@ikon85/agent-workflow-kit 0.32.1 → 0.33.0

package/scripts/test_worktree_setup_base_guard.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Worktree reuse must refuse a stale base on BOTH reuse paths.
+
+`setup.py create()` can reach an existing worktree two ways: the target is
+already a registered worktree, or only its branch exists locally and
+`git worktree add <target> <branch>` silently ignores `--base`. Reuse is safe
+only when the reused HEAD is AT the base or cleanly behind it (fast-forwardable);
+anything ahead or diverged builds the slice on a stale base and must STOP.
+"""
+
+import importlib.util
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from argparse import Namespace
+from contextlib import contextmanager
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+LIFECYCLE = REPO / "scripts/worktree-lifecycle"
+
+PROFILE = """{
+  "worktreeLifecycle": {
+    "enabled": true,
+    "worktreeRoot": ".worktrees",
+    "branchTemplate": "{type}/{issue}-{slug}",
+    "pathTemplate": "{issue}-{slug}",
+    "setupSteps": []
+  }
+}
+"""
+
+
+def load_setup():
+    sys.path.insert(0, str(LIFECYCLE))
+    try:
+        spec = importlib.util.spec_from_file_location(
+            "worktree_setup_base_guard", LIFECYCLE / "setup.py"
+        )
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        return module
+    finally:
+        sys.path.remove(str(LIFECYCLE))
+
+
+def git(repo: Path, *args: str) -> str:
+    result = subprocess.run(
+        ["git", *args], cwd=repo, capture_output=True, text=True, check=True
+    )
+    return result.stdout.strip()
+
+
+@contextmanager
+def fixture():
+    """A repo whose `main` carries two commits: base_first, then head."""
+    with tempfile.TemporaryDirectory() as tmp:
+        repo = Path(tmp).resolve() / "repo"
+        repo.mkdir()
+        git(repo, "init", "--initial-branch=main")
+        git(repo, "config", "user.email", "test@example.invalid")
+        git(repo, "config", "user.name", "Test User")
+        profile = repo / "docs/agents/workflow-capabilities.json"
+        profile.parent.mkdir(parents=True)
+        profile.write_text(PROFILE, encoding="utf-8")
+        (repo / "README.md").write_text("# fixture\n", encoding="utf-8")
+        git(repo, "add", "-A")
+        git(repo, "commit", "-m", "first")
+        first = git(repo, "rev-parse", "HEAD")
+        (repo / "README.md").write_text("# fixture 2\n", encoding="utf-8")
+        git(repo, "commit", "-am", "second")
+        second = git(repo, "rev-parse", "HEAD")
+        yield repo, first, second
+
+
+@contextmanager
+def chdir(path: Path):
+    previous = Path.cwd()
+    os.chdir(path)
+    try:
+        yield
+    finally:
+        os.chdir(previous)
+
+
+def args_for(base: str) -> Namespace:
+    return Namespace(
+        profile="docs/agents/workflow-capabilities.json",
+        base=base,
+        issue="173",
+        slug="wave-safety",
+        branch_type="feat",
+    )
+
+
+class WorktreeReuseBaseGuard(unittest.TestCase):
+    def test_registered_worktree_reuse_stops_when_head_is_not_at_base(self):
+        setup = load_setup()
+        with fixture() as (repo, first, second):
+            target = repo / ".worktrees/173-wave-safety"
+            git(repo, "worktree", "add", "-b", "feat/173-wave-safety", str(target), second)
+            # base is the OLDER commit -> the registered worktree is ahead of it.
+            with chdir(repo):
+                with self.assertRaises(setup.LifecycleError) as stopped:
+                    setup.create(args_for(first))
+        self.assertIn("stale", str(stopped.exception).lower())
+
+    def test_existing_branch_reuse_stops_when_branch_is_not_at_base(self):
+        setup = load_setup()
+        with fixture() as (repo, first, second):
+            git(repo, "branch", "feat/173-wave-safety", second)
+            target = repo / ".worktrees/173-wave-safety"
+            with chdir(repo):
+                with self.assertRaises(setup.LifecycleError) as stopped:
+                    setup.create(args_for(first))
+        self.assertIn("stale", str(stopped.exception).lower())
+        self.assertFalse(target.exists(), "no worktree may be created on a stale base")
+
+    def test_registered_worktree_reuse_allows_head_at_base(self):
+        setup = load_setup()
+        with fixture() as (repo, _first, second):
+            target = repo / ".worktrees/173-wave-safety"
+            git(repo, "worktree", "add", "-b", "feat/173-wave-safety", str(target), second)
+            with chdir(repo):
+                self.assertEqual(setup.create(args_for(second)).resolve(), target.resolve())
+
+    def test_existing_branch_reuse_allows_a_branch_cleanly_behind_base(self):
+        setup = load_setup()
+        with fixture() as (repo, first, second):
+            git(repo, "branch", "feat/173-wave-safety", first)
+            target = repo / ".worktrees/173-wave-safety"
+            with chdir(repo):
+                self.assertEqual(setup.create(args_for(second)).resolve(), target.resolve())
+            self.assertTrue(target.is_dir())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/scripts/worktree-lifecycle/setup.py

