@intentic/constants 1.248.0 → 1.250.0

package/README.md

@@ -14,10 +14,13 @@ The ports, paths and image references the daemon, the CLIs and the desktop app a
 - [src/node.mjs](src/node.mjs): `repoRoot()` and `packageRoot()`, behind the `@intentic/constants/node`
   subpath. Node-only, and hand-written JavaScript rather than compiled TypeScript.
 - [src/assertion-measure.mjs](src/assertion-measure.mjs), [src/contract-shrink.mjs](src/contract-shrink.mjs),
-  [src/control-bytes.mjs](src/control-bytes.mjs) and [src/mirror-roots.mjs](src/mirror-roots.mjs): the four
-  judgments the repository's checkout gates (`_tools/checks/`) and the daemon both make, kept as one copy each.
+  [src/control-bytes.mjs](src/control-bytes.mjs), [src/mirror-roots.mjs](src/mirror-roots.mjs) and
+  [src/ci-infra-steps.mjs](src/ci-infra-steps.mjs): the five judgments the repository's scripts and checks
+  (`_tools/checks/`, `_tools/scripts/ci/ci-audit.mjs`) and the daemon both make, kept as one copy each.
   Hand-written JavaScript for the same reason `node.mjs` is: a gate that runs before `pnpm install` imports them
-  by relative path, and the daemon imports them as subpaths of this package.
+  by relative path, and the daemon imports them as subpaths of this package. `assertion-measure.mjs` carries
+  three of them, not one: which files are test files (`TEST_FILE`), how strong a TypeScript file's assertions
+  are, and how strong a python file's are.
 
 ## How it fits
 
@@ -26,7 +29,10 @@ makes it the home of the few pure judgments a pre-install script and the daemon
 they could both import would need an install to resolve. `mirror-roots.mjs` is the clearest case of that: the
 set of directories an isolated turn overlays is the daemon's business (`agents/isolation.ts` mounts them), and
 whether a build script may `rm -rf` one of them is a checkout gate's business, and the two answers have to be
-the same answer or a name added to one is a directory the other stops protecting. A port number that lives
+the same answer or a name added to one is a directory the other stops protecting. `assertion-measure.mjs` is
+the same shape of problem one level up: the push gate refuses an undeclared weakening and the daemon reports one
+at the Stop, so if the two disagreed about which files are tests, or about what a python `assert` is worth, a
+file could be measured by one and ignored by the other while both claimed to hold the same line. A port number that lives
 in two files is a port number that will eventually be two different numbers, which is the entire argument for
 this package existing. The same argument covers the directory layouts: `/work`, `/history`, `.intentic`,
 `/opt/intentic`: which were previously typed out by hand across dozens of files with nothing linking the copies.

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from "./provider-logos.js";
 export declare const WORKSPACE_ROOT = "/work";
 export declare const HISTORY_ROOT = "/history";
 export declare const STATE_DIR = ".intentic";
+export declare const MEMORY_FILE = "AGENTS.md";
 export declare const HOST_STATE_ROOT = "/opt/intentic";
 export declare const LEGAL_VERSION = "2026-09-03";
 export declare const LEGAL_CONTACT_EMAIL = "contact@intentic.dev";
@@ -82,4 +83,6 @@ export declare const DAEMON_PORT = 8787;
 export declare const PREVIEW_PORT = 5173;
 export declare const LOCAL_PORT = 8788;
 export declare const TRANSLATOR_PORT = 8789;
+export declare const GOOGLE_CLIENT_ID = "481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.apps.googleusercontent.com";
+export declare const GOOGLE_TOKEN_STORAGE_KEY = "intentic.gid.481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.apps.googleusercontent.com";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,qBAAqB,CAAC;AAkBpC,eAAO,MAAM,cAAc,UAAU,CAAC;AAItC,eAAO,MAAM,YAAY,aAAa,CAAC;AAMvC,eAAO,MAAM,SAAS,cAAc,CAAC;AAIrC,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAK/C,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAW1D,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AACtE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAUtC,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAe5C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAK9D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAe3D,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,eAAe;;iBAClB,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACnC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;;iBAGtC,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAC7C,IAAI,EAAE,mBAAmB;iBAAE,IAAI,EAAE,kBAAkB;;;iBAC/C,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAChD,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;;iBAC7B,IAAI,EAAE,WAAW;iBAAE,IAAI,EAAE,UAAU;;;iBACrC,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,WAAW;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,YAAY;;;iBACzC,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,aAAa;;;iBAClC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,cAAc;;;iBAC9C,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,aAAa;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,cAAc;;;iBAC3C,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACjC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;CACQ,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAGzD,eAAO,MAAM,gBAAgB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAGtH,eAAO,MAAM,iBAAiB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAavH,eAAO,MAAM,WAAW,OAAO,CAAC;AAChC,eAAO,MAAM,YAAY,OAAO,CAAC;AASjC,eAAO,MAAM,UAAU,OAAO,CAAC;AAO/B,eAAO,MAAM,eAAe,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,qBAAqB,CAAC;AAOpC,eAAO,MAAM,cAAc,UAAU,CAAC;AAGtC,eAAO,MAAM,YAAY,aAAa,CAAC;AAGvC,eAAO,MAAM,SAAS,cAAc,CAAC;AAKrC,eAAO,MAAM,WAAW,cAAc,CAAC;AAGvC,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAG/C,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAI1D,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AACtE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAGtC,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAG5C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAG9D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAI3D,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,eAAe;;iBAClB,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACnC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;;iBAEtC,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAC7C,IAAI,EAAE,mBAAmB;iBAAE,IAAI,EAAE,kBAAkB;;;iBAC/C,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAChD,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;;iBAC7B,IAAI,EAAE,WAAW;iBAAE,IAAI,EAAE,UAAU;;;iBACrC,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,WAAW;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,YAAY;;;iBACzC,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,aAAa;;;iBAClC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,cAAc;;;iBAC9C,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,aAAa;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,cAAc;;;iBAC3C,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACjC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;CACQ,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAGzD,eAAO,MAAM,gBAAgB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAGtH,eAAO,MAAM,iBAAiB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAIvH,eAAO,MAAM,WAAW,OAAO,CAAC;AAChC,eAAO,MAAM,YAAY,OAAO,CAAC;AAGjC,eAAO,MAAM,UAAU,OAAO,CAAC;AAG/B,eAAO,MAAM,eAAe,OAAO,CAAC;AAGpC,eAAO,MAAM,gBAAgB,6EAA6E,CAAC;AAG3G,eAAO,MAAM,wBAAwB,0FAAqC,CAAC"}

