@event4u/agent-config 14.8.0 → 14.10.0

package/src/scripts/check_pack_passport_reconciliation.ts

@@ -0,0 +1,274 @@
+#!/usr/bin/env node
+/**
+ * Do the per-pack passports add up to the census the tree already runs?
+ *
+ * A per-pack number published beside a tree-wide number it contradicts is worse
+ * than no per-pack number: both get quoted, and nobody can say which is wrong.
+ * This is the check that says so out loud.
+ *
+ * THE ±10 % BAND THIS WAS SPECIFIED WITH RESTED ON A FALSE PREMISE, and the
+ * measurement is what refuted it. The band assumed packs roughly PARTITION the
+ * tree, so per-pack sums should approach the tree-wide census. Measured on
+ * 2026-08-22: across all 17 packs, `dependencies` claims **4 skills and 0
+ * rules**, against **291 skills and 118 rules** in the projection. Packs claim
+ * ~1 % of the artefacts the census counts.
+ *
+ * So the two numbers are not a reconciliation pair at all:
+ *
+ *   census   — the PROJECTED tree (`dist/agent-src/`), everything that ships
+ *   passport — what a pack CLAIMS, which is a small, deliberate subset
+ *
+ * A gate failing on an 84 % gap would be failing on a property of the tree, not
+ * on a defect — and a gate that is red by construction gets disabled rather
+ * than fixed. So this REPORTS coverage as a first-class number and exits 0.
+ * That is exactly what the step behind it asked for: a passport that does not
+ * reconcile "must say what, in-band, rather than being published alongside a
+ * number it contradicts."
+ *
+ * What would make it a gate: pack coverage approaching the tree. Then the band
+ * becomes meaningful and the exit code can follow it. Until then the useful
+ * output is the RANKING plus the coverage figure.
+ *
+ * Both sides are `chars/4` — the basis `preamble-payload-budget.json` declares
+ * for itself. Mixing an exact tokenizer into one side would make the gap
+ * between two METHODS read as a discrepancy in the packs.
+ *
+ * Also emits the RANKING, because the useful output is not the numbers but
+ * which packs carry the weight: a per-pack table sorted by cost turns "the
+ * estate grew" into "this pack grew".
+ *
+ * Exit: 0 always (it is a REPORT, not a gate), 2 on a dead scan scope. See the
+ * band note above for why the exit code does not follow the gap.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+import { runSelfTest } from './_lib/gate_self_test.js';
+import { censusRuleDir, censusSkillsCatalog } from './preamble_byte_census.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+export const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+export const PACKS_DIR = path.join(REPO_ROOT, 'src/packs');
+export const RANKING = path.join(REPO_ROOT, 'agents/evidence/reports/pack-token-ranking.md');
+
+/** ±10 %. See the module docstring for why a band exists at all. */
+export const TOLERANCE = 0.1;
+
+export interface Passport {
+    pack: string;
+    rules_tokens: number;
+    catalog_tokens: number;
+    commands_tokens: number;
+    other_tokens: number;
+    total_tokens: number;
+}
+
+/** Read `token_passport:` out of a generated pack.yaml — no YAML dependency. */
+export function readPassport(pack: string, text: string): Passport | null {
+    const start = text.indexOf('token_passport:');
+    if (start < 0) return null;
+    const num = (key: string): number => {
+        const m = new RegExp(`^\\s+${key}:\\s*(\\d+)\\s*$`, 'm').exec(text.slice(start));
+        return m === null ? 0 : Number(m[1]);
+    };
+    return {
+        pack,
+        rules_tokens: num('rules_tokens'),
+        catalog_tokens: num('catalog_tokens'),
+        commands_tokens: num('commands_tokens'),
+        other_tokens: num('other_tokens'),
+        total_tokens: num('total_tokens'),
+    };
+}
+
+export function collectPassports(dir: string = PACKS_DIR): Passport[] {
+    if (!fs.existsSync(dir)) return [];
+    const out: Passport[] = [];
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (!e.isDirectory()) continue;
+        const f = path.join(dir, e.name, 'pack.yaml');
+        if (!fs.existsSync(f)) continue;
+        const p = readPassport(e.name, fs.readFileSync(f, 'utf-8'));
+        if (p !== null) out.push(p);
+    }
+    return out;
+}
+
+export interface Reconciliation {
+    bucket: string;
+    packSum: number;
+    censusTotal: number;
+    gapPct: number;
+    inBand: boolean;
+}
+
+export function reconcile(packSum: number, censusTotal: number, bucket: string): Reconciliation {
+    // Denominator is the CENSUS, which is the side with the independent
+    // measurement. Dividing by the pack sum would let a passport that measured
+    // almost nothing report a small gap.