@@ -84,6 +84,39 @@ def execute_step(
     raise LifecycleError(f"unsupported setup step kind: {kind!r}")
 
 
+def commit_oid(repo: Path, rev: str) -> str | None:
+    result = run(["git", "rev-parse", "--verify", f"{rev}^{{commit}}"], cwd=repo, check=False)
+    return result.stdout.strip() if result.returncode == 0 else None
+
+
+def ensure_reusable_base(main: Path, *, repo: Path, rev: str, base: str, label: str) -> None:
+    """Reuse is safe only AT the base or cleanly behind it; anything else is stale.
+
+    Both reuse paths skip `git worktree add`'s base argument, so without this
+    guard a slice silently builds on whatever the old branch/worktree pointed at.
+    """
+    base_oid = commit_oid(main, base)
+    if base_oid is None:
+        raise LifecycleError(f"base {base!r} is not resolvable")
+    current = commit_oid(repo, rev)
+    if current is None:
+        raise LifecycleError(f"{label}: HEAD is not resolvable")
+    if current == base_oid:
+        return
+    behind = run(
+        ["git", "merge-base", "--is-ancestor", current, base_oid],
+        cwd=main,
+        check=False,
+    )
+    if behind.returncode == 0:
+        return
+    raise LifecycleError(
+        f"{label}: HEAD {current[:7]} is stale against base {base} ({base_oid[:7]}) — "
+        "it is ahead of or diverged from the base. Land or rebase that work, or remove "
+        "the worktree/branch, before reusing it."
+    )
+
+
 def remove_failed_worktree(main: Path, target: Path, branch: str, created_branch: bool) -> None:
     run(["git", "worktree", "remove", "--force", str(target)], cwd=main, check=False)
     if created_branch:
@@ -101,10 +134,17 @@ def create(args: argparse.Namespace) -> Path:
     target = (main / profile.relative_path(args.issue, args.slug, args.branch_type)).resolve()
 
     if target in registered_worktrees(main):
+        ensure_reusable_base(
+            main, repo=target, rev="HEAD", base=args.base, label=f"worktree {target}"
+        )
         print(f"Worktree already exists: {target} ({branch})")
         return target
 
     branch_existed = local_branch_exists(main, branch)
+    if branch_existed:
+        ensure_reusable_base(
+            main, repo=main, rev=branch, base=args.base, label=f"branch {branch}"
+        )
     command = ["git", "worktree", "add", str(target)]
     command += [branch] if branch_existed else ["-b", branch, args.base]
     run(command, cwd=main)

