@event4u/agent-config 16.2.0 → 16.4.0

package/src/scripts/lint_ticked_unmet_criteria.ts

@@ -0,0 +1,165 @@
+#!/usr/bin/env tsx
+/**
+ * Reports an acceptance criterion ticked over its own "NOT met".
+ *
+ * A `- [x] AC-<n>` item whose own text says a half of it `is NOT met` is a
+ * contradiction a reader of the checkbox never sees: the glyph says done, the
+ * prose says not. The honest glyph is `[~]`, which carries the unmet half as a
+ * deferral rather than hiding it under a tick.
+ *
+ * The criterion's text is the bullet line plus its indented continuation lines,
+ * up to a blank line, a less-indented line or the next checkbox. Fenced code is
+ * skipped, so a quoted example is not a finding. The match is the literal
+ * `NOT met` — upper-case on purpose, because that is how an author marks the
+ * unmet half, and a lower-case "not met" inside an explanation is prose.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/lint_ticked_unmet_criteria
+ *   ./scripts-run src/scripts/lint_ticked_unmet_criteria --root <repo>
+ *
+ * Scans every `*.md` under the roadmap tree, archive included: an archived
+ * roadmap is exactly where a contradictory tick outlives the session that
+ * made it.
+ *
+ * Exit codes: 0 no hit · 1 at least one hit · 2 usage error.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { reportScanned } from './_lib/scan_scope.js';
+
+interface Hit {
+    file: string;
+    line: number;
+    criterion: string;
+}
+
+const TICKED_AC_RE = /^([ \t]*)[-*][ \t]+\[[xX]\][ \t]+(AC-[\w.-]+)/;
+const CHECKBOX_RE = /^[ \t]*[-*][ \t]+\[[ xX~-]\]/;
+const FENCE_RE = /^[ \t]*(```|~~~)/;
+const UNMET = 'NOT met';
+
+function _indent(line: string): number {
+    return (/^[ \t]*/.exec(line)?.[0] ?? '').length;
+}
+
+function scanText(text: string, file: string): Hit[] {
+    const lines = text.split('\n');
+    const hits: Hit[] = [];
+    let inFence = false;
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i] as string;
+        if (FENCE_RE.test(line)) {
+            inFence = !inFence;
+            continue;
+        }
+        if (inFence) {
+            continue;
+        }
+        const m = TICKED_AC_RE.exec(line);
+        if (!m) {
+            continue;
+        }
+        const base = (m[1] as string).length;
+        const block = [line];
+        for (let j = i + 1; j < lines.length; j += 1) {
+            const next = lines[j] as string;
+            if (next.trim() === '' || CHECKBOX_RE.test(next) || FENCE_RE.test(next) || _indent(next) <= base) {
+                break;
+            }
+            block.push(next);
+        }
+        if (block.join('\n').includes(UNMET)) {
+            hits.push({ file, line: i + 1, criterion: m[2] as string });
+        }
+    }
+    return hits;
+}
+
+function _walk(dir: string): string[] {
+    let entries: fs.Dirent[];
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+        return [];
+    }
+    const out: string[] = [];
+    for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+            out.push(..._walk(full));
+        } else if (e.isFile() && e.name.endsWith('.md')) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+
+function scanTree(root: string): { hits: Hit[]; scanned: number } {
+    const files = _walk(path.join(root, 'agents', 'roadmaps'));
+    const hits: Hit[] = [];
+    for (const abs of files) {
+        const rel = path.relative(root, abs).split(path.sep).join('/');
+        hits.push(...scanText(fs.readFileSync(abs, 'utf8'), rel));
+    }
+    return { hits, scanned: files.length };
+}
+
+const _DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+
+function main(argv: string[] = process.argv.slice(2)): number {
+    let root = _DEFAULT_ROOT;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--root') {
+            const v = argv[i + 1];
+            if (v === undefined) {
+                process.stderr.write('lint_ticked_unmet_criteria: --root requires a value\n');
+                return 2;
+            }
+            root = path.resolve(v);
+            i += 1;
+        } else {
+            process.stderr.write(`lint_ticked_unmet_criteria: unknown argument: ${String(arg)}\n`);
+            return 2;
+        }
+    }
+    const { hits, scanned } = scanTree(root);
+    reportScanned({
+        gate: 'lint_ticked_unmet_criteria',
+        scanned,
+        units: 'roadmap file(s)',
+        roots: ['agents/roadmaps'],
+        allowEmpty: 'EMPTY_VALID: a checkout with no roadmap has no criterion to tick',
+    });
+    if (hits.length === 0) {
+        process.stdout.write(`✅  lint_ticked_unmet_criteria: ${String(scanned)} roadmap file(s), no criterion ticked over "${UNMET}".\n`);
+        return 0;
+    }
+    process.stderr.write(
+        `❌  lint_ticked_unmet_criteria: ${String(hits.length)} criterion/criteria ticked [x] over their own "${UNMET}":\n`,
+    );
+    for (const h of hits) {
+        process.stderr.write(`  ${h.file}:${String(h.line)} · ${h.criterion}\n`);
+    }
+    process.stderr.write('\n    The unmet half is a deferral: use `[~]` and carry it, or meet it.\n');
+    return 1;
+}
+
+if (process.argv[1] !== undefined) {
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv1 = fs.realpathSync(path.resolve(process.argv[1]));
+        if (here === argv1) {
+            process.exit(main());
+        }
+    } catch {
+        if (import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+            process.exit(main());
+        }
+    }
+}
+
+export { scanText, scanTree, main };
+export type { Hit };

