heading regex allows a SUFFIX, so `## Confirmation — not yet performed` — the realistic
+        // placeholder an unfinished ADR carries — scored a full PASS. Heading presence is structural;
+        // heading TEXT is not, and this one can deny itself. Default (narrow) vocabulary: a heading is
+        // a fragment, and the quantifiers only appear in prose. Pinned both ways by tests.
+        const conf = evidenceLinePositive(adrText, /^##+\s*Confirmation/i);
+        add('adr-confirmation', 'ADR present, property → named test', conf !== null ? 'pass' : 'partial', conf ?? 'ADR exists but has no (non-negated) Confirmation heading — the load-bearing property names no test');
     }
     // 2. Discrimination — proof the test can FAIL (the §42 gate, or an explicit mutation proof).
+    //    Default (narrow) vocabulary ON PURPOSE (QE B-F2): mutation evidence is written by negating the
+    //    MUTANTS — "None of the mutants survived", "neither mutant escaped" — which is the proof, not
+    //    its denial. The quantifiers would discard exactly the strongest lines this discipline exists
+    //    to find. "No discrimination proof was performed" is still caught by the narrow list.
     const discr = evidenceLinePositive(allText, /discrimination|§42/i) ??
         evidenceLinePositive(allText, /mutation[s]?\s.*(prov|kill)|mutant[s]?\s.*(kill|red)|RED on the old|goes? RED|failed as expected/i);
     add('discrimination', 'the property test is proven able to fail', discr !== null ? 'pass' : 'absent', discr ?? 'no discrimination/§42/mutation-proof evidence in any artifact');
@@ -91,6 +111,13 @@ export function scoreRun(slug, artifacts) {
     }
     else {
         const crossLine = evidenceLinePositive(qeText, /codex|gpt-|cross-model/i);
+        // EXEMPT from the negation filter (wave1-scorer-negation, per-site review): this line is a
+        // DISPLAY LOCATOR, not a verdict input — the verdict above rests on `crossLine` (already
+        // positive-filtered) AND on `grade`, parsed from the whole report. A letter grade is a
+        // structural token ("Grade: D"); there is no idiomatic "no Grade: D". Filtering here would only
+        // drop the most common real grade line ("**Grade: B** — no blockers remain") from the shown
+        // evidence for zero change in verdict. Pinned by a test. Residual, flagged not hidden:
+        // `extractQeGrade` itself is negation-blind and stays so — out of FR-B1's scope.
         const gradeLine = grade !== null ? evidenceLine(qeText, GRADE_RE) : null;
         add('cross-model-qe', 'independent cross-model review with a grade', crossLine !== null && grade !== null ? 'pass' : 'partial', crossLine !== null
             ? grade !== null
@@ -100,15 +127,22 @@ export function scoreRun(slug, artifacts) {
     }
     // 4. Live verification — the property was observed, not inferred. The health-advisor 1.2.0 QE
     //    report is the cautionary case: "✅ (mechanism)" with no live evidence shipped a dead feature.
-    const live = evidenceLine(qeText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i);
-    const liveAnywhere = live ?? evidenceLine(allText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i);
+    //    POSITIVE (wave1-scorer-negation): "nothing was MEASURED" / "no reproducer was run" is the
+    //    claim's exact opposite and used to score as proof of it (the crossrt-1 6/7 shape).
+    const live = evidenceLinePositive(qeText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i, NEGATION_QUANTIFIED_RE);
+    const liveAnywhere = live ?? evidenceLinePositive(allText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i, NEGATION_QUANTIFIED_RE);
     add('live-verification', 'claims verified by running, not by reasoning', live !== null ? 'pass' : liveAnywhere !== null ? 'partial' : 'absent', live ?? liveAnywhere ?? 'no MEASURED / verified-live / reproducer marker anywhere — every claim is inferred');
     // 5. README-first — the docs travelled in the same change.
-    const readme = evidenceLine(qeText + '\n' + manifestText, /README/);
+    //    POSITIVE (wave1-scorer-negation): THE acid-A5 defect. crossrt-1-agents-md scored ✓ here over
+    //    its own finding "README-first not satisfied — no README was touched": a negation rendered as
+    //    a checkmark. A README mention is not a README update.
+    const readme = evidenceLinePositive(qeText + '\n' + manifestText, /README/, NEGATION_QUANTIFIED_RE);
     add('readme-first', 'READMEs updated in the same change', readme !== null ? 'pass' : 'absent', readme ?? 'no README mention in the QE report or the change manifest');
     // 6. The learning loop — Step-0 recall folded in, Step-8 lessons taught.
-    const recalled = evidenceLine(complexityText + '\n' + allText, /LEARNED_PATTERNS|dz recall|recalled/i);
-    const taught = evidenceLine(allText, /lesson[s]? taught|dz teach|taught \(/i);
+    //    POSITIVE both halves (wave1-scorer-negation): "recall was not performed" and "no lessons were
+    //    taught (dz teach skipped)" both matched the plain regexes and scored the loop as RUN.
