@fusengine/harness 0.1.47 → 0.1.49

package/dist/{validate-DVV4nRfr.mjs → validate-DCQ8dkdL.mjs}

@@ -1,9 +1,9 @@
 import { r as resolveMaxLines } from "./limits-CHn8AIL1.mjs";
-import { c as ttlLabel, t as HOME_DIR } from "./dotenv-B9nM4cuQ.mjs";
-import { t as detectHarness } from "./harness-C8Nxxyn_.mjs";
-import { F as PLUGINS_DIR, I as SOLID_REF, L as countFrameworkCodeLines } from "./evaluate-qYC5xClb.mjs";
+import { c as ttlLabel } from "./dotenv-Jj8aL1FL.mjs";
+import { d as countFrameworkCodeLines, l as PLUGINS_DIR, u as SOLID_REF } from "./home-state-D0RLWP8J.mjs";
 import { r as isDocConsulted, t as formatDocDeny } from "./doc-helpers-CWZegVdR.mjs";
 import { t as routeReferences } from "./router-PKVNBHge.mjs";
+import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DhItkBzk.mjs";
 import { extname, join } from "node:path";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
@@ -109,11 +109,26 @@ function detectFramework(filePath, content) {
 }
 //#endregion
 //#region src/policy/apex-gates.ts
-/** Gate: the routed SOLID references for this edit must have been read. */
+/**
+* True when the SOLID ref read at `path` still counts. Parity require-solid-read.py
+* `_check_solid_read` (FUSE_ENFORCE_TTL_SEC, default 120s): a SOLID read older than
+* the window has expired and must be redone. PARITY NOTE: the TTL applies ONLY to
+* this gate — Python TTL-izes SOLID reads exclusively; the other refsRead consumers
+* (skillTriggerGate, shadcn/tailwind/design gates) stay session-scoped, so this
+* predicate must never leak into them. Backward compat: a path with no `refsReadAt`
+* stamp (tracks recorded before the field existed) or a context without a clock
+* (`now` absent) counts as read.
+*/
+function refReadFresh(ctx, path, windowMs) {
+	const at = ctx.refsReadAt?.[path];
+	return at === void 0 || ctx.now === void 0 || ctx.now - at < windowMs;
+}
+/** Gate: the routed SOLID references for this edit must have been read within the TTL. */
 const solidReadGate = (ctx) => {
 	if (!ctx.refs?.length) return null;
 	const routed = routeReferences(ctx.refs, ctx.filePath, ctx.content);
-	const ttl = ttlLabel(Math.round((ctx.windowMs ?? 120 * 1e3) / 1e3));
+	const windowMs = ctx.windowMs ?? 120 * 1e3;
+	const ttl = ttlLabel(Math.round(windowMs / 1e3));
 	if (!routed) {
 		const ref = SOLID_REF[ctx.framework] ?? "generic/";
 		return {
@@ -123,7 +138,7 @@ const solidReadGate = (ctx) => {
 			actions: [`Read ${PLUGINS_DIR}/${ref}SKILL.md`]
 		};
 	}
-	const read = new Set(ctx.refsRead ?? []);
+	const read = new Set((ctx.refsRead ?? []).filter((p) => refReadFresh(ctx, p, windowMs)));
 	const missing = !!routed.skillPath && read.has(routed.skillPath) ? [] : routed.required.map((r) => r.meta.filePath).filter((p) => !read.has(p));
 	if (missing.length === 0) return null;
 	const optional = routed.optional.map((r) => r.meta.filePath);
@@ -167,13 +182,17 @@ const brainstormGate = (ctx) => ctx.brainstormRequired && ctx.brainstormFresh ==
 	reason: `Creation intent detected — brainstorm before creating new ${ctx.framework} files.`,
 	actions: ["Launch the brainstorming agent"]
 } : null;
-/** Default APEX gate chain (brainstorm, freshness, docs, SOLID refs). */
-const APEX_GATES = [
-	brainstormGate,
-	freshnessGate,
-	docConsultedGate,
-	solidReadGate
-];
+/** Gates that run BEFORE Check 1 (harness-specific brainstorm + agent freshness, pre-dating enforce-apex-phases). */
+const PRE_AUTH_GATES = [brainstormGate, freshnessGate];
+/** Gates that run AFTER Check 1: Check 2 (doc consulted once per session) then the SOLID refs. */
+const POST_AUTH_GATES = [docConsultedGate, solidReadGate];
+/**
+* Default APEX gate chain (brainstorm, freshness, docs, SOLID refs). Check 1
+* (`apexAuthorizationGate`, policy/apex-authorization.ts) is wired BETWEEN the
+* PRE and POST sub-chains by the runtime (gate-apex.ts), which owns its
+* target-write side effect — parity enforce-apex-phases.ts Check1 -> Check2.