+    const gapPct = censusTotal === 0 ? (packSum === 0 ? 0 : 1) : Math.abs(packSum - censusTotal) / censusTotal;
+    return { bucket, packSum, censusTotal, gapPct, inBand: gapPct <= TOLERANCE };
+}
+
+export function renderRanking(ps: readonly Passport[]): string {
+    const sorted = [...ps].sort((a, b) => b.total_tokens - a.total_tokens);
+    const total = sorted.reduce((a, p) => a + p.total_tokens, 0);
+    const lines = [
+        '<!-- evidence-type: analysis -->',
+        '# Pack token ranking — which packs carry the weight',
+        '',
+        'GENERATED by `./scripts-run src/scripts/check_pack_passport_reconciliation --write-ranking`.',
+        'Do not hand-edit. Basis `chars/4`, per `docs/contracts/pack-token-passport.md`.',
+        '',
+        'The numbers are each pack\'s STANDING contribution — what is paid whether or',
+        'not the pack is used. A skill body loaded on invocation is a runtime cost and',
+        'is not here, and the residual bucket (tool definitions + dispatch prompt) is',
+        'not attributable to a pack at all.',
+        '',
+        `**${String(sorted.length)} packs, ${String(total)} tokens total.**`,
+        '',
+        '| rank | pack | total | rules | catalog | commands | other | share |',
+        '|---:|---|---:|---:|---:|---:|---:|---:|',
+    ];
+    sorted.forEach((p, i) => {
+        const share = total === 0 ? 0 : (p.total_tokens / total) * 100;
+        lines.push(
+            `| ${String(i + 1)} | \`${p.pack}\` | ${String(p.total_tokens)} | ${String(p.rules_tokens)} | ` +
+                `${String(p.catalog_tokens)} | ${String(p.commands_tokens)} | ${String(p.other_tokens)} | ${share.toFixed(1)} % |`,
+        );
+    });
+    return `${lines.join('\n')}\n`;
+}
+
+/**
+ * Discrimination over the two pure units — the parser and the ratio.
+ *
+ * This script exits 0 on every path by design (it is a report, not a gate), so
+ * no planted file can make it red and the canary harness cannot prove anything
+ * about it. The `scanned:` floor is the one thing about it that CAN break, and
+ * a self-test is what proves the two functions behind the number actually
+ * discriminate rather than returning something shaped like an answer.
+ */
+function selfTest(): number {
+    const yaml = [
+        'artefact_count: 3',
+        'token_passport:',
+        '  basis: chars/4',
+        '  catalog_tokens: 20',
+        '  commands_tokens: 5',
+        '  other_tokens: 1',
+        '  rules_tokens: 10',
+        '  total_tokens: 36',
+    ].join('\n');
+    return runSelfTest({
+        gate: 'check_pack_passport_reconciliation',
+        minCases: 6,
+        minRejectCases: 3,
+        cases: [
+            {
+                name: 'a manifest with a passport parses every field',
+                expect: 'reject',
+                run: () => {
+                    const p = readPassport('x', yaml);
+                    return p !== null && p.rules_tokens === 10 && p.total_tokens === 36 ? 1 : 0;
+                },
+            },
+            {
+                name: 'a manifest with NO passport returns null, not a zero passport',
+                expect: 'accept',
+                run: () => (readPassport('x', 'artefact_count: 3\n') === null ? 0 : 1),
+            },
+            {
+                name: 'an exact match is in band',
+                expect: 'accept',
+                run: () => (reconcile(100, 100, 'b').inBand ? 0 : 1),
+            },
+            {
+                name: 'a 9 % gap is in band and an 11 % gap is not',
+                expect: 'reject',
+                run: () => (reconcile(109, 100, 'b').inBand && !reconcile(111, 100, 'b').inBand ? 1 : 0),
+            },
+            {
+                // The denominator is the CENSUS, the side with the independent
+                // measurement. Dividing by the pack sum would let a passport
+                // that measured almost nothing report a small gap — which is
+                // exactly the failure this repo's own measurement produced.
