@inhuman.tools/turn 0.0.0-stage → 0.2.0

package/dist/policy-processor/classifier.js

@@ -0,0 +1,671 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+/**
+ * Remainder-classifier handle. Auto ask (floor ask + hatch). Cache is
+ * remainder skip. Empty connection or model gates the classifier, not
+ * identity — `dotprompt/run` requires both, and a run plan with one
+ * missing retries the invariant forever.
+ * `start` owns the run-plan reaction; minting does not begin I/O.
+ * Eligibility lives on the scope key set — this handle re-runs when the
+ * plan inputs change. Timer ticks are events (backoff). Floor `block`
+ * never mints these. Cluster ports share this handle. Classifier
+ * prompt files load on first require, not at import.
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { disposeRunContext, execState, jsToScheme, makeCallCtx, parse, toJS, } from "@here.build/arrival";
+import { applyCallback } from "@here.build/arrival/host-internals";
+import { ASymbol } from "@here.build/arrival/reflect-internals";
+import { loaderFromResolver } from "@here.build/arrival-modules";
+import { DefaultedMap } from "@here.build/collections";
+import { promptIsolatedCapability } from "@inhuman.tools/env-capability-module-prompt";
+import { fileQuestion, isJsonSchemaUnsupported, JUDGE_FAILS_FINAL, MCPToolJob, clusterOf, ruleStampFor, workspacePath, } from "@inhuman.tools/harness-model";
+import { classifierResources, policyEnvCapability } from "@inhuman.tools/policy/floor";
+import { parseTirithEvidence, tirithCoverage } from "@inhuman.tools/policy-tirith";
+import { action, comparer, observable, reaction, runInAction } from "mobx";
+import { classifierArgs } from "./cluster.js";
+import { evidenceCuts, evidenceIdentity } from "./evidence.js";
+import { buildSoftDenySections, identityTokens, parseSoftDenyVote, } from "./soft-deny.js";
+function trace(name, message) {
+    const debug = process.env.DEBUG;
+    if (debug == null)
+        return;
+    const parts = debug.trim() === "" ? ["*"] : debug.split(/[\s,]+/).filter((part) => part !== "");
+    const on = parts.some((part) => {
+        if (part.startsWith("-"))
+            return false;
+        if (part === "*" || part === name)
+            return true;
+        if (part.endsWith("*"))
+            return name.startsWith(part.slice(0, -1));
+        return name.startsWith(`${part}:`);
+    });
+    if (!on)
+        return;
+    process.stderr.write(`${name} ${message}\n`);
+}
+/**
+ * Every remainder attempt is deadline-bounded. The first is short because the
+ * first vote is what the human is waiting on — a miss must open the approval
+ * window fast. Retries get longer: a slow-but-live model may still deliver a
+ * late allow, and the loop never gives up (overnight runs rely on that). But no
+ * attempt may run unbounded — with `scope.cap` a stuck classifier squatting a slot
+ * starves every job behind it, which is the hang.
+ *
+ * Below the stall timer on purpose: a live stream that trickles a token every
+ * few minutes resets the stall timer forever, so the wall clock is the only
+ * bound that fires.
+ */
+export const FIRST_ATTEMPT_MS = 12_000;
+export const RETRY_ATTEMPT_MS = 5 * 60_000;
+function voteOf(value) {
+    switch (typeof value) {
+        case "string":
+            switch (value) {
+                case "allow":
+                case "deny":
+                    return { decision: value };
+                default:
+                    return value.trim() === "" ? { fail: "classifier did not vote" } : { fail: value };
+            }
+        case "object": {
+            if (value === null || Array.isArray(value))
+                return { fail: "classifier did not vote" };
+            const rec = value;
+            const decision = rec.decision ?? rec[":decision"];
+            switch (decision) {
+                case "allow":
+                case "deny":
+                    return { decision };
+                default:
+                    return { fail: "classifier did not vote" };
+            }
+        }
+        default:
+            return { fail: "classifier did not vote" };
+    }
+}
+async function applyClassifier(runCtx, fn, args) {
+    const boxed = applyCallback(fn, args.map((value) => jsToScheme(runCtx, value)), makeCallCtx(runCtx));
+    const signal = runCtx.signal;
+    if (signal === undefined || signal.aborted)
+        return toJS(await boxed);
+    const gate = new AbortController();
+    const winner = AbortSignal.any([signal, gate.signal]);
+    const abort = new Promise((_resolve, reject) => {
+        winner.addEventListener("abort", () => {
+            reject(signal.reason instanceof Error ? signal.reason : new Error("classifier aborted"));