+    const recalled = evidenceLinePositive(complexityText + '\n' + allText, /LEARNED_PATTERNS|dz recall|recalled/i, NEGATION_QUANTIFIED_RE);
+    const taught = evidenceLinePositive(allText, /lesson[s]? taught|dz teach|taught \(/i, NEGATION_QUANTIFIED_RE);
     add('learning-loop', 'Step-0 recall used; Step-8 lessons taught', recalled !== null && taught !== null ? 'pass' : recalled !== null || taught !== null ? 'partial' : 'absent', recalled !== null && taught !== null
         ? `${recalled.slice(0, 68)} | ${taught.slice(0, 68)}`
         : recalled ?? taught ?? 'no recall/teach evidence — the run neither drew on nor fed the learned store');

package/dist/score.js.map

@@ -1 +1 @@
-{"version":3,"file":"score.js","sourceRoot":"","sources":["../src/score.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAyBH,SAAS,OAAO,CAAC,SAAuB,EAAE,SAAoC;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,IAAY,EAAE,EAAU;IAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,4CAA4C,CAAC;AACjE,SAAS,oBAAoB,CAAC,IAAY,EAAE,EAAU;IACpD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,6CAA6C;QAC7C,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,oEAAoE,CAAC;AAEtF,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,SAAuB;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,iBAAiB,IAAI,CAAC,KAAK,2BAA2B,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,2BAA2B,IAAI,CAAC,KAAK,yBAAyB,CAAC,CAAC;IACjH,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,6BAA6B,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE/C,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,OAA0B,EAAE,QAAgB,EAAQ,EAAE;QAC5F,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,4FAA4F;IAC5F,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,kBAAkB,EAAE,oCAAoC,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC3D,GAAG,CACD,kBAAkB,EAClB,oCAAoC,EACpC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAClC,IAAI,IAAI,sFAAsF,CAC/F,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,MAAM,KAAK,GACT,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,CAAC;QACpD,oBAAoB,CAAC,OAAO,EAAE,mGAAmG,CAAC,CAAC;IACrI,GAAG,CACD,gBAAgB,EAChB,0CAA0C,EAC1C,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAClC,KAAK,IAAI,+DAA+D,CACzE,CAAC;IAEF,6EAA6E;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,GAAG,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IAChH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,GAAG,CACD,gBAAgB,EAChB,6CAA6C,EAC7C,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACzD,SAAS,KAAK,IAAI;YAChB,CAAC,CAAC,KAAK,KAAK,IAAI;gBACd,CAAC,CAAC,GAAG,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvG,CAAC,CAAC,GAAG,SAAS,2BAA2B,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACzD,CAAC,CAAC,wFAAwF,CAC7F,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,kGAAkG;IAClG,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,kDAAkD,CAAC,CAAC;IACvG,GAAG,CACD,mBAAmB,EACnB,8CAA8C,EAC9C,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EACrE,IAAI,IAAI,YAAY,IAAI,oFAAoF,CAC7G,CAAC;IAEF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpE,GAAG,CACD,cAAc,EACd,oCAAoC,EACpC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EACnC,MAAM,IAAI,2DAA2D,CACtE,CAAC;IAEF,yEAAyE;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,GAAG,IAAI,GAAG,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;IAC9E,GAAG,CACD,eAAe,EACf,2CAA2C,EAC3C,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAC3G,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAClC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACrD,CAAC,CAAC,QAAQ,IAAI,MAAM,IAAI,8EAA8E,CACzG,CAAC;IAEF,0FAA0F;IAC1F,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,wFAAwF;QACxF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,GAAG,CACD,wBAAwB,EACxB,8CAA8C,EAC9C,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC1E,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC5D,CAAC,CAAC,WAAW,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GACX,GAAG,MAAM,IAAI,KAAK,8BAA8B;QAChD,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC5D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,IAAI,GAAsC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAEzF,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,sDAAsD,CAAC,CAAC;IACxF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../src/score.