package/src/scripts/lint_workflow_security.ts

@@ -28,6 +28,9 @@
  * TIERS are untouched; only the description of what MEDIUM covers now matches
  * the code. Re-tiering the locked model is a separate decision, recorded as
  * unresolved in agents/evidence/analysis/workflow-security-net-degraded-decision.md.
+ * The CI INVOCATION is decided there too: since 2026-10-07 consistency.yml runs
+ * this gate under `--strict` (AI council, 2/2), so a HIGH fails a pull request;
+ * the tiers are unchanged.
  *
  * Script-injection detection (regex-based) is intentionally deferred — it
  * requires an AST-aware pass to avoid false positives on quoted / escaped
@@ -35,12 +38,14 @@
  */
 
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import YAML from 'yaml';
 
-import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
+import { DeadScopeError, reportScanned } from './_lib/scan_scope.js';
 import { py_json_dumps_indent2 } from './_lib/security_lint.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -48,8 +53,16 @@ const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 // Mutable bindings so tests can sandbox the scan target (mirrors the pytest
 // monkeypatch.setattr seam used by sibling lint twins).
-let WORKFLOWS_DIR = path.join(REPO_ROOT, '.github', 'workflows');
-let ALLOWLIST_PATH = path.join(path.dirname(_HERE), 'lint_workflow_security_allowlist.json');
+//
+// `--self-test` needs the same sandbox from a CHILD process, which cannot reach
+// the in-process seam, so the two paths are also readable from the environment.
+// Deliberately env and not argv: the CLI surface is pinned (argparse flags,
+// byte-identical usage lines, unknown arg → exit 2), and a scan root is not
+// something a caller should be able to redirect by typing a flag.
+let WORKFLOWS_DIR = process.env['LINT_WORKFLOW_SECURITY_DIR'] ?? path.join(REPO_ROOT, '.github', 'workflows');
+let ALLOWLIST_PATH =
+    process.env['LINT_WORKFLOW_SECURITY_ALLOWLIST'] ??
+    path.join(path.dirname(_HERE), 'lint_workflow_security_allowlist.json');
 const ALLOWLIST_CAP = 20;
 
 function _setWorkflowsDirForTest(p: string): void {
@@ -577,8 +590,147 @@ function _usageError(arg: string): string {
     );
 }
 
