@gethmy/harness 1.2.1 → 1.3.0

package/dist/cli.js

@@ -35,6 +35,9 @@ var init_branchRef = __esm(() => {
 
 // ../harmony-shared/dist/cardLinks.js
 var init_cardLinks = () => {};
+
+// ../harmony-shared/dist/cardModelStat.js
+var init_cardModelStat = () => {};
 // ../harmony-shared/dist/classification.js
 function tierFromScore(score) {
   const s = Math.max(0, Math.min(10, Math.round(score)));
@@ -393,7 +396,8 @@ var init_gateEvaluate = __esm(() => {
     "artifact",
     "label",
     "custom",
-    "oracle_passed"
+    "oracle_passed",
+    "oracle_red"
   ];
   GATE_OPERATORS = [
     "eq",
@@ -496,6 +500,7 @@ var init_dist = __esm(() => {
   init_agentStaleness();
   init_branchRef();
   init_cardLinks();
+  init_cardModelStat();
   init_classification();
   init_columnCardSplit();
   init_columnSort();
@@ -652,6 +657,8 @@ var AUTH = /\b401\b|invalid x-api-key|authentication_error|unauthorized|oauth to
 var OUT_OF_CREDITS = /\b402\b|credit balance is too low|insufficient (?:funds|credit|balance)|billing|payment required|purchase more credits/i;
 var USAGE_LIMIT = /usage limit|daily limit|monthly limit|quota (?:exceeded|reached)|reached your .{0,20}limit|usage_limit_reached|limit will reset/i;
 var RATE_LIMIT = /\b429\b|\b529\b|rate[ _-]?limit|too many requests|overloaded_error|"type"\s*:\s*"overloaded"/i;
+var SPEND_LIMIT = /spend(?:ing)? (?:limit|cap)|monthly spend/i;
+var SPEND_LIMIT_REMEDY = /admin-settings\/usage/i;
 function parseRetryAfterMs(message) {
   const match = message.match(/retry[- ]?after["':\s]+(\d+)/i);
   if (!match)
@@ -667,12 +674,16 @@ function classifyRunError(message) {
   const retryAfterMs = parseRetryAfterMs(message);
   if (AUTH.test(message))
     return { kind: "auth", retryAfterMs };
+  if (SPEND_LIMIT.test(message))
+    return { kind: "spend_limit", retryAfterMs };
   if (OUT_OF_CREDITS.test(message))
     return { kind: "out_of_credits", retryAfterMs };
   if (USAGE_LIMIT.test(message))
     return { kind: "usage_limit", retryAfterMs };
   if (RATE_LIMIT.test(message))
     return { kind: "rate_limit", retryAfterMs };
+  if (SPEND_LIMIT_REMEDY.test(message))
+    return { kind: "spend_limit", retryAfterMs };
   return { kind: null };
 }
 function describeApiError(kind) {
@@ -685,6 +696,8 @@ function describeApiError(kind) {
       return "Anthropic usage limit reached — retrying after reset";
     case "rate_limit":
       return "Anthropic rate limit hit — retrying shortly";
+    case "spend_limit":
+      return "Account spend limit reached — raise it at claude.ai/admin-settings/usage, then run `harmony-agent resume`";
   }
 }
 function cooldownMsFor(kind) {
@@ -697,6 +710,8 @@ function cooldownMsFor(kind) {
       return 30 * 60000;
     case "auth":
       return 30 * 60000;
+    case "spend_limit":
+      return 30 * 60000;
   }
 }
 
@@ -1050,7 +1065,7 @@ ${this.capturedStderr}`);
             kind: "error",
             source: "system",
             payload: {
-              message: `result ${r.subtype}: ${joined || "(no detail)"}`,
+              message: resultErrorMessage(r.subtype, joined),
               errorKind: cls.kind,
               retryable: cls.kind !== "auth" && cls.kind !== null
             }
@@ -1061,6 +1076,13 @@ ${this.capturedStderr}`);
     }
   }
 }
+function resultErrorMessage(subtype, detail) {
+  return `result ${subtype}: ${detail || "(no detail)"}`;
+}
+function resultErrorSubtype(message) {
+  const match = message.match(/^result ([A-Za-z0-9_]+):/);
+  return match ? match[1] : null;
+}
 function normalize(raw) {
   if (raw == null)
     return;
@@ -1545,24 +1567,342 @@ function truncate(value, max) {
 init_log();
 
 // src/oracle-collector.ts
-init_log();
 import { createHash } from "node:crypto";
-var TAG4 = "oracle-collector";
+init_log();
 
-class OracleCollector {
+// src/oracle.ts
+import { lstatSync, readFileSync, statSync } from "node:fs";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  mkdtemp,
+  realpath,
+  rm,
+  writeFile
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+init_log();
+var TAG4 = "oracle";
+async function resolveContained(repoPath, relativePath) {
+  if (isAbsolute(relativePath)) {
+    throw new Error(`refusing to place an oracle at an absolute path: ${relativePath}`);
+  }
+  if (relativePath === "" || relativePath === ".") {
+    throw new Error(`refusing to place an oracle at the empty/self path: "${relativePath}"`);
+  }
+  const root = await realpath(repoPath);
+  const target = resolve(root, relativePath);
+  if (target !== root && !target.startsWith(root + sep)) {
+    throw new Error(`refusing to place an oracle outside the worktree: ${relativePath}`);
+  }
+  let cursor = root;
+  for (const segment of relativePath.split("/")) {
+    cursor = resolve(cursor, segment);
+    const stat = await lstat(cursor).catch(() => null);
+    if (stat?.isSymbolicLink()) {
+      throw new Error(`refusing an oracle path through a symlink component: ${relativePath}`);
+    }
+  }
+  return target;
+}
+async function place(repoPath, oracle) {
+  const target = await resolveContained(repoPath, oracle.path);
+  await mkdir(dirname(target), { recursive: true });
+  await writeFile(target, oracle.content, "utf8");
+}
+async function remove(repoPath, oracle) {
+  const target = await resolveContained(repoPath, oracle.path);
+  await rm(target, { force: true });
+}
+var ORACLE_RUNNERS = {
+  vitest: {
+    argv: (path) => ({
+      command: "npx",
+      args: ["--no-install", "vitest", "run", path]
+    }),
+    verdictStream: "stdout",
