@ikon85/agent-workflow-kit 0.32.1 → 0.34.0

package/src/lib/reportValidator.mjs

@@ -0,0 +1,186 @@
+const HASH_PATTERN = '^[0-9a-f]{40}$|^[0-9a-f]{64}$';
+
+const stringArray = { type: 'array', items: { type: 'string' } };
+
+export const RECON_REPORT_SCHEMA = {
+  type: 'object',
+  required: ['sliceId', 'plannedFiles', 'dependencyEdges'],
+  additionalProperties: false,
+  properties: {
+    sliceId: { type: 'string', pattern: '^[0-9]+$' },
+    plannedFiles: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['path', 'role'],
+        additionalProperties: false,
+        properties: {
+          path: { type: 'string' },
+          role: { type: 'string', enum: ['edit', 'consume', 'sharedMutable'] },
+        },
+      },
+    },
+    dependencyEdges: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['from', 'to'],
+        additionalProperties: false,
+        properties: {
+          from: { type: 'string', pattern: '^[0-9]+$' },
+          to: { type: 'string', pattern: '^[0-9]+$' },
+        },
+      },
+    },
+  },
+};
+
+export const BUILDER_REPORT_SCHEMA = {
+  type: 'object',
+  required: [
+    'status', 'filesTouched', 'testDecisions', 'commands',
+    'commitSha', 'stopItems', 'visualVerify',
+  ],
+  additionalProperties: false,
+  properties: {
+    status: { type: 'string', enum: ['pass', 'stop'] },
+    filesTouched: stringArray,
+    testDecisions: stringArray,
+    commands: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['command', 'exitCode', 'summary'],
+        additionalProperties: false,
+        properties: {
+          command: { type: 'string' },
+          exitCode: { type: 'integer' },
+          summary: { type: 'string' },
+        },
+      },
+    },
+    commitSha: { anyOf: [{ type: 'string', pattern: HASH_PATTERN }, { type: 'null' }] },
+    stopItems: stringArray,
+    visualVerify: { type: 'string' },
+  },
+  oneOf: [
+    {
+      required: ['status', 'commitSha', 'stopItems'],
+      properties: {
+        status: { const: 'pass' },
+        commitSha: { type: 'string', pattern: HASH_PATTERN },
+        stopItems: { type: 'array', maxItems: 0 },
+      },
+    },
+    {
+      required: ['status', 'commitSha', 'stopItems'],
+      properties: {
+        status: { const: 'stop' },
+        commitSha: { anyOf: [{ type: 'string', pattern: HASH_PATTERN }, { type: 'null' }] },
+        stopItems: { type: 'array', minItems: 1 },
+      },
+    },
+  ],
+};
+
+function valueHasType(value, type) {
+  if (type === 'null') return value === null;
+  if (type === 'array') return Array.isArray(value);
+  if (type === 'object') return value !== null && typeof value === 'object' && !Array.isArray(value);
+  if (type === 'integer') return Number.isInteger(value);
+  return typeof value === type;
+}
+
+function validateCombinators(value, schema, path) {
+  const errors = [];
+  if (schema.anyOf && !schema.anyOf.some((branch) => collectErrors(value, branch, path).length === 0)) {
+    errors.push(`${path} must match at least one allowed schema`);
+  }
+  if (schema.oneOf) {
+    const matches = schema.oneOf.filter((branch) => collectErrors(value, branch, path).length === 0).length;
+    if (matches !== 1) errors.push(`${path} must match exactly one allowed schema`);
+  }
+  return errors;
+}
+
+function validateObject(value, schema, path) {
+  const errors = [];
+  for (const key of schema.required ?? []) {
+    if (!Object.hasOwn(value, key)) errors.push(`${path}.${key} is required`);
+  }
+  if (schema.additionalProperties === false) {
+    for (const key of Object.keys(value)) {
+      if (!Object.hasOwn(schema.properties ?? {}, key)) errors.push(`${path}.${key} is not allowed`);
+    }
+  }
+  for (const [key, childSchema] of Object.entries(schema.properties ?? {})) {
+    if (Object.hasOwn(value, key)) errors.push(...collectErrors(value[key], childSchema, `${path}.${key}`));
+  }
+  return errors;
+}
+
+function collectErrors(value, schema, path = '$') {
+  const errors = validateCombinators(value, schema, path);
