@evo-dev/core 0.0.1-alpha.1 → 0.0.1-alpha.11

package/src/task/index.ts

@@ -1,840 +0,0 @@
-import { lstat, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join, resolve } from "node:path";
-
-export type TaskContractStatus = "draft" | "routed" | "verified" | "failed";
-export type TaskExecutionMode = "minimal" | "standard" | "rigorous";
-export type VerificationStatus =
-  | "pass"
-  | "fail"
-  | "not-run"
-  | "not-applicable"
-  | "unknown"
-  | "triggered"
-  | "clear";
-
-export interface TaskContract {
-  version: 1;
-  taskId: string;
-  status: TaskContractStatus;
-  classification: "local-private";
-  source: {
-    summary: string;
-    rawPromptStored: false;
-  };
-  context: {
-    projectId: string | null;
-    relatedFiles: Array<{ path: string; reason: string; contentCaptured: false }>;
-    assumptions: string[];
-    openQuestions: string[];
-  };
-  currentState: { summary: string; evidenceRefs: string[] };
-  targetState: { summary: string; nonGoals: string[]; constraints: string[] };
-  scope: {
-    allowedPaths: string[];
-    forbiddenPaths: string[];
-    allowedOperations: string[];
-    requiresUserConfirmation: string[];
-  };
-  acceptanceCriteria: Array<{
-    id: string;
-    category: "product" | "engineering" | "safety" | "documentation";
-    statement: string;
-    requiredEvidence: string[];
-    status: VerificationStatus;
-  }>;
-  antiCriteria: Array<{
-    id: string;
-    category: "privacy" | "scope" | "safety" | "release";
-    statement: string;
-    status: VerificationStatus;
-  }>;
-  route: {
-    mode: TaskExecutionMode | null;
-    workflowId: string | null;
-    rationale: string;
-    requiredReview: string[];
-    requiredVerification: string[];
-  };
-  verification: {
-    policy: "advisory";
-    commands: VerificationCommandResult[];
-    acceptanceResults: VerificationCriterionResult[];
-    antiCriteriaResults: VerificationCriterionResult[];
-    status: "pass" | "fail" | "not-run";
-    summary: string;
-  };
-  evidence: {
-    metadataOnly: true;
-    items: VerificationEvidenceItem[];
-  };
-  learningCandidates: [];
-}
-
-export interface VerificationCommandResult {
-  id: string;
-  status: "pass" | "fail" | "not-run";
-  exitCode?: number;
-  summary: string;
-  rawOutputStored: false;
-}
-
-export type AcceptanceResultStatus = "pass" | "fail" | "not-run" | "not-applicable";
-export type AntiCriteriaResultStatus = "clear" | "triggered" | "unknown";
-
-export interface VerificationCriterionResult {
-  id: string;
-  status: VerificationStatus;
-  summary: string;
-}
-
-export interface VerificationEvidenceItem {
-  type: "command-result" | "manual-check" | "review";
-  id: string;
-  status: VerificationStatus;
-  summary: string;
-  rawOutputStored: false;
-  sourceContentStored: false;
-}
-
-export interface TaskInitInput {
-  title: string;
-  summary?: string;
-  projectId?: string | null;
-  allowedPaths?: string[];
-  allowedOperations?: string[];
-  requiresUserConfirmation?: string[];
-  requiredVerification?: string[];
-  acceptanceCriteria?: Array<{
-    id: string;
-    category: "product" | "engineering" | "safety" | "documentation";
-    statement: string;
-    requiredEvidence?: string[];
-  }>;
-  antiCriteria?: Array<{
-    id: string;
-    category: "privacy" | "scope" | "safety" | "release";
-    statement: string;
-  }>;
-}
-
-export interface TaskVerificationInput {
-  commands?: Array<{
-    id: string;
-    status: "pass" | "fail" | "not-run";
-    exitCode?: number;
-    summary?: string;
-  }>;
-  acceptanceResults?: Array<{
-    id: string;
-    status: AcceptanceResultStatus;
-    summary?: string;
-  }>;
-  antiCriteriaResults?: Array<{
-    id: string;