package/dist/index.js

@@ -2,6 +2,7 @@ export * from "./provider-logos.js";
 export const WORKSPACE_ROOT = "/work";
 export const HISTORY_ROOT = "/history";
 export const STATE_DIR = ".intentic";
+export const MEMORY_FILE = "AGENTS.md";
 export const HOST_STATE_ROOT = "/opt/intentic";
 export const LEGAL_VERSION = "2026-09-03";
 export const LEGAL_CONTACT_EMAIL = "contact@intentic.dev";
@@ -36,4 +37,6 @@ export const DAEMON_PORT = 8787;
 export const PREVIEW_PORT = 5173;
 export const LOCAL_PORT = 8788;
 export const TRANSLATOR_PORT = 8789;
+export const GOOGLE_CLIENT_ID = "481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.apps.googleusercontent.com";
+export const GOOGLE_TOKEN_STORAGE_KEY = `intentic.gid.${GOOGLE_CLIENT_ID}`;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,qBAAqB,CAAC;AAkBpC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAItC,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAMvC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAIrC,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAK/C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAW1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAUtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAe5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAK9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAe3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAGlD,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAChE,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IACtD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;IAClD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IACjD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;CACM,CAAC;AAKpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAGtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,mBAAmB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAavH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AASjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAO/B,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,qBAAqB,CAAC;AAOpC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAGtC,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAGvC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAKrC,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAGvC,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAG/C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAI1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAGtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAG5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAG9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAI3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAElD,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAChE,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IACtD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;IAClD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IACjD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;CACM,CAAC;AAKpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAGtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,mBAAmB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAIvH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAGjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAG/B,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAGpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,0EAA0E,CAAC;AAG3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,gBAAgB,EAAE,CAAC"}

package/dist/provider-logos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-logos.d.ts","sourceRoot":"","sources":["../src/provider-logos.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,oBAAoB;aAC7B,MAAM,EAAE,qxDAAqxD;aAC7xD,KAAK,EAAE,s7CAAs7C;aAC77C,IAAI,EAAE,8iBAA8iB;aAGpjB,IAAI,EAAE,iDAAiD;aACvD,MAAM,EAAE,8RAA8R;aAGtS,MAAM,EAAE,0VAA0V;aAGlW,IAAI,EAAE,ksCAAksC;aAIxsC,GAAG,EAAE,yHAAyH;CACxH,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAS9D,eAAO,MAAM,gBAAgB,UAAW,aAAa,KAAG,SAAS,GAAG,SAAgE,CAAC"}
+{"version":3,"file":"provider-logos.d.ts","sourceRoot":"","sources":["../src/provider-logos.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,oBAAoB;aAC7B,MAAM,EAAE,qxDAAqxD;aAC7xD,KAAK,EAAE,s7CAAs7C;aAC77C,IAAI,EAAE,8iBAA8iB;aAEpjB,IAAI,EAAE,iDAAiD;aACvD,MAAM,EAAE,8RAA8R;aAEtS,MAAM,EAAE,0VAA0V;aAElW,IAAI,EAAE,ksCAAksC;aAExsC,GAAG,EAAE,yHAAyH;CACxH,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAK9D,eAAO,MAAM,gBAAgB,UAAW,aAAa,KAAG,SAAS,GAAG,SAAgE,CAAC"}