+                name: 'the denominator is the census, not the pack sum',
+                expect: 'reject',
+                run: () => (Math.abs(reconcile(1, 100, 'b').gapPct - 0.99) < 1e-9 ? 1 : 0),
+            },
+            {
+                name: 'both sides zero is in band; a sum against a zero census is not',
+                expect: 'accept',
+                run: () => (reconcile(0, 0, 'b').inBand && !reconcile(5, 0, 'b').inBand ? 0 : 1),
+            },
+        ],
+    });
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    if (argv.includes('--self-test')) return selfTest();
+    const passports = collectPassports();
+    try {
+        assertScanned({
+            gate: 'check_pack_passport_reconciliation',
+            scanned: passports.length,
+            units: 'pack passport(s)',
+            roots: ['src/packs/*/pack.yaml'],
+        });
+    } catch (err) {
+        if (err instanceof DeadScopeError) {
+            process.stderr.write(`❌  passport reconciliation: ${err.message}\n`);
+            return 2;
+        }
+        throw err;
+    }
+    process.stdout.write(`scanned: ${String(passports.length)}\n`);
+
+    if (argv.includes('--write-ranking')) {
+        fs.mkdirSync(path.dirname(RANKING), { recursive: true });
+        fs.writeFileSync(RANKING, renderRanking(passports));
+        process.stdout.write(`✅  ranking written to ${path.relative(REPO_ROOT, RANKING)}\n`);
+    }
+
+    const rules = censusRuleDir(path.join(REPO_ROOT, 'dist', 'agent-src', 'rules'));
+    const catalog = censusSkillsCatalog(path.join(REPO_ROOT, 'dist', 'agent-src', 'skills'));
+    const tok = (chars: number): number => Math.round(chars / 4);
+    const recs = [
+        reconcile(
+            passports.reduce((a, p) => a + p.rules_tokens, 0),
+            tok(rules.chars),
+            'project-scope rules',
+        ),
+        reconcile(
+            passports.reduce((a, p) => a + p.catalog_tokens, 0),
+            tok(catalog.chars),
+            'preloaded skills catalog',
+        ),
+    ];
+    for (const r of recs) {
+        process.stdout.write(
+            `  ${r.inBand ? '✅' : '❌'} ${r.bucket.padEnd(26)} packs ${String(r.packSum).padStart(7)} · ` +
+                `census ${String(r.censusTotal).padStart(7)} · gap ${(r.gapPct * 100).toFixed(1)} %\n`,
+        );
+    }
+    const covered = recs.filter((r) => r.inBand).length;
+    process.stdout.write(
+        `\ncoverage: packs account for ${String(covered)} of ${String(recs.length)} census bucket(s) within ±${String(
+            TOLERANCE * 100,
+        )} %.\n` +
+            '  A gap here is a PROPERTY OF THE TREE, not a defect: pack `dependencies` claim a\n' +
+            '  small deliberate subset of what ships, so the two numbers are not a reconciliation\n' +
+            '  pair. Failing on that would be failing by construction, and a gate that is red by\n' +
+            '  construction gets disabled rather than fixed.\n' +
+            '  The useful output is the ranking above plus this figure. See\n' +
+            '  docs/contracts/pack-token-passport.md § Reconciliation for what would make it a gate.\n',
+    );
+    return 0;
+}
+
+if (process.argv[1] !== undefined && process.argv[1].includes('check_pack_passport_reconciliation')) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/check_pack_size.ts

@@ -28,6 +28,7 @@ import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+import { runSelfTest } from './_lib/gate_self_test.js';
 
 const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..');
 const BUDGET_PATH = path.join(REPO_ROOT, 'src', 'config', 'pack-size-budget.json');
@@ -98,6 +99,126 @@ export function skillBytes(files: readonly PackFile[]): { perSkill: Record<strin
 }
 
 /** Every violation, as human-readable lines. Empty array means green. */
+/**
+ * Content classes the published payload is checked for.