+        }, { once: true });
+    });
+    try {
+        return toJS(await Promise.race([Promise.resolve(boxed), abort]));
+    }
+    finally {
+        gate.abort();
+    }
+}
+const here = path.dirname(fileURLToPath(import.meta.url));
+const classifierCache = new DefaultedMap((p) => {
+    switch (p) {
+        case "classifier-bash.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-bash.prompt"), "utf8");
+        case "classifier-read.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-read.prompt"), "utf8");
+        case "classifier-write.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write.prompt"), "utf8");
+        case "classifier-write-outside.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write-outside.prompt"), "utf8");
+        case "classifier-write-workspace.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write-workspace.prompt"), "utf8");
+        case "classifier-write-risky.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write-risky.prompt"), "utf8");
+        case "classifier-mcp.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-mcp.prompt"), "utf8");
+        case "classifier-bash-incomplete.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-bash-incomplete.prompt"), "utf8");
+        case "soft-deny-round1.prompt":
+            return readFileSync(path.join(here, "../../policy/soft-deny-round1.prompt"), "utf8");
+        case "soft-deny-round2.prompt":
+            return readFileSync(path.join(here, "../../policy/soft-deny-round2.prompt"), "utf8");
+        case "bypass-detect.prompt":
+            return readFileSync(path.join(here, "../../policy/bypass-detect.prompt"), "utf8");
+        default:
+            throw new Error(`no such file: ${p}`);
+    }
+});
+export const classifierFiles = loaderFromResolver((p) => classifierCache.get(p));
+export function classifierRoute(kvs, opts) {
+    const fallback = opts?.fallback ?? {};
+    const connection = (kvs.judgeConnection || fallback.judgeConnection || kvs.connection || "").trim();
+    const judgeModel = (kvs.judgeModel || fallback.judgeModel || "").trim();
+    const configured = connection !== "" && opts?.configuredModel != null ? opts.configuredModel(connection).trim() : "";
+    const model = (judgeModel || configured || kvs.model || "").trim();
+    return { connection, model, key: `${connection}\n${model}` };
+}
+const programReads = observable.map({}, { deep: false });
+const programReadsStarted = new Set();
+function startProgramRead(source) {
+    if (programReadsStarted.has(source))
+        return;
+    programReadsStarted.add(source);
+    void parse(source).then((forms) => runInAction(() => programReads.set(source, { state: "forms", forms })), () => runInAction(() => programReads.set(source, { state: "broken" })));
+}
+/** One symbol. The reader has already dropped comments. A string `"allow"` is not this. */
+function literalOf(forms) {
+    const form = forms.length === 1 ? forms[0] : undefined;
+    if (!(form instanceof ASymbol))
+        return undefined;
+    return form.__name__ === "allow" || form.__name__ === "deny" ? form.__name__ : undefined;
+}
+/** The owner's `describe` for an MCP call, from the session's layers (a project file's words are not included). */
+function ownerDescription(job) {
+    if (job.authCluster !== "mcp")
+        return undefined;
+    return ruleStampFor(job.authorizationLayers, job.callSubject).describe;
+}
+function remainderPlan(scope, job, attempt) {
+    const source = scope.root.judgeAskProgram;
+    const route = classifierRoute(scope.root.kvs, {
+        fallback: scope.judgeFallbackKvs,
+        configuredModel: scope.judgeConfiguredModel,
+    });
+    const cuts = evidenceCuts(job);
+    const identity = evidenceIdentity(cuts);
+    const cached = scope.remainderHit(job, identity);
+    if (cached !== null)
+        return { kind: "cache", decision: cached, attempt };
+    const soft = job.judgeKind === "soft-deny";
+    const resolver = job.resolution?.resolver;
+    const params = resolver?.kind === "judge" ? resolver.params : {};
+    // No user words, no explicit request: nothing to ask a model.
+    if (soft && (cuts.userMessages ?? []).length === 0) {
+        return { kind: "verdict", decision: "deny", reason: "no user message asks for this", attempt };
+    }
+    const read = programReads.get(source);
+    if (read === undefined)
+        return { kind: "unread", source, attempt };
+    if (read.state === "forms") {
+        const decision = literalOf(read.forms);
+        // A literal program is the ask judge's shortcut. It is never a soft-deny license: the host must
+        // see the user's words, so only a literal deny applies here.