+    report: {
+      file: "report.json",
+      flags: (reportPath) => [
+        "--reporter=default",
+        "--reporter=json",
+        `--outputFile=${reportPath}`
+      ],
+      parse: (content) => {
+        const parsed = JSON.parse(content);
+        if (typeof parsed !== "object" || parsed === null)
+          return null;
+        const { numTotalTests, numFailedTests } = parsed;
+        if (typeof numTotalTests !== "number" || typeof numFailedTests !== "number" || !Number.isFinite(numTotalTests) || !Number.isFinite(numFailedTests)) {
+          return null;
+        }
+        return { total: numTotalTests, failed: numFailedTests };
+      }
+    }
+  },
+  bun: {
+    argv: (path) => ({ command: "bun", args: ["test", path] }),
+    verdictStream: "stderr",
+    report: {
+      file: "report.xml",
+      flags: (reportPath) => [
+        "--reporter=junit",
+        `--reporter-outfile=${reportPath}`
+      ],
+      parse: (content) => {
+        const root = /<testsuites\b[^>]*>/.exec(content);
+        if (!root)
+          return null;
+        const total = /\btests="(\d+)"/.exec(root[0]);
+        const failed = /\bfailures="(\d+)"/.exec(root[0]);
+        if (!total || !failed)
+          return null;
+        return { total: Number(total[1]), failed: Number(failed[1]) };
+      }
+    }
+  }
+};
+var ORACLE_RUNNER_HINTS = Object.keys(ORACLE_RUNNERS).sort();
+var ORACLE_OUTPUT_LIMIT = 64 * 1024;
+var ORACLE_SIGINT_GRACE_MS = 2000;
+var ORACLE_SIGTERM_GRACE_MS = 3000;
+var ORACLE_DRAIN_GRACE_MS = 500;
+function resolveOracleRunner(oracle) {
+  return resolveOracleRunnerSpec(oracle).argv(argvPath(oracle.path));
+}
+function resolveOracleRunnerSpec(oracle) {
+  const hint = oracle.runnerHint?.trim().toLowerCase() ?? "";
+  const spec = Object.hasOwn(ORACLE_RUNNERS, hint) ? ORACLE_RUNNERS[hint] : undefined;
+  if (!spec) {
+    throw new Error(`refusing to run the held test: runner_hint ${JSON.stringify(oracle.runnerHint)} is not in the motor's allow-list (${ORACLE_RUNNER_HINTS.join(", ")})`);
+  }
+  return spec;
+}
+function summarizeOracleReport(oracle, content) {
+  const spec = resolveOracleRunnerSpec(oracle);
+  try {
+    return spec.report.parse(content) ?? null;
+  } catch {
+    return null;
+  }
+}
+function gradeOracleRed(summary, exitCode) {
+  if (!summary) {
+    return {
+      outcome: "no_verdict",
+      reason: `the runner exited ${exitCode} but the motor has no report it could read — absent, unreadable, or refused, ` + "so it cannot be shown to have run the held test (an absent runner and a failing test share this exit code). " + "The report is a file the runner writes outside the worktree; the motor's local log says which of the three it was"
+    };
+  }
+  if (summary.total === 0) {
+    return {
+      outcome: "no_verdict",
+      reason: `the runner started but executed no tests (exit ${exitCode}), so the held test produced no verdict`
+    };
+  }
+  if (summary.failed > 0) {
+    return { outcome: "reproduced", summary };
+  }
+  if (exitCode === 0) {
+    return { outcome: "not_reproduced", summary };
+  }
+  return {
+    outcome: "no_verdict",
+    reason: `all ${summary.total} test(s) passed but the runner exited ${exitCode}, so the failure is not the held test's`
+  };
+}
+function argvPath(path) {
+  return path.startsWith("./") ? path : `./${path}`;
+}
+async function runHeldOracle(repoPath, oracle, timeoutMs = DEFAULT_METRIC_TIMEOUT_MS) {
+  const spec = resolveOracleRunnerSpec(oracle);
+  const reportDir = await mkdtemp(join(tmpdir(), reportDirPrefix()));
+  const reportPath = join(reportDir, spec.report.file);
+  try {
+    return await spawnHeldOracle(spec, repoPath, oracle, reportPath, timeoutMs);
+  } finally {
+    await removeReportDir(reportDir);
+  }
+}
+function reportDirPrefix() {
+  return "harmony-oracle-report-";
+}
+function assertUntampered(reportPath) {
+  const dir = statSync(dirname(reportPath));
+  if ((dir.mode & 511) !== 448) {
+    throw new Error(`the oracle report directory's mode changed to ${(dir.mode & 511).toString(8)} — refusing the report`);
+  }
+  const file = lstatSync(reportPath);
+  if (!file.isFile()) {
+    throw new Error("the oracle report is not a regular file — refusing it");
+  }
+  if ((file.mode & 128) === 0) {
+    throw new Error(`the oracle report is not owner-writable (mode ${(file.mode & 511).toString(8)}), so the runner could not have written it last — refusing it`);
+  }
+}
+async function removeReportDir(reportDir) {
+  try {
+    await chmod(reportDir, 448).catch(() => {});
+    await rm(reportDir, { recursive: true, force: true });
+  } catch (err) {
+    log.warn(TAG4, `Could not remove the oracle report directory ${reportDir} (${err instanceof Error ? err.message : String(err)}) — it may still hold the runner's report, which carries assertion text for vitest. Remove it by hand.`);
+  }
+}
+async function spawnHeldOracle(spec, repoPath, oracle, reportPath, timeoutMs) {
+  const { command, args: baseArgs } = spec.argv(argvPath(oracle.path));
+  const args = [...baseArgs, ...spec.report.flags(reportPath)];
+  return await new Promise((settleOk, settleErr) => {
+    let child;
+    try {
+      child = spawnInGroup(command, args, {
+        cwd: repoPath,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+    } catch (err) {
+      settleErr(err);
+      return;
+    }
+    const pgid = child.pid;
+    let output = "";
+    let truncated = false;
+    const outDecoder = new StringDecoder("utf8");