+/**
+ * Prove, on demand, that the gate's rejections still fire.
+ *
+ * The CI invocation is warn-only, so the exit code `runSelfTest` reads cannot be
+ * moved by a finding there. The cases below therefore drive the two exits the
+ * gate really has — 2 for a dead scan scope or an over-cap allowlist, 1 for a
+ * HIGH under `--strict` — and pin the warn-only tier itself from the other side:
+ * a MEDIUM under `--strict` must still PASS, which is the direction a future
+ * re-tiering would silently break.
+ */
+function selfTest(): number {
+    const plant = (name: string, files: Record<string, string>): string => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), `lws-selftest-${name}-`));
+        for (const [rel, body] of Object.entries(files)) {
+            fs.writeFileSync(path.join(dir, rel), body, 'utf-8');
+        }
+        return dir;
+    };
+    const allowlistFile = (entries: unknown[]): string => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'lws-selftest-al-'));
+        const p = path.join(dir, 'allowlist.json');
+        fs.writeFileSync(p, JSON.stringify({ findings: entries }), 'utf-8');
+        return p;
+    };
+    const run = (wfDir: string, args: readonly string[], allowlist?: string): number => {
+        const prevDir = process.env['LINT_WORKFLOW_SECURITY_DIR'];
+        const prevAl = process.env['LINT_WORKFLOW_SECURITY_ALLOWLIST'];
+        process.env['LINT_WORKFLOW_SECURITY_DIR'] = wfDir;
+        if (allowlist !== undefined) {
+            process.env['LINT_WORKFLOW_SECURITY_ALLOWLIST'] = allowlist;
+        }
+        try {
+            return runGateCli(
+                REPO_ROOT,
+                path.join('src', 'scripts', 'lint_workflow_security.ts'),
+                args,
+                REPO_ROOT,
+            );
+        } finally {
+            if (prevDir === undefined) {
+                delete process.env['LINT_WORKFLOW_SECURITY_DIR'];
+            } else {
+                process.env['LINT_WORKFLOW_SECURITY_DIR'] = prevDir;
+            }
+            if (prevAl === undefined) {
+                delete process.env['LINT_WORKFLOW_SECURITY_ALLOWLIST'];
+            } else {
+                process.env['LINT_WORKFLOW_SECURITY_ALLOWLIST'] = prevAl;
+            }
+        }
+    };
+
+    const HIGH_WF = [
+        'on:',
+        '  pull_request_target:',
+        'jobs:',
+        '  build:',
+        '    steps:',
+        '      - uses: actions/checkout@0000000000000000000000000000000000000000',
+        '        with:',
+        '          persist-credentials: false',
+        '          ref: ${{ github.event.pull_request.head.sha }}',
+        '',
+    ].join('\n');
+    // Unpinned third-party action — MEDIUM, and MEDIUM alone.
+    const MEDIUM_WF = [
+        'on:',
+        '  push:',
+        'jobs:',
+        '  build:',
+        '    steps:',
+        '      - uses: somevendor/action@v1',
+        '',
+    ].join('\n');
+    const CLEAN_WF = [
+        'on:',
+        '  push:',
+        'jobs:',
+        '  build:',
+        '    steps:',
+        '      - uses: actions/checkout@0000000000000000000000000000000000000000',
+        '        with:',
+        '          persist-credentials: false',
+        '      - run: npm ci --ignore-scripts',
+        '',
+    ].join('\n');
+
+    return runSelfTest({
+        gate: 'lint_workflow_security',
+        minCases: 5,
+        minRejectCases: 3,
+        cases: [
+            {
+                name: 'an empty workflows directory is refused, not certified "0 HIGH, 0 MEDIUM"',
+                expect: 'reject',
+                run: () => run(plant('empty', {}), []),
+            },
+            {
+                name: 'a pull_request_target checkout of the untrusted ref fails under --strict',
+                expect: 'reject',
+                run: () => run(plant('high', { 'bad.yml': HIGH_WF }), ['--strict']),
+            },
+            {
+                name: 'an over-cap allowlist fails rather than suppressing silently',
+                expect: 'reject',
+                run: () =>
+                    run(
+                        plant('cap', { 'ok.yml': CLEAN_WF }),
+                        [],
+                        allowlistFile(
+                            Array.from({ length: ALLOWLIST_CAP + 1 }, (_, n) => ({
+                                workflow: `w${String(n)}.yml`,
+                                rule: 'unpinned-action',
+                            })),
+                        ),
+                    ),
+            },
+            {
+                name: 'a MEDIUM under --strict still PASSES — the tier split is real, not decorative',
+                expect: 'accept',
+                run: () => run(plant('medium', { 'med.yml': MEDIUM_WF }), ['--strict']),
+            },
+            {
+                name: 'a clean workflow passes under --strict',
+                expect: 'accept',
+                run: () => run(plant('clean', { 'ok.yml': CLEAN_WF }), ['--strict']),
+            },
+        ],
+    });
+}
+
 export function main(argv?: string[]): number {
-    const parsed = _parseArgs(argv ?? process.argv.slice(2));
+    const rawArgv = argv ?? process.argv.slice(2);
+    if (rawArgv.includes('--self-test')) {
+        if (process.env['GATE_SELF_TEST_CHILD'] === '1') {
+            process.stderr.write('lint_workflow_security: --self-test does not recurse\n');
+            return 2;
+        }
+        return selfTest();
+    }
+    const parsed = _parseArgs(rawArgv);
     if (parsed.exitCode !== undefined) {
         return parsed.exitCode;
     }
@@ -600,7 +752,14 @@ export function main(argv?: string[]): number {
     const yml = _sortedGlob('.yml');
     const yaml = _sortedGlob('.yaml');
     try {
-        assertScanned({
+        // `reportScanned`, not `assertScanned`: the gate now carries a floor in
+        // src/config/gate-coverage.yml, and the guard there reads the
+        // machine-readable `scanned:` line. Asserting without publishing leaves
+        // the gate invisible to the coverage guard — the half-adoption
+        // `_lib/scan_scope.reportScanned` was written to close. The line goes to
+        // stdout unconditionally, `--quiet` included, because CI passes
+        // `--quiet` and a count only visible without it is not a count.
+        reportScanned({
             gate: 'lint_workflow_security',
             scanned: yml.length + yaml.length,
             units: 'workflow file(s)',
@@ -649,7 +808,9 @@ export function main(argv?: string[]): number {
         );
         if (high.length || medium.length) {
             process.stdout.write(
-                '  (warn-only — run with --strict to make HIGH findings block CI)\n',
+                args.strict
+                    ? '  (--strict — HIGH findings fail this run; MEDIUM stays advisory)\n'
+                    : '  (warn-only — run with --strict to make HIGH findings block CI)\n',
             );
         } else {
             process.stdout.write('  no non-allowlisted findings\n');
@@ -657,6 +818,12 @@ export function main(argv?: string[]): number {
     }
 