package/src/lib/bundle.mjs

@@ -72,6 +72,16 @@ export const HELPER_FILES = [
   { path: 'src/lib/release-preview.mjs', kind: 'script', mode: 0o644 },
   { path: 'src/lib/release-apply.mjs', kind: 'script', mode: 0o644 },
   { path: 'scripts/project-release.mjs', kind: 'script', mode: 0o755 },
+  // Canonical schema and semantic validator shared across orchestration paths.
+  // Library → 0o644; later helper-owning slices append their paths once present.
+  { path: 'src/lib/reportValidator.mjs', kind: 'script', mode: 0o644 },
+  // Fail-closed orchestration selector and its host-inventory adapters.
+  { path: 'src/lib/capabilityMatrix.mjs', kind: 'script', mode: 0o644 },
+  // Main-thread recon boundary shared by every orchestration path.
+  { path: 'src/lib/reconcileReconReports.mjs', kind: 'script', mode: 0o644 },
+  // Atomic compare-and-set wave claim: two sessions cannot orchestrate the same
+  // wave. Library (imported by the Phase-0 claim protocol) → 0o644.
+  { path: 'src/lib/waveClaim.mjs', kind: 'script', mode: 0o644 },
   // GitHub-consumer automation: invokes the existing update command, then owns
   // only the stable tested branch/pull-request upsert.
   { path: 'scripts/kit-update-pr.mjs', kind: 'script', mode: 0o755 },

package/src/lib/capabilityMatrix.mjs

@@ -0,0 +1,94 @@
+const UNKNOWN = 'unknown';
+
+const PATH_A_CAPABILITIES = [
+  'namedPhases',
+  'runIdentity',
+  'runtimeOutputValidation',
+  'journal',
+  'resume',
+];
+
+const PATH_B_TOOLS = [
+  ['spawn_agent', 'spawn'],
+  ['wait_agent', 'wait'],
+  ['list_agents', 'aggregate'],
+];
+
+const TARGETS = Object.freeze({
+  A: Object.freeze({ path: 'A', kind: 'reference', value: 'references/dispatch-workflow.md' }),
+  B: Object.freeze({ path: 'B', kind: 'reference', value: 'references/dispatch-subagents.md' }),
+  C: Object.freeze({ path: 'C', kind: 'inline', value: 'path-c' }),
+});
+
+function triState(value) {
+  return typeof value === 'boolean' ? value : UNKNOWN;
+}
+
+function capacity(value) {
+  return Number.isInteger(value) && value >= 0 ? value : UNKNOWN;
+}
+
+function normalizeTool(tool) {
+  if (!tool || typeof tool !== 'object' || Array.isArray(tool)) return null;
+  return {
+    name: typeof tool.name === 'string' ? tool.name : UNKNOWN,
+    schema: tool.schema && typeof tool.schema === 'object' && !Array.isArray(tool.schema)
+      ? tool.schema
+      : UNKNOWN,
+    callable: triState(tool.callable),
+    permitted: triState(tool.permitted),
+    capabilities: Array.isArray(tool.capabilities)
+      && tool.capabilities.every((item) => typeof item === 'string')
+      ? [...new Set(tool.capabilities)]
+      : UNKNOWN,
+  };
+}
+
+function adaptInventory(inventory) {
+  const source = inventory && typeof inventory === 'object' ? inventory : {};
+  const validContract = source.contractVersion === 1;
+  return {
+    contractVersion: 1,
+    tools: validContract && Array.isArray(source.tools)
+      ? source.tools.map(normalizeTool).filter(Boolean)
+      : [],
+    effectiveConcurrency: validContract ? capacity(source.effectiveConcurrency) : UNKNOWN,
+    threadCapacity: validContract ? capacity(source.threadCapacity) : UNKNOWN,
+  };
+}
+
+export const capabilityAdapter = Object.freeze({
+  claude: adaptInventory,
+  codex: adaptInventory,
+});
+
+function proves(tool, capability) {
+  return tool?.callable === true
+    && tool.permitted === true
+    && tool.schema !== UNKNOWN
+    && Array.isArray(tool.capabilities)
+    && tool.capabilities.includes(capability);
+}
+
+function supportsPathA(inventory) {
+  const workflow = inventory.tools.find(({ name }) => name === 'Workflow');
+  return PATH_A_CAPABILITIES.every((capability) => proves(workflow, capability));
+}
+
+function supportsPathB(inventory) {
+  if (inventory.effectiveConcurrency === UNKNOWN || inventory.effectiveConcurrency < 2) return false;
+  if (inventory.threadCapacity === UNKNOWN || inventory.threadCapacity < 2) return false;
+  return PATH_B_TOOLS.every(([name, capability]) =>
+    inventory.tools.some((tool) => tool.name === name && proves(tool, capability)));
+}
+
+export function classifyCapabilities(inventory) {
+  const normalized = adaptInventory(inventory);
+  if (supportsPathA(normalized)) return 'A';
+  if (supportsPathB(normalized)) return 'B';
+  return 'C';
+}
+
+export function selectOrchestrationReference(inventory) {
+  return TARGETS[classifyCapabilities(inventory)];
+}