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAyBH,SAAS,OAAO,CAAC,SAAuB,EAAE,SAAoC;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,IAAY,EAAE,EAAU;IAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,qFAAqF;AACrF,MAAM,WAAW,GAAG,4CAA4C,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,4EAA4E,CAAC;AAE5G,SAAS,oBAAoB,CAAC,IAAY,EAAE,EAAU,EAAE,aAAqB,WAAW;IACtF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,6CAA6C;QAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,oEAAoE,CAAC;AAEtF,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,SAAuB;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,iBAAiB,IAAI,CAAC,KAAK,2BAA2B,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,2BAA2B,IAAI,CAAC,KAAK,yBAAyB,CAAC,CAAC;IACjH,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,6BAA6B,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE/C,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,OAA0B,EAAE,QAAgB,EAAQ,EAAE;QAC5F,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,4FAA4F;IAC5F,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,kBAAkB,EAAE,oCAAoC,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;QACnF,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QACnE,GAAG,CACD,kBAAkB,EAClB,oCAAoC,EACpC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAClC,IAAI,IAAI,oGAAoG,CAC7G,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,oGAAoG;IACpG,kGAAkG;IAClG,kGAAkG;IAClG,0FAA0F;IAC1F,MAAM,KAAK,GACT,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,CAAC;QACpD,oBAAoB,CAAC,OAAO,EAAE,mGAAmG,CAAC,CAAC;IACrI,GAAG,CACD,gBAAgB,EAChB,0CAA0C,EAC1C,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAClC,KAAK,IAAI,+DAA+D,CACzE,CAAC;IAEF,6EAA6E;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,GAAG,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IAChH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QAC1E,2FAA2F;QAC3F,yFAAyF;QACzF,uFAAuF;QACvF,gGAAgG;QAChG,4FAA4F;QAC5F,uFAAuF;QACvF,iFAAiF;QACjF,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,GAAG,CACD,gBAAgB,EAChB,6CAA6C,EAC7C,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EACzD,SAAS,KAAK,IAAI;YAChB,CAAC,CAAC,KAAK,KAAK,IAAI;gBACd,CAAC,CAAC,GAAG,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvG,CAAC,CAAC,GAAG,SAAS,2BAA2B,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACzD,CAAC,CAAC,wFAAwF,CAC7F,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wFAAwF;IACxF,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,EAAE,kDAAkD,EAAE,sBAAsB,CAAC,CAAC;IACtH,MAAM,YAAY,GAChB,IAAI,IAAI,oBAAoB,CAAC,OAAO,EAAE,kDAAkD,EAAE,sBAAsB,CAAC,CAAC;IACpH,GAAG,CACD,mBAAmB,EACnB,8CAA8C,EAC9C,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EACrE,IAAI,IAAI,YAAY,IAAI,oFAAoF,CAC7G,CAAC;IAEF,2DAA2D;IAC3D,kGAAkG;IAClG,kGAAkG;IAClG,2DAA2D;IAC3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACpG,GAAG,CACD,cAAc,EACd,oCAAoC,EACpC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EACnC,MAAM,IAAI,2DAA2D,CACtE,CAAC;IAEF,yEAAyE;IACzE,mGAAmG;IACnG,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,oBAAoB,CACnC,cAAc,GAAG,IAAI,GAAG,OAAO,EAC/B,sCAAsC,EACtC,sBAAsB,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,uCAAuC,EAAE,sBAAsB,CAAC,CAAC;IAC9G,GAAG,CACD,eAAe,EACf,2CAA2C,EAC3C,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAC3G,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAClC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACrD,CAAC,CAAC,QAAQ,IAAI,MAAM,IAAI,8EAA8E,CACzG,CAAC;IAEF,0FAA0F;IAC1F,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,wFAAwF;QACxF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,GAAG,CACD,wBAAwB,EACxB,8CAA8C,EAC9C,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC1E,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC5D,CAAC,CAAC,WAAW,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GACX,GAAG,MAAM,IAAI,KAAK,8BAA8B;QAChD,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC5D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,IAAI,GAAsC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAEzF,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,sDAAsD,CAAC,CAAC;IACxF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/trace-corroborate.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `trace-corroborate` — the Claude host's OWN records, for the half of a trace they can witness.
+ *
+ * ADR-002. Pure over already-read strings: no `fs`, so it is testable with fixtures alone.
+ *
+ * The design is shaped by one MEASURED fact and one refuted design. The fact: the trace and the
+ * host's `journal.jsonl` share NO identifier — trace dispatch events carry `invocationId` /
+ * `stepId`, the journal carries `agentId` and a `v2:<sha>` key. There is no run nonce to bind them
+ * with, and we do not control the host's format, so DIRECTORY CONTAINMENT is the only binding
+ * available and every result says so. The refuted design: a bare `agrees` over "agent set +
+ * wall-clock order", which a cross-family reviewer defeated with a trace that matched on agents
+ * while inventing a join, a gate redo, a typed pause and a file deliverable — every consequential
+ * claim fabricated, the verdict green. Hence `agreesWithinScope`, and hence `notWitnessed` being
+ * non-empty BY TYPE rather than by discipline.
