@fro.bot/systematic 3.18.3 → 3.18.4

package/HARNESSES.md

@@ -55,13 +55,17 @@ Behavioral enforcement rides a plugin output style (`force-for-plugin: true`), w
 
 Honest capability boundary: output-style enforcement is real and applies automatically on install, but it operates at the system-prompt level — the same layer as any other instruction the model receives — so it is strong guidance, not a hard gate the model cannot violate. Coverage also differs by surface: plugin-bundled hooks fire app-wide, including in Cowork, while a project-local `.claude/settings.json` hook fires in the Code tab but not in Cowork — state or enforcement reaching Cowork sessions has to come through the plugin, not a project-local hook. Integration coverage lives in `tests/integration/claude-code.test.ts` [CC-10].
 
-## Review-return validator — packaged paths
+## Review synthesis pipeline validator — packaged paths
 
-The raw-return and aggregate validators ship as one self-contained Node bundle,
+The raw-return validator and the four-phase synthesis pipeline (`screen`, `prepare`, `merge`,
+`finalize`) ship as one self-contained Node bundle,
 `skills/ce-review/scripts/validate-review.mjs`, generated from
 `src/ce-review-validator.ts` by `scripts/generate-ce-review-validator.ts` and
-gated by `bun run ce-review-validator:drift`. Recorded execution evidence for
-this surface:
+gated by `bun run ce-review-validator:drift`. The bundle dispatches six subcommands (`return`,
+`artifact`, `screen`, `prepare`, `merge`, `finalize`) through one shared exit-code vocabulary (0
+ok, 1 rejection/oversized/invalid UTF-8, 2 usage/TTY/read failure) and one exception boundary;
+`merge` and `finalize` run through one shared strict-JSON stdin runner bounded by
+`AGGREGATE_STDIN_BYTE_CAP`. Recorded execution evidence for this surface:
 
 - **npm / OpenCode / Pi package layout** — real Node execution from an extracted
   `npm pack --ignore-scripts` archive, resolving the script through its packaged

package/dist/ce-review-validator.d.ts

@@ -4,14 +4,55 @@ import { type ReadChunk } from './lib/review-return-validator.js';
  * validator shim (`skills/ce-review/scripts/validate-review.mjs`).
  *
  * This is a thin packaging compatibility shim, not a public extension point:
- * it dispatches exactly two subcommands and owns no validation logic itself.
+ * it dispatches exactly six subcommands and owns no validation logic
+ * beyond `screen`'s flag parsing and stdin plumbing.
  * - `return`   -> the bounded raw persona-return validator (stdin).
  * - `artifact` -> the existing aggregate review-artifact validator.
+ * - `screen`   -> executable reviewer-return admission (`screenReviewReturn`),
+ *                 reusing the same bounded stdin reader as `return`.
+ * - `prepare`  -> executable candidate preparation (`prepareReviewCandidates`),
+ *                 reusing the same bounded stdin reader with the larger
+ *                 aggregate byte cap.
+ * - `merge`    -> executable adjudication application
+ *                 (`applyReviewAdjudication`), reusing the same bounded
+ *                 stdin reader with the aggregate byte cap.
+ * - `finalize` -> executable finalize-envelope synthesis (`finalizeReview`),
+ *                 reusing the same bounded stdin reader with the aggregate
+ *                 byte cap.
  *
  * It exists because shipped skill layouts cannot all rely on the npm CLI or
  * `dist/`; every harness invokes the committed bundle through `SKILL_DIR`.
  */
-export declare const CE_REVIEW_VALIDATOR_USAGE = "Usage: node validate-review.mjs <return|artifact> [...]";
+export declare const CE_REVIEW_VALIDATOR_USAGE = "Usage: node validate-review.mjs <return|artifact|screen|prepare|merge|finalize> [...]";
+export declare const CE_REVIEW_SCREEN_USAGE = "Usage: node validate-review.mjs screen --reviewer <name> --harness <opencode|pi|claude-code>";
+export declare const CE_REVIEW_SCREEN_STDIN_TTY_MESSAGE = "screen reads one raw reviewer return from stdin; interactive input is not supported";
+export declare const CE_REVIEW_SCREEN_STDIN_READ_FAILED_MESSAGE = "screen could not read the reviewer return from stdin";
+export declare const CE_REVIEW_SCREEN_STDIN_OVERSIZED_MESSAGE = "screen input exceeds the 1 MiB limit";
+export declare const CE_REVIEW_SCREEN_STDIN_INVALID_UTF8_MESSAGE = "screen input is not valid UTF-8";
+export declare const CE_REVIEW_SCREEN_STDIN_EMPTY_MESSAGE = "screen received empty stdin";
+export declare const CE_REVIEW_SCREEN_REJECTED_MESSAGE = "screen rejected the reviewer return";
+export declare const CE_REVIEW_SCREEN_INTERNAL_ERROR_MESSAGE = "ce-review-validator: internal error";
+export declare const CE_REVIEW_PREPARE_USAGE = "Usage: node validate-review.mjs prepare";
+export declare const CE_REVIEW_PREPARE_STDIN_TTY_MESSAGE = "prepare reads one aggregate JSON envelope from stdin; interactive input is not supported";
+export declare const CE_REVIEW_PREPARE_STDIN_READ_FAILED_MESSAGE = "prepare could not read the aggregate envelope from stdin";
+export declare const CE_REVIEW_PREPARE_STDIN_OVERSIZED_MESSAGE = "prepare input exceeds the aggregate byte cap";
+export declare const CE_REVIEW_PREPARE_STDIN_INVALID_UTF8_MESSAGE = "prepare input is not valid UTF-8";
+export declare const CE_REVIEW_PREPARE_STDIN_EMPTY_MESSAGE = "prepare received empty stdin";
+export declare const CE_REVIEW_PREPARE_REJECTED_MESSAGE = "prepare rejected the aggregate envelope";
+export declare const CE_REVIEW_MERGE_USAGE = "Usage: node validate-review.mjs merge";
+export declare const CE_REVIEW_MERGE_STDIN_TTY_MESSAGE = "merge reads one aggregate JSON envelope from stdin; interactive input is not supported";
+export declare const CE_REVIEW_MERGE_STDIN_READ_FAILED_MESSAGE = "merge could not read the aggregate envelope from stdin";
+export declare const CE_REVIEW_MERGE_STDIN_OVERSIZED_MESSAGE = "merge input exceeds the aggregate byte cap";
+export declare const CE_REVIEW_MERGE_STDIN_INVALID_UTF8_MESSAGE = "merge input is not valid UTF-8";
+export declare const CE_REVIEW_MERGE_STDIN_EMPTY_MESSAGE = "merge received empty stdin";
+export declare const CE_REVIEW_MERGE_REJECTED_MESSAGE = "merge rejected the aggregate envelope";
+export declare const CE_REVIEW_FINALIZE_USAGE = "Usage: node validate-review.mjs finalize";
+export declare const CE_REVIEW_FINALIZE_STDIN_TTY_MESSAGE = "finalize reads one aggregate JSON envelope from stdin; interactive input is not supported";
+export declare const CE_REVIEW_FINALIZE_STDIN_READ_FAILED_MESSAGE = "finalize could not read the aggregate envelope from stdin";
+export declare const CE_REVIEW_FINALIZE_STDIN_OVERSIZED_MESSAGE = "finalize input exceeds the aggregate byte cap";
+export declare const CE_REVIEW_FINALIZE_STDIN_INVALID_UTF8_MESSAGE = "finalize input is not valid UTF-8";
+export declare const CE_REVIEW_FINALIZE_STDIN_EMPTY_MESSAGE = "finalize received empty stdin";
+export declare const CE_REVIEW_FINALIZE_REJECTED_MESSAGE = "finalize rejected the aggregate envelope";
 export interface CeReviewValidatorOptions {
     readonly argv: readonly string[];
     readonly cwd?: string;