+  if (schema.const !== undefined && value !== schema.const) errors.push(`${path} must equal ${schema.const}`);
+  if (schema.enum && !schema.enum.includes(value)) errors.push(`${path} has an unsupported value`);
+  if (schema.type && !valueHasType(value, schema.type)) return [...errors, `${path} must be ${schema.type}`];
+  if (schema.pattern && !new RegExp(schema.pattern).test(value)) errors.push(`${path} has an invalid format`);
+  if (Array.isArray(value)) {
+    if (schema.minItems !== undefined && value.length < schema.minItems) errors.push(`${path} has too few items`);
+    if (schema.maxItems !== undefined && value.length > schema.maxItems) errors.push(`${path} has too many items`);
+    if (schema.items) value.forEach((item, index) => errors.push(...collectErrors(item, schema.items, `${path}[${index}]`)));
+  }
+  if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+    errors.push(...validateObject(value, schema, path));
+  }
+  return errors;
+}
+
+function validateSchema(value, schema) {
+  const errors = collectErrors(value, schema);
+  return { ok: errors.length === 0, errors };
+}
+
+export const validateReconReport = (report) => validateSchema(report, RECON_REPORT_SCHEMA);
+export const validateBuilderReport = (report) => validateSchema(report, BUILDER_REPORT_SCHEMA);
+
+function verifyCommit(report, gitFacts) {
+  if (!['sha1', 'sha256'].includes(gitFacts?.objectFormat)) return ['gitFacts.objectFormat is unsupported'];
+  if (report.commitSha === null) return [];
+  const errors = [];
+  const expectedLength = gitFacts.objectFormat === 'sha1' ? 40 : 64;
+  if (report.commitSha.length !== expectedLength) {
+    errors.push(`commitSha does not match ${gitFacts.objectFormat} object format`);
+  }
+  if (gitFacts.commitSha !== report.commitSha) errors.push('commit SHA does not match independently observed git facts');
+  if (gitFacts.baseIsAncestorOfCommit !== true) {
+    errors.push('integration base is not an ancestor of the builder commit');
+  }
+  return errors;
+}
+
+function verifyFilesAndCommands(report, gitFacts, allowlist, requiredCommands) {
+  const errors = [];
+  if (!Array.isArray(gitFacts?.changedFiles)) errors.push('gitFacts.changedFiles must be an array');
+  else if (gitFacts.changedFiles.some((path) => !allowlist.includes(path))) {
+    errors.push('git diff contains a path outside the allowlist');
+  }
+  const observedCommands = new Set(report.commands.map(({ command }) => command));
+  for (const command of requiredCommands) {
+    if (!observedCommands.has(command)) errors.push(`required command was not reported: ${command}`);
+  }
+  return errors;
+}
+
+export function semanticVerify(report, { gitFacts, allowlist = [], requiredCommands = [] } = {}) {
+  const structural = validateBuilderReport(report);
+  const errors = [...structural.errors];
+  if (structural.ok) {
+    if (report.status === 'pass' && report.commands.some(({ exitCode }) => exitCode !== 0)) {
+      errors.push('PASS report contains a command with a nonzero exit');
+    }
+    errors.push(...verifyCommit(report, gitFacts));
+    errors.push(...verifyFilesAndCommands(report, gitFacts, allowlist, requiredCommands));
+  }
+  return { ok: errors.length === 0, errors };
+}

package/src/lib/routeDispatcher.mjs

@@ -0,0 +1,158 @@
+import { createDispatchReceipt } from './dispatchReceipt.mjs';
+import { resolveRoute } from './routingResolver.mjs';
+import {
+  assertRoutingProfileUnchanged,
+  captureRoutingProfileSnapshot,
+} from './routingEvidenceCache.mjs';
+
+const RECEIPT_ROUTE_FIELDS = [
+  'providerId',
+  'modelId',
+  'effort',
+  'surfaceId',
+  'transportId',
+];
+
+function receiptRoute(route) {
+  return Object.fromEntries(RECEIPT_ROUTE_FIELDS.map((field) => [field, route[field]]));
+}
+
+function receiptRevisions(decision) {
+  return Object.fromEntries(
+    ['catalog', 'accessGraph', 'policy'].map((field) => [
+      field,
+      decision.revisions[field] ?? 'missing',
+    ]),
+  );
+}
+
+function blockedReceipt(input, decision, reason, details = {}) {
+  return createDispatchReceipt({
+    executionId: input.executionId,