+*/
+const APEX_GATES = [...PRE_AUTH_GATES, ...POST_AUTH_GATES];
 /**
 * Run the APEX gates (chain-of-responsibility): the first failing gate's prompt
 * wins; null means every gate passed (allow).
@@ -804,94 +823,6 @@ function isShadcnProject(cwd) {
 	return UI_DIRS.some((dir) => existsSync(join(cwd, dir)));
 }
 //#endregion
-//#region src/runtime/lifecycle/cartographer/detect.ts
-/**
-* Plugin discovery (fs). Ports `detect_plugins.py`: marketplace `plugins` dir
-* resolution + `plugin.json` meta reading.
-*/
-/** Sorted entry names of `dir` (alpha, byte-order), or `[]` on error. */
-function sortedNames$1(dir) {
-	try {
-		return readdirSync(dir).sort((a, b) => a.localeCompare(b, "en"));
-	} catch {
-		return [];
-	}
-}
-/**
-* Read `[version, name]` from `<pluginPath>/.claude-plugin/plugin.json`.
-* @param pluginPath - Absolute plugin directory.
-* @returns The `[version, name]` pair (both "" when absent/unreadable).
-*/
-function readPluginMeta(pluginPath) {
-	const pj = join(pluginPath, ".claude-plugin", "plugin.json");
-	if (!existsSync(pj)) return ["", ""];
-	try {
-		const meta = JSON.parse(readFileSync(pj, "utf-8"));
-		return [meta.version ?? "", meta.name ?? ""];
-	} catch {
-		return ["", ""];
-	}
-}
-/**
-* Auto-detect the marketplace `plugins` dir that contains `cartographer`,
-* falling back to the first marketplace with a `plugins` dir, else `cwd`.
-* Ports `find_marketplace_plugins`, but harness-agnostic: the config dir is
-* derived from the detected harness (`.claude`, `.codex`, `.cursor`, …) via the
-* shared `HOME_DIR` mapping instead of a hardcoded `.claude`.
-* @param home - Home directory (defaults to `~`).
-* @param id - Detected harness id (defaults to runtime detection).
-* @returns The resolved plugins directory.
-*/
-function findMarketplacePlugins(home = homedir(), id = detectHarness().id) {
-	const mp = join(home, HOME_DIR[id] ?? ".claude", "plugins", "marketplaces");
-	const markets = sortedNames$1(mp);
-	for (const m of markets) if (existsSync(join(mp, m, "plugins", "cartographer"))) return join(mp, m, "plugins");
-	for (const m of markets) if (existsSync(join(mp, m, "plugins"))) return join(mp, m, "plugins");
-	return process.cwd();
-}
-//#endregion
-//#region src/policy/skill-path.ts
-/**
-* Dynamic skill-path resolution (fs). Replaces a hardcoded `PLUGIN_DIR`
-* table (framework -> plugin dir name), which can drift from what's actually
-* installed: scans installed marketplace plugins for a `skills/<name>/SKILL.md`
-* that exists ON DISK, returning the first real absolute path found — never a
-* guessed one.