package/dist/cli.js

@@ -2204,7 +2204,6 @@ var REVIEW_ARTIFACT_CUSTOM_MESSAGES = [
   "provenance.agreement_credit must not contain duplicate reviewers",
   "provenance.agreement_credit must not overlap provenance.submitters",
   "provenance.agreement_credit requires an eligible returned persona with admitted evidence",
-  "satisfied risk coverage must cite a validated finding on the lost persona selection surface",
   "satisfied risk coverage must cite an admitted ledger row owned by another persona"
 ];
 var boundedText = (maxLength) => string().min(1).max(maxLength).regex(/\S/);
@@ -2243,7 +2242,13 @@ var RISK_CRITICAL_PERSONAS = [
 ];
 var RiskCriticalPersonaSchema = _enum(RISK_CRITICAL_PERSONAS);
 var FindingTitleSchema = boundedText(256);
-var SeveritySchema = _enum(["P0", "P1", "P2", "P3", "unknown"]);
+var SeveritySchema = _enum([
+  "P0",
+  "P1",
+  "P2",
+  "P3",
+  "unknown"
+]);
 var FindingSeveritySchema = SeveritySchema.exclude(["unknown"]);
 var AutofixClassSchema = _enum([
   "safe_auto",
@@ -2592,17 +2597,6 @@ var ReviewArtifactSchema = object({
       return;
     }
     if (owner === coverage.persona) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["risk_coverage", coverageIndex, "input_finding_id"],
-        message: REVIEW_ARTIFACT_CUSTOM_MESSAGES[19]
-      });
-      return;
-    }
-    const lostDispatch = artifact.dispatches.find((dispatch) => dispatch.persona === coverage.persona);
-    const surface = lostDispatch?.selection_surface ?? [];
-    const covered = artifact.findings.some((finding) => finding.input_finding_ids.includes(citedId) && finding.validated !== false && surface.includes(finding.file));
-    if (!covered) {
       ctx.addIssue({
         code: "custom",
         path: ["risk_coverage", coverageIndex, "input_finding_id"],
@@ -2713,11 +2707,11 @@ function readChunkWithRetry(fd, buffer, toRead, readChunk) {
     }
   }
 }
-function readBoundedStdin(fd, readChunk) {
+function readBoundedStdin(fd, readChunk, maxBytes = MAX_REVIEW_RETURN_BYTES) {
   const chunks = [];
   let total = 0;
   while (true) {
-    const remaining = MAX_REVIEW_RETURN_BYTES + 1 - total;
+    const remaining = maxBytes + 1 - total;
     if (remaining <= 0)
       return { status: "oversized" };
     const toRead = Math.min(READ_CHUNK_BYTES, remaining);
@@ -2729,7 +2723,7 @@ function readBoundedStdin(fd, readChunk) {
       break;
     total += read.bytesRead;
     chunks.push(buffer.subarray(0, read.bytesRead));
-    if (total > MAX_REVIEW_RETURN_BYTES)
+    if (total > maxBytes)
       return { status: "oversized" };
   }
   return { buffer: Buffer.concat(chunks, total), status: "ok" };