+    status: 'blocked',
+    afk: input.afk,
+    requestedRoute: details.requestedRoute ?? null,
+    appliedRoute: details.appliedRoute ?? null,
+    enforcement: details.enforcement ?? null,
+    precedence: details.precedence ?? null,
+    revisions: receiptRevisions(decision),
+    dispatchedAt: input.dispatchedAt,
+    reason,
+  });
+}
+
+function decisionReason(decision) {
+  const blockers = decision.blockers.length > 0 ? `:${decision.blockers.join(',')}` : '';
+  return `${decision.status}:${decision.reason}${blockers}`;
+}
+
+function safeFailureReason(error) {
+  const message = error instanceof Error ? error.message : '';
+  const safeReasons = [
+    ['Claude route capability is not attested', 'Claude route capability is not attested'],
+    ['route identity is incomplete', 'route identity is incomplete'],
+    ['transport is not detected', 'transport is not detected'],
+    ['transport is not callable', 'transport is not callable'],
+    ['transport is not permitted', 'transport is not permitted'],
+    ['model control is not enforced', 'model control is not enforced'],
+    ['effort control is not enforced', 'effort control is not enforced'],
+    ['model environment precedence is unverified', 'model environment precedence is unverified'],
+    ['effort environment precedence is unverified', 'effort environment precedence is unverified'],
+    ['model applied value is unverified', 'model applied value is unverified'],
+    ['effort applied value is unverified', 'effort applied value is unverified'],
+    ['transport has no approved dispatcher', 'transport has no approved dispatcher'],
+    ['environment precedence mismatch: model', 'environment precedence mismatch: model'],
+    ['environment precedence mismatch: effort', 'environment precedence mismatch: effort'],
+    ['applied route mismatch', 'applied route mismatch'],
+    ['spawn guard received no callable dispatcher', 'spawn guard received no callable dispatcher'],
+    ['applied route differs from requested route', 'applied route differs from requested route'],
+    ['applied enforcement differs from attested access path', 'applied enforcement differs from attested access path'],
+    ['AFK dispatch requires enforced model and effort selection', 'AFK dispatch requires enforced model and effort selection'],
+    ['AFK dispatch requires verified environment precedence', 'AFK dispatch requires verified environment precedence'],
+    ['concurrent routing profile mutation', 'concurrent routing profile mutation'],
+    ['concurrent evidence catalog mutation', 'concurrent evidence catalog mutation'],
+  ];
+  return safeReasons.find(([prefix]) => message.startsWith(prefix))?.[1]
+    ?? 'dispatch adapter rejected route';
+}
+
+function safeDispatchResult(result) {
+  if (!result || typeof result !== 'object' || Array.isArray(result)) return null;
+  const taskId = typeof result.taskId === 'string' && result.taskId !== ''
+    ? result.taskId
+    : null;
+  return taskId === null ? null : Object.freeze({ taskId });
+}
+
+function assertAppliedEnforcement(decision, applied) {
+  for (const field of ['model', 'effort']) {
+    if (decision.bestExecutable.enforcement[field] !== applied[field]) {
+      throw new Error(`applied enforcement differs from attested access path: ${field}`);
+    }
+  }
+}
+
+export async function dispatchResolvedRoute(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new TypeError('dispatch input must be an object');
+  }
+  if (!input.adapter || typeof input.adapter.prepare !== 'function') {
+    throw new TypeError('dispatch adapter must expose prepare');
+  }
+  const decision = resolveRoute(input.resolverInput);
+  if (decision.status !== 'ready') {
+    return Object.freeze({
+      decision,
+      receipt: blockedReceipt(input, decision, decisionReason(decision)),
+      dispatchResult: null,
+    });
+  }
+  const profileSnapshot = captureRoutingProfileSnapshot(input.resolverInput);
+  const catalogRevision = input.resolverInput.catalog.revision;
+
+  const requestedRoute = receiptRoute(decision.bestExecutable);