-*
-* Deliberately lighter than the cartographer's own `scanSkills` (which
-* frontmatter-parses every skill in a plugin): this runs once per missing
-* sub-skill on every gated Write/Edit, so it does a single flat `readdirSync`
-* of the plugins dir + one `existsSync` per candidate — no file reads, no
-* recursion, no `statSync`.
-*/
-/** Sorted entry names of `dir` (alpha, byte-order), or `[]` on error. */
-function pluginDirNames(dir) {
-	try {
-		return readdirSync(dir).sort((a, b) => a.localeCompare(b, "en"));
-	} catch {
-		return [];
-	}
-}
-/**
-* Resolve the real, installed `SKILL.md` path for `skillName`.
-* @param skillName - the sub-skill directory name (e.g. "solid-react",
-*   "shadcn-detection", "react-shadcn").
-* @param pluginsDirOverride - override for the marketplace plugins dir
-*   (tests); defaults to the auto-detected marketplace root.
-* @returns the absolute `<pluginDir>/skills/<skillName>/SKILL.md` of the
-*   first installed plugin that actually has it, or the generic
-*   `${PLUGINS_DIR}/<skillName>` fallback when none is found (CI/test
-*   environments without a marketplace).
-*/
-function resolveSkillPath(skillName, pluginsDirOverride) {
-	const pluginsDir = pluginsDirOverride ?? findMarketplacePlugins();
-	for (const dir of pluginDirNames(pluginsDir)) {
-		const candidate = join(pluginsDir, dir, "skills", skillName, "SKILL.md");
-		if (existsSync(candidate)) return candidate;
-	}
-	return `${PLUGINS_DIR}/${skillName}`;
-}
-//#endregion
 //#region src/policy/skill-triggers.ts
 /**
 * Detect which sub-skills the written `content` requires for a `framework`.
@@ -1227,7 +1158,7 @@ function buildApexInstruction(projectType, maxLines) {
 	const expertAgent = getExpertAgent(projectType);
 	return `INSTRUCTION: This is a development task. Use APEX methodology:
 
-**TRACKING FILE**: [project]/.claude/apex/task.json (auto-created on first Write/Edit)
+**TRACKING FILE**: [project]/.claude/apex/task.json (created by the /apex command)
 
 1. **ANALYZE** (MANDATORY - 3 AGENTS IN PARALLEL):
    - explore-codebase + research-expert + ${expertAgent} (framework expertise)\n   - Project type detected: ${projectType}\n\n2. **PLAN**: Use TaskCreate to break down tasks (<${maxLines} lines per file)\n\n3. **EXECUTE**: ${expertAgent}, follow SOLID principles, split at ${maxLines - 10} lines\n\n4. **EXAMINE**: Run sniper agent after ANY modification\n\n**IMPORTANT**: Read .claude/apex/task.json to check documentation status before writing code.`;
@@ -1545,4 +1476,4 @@ function missingSeoElements(html) {
 	return missing;
 }
 //#endregion
-export { MAX_EXA_RESULTS as A, detectFramework as B, resolveSkillPath as C, frameworkSolidGate as D, SKILL_TRIGGERS as E, brainstormGate as F, requiredArchSkill as G, detectModularArchitecture as H, docConsultedGate as I, evaluateApex as L, capVerbosity as M, detectCreationIntent as N, isExcludedJsPath as O, APEX_GATES as P, freshnessGate as R, usesTailwindUtilities as S, readPluginMeta as T, detectProjectType as U, DEV_KEYWORDS as V, isApexCommand as W, scanPlugin as _, firstHeading as a, detectRequiredSkills as b, EXCLUDE_DIRS as c, buildApexTaskInjection as d, loadApexTaskState as f, detectClaudeMdProjectType as g, buildClaudeMdContext as h, firstComment as i, MAX_TOKENS as j, isExcludedSwiftPath as k, PROJECT_INDICATORS as l, buildApexInstruction as m, missingSeoElements as n, parseEnrichment as o, DEV_VERBS as p, descFromText as r, parseEntry as s, isHtmlLike as t, buildApexTaskContext as u, parseBodyDesc as v, findMarketplacePlugins as w, skillTriggerGate as x, parseField as y, solidReadGate as z };