package/dist/provider-logos.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-logos.js","sourceRoot":"","sources":["../src/provider-logos.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,MAAM,EAAE,qxDAAqxD;IAC7xD,KAAK,EAAE,s7CAAs7C;IAC77C,IAAI,EAAE,8iBAA8iB;IAGpjB,IAAI,EAAE,iDAAiD;IACvD,MAAM,EAAE,8RAA8R;IAGtS,MAAM,EAAE,0VAA0V;IAGlW,IAAI,EAAE,ksCAAksC;IAIxsC,GAAG,EAAE,yHAAyH;CACxH,CAAC;AAUX,MAAM,cAAc,GAA+B,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAyB,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC"}
+{"version":3,"file":"provider-logos.js","sourceRoot":"","sources":["../src/provider-logos.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,MAAM,EAAE,qxDAAqxD;IAC7xD,KAAK,EAAE,s7CAAs7C;IAC77C,IAAI,EAAE,8iBAA8iB;IAEpjB,IAAI,EAAE,iDAAiD;IACvD,MAAM,EAAE,8RAA8R;IAEtS,MAAM,EAAE,0VAA0V;IAElW,IAAI,EAAE,ksCAAksC;IAExsC,GAAG,EAAE,yHAAyH;CACxH,CAAC;AAMX,MAAM,cAAc,GAA+B,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAyB,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/constants",
-  "version": "1.248.0",
+  "version": "1.250.0",
   "description": "Shared constants for the intentic packages, ports, paths, and image references the daemon, CLIs and desktop app all agree on",
   "license": "MIT",
   "type": "module",
@@ -21,7 +21,9 @@
     "src/control-bytes.mjs",
     "src/control-bytes.d.mts",
     "src/mirror-roots.mjs",
-    "src/mirror-roots.d.mts"
+    "src/mirror-roots.d.mts",
+    "src/ci-infra-steps.mjs",
+    "src/ci-infra-steps.d.mts"
   ],
   "exports": {
     ".": {
@@ -51,6 +53,10 @@
       "types": "./src/control-bytes.d.mts",
       "default": "./src/control-bytes.mjs"
     },
+    "./ci-infra-steps": {
+      "types": "./src/ci-infra-steps.d.mts",
+      "default": "./src/ci-infra-steps.mjs"
+    },
     "./mirror-roots": {
       "types": "./src/mirror-roots.d.mts",
       "default": "./src/mirror-roots.mjs"

package/src/assertion-measure.d.mts

@@ -7,8 +7,13 @@ export interface AssertionMeasure {
 }
 export type Weakening = "downgrade" | "narrowing";
 export const NARROWING: number;
+export const TEST_FILE: RegExp;
 export const EXACT: readonly string[];
 export const LOOSE: readonly string[];
+export const PY_EXACT: readonly string[];
+export const PY_LOOSE: readonly string[];
 export function measure(source: string): AssertionMeasure;
+export function measurePython(source: string): AssertionMeasure;
+export function measureFile(source: string, path: string): AssertionMeasure;
 export function weakened(before: AssertionMeasure | undefined, after: AssertionMeasure): Weakening | undefined;
 export function describeWeakening(path: string, shape: Weakening, before: AssertionMeasure, after: AssertionMeasure): string;