+    const errDecoder = new StringDecoder("utf8");
+    let verdict = "";
+    let flushed = false;
+    const flush = () => {
+      if (flushed)
+        return;
+      flushed = true;
+      const outTail = outDecoder.end();
+      const errTail = errDecoder.end();
+      output += outTail + errTail;
+      verdict += spec.verdictStream === "stdout" ? outTail : errTail;
+    };
+    const finalOutput = () => {
+      flush();
+      return truncated ? `… earlier output dropped; kept the last ${ORACLE_OUTPUT_LIMIT} characters
+${output}` : output;
+    };
+    const finalVerdict = () => {
+      flush();
+      return verdict;
+    };
+    let report = null;
+    const captureReport = () => {
+      try {
+        assertUntampered(reportPath);
+        report = spec.report.parse(readFileSync(reportPath, "utf8"));
+      } catch (err) {
+        report = null;
+        const message = err instanceof Error ? err.message : String(err);
+        const absent = err instanceof Error && err.code === "ENOENT";
+        if (absent) {
+          log.info(TAG4, `No oracle report at ${reportPath} — no verdict.`);
+        } else {
+          log.warn(TAG4, `Refusing the oracle report at ${reportPath}: ${message} — the gate will report no verdict.`);
+        }
+      }
+    };
+    let settled = false;
+    let killing = false;
+    let timer;
+    let drainTimer;
+    const settle = (failure, result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      if (drainTimer)
+        clearTimeout(drainTimer);
+      reapGroup(pgid);
+      if (failure)
+        settleErr(failure);
+      else
+        settleOk(result);
+    };
+    const append = (stream, chunk) => {
+      const text = (stream === "stdout" ? outDecoder : errDecoder).write(chunk);
+      output += text;
+      if (output.length > ORACLE_OUTPUT_LIMIT) {
+        output = output.slice(-ORACLE_OUTPUT_LIMIT);
+        truncated = true;
+      }
+      if (stream === spec.verdictStream) {
+        verdict += text;
+        if (verdict.length > ORACLE_OUTPUT_LIMIT) {
+          verdict = verdict.slice(-ORACLE_OUTPUT_LIMIT);
+        }
+      }
+    };
+    child.stdout?.on("data", (chunk) => append("stdout", chunk));
+    child.stderr?.on("data", (chunk) => append("stderr", chunk));
+    child.once("error", (err) => settle(err));
+    const settleFromExit = (code, signal) => {
+      if (drainTimer)
+        clearTimeout(drainTimer);
+      if (code === null) {
+        settle(new Error(`the held test was terminated by signal ${signal}`));
+        return;
+      }
+      settle(null, {
+        exitCode: code,
+        output: finalOutput(),
+        verdict: finalVerdict(),
+        report
+      });
+    };
+    child.once("exit", (code, signal) => {
+      if (killing)
+        return;
+      captureReport();
+      if (timer)
+        clearTimeout(timer);
+      reapGroup(pgid);
+      drainTimer = setTimeout(() => settleFromExit(code, signal), ORACLE_DRAIN_GRACE_MS);
+      child.once("close", () => settleFromExit(code, signal));
+    });
+    timer = setTimeout(() => {
+      if (settled)
+        return;
+      killing = true;
+      terminateGroup(child, {
+        sigintTimeoutMs: ORACLE_SIGINT_GRACE_MS,
+        sigtermTimeoutMs: ORACLE_SIGTERM_GRACE_MS
+      }).catch(() => {}).then(() => {
+        settle(new Error(`the held test did not finish within ${timeoutMs}ms`));
+      });
+    }, timeoutMs);
+  });
+}
+
+// src/oracle-collector.ts
+var TAG5 = "oracle-collector";
+
+class HeldOracleCollector {
   deps;
-  kind = "oracle_passed";
   constructor(deps) {
     this.deps = deps;
   }
   async collect(context) {
-    const oracle = await this.deps.fetchOracle(context.cardId, context.stageId, this.deps.sessionId);
+    const stageId = this.oracleStageId(context);
+    if (!stageId) {
+      const reason = `No stage downstream of ${context.stageId} declares an \`oracle_passed\` gate, ` + "so there is no held test for this gate to grade. A red gate needs a later stage that runs the same test green.";
+      log.warn(TAG5, `${reason} — blocked (config)`);
+      return {
+        result: "blocked",
+        structured: { reason, ...GATE_CONFIG_ERROR_MARK }
+      };
+    }
+    const oracle = await this.deps.fetchOracle(context.cardId, stageId, this.deps.sessionId);
     if (!oracle) {
-      log.info(TAG4, `No oracle held for stage ${context.stageId} — blocked`);
+      log.info(TAG5, `No oracle held for stage ${stageId} — blocked`);
       return {
         result: "blocked",
         structured: {
-          reason: `No oracle is held for stage ${context.stageId}.`
+          reason: `No oracle is held for stage ${stageId}.`
         }
       };
     }
@@ -1575,28 +1915,24 @@ class OracleCollector {
     };
     await this.deps.place(this.deps.repoPath, oracle);
     try {
-      const { exitCode, output } = await this.deps.run(this.deps.repoPath, oracle);
+      const { exitCode, output, report } = await this.deps.run(this.deps.repoPath, oracle);
       const logLine = `Oracle run for ${oracle.path} exited ${exitCode}:
 ${output}`;
       if (exitCode === 0) {
-        log.info(TAG4, logLine);
+        log.info(TAG5, logLine);
       } else {
-        log.warn(TAG4, logLine);
+        log.warn(TAG5, logLine);
       }
-      return {
-        result: exitCode === 0 ? "passed" : "failed",
-        structured: {
-          oracle: {
-            exitCode,
-            path: oracle.path,
-            ...identity,
-            output: "withheld — oracle_passed is a secrecy gate; see the motor's local log"