+        if (decision !== undefined && (!soft || decision === "deny"))
+            return { kind: "literal", decision, identity, attempt };
+        if (decision !== undefined)
+            return { kind: "noprogram", attempt };
+        // No forms is the empty result exec returns. A top-level define is #<void>, not empty.
+        if (read.forms.length === 0)
+            return { kind: "empty", attempt };
+    }
+    if (scope.schemaHaltKeys.has(route.key))
+        return { kind: "halt", attempt };
+    if (route.connection === "" || route.model === "")
+        return { kind: "noconnect", attempt };
+    if (source.trim() === "")
+        return { kind: "empty", attempt };
+    const base = {
+        kind: "run",
+        source,
+        connection: route.connection,
+        model: route.model,
+        attempt,
+        identity,
+        privileged: cuts.privileged,
+        priorTurn: cuts.priorTurn,
+        quarantined: cuts.quarantined,
+        policy: cuts.policy ?? "",
+        margin: params.margin ?? 0,
+    };
+    if (!soft)
+        return base;
+    const layer = job.resolution?.layer;
+    const rounds = (params.rounds ?? 2);
+    const unattended = job.unattended;
+    const userMessages = cuts.userMessages ?? [];
+    const agentAnswer = cuts.agentAnswer ?? "";
+    const votes = job.policyVotes;
+    const cluster = clusterOf(job.name);
+    const sections = buildSoftDenySections({
+        classes: job.policyClasses,
+        votes,
+        userMessages,
+        agentAnswer,
+        allowAgentAnswer: rounds === 2 && !unattended,
+        tool: job.name,
+        cluster,
+        args: job.args,
+        describe: ownerDescription(job),
+    });
+    const tokens = identityTokens({
+        cluster,
+        tool: job.name,
+        args: job.args,
+        votes,
+        serverToolName: job instanceof MCPToolJob ? job.serverToolName : undefined,
+    });
+    return {
+        ...base,
+        soft: {
+            sections,
+            rounds,
+            unattended,
+            hasAgentAnswer: sections.agentAnswerJson !== "",
+            callTier: "soft-deny",
+            callClasses: job.policyClasses.join(","),
+            callRules: votes.map((vote) => vote.ruleId).join(","),
+            check: {
+                userMessages,
+                agentAnswer,
+                identityTokens: tokens,
+                // Only a layer the human wrote may turn the quote check off.
+                requireQuote: !(params.requireQuote === false &&
+                    (layer === "user" || layer === "session" || layer === "managed")),
+                margin: params.margin ?? 0,
+            },
+        },
+    };
+}
+/**
+ * One bypass-check attempt: the program's `bypass/judge` sink, applied once, under the per-attempt
+ * deadline. Throws on any failure (no connection, no sink, timeout, a crash); the caller decides what
+ * a failed check means. The parent job is the denied call that triggered the check, which is still open.
+ */
+export async function runBypassJudge(scope, job, sections) {
+    const source = scope.root.judgeAskProgram;
+    const route = classifierRoute(scope.root.kvs, {
+        fallback: scope.judgeFallbackKvs,
+        configuredModel: scope.judgeConfiguredModel,
+    });
+    if (route.connection === "" || route.model === "")
+        throw new Error("no model connection");
+    if (scope.schemaHaltKeys.has(route.key))
+        throw new Error("json_schema unsupported");
+    if (source.trim() === "")
+        throw new Error("auto-mode classifier program is empty");
+    const attemptMs = scope.judgeDeadlineMs(0);
+    const abort = new AbortController();
+    const deadline = setTimeout(() => abort.abort(new Error(`bypass check timed out after ${attemptMs}ms`)), attemptMs);
+    deadline.unref();
+    try {
+        const cuts = evidenceCuts(job);
+        const state = await execState(source, {
+            capabilities: [policyEnvCapability, promptIsolatedCapability],
+            signal: abort.signal,
+            config: {
+                privileged: cuts.privileged,
+                taskJson: sections.taskJson,
+                restrictionsJson: sections.restrictionsJson,
+                callsJson: sections.callsJson,
+                hintsJson: sections.hintsJson,
+                notesJson: sections.notesJson,