+ *
+ * The gap this closes: before it, the tarball was measured by SIZE and by build
+ * correctness, and by nothing that read what the files ARE. A payload can be
+ * comfortably under budget and still ship compiled tests, an IDE directory, or
+ * a credential-shaped file.
+ *
+ * `limit: 0` is a hard class — nothing of that shape may ship. A positive limit
+ * is a RATCHET: the number was measured, not chosen, and it may only walk down.
+ * The distinction is in `measured_in`, which every entry carries, because the
+ * same `npm pack` reports a fifth of the source maps in an unbuilt worktree as
+ * in a built one. A threshold with no stated tree reads as drift the first time
+ * someone runs it from a fresh checkout.
+ */
+interface ContentClass {
+    id: string;
+    /** Matches a payload path. */
+    match: (p: string) => boolean;
+    /** 0 = must not ship at all. > 0 = shrink-only ratchet. */
+    limit: number;
+    /** Which tree the limit was measured in, and when. */
+    measured_in: string;
+    /**
+     * True when the class only exists in a BUILT tree.
+     *
+     * This is the difference between a check and a false pass. `npm pack
+     * --dry-run --ignore-scripts` on a clean checkout — which is the condition
+     * `pack-size-budget.json` declares for its own numbers — produces no
+     * `dist/cli/**` at all, so a source-map count of 22 sails under a limit of
+     * 120 while measuring a fifth of the payload. Reported NOT MEASURABLE
+     * instead, on the same principle as the dead-scope assertion above: a check
+     * that could not run is not a clean bill.
+     */
+    requires_build: boolean;
+    why: string;
+}
+
+/**
+ * Was this payload produced from a built tree?
+ *
+ * Keyed on the payload itself rather than on the filesystem, so it describes
+ * the thing being judged instead of the machine judging it.
+ */
+function payloadIsBuilt(files: readonly PackFile[]): boolean {
+    return files.some((f) => f.path.startsWith('dist/cli/'));
+}
+
+const CONTENT_CLASSES: readonly ContentClass[] = [
+    {
+        id: 'compiled-test-artefact',
+        requires_build: true,
+        match: (p) => /\.(test|spec)\.(js|js\.map|d\.ts)$/.test(p),
+        limit: 0,
+        measured_in: 'built main checkout, 2026-08-22: 8 `.test.js` + 8 `.test.js.map` were shipping before the `files[]` negations landed',
+        why: "a compiled test's output has no consumer-facing purpose; council 2026-08-22 decision (b') strips BOTH the JS and its map, because stripping only the maps left the compiled tests themselves in the tarball",
+    },
+    {
+        id: 'credential-shaped',
+        requires_build: false,
+        match: (p) => /(^|\/)\.env(\.|$)|\.pem$|(^|\/)id_(rsa|ed25519)$|\.p12$|\.pfx$/.test(p),
+        limit: 0,
+        measured_in: 'built main checkout, 2026-08-22: 0 present',
+        why: 'a clean class with no check is indistinguishable from a class nobody looked at — and this one is worth a canary precisely because it is empty today',
+    },
+    {
+        id: 'ide-metadata',
+        requires_build: false,
+        match: (p) => /(^|\/)\.(idea|vscode)\//.test(p),
+        limit: 0,
+        measured_in: 'built main checkout, 2026-08-22: 0 present',
+        why: 'same reason as the credential class: empty and unchecked is not the same as empty and verified',
+    },
+    {
+        id: 'source-map',
+        requires_build: true,
+        match: (p) => p.endsWith('.js.map'),
+        limit: 120,
+        measured_in: 'built worktree, 2026-08-22, AFTER the compiled-test negations: 120 product maps (128 total minus 8 test maps)',
+        why: "a product source map is a consumer debugging affordance — proper line mapping and stepping over shipped JS — so council 2026-08-22 kept the 119/120 product maps and refused a blanket zero. Recorded as a PROVISIONAL measured ratchet, not an architectural constant: nothing here establishes that any consumer debugs the shipped JS, and nothing establishes they do not",
+    },
+];
+
+/**
+ * Count each content class in the payload and report over-limit classes.