package/dist/lib/review-artifact-schema.d.ts

@@ -1,5 +1,9 @@
 import { z } from 'zod';
-export declare const REVIEW_ARTIFACT_CUSTOM_MESSAGES: readonly ['severity count must match rejected finding count', 'filtered findings require a validation reason', 'risk-critical dispatches require a non-empty selection surface', 'satisfied risk coverage requires a citing input finding ID', 'unsatisfied risk coverage must not cite an input finding ID', 'passed validation must not include a reason; non-passed validation requires a reason', 'validation_unavailable dispatches must record zero input findings', 'a completed run must not contain validation_unavailable evidence', 'a validation_unavailable persona must not have an input finding', 'every synthesized input finding ID must resolve to an admitted ledger row', 'every provenance submitter must be represented by a cited admitted ledger row', 'satisfied risk coverage must cite an admitted ledger row', 'duplicate admitted input finding IDs are not allowed', 'every cited admitted reviewer must appear in provenance.submitters', 'provenance.submitters must not contain duplicate reviewers', 'provenance.agreement_credit must not contain duplicate reviewers', 'provenance.agreement_credit must not overlap provenance.submitters', 'provenance.agreement_credit requires an eligible returned persona with admitted evidence', 'satisfied risk coverage must cite a validated finding on the lost persona selection surface', 'satisfied risk coverage must cite an admitted ledger row owned by another persona'];
+export declare const MAX_INPUT_ID_LENGTH = 128;
+export declare const MAX_REASON_LENGTH = 2048;
+export declare const MAX_FINDINGS = 32;
+export declare const MAX_PERSONAS = 64;
+export declare const REVIEW_ARTIFACT_CUSTOM_MESSAGES: readonly ['severity count must match rejected finding count', 'filtered findings require a validation reason', 'risk-critical dispatches require a non-empty selection surface', 'satisfied risk coverage requires a citing input finding ID', 'unsatisfied risk coverage must not cite an input finding ID', 'passed validation must not include a reason; non-passed validation requires a reason', 'validation_unavailable dispatches must record zero input findings', 'a completed run must not contain validation_unavailable evidence', 'a validation_unavailable persona must not have an input finding', 'every synthesized input finding ID must resolve to an admitted ledger row', 'every provenance submitter must be represented by a cited admitted ledger row', 'satisfied risk coverage must cite an admitted ledger row', 'duplicate admitted input finding IDs are not allowed', 'every cited admitted reviewer must appear in provenance.submitters', 'provenance.submitters must not contain duplicate reviewers', 'provenance.agreement_credit must not contain duplicate reviewers', 'provenance.agreement_credit must not overlap provenance.submitters', 'provenance.agreement_credit requires an eligible returned persona with admitted evidence', 'satisfied risk coverage must cite an admitted ledger row owned by another persona'];
 export declare const DispatchOutcomeSchema: z.ZodEnum<{
     empty: "empty";
     findings: "findings";
@@ -20,6 +24,14 @@ export declare const HarnessSchema: z.ZodEnum<{
     pi: "pi";
 }>;
 export declare const RepoRelativePathSchema: z.ZodString;
+export declare const RISK_CRITICAL_PERSONAS: readonly ['security', 'data-migrations', 'api-contract', 'reliability', 'performance'];
+export declare const SeveritySchema: z.ZodEnum<{
+    P0: "P0";
+    P1: "P1";
+    P2: "P2";
+    P3: "P3";
+    unknown: "unknown";
+}>;
 export declare const InputFindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     record_type: z.ZodLiteral<"admitted">;
     input_id: z.ZodString;
@@ -54,6 +66,11 @@ export declare const InputFindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }>;
     reason: z.ZodString;
 }, z.core.$strict>], "record_type">;
+export declare const ProvenanceSchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    submitters: z.ZodArray<z.ZodString>;
+    agreement_credit: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
 declare const SynthesizedFindingFieldsSchema: z.ZodObject<{
     title: z.ZodString;
     severity: z.ZodEnum<{