+                loader: classifierFiles,
+                job,
+                connectionId: route.connection,
+                completionModel: route.model,
+                complete: scope.complete,
+            },
+        });
+        try {
+            const fn = classifierResources(state.runCtx).bypass;
+            if (fn === undefined)
+                throw new Error("no bypass/judge sink in the classifier program");
+            return await applyClassifier(state.runCtx, fn, []);
+        }
+        finally {
+            await disposeRunContext(state.runCtx);
+        }
+    }
+    catch (error) {
+        const text = error instanceof Error ? error.message : String(error);
+        if (isJsonSchemaUnsupported(text))
+            scope.schemaHaltKeys.add(route.key);
+        throw error;
+    }
+    finally {
+        clearTimeout(deadline);
+        if (!abort.signal.aborted)
+            abort.abort();
+    }
+}
+let ClassifierHandle = (() => {
+    let _instanceExtraInitializers = [];
+    let _attempt_decorators;
+    let _attempt_initializers = [];
+    let _attempt_extraInitializers = [];
+    let _start_decorators;
+    let _writeFail_decorators;
+    let _writeFailSticky_decorators;
+    return class ClassifierHandle {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _attempt_decorators = [observable];
+            _start_decorators = [action];
+            _writeFail_decorators = [action];
+            _writeFailSticky_decorators = [action];
+            __esDecorate(this, null, _attempt_decorators, { kind: "accessor", name: "attempt", static: false, private: false, access: { has: obj => "attempt" in obj, get: obj => obj.attempt, set: (obj, value) => { obj.attempt = value; } }, metadata: _metadata }, _attempt_initializers, _attempt_extraInitializers);
+            __esDecorate(this, null, _start_decorators, { kind: "method", name: "start", static: false, private: false, access: { has: obj => "start" in obj, get: obj => obj.start }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _writeFail_decorators, { kind: "method", name: "writeFail", static: false, private: false, access: { has: obj => "writeFail" in obj, get: obj => obj.writeFail }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _writeFailSticky_decorators, { kind: "method", name: "writeFailSticky", static: false, private: false, access: { has: obj => "writeFailSticky" in obj, get: obj => obj.writeFailSticky }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        job = __runInitializers(this, _instanceExtraInitializers);
+        scope;
+        #attempt_accessor_storage = __runInitializers(this, _attempt_initializers, 0);
+        get attempt() { return this.#attempt_accessor_storage; }
+        set attempt(value) { this.#attempt_accessor_storage = value; }
+        #timer = __runInitializers(this, _attempt_extraInitializers);
+        #attemptAbort;
+        #stop;
+        #seq = 0;
+        constructor(job, scope) {
+            this.job = job;
+            this.scope = scope;
+        }
+        async #classifierApplyArgs() {
+            const args = classifierArgs(this.job.name, this.job.args);
+            if (args === undefined)
+                return undefined;
+            const cluster = clusterOf(this.job.name);
+            if (cluster === "write") {
+                const question = fileQuestion(this.job.name, this.job.args ?? undefined);
+                if (question == null)
+                    return undefined;
+                const source = this.scope.root.policyProgram.trim() === "" ? this.scope.distSource() : this.scope.root.policyProgram;
+                const policy = await this.scope.compiledPolicy(source);
+                // A floor deny names its remainder kind; an ordinary in-tree ask is judged on the task.
+                const kind = policy.writeKind(workspacePath(this.scope.root.path, question)) ??
+                    (this.job.policyResult === "ask" ? "workspace" : "outside");
+                return [...args, kind];
+            }
+            if (cluster === "mcp") {
+                const describe = ownerDescription(this.job);
+                if (describe === undefined)
+                    return args;
+                // The program appends the second string under the operation: a labelled owner note, JSON-encoded.