-          }
-        }
-      };
+      return this.verdict({
+        oracle,
+        identity,
+        exitCode,
+        output,
+        report: report ?? null
+      });
     } catch (err) {
       const message = errText(err);
-      log.warn(TAG4, `Oracle run threw: ${message} — blocked`);
+      log.warn(TAG5, `Oracle run threw: ${message} — blocked`);
       return {
         result: "blocked",
         structured: {
@@ -1613,16 +1949,74 @@ ${output}`;
       await this.deps.remove(this.deps.repoPath, oracle);
       return;
     } catch (err) {
-      log.warn(TAG4, `Removing the held test at ${oracle.path} failed (${errText(err)}) — retrying once`);
+      log.warn(TAG5, `Removing the held test at ${oracle.path} failed (${errText(err)}) — retrying once`);
     }
     try {
       await this.deps.remove(this.deps.repoPath, oracle);
-      log.info(TAG4, `Held test at ${oracle.path} removed on the second attempt`);
+      log.info(TAG5, `Held test at ${oracle.path} removed on the second attempt`);
     } catch (err) {
-      log.error(TAG4, `HELD TEST NOT REMOVED: ${oracle.path} is still in ${this.deps.repoPath} after two attempts (${errText(err)}). ` + "It will be auto-committed by the completion path if it is left there — delete it by hand and check whether it reached a commit.");
+      log.error(TAG5, `HELD TEST NOT REMOVED: ${oracle.path} is still in ${this.deps.repoPath} after two attempts (${errText(err)}). ` + "It will be auto-committed by the completion path if it is left there — delete it by hand and check whether it reached a commit.");
     }
   }
 }
+
+class OracleCollector extends HeldOracleCollector {
+  kind = "oracle_passed";
+  oracleStageId(context) {
+    return context.stageId;
+  }
+  verdict({
+    oracle,
+    identity,
+    exitCode
+  }) {
+    return {
+      result: exitCode === 0 ? "passed" : "failed",
+      structured: {
+        oracle: {
+          exitCode,
+          path: oracle.path,
+          ...identity,
+          output: "withheld — oracle_passed is a secrecy gate; see the motor's local log"
+        }
+      }
+    };
+  }
+}
+
+class OracleRedCollector extends HeldOracleCollector {
+  kind = "oracle_red";
+  oracleStageId() {
+    return this.deps.targetStageId ?? null;
+  }
+  verdict({
+    oracle,
+    identity,
+    exitCode,
+    report
+  }) {
+    const graded = gradeOracleRed(report, exitCode);
+    const base = { exitCode, path: oracle.path, ...identity };
+    if (graded.outcome === "no_verdict") {
+      log.warn(TAG5, `Red gate for ${oracle.path}: ${graded.reason} — blocked`);
+      return {
+        result: "blocked",
+        structured: { oracle: base, reason: graded.reason }
+      };
+    }
+    return {
+      result: graded.outcome === "reproduced" ? "passed" : "failed",
+      structured: {
+        oracle: {
+          ...base,
+          testsRun: graded.summary.total,
+          testsFailed: graded.summary.failed,
+          output: "withheld — oracle_red is a secrecy gate; see the motor's local log"
+        }
+      }
+    };
+  }
+}
 function errText(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1635,7 +2029,7 @@ import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_proce
 init_log();
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
-var TAG5 = "pm";
+var TAG6 = "pm";
 var cached = null;
 function detectPackageManager() {
   if (cached)
@@ -1657,20 +2051,21 @@ function detectPackageManager() {
   } else {
     cached = "npm";
   }
-  log.info(TAG5, `Detected package manager: ${cached}`);
+  log.info(TAG6, `Detected package manager: ${cached}`);
   return cached;
 }
-function installCommand() {
+function installCommand(ignoreScripts = false) {
   const pm = detectPackageManager();
+  const skip = ignoreScripts ? " --ignore-scripts" : "";
   switch (pm) {
     case "bun":
-      return "bun install --frozen-lockfile";
+      return `bun install --frozen-lockfile${skip}`;
     case "pnpm":
-      return "pnpm install --frozen-lockfile";
+      return `pnpm install --frozen-lockfile${skip}`;
     case "yarn":
-      return "yarn install --frozen-lockfile";
+      return `yarn install --frozen-lockfile${skip}`;
     case "npm":
-      return "npm ci";
+      return `npm ci${skip}`;
   }
 }
 function spawnRunArgs(script, ...extra) {
@@ -1684,8 +2079,8 @@ function spawnRunArgs(script, ...extra) {
 // src/project-type.ts
 init_log();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync2, readdirSync, readFileSync } from "node:fs";
-var TAG6 = "project-type";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
+var TAG7 = "project-type";
 var _cache = new Map;
 function _resetCache() {
   _cache.clear();
@@ -1696,7 +2091,7 @@ function detect(dir) {
     return cached2;
   const result = detectUncached(dir);
   _cache.set(dir, result);
-  log.info(TAG6, `Detected project type in ${dir}: ${result.kind}`);
+  log.info(TAG7, `Detected project type in ${dir}: ${result.kind}`);
   return result;
 }
 function detectUncached(dir) {
@@ -1787,16 +2182,16 @@ var NPM_PLACEHOLDER_TEST = /no test specified/i;
 function hasNodeTestScript(dir) {
   let script;
   try {
-    const pkg = JSON.parse(readFileSync(`${dir}/package.json`, "utf-8"));
+    const pkg = JSON.parse(readFileSync2(`${dir}/package.json`, "utf-8"));
     script = pkg.scripts?.test;
   } catch (err) {
-    log.warn(TAG6, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG7, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
     return false;
   }