+export { detectCreationIntent as A, DEV_KEYWORDS as B, SKILL_TRIGGERS as C, MAX_EXA_RESULTS as D, isExcludedSwiftPath as E, docConsultedGate as F, detectProjectType as H, evaluateApex as I, freshnessGate as L, POST_AUTH_GATES as M, PRE_AUTH_GATES as N, MAX_TOKENS as O, brainstormGate as P, solidReadGate as R, usesTailwindUtilities as S, isExcludedJsPath as T, isApexCommand as U, detectModularArchitecture as V, requiredArchSkill as W, scanPlugin as _, firstHeading as a, detectRequiredSkills as b, EXCLUDE_DIRS as c, buildApexTaskInjection as d, loadApexTaskState as f, detectClaudeMdProjectType as g, buildClaudeMdContext as h, firstComment as i, APEX_GATES as j, capVerbosity as k, PROJECT_INDICATORS as l, buildApexInstruction as m, missingSeoElements as n, parseEnrichment as o, DEV_VERBS as p, descFromText as r, parseEntry as s, isHtmlLike as t, buildApexTaskContext as u, parseBodyDesc as v, frameworkSolidGate as w, skillTriggerGate as x, parseField as y, detectFramework as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",
@@ -108,6 +108,11 @@
       "bun": "./src/adapters/gemini/index.ts",
       "types": "./dist/adapters/gemini/index.d.mts",
       "import": "./dist/adapters/gemini/index.mjs"
+    },
+    "./adapters/hermes": {
+      "bun": "./src/adapters/hermes/index.ts",
+      "types": "./dist/adapters/hermes/index.d.mts",
+      "import": "./dist/adapters/hermes/index.mjs"
     }
   },
   "files": [
@@ -127,7 +132,7 @@
     "test": "bun test",
     "typecheck": "tsc --noEmit",
     "docs:api": "typedoc",
-    "build": "tsdown src/index.ts src/config/index.ts src/util/index.ts src/detect/index.ts src/policy/index.ts src/prompt/index.ts src/memory/index.ts src/cache/index.ts src/freshness/index.ts src/refs/index.ts src/statusline/index.ts src/cli/index.ts src/cli/bin.ts src/init/index.ts src/tracking/index.ts src/runtime/index.ts src/adapters/claude/index.ts src/adapters/codex/index.ts src/adapters/cursor/index.ts src/adapters/cline/index.ts src/adapters/gemini/index.ts --dts --format esm --clean --out-dir dist",
+    "build": "tsdown src/index.ts src/config/index.ts src/util/index.ts src/detect/index.ts src/policy/index.ts src/prompt/index.ts src/memory/index.ts src/cache/index.ts src/freshness/index.ts src/refs/index.ts src/statusline/index.ts src/cli/index.ts src/cli/bin.ts src/init/index.ts src/tracking/index.ts src/runtime/index.ts src/adapters/claude/index.ts src/adapters/codex/index.ts src/adapters/cursor/index.ts src/adapters/cline/index.ts src/adapters/gemini/index.ts src/adapters/hermes/index.ts --dts --format esm --clean --out-dir dist",
     "prepublishOnly": "bun test && tsc --noEmit && bun run build"
   },
   "publishConfig": {

package/dist/home-state-mKZxP4oZ.mjs

@@ -1,52 +0,0 @@
-import { t as atomicWrite } from "./json-io-DisYd2fb.mjs";
-import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-//#region src/runtime/home-state.ts
-/** Home `~/.claude` dir — per-harness config (CLAUDE.md, logs, plugins). */
-function claudeHome(home = homedir()) {
-	return join(home, ".claude");
-}
-/** Neutral, harness-agnostic home for fuse-harness's OWN cache/state: `~/.fuse-harness`. */