+ */
+/** Non-empty by construction: a tuple type, so no edit can empty it and silently unscope a result. */
+export type NotWitnessed = readonly ['join', 'gate-redo', 'typed-pause', 'file-deliverable'];
+export declare const NOT_WITNESSED: NotWitnessed;
+export type WitnessedClaim = 'agent-multiset' | 'agent-count' | 'wall-clock-order';
+export declare const WITNESSED: readonly WitnessedClaim[];
+/** Deliberately NOT `agrees`. The scope lives in the word, so a stored verdict carries it too. */
+export type CorroborationVerdict = 'agreesWithinScope' | 'disagrees' | 'inconclusive';
+export interface CorroborationResult {
+    verdict: CorroborationVerdict;
+    /** The ONLY binding available — see the module note. Never omitted. */
+    binding: 'by-directory';
+    hostDir: string;
+    witnessed: readonly WitnessedClaim[];
+    notWitnessed: NotWitnessed;
+    /** Why, in words, for the human-readable report. */
+    detail: string;
+    /** Counts, so a caller can render the disagreement rather than re-deriving it. */
+    traceAgentCount: number;
+    hostAgentCount: number;
+}
+/** One host record set, already read from disk by the caller. */
+export interface HostRecords {
+    /** Raw `journal.jsonl` text, or null when the file is absent/unreadable. */
+    journal: string | null;
+    /** Raw `agent-<id>.jsonl` texts, keyed by agent id. Empty when none were found. */
+    agentTranscripts: Record<string, string>;
+}
+/** The trace side, projected by the caller: the agent ids the trace claims took part, in order. */
+export interface TraceAgentProjection {
+    agentIds: string[];
+}
+export declare function corroborate(trace: TraceAgentProjection, host: HostRecords, hostDir: string): CorroborationResult;
+//# sourceMappingURL=trace-corroborate.d.ts.map

package/dist/trace-corroborate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-corroborate.d.ts","sourceRoot":"","sources":["../src/trace-corroborate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC7F,eAAO,MAAM,aAAa,EAAE,YAAgF,CAAC;AAE7G,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,kBAAkB,CAAC;AACnF,eAAO,MAAM,SAAS,EAAE,SAAS,cAAc,EAAmE,CAAC;AAEnH,kGAAkG;AAClG,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,WAAW,GAAG,cAAc,CAAC;AAEtF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,uEAAuE;IACvE,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IACrC,YAAY,EAAE,YAAY,CAAC;IAC3B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mFAAmF;IACnF,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA+ED,wBAAgB,WAAW,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,CA0EhH"}

package/dist/trace-corroborate.js

@@ -0,0 +1,172 @@
+/**
+ * `trace-corroborate` — the Claude host's OWN records, for the half of a trace they can witness.
+ *
+ * ADR-002. Pure over already-read strings: no `fs`, so it is testable with fixtures alone.
+ *
+ * The design is shaped by one MEASURED fact and one refuted design. The fact: the trace and the
+ * host's `journal.jsonl` share NO identifier — trace dispatch events carry `invocationId` /
+ * `stepId`, the journal carries `agentId` and a `v2:<sha>` key. There is no run nonce to bind them
+ * with, and we do not control the host's format, so DIRECTORY CONTAINMENT is the only binding
+ * available and every result says so. The refuted design: a bare `agrees` over "agent set +
+ * wall-clock order", which a cross-family reviewer defeated with a trace that matched on agents
+ * while inventing a join, a gate redo, a typed pause and a file deliverable — every consequential
+ * claim fabricated, the verdict green. Hence `agreesWithinScope`, and hence `notWitnessed` being
+ * non-empty BY TYPE rather than by discipline.
+ */
+export const NOT_WITNESSED = ['join', 'gate-redo', 'typed-pause', 'file-deliverable'];
+export const WITNESSED = ['agent-multiset', 'agent-count', 'wall-clock-order'];
+/**
+ * Read the agent ids the host journal STARTED, or null when the journal cannot be trusted to be
+ * complete. QE round 1 closed three ways this used to lie:
+ *   H4 — a `started` row whose `agentId` is not a string was silently DROPPED, so a malformed row
+ *        that may well represent a real extra agent made the sets look equal.
+ *   M2 — a non-empty journal with zero usable start rows returned `[]`, and an empty trace then
+ *        "agreed" with it. A journal that records no starts is not evidence that none happened.
+ *   M3 — `JSON.parse('null')` is valid JSON, and indexing the result threw.
+ */
+function journalAgentIds(journal) {
+    const ids = [];
+    let sawAny = false;
+    for (const line of journal.split('\n')) {
+        const t = line.trim();
+        if (t === '')
+            continue;
+        sawAny = true;
+        let o;
+        try {
+            o = JSON.parse(t);
+        }
+        catch {
+            // A malformed journal is INCONCLUSIVE, not "the agents we could still parse". A partially
+            // readable independent record is not an independent record.
+            return null;
+        }
+        // M3: `null`, a number and a string are all valid JSON and none of them are records.
+        if (typeof o !== 'object' || o === null || Array.isArray(o))
+            return null;
+        const rec = o;
+        if (rec['type'] !== 'started')
+            continue;
+        // H4: a start row we cannot read is a start row we cannot account for.
+        if (typeof rec['agentId'] !== 'string' || rec['agentId'] === '')
+            return null;
+        ids.push(rec['agentId']);
+    }
+    // M2: a non-empty journal that yielded no starts tells us nothing about how many agents ran.
+    if (!sawAny || ids.length === 0)
+        return null;
+    return ids;
+}
+/**
+ * The FIRST readable timestamp in a transcript, or null when the answer cannot be trusted.
+ *
+ * QE round 1 / M1: this used to skip unparseable lines and keep scanning. But an unparseable line
+ * EARLIER in the file may carry an earlier timestamp — so a corrupt prefix does not just cost us a
+ * line, it invalidates the whole "first" claim. Returning the next readable stamp presents a
+ * possibly-late time as the earliest one, which is exactly how a wrong order reads as right.