-    status: AntiCriteriaResultStatus;
-    summary?: string;
-  }>;
-  evidence?: Array<{
-    type: "command-result" | "manual-check" | "review";
-    id: string;
-    status: VerificationStatus;
-    summary?: string;
-  }>;
-}
-
-const FORBIDDEN_TASK_PATHS = ["CLAUDE.md", "AGENTS.md", ".claude/**", ".codex/**"];
-const FORBIDDEN_TASK_WRITE_SEGMENTS = new Set([".claude", ".codex"]);
-const FORBIDDEN_PROJECT_ASSET_SEGMENTS = new Set(["packages", "src"]);
-const FORBIDDEN_TASK_WRITE_FILES = new Set(["agents.md", "claude.md", "package.json", "readme.md"]);
-const FORBIDDEN_RAW_KEYS = new Set([
-  "rawoutput",
-  "raw_output",
-  "stdout",
-  "stderr",
-  "source",
-  "sourcecontent",
-  "source_content",
-  "sourcetext",
-  "source_text",
-  "prompt",
-  "prompttext",
-  "prompt_text",
-  "transcript",
-  "transcripttext",
-  "transcript_text",
-  "secret",
-  "secretvalue",
-  "secret_value",
-]);
-const ALLOWED_VERIFICATION_KEYS = new Set([
-  "acceptanceResults",
-  "antiCriteriaResults",
-  "commands",
-  "evidence",
-  "exitCode",
-  "id",
-  "status",
-  "summary",
-  "type",
-]);
-const SENSITIVE_TEXT_PATTERN =
-  /https?:\/\/\S+|\b(secret|token|password|passwd|private|internal|api[_-]?key|apikey|credential|credentials|raw log|raw source|raw prompt)\b/gi;
-
-export function createTaskContract(input: TaskInitInput): TaskContract {
-  const taskId = createTaskId(input.title);
-  const summary = input.summary ?? input.title;
-  const acceptanceCriteria =
-    input.acceptanceCriteria === undefined || input.acceptanceCriteria.length === 0
-      ? [
-          {
-            id: "AC1",
-            category: "engineering" as const,
-            statement: "Task outcome satisfies the requested target state.",
-            requiredEvidence: ["verification-summary"],
-            status: "not-run" as const,
-          },
-        ]
-      : input.acceptanceCriteria.map((criterion) => ({
-          id: sanitizeId(criterion.id),
-          category: criterion.category,
-          statement: sanitizeText(criterion.statement),
-          requiredEvidence: uniqueSanitizedIds(criterion.requiredEvidence ?? []),
-          status: "not-run" as const,
-        }));
-  const defaultAntiCriteria = [
-    {
-      id: "ANTI1",
-      category: "privacy" as const,
-      statement:
-        "Do not collect source code, prompts, raw command output, secrets, or internal links.",
-      status: "unknown" as const,
-    },
-    {
-      id: "ANTI2",
-      category: "scope" as const,
-      statement: "Do not write outside approved task storage or approved implementation scope.",
-      status: "unknown" as const,
-    },
-  ];
-
-  return {
-    version: 1,
-    taskId,
-    status: "draft",
-    classification: "local-private",
-    source: { summary: sanitizeText(summary), rawPromptStored: false },
-    context: {
-      projectId:
-        input.projectId === undefined || input.projectId === null
-          ? null
-          : sanitizeText(input.projectId),
-      relatedFiles: [],
-      assumptions: [],
-      openQuestions: [],
-    },
-    currentState: { summary: "To be completed by the task owner.", evidenceRefs: [] },
-    targetState: { summary: sanitizeText(input.title), nonGoals: [], constraints: [] },
-    scope: {
-      allowedPaths: sanitizeTextList(input.allowedPaths ?? []),
-      forbiddenPaths: FORBIDDEN_TASK_PATHS,
-      allowedOperations:
-        input.allowedOperations === undefined || input.allowedOperations.length === 0
-          ? ["read", "edit-approved-files", "run-local-tests"]
-          : sanitizeTextList(input.allowedOperations),
-      requiresUserConfirmation: sanitizeTextList(input.requiresUserConfirmation ?? []),
-    },
-    acceptanceCriteria,