package/src/assertion-measure.mjs

@@ -1,63 +1,14 @@
-/* HOW STRONG A TEST FILE'S ASSERTIONS ARE, as three numbers, and whether a second version of the file is weaker.
- *
- * The pure half of the assertion ratchet, shared by the push gate (_tools/scripts/verify/assertion-ratchet.mjs, which
- * runs it over a commit range or the working tree, importing this file by relative path because a pre-push hook
- * runs on a clone that may never have installed) and by the daemon's turn-ending check
- * (_sandbox/sandbox/src/agent/agent-tests.ts, importing it as @intentic/constants/assertion-measure), which asks
- * the same question of the test files a turn touched and tells the model while it can still act. One copy, so
- * the two readers cannot disagree.
- *
- * WHY. On 2026-08-31 eight commits in fifty minutes "relaxed" about 180 test files. `toEqual({ …, message:
- * "Reached Example, authenticated as ada." })` became `toMatchObject({ … })` plus `toContain("ada")`; `"9 of 12
- * files still in your workspace"` became `toContain("9")` and `toContain("12")`; `"Start your first agent"`
- * became `"first agent"`. Every suite stayed green, every gate said yes, and each of those tests can now barely
- * fail. AGENTS.md forbids exactly this ("an assertion that cannot fail is worse than no test") and no linter can
- * enforce it: the shape of a weak `toContain` is the shape of a strong one. What CAN be seen is the direction
- * of travel between two versions of the same file, which is what this measures.
- *
- * THREE NUMBERS PER FILE: EXACT matchers (toBe, toEqual, toStrictEqual, toHaveLength, toHaveBeenCalledWith,
- * snapshots…), LOOSE matchers (toContain, toMatch, toMatchObject, toBeTruthy, toBeGreaterThan, expect.any…), and
- * the characters of literal text the assertions pin down (every string, regex and template run inside a
- * matcher's argument list, comments excluded). A file is weaker in either of two shapes:
- *
- *   · a DOWNGRADE: fewer exact matchers and more loose ones AND no more asserted text than before, the
- *     `toEqual` → `toMatchObject` move. That third clause is what tells the move from its opposite. The move
- *     always SHEDS pinned text — it replaces a whole expected object with a fragment of one — so a file that
- *     ends up pinning more text than it did is doing something else, whatever its matcher mix did. Without the
- *     clause the rule read absolute counts with no sense of scale, and a suite that grew by five tests and 247
- *     characters of expectation was refused for turning one `toEqual({})` — an exact matcher asserting that a
- *     result is EMPTY — into `toMatchObject({ permissionDecision: "deny" })`, which pins a value the old
- *     assertion could not see. One matcher moved from the exact column to the loose one and the file got
- *     stronger. Over the 400 commits before this clause was written it changes exactly one verdict, and that
- *     one was wrong.
- *   · a NARROWING: the asserted text shrinks by more than a quarter while the file keeps as many tests as it had,
- *     the "first agent" move. Tests removed with their text are not a narrowing, and the test count says so.
- *     Deliberately left on absolute ratio with no floor and no exemption for a file whose matcher mix improved:
- *     both were tried against the same 400 commits and both cost more than they bought. A floor big enough to
- *     excuse an 85→52 character file exempts 60% of the repository's test files, because the median test file
- *     pins only 110 characters; and exempting "the exact count went up while the loose count went down" lets a
- *     commit gut six text assertions and buy the exemption with one added `toBe`, which is a real commit
- *     (daf77486) this would then have missed. Of the 62 narrowings in that range, 60 sit on commits whose own
- *     subject says they relaxed assertions. The two that do not are a `toEqual({…})` replaced by
- *     `toBeUndefined()` and a 33-character trim — both worth a reviewer's eye, which is all a flag asks for.
- *
- * A HEURISTIC, AND SAID TO BE ONE. A refactor that replaces twenty `toBe` lines with one `toEqual` of a whole
- * object reads as fewer exact matchers; a suite that switches from asserting prose to asserting structure reads
- * as narrowing. Both are legitimate, and both are exactly the changes a reviewer should be told about, which is
- * why the gate refuses only an UNDECLARED weakening and the turn-ending check reports rather than refuses.
- *
- * Deliberately regex over source, not an AST: this runs from a pre-push hook on a clone that may never have
- * installed, so it can import nothing, and the matchers it counts are names, which a regex reads as well as a
- * parser does. It cannot see a matcher called through a helper (`expectRow(row).toBe(…)` counts, `check(row)`
- * does not), which is the direction of error that under-reports rather than nags. */
+// Three numbers per test file (exact matchers, loose matchers, asserted-text characters) that flag a weaker second
+// version; shared by the push gate and the daemon's turn-ending check so both agree. Regex over source, not an AST,
+// since the push gate runs before install.
 
 // Asserted text that shrinks past this fraction of what it was, with no test removed, is a narrowing.
 export const NARROWING = 0.75;
 
-/* The vocabulary. Exact matchers pin a value; loose ones admit a family of them. `toThrow` and `toHaveProperty`
- * are both depending on their arguments (a message or a value makes them exact) and are counted as neither, so
- * a file that trades between them moves no number. Asymmetric matchers (`expect.any`, `objectContaining`) loosen
- * whatever exact matcher they sit inside, so each one counts as loose. */
+// Test file naming this ratchet knows: `foo.test.ts`/`foo.spec.tsx`, or pytest's `test_foo.py`/`foo_test.py`.
+export const TEST_FILE = /(\.(test|spec)\.[cm]?[jt]sx?|(^|\/)(test_[^/]+|[^/]+_test)\.py)$/;
+
+// toThrow/toHaveProperty count as neither (an argument makes them exact); expect.any always counts as loose.
 export const EXACT = [
     "toBe",
     "toEqual",
@@ -105,23 +56,9 @@ const ASYMMETRIC = /\bexpect\.(any|anything|stringContaining|stringMatching|obje
 const MATCHER = /\.(to[A-Z][A-Za-z]*)\s*\(/g;
 const TEST_CASE = /^\s*(?:test|it)(?:\.(?:each|skip|only|concurrent|todo|fails|skipIf|runIf))?\s*\(/gm;
 