+ */
+function firstTimestamp(text) {
+    for (const line of text.split('\n')) {
+        const t = line.trim();
+        if (t === '')
+            continue;
+        let o;
+        try {
+            o = JSON.parse(t);
+        }
+        catch {
+            return null; // a corrupt line before any stamp ⇒ the earliest is unknowable
+        }
+        if (typeof o !== 'object' || o === null || Array.isArray(o))
+            return null;
+        const ts = o['timestamp'];
+        if (typeof ts === 'string') {
+            const ms = Date.parse(ts);
+            if (Number.isFinite(ms))
+                return ms;
+        }
+    }
+    return null;
+}
+function multisetEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const count = new Map();
+    for (const x of a)
+        count.set(x, (count.get(x) ?? 0) + 1);
+    for (const x of b) {
+        const n = count.get(x);
+        if (n === undefined || n === 0)
+            return false;
+        count.set(x, n - 1);
+    }
+    return true;
+}
+export function corroborate(trace, host, hostDir) {
+    const base = {
+        binding: 'by-directory',
+        hostDir,
+        witnessed: WITNESSED,
+        notWitnessed: NOT_WITNESSED,
+        traceAgentCount: trace.agentIds.length,
+    };
+    if (host.journal === null) {
+        return { ...base, verdict: 'inconclusive', hostAgentCount: 0, detail: 'no host journal at ' + hostDir + ' — absent evidence is never agreement' };
+    }
+    const hostIds = journalAgentIds(host.journal);
+    if (hostIds === null) {
+        return { ...base, verdict: 'inconclusive', hostAgentCount: 0, detail: 'the host journal is empty or malformed — a partially readable record is not an independent one' };
+    }
+    // COUNT and MULTISET before ordering: a mismatch here is a real disagreement, and comparing the
+    // order of two different sets would be meaningless anyway.
+    if (!multisetEqual(trace.agentIds, hostIds)) {
+        return {
+            ...base,
+            verdict: 'disagrees',
+            hostAgentCount: hostIds.length,
+            detail: `the trace claims ${trace.agentIds.length} agent run(s), the host journal records ${hostIds.length}` +
+                (trace.agentIds.length === hostIds.length ? ' — same count, different ids' : ''),
+        };
+    }
+    // Wall-clock order, from the per-agent transcripts (the journal carries no ts). An agent with no
+    // readable timestamp makes the ORDER unwitnessable — inconclusive, not a pass on the rest.
+    //
+    // QE round 1 / M4: `host.agentTranscripts[id]` walks the PROTOTYPE, so an agent literally named
+    // `__proto__` (or `constructor`, `toString`, …) read a function off Object.prototype and threw.
+    // An own-property check is the fix; the id is data from an outside file and must be treated as such.
+    const own = (o, k) => Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined;
+    const stamps = [];
+    for (const id of hostIds) {
+        const text = own(host.agentTranscripts, id);
+        const at = typeof text !== 'string' ? null : firstTimestamp(text);
+        if (at === null) {
+            return { ...base, verdict: 'inconclusive', hostAgentCount: hostIds.length, detail: `no readable timestamp for agent ${id} — the wall-clock order cannot be witnessed` };
+        }
+        stamps.push({ id, at });
+    }
+    // QE round 1 / H3: two agents sharing a timestamp make their relative order UNKNOWABLE. A stable
+    // sort preserved the journal's own order and reported agreement — the sort's tie-breaking rule
+    // was silently doing duty as evidence.
+    const sorted = [...stamps].sort((a, b) => a.at - b.at);
+    for (let i = 1; i < sorted.length; i++) {
+        if (sorted[i].at === sorted[i - 1].at) {
+            return { ...base, verdict: 'inconclusive', hostAgentCount: hostIds.length, detail: `agents ${sorted[i - 1].id} and ${sorted[i].id} share a timestamp — their relative order cannot be witnessed` };
+        }
+    }
+    // QE round 1 / H2: compare ELEMENT-WISE. `join('|')` collapsed ['x','x|x'] and ['x|x','x'] to the
+    // same string, so a reversed order read as agreement — a delimiter chosen for display doing duty
+    // as an equality operator.