-function fuseHarnessHome(home = homedir()) {
-	return join(home, ".fuse-harness");
-}
-/** `~/.fuse-harness/cache` base dir for session/cache state (shared across harnesses). */
-function fusengineCache(home = homedir()) {
-	return join(fuseHarnessHome(home), "cache");
-}
-/** `~/.fuse-harness/cache/sessions` — per-session JSON state dir. */
-function sessionsDir(home = homedir()) {
-	return join(fusengineCache(home), "sessions");
-}
-const SID_RE = /^[a-zA-Z0-9_-]{1,128}$/;
-/** Validate a session id (1-128 url-safe chars); null when invalid. */
-function sanitizeSessionId(sid) {
-	const s = String(sid ?? "").trim();
-	return SID_RE.test(s) ? s : null;
-}
-/** Unified per-session state file path: `sessions/session-<sid>.json`. */
-function sessionStatePath(sid, home = homedir()) {
-	return join(sessionsDir(home), `session-${sid}.json`);
-}
-/** Load a session-state dict, or `{}` when missing/corrupt (mirrors Python). */
-function loadSessionState(sid, home = homedir()) {
-	const path = sessionStatePath(sid, home);
-	try {
-		if (!existsSync(path)) return {};
-		const data = JSON.parse(readFileSync(path, "utf-8"));
-		return typeof data === "object" && data !== null && !Array.isArray(data) ? data : {};
-	} catch {
-		return {};
-	}
-}
-/** Atomically persist a session-state dict (0o600 via atomicWrite, indent 2). */
-function saveSessionState(sid, state, home = homedir()) {
-	mkdirSync(sessionsDir(home), {
-		recursive: true,
-		mode: 448
-	});
-	atomicWrite(sessionStatePath(sid, home), JSON.stringify(state, null, 2));
-}
-//#endregion
-export { sanitizeSessionId as a, sessionsDir as c, loadSessionState as i, fuseHarnessHome as n, saveSessionState as o, fusengineCache as r, sessionStatePath as s, claudeHome as t };

package/dist/session-state-D4F_Dub6.d.mts

@@ -1,35 +0,0 @@
-import { t as AuthEntry } from "./doc-helpers-BNfYWvYv.mjs";
-
-//#region src/tracking/session-state.d.ts
-/** Quality of a recorded agent call (the freshness gate ignores insufficient ones). */
-type AgentQuality = "sufficient" | "insufficient";
-/** Recorded session activity that feeds the APEX gates. */
-interface SessionTrack {
-  authorizations: Record<string, AuthEntry>;
-  refsRead: string[];
-  agents: {
-    name: string;
-    ts: number;
-    quality?: AgentQuality;
-  }[];
-  trivialEdits: number[];
-  brainstormRequired?: boolean;
-}
-/** A fresh, empty track. */
-declare function emptyTrack(): SessionTrack;
-/** Record a doc consultation (Context7/Exa) for a framework in this session. Immutable. */
-declare function recordDoc(track: SessionTrack, framework: string, sessionId: string, source: string): SessionTrack;
-/** Record that a SOLID reference file was read (deduped). Immutable. */
-declare function recordRefRead(track: SessionTrack, path: string): SessionTrack;
-/** Record an agent/tool call with a timestamp + optional quality. Immutable. */
-declare function recordAgent(track: SessionTrack, name: string, ts: number, quality?: AgentQuality): SessionTrack;
-/** True when ALL of `names` ran within `windowMs` with non-insufficient quality. */
-declare function agentsFresh(track: SessionTrack, names: string[], windowMs: number, now: number): boolean;
-/** Record a trivial edit timestamp (sliding window; old evicted). Immutable. */
-declare function recordTrivialEdit(track: SessionTrack, ts: number, windowMs: number, now: number): SessionTrack;