-/* The literal text a matcher's argument list pins down: from the `(` that opens it to the `)` that closes it,
- * every string literal's characters, every regex's source, and every static run of a template. Walked by hand
- * because a matcher's argument is routinely a multi-line object with nested calls, which no single regex can
- * bound.
- *
- * COMMENTS ARE SKIPPED FIRST, and that is not tidiness. Assertions here are routinely commented one by one,
- * the prose says "the owner's" and "the agent's", and to a walker that reads an apostrophe as an opening quote
- * that comment is a string running to the next apostrophe — over the `)` that closes the matcher, over the
- * tests below it, to the end of the file. The number that came back was not an overcount of one file's text so
- * much as a coin flip on how many apostrophes the prose happened to hold, and editing a comment landed a
- * "narrowing" on a file whose assertions nobody had touched.
- *
- * A TEMPLATE'S STATIC RUNS COUNT, only its `${…}` does not. `${STATE_DIR}/config/safety.md` pins seventeen
- * characters of path and one interpolation, and reading the whole literal as computed made every assertion in
- * a repository that composes its paths from constants — which this one requires, see _tools/checks/path-literals.mjs —
- * look like an assertion about nothing. */
-// Past a template's `${…}`, by brace depth: the expression inside is computed, so none of it is asserted text.
+// Text a matcher's argument list pins, walked by hand (args can be multi-line, nested calls). Comments are stripped
+// first so a comment's apostrophe can't read as an open quote; a template's static runs count, its `${…}` does not.
+// Skips past a template's `${…}` by brace depth; the expression inside is computed, not asserted text.
 const pastInterpolation = (source, from) => {
     let braces = 1;
     let i = from + 2;
@@ -132,7 +69,7 @@ const pastInterpolation = (source, from) => {
     return i;
 };
 
-// A template literal, from its opening backtick: the characters of its static runs, and where it ends.
+// A template literal from its opening backtick: the character count of its static runs, and where it ends.
 const templateChars = (source, from) => {
     let chars = 0;
     let run = from + 1;
@@ -190,7 +127,7 @@ const assertedChars = (source, from) => {
             chars += template.chars;
             i = template.end;
         } else if (ch === "/" && /[(,\s=]/.test(source[i - 1] ?? "(")) {
-            // A regex literal in argument position: its source is asserted text like a string's.
+            // A regex literal in argument position; its source counts as asserted text like a string's.
             let j = i + 1;
             for (; j < source.length && source[j] !== "/" && source[j] !== "\n"; j += 1) {
                 if (source[j] === "\\") {
@@ -223,13 +160,173 @@ export const measure = (source) => {
     return { exact: exactCount, loose: looseCount, chars, tests };
 };
 