+    const byClock = sorted.map((sv) => sv.id);
+    const orderMatches = byClock.length === trace.agentIds.length && byClock.every((id, i) => id === trace.agentIds[i]);
+    if (!orderMatches) {
+        return { ...base, verdict: 'disagrees', hostAgentCount: hostIds.length, detail: 'the host wall-clock order of the agents differs from the order the trace claims' };
+    }
+    return {
+        ...base,
+        verdict: 'agreesWithinScope',
+        hostAgentCount: hostIds.length,
+        detail: 'the host records agree on which agents ran and in what order. They CANNOT witness ' +
+            NOT_WITNESSED.join(', ') + ' — a fabricated one of those would still land here, which is why this is never a bare "agrees"',
+    };
+}
+//# sourceMappingURL=trace-corroborate.js.map

package/dist/trace-corroborate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-corroborate.js","sourceRoot":"","sources":["../src/trace-corroborate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,CAAC,MAAM,aAAa,GAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAU,CAAC;AAG7G,MAAM,CAAC,MAAM,SAAS,GAA8B,CAAC,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,CAAU,CAAC;AAgCnH;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QACvB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAU,CAAC;QACf,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,4DAA4D;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qFAAqF;QACrF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;YAAE,SAAS;QACxC,uEAAuE;QACvE,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,6FAA6F;IAC7F,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QACvB,IAAI,CAAU,CAAC;QACf,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,+DAA+D;QAC9E,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,EAAE,GAAI,CAA6B,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,CAAW,EAAE,CAAW;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAA2B,EAAE,IAAiB,EAAE,OAAe;IACzF,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,cAAuB;QAChC,OAAO;QACP,SAAS,EAAE,SAAS;QACpB,YAAY,EAAE,aAAa;QAC3B,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;KACvC,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,GAAG,uCAAuC,EAAE,CAAC;IACpJ,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,gGAAgG,EAAE,CAAC;IAC3K,CAAC;IAED,gGAAgG;IAChG,2DAA2D;IAC3D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,WAAW;YACpB,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,MAAM,EAAE,oBAAoB,KAAK,CAAC,QAAQ,CAAC,MAAM,2CAA2C,OAAO,CAAC,MAAM,EAAE;gBAC1G,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,qGAAqG;IACrG,MAAM,GAAG,GAAG,CAAC,CAAyB,EAAE,CAAS,EAAsB,EAAE,CACvE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhE,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,mCAAmC,EAAE,6CAA6C,EAAE,CAAC;QAC1K,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,iGAAiG;IACjG,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,EAAE,CAAC;YACxC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,+DAA+D,EAAE,CAAC;QACvM,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,iGAAiG;IACjG,2BAA2B;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,iFAAiF,EAAE,CAAC;IACtK,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,mBAAmB;QAC5B,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,MAAM,EAAE,oFAAoF;YAC1F,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,gGAAgG;KAC9H,CAAC;AACJ,CAAC"}

package/dist/workflow-run-dispatch.d.ts

@@ -0,0 +1,230 @@
+/**
+ * `workflow-run-dispatch` — the DISPATCHER SEAM of `dz workflow run` (ADR-002 O1).
+ *
+ * Why a seam at all: the two runtimes disagree about almost everything that matters (stdin open vs
+ * closed, envelope shape, where a deliverable appears, what a clean exit means), and the scheduler
+ * must not know any of it. What it knows is: ask for a dispatch, get back a typed outcome whose
+ * failure reason is a member of ONE list.
+ *
+ * Everything below the contract is CONVENTION — and every convention here is a MEASURED lesson, not
+ * a preference. Each one is named at its definition with the observation that produced it, because
+ * a convention whose reason is lost is the next thing somebody "cleans up".
+ */
+import type { Deliverable } from './loop-plan.js';
+import { type BridgeFamily } from './qe-bridge.js';
+import type { WfRunReason } from './workflow-run.js';
+/** The dispatch REQUEST — every field resolved by the scheduler, so an adapter never re-decides. */
+export interface DispatchRequest {
+    stepId: string;
+    /** The fanout member key, or null for a top-level step. */
+    itemKey: string | null;
+    /** 1-based; INCLUDES the initial attempt. */
+    attempt: number;
+    /** Fully assembled (USER prompt + shared contract lines + item binding), ingress-defanged. */
+    prompt: string;
+    /** Resolved at preflight (AM-8) — TOTAL, never inferred inside the adapter. */
+    family: BridgeFamily;
+    /** The PROBED id, never the requested spec: an allowlist says a name is spellable, only a probe
+     * says it answers. */
+    resolvedModelId: string;
+    deliverable: Deliverable;
+    /** Declared reads — the input paths a file-mode step is asked to OPEN. They travel so the adapter
+     * (and the scheduler's dispatch-time containment re-check) can hold them to the SAME realpath /
+     * symlinked-ancestor discipline as writes: a read that escapes the root is not safer than a write
+     * that does (Step-8 re-QE R3-A). */
+    expectedReads: string[];
+    /** Declared writes. The scheduler owns the landed barrier (it snapshots the baseline); the
+     * adapter only needs to know the step is in file mode. */
+    expectedWrites: string[];
+    timeoutMs: number;
+    /** Target tree for file mode; ignored by a return-value claude dispatch (isolated temp cwd). */
+    cwd: string;
+}
+export interface DispatchFailure {
+    reason: WfRunReason;
+    detail: string;
+}
+export interface DispatchResult {
+    /** Pinned to the trace settle vocabulary (`loop-trace.ts` settle outcomes) — one word, two planes. */
+    outcome: 'ok' | 'null' | 'error';
+    /** Envelope-extracted text; null on null/error. */
+    text: string | null;
+    family: BridgeFamily;
+    modelUsed: string | null;
+    wallMs: number;
+    /** null when the runtime did not report a count — NEVER 0, never estimated (ADR-004 C4). */
+    tokensIn: number | null;
+    tokensOut: number | null;
+    tokensSource: 'claude-envelope' | 'codex-stderr' | null;
+    failure?: DispatchFailure;
+}
+export interface ProbeOutcome {
+    /** The id that ANSWERED, or null when no candidate did. */
+    id: string | null;
+    wallMs: number;
+    detail: string;
+}
+export interface Dispatcher {
+    /** Once per run per family; the result is cached by the SCHEDULER and persisted into run-state
+     * (AM-8), so a resume compares against the id that actually ran. */
+    probe(candidates: string[]): Promise<ProbeOutcome>;
+    dispatch(req: DispatchRequest): Promise<DispatchResult>;
+}
+/**
+ * The 4 reasons an ADAPTER may produce — the producer PARTITION of the one 22-member
+ * `WF_RUN_REASONS` list (K3). There is no second taxonomy: the type stays `WfRunReason`, and this
+ * array is the data a test uses to assert who is allowed to produce what. The other 18 members have
+ * preflight, scheduler or state-plane producers.