-    antiCriteria: [
-      ...defaultAntiCriteria,
-      ...(input.antiCriteria ?? []).map((criterion) => ({
-        id: sanitizeId(criterion.id),
-        category: criterion.category,
-        statement: sanitizeText(criterion.statement),
-        status: "unknown" as const,
-      })),
-    ],
-    route: {
-      mode: null,
-      workflowId: null,
-      rationale: "Not routed yet.",
-      requiredReview: [],
-      requiredVerification: uniqueSanitizedIds(input.requiredVerification ?? []),
-    },
-    verification: {
-      policy: "advisory",
-      commands: [],
-      acceptanceResults: [],
-      antiCriteriaResults: [],
-      status: "not-run",
-      summary: "Verification has not run.",
-    },
-    evidence: { metadataOnly: true, items: [] },
-    learningCandidates: [],
-  };
-}
-
-export function routeTaskContract(contract: TaskContract): TaskContract {
-  const mode = selectMode(contract);
-  const requiredVerification = uniqueSanitizedIds([
-    ...(contract.route.requiredVerification ?? []),
-    "verification-summary",
-  ]);
-  return {
-    ...contract,
-    status: "routed",
-    route: {
-      mode,
-      workflowId: selectWorkflowId(contract, mode),
-      rationale: createRouteRationale(contract, mode),
-      requiredReview: mode === "rigorous" ? ["security-boundary", "verification"] : [],
-      requiredVerification,
-    },
-  };
-}
-
-export function verifyTaskContract(
-  contract: TaskContract,
-  input: TaskVerificationInput,
-): { contract: TaskContract; ok: boolean; summary: string } {
-  assertMetadataOnly(input);
-
-  const commands = (input.commands ?? []).map((command) => ({
-    id: sanitizeId(command.id),
-    status: assertVerificationCommandStatus(command.status, `command ${command.id}`),
-    exitCode: command.exitCode,
-    summary: sanitizeText(command.summary ?? `${command.id}: ${command.status}`),
-    rawOutputStored: false as const,
-  }));
-  const acceptanceResults = (input.acceptanceResults ?? []).map((result) => ({
-    id: sanitizeId(result.id),
-    status: assertAcceptanceResultStatus(result.status, `acceptance ${result.id}`),
-    summary: sanitizeText(result.summary ?? `${result.id}: ${result.status}`),
-  }));
-  const antiCriteriaResults = (input.antiCriteriaResults ?? []).map((result) => ({
-    id: sanitizeId(result.id),
-    status: assertAntiCriteriaResultStatus(result.status, `anti-criteria ${result.id}`),
-    summary: sanitizeText(result.summary ?? `${result.id}: ${result.status}`),
-  }));
-  const evidence = (input.evidence ?? []).map((item) => ({
-    type: assertEvidenceType(item.type, `evidence ${item.id}`),
-    id: sanitizeId(item.id),
-    status: assertVerificationStatus(item.status, `evidence ${item.id}`),
-    summary: sanitizeText(item.summary ?? `${item.id}: ${item.status}`),
-    rawOutputStored: false as const,
-    sourceContentStored: false as const,
-  }));
-
-  const failures = collectVerificationFailures(
-    contract,
-    commands,
-    acceptanceResults,
-    antiCriteriaResults,
-    evidence,
-  );
-  const ok = failures.length === 0;
-  const summary = ok ? "Verification passed." : `Verification failed: ${failures.join("; ")}`;
-
-  return {
-    ok,
-    summary,
-    contract: {
-      ...contract,
-      status: ok ? "verified" : "failed",
-      acceptanceCriteria: contract.acceptanceCriteria.map((criterion) => ({
-        ...criterion,
-        status:
-          acceptanceResults.find((result) => result.id === criterion.id)?.status ??
-          criterion.status,
-      })),
-      antiCriteria: contract.antiCriteria.map((criterion) => ({
-        ...criterion,
-        status:
-          antiCriteriaResults.find((result) => result.id === criterion.id)?.status ??