-// Weaker, in either of the two shapes the header names. `before` absent (a new file) can only be stronger.
+// Same three numbers over Python's `assert` statements and unittest methods, mapped onto the same vocabulary (`==`/`is`
+// exact, `in`/comparisons/bare assert loose, `approx(...)` loosens). A compound assert counts toward both exact and
+// loose. assertRaises counts as neither, like toThrow.
+export const PY_EXACT = [
+    "assertEqual",
+    "assertNotEqual",
+    "assertIs",
+    "assertIsNot",
+    "assertIsNone",
+    "assertIsNotNone",
+    "assertListEqual",
+    "assertDictEqual",
+    "assertSetEqual",
+    "assertTupleEqual",
+    "assertSequenceEqual",
+    "assertMultiLineEqual",
+    "assertCountEqual",
+    "assertAlmostEqual",
+];
+export const PY_LOOSE = [
+    "assertTrue",
+    "assertFalse",
+    "assertIn",
+    "assertNotIn",
+    "assertIsInstance",
+    "assertNotIsInstance",
+    "assertGreater",
+    "assertGreaterEqual",
+    "assertLess",
+    "assertLessEqual",
+    "assertRegex",
+    "assertNotRegex",
+    "assertWarns",
+    "assertLogs",
+];
+const pyExact = new Set(PY_EXACT);
+const pyLoose = new Set(PY_LOOSE);
+
+const PY_EXACT_OP = /==|!=|\bis\b/;
+const PY_LOOSE_OP = /\bin\b|<=|>=|<|>|\bisinstance\s*\(|\bapprox\s*\(/;
+const PY_ASSERT = /^[ \t]*assert\b/gm;
+const PY_METHOD = /\bassert[A-Z][A-Za-z]*\s*\(/g;
+const PY_TEST_CASE = /^[ \t]*(?:async\s+)?def\s+test\w*\s*\(/gm;
+
+// One pass blanks every comment and string's contents (same length as source, so offsets line up) and counts each
+// string's characters by position. Must be one pass: a `#` inside a string is not a comment and a quote inside a
+// comment doesn't open a string; triple-quoted strings are tracked since a docstring spans lines.
+// Blanks one string literal in `code`, counts its characters in `text`, and returns where it ends. A single-quoted
+// string stops at the next newline so one stray quote can't blank the rest of the file.
+const blankString = (source, code, text, start) => {
+    const ch = source[start];
+    const quote = source.startsWith(ch.repeat(3), start) ? ch.repeat(3) : ch;
+    let i = start + quote.length;
+    while (i < source.length && !source.startsWith(quote, i)) {
+        if (quote.length === 1 && source[i] === "\n") {
+            return i;
+        }
+        text[i] = 1;
+        code[i] = " ";
+        i += source[i] === "\\" ? 2 : 1;
+    }
+    return Math.min(i + quote.length - 1, source.length - 1);
+};
+
+const blankComment = (source, code, start) => {
+    let i = start;
+    while (i < source.length && source[i] !== "\n") {
+        code[i] = " ";
+        i += 1;
+    }
+    return i;
+};
+
+const blankPython = (source) => {
+    const code = [...source];
+    const text = new Uint8Array(source.length);
+    for (let i = 0; i < source.length; i += 1) {
+        const ch = source[i];
+        if (ch === "#") {
+            i = blankComment(source, code, i);
+        } else if (ch === '"' || ch === "'") {
+            i = blankString(source, code, text, i);
+        }
+    }
+    return { code: code.join(""), text };
+};
+
+const OPENERS = new Set(["(", "[", "{"]);
+const CLOSERS = new Set([")", "]", "}"]);
+
+// End of the statement starting at `from`: first newline at bracket depth zero, not escaped by a trailing backslash.
+// Reads the blanked code, so a bracket or backslash inside a string can't extend it.
+const statementEnd = (code, from) => {
+    let depth = 0;
+    for (let i = from; i < code.length; i += 1) {
+        const ch = code[i];
+        depth += OPENERS.has(ch) ? 1 : 0;
+        depth -= CLOSERS.has(ch) ? 1 : 0;
+        const ends = ch === "\n" && depth <= 0 && code[i - 1] !== "\\";
+        if (ends) {
+            return i;
+        }
+    }
+    return code.length;
+};
+
+const charsIn = (text, from, to) => {
+    let chars = 0;
+    for (let i = from; i < to; i += 1) {
+        chars += text[i];
+    }
+    return chars;
+};
+
+// Classifies each `assert` statement by the operators it uses.
+const assertStatements = (code, text) => {
+    const totals = { exact: 0, loose: 0, chars: 0 };
+    for (const match of code.matchAll(PY_ASSERT)) {
+        const end = statementEnd(code, match.index);
+        const statement = code.slice(match.index, end);
+        const isExact = PY_EXACT_OP.test(statement);
+        // No operator at all is a bare truthiness assert; it admits anything that is not falsy.
+        totals.exact += isExact ? 1 : 0;
+        totals.loose += PY_LOOSE_OP.test(statement) || !isExact ? 1 : 0;
+        totals.chars += charsIn(text, match.index, end);
+    }
+    return totals;
+};
+
+// unittest's assertion methods, classified by name like a matcher.
+const assertMethods = (code, text) => {
+    const totals = { exact: 0, loose: 0, chars: 0 };
+    for (const match of code.matchAll(PY_METHOD)) {
+        const name = match[0].slice(0, match[0].search(/\s*\(/));
+        // A name in neither set (assertRaises, a project helper) counts as neither, and its text is not counted.
+        if (!pyExact.has(name) && !pyLoose.has(name)) {
+            continue;
+        }
+        totals.exact += pyExact.has(name) ? 1 : 0;
+        totals.loose += pyLoose.has(name) ? 1 : 0;
+        totals.chars += charsIn(text, match.index, statementEnd(code, match.index));
+    }
+    return totals;
+};
+
+export const measurePython = (source) => {
+    const { code, text } = blankPython(source);
+    const statements = assertStatements(code, text);
+    const methods = assertMethods(code, text);
+    return {
+        exact: statements.exact + methods.exact,
+        loose: statements.loose + methods.loose,
+        chars: statements.chars + methods.chars,
+        tests: [...code.matchAll(PY_TEST_CASE)].length,
+    };
+};
+
+// Decides which measure a file gets, by extension, so both readers agree. An unrecognized file falls to the TypeScript
+// measure, which reads it as zero of everything, so it's silently unmeasured rather than wrongly flagged.
+export const measureFile = (source, path) => (path.endsWith('.py') ? measurePython(source) : measure(source));
+
+// Weaker, in either of the two shapes measured. A new file, with no before, can only be stronger.
 export const weakened = (before, after) => {
     if (before === undefined) {
         return undefined;
     }
-    // The third clause is the scale the first two have none of: see the header. A file that pins MORE text than
-    // it did is not making the `toEqual` → `toMatchObject` move, whichever way its matcher counts went.
+    // More text pinned than before rules out a toEqual→toMatchObject move, whatever the matcher counts did.
     if (after.exact < before.exact && after.loose > before.loose && after.chars <= before.chars) {
         return "downgrade";
     }
@@ -239,6 +336,6 @@ export const weakened = (before, after) => {
     return undefined;
 };
 