   if (typeof script !== "string" || script.trim().length === 0)
     return false;
   if (NPM_PLACEHOLDER_TEST.test(script)) {
-    log.info(TAG6, `package.json 'test' is the npm placeholder — skipping tests`);
+    log.info(TAG7, `package.json 'test' is the npm placeholder — skipping tests`);
     return false;
   }
   return true;
@@ -1804,10 +2199,10 @@ function hasNodeTestScript(dir) {
 function firstNodeScript(dir, candidates) {
   let scripts;
   try {
-    const pkg = JSON.parse(readFileSync(`${dir}/package.json`, "utf-8"));
+    const pkg = JSON.parse(readFileSync2(`${dir}/package.json`, "utf-8"));
     scripts = pkg.scripts ?? {};
   } catch (err) {
-    log.warn(TAG6, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG7, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
     return null;
   }
   for (const name of candidates) {
@@ -1826,7 +2221,7 @@ function xcodeBuildCommand(pt) {
     return null;
   const scheme = resolveXcodeScheme(pt);
   if (!scheme) {
-    log.warn(TAG6, "Could not resolve an Xcode scheme — skipping build (best-effort)");
+    log.warn(TAG7, "Could not resolve an Xcode scheme — skipping build (best-effort)");
     return null;
   }
   const containerFlag = pt.xcodeIsWorkspace ? "-workspace" : "-project";
@@ -1854,7 +2249,7 @@ function resolveXcodeScheme(pt) {
     const schemes = pt.xcodeIsWorkspace ? parsed.workspace?.schemes ?? [] : parsed.project?.schemes ?? [];
     return schemes[0] ?? null;
   } catch (err) {
-    log.warn(TAG6, `xcodebuild -list failed: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG7, `xcodebuild -list failed: ${err instanceof Error ? err.message : err}`);
     return null;
   }
 }
@@ -1862,7 +2257,7 @@ function resolveXcodeScheme(pt) {
 // src/revert-guard.ts
 init_log();
 import { execFileSync as execFileSync3 } from "node:child_process";
-var TAG7 = "revert-guard";
+var TAG8 = "revert-guard";
 var TEST_FILE = /(?:^|\/)__tests__\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
 function isTestFile(path) {
   return TEST_FILE.test(path);
@@ -1877,7 +2272,7 @@ function refetchBase(worktreePath, baseBranch) {
       stdio: "pipe"
     });
   } catch {
-    log.warn(TAG7, "Failed to re-fetch base for revert guard — using last fetch");
+    log.warn(TAG8, "Failed to re-fetch base for revert guard — using last fetch");
   }
 }
 function listDeletedFilesAgainstBase(worktreePath, baseBranch) {
@@ -1886,7 +2281,7 @@ function listDeletedFilesAgainstBase(worktreePath, baseBranch) {
     return out.split(`
 `).map((l) => l.trim()).filter((l) => l.length > 0);
   } catch (err) {
-    log.warn(TAG7, `Failed to list deleted files: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG8, `Failed to list deleted files: ${err instanceof Error ? err.message : err}`);
     return [];
   }
 }
@@ -1896,7 +2291,7 @@ function findDeletedTestFiles(worktreePath, baseBranch) {
 }
 
 // src/verification.ts
-var TAG8 = "verification";
+var TAG9 = "verification";
 var MAX_OUTPUT_BUFFER2 = 64 * 1024 * 1024;
 async function runVerification(worktreePath, config, workerId) {
   const result = {
@@ -1908,52 +2303,52 @@ async function runVerification(worktreePath, config, workerId) {
     revertWarnings: []
   };
   if (config.verification.revertGuard) {
-    log.info(TAG8, `[worker:${workerId}] Checking for reverted merged work...`);
+    log.info(TAG9, `[worker:${workerId}] Checking for reverted merged work...`);
     const deletedTests = findDeletedTestFiles(worktreePath, config.worktree.baseBranch);
     if (deletedTests.length > 0) {
       result.revertWarnings = deletedTests.map((f) => `Branch deletes test file '${f}' relative to current ${config.worktree.baseBranch} — ` + "likely an accidental revert of already-merged work. Restore the test or rebase on current main.");
-      log.warn(TAG8, `[worker:${workerId}] Revert guard tripped: ${deletedTests.length} deleted test file(s)`);
+      log.warn(TAG9, `[worker:${workerId}] Revert guard tripped: ${deletedTests.length} deleted test file(s)`);
       result.passed = false;
     } else {
-      log.info(TAG8, `[worker:${workerId}] Revert guard passed`);
+      log.info(TAG9, `[worker:${workerId}] Revert guard passed`);
     }
   }
   if (config.verification.build) {
-    log.info(TAG8, `[worker:${workerId}] Running build...`);
+    log.info(TAG9, `[worker:${workerId}] Running build...`);
     result.buildErrors = runBuild(worktreePath, config.verification.timeout);
     if (result.buildErrors.length > 0) {
-      log.warn(TAG8, `[worker:${workerId}] Build failed with ${result.buildErrors.length} error(s)`);
+      log.warn(TAG9, `[worker:${workerId}] Build failed with ${result.buildErrors.length} error(s)`);
       result.passed = false;
     } else {
-      log.info(TAG8, `[worker:${workerId}] Build passed`);
+      log.info(TAG9, `[worker:${workerId}] Build passed`);
     }
   }
   if (config.verification.test && result.buildErrors.length === 0) {
-    log.info(TAG8, `[worker:${workerId}] Running tests...`);
+    log.info(TAG9, `[worker:${workerId}] Running tests...`);
     result.testFailures = runTests(worktreePath, config.verification.testTimeout);
     if (result.testFailures.length > 0) {
-      log.warn(TAG8, `[worker:${workerId}] Tests failed with ${result.testFailures.length} failure(s)`);
+      log.warn(TAG9, `[worker:${workerId}] Tests failed with ${result.testFailures.length} failure(s)`);
       result.passed = false;
     } else {
-      log.info(TAG8, `[worker:${workerId}] Tests passed`);
+      log.info(TAG9, `[worker:${workerId}] Tests passed`);