     if (args.strict && high.length) {
+        if (args.quiet) {
+            // --quiet suppresses the report; a failing run still names its cause.
+            process.stderr.write(
+                `workflow-security: ${high.length} HIGH under --strict — rerun without --quiet for the findings\n`,
+            );
+        }
         return 1;
     }
     return 0;

package/src/scripts/mcp_server/consumer_tool_catalog.json

@@ -283,6 +283,59 @@
         "readOnlyHint": false
       }
     },
+    {
+      "name": "graph_node",
+      "description": "One symbol in full: where it is declared, what reaches it, what it reaches, and how connected it is. Resolves EXACTLY (node id, then label) and refuses anything it cannot — it never scores free text, so an answer is always about the node you named.",
+      "side_effect": "ro",
+      "implemented_on": [
+        "stdio"
+      ],
+      "input_schema": {
+        "type": "object",
+        "required": [
+          "id"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Node id `<relpath>#<sym>` or an exact label."
+          },
+          "direction": {
+            "type": "string",
+            "enum": [
+              "in",
+              "out",
+              "both"
+            ],
+            "default": "both",
+            "description": "Which edges to walk. `in` = who reaches it, `out` = what it reaches."
+          },
+          "depth": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 3,
+            "default": 1,
+            "description": "Hop limit."
+          },
+          "relation": {
+            "type": "string",
+            "enum": [
+              "calls",
+              "imports",
+              "uses",
+              "inherits",
+              "member",
+              "tests"
+            ],
+            "description": "Restrict to one relation. Omit for all of them."
+          }
+        },
+        "additionalProperties": false
+      },
+      "annotations": {
+        "readOnlyHint": true
+      }
+    },
     {
       "name": "graph_path",
       "description": "The shortest relation chain between two symbols, direction preserved. Answers \"how does A reach B\" without reading the files between. `(no path found)` when unconnected is an answer.",