package/src/lib/reconcileReconReports.mjs

@@ -0,0 +1,111 @@
+import { validateReconReport } from './reportValidator.mjs';
+
+const byPath = (left, right) => left.path.localeCompare(right.path);
+const bySlice = (left, right) => left.localeCompare(right, 'en', { numeric: true });
+const edgeKey = ({ from, to }) => `${from}:${to}`;
+
+function validateReports(reports) {
+  if (!Array.isArray(reports)) throw new TypeError('recon reports must be an array');
+  const sliceIds = new Set();
+  for (const report of reports) {
+    const validation = validateReconReport(report);
+    if (!validation.ok) throw new Error(`invalid recon report: ${validation.errors.join('; ')}`);
+    if (sliceIds.has(report.sliceId)) throw new Error(`duplicate recon report for slice ${report.sliceId}`);
+    sliceIds.add(report.sliceId);
+  }
+  return sliceIds;
+}
+
+function buildGraph(reports, sliceIds) {
+  const edges = new Map();
+  const successors = new Map([...sliceIds].map((id) => [id, new Set()]));
+  const indegree = new Map([...sliceIds].map((id) => [id, 0]));
+  for (const { dependencyEdges } of reports) {
+    for (const edge of dependencyEdges) {
+      if (!sliceIds.has(edge.from) || !sliceIds.has(edge.to)) {
+        const unknown = !sliceIds.has(edge.from) ? edge.from : edge.to;
+        throw new Error(`dependency edge references unknown slice ${unknown}`);
+      }
+      if (edge.from === edge.to) throw new Error(`self dependency is not allowed for slice ${edge.from}`);
+      if (edges.has(edgeKey(edge))) continue;
+      edges.set(edgeKey(edge), edge);
+      successors.get(edge.from).add(edge.to);
+      indegree.set(edge.to, indegree.get(edge.to) + 1);
+    }
+  }
+  const ready = [...sliceIds].filter((id) => indegree.get(id) === 0).sort(bySlice);
+  const order = [];
+  while (ready.length > 0) {
+    const current = ready.shift();
+    order.push(current);
+    for (const next of [...successors.get(current)].sort(bySlice)) {
+      indegree.set(next, indegree.get(next) - 1);
+      if (indegree.get(next) === 0) ready.push(next);
+    }
+    ready.sort(bySlice);
+  }
+  if (order.length !== sliceIds.size) throw new Error('dependency graph contains a cycle');
+  return { edges: [...edges.values()].sort((a, b) => edgeKey(a).localeCompare(edgeKey(b))), successors, order };
+}
+
+function collectFiles(reports) {
+  const files = new Map();
+  for (const { sliceId, plannedFiles } of reports) {
+    for (const { path, role } of plannedFiles) {
+      const file = files.get(path) ?? { editors: new Set(), shared: false };
+      if (role === 'edit') file.editors.add(sliceId);
+      if (role === 'sharedMutable') file.shared = true;
+      files.set(path, file);
+    }
+  }
+  return files;
+}
+
+function canReach(from, to, successors) {
+  const pending = [...successors.get(from)];
+  const seen = new Set();
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (current === to) return true;
+    if (seen.has(current)) continue;
+    seen.add(current);
+    pending.push(...successors.get(current));
+  }
+  return false;
+}
+
+function orderedEditors(path, file, graph) {
+  const editors = [...file.editors];
+  if (file.shared && editors.length !== 1) {
+    const found = editors.sort(bySlice);
+    throw new Error(`${path} must have exactly one edit owner; found ${found.length ? found.join(', ') : '0'}`);
+  }
+  const position = new Map(graph.order.map((id, index) => [id, index]));
+  editors.sort((left, right) => position.get(left) - position.get(right));
+  for (let left = 0; left < editors.length; left += 1) {
+    for (let right = left + 1; right < editors.length; right += 1) {
+      if (!canReach(editors[left], editors[right], graph.successors)) {
+        throw new Error(`${path} edit owners are not totally ordered by dependencies`);
+      }
+    }
+  }
+  return editors;
+}
+
+/** Reconcile schema-valid per-slice recon reports before any builder dispatch. */
+export function reconcileReconReports(reports) {
+  const sliceIds = validateReports(reports);
+  const graph = buildGraph(reports, sliceIds);
+  const editOwners = [];
+  const overlaps = [];
+  for (const [path, file] of collectFiles(reports)) {
+    const sliceIdsForPath = orderedEditors(path, file, graph);
+    if (sliceIdsForPath.length > 0) editOwners.push({ path, sliceIds: sliceIdsForPath });
+    if (sliceIdsForPath.length > 1) overlaps.push({ path, editors: sliceIdsForPath });
+  }
+  return {
+    editOwners: editOwners.sort(byPath),
+    overlaps: overlaps.sort(byPath),
+    dependencyEdges: graph.edges,
+  };
+}