     }
   }
   if (config.verification.lint) {
-    log.info(TAG8, `[worker:${workerId}] Running lint...`);
+    log.info(TAG9, `[worker:${workerId}] Running lint...`);
     result.lintWarnings = runLint(worktreePath, config.verification.timeout);
     if (result.lintWarnings.length > 0) {
-      log.warn(TAG8, `[worker:${workerId}] Lint found ${result.lintWarnings.length} issue(s)`);
+      log.warn(TAG9, `[worker:${workerId}] Lint found ${result.lintWarnings.length} issue(s)`);
     } else {
-      log.info(TAG8, `[worker:${workerId}] Lint passed`);
+      log.info(TAG9, `[worker:${workerId}] Lint passed`);
     }
   }
   if (config.verification.deepReview) {
-    log.info(TAG8, `[worker:${workerId}] Running deep review...`);
+    log.info(TAG9, `[worker:${workerId}] Running deep review...`);
     result.reviewFindings = await runDeepReview(worktreePath, config, workerId);
     if (result.reviewFindings.length > 0) {
-      log.warn(TAG8, `[worker:${workerId}] Deep review found ${result.reviewFindings.length} finding(s)`);
+      log.warn(TAG9, `[worker:${workerId}] Deep review found ${result.reviewFindings.length} finding(s)`);
     } else {
-      log.info(TAG8, `[worker:${workerId}] Deep review passed`);
+      log.info(TAG9, `[worker:${workerId}] Deep review passed`);
     }
   }
   return result;
@@ -1961,7 +2356,7 @@ async function runVerification(worktreePath, config, workerId) {
 function runBuild(worktreePath, timeout) {
   const command = buildCommand(worktreePath);
   if (!command) {
-    log.warn(TAG8, `No known build toolchain for ${worktreePath} — skipping build`);
+    log.warn(TAG9, `No known build toolchain for ${worktreePath} — skipping build`);
     return [];
   }
   try {
@@ -1979,7 +2374,7 @@ function runBuild(worktreePath, timeout) {
 function runTests(worktreePath, timeout) {
   const command = testCommand(worktreePath);
   if (!command) {
-    log.warn(TAG8, `No test command for detected toolchain in ${worktreePath} — skipping tests`);
+    log.warn(TAG9, `No test command for detected toolchain in ${worktreePath} — skipping tests`);
     return [];
   }
   try {
@@ -1992,7 +2387,7 @@ function runTests(worktreePath, timeout) {
     return [];
   } catch (err) {
     const output = combineOutput(err);
-    log.warn(TAG8, `Test run failed:
+    log.warn(TAG9, `Test run failed:
 ${output.slice(-4000) || "(no output captured)"}`);
     return parseTestFailures(err, timeout);
   }
@@ -2008,15 +2403,15 @@ function runFormatFix(worktreePath, timeout, workerId) {
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER2
     });
-    log.info(TAG8, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
+    log.info(TAG9, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
   } catch (err) {
-    log.warn(TAG8, `[worker:${workerId}] Auto-format step exited non-zero (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+    log.warn(TAG9, `[worker:${workerId}] Auto-format step exited non-zero (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function runLint(worktreePath, timeout) {
   const command = lintCommand(worktreePath);
   if (!command) {
-    log.info(TAG8, `No lint step for detected toolchain in ${worktreePath} — skipping lint`);
+    log.info(TAG9, `No lint step for detected toolchain in ${worktreePath} — skipping lint`);
     return [];
   }
   try {
@@ -2033,7 +2428,7 @@ function runLint(worktreePath, timeout) {
 }
 async function runDeepReview(worktreePath, config, workerId) {
   if (!supportsDevServer(worktreePath)) {
-    log.info(TAG8, `[worker:${workerId}] Detected non-web toolchain — skipping deep review`);
+    log.info(TAG9, `[worker:${workerId}] Detected non-web toolchain — skipping deep review`);
     return [];
   }
   const port = config.verification.devServerBasePort + workerId;
@@ -2048,7 +2443,7 @@ async function runDeepReview(worktreePath, config, workerId) {
       await waitForDevServer(devServer, 30000);
       await probeDevServer(port);
     } catch (err) {
-      log.error(TAG8, `Dev server did not become ready: ${err instanceof Error ? err.message : err}`);
+      log.error(TAG9, `Dev server did not become ready: ${err instanceof Error ? err.message : err}`);
       return [];
     }
     let diff = "";
@@ -2093,7 +2488,7 @@ async function runDeepReview(worktreePath, config, workerId) {
     });
     return parseReviewFindings(output);
   } catch (err) {
-    log.error(TAG8, `Deep review failed: ${err instanceof Error ? err.message : err}`);
+    log.error(TAG9, `Deep review failed: ${err instanceof Error ? err.message : err}`);
     return [];
   } finally {
     if (devServer && !devServer.killed) {
@@ -2132,7 +2527,7 @@ function attemptAutoFix(worktreePath, config, errors) {
     "--",
     fixPrompt
   ];
-  log.info(TAG8, "Spawning Claude for auto-fix...");
+  log.info(TAG9, "Spawning Claude for auto-fix...");
   execFileSync4("claude", args, {
     cwd: worktreePath,
     timeout: config.verification.timeout,
@@ -2170,7 +2565,7 @@ async function reportFindings(client, cardId, result, recovery) {
     try {
       await client.createSubtask(cardId, title);
     } catch (err) {
-      log.error(TAG8, `Failed to create subtask: ${err instanceof Error ? err.message : err}`);
+      log.error(TAG9, `Failed to create subtask: ${err instanceof Error ? err.message : err}`);
     }
   }));
   if (overflow > 0) {
@@ -2178,7 +2573,7 @@ async function reportFindings(client, cardId, result, recovery) {
       await client.createSubtask(cardId, `...and ${overflow} more issues`);