package/src/scripts/mcp_server/graph_tools.ts

@@ -1,7 +1,13 @@
 /**
- * The five code-graph MCP tools (`road-to-a-graph-that-is-shipped` 4.1).
+ * The code-graph MCP tools (`road-to-a-graph-that-is-shipped` 4.1).
+ *
+ * `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query`, `graph_path`
+ * — and `graph_node`, added by `road-to-a-graph-that-feeds-the-gate` 3.1. The
+ * first five all answer about a NEIGHBOURHOOD or a SET; none answered "where
+ * does this live, who reaches it, what does it reach, how connected is it",
+ * which is the question an agent asks first and had to assemble from two calls
+ * and a file read.
  *
- * `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query`, `graph_path`.
  * They are the agent-facing half of Phase 3: the verbs exist on the CLI and an
  * agent that has to shell out to reach them will not, so the engine's answers
  * were unreachable from the surface the consumer actually talks to. Risk-Register
@@ -39,7 +45,15 @@ import { changedFiles } from '../code_graph/cli.js';
 import { detectSources, graphState, NATIVE_CACHE_REL, pickSource } from '../code_graph/detect.js';
 import { resolvePath } from './path_util.js';
 import { isTestFile } from '../code_graph/build.js';
-import { loadGraph, type LoadedGraph, path as graphPathVerb, query as graphQueryVerb } from '../code_graph/query.js';
+import {
+    loadGraph,
+    type LoadedGraph,
+    node as graphNodeVerb,
+    type NodeOptions,
+    path as graphPathVerb,
+    query as graphQueryVerb,
+} from '../code_graph/query.js';
+import type { Relation } from '../code_graph/types.js';
 import {
     dead,
     entryPointsFromFile,
@@ -97,6 +111,16 @@ function str(args: Record<string, unknown>, key: string): string {
     return typeof v === 'string' ? v.trim() : '';
 }
 
+/**
+ * The closed relation vocabulary, as a schema enum.
+ *
+ * Spelled out rather than derived from the `Relation` union, which erases at
+ * compile time — and pinned by a test against that union so the two cannot
+ * drift. An enum that silently lost a value would turn a legal filter into a
+ * rejected argument.
+ */
+const RELATIONS = ['calls', 'imports', 'uses', 'inherits', 'member', 'tests'] as const;
+
 function num(args: Record<string, unknown>, key: string, dflt: number): number {
     const v = args[key];
     return typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : dflt;
@@ -263,6 +287,51 @@ export const GRAPH_TOOLS: Record<string, BuiltinTool> = {
         },
     },
 
+    graph_node: {
+        name: 'graph_node',
+        side_effect: 'ro',
+        description:
+            'One symbol in full: where it is declared, what reaches it, what it ' +
+            'reaches, and how connected it is. Resolves EXACTLY (node id, then ' +
+            'label) and refuses anything it cannot — it never scores free text, ' +
+            'so an answer is always about the node you named.',
+        input_schema: {
+            type: 'object',
+            required: ['id'],
+            properties: {
+                id: { type: 'string', description: 'Node id `<relpath>#<sym>` or an exact label.' },
+                direction: {
+                    type: 'string',
+                    enum: ['in', 'out', 'both'],
+                    default: 'both',
+                    description: 'Which edges to walk. `in` = who reaches it, `out` = what it reaches.',
+                },
+                depth: { type: 'integer', minimum: 1, maximum: 3, default: 1, description: 'Hop limit.' },
+                relation: {
+                    type: 'string',
+                    enum: RELATIONS,
+                    description: 'Restrict to one relation. Omit for all of them.',
+                },
+            },
+            additionalProperties: false,
+        },
+        handler: async (args, root) => {
+            const id = str(args, 'id');
+            if (id === '') return { status: 'error', error: 'id must be a non-empty string' };
+            const staleness = graphState(root);
+            const opts: NodeOptions = {};
+            const dir = str(args, 'direction');
+            if (dir === 'in' || dir === 'out' || dir === 'both') opts.direction = dir;
+            // `num` clamps at >0 only; the 1-3 band is the verb's, so an
+            // out-of-band value is clamped there rather than rejected here —
+            // two places enforcing one band is how they drift apart.
+            opts.depth = num(args, 'depth', 1);
+            const rel = str(args, 'relation');
+            if ((RELATIONS as readonly string[]).includes(rel)) opts.relation = rel as Relation;
+            return withGraph(root, (g) => ({ staleness, ...graphNodeVerb(g, id, opts) }));
+        },
+    },
+
     graph_path: {
         name: 'graph_path',
         side_effect: 'ro',

package/src/scripts/measure_routing_signal.ts

@@ -117,6 +117,59 @@ export function mcnemarExactP(gained: number, lost: number): number {
 
 const pp = (hits: number, total: number): number => (total === 0 ? 0 : (hits / total) * 100);
 