package/src/lib/reportValidator.mjs

@@ -0,0 +1,186 @@
+const HASH_PATTERN = '^[0-9a-f]{40}$|^[0-9a-f]{64}$';
+
+const stringArray = { type: 'array', items: { type: 'string' } };
+
+export const RECON_REPORT_SCHEMA = {
+  type: 'object',
+  required: ['sliceId', 'plannedFiles', 'dependencyEdges'],
+  additionalProperties: false,
+  properties: {
+    sliceId: { type: 'string', pattern: '^[0-9]+$' },
+    plannedFiles: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['path', 'role'],
+        additionalProperties: false,
+        properties: {
+          path: { type: 'string' },
+          role: { type: 'string', enum: ['edit', 'consume', 'sharedMutable'] },
+        },
+      },
+    },
+    dependencyEdges: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['from', 'to'],
+        additionalProperties: false,
+        properties: {
+          from: { type: 'string', pattern: '^[0-9]+$' },
+          to: { type: 'string', pattern: '^[0-9]+$' },
+        },
+      },
+    },
+  },
+};
+
+export const BUILDER_REPORT_SCHEMA = {
+  type: 'object',
+  required: [
+    'status', 'filesTouched', 'testDecisions', 'commands',
+    'commitSha', 'stopItems', 'visualVerify',
+  ],
+  additionalProperties: false,
+  properties: {
+    status: { type: 'string', enum: ['pass', 'stop'] },
+    filesTouched: stringArray,
+    testDecisions: stringArray,
+    commands: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['command', 'exitCode', 'summary'],
+        additionalProperties: false,
+        properties: {
+          command: { type: 'string' },
+          exitCode: { type: 'integer' },
+          summary: { type: 'string' },
+        },
+      },
+    },
+    commitSha: { anyOf: [{ type: 'string', pattern: HASH_PATTERN }, { type: 'null' }] },
+    stopItems: stringArray,
+    visualVerify: { type: 'string' },
+  },
+  oneOf: [
+    {
+      required: ['status', 'commitSha', 'stopItems'],
+      properties: {
+        status: { const: 'pass' },
+        commitSha: { type: 'string', pattern: HASH_PATTERN },
+        stopItems: { type: 'array', maxItems: 0 },
+      },
+    },
+    {
+      required: ['status', 'commitSha', 'stopItems'],
+      properties: {
+        status: { const: 'stop' },
+        commitSha: { anyOf: [{ type: 'string', pattern: HASH_PATTERN }, { type: 'null' }] },
+        stopItems: { type: 'array', minItems: 1 },
+      },
+    },
+  ],
+};
+
+function valueHasType(value, type) {
+  if (type === 'null') return value === null;
+  if (type === 'array') return Array.isArray(value);
+  if (type === 'object') return value !== null && typeof value === 'object' && !Array.isArray(value);
+  if (type === 'integer') return Number.isInteger(value);
+  return typeof value === type;
+}
+
+function validateCombinators(value, schema, path) {
+  const errors = [];
+  if (schema.anyOf && !schema.anyOf.some((branch) => collectErrors(value, branch, path).length === 0)) {
+    errors.push(`${path} must match at least one allowed schema`);
+  }
+  if (schema.oneOf) {
+    const matches = schema.oneOf.filter((branch) => collectErrors(value, branch, path).length === 0).length;
+    if (matches !== 1) errors.push(`${path} must match exactly one allowed schema`);
+  }
+  return errors;
+}
+
+function validateObject(value, schema, path) {
+  const errors = [];
+  for (const key of schema.required ?? []) {
+    if (!Object.hasOwn(value, key)) errors.push(`${path}.${key} is required`);
+  }
+  if (schema.additionalProperties === false) {
+    for (const key of Object.keys(value)) {
+      if (!Object.hasOwn(schema.properties ?? {}, key)) errors.push(`${path}.${key} is not allowed`);