     } catch {}
   }
-  log.info(TAG8, `Reported ${Math.min(items.length, maxSubtasks)} finding(s) as subtasks on card ${cardId}`);
+  log.info(TAG9, `Reported ${Math.min(items.length, maxSubtasks)} finding(s) as subtasks on card ${cardId}`);
 }
 function combineOutput(err) {
   const stderr = err?.stderr?.toString() ?? "";
@@ -2238,7 +2633,7 @@ class DevServerReadinessError extends Error {
   }
 }
 function waitForDevServer(proc, timeout) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const cleanup = () => {
       proc.stdout?.off("data", onData);
@@ -2252,7 +2647,7 @@ function waitForDevServer(proc, timeout) {
         return;
       settled = true;
       cleanup();
-      resolve();
+      resolve2();
     };
     const settleReject = (err) => {
       if (settled)
@@ -2302,7 +2697,7 @@ async function probeDevServer(port, timeoutMs = 5000) {
 }
 
 // src/gate-collectors.ts
-var TAG9 = "gate-collectors";
+var TAG10 = "gate-collectors";
 async function resolveStageGate(client, card) {
   const currentStage = card.current_stage;
   const playbookId = card.playbook_id;
@@ -2320,7 +2715,7 @@ async function resolveStageGate(client, card) {
       return null;
     return { stage: resolution.stage, gate };
   } catch (err) {
-    log.warn(TAG9, `resolveStageGate failed for stage "${currentStage}": ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG10, `resolveStageGate failed for stage "${currentStage}": ${err instanceof Error ? err.message : err}`);
     return null;
   }
 }
@@ -2445,13 +2840,14 @@ function buildGateCollectorRegistry(deps) {
   }
   if (deps.oracle) {
     registry.oracle_passed = new OracleCollector(deps.oracle);
+    registry.oracle_red = new OracleRedCollector(deps.oracle);
   }
   return registry;
 }
 async function collectGateEvidence(registry, context) {
   const collector = registry[context.gate.kind];
   if (!collector) {
-    log.info(TAG9, `No collector for gate kind "${context.gate.kind}" — reporting blocked`);
+    log.info(TAG10, `No collector for gate kind "${context.gate.kind}" — reporting blocked`);
     return {
       result: "blocked",
       structured: {
@@ -2463,14 +2859,14 @@ async function collectGateEvidence(registry, context) {
     return await collector.collect(context);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log.warn(TAG9, `Collector for "${context.gate.kind}" threw: ${msg} — reporting blocked`);
+    log.warn(TAG10, `Collector for "${context.gate.kind}" threw: ${msg} — reporting blocked`);
     return { result: "blocked", structured: { error: msg } };
   }
 }
 
 // src/harmony-client.ts
 init_log();
-var TAG10 = "harmony-client";
+var TAG11 = "harmony-client";
 function readClientConfig(env) {
   const apiUrl = env.HARMONY_API_URL?.trim();
   const apiKey = env.HARMONY_API_KEY?.trim();
@@ -2522,7 +2918,7 @@ class HarmonyClient {
       purpose: "gate_evaluation"
     });
     if (!response.ok) {
-      log.warn(TAG10, `Oracle fetch for stage ${stageId} returned ${response.status} — no oracle read, the gate will report blocked`);
+      log.warn(TAG11, `Oracle fetch for stage ${stageId} returned ${response.status} — no oracle read, the gate will report blocked`);
       return null;
     }
     const body = await response.json();
@@ -2603,140 +2999,6 @@ function relayAgentEvent(draft) {
   return { type: "agent_event", event: draft };
 }
 
-// src/oracle.ts
-import { lstat, mkdir, realpath, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, resolve, sep } from "node:path";
-async function resolveContained(repoPath, relativePath) {
-  if (isAbsolute(relativePath)) {
-    throw new Error(`refusing to place an oracle at an absolute path: ${relativePath}`);
-  }
-  if (relativePath === "" || relativePath === ".") {
-    throw new Error(`refusing to place an oracle at the empty/self path: "${relativePath}"`);
-  }
-  const root = await realpath(repoPath);
-  const target = resolve(root, relativePath);
-  if (target !== root && !target.startsWith(root + sep)) {
-    throw new Error(`refusing to place an oracle outside the worktree: ${relativePath}`);
-  }
-  let cursor = root;
-  for (const segment of relativePath.split("/")) {
-    cursor = resolve(cursor, segment);
-    const stat = await lstat(cursor).catch(() => null);
-    if (stat?.isSymbolicLink()) {
-      throw new Error(`refusing an oracle path through a symlink component: ${relativePath}`);
-    }
-  }
-  return target;
-}
-async function place(repoPath, oracle) {
-  const target = await resolveContained(repoPath, oracle.path);
-  await mkdir(dirname(target), { recursive: true });
-  await writeFile(target, oracle.content, "utf8");
-}
-async function remove(repoPath, oracle) {
-  const target = await resolveContained(repoPath, oracle.path);
-  await rm(target, { force: true });
-}
-var ORACLE_RUNNERS = {
-  vitest: (path) => ({
-    command: "npx",
-    args: ["--no-install", "vitest", "run", path]
-  }),
-  bun: (path) => ({ command: "bun", args: ["test", path] })
-};
-var ORACLE_RUNNER_HINTS = Object.keys(ORACLE_RUNNERS).sort();
-var ORACLE_OUTPUT_LIMIT = 64 * 1024;
-var ORACLE_SIGINT_GRACE_MS = 2000;
-var ORACLE_SIGTERM_GRACE_MS = 3000;
-var ORACLE_DRAIN_GRACE_MS = 500;
-function resolveOracleRunner(oracle) {
-  const hint = oracle.runnerHint?.trim().toLowerCase() ?? "";
-  const build = Object.hasOwn(ORACLE_RUNNERS, hint) ? ORACLE_RUNNERS[hint] : undefined;
-  if (!build) {
-    throw new Error(`refusing to run the held test: runner_hint ${JSON.stringify(oracle.runnerHint)} is not in the motor's allow-list (${ORACLE_RUNNER_HINTS.join(", ")})`);