+/** The inputs the pre-registered verdict function reads, and nothing else. */
+export interface VerdictInputs {
+    readonly deltaRecall: number;
+    readonly deltaFalse: number;
+    readonly p: number;
+    readonly gained: number;
+    readonly lost: number;
+}
+
+/**
+ * The pre-registered verdict function, in its pre-registered ORDER.
+ *
+ * Extracted from `measure` on 2026-10-04 so the order can be tested against
+ * chosen inputs rather than against whatever the live corpus happens to
+ * produce. The behaviour is unchanged, deliberately: this is a move, not a
+ * rewrite, and the bars it reads are the same module-level constants.
+ *
+ * WHY IT HAD TO MOVE. The order is load-bearing — power floor, then guard,
+ * then primary — and the only thing pinning it was a test asserting that the
+ * LIVE run happened to be a case that discriminates: primary met AND guard
+ * breached, so a function checking the primary first would wrongly say
+ * `signal`. That witness is a property of the corpus, not of the code, and the
+ * corpus grows whenever a skill gains a trigger file. On 2026-10-04 one such
+ * growth moved delta-recall from 5.128 to 4.608 and the witness was gone,
+ * leaving the ordering guarded by nothing. Tested here against chosen inputs,
+ * the discriminating case is always available and no future corpus growth can
+ * take it away.
+ */
+export function verdictOf(i: VerdictInputs): { verdict: Verdict; reason: string } {
+    if (i.gained + i.lost < POWER_FLOOR_DISCORDANT) {
+        return {
+            verdict: 'underpowered',
+            reason: `${i.gained + i.lost} discordant positive pairs < power floor ${POWER_FLOOR_DISCORDANT}`,
+        };
+    }
+    if (i.deltaFalse > FALSE_ACTIVATION_GUARD_PP) {
+        return {
+            verdict: 'harmful',
+            reason: `false activation +${i.deltaFalse.toFixed(2)} pp breaches the +${FALSE_ACTIVATION_GUARD_PP.toFixed(1)} pp guard`,
+        };
+    }
+    if (i.deltaRecall >= RECALL_GAIN_BAR_PP && i.p < ALPHA) {
+        return {
+            verdict: 'signal',
+            reason: `recall +${i.deltaRecall.toFixed(2)} pp at p=${i.p.toExponential(2)}`,
+        };
+    }
+    return {
+        verdict: 'null',
+        reason: `recall +${i.deltaRecall.toFixed(2)} pp at p=${i.p.toExponential(2)} does not clear +${RECALL_GAIN_BAR_PP.toFixed(1)} pp and p<${ALPHA}`,
+    };
+}
+
 export function measure(repo = REPO, k = K): Measurement {
     const catalogue: CatalogueEntry[] = loadCatalogue(repo);
     const cases: CorpusCase[] = loadTrainCases(repo);
@@ -170,22 +223,7 @@ export function measure(repo = REPO, k = K): Measurement {
         (falsePp['description+body'] as number) - (falsePp['description'] as number);
     const p = mcnemarExactP(gained, lost);
 
-    // The pre-registered verdict function, in its pre-registered order.
-    let verdict: Verdict;
-    let reason: string;
-    if (gained + lost < POWER_FLOOR_DISCORDANT) {
-        verdict = 'underpowered';
-        reason = `${gained + lost} discordant positive pairs < power floor ${POWER_FLOOR_DISCORDANT}`;
-    } else if (deltaFalse > FALSE_ACTIVATION_GUARD_PP) {
-        verdict = 'harmful';
-        reason = `false activation +${deltaFalse.toFixed(2)} pp breaches the +${FALSE_ACTIVATION_GUARD_PP.toFixed(1)} pp guard`;
-    } else if (deltaRecall >= RECALL_GAIN_BAR_PP && p < ALPHA) {
-        verdict = 'signal';
-        reason = `recall +${deltaRecall.toFixed(2)} pp at p=${p.toExponential(2)}`;
-    } else {
-        verdict = 'null';
-        reason = `recall +${deltaRecall.toFixed(2)} pp at p=${p.toExponential(2)} does not clear +${RECALL_GAIN_BAR_PP.toFixed(1)} pp and p<${ALPHA}`;
-    }
+    const { verdict, reason } = verdictOf({ deltaRecall, deltaFalse, p, gained, lost });
 
     return {
         k,