+                return [
+                    args[0],
+                    `${String(args[1])}\nOWNER NOTE (written by the policy owner, not the agent): ${JSON.stringify(describe)}`,
+                ];
+            }
+            if (cluster === "bash") {
+                const report = parseTirithEvidence(this.job.policyEvidenceJson);
+                if (report != null && tirithCoverage(report) === "incomplete")
+                    return [...args, "incomplete"];
+            }
+            return args;
+        }
+        start() {
+            if (this.#stop !== undefined || this.scope.closed)
+                return;
+            this.#stop = reaction(() => remainderPlan(this.scope, this.job, this.attempt), async (plan) => {
+                this.#clearTimer();
+                const seq = ++this.#seq;
+                const jobId = this.job.toolCallId || this.job.name;
+                trace("harness:judge", `plan ${plan.kind} job=${jobId} tool=${this.job.name} attempt=${plan.attempt}${plan.kind === "run" ? ` model=${plan.model}` : ""}`);
+                switch (plan.kind) {
+                    case "cache":
+                        runInAction(() => {
+                            if (this.job.classifierResult !== null)
+                                return;
+                            this.job.classifierResult = plan.decision;
+                            if (plan.decision === "deny" && this.job.judgeKind === "soft-deny") {
+                                this.job.judgeReason = "already denied this turn";
+                            }
+                        });
+                        return;
+                    case "verdict":
+                        runInAction(() => {
+                            if (this.job.classifierResult !== null)
+                                return;
+                            this.job.classifierResult = plan.decision;
+                            this.job.judgeReason = plan.reason;
+                        });
+                        return;
+                    case "noprogram":
+                        this.writeFailSticky("auto-mode classifier program has no soft-deny sink (soft-deny/<cluster>); a person decides");
+                        return;
+                    case "literal":
+                        runInAction(() => {
+                            if (this.job.classifierResult !== null)
+                                return;
+                            this.job.classifierResult = plan.decision;
+                            this.scope.remainderStore(this.job, plan.identity, plan.decision);
+                        });
+                        return;
+                    case "halt":
+                        this.writeFailSticky("json_schema unsupported: auto mode needs a model that supports structured output");
+                        return;
+                    case "noconnect":
+                        this.writeFail("no model connection");
+                        return;
+                    case "empty":
+                        // An empty program can never vote. Abstain so the call reaches the human
+                        // cover (and the diagnostic is shown) instead of waiting forever.
+                        this.writeFailSticky("auto-mode classifier program is empty or unreadable (check autoModeClassifier in config.json)");
+                        return;
+                    case "unread":
+                        startProgramRead(plan.source);
+                        return;
+                    case "run":
+                        break;
+                }
+                const started = Date.now();
+                const attemptMs = this.scope.judgeDeadlineMs(plan.attempt);
+                this.#attemptAbort = new AbortController();
+                const attemptAbort = this.#attemptAbort;
+                const deadline = setTimeout(() => {
+                    attemptAbort.abort(new Error(`classifier timed out after ${attemptMs}ms`));
+                }, attemptMs);
+                deadline.unref();
+                try {
+                    let vote = { fail: "classifier did not vote" };
+                    let state;
+                    try {
+                        state = await execState(plan.source, {
+                            capabilities: [policyEnvCapability, promptIsolatedCapability],
+                            signal: attemptAbort.signal,
+                            config: {
+                                privileged: plan.privileged,
+                                priorTurn: plan.priorTurn,
+                                quarantined: plan.quarantined,
+                                policy: plan.policy,
+                                riskMargin: plan.margin,
+                                ...(plan.soft === undefined
+                                    ? {}
+                                    : {
+                                        floorJson: plan.soft.sections.floorJson,
+                                        userJson: plan.soft.sections.userJson,
+                                        callJson: plan.soft.sections.callJson,
+                                        agentAnswerJson: plan.soft.sections.agentAnswerJson,
+                                        callTier: plan.soft.callTier,
+                                        callClasses: plan.soft.callClasses,
+                                        callRules: plan.soft.callRules,
+                                    }),
+                                loader: classifierFiles,
+                                job: this.job,
+                                connectionId: plan.connection,
+                                completionModel: plan.model,
+                                complete: this.scope.complete,
+                            },
+                        });
+                    }
+                    catch (error) {
+                        vote = { fail: error instanceof Error ? error.message : String(error) };
+                    }
+                    if (state !== undefined) {
+                        try {
+                            const cluster = clusterOf(this.job.name);
+                            if (plan.soft !== undefined) {
+                                vote = await this.#softDeny(state.runCtx, cluster, plan.soft);
+                            }
+                            else {
+                                const fn = classifierResources(state.runCtx)[cluster];
+                                if (fn === undefined) {