+ */
+export declare const DISPATCH_REASONS: readonly ["dispatch-timeout", "dispatch-dead", "prompt-over-ceiling", "probe-failed"];
+export type DispatchReason = (typeof DISPATCH_REASONS)[number];
+/** Measured 2026-08-12: a codex `exec` at xhigh effort needs this much wall clock at the far end of
+ * its distribution. Used as the scheduler's DEFAULT per-stage timeout when the operator gives none. */
+export declare const CODEX_EXEC_XHIGH_TIMEOUT_MS = 560000;
+export interface ChildRun {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    timedOut: boolean;
+    spawnError: string | null;
+}
+export type ChildRunner = (bin: string, argv: string[], opts: {
+    stdinText: string | null;
+    timeoutMs: number;
+    cwd: string;
+    detached: boolean;
+}) => Promise<ChildRun>;
+/**
+ * W1 — the timeout/dead discriminator, decided on the WRAPPER'S OWN FIELDS and nothing else.
+ *
+ * The distinction is load-bearing because the two have different retry semantics and different
+ * operator meanings: a timeout says "it was still working", a dead dispatch says "nothing came
+ * back". Deciding it from stderr text would make the verdict depend on a runtime's phrasing.
+ *
+ *   • `timedOut === true` ⇒ `timeout` — the deadline timer FIRED, full stop;
+ *   • a spawn error, or `exitCode === null` WITHOUT a timeout ⇒ `dead` (the process never ran, or
+ *     vanished);
+ *   • anything else ⇒ `exited`, and the FAMILY parser decides. A clean exit with no parseable
+ *     envelope is ALSO dead — the "spawned but mute" case — but that call belongs to the parser
+ *     that knows what an envelope looks like, not to this function.
+ */
+export declare function classifyChildRun(run: ChildRun): {
+    kind: 'timeout';
+} | {
+    kind: 'dead';
+    detail: string;
+} | {
+    kind: 'exited';
+    exitCode: number;
+};
+/**
+ * Prepended to a RETURN-VALUE codex dispatch. Codex `exec` is an agent with a workspace, not a
+ * completion endpoint: without this it will happily start reading files to answer a question whose
+ * whole answer is in the prompt. Paired with `--sandbox read-only`, which makes the instruction
+ * enforceable rather than advisory.
+ */
+export declare const CODEX_SCOPING_PREFIX = "Answer directly from this prompt text alone; no commands, no files, no tools.";
+/**
+ * The REAL prompt ceiling for `codex exec`.
+ *
+ * The folk value 1200 is refuted history: it came from an era when the prompt travelled through a
+ * fire-and-forget wrapper. Over-ceiling ⇒ a LOUD `prompt-over-ceiling`, never truncation — a
+ * truncated prompt produces a confident answer to a question nobody asked.
+ */
+export declare const CODEX_EXEC_PROMPT_CEILING_CHARS = 24000;
+/**
+ * argv for one codex dispatch. The prompt travels as ONE argv element (no shell, no quoting), and
+ * `stdinText` is ALWAYS null for codex — MEASURED this session: with stdin left open, codex-cli
+ * 0.148.0 prints `Reading additional input from stdin...` and waits. `< /dev/null` is not a style
+ * choice; it is the difference between a 5.7 s answer and a hang.
+ *
+ * Return-value mode gets the scoping prefix AND `--sandbox read-only`. File mode gets NEITHER: the
+ * step's whole deliverable is a file it must be able to write.
+ */
+export declare function codexExecArgv(modelId: string, prompt: string, deliverable: Deliverable): string[];
+/** The liveness probe: an allowlist says an id is SPELLABLE, only a probe says it ANSWERS. */
+export declare function codexProbeArgv(candidateId: string): string[];
+/** Word-bounded `OK` on a clean exit — the `interpretClaudeProbe` twin. */
+export declare function interpretCodexProbe(out: {
+    stdout: string;
+    exitCode: number | null;
+}): boolean;
+/**
+ * Best-effort token extraction from codex stderr — null when absent, NEVER 0 and never estimated.