-          criterion.status,
-      })),
-      verification: {
-        policy: "advisory",
-        commands,
-        acceptanceResults,
-        antiCriteriaResults,
-        status: ok ? "pass" : "fail",
-        summary,
-      },
-      evidence: {
-        metadataOnly: true,
-        items: evidence,
-      },
-    },
-  };
-}
-
-export async function readTaskContract(path: string): Promise<TaskContract> {
-  return parseTaskContract(JSON.parse(await readFile(path, "utf8")));
-}
-
-export async function writeTaskContract(
-  path: string,
-  contract: TaskContract,
-  options: { overwrite?: boolean } = {},
-): Promise<void> {
-  await assertTaskContractWritePathAllowed(path);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, `${JSON.stringify(contract, null, 2)}\n`, {
-    encoding: "utf8",
-    flag: options.overwrite === true ? "w" : "wx",
-  });
-}
-
-export async function resolveTaskContractOutputPath(input: {
-  taskId: string;
-  outputDir?: string;
-  projectDir?: string;
-}): Promise<string> {
-  if (input.outputDir !== undefined) {
-    const outputPath = join(input.outputDir, input.taskId, "contract.json");
-    await assertTaskContractWritePathAllowed(outputPath);
-    return outputPath;
-  }
-
-  if (input.projectDir !== undefined) {
-    const projectContextPath = join(input.projectDir, ".evodev", "project.json");
-    if (!(await pathExists(projectContextPath))) {
-      throw new Error(
-        "Project mode requires existing .evodev/project.json; use --output-dir instead.",
-      );
-    }
-    const outputPath = join(input.projectDir, ".evodev", "tasks", input.taskId, "contract.json");
-    await assertTaskContractWritePathAllowed(outputPath);
-    return outputPath;
-  }
-
-  throw new Error(
-    "Task writes require --output-dir or --project-dir with existing project context.",
-  );
-}
-
-export function formatTaskContract(contract: TaskContract): string {
-  return [
-    "EvoDev task contract",
-    "",
-    `Task id: ${contract.taskId}`,
-    `Status: ${contract.status}`,
-    `Summary: ${contract.source.summary}`,
-    `Mode: ${contract.route.mode ?? "not routed"}`,
-    `Workflow: ${contract.route.workflowId ?? "not routed"}`,
-    `Required verification: ${formatList(contract.route.requiredVerification)}`,
-    `Required review: ${formatList(contract.route.requiredReview)}`,
-    `Route rationale: ${contract.route.rationale}`,
-    `Verification: ${contract.verification.status}`,
-    `Verification summary: ${contract.verification.summary}`,
-  ].join("\n");
-}
-
-function selectMode(contract: TaskContract): TaskExecutionMode {
-  if (selectRigorousTrigger(contract) !== null) {
-    return "rigorous";
-  }
-  const allowedPaths = contract.scope.allowedPaths ?? [];
-  if (allowedPaths.length <= 1 && contract.acceptanceCriteria.length <= 1) {
-    return "minimal";
-  }
-  return "standard";
-}
-
-function selectWorkflowId(contract: TaskContract, mode: TaskExecutionMode): string {
-  const text = collectRouteText(contract);
-  if (text.includes("release") || text.includes("publish")) return "rd-release-readiness";
-  if (hasSecurityBoundaryTerms(text) || mode === "rigorous") {
-    return "rd-security-boundary-review";
-  }
-  if (text.includes("bug")) return "rd-bug-fix";
-  if (text.includes("refactor")) return "rd-refactor";
-  if (text.includes("review")) return "rd-code-review";
-  if (text.includes("doc")) return "rd-docs-update";
-  if (text.includes("test")) return "rd-test-generation";
-  if (mode === "minimal") return "rd-docs-update";
-  return "rd-feature-implementation";
-}
-
-function collectRouteText(contract: TaskContract): string {
-  return [
-    contract.taskId,
-    contract.source.summary,
-    contract.currentState.summary,
-    ...contract.currentState.evidenceRefs,
-    contract.targetState.summary,
-    ...contract.targetState.nonGoals,
-    ...contract.targetState.constraints,
-    ...contract.context.relatedFiles.map((file) => `${file.path} ${file.reason}`),
-    ...contract.context.assumptions,
-    ...contract.context.openQuestions,
-    ...(contract.scope.allowedPaths ?? []),
-    ...(contract.scope.allowedOperations ?? []),
-    ...(contract.scope.requiresUserConfirmation ?? []),
-    ...contract.acceptanceCriteria.map((criterion) => criterion.statement),
-    ...contract.acceptanceCriteria.flatMap((criterion) => criterion.requiredEvidence),