+                                    vote = { fail: `no classifier/${cluster}` };
+                                }
+                                else {
+                                    const args = await this.#classifierApplyArgs();
+                                    vote =
+                                        args === undefined
+                                            ? { fail: "classifier did not vote" }
+                                            : voteOf(await applyClassifier(state.runCtx, fn, args));
+                                }
+                            }
+                        }
+                        finally {
+                            await disposeRunContext(state.runCtx);
+                        }
+                    }
+                    if (seq !== this.#seq) {
+                        trace("harness:judge", `stale job=${jobId} ms=${Date.now() - started}`);
+                        return;
+                    }
+                    runInAction(() => {
+                        if (this.job.classifierResult !== null)
+                            return;
+                        if ("fail" in vote) {
+                            trace("harness:judge", `fail job=${jobId} ms=${Date.now() - started} ${vote.fail}`);
+                            if (isJsonSchemaUnsupported(vote.fail)) {
+                                this.scope.schemaHaltKeys.add(`${plan.connection}\n${plan.model}`);
+                                this.writeFailSticky(vote.fail);
+                                return;
+                            }
+                            this.writeFail(vote.fail);
+                            return;
+                        }
+                        trace("harness:judge", `vote ${vote.decision} job=${jobId} ms=${Date.now() - started}`);
+                        this.job.classifierResult = vote.decision;
+                        if (vote.reason !== undefined)
+                            this.job.judgeReason = vote.reason;
+                        if (vote.round !== undefined)
+                            this.job.softDenyRound = vote.round;
+                        this.scope.remainderStore(this.job, plan.identity, vote.decision);
+                    });
+                }
+                catch (error) {
+                    if (seq !== this.#seq)
+                        return;
+                    trace("harness:judge", `throw job=${jobId} ms=${Date.now() - started} ${error instanceof Error ? error.message : String(error)}`);
+                    runInAction(() => {
+                        const text = error instanceof Error ? error.message : String(error);
+                        if (isJsonSchemaUnsupported(text)) {
+                            this.scope.schemaHaltKeys.add(`${plan.connection}\n${plan.model}`);
+                            this.writeFailSticky(text);
+                            return;
+                        }
+                        this.writeFail(text);
+                    });
+                }
+                finally {
+                    clearTimeout(deadline);
+                    if (!attemptAbort.signal.aborted)
+                        attemptAbort.abort();
+                    if (this.#attemptAbort === attemptAbort)
+                        this.#attemptAbort = undefined;
+                }
+            }, { equals: comparer.structural, fireImmediately: true });
+        }
+        dispose() {
+            this.#seq += 1;
+            this.#clearTimer();
+            this.#attemptAbort?.abort();
+            this.#attemptAbort = undefined;
+            this.#stop?.();
+            this.#stop = undefined;
+        }
+        /**
+         * The soft-deny rounds. The program's sink is applied with the round; the host parses and verifies
+         * each vote (quote, identity of the action, risk x authorization). Round 2 runs only when round 1
+         * asked for the agent's last answer, the cell allows two rounds, one exists, and a person is watching.
+         */
+        async #softDeny(runCtx, cluster, plan) {
+            const fn = classifierResources(runCtx).softDeny[cluster];
+            if (fn === undefined)
+                return { fail: `no soft-deny/${cluster}` };
+            const first = parseSoftDenyVote(await this.#applySoft(runCtx, fn, 1), 1, plan.check);
+            const settle = (outcome, round) => {
+                if (outcome.kind === "fail")
+                    return { fail: outcome.reason };
+                if (outcome.kind === "need-agent-answer")
+                    return { decision: "deny", reason: outcome.reason, round };
+                return { decision: outcome.decision, reason: outcome.reason, round: outcome.round };
+            };
+            if (first.kind !== "need-agent-answer")
+                return settle(first, 1);
+            if (plan.rounds === 1 || plan.unattended || !plan.hasAgentAnswer) {
+                return {
+                    decision: "deny",
+                    reason: plan.hasAgentAnswer ? first.reason : "confirmation with no proposal to refer to",
+                    round: 1,
+                };
+            }
+            return settle(parseSoftDenyVote(await this.#applySoft(runCtx, fn, 2), 2, plan.check), 2);
+        }
+        async #applySoft(runCtx, fn, round) {
+            return await applyClassifier(runCtx, fn, [round]);
+        }
+        writeFail(text) {
+            if (this.job.classifierResult !== null)
+                return;
+            if (text.trim() !== "")
+                this.job.classifierAbstain = text;
+            this.job.judgeFails += 1;
+            if (this.scope.closed)
+                return;
+            this.#clearTimer();
+            const n = this.attempt + 1;
+            this.#timer = setTimeout(action("judgeBackoff", () => {
+                this.#timer = undefined;
+                this.attempt = n;
+            }), this.scope.backoffMs(n));
+        }
+        writeFailSticky(text) {
+            if (this.job.classifierResult !== null)
+                return;
+            if (text.trim() !== "")
+                this.job.classifierAbstain = text;
+            this.job.judgeFails = JUDGE_FAILS_FINAL;
+            this.#clearTimer();
+        }
+        #clearTimer() {
+            if (this.#timer === undefined)
+                return;
+            clearTimeout(this.#timer);
+            this.#timer = undefined;
+        }
+    };
+})();
+export { ClassifierHandle };
+//# sourceMappingURL=classifier.js.map