-// One line per weakened file, the numbers a reader needs to judge the heuristic for themselves.
+// One line per weakened file, with the numbers a reader needs to judge the heuristic themselves.
 export const describeWeakening = (path, shape, before, after) =>
     `${path}: ${shape} (exact ${before.exact}→${after.exact}, loose ${before.loose}→${after.loose}, asserted chars ${before.chars}→${after.chars}, tests ${before.tests}→${after.tests})`;

package/src/ci-infra-steps.d.mts

@@ -0,0 +1,3 @@
+// Types for ci-infra-steps.mjs, the one list of runner-owned job steps the CI board and the audit script share.
+export const INFRA_STEP: RegExp;
+export function isInfraStep(name: string): boolean;

package/src/ci-infra-steps.mjs

@@ -0,0 +1,6 @@
+// The steps of a CI job the runner owns, not the repository: a failure in one says the fleet died before any step of
+// the checkout ran, so it is nothing an agent on the code can fix. One list, read by the daemon's CI board and by
+// _tools/scripts/ci/ci-audit.mjs.
+export const INFRA_STEP = /^(Set up job|Set up runner|Initialize containers|Stop containers|Complete job|Post .*)$/;
+
+export const isInfraStep = (name) => INFRA_STEP.test(name);

package/src/contract-shrink.mjs

@@ -1,30 +1,8 @@
-/* WHAT A WIRE-CONTRACT LOCK LOST, as one comparison shared by everything that asks it.
- *
- * contract.lock.json is the sandbox-contract package's exported schemas as one comparable document
- * (_sandbox/sandbox-contract/src/contract-lock.ts explains the pair). Three readers ask what a newer lock no
- * longer offers: the checkout gate that refuses an undeclared shrink at the push (_tools/checks/contract-shrink.mjs),
- * the landing drafter that forces the `!` and the Breaking-Note into the commit message
- * (_sandbox/sandbox/src/git/contract-shrink.ts), and the tests that hold both to the same judgment. One
- * implementation here, hand-written JavaScript rather than compiled TypeScript for the same reason node.mjs
- * beside it is: the gate runs before `pnpm install`, so it imports this file by relative path and nothing else.
- *
- * ADDITIONS NEVER APPEAR IN THE RESULT. Every reader of the wire parses loosely, so growth breaks nobody, and a
- * detector that flagged growth would put a false `!` on ordinary work.
- *
- * ARRAYS ARE THE SCHEMA'S COLLECTIONS (`oneOf` alternatives, `enum` values, `required` names) and the lock
- * writer keeps them in declaration order rather than sorting, so a position means nothing on its own: every
- * base element must be matched by SOME head element, and extras pass in silence exactly like a new property
- * does. An element that merely changed reads as removed: the same verdict either way.
- *
- * `description` AS A KEYWORD IS PROSE, AND PROSE IS NOT A PROMISE. zod's `.describe()` rides into the lock
- * beside the shape, so re-wording a help sentence used to read as "a surface changed" and demand a `!` commit.
- * Nothing on the wire moves when it does. It is skipped ONLY as a keyword: 78 schemas in this lock carry a
- * real field NAMED `description`, and losing one of those is a genuine break, so the walk tracks whether the
- * object it is reading is a name map (keys are fields) or a schema (keys are keywords). */
+// What base offers that head no longer does, as dotted paths; shared by the push gate and the commit drafter so both
+// draw the same verdict. Growth never appears in the result; array elements match unordered, so a moved element passes.
+// `description` is skipped only as a schema keyword, not when it names an actual field.
 
-// The JSON Schema keywords whose value is a map of NAME to schema: inside one a key is a field the wire
-// carries, everywhere else a key is a keyword. The lock's own root is one too (its keys are the exported
-// schema names), which is why the walk starts `named`.
+// JSON Schema keywords whose value maps NAME to schema; inside one a key is a field, elsewhere a keyword.
 const NAME_MAPS = new Set(["properties", "patternProperties", "$defs", "definitions"]);
 
 const dotted = (at, key) => (at === "" ? key : `${at}.${key}`);
@@ -64,9 +42,7 @@ export const shrunkSurfaces = (base, head, at = "", out = [], named = true) => {
     return out;
 };
 
-// The same comparison over the two texts of a lock file. Either side failing to parse yields NO shrink rather
-// than a throw: one reader feeds a commit-message draft, and a mangled lock is the contract-lock test's failure
-// to report, not a reason to draft nothing.
+// Same comparison over two lock-file texts; either side failing to parse yields no shrink rather than a throw.
 export const lockShrinkage = (baseText, headText) => {
     try {
         return shrunkSurfaces(JSON.parse(baseText), JSON.parse(headText));

package/src/control-bytes.mjs

@@ -1,16 +1,8 @@
-/* THE BYTES THAT MAKE A TEXT FILE BINARY, named once for everything that polices them: the checkout gate
- * (_tools/checks/control-chars.mjs, every tracked file), and the daemon's per-edit reader (the `bytes-edit`
- * rule's script), which asks the same question of one file the moment it is written.
- *
- * A NUL typed straight into a string literal is invisible in an editor and decisive everywhere else: git, grep,
- * `file`, code review and every diff viewer sniff for one and call the whole file binary. The escape
- * (backslash-u-0000) is the same code point at runtime and leaves the file text, so every reader here asks for
- * it and nothing else. Hand-written JavaScript rather than compiled TypeScript so a pre-push hook on a clone
- * that never installed can import it by relative path. */
+// Bytes that make a text file binary, checked once here for the checkout gate and the daemon's per-edit reader. A NUL
+// reads as binary everywhere (git, grep, diff viewers); its backslash-u-0000 escape is the same code point at runtime
+// but stays text.
 