+  try {
+    const prepared = await input.adapter.prepare(requestedRoute);
+    assertRoutingProfileUnchanged(profileSnapshot, input.resolverInput);
+    if (catalogRevision !== input.resolverInput.catalog?.revision) {
+      throw new Error('concurrent evidence catalog mutation');
+    }
+    assertAppliedEnforcement(decision, prepared.enforcement);
+    if (prepared.mismatchReason) {
+      return Object.freeze({
+        decision,
+        receipt: blockedReceipt(input, decision, safeFailureReason(
+          new Error(prepared.mismatchReason),
+        ), {
+          requestedRoute,
+          appliedRoute: receiptRoute(prepared.appliedRoute),
+          enforcement: prepared.enforcement,
+          precedence: prepared.precedence,
+        }),
+        dispatchResult: null,
+      });
+    }
+    const receipt = createDispatchReceipt({
+      executionId: input.executionId,
+      status: 'dispatched',
+      afk: input.afk,
+      requestedRoute,
+      appliedRoute: receiptRoute(prepared.appliedRoute),
+      enforcement: prepared.enforcement,
+      precedence: prepared.precedence,
+      revisions: receiptRevisions(decision),
+      dispatchedAt: input.dispatchedAt,
+    });
+    if (typeof prepared.dispatch !== 'function') {
+      throw new Error('spawn guard received no callable dispatcher');
+    }
+    const dispatchResult = safeDispatchResult(await prepared.dispatch());
+    return Object.freeze({ decision, receipt, dispatchResult });
+  } catch (error) {
+    return Object.freeze({
+      decision,
+      receipt: blockedReceipt(input, decision, safeFailureReason(error), { requestedRoute }),
+      dispatchResult: null,
+    });
+  }
+}

package/src/lib/routingAccessGraph.mjs

@@ -0,0 +1,105 @@
+export const ACCESS_GRAPH_VERSION = 1;
+
+export const ROUTE_AVAILABILITY = Object.freeze([
+  'available',
+  'unavailable',
+  'unknown',
+]);
+
+export const ENFORCEMENT_METHODS = Object.freeze([
+  'per-spawn',
+  'named-agent',
+  'session-default',
+  'none',
+]);
+
+const PATH_FIELDS = new Set([
+  'id',
+  'surfaceId',
+  'providerId',
+  'modelId',
+  'transportId',
+  'availability',
+  'enforcement',
+  'capabilityEvidence',
+]);
+
+function object(value, field) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new TypeError(`${field} must be an object`);
+  }
+  return value;
+}
+
+function string(value, field) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new TypeError(`${field} must be a non-empty string`);
+  }
+  return value;
+}
+
+function oneOf(value, values, field) {
+  if (!values.includes(value)) throw new TypeError(`${field} must be one of: ${values.join(', ')}`);
+  return value;
+}
+
+function timestamp(value, field) {
+  string(value, field);
+  if (!Number.isFinite(Date.parse(value))) throw new TypeError(`${field} must be an ISO timestamp`);
+  return value;
+}
+
+function deepFreeze(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+  Object.freeze(value);
+  for (const child of Object.values(value)) deepFreeze(child);
+  return value;
+}
+
+function validatePath(path, index) {
+  const field = `paths[${index}]`;
+  object(path, field);
+  for (const key of Object.keys(path)) {
+    if (!PATH_FIELDS.has(key)) throw new TypeError(`unknown access path field: ${key}`);
+  }
+  const enforcement = object(path.enforcement, `${field}.enforcement`);
+  const evidence = object(path.capabilityEvidence, `${field}.capabilityEvidence`);
+  const observedAt = timestamp(evidence.observedAt, `${field}.capabilityEvidence.observedAt`);
+  const expiresAt = timestamp(evidence.expiresAt, `${field}.capabilityEvidence.expiresAt`);
+  if (Date.parse(expiresAt) <= Date.parse(observedAt)) {
+    throw new TypeError(`${field}.capabilityEvidence.expiresAt must follow observedAt`);
+  }
+  return {
+    id: string(path.id, `${field}.id`),
+    surfaceId: string(path.surfaceId, `${field}.surfaceId`),
+    providerId: string(path.providerId, `${field}.providerId`),
+    modelId: string(path.modelId, `${field}.modelId`),
+    transportId: string(path.transportId, `${field}.transportId`),