-/** Count trivial edits within the sliding window. */
-declare function trivialCount(track: SessionTrack, windowMs: number, now: number): number;
-/** Set the brainstorm-required flag (from creation-intent detection). Immutable. */
-declare function recordBrainstormRequired(track: SessionTrack, required: boolean): SessionTrack;
-//#endregion
-export { recordAgent as a, recordRefRead as c, emptyTrack as i, recordTrivialEdit as l, SessionTrack as n, recordBrainstormRequired as o, agentsFresh as r, recordDoc as s, AgentQuality as t, trivialCount as u };

package/dist/store-CNjFenWe.mjs

@@ -1,184 +0,0 @@
-import { a as writeJsonFile, i as readJsonFile } from "./json-io-DisYd2fb.mjs";
-import { n as fuseHarnessHome } from "./home-state-mKZxP4oZ.mjs";
-import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { createHmac, randomBytes } from "node:crypto";
-//#region src/tracking/session-state.ts
-/** A fresh, empty track. */
-function emptyTrack() {
-	return {
-		authorizations: {},
-		refsRead: [],
-		agents: [],
-		trivialEdits: []
-	};
-}
-/** Record a doc consultation (Context7/Exa) for a framework in this session. Immutable. */
-function recordDoc(track, framework, sessionId, source) {
-	const prev = track.authorizations[framework] ?? {};
-	const sessions = new Set(prev.doc_sessions ?? []);
-	sessions.add(sessionId);
-	const sources = new Set(prev.sources ?? (prev.source ? [prev.source] : []));
-	sources.add(source);
-	return {
-		...track,
-		authorizations: {
-			...track.authorizations,
-			[framework]: {
-				...prev,
-				doc_sessions: [...sessions],
-				sources: [...sources]
-			}
-		}
-	};
-}
-/** Record that a SOLID reference file was read (deduped). Immutable. */
-function recordRefRead(track, path) {
-	return track.refsRead.includes(path) ? track : {
-		...track,
-		refsRead: [...track.refsRead, path]
-	};
-}
-/** Record an agent/tool call with a timestamp + optional quality. Immutable. */
-function recordAgent(track, name, ts, quality) {
-	const entry = quality ? {
-		name,
-		ts,
-		quality
-	} : {
-		name,
-		ts
-	};
-	return {
-		...track,
-		agents: [...track.agents, entry]
-	};
-}
-/** True when ALL of `names` ran within `windowMs` with non-insufficient quality. */
-function agentsFresh(track, names, windowMs, now) {
-	const cutoff = now - windowMs;
-	return names.every((n) => track.agents.some((a) => a.name === n && a.ts > cutoff && a.quality !== "insufficient"));
-}
-/** Record a trivial edit timestamp (sliding window; old evicted). Immutable. */
-function recordTrivialEdit(track, ts, windowMs, now) {
-	const cutoff = now - windowMs;
-	return {
-		...track,
-		trivialEdits: [...(track.trivialEdits ?? []).filter((t) => t > cutoff), ts]
-	};
-}
-/** Count trivial edits within the sliding window. */
-function trivialCount(track, windowMs, now) {
-	const cutoff = now - windowMs;
-	return (track.trivialEdits ?? []).filter((t) => t > cutoff).length;
-}
-/** Set the brainstorm-required flag (from creation-intent detection). Immutable. */
-function recordBrainstormRequired(track, required) {
-	return {
-		...track,
-		brainstormRequired: required
-	};
-}
-//#endregion
-//#region src/tracking/integrity.ts
-/**
-* @module integrity
-* HMAC-SHA256 tamper-evident wrapping for {@link SessionTrack}.
-*
-* Failure policy: ONLY a MAC mismatch causes fail-closed (returns null).