-    ...(contract.route.requiredVerification ?? []),
-  ]
-    .join(" ")
-    .toLowerCase();
-}
-
-function createRouteRationale(contract: TaskContract, mode: TaskExecutionMode): string {
-  const trigger = selectRigorousTrigger(contract);
-  if (mode === "rigorous") return `Selected rigorous due to ${trigger ?? "high-risk"} trigger.`;
-  if (mode === "minimal")
-    return "Selected minimal for narrow scope and simple acceptance criteria.";
-  return "Selected standard for bounded engineering work requiring Task Contract verification.";
-}
-
-function selectRigorousTrigger(contract: TaskContract): string | null {
-  const text = collectRouteText(contract);
-  if (text.includes("[redacted]") || hasSecurityBoundaryTerms(text)) return "privacy/security";
-  if (/\b(release|publish|publishing|package distribution|npm publish)\b/.test(text)) {
-    return "release/publish";
-  }
-  if (/\b(hook|hooks|learning|memory|telemetry|observability)\b/.test(text)) {
-    return "hook/learning/telemetry";
-  }
-  if (
-    /\b(migration|migrate|hard to rollback|hard-to-rollback|irreversible|destructive)\b/.test(text)
-  ) {
-    return "hard-to-rollback";
-  }
-  if (hasHighRiskOperationTerms(text)) {
-    return "high-risk operation";
-  }
-  if ((contract.scope.requiresUserConfirmation ?? []).length > 0) {
-    return "explicit user confirmation";
-  }
-  for (const path of contract.scope.allowedPaths ?? []) {
-    const trigger = selectRigorousPathTrigger(path);
-    if (trigger !== null) return trigger;
-  }
-  for (const operation of contract.scope.allowedOperations ?? []) {
-    if (hasHighRiskOperationTerms(operation)) return "high-risk operation";
-  }
-  return null;
-}
-
-function hasSecurityBoundaryTerms(text: string): boolean {
-  return /\b(security|privacy|private data|auth|authentication|authorization|credential|credentials|secret|secrets|token|tokens|api key|api-key|apikey|password|passwd)\b/.test(
-    text,
-  );
-}
-
-function selectRigorousPathTrigger(path: string): string | null {
-  const normalized = path.trim().replace(/\\/g, "/").toLowerCase();
-  if (/^~\/\.(evodev|claude|codex)(\/|$)/.test(normalized)) {
-    return "user-level Code Agent/EvoDev path";
-  }
-  if (
-    normalized === ".evodev" ||
-    normalized.startsWith(".evodev/") ||
-    normalized.includes("/.evodev/")
-  ) {
-    return "project .evodev path";
-  }
-  if (
-    normalized === ".claude" ||
-    normalized.startsWith(".claude/") ||
-    normalized.includes("/.claude/") ||
-    normalized === ".codex" ||
-    normalized.startsWith(".codex/") ||
-    normalized.includes("/.codex/")
-  ) {
-    return "project Code Agent config path";
-  }
-  const fileName = basename(normalized);
-  if (fileName === "claude.md" || fileName === "agents.md") return "agent instruction file";
-  return null;
-}
-
-function hasHighRiskOperationTerms(text: string): boolean {
-  const normalized = text.toLowerCase().replace(/[_-]+/g, " ");
-  return /\b(delete|remove|publish|release|install|uninstall|network|external|external service|external api|write user config|user config|write project context|project context|hook|learning|memory|telemetry)\b/.test(
-    normalized,
-  );
-}
-
-function collectVerificationFailures(
-  contract: TaskContract,
-  commands: VerificationCommandResult[],
-  acceptanceResults: VerificationCriterionResult[],
-  antiCriteriaResults: VerificationCriterionResult[],
-  evidence: VerificationEvidenceItem[],
-): string[] {
-  const failures: string[] = [];
-
-  if (!isVerificationReady(contract)) {
-    failures.push("task contract must be routed before verification");
-  }
-
-  failures.push(...collectDuplicateIdFailures("command", commands));
-  failures.push(...collectDuplicateIdFailures("evidence", evidence));
-  failures.push(...collectDuplicateIdFailures("acceptance result", acceptanceResults));
-  failures.push(...collectDuplicateIdFailures("anti-criteria result", antiCriteriaResults));
-
-  for (const requiredId of contract.route.requiredVerification ?? []) {
-    const matches = [
-      ...commands.filter((command) => command.id === requiredId),
-      ...evidence.filter((item) => item.id === requiredId),
-    ];
-    if (matches.length === 0) {
-      failures.push(`missing required verification: ${requiredId}`);
-      continue;
-    }
-    if (matches.some((item) => !isSatisfyingVerificationItem(item))) {