+    availability: oneOf(path.availability, ROUTE_AVAILABILITY, `${field}.availability`),
+    enforcement: {
+      model: oneOf(enforcement.model, ENFORCEMENT_METHODS, `${field}.enforcement.model`),
+      effort: oneOf(enforcement.effort, ENFORCEMENT_METHODS, `${field}.enforcement.effort`),
+    },
+    capabilityEvidence: {
+      revision: string(evidence.revision, `${field}.capabilityEvidence.revision`),
+      observedAt,
+      expiresAt,
+    },
+  };
+}
+
+export function validateAccessGraph(input) {
+  object(input, 'access graph');
+  if (input.schemaVersion !== ACCESS_GRAPH_VERSION) {
+    throw new TypeError(`access graph schemaVersion must be ${ACCESS_GRAPH_VERSION}`);
+  }
+  const revision = string(input.revision, 'access graph revision');
+  if (!Array.isArray(input.paths)) throw new TypeError('access graph paths must be an array');
+  const paths = input.paths.map(validatePath);
+  const ids = new Set();
+  for (const path of paths) {
+    if (ids.has(path.id)) throw new TypeError(`duplicate access path: ${path.id}`);
+    ids.add(path.id);
+  }
+  return deepFreeze({ schemaVersion: ACCESS_GRAPH_VERSION, revision, paths });
+}

package/src/lib/routingAdapters/claude.mjs

@@ -0,0 +1,62 @@
+import { adaptClaudeRoutingInventory } from '../capabilityMatrix.mjs';
+
+function matchesRoute(path, route) {
+  return ['surfaceId', 'providerId', 'modelId', 'transportId']
+    .every((field) => path[field] === route[field]);
+}
+
+function appliedRoute(path, requestedRoute) {
+  return Object.freeze({
+    ...requestedRoute,
+    modelId: path.model.applied,
+    effort: path.effort.applied,
+  });
+}
+
+function mismatchReason(path, requested, applied) {
+  for (const field of ['modelId', 'effort']) {
+    if (requested[field] === applied[field]) continue;
+    const control = field === 'modelId' ? path.model : path.effort;
+    if (control.precedence === 'environment-over-agent-definition') {
+      return `environment precedence mismatch: ${field === 'modelId' ? 'model' : field}`;
+    }
+    return `applied route mismatch: ${field}`;
+  }
+  return null;
+}
+
+export function createClaudeRoutingAdapter({ inventory, dispatchers = {} }) {
+  const capabilities = adaptClaudeRoutingInventory(inventory);
+  return Object.freeze({
+    async prepare(requestedRoute) {
+      const path = capabilities.paths.find((candidate) => matchesRoute(candidate, requestedRoute));
+      if (!path) throw new Error('Claude route capability is not attested');
+      if (!path.verified) throw new Error(path.verificationFailures.join('; '));
+      const invoke = dispatchers[path.transportId];
+      if (typeof invoke !== 'function') {
+        throw new Error(`transport has no approved dispatcher: ${path.transportId}`);
+      }
+      const applied = appliedRoute(path, requestedRoute);
+      const mismatch = mismatchReason(path, requestedRoute, applied);
+      return Object.freeze({
+        appliedRoute: applied,
+        enforcement: Object.freeze({
+          model: path.model.method,
+          effort: path.effort.method,
+        }),
+        precedence: Object.freeze({
+          model: path.model.precedence,
+          effort: path.effort.precedence,
+        }),
+        mismatchReason: mismatch,
+        dispatch: () => invoke(Object.freeze({
+          route: applied,
+          enforcement: Object.freeze({
+            model: path.model.method,
+            effort: path.effort.method,
+          }),
+        })),
+      });
+    },
+  });
+}

package/src/lib/routingAdapters/codex.mjs

@@ -0,0 +1,136 @@
+import { adaptClaudeRoutingInventory } from '../capabilityMatrix.mjs';
+
+const MODEL_SELECTORS = ['model'];
+const EFFORT_SELECTORS = ['effort', 'reasoning_effort', 'model_reasoning_effort'];
+
+function object(value, field) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new TypeError(`${field} must be an object`);
+  }
+  return value;
+}
+
+function string(value, field) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new TypeError(`${field} must be a non-empty string`);