+ *
+ * MEASURED (codex-cli 0.148.0, this session): the trailer is a TOTAL only —
+ * `tokens used\n9,820` — with no input/output split. `wf-budget-1` has no field for a total, and
+ * attributing a total to either half would be a fabrication, so this returns BOTH nulls for that
+ * shape and the row's `tokensSource` stays null. The split branch below exists because some
+ * builds/configs do print one; it is tested, not assumed. (Named consequence: codex runs report no
+ * token counts today. That is the honest state, not a bug to paper over — see the manifest.)
+ */
+export declare function extractCodexTokens(stderr: string): {
+    tokensIn: number | null;
+    tokensOut: number | null;
+};
+/**
+ * The claude `--output-format json` USAGE fields, pinned to the LIVE envelope shape.
+ *
+ * MEASURED this session (`claude -p --output-format json`, sonnet):
+ * `usage.input_tokens = 2`, `usage.output_tokens = 4`, alongside `cache_read_input_tokens` and
+ * `cache_creation_input_tokens`. Only the two plain counters are reported — cache tokens are a
+ * SEPARATE dimension `wf-budget-1` has no field for, and silently folding them into `tokensIn`
+ * would inflate every cached run's cost picture. Added to the architecture's export list; see the
+ * manifest.
+ */
+export declare function extractClaudeUsage(stdout: string): {
+    tokensIn: number | null;
+    tokensOut: number | null;
+};
+/**
+ * The codex adapter. Conventions, each a Confirmation-1 assertion:
+ * stdin ALWAYS closed; the prompt as one argv element; scoping prefix + `--sandbox read-only` on
+ * return-value and NEITHER on file mode; `detached: true` on every spawn (AM-10).
+ */
+export declare function makeCodexExecDispatcher(run: ChildRunner, opts?: {
+    bin?: string;
+    ceilingChars?: number;
+    isolatedCwd?: () => string;
+    monotonicMs?: () => number;
+}): Dispatcher;
+/**
+ * The claude adapter. Return-value mode is the `dz qe-bridge` ISOLATION discipline verbatim:
+ * `claudeReviewArgs(model)` (which carries `CLAUDE_ISOLATION_ARGS`: `--output-format json`,
+ * `--safe-mode`, `--strict-mcp-config`, `--tools ''`, `--no-session-persistence`), an EMPTY temp
+ * cwd so no project state leaks in, the prompt on STDIN (no ARG_MAX ceiling, no shell), and a
+ * LAST-anchored envelope parse so anything a customization printed first is structurally outside
+ * the reviewed text.
+ *
+ * File mode drops `--tools ''` and `--safe-mode` (the step's deliverable is a file it must write)
+ * and runs in `req.cwd`, but keeps `--output-format json` and the envelope parse — and the
+ * scheduler's landed barrier still has the last word.
+ */
+export declare function makeClaudePDispatcher(run: ChildRunner, opts?: {
+    bin?: string;
+    isolatedCwd?: () => string;
+    monotonicMs?: () => number;
+}): Dispatcher;
+/**
+ * FILE-mode claude argv: the isolation set MINUS the two flags that would make writing impossible
+ * (`--tools ''` and `--safe-mode`). Everything that makes the reply READABLE stays — the envelope
+ * is how the runner tells an answer from a banner, in either mode.
+ */
+export declare function claudeFileArgs(model: string): string[] | null;
+/**
+ * Neutralize anchored `GATE: PASS|FAIL` lines inside UPSTREAM text before it is spliced into a
+ * DOWNSTREAM prompt.
+ *
+ * Why this exists as a second defence, when `gateVerdict` is already LAST-anchored: the two attacks
+ * are different. The egress parser stops a single reply from smuggling a verdict past its own
+ * terminal line. This stops a reply that legitimately CONTAINS a verdict — an upstream gate's own
+ * answer — from becoming the terminal line of a DOWNSTREAM step's reply once the model quotes its
+ * input back. Without it, "please review the previous verdict" is a working exploit against a plan
+ * that never did anything wrong.
+ *
+ * NEUTRALIZATION, not deletion: the words survive so the downstream model can still read what the
+ * upstream said. Only the ANCHORED grammar is broken. Idempotent — defanging twice is defanging
+ * once, so a value that travels through three steps is not progressively mangled.
+ */
+export declare function defangGateEchoes(text: string): string;
+//# sourceMappingURL=workflow-run-dispatch.d.ts.map

package/dist/workflow-run-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-run-dispatch.d.ts","sourceRoot":"","sources":["../src/workflow-run-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAgF,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACjI,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,MAAM,EAAE,YAAY,CAAC;IACrB;0BACsB;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;wCAGoC;IACpC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;8DAC0D;IAC1D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,sGAAsG;IACtG,OAAO,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,mDAAmD;IACnD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,iBAAiB,GAAG,cAAc,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB;wEACoE;IACpE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,uFAAwF,CAAC;AACtH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;uGACuG;AACvG,eAAO,MAAM,2BAA2B,SAAU,CAAC;AAOnD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,KAClF,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAC1C;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CASvC;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,kFACgD,CAAC;AAElF;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,CAIjG;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAG7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAaxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAwBxG;AAkBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAAG,UAAU,CA0D5K;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAAG,UAAU,CA4DnJ;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAe7D;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD"}