-      failures.push(`required verification ${requiredId} is not satisfied`);
-    }
-  }
-
-  for (const criterion of contract.acceptanceCriteria) {
-    const result = acceptanceResults.find((candidate) => candidate.id === criterion.id);
-    if (result === undefined || (result.status !== "pass" && result.status !== "not-applicable")) {
-      failures.push(`acceptance ${criterion.id} is not satisfied`);
-    }
-    for (const evidenceId of criterion.requiredEvidence) {
-      const matches = evidence.filter((item) => item.id === evidenceId);
-      if (matches.length === 0) {
-        failures.push(`missing evidence for ${criterion.id}: ${evidenceId}`);
-        continue;
-      }
-      if (matches.some((item) => !isSatisfyingEvidenceItem(item))) {
-        failures.push(`evidence for ${criterion.id} is not satisfied: ${evidenceId}`);
-      }
-    }
-  }
-
-  for (const criterion of contract.antiCriteria) {
-    const result = antiCriteriaResults.find((candidate) => candidate.id === criterion.id);
-    if (result === undefined || result.status === "unknown" || result.status === "triggered") {
-      failures.push(`anti-criteria ${criterion.id} is not clear`);
-    }
-  }
-
-  return failures;
-}
-
-function collectDuplicateIdFailures(label: string, items: Array<{ id: string }>): string[] {
-  const seen = new Set<string>();
-  const duplicates = new Set<string>();
-  for (const item of items) {
-    if (seen.has(item.id)) duplicates.add(item.id);
-    seen.add(item.id);
-  }
-  return Array.from(duplicates).map((id) => `duplicate ${label} id: ${id}`);
-}
-
-function isSatisfyingVerificationItem(
-  item: VerificationCommandResult | VerificationEvidenceItem,
-): boolean {
-  if ("rawOutputStored" in item && "type" in item) return isSatisfyingEvidenceItem(item);
-  return item.status === "pass";
-}
-
-function isSatisfyingEvidenceItem(item: VerificationEvidenceItem): boolean {
-  if (item.type === "command-result") return item.status === "pass";
-  return item.status === "pass" || item.status === "clear";
-}
-
-function isVerificationReady(contract: TaskContract): boolean {
-  return (
-    contract.status !== "draft" &&
-    contract.route.mode !== null &&
-    contract.route.workflowId !== null &&
-    (contract.route.requiredVerification ?? []).length > 0
-  );
-}
-
-function parseTaskContract(value: unknown): TaskContract {
-  if (!isRecord(value) || value.version !== 1 || typeof value.taskId !== "string") {
-    throw new Error("Invalid Task Contract JSON.");
-  }
-  return value as unknown as TaskContract;
-}
-
-function assertMetadataOnly(value: unknown): void {
-  if (Array.isArray(value)) {
-    for (const item of value) assertMetadataOnly(item);
-    return;
-  }
-  if (!isRecord(value)) {
-    if (typeof value === "string" && containsSensitiveText(value)) {
-      throw new Error("Verification input contains sensitive content in metadata field.");
-    }
-    return;
-  }
-
-  for (const [key, child] of Object.entries(value)) {
-    const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-    if (FORBIDDEN_RAW_KEYS.has(key) || FORBIDDEN_RAW_KEYS.has(normalizedKey)) {
-      throw new Error(`Verification input contains forbidden raw field: ${key}`);
-    }
-    if (!ALLOWED_VERIFICATION_KEYS.has(key)) {
-      throw new Error(`Verification input contains unsupported field: ${key}`);
-    }
-    assertMetadataOnly(child);
-  }
-}
-
-function assertVerificationCommandStatus(
-  value: unknown,
-  label: string,
-): VerificationCommandResult["status"] {
-  if (value === "pass" || value === "fail" || value === "not-run") return value;
-  throw new Error(`Invalid verification command status for ${label}: ${String(value)}`);
-}
-
-function assertAcceptanceResultStatus(value: unknown, label: string): AcceptanceResultStatus {
-  if (value === "pass" || value === "fail" || value === "not-run" || value === "not-applicable") {
-    return value;
-  }
-  throw new Error(`Invalid acceptance result status for ${label}: ${String(value)}`);
-}
-
-function assertAntiCriteriaResultStatus(value: unknown, label: string): AntiCriteriaResultStatus {
-  if (value === "clear" || value === "triggered" || value === "unknown") return value;
-  throw new Error(`Invalid anti-criteria result status for ${label}: ${String(value)}`);
-}
-
-function assertVerificationStatus(value: unknown, label: string): VerificationStatus {