+ *
+ * Returns one error string per violating class, with the offending paths — the
+ * count alone tells a reader a rule broke and not which file broke it.
+ */
+export function classifyPayload(files: readonly PackFile[]): string[] {
+    const out: string[] = [];
+    const built = payloadIsBuilt(files);
+    for (const c of CONTENT_CLASSES) {
+        if (c.requires_build && !built) continue;
+        const hits = files.filter((f) => c.match(f.path)).map((f) => f.path);
+        if (hits.length <= c.limit) continue;
+        const shown = hits.slice(0, 8);
+        out.push(
+            `content class \`${c.id}\`: ${String(hits.length)} entr${hits.length === 1 ? 'y' : 'ies'} ` +
+                `exceeds its limit of ${String(c.limit)} (measured in: ${c.measured_in}) — ` +
+                `${shown.join(', ')}${hits.length > shown.length ? `, +${String(hits.length - shown.length)} more` : ''}. ` +
+                `Why this class is checked: ${c.why}`,
+        );
+    }
+    return out;
+}
+
+/** Per-class counts, for the green-path report. */
+export function payloadClassCounts(
+    files: readonly PackFile[],
+): Array<{ id: string; count: number; limit: number; measurable: boolean }> {
+    const built = payloadIsBuilt(files);
+    return CONTENT_CLASSES.map((c) => ({
+        id: c.id,
+        count: files.filter((f) => c.match(f.path)).length,
+        limit: c.limit,
+        measurable: built || !c.requires_build,
+    }));
+}
+
 export function evaluate(budget: PackSizeBudget, pack: PackResult): string[] {
     const errors: string[] = [];
 
@@ -163,7 +284,103 @@ function readPack(argv: readonly string[]): PackResult {
     return parsePackJson(stdout);
 }
 
+/**
+ * Per-class discrimination, proven rather than asserted.
+ *
+ * WHY THIS EXISTS AND THE CANARY DOES NOT COVER IT. `gate-coverage.yml` carries
+ * `canary?: CanarySpec` — exactly ONE recipe per gate id, not a list (see
+ * `check_gate_coverage.ts`'s entry shape). The roadmap step behind this asked
+ * for "one canary per class", which the register cannot express. Two of the four
+ * classes cannot be planted through it at all: `compiled-test-artefact` is
+ * excluded from the payload by the `files[]` negations that fixed it, so a plant
+ * never ships and never reds, and `source-map` needs 121 files in a BUILT tree.
+ *
+ * So the register gets the one canary it can hold — the credential-shaped plant,
+ * chosen because that class is empty today and an empty unchecked class is
+ * indistinguishable from one nobody looked at — and every class is proven red
+ * here, over a synthetic payload, deterministically and with no pack run.
+ *
+ * A test file was the alternative and is weaker: the non-adopter ratchet in
+ * `check_gate_coverage` requires a NEW registered gate to carry a `--self-test`
+ * or an exemption, and a self-test drives the gate's own decision function
+ * rather than a copy of it.
+ */
+function packFiles(...paths: readonly string[]): PackFile[] {
+    return paths.map((path) => ({ path, size: 1 }));
+}
+
+/** A payload that looks built, so `requires_build` classes do not abstain. */
+function builtPayload(...paths: readonly string[]): PackFile[] {
+    return packFiles('dist/cli/agent-config.js', ...paths);
+}
+
+function selfTest(): number {
+    // NOT under `dist/cli/` — that prefix is exactly what `payloadIsBuilt`
+    // keys on, so maps placed there would make an "unbuilt" fixture built and
+    // the abstain case would test nothing. Found by the case failing, which is
+    // the self-test doing its job on its own fixtures.