+    }
+  }
+  for (const [key, childSchema] of Object.entries(schema.properties ?? {})) {
+    if (Object.hasOwn(value, key)) errors.push(...collectErrors(value[key], childSchema, `${path}.${key}`));
+  }
+  return errors;
+}
+
+function collectErrors(value, schema, path = '$') {
+  const errors = validateCombinators(value, schema, path);
+  if (schema.const !== undefined && value !== schema.const) errors.push(`${path} must equal ${schema.const}`);
+  if (schema.enum && !schema.enum.includes(value)) errors.push(`${path} has an unsupported value`);
+  if (schema.type && !valueHasType(value, schema.type)) return [...errors, `${path} must be ${schema.type}`];
+  if (schema.pattern && !new RegExp(schema.pattern).test(value)) errors.push(`${path} has an invalid format`);
+  if (Array.isArray(value)) {
+    if (schema.minItems !== undefined && value.length < schema.minItems) errors.push(`${path} has too few items`);
+    if (schema.maxItems !== undefined && value.length > schema.maxItems) errors.push(`${path} has too many items`);
+    if (schema.items) value.forEach((item, index) => errors.push(...collectErrors(item, schema.items, `${path}[${index}]`)));
+  }
+  if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+    errors.push(...validateObject(value, schema, path));
+  }
+  return errors;
+}
+
+function validateSchema(value, schema) {
+  const errors = collectErrors(value, schema);
+  return { ok: errors.length === 0, errors };
+}
+
+export const validateReconReport = (report) => validateSchema(report, RECON_REPORT_SCHEMA);
+export const validateBuilderReport = (report) => validateSchema(report, BUILDER_REPORT_SCHEMA);
+
+function verifyCommit(report, gitFacts) {
+  if (!['sha1', 'sha256'].includes(gitFacts?.objectFormat)) return ['gitFacts.objectFormat is unsupported'];
+  if (report.commitSha === null) return [];
+  const errors = [];
+  const expectedLength = gitFacts.objectFormat === 'sha1' ? 40 : 64;
+  if (report.commitSha.length !== expectedLength) {
+    errors.push(`commitSha does not match ${gitFacts.objectFormat} object format`);
+  }
+  if (gitFacts.commitSha !== report.commitSha) errors.push('commit SHA does not match independently observed git facts');
+  if (gitFacts.baseIsAncestorOfCommit !== true) {
+    errors.push('integration base is not an ancestor of the builder commit');
+  }
+  return errors;
+}
+
+function verifyFilesAndCommands(report, gitFacts, allowlist, requiredCommands) {
+  const errors = [];
+  if (!Array.isArray(gitFacts?.changedFiles)) errors.push('gitFacts.changedFiles must be an array');
+  else if (gitFacts.changedFiles.some((path) => !allowlist.includes(path))) {
+    errors.push('git diff contains a path outside the allowlist');
+  }
+  const observedCommands = new Set(report.commands.map(({ command }) => command));
+  for (const command of requiredCommands) {
+    if (!observedCommands.has(command)) errors.push(`required command was not reported: ${command}`);
+  }
+  return errors;
+}
+
+export function semanticVerify(report, { gitFacts, allowlist = [], requiredCommands = [] } = {}) {
+  const structural = validateBuilderReport(report);
+  const errors = [...structural.errors];
+  if (structural.ok) {
+    if (report.status === 'pass' && report.commands.some(({ exitCode }) => exitCode !== 0)) {
+      errors.push('PASS report contains a command with a nonzero exit');
+    }
+    errors.push(...verifyCommit(report, gitFacts));
+    errors.push(...verifyFilesAndCommands(report, gitFacts, allowlist, requiredCommands));
+  }
+  return { ok: errors.length === 0, errors };
+}