-  if (
-    value === "pass" ||
-    value === "fail" ||
-    value === "not-run" ||
-    value === "not-applicable" ||
-    value === "unknown" ||
-    value === "triggered" ||
-    value === "clear"
-  ) {
-    return value;
-  }
-  throw new Error(`Invalid verification status for ${label}: ${String(value)}`);
-}
-
-function assertEvidenceType(value: unknown, label: string): VerificationEvidenceItem["type"] {
-  if (value === "command-result" || value === "manual-check" || value === "review") return value;
-  throw new Error(`Invalid evidence type for ${label}: ${String(value)}`);
-}
-
-function sanitizeText(value: string): string {
-  return value.replace(SENSITIVE_TEXT_PATTERN, "[redacted]").slice(0, 500);
-}
-
-function containsSensitiveText(value: string): boolean {
-  SENSITIVE_TEXT_PATTERN.lastIndex = 0;
-  return SENSITIVE_TEXT_PATTERN.test(value);
-}
-
-async function assertTaskContractWritePathAllowed(path: string): Promise<void> {
-  assertTaskContractWritePathSegmentsAllowed(resolve(path));
-  assertTaskContractWritePathSegmentsAllowed(await resolveTaskWriteRealPath(path));
-}
-
-function assertTaskContractWritePathSegmentsAllowed(path: string): void {
-  const segments = path
-    .replace(/\\/g, "/")
-    .split("/")
-    .filter((segment) => segment.length > 0)
-    .map((segment) => segment.toLowerCase());
-  const protectedSegment = segments.find((segment) => FORBIDDEN_TASK_WRITE_SEGMENTS.has(segment));
-  if (protectedSegment !== undefined) {
-    throw new Error(`Task contract write path is protected: ${protectedSegment}`);
-  }
-  if (!isTaskStoragePath(segments)) {
-    const protectedProjectAssetSegment = segments.find((segment) =>
-      FORBIDDEN_PROJECT_ASSET_SEGMENTS.has(segment),
-    );
-    if (protectedProjectAssetSegment !== undefined) {
-      throw new Error(`Task contract write path is protected: ${protectedProjectAssetSegment}`);
-    }
-  }
-  const protectedFile = segments.find((segment) => FORBIDDEN_TASK_WRITE_FILES.has(segment));
-  if (protectedFile !== undefined) {
-    throw new Error(`Task contract write path is protected: ${protectedFile}`);
-  }
-}
-
-async function resolveTaskWriteRealPath(path: string): Promise<string> {
-  let currentPath = resolve(path);
-  const missingSegments: string[] = [];
-
-  while (true) {
-    try {
-      await lstat(currentPath);
-      return join(await realpath(currentPath), ...missingSegments.reverse());
-    } catch (error) {
-      if (!isMissingPathError(error)) throw error;
-      const parentPath = dirname(currentPath);
-      if (parentPath === currentPath) return resolve(path);
-      missingSegments.push(basename(currentPath));
-      currentPath = parentPath;
-    }
-  }
-}
-
-function isTaskStoragePath(segments: string[]): boolean {
-  return segments.some(
-    (segment, index) =>
-      segment === ".evodev" &&
-      (segments[index + 1] === "tasks" ||
-        (segments[index + 1] === "state" && segments[index + 2] === "tasks")),
-  );
-}
-
-function sanitizeTextList(values: string[]): string[] {
-  return values.map((value) => sanitizeText(value)).filter((value) => value.length > 0);
-}
-
-function sanitizeId(value: string): string {
-  const sanitized = sanitizeText(value)
-    .replace(/\[redacted\]/gi, "redacted")
-    .replace(/[^a-zA-Z0-9._-]/g, "-")
-    .replace(/-+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 80);
-  return sanitized || "item";
-}
-
-function uniqueSanitizedIds(values: string[]): string[] {
-  return Array.from(new Set(values.map((value) => sanitizeId(value))));
-}
-
-function formatList(values: string[]): string {
-  return values.length === 0 ? "none" : values.join(", ");
-}
-
-function createTaskId(title: string): string {
-  const slug = sanitizeId(title.toLowerCase()) || "task";
-  return `task-${slug}`.slice(0, 80);
-}
-
-async function pathExists(path: string): Promise<boolean> {
-  try {
-    await stat(path);
-    return true;
-  } catch (error) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "ENOENT"
-    ) {
-      return false;
-    }
-    throw error;
-  }
-}
-
-function isMissingPathError(error: unknown): boolean {
-  return (
-    error instanceof Error &&
-    "code" in error &&
-    ((error as NodeJS.ErrnoException).code === "ENOENT" ||
-      (error as NodeJS.ErrnoException).code === "ENOTDIR")
-  );
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}