+    const maps = (n: number): string[] =>
+        Array.from({ length: n }, (_, i) => `dist/hooks/chunk-${String(i)}.js.map`);
+    return runSelfTest({
+        gate: 'check_pack_size',
+        minCases: 9,
+        minRejectCases: 5,
+        cases: [
+            {
+                name: 'credential-shaped: a .pem in the payload is refused',
+                expect: 'reject',
+                run: () => (classifyPayload(packFiles('src/scripts/x.pem')).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'credential-shaped: a dotted .env form is refused',
+                expect: 'reject',
+                run: () => (classifyPayload(packFiles('src/config/.env.production')).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'ide-metadata: a .vscode entry is refused',
+                expect: 'reject',
+                run: () => (classifyPayload(packFiles('src/scripts/.vscode/settings.json')).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'compiled-test-artefact: a shipped .test.js is refused',
+                expect: 'reject',
+                run: () => (classifyPayload(builtPayload('dist/cli/a.test.js')).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'source-map: one over the measured ratchet is refused',
+                expect: 'reject',
+                run: () => (classifyPayload(builtPayload(...maps(121))).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'source-map: the ratchet boundary itself passes',
+                expect: 'accept',
+                run: () => (classifyPayload(builtPayload(...maps(120))).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'a plain payload passes — the classes are not firing on everything',
+                expect: 'accept',
+                run: () => (classifyPayload(packFiles('src/scripts/x.ts', 'README.md')).length > 0 ? 1 : 0),
+            },
+            {
+                // The false pass 1.2 closed. An unbuilt payload carries a fifth
+                // of the source maps, so a build-gated class must ABSTAIN there
+                // rather than report clean — and must not report a failure
+                // either, or every clean-checkout run would red.
+                name: 'unbuilt payload: build-gated classes abstain, not pass and not fail',
+                expect: 'accept',
+                run: () => (classifyPayload(packFiles(...maps(121))).length > 0 ? 1 : 0),
+            },
+            {
+                name: 'unbuilt payload: a build-INDEPENDENT class still fires',
+                expect: 'reject',
+                run: () => (classifyPayload(packFiles('src/scripts/id_rsa')).length > 0 ? 1 : 0),
+            },
+        ],
+    });
+}
+
 export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    if (argv.includes('--self-test')) return selfTest();
     let budget: PackSizeBudget;
     let pack: PackResult;
     try {
@@ -199,7 +416,14 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         throw err;
     }
 
-    const errors = evaluate(budget, pack);
+    // The coverage register requires an enforced gate to report what it
+    // inspected, and it is the same reason `assertScanned` runs above: a verdict
+    // with no denominator cannot be told apart from a verdict over nothing.
+    // Printed on EVERY path, including the failing one, so a reader of a red run
+    // still knows the population it was red over.
+    process.stdout.write(`scanned: ${String(pack.files.length)}\n`);
+
+    const errors = [...evaluate(budget, pack), ...classifyPayload(pack.files)];
     const { perSkill, total } = skillBytes(pack.files);
     if (argv.includes('--json')) {
         process.stdout.write(
@@ -216,6 +440,15 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
             `${Object.keys(perSkill).length} skills, largest share ` +
             `${Math.max(...Object.values(perSkill).map((b) => (b / total) * 100)).toFixed(2)}%\n`,
     );
+    // Printed on the GREEN path on purpose. A class that is clean and silent is
+    // indistinguishable from a class nobody checks, which is the whole reason
+    // two of these four are limit-0 over an empty set today.
+    for (const c of payloadClassCounts(pack.files)) {
+        const verdict = c.measurable
+            ? `${String(c.count)} / ${c.limit === 0 ? 'must be 0' : `${String(c.limit)} max`}`
+            : 'NOT MEASURABLE — this payload has no dist/cli/**, so the tree is unbuilt and the class is out of view';
+        process.stdout.write(`    content class ${c.id}: ${verdict}\n`);
+    }
     return 0;
 }