-  }
-  return build(argvPath(oracle.path));
-}
-function argvPath(path) {
-  return path.startsWith("./") ? path : `./${path}`;
-}
-async function runHeldOracle(repoPath, oracle, timeoutMs = DEFAULT_METRIC_TIMEOUT_MS) {
-  const { command, args } = resolveOracleRunner(oracle);
-  return await new Promise((settleOk, settleErr) => {
-    let child;
-    try {
-      child = spawnInGroup(command, args, {
-        cwd: repoPath,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-    } catch (err) {
-      settleErr(err);
-      return;
-    }
-    const pgid = child.pid;
-    let output = "";
-    let settled = false;
-    let killing = false;
-    let timer;
-    let drainTimer;
-    const settle = (failure, result) => {
-      if (settled)
-        return;
-      settled = true;
-      if (timer)
-        clearTimeout(timer);
-      if (drainTimer)
-        clearTimeout(drainTimer);
-      reapGroup(pgid);
-      if (failure)
-        settleErr(failure);
-      else
-        settleOk(result);
-    };
-    const append = (chunk) => {
-      if (output.length >= ORACLE_OUTPUT_LIMIT)
-        return;
-      output += chunk.toString("utf8");
-      if (output.length > ORACLE_OUTPUT_LIMIT) {
-        output = `${output.slice(0, ORACLE_OUTPUT_LIMIT)}
-… output truncated at ${ORACLE_OUTPUT_LIMIT} characters`;
-      }
-    };
-    child.stdout?.on("data", append);
-    child.stderr?.on("data", append);
-    child.once("error", (err) => settle(err));
-    const settleFromExit = (code, signal) => {
-      if (drainTimer)
-        clearTimeout(drainTimer);
-      if (code === null) {
-        settle(new Error(`the held test was terminated by signal ${signal}`));
-        return;
-      }
-      settle(null, { exitCode: code, output });
-    };
-    child.once("exit", (code, signal) => {
-      if (killing)
-        return;
-      if (timer)
-        clearTimeout(timer);
-      reapGroup(pgid);
-      drainTimer = setTimeout(() => settleFromExit(code, signal), ORACLE_DRAIN_GRACE_MS);
-      child.once("close", () => settleFromExit(code, signal));
-    });
-    timer = setTimeout(() => {
-      if (settled)
-        return;
-      killing = true;
-      terminateGroup(child, {
-        sigintTimeoutMs: ORACLE_SIGINT_GRACE_MS,
-        sigtermTimeoutMs: ORACLE_SIGTERM_GRACE_MS
-      }).catch(() => {}).then(() => {
-        settle(new Error(`the held test did not finish within ${timeoutMs}ms`));
-      });
-    }, timeoutMs);
-  });
-}
-
 // src/stage-cli.ts
 init_dist();
 
@@ -2985,7 +3247,7 @@ async function runStage(request, deps) {
 }
 
 // src/cli.ts
-var TAG11 = "cli";
+var TAG12 = "cli";
 var GATE_VERIFICATION_TIMEOUT_MS = 600000;
 var SHUTDOWN_HARD_EXIT_MS = 15000;
 var activeRunner = null;
@@ -3016,12 +3278,12 @@ async function runRole(request, prompt, emit2) {
   });
   const runner = new SdkAgentRunner(launch.config);
   activeRunner = runner;
-  log.info(TAG11, `Running stage ${request.stageId} as role ${launch.role ?? "(none — fail-closed)"}`);
+  log.info(TAG12, `Running stage ${request.stageId} as role ${launch.role ?? "(none — fail-closed)"}`);
   const timeoutMs = stageTimeoutMs(process.env);
   let timedOut = false;
   const clock = timeoutMs > 0 ? setTimeout(() => {
     timedOut = true;
-    log.warn(TAG11, `stage ${request.stageId} exceeded ${timeoutMs}ms — stopping the subagent`);
+    log.warn(TAG12, `stage ${request.stageId} exceeded ${timeoutMs}ms — stopping the subagent`);
     runner.stop("timeout");
   }, timeoutMs) : null;
   clock?.unref?.();
@@ -3037,9 +3299,9 @@ async function runRole(request, prompt, emit2) {
       if (relayed)
         emit2(relayed);
       if (event.kind === "error") {
-        log.warn(TAG11, `subagent error: ${event.payload.message}`);
+        log.warn(TAG12, `subagent error: ${event.payload.message}`);
       } else {
-        log.event(TAG11, `subagent ${event.kind}`);
+        log.event(TAG12, `subagent ${event.kind}`);
       }
     }
   } finally {
@@ -3070,8 +3332,8 @@ ${STAGE_RUN_USAGE}
   const { cardId, stageId, workspaceId, repoPath, sessionId, metricsPath } = parsed.args;
   let driverMetrics = {};
   if (metricsPath !== null) {
-    const { readFileSync: readFileSync2 } = await import("node:fs");
-    driverMetrics = parseMetricsAllowlist(readFileSync2(metricsPath, "utf8"), metricsPath);
+    const { readFileSync: readFileSync3 } = await import("node:fs");
+    driverMetrics = parseMetricsAllowlist(readFileSync3(metricsPath, "utf8"), metricsPath);
   }
   const client = new HarmonyClient(readClientConfig(process.env));
   const card = await client.fetchStageCard(cardId);
@@ -3085,12 +3347,13 @@ ${STAGE_RUN_USAGE}
     throw new Error(`refusing to run stage "${stageId}" for card ${cardId}: ${pinned.reason}`);
   }
   assertStageIsAgentRunnable(pinned.stage);
+  const oracleTargetStageId = findOracleTargetStage(version, stageId);
   const prompt = buildStagePrompt({
     cardId,
     stageId,
     stage: pinned.stage,
     sessionId,
-    oracleTargetStageId: findOracleTargetStage(version, stageId)
+    oracleTargetStageId
   });
   const request = {
     cardId,
@@ -3118,6 +3381,7 @@ ${STAGE_RUN_USAGE}
         oracle: {
           repoPath: req.repoPath,
           sessionId: req.sessionId,
+          targetStageId: oracleTargetStageId,
           fetchOracle: (oracleCardId, oracleStageId, oracleSessionId) => client.fetchOracle(oracleCardId, oracleStageId, oracleSessionId),
           place,
           remove,