+  }
+  return value;
+}
+
+function timestamp(value, field) {
+  string(value, field);
+  if (!Number.isFinite(Date.parse(value))) {
+    throw new TypeError(`${field} must be an ISO timestamp`);
+  }
+  return value;
+}
+
+function schemaProperties(schema) {
+  if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return {};
+  if (!schema.properties || typeof schema.properties !== 'object'
+      || Array.isArray(schema.properties)) return {};
+  return schema.properties;
+}
+
+function hasSelector(properties, selectors) {
+  return selectors.some((selector) =>
+    Object.prototype.hasOwnProperty.call(properties, selector));
+}
+
+function uncontrolled(control) {
+  return {
+    ...control,
+    method: 'none',
+    enforced: false,
+    precedence: 'uncontrolled',
+    applied: undefined,
+  };
+}
+
+function applySpawnSchemaEvidence(path, properties) {
+  const candidate = { ...path };
+  if (path?.model?.method === 'per-spawn'
+      && !hasSelector(properties, MODEL_SELECTORS)) {
+    candidate.model = uncontrolled(path.model);
+  }
+  if (path?.effort?.method === 'per-spawn'
+      && !hasSelector(properties, EFFORT_SELECTORS)) {
+    candidate.effort = uncontrolled(path.effort);
+  }
+  return candidate;
+}
+
+function matchesRoute(path, route) {
+  return ['surfaceId', 'providerId', 'modelId', 'transportId']
+    .every((field) => path[field] === route[field]);
+}
+
+function appliedRoute(path, requestedRoute) {
+  return Object.freeze({
+    ...requestedRoute,
+    modelId: path.model.applied,
+    effort: path.effort.applied,
+  });
+}
+
+function mismatchReason(path, requested, applied) {
+  for (const field of ['modelId', 'effort']) {
+    if (requested[field] === applied[field]) continue;
+    const control = field === 'modelId' ? path.model : path.effort;
+    if (control.precedence === 'environment-over-agent-definition') {
+      return `environment precedence mismatch: ${field === 'modelId' ? 'model' : field}`;
+    }
+    return `applied route mismatch: ${field}`;
+  }
+  return null;
+}
+
+export function adaptCodexRoutingInventory(inventory) {
+  const source = object(inventory, 'Codex host attestation');
+  timestamp(source.observedAt, 'Codex host attestation observedAt');
+  const host = object(source.host, 'Codex host attestation host');
+  string(host.id, 'Codex host attestation host.id');
+  string(host.version, 'Codex host attestation host.version');
+  const properties = schemaProperties(source.spawnSchema);
+  const paths = Array.isArray(source.paths)
+    ? source.paths
+      .filter((path) => path?.surfaceId === 'codex')
+      .map((path) => applySpawnSchemaEvidence(path, properties))
+    : [];
+  return adaptClaudeRoutingInventory({
+    contractVersion: source.contractVersion,
+    paths,
+  });
+}
+
+export function createCodexRoutingAdapter({ inventory, dispatchers = {} }) {
+  const capabilities = adaptCodexRoutingInventory(inventory);
+  return Object.freeze({
+    async prepare(requestedRoute) {
+      const path = capabilities.paths.find((candidate) =>
+        matchesRoute(candidate, requestedRoute));
+      if (!path) throw new Error('Codex route capability is not attested');
+      if (!path.verified) throw new Error(path.verificationFailures.join('; '));
+      const invoke = dispatchers[path.transportId];
+      if (typeof invoke !== 'function') {
+        throw new Error(`transport has no approved dispatcher: ${path.transportId}`);
+      }
+      const applied = appliedRoute(path, requestedRoute);
+      const mismatch = mismatchReason(path, requestedRoute, applied);
+      const enforcement = Object.freeze({
+        model: path.model.method,
+        effort: path.effort.method,
+      });
+      return Object.freeze({
+        appliedRoute: applied,
+        enforcement,
+        precedence: Object.freeze({
+          model: path.model.precedence,
+          effort: path.effort.precedence,
+        }),
+        mismatchReason: mismatch,
+        dispatch: () => invoke(Object.freeze({ route: applied, enforcement })),
+      });
+    },
+  });
+}