-* The nonce is included in the signed payload and written to disk for advisory
-* diagnostics, but is NOT checked during verification — concurrent hook
-* invocations (PostToolUse, SubagentStop, …) legitimately load the same
-* envelope after the nonce watermark advances; a monotonic check would trigger
-* spurious fail-closed behaviour mid-session.
-*
-* The machine key is readable by the same agent process, so this deters naive
-* out-of-band tampering — not a determined re-sign. Item B (transcript-grounded
-* freshness) is the primary guarantee.
-* @packageDocumentation
-*/
-const HARNESS_DIR = fuseHarnessHome();
-const KEY_PATH = join(HARNESS_DIR, ".key");
-const NONCE_PATH = join(HARNESS_DIR, ".nonce");
-/** Load (or create on first use) the per-machine HMAC key stored at mode 0600. */
-function loadOrCreateKey() {
-	mkdirSync(HARNESS_DIR, { recursive: true });
-	if (!existsSync(KEY_PATH)) {
-		const key = randomBytes(32).toString("hex");
-		writeFileSync(KEY_PATH, key, {
-			encoding: "utf8",
-			mode: 384
-		});
-		return key;
-	}
-	return readFileSync(KEY_PATH, "utf8").trim();
-}
-/**
-* Persist the last-seen nonce for advisory diagnostics (mode 0600).
-* Never read during {@link verifyTrack} — see module JSDoc for rationale.
-*/
-function writeLastNonce(nonce) {
-	mkdirSync(HARNESS_DIR, { recursive: true });
-	writeFileSync(NONCE_PATH, String(nonce), {
-		encoding: "utf8",
-		mode: 384
-	});
-}
-/** Compute HMAC-SHA256 over the canonical message `"${nonce}:${data}"`. */
-function computeMac(key, data, nonce) {
-	return createHmac("sha256", key).update(`${nonce}:${data}`).digest("hex");
-}
-/**
-* Sign a {@link SessionTrack} into a tamper-evident envelope. The nonce
-* (`Date.now()`) is embedded in the MAC to bind the timestamp to the payload.
-*/
-function signTrack(track) {
-	const key = loadOrCreateKey();
-	const data = JSON.stringify(track);
-	const nonce = Date.now();
-	return {
-		data,
-		nonce,
-		mac: computeMac(key, data, nonce)
-	};
-}
-/**
-* Verify a {@link TrackEnvelope}. Returns the parsed {@link SessionTrack} on
-* success, or `null` ONLY on MAC mismatch / parse failure (fail-closed on
-* tampering). The nonce is NOT checked — see module JSDoc.
-*/
-function verifyTrack(envelope) {
-	try {
-		const key = loadOrCreateKey();
-		if (envelope.mac !== computeMac(key, envelope.data, envelope.nonce)) return null;
-		return JSON.parse(envelope.data);
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/tracking/store.ts
-/**
-* Load and verify a session track from a signed envelope file.
-*
-* Returns {@link emptyTrack} (fail closed) when the file is absent, corrupt, or
-* fails MAC validation — so the gates re-require real agents rather than trust a
-* forged track. Only a MAC mismatch triggers fail-closed; the nonce is advisory
-* and is never checked during load.
-*/
-async function loadTrack(file) {
-	const envelope = await readJsonFile(file);
-	if (!envelope) return emptyTrack();
-	return verifyTrack(envelope) ?? emptyTrack();
-}
-/**
-* Sign and persist a session track as a tamper-evident envelope, then write the
-* advisory nonce watermark.
-*/
-async function saveTrack(file, track) {
-	const envelope = signTrack(track);
-	await writeJsonFile(file, envelope);
-	writeLastNonce(envelope.nonce);
-}
-//#endregion
-export { emptyTrack as a, recordDoc as c, trivialCount as d, agentsFresh as i, recordRefRead as l, saveTrack as n, recordAgent as o, verifyTrack as r, recordBrainstormRequired as s, loadTrack as t, recordTrivialEdit as u };