-// What is allowed to hold arbitrary bytes. Extensions, not paths: an image is an image wherever it lands.
-// Genuinely binary content is skipped by extension rather than by sniffing, because sniffing is exactly the
-// thing that goes wrong here: a source file that LOOKS binary is the bug, not the exemption.
+// Extensions allowed arbitrary bytes, skipped by name not sniffed: binary-looking source is the bug.
 export const BINARY_EXTENSIONS = new Set([
     "png",
     "jpg",
@@ -43,13 +35,11 @@ export const BINARY_EXTENSIONS = new Set([
 
 export const isBinaryPath = (path) => BINARY_EXTENSIONS.has(path.split(".").pop()?.toLowerCase() ?? "");
 
-// C0 controls minus the three every text file legitimately contains (tab, newline, carriage return). DEL rides
-// along: it is as invisible as the rest and has no business in source either.
+// C0 controls minus tab/newline/CR; DEL rides along, equally invisible and out of place in source.
 export const isForbiddenByte = (byte) => byte <= 0x08 || byte === 0x0b || byte === 0x0c || (byte >= 0x0e && byte <= 0x1f) || byte === 0x7f;
 
-// The first forbidden byte in a buffer as `{ offset, line, column, byte }`, or undefined for a clean file.
-// One report per file is enough to send someone to it. Sliced only for a byte already known to be bad, so
-// the clean file, the overwhelmingly common case, pays for one linear scan and nothing else.
+// First forbidden byte as {offset, line, column, byte}, or undefined if none; slices only once a bad byte is found, so
+// a clean file costs one linear scan.
 export const firstForbiddenByte = (bytes) => {
     for (let at = 0; at < bytes.length; at++) {
         if (isForbiddenByte(bytes[at])) {

package/src/mirror-roots.mjs

@@ -1,102 +1,34 @@
-/* THE DIRECTORIES AN ISOLATED TURN MOUNTS OVER, and the one thing the main checkout must never do to them.
- *
- * A worktree holds TRACKED files only, so the two trees a package's dependents resolve THROUGH — its installed
- * tree (`node_modules`) and its build output (`dist`, `generated`) — cannot be checked out and have to come
- * from the main tree. The daemon supplies them as overlayfs mounts, one per directory, the MAIN checkout's copy
- * as the lowerdir and a per-conversation upper layer for whatever the turn writes
- * (_sandbox/sandbox/src/agents/isolation.ts, which imports this set rather than keeping its own).
- *
- * AN OVERLAY RESOLVES ITS LOWERDIR ONCE, AT MOUNT TIME, and holds that dentry for the life of the mount.
- * Rewriting the FILES inside it is harmless, and that is the whole reason mirroring a build directory works at
- * all: measured on this image (ext4 lower, kernel 6.18), unlinking every file in the lower root and writing new
- * ones is picked up by the merged view immediately, entry for entry. REPLACING THE DIRECTORY ITSELF is not.
- * `rm -rf dist` followed by a `mkdir` gives that path a new inode; the mount keeps pointing at the old one, and
- * the merged directory then reads as COMPLETELY EMPTY — not even the entries in the turn's own upper layer,
- * though `stat` on any of those upper files still succeeds, which is what makes the symptom so hard to read.
- * `mount -o remount` does not repair it. Only umount/mount does, and nothing inside the turn can do either: the
- * mount root is the one lower directory a turn cannot shadow with a write of its own.
- *
- * That is not a hazard someone imagined. It is what `_platform/prisma`'s build script did: `rm -rf ./generated
- * ./dist ./.cache` ahead of `prisma generate`. Run on the main tree by `turbo run build` — the push gate's third
- * tier, the image-tree prep, an owner typing `pnpm build` — it replaced the lowerdir of every live agent
- * worktree's `_platform/prisma/generated` overlay at once. Each of those turns was then holding a directory with
- * a freshly generated `client.ts` in it that `readdir` reported as empty, so the `"include": ["./generated/**"]`
- * glob in that package's tsconfig matched nothing and the declarations emit died with
- *
- *     _platform/prisma/client.ts(1,15): error TS6307: File '.../generated/client.ts' is not listed within the
- *     file list of project '.../_platform/prisma/tsconfig.json'
- *
- * on the turn-ending check of every conversation, whatever the turn had actually changed. A gate that is red for
- * a reason no turn caused is the failure mode docs/ci-failure-audit.md exists to hunt, and it teaches everyone
- * reading it that a red check is background noise.
- *
- * WHY THE RULE IS ABOUT THE MOUNT ROOT AND NOT ABOUT EVERY DIRECTORY UNDER IT. `prisma generate` does the same
- * remove-and-recreate to `generated/models` and `generated/internal` on every run, and no rule here could stop
- * it — that is a third-party generator's business. It does not have to be stopped: a turn's own generate rmdirs
- * those same subdirectories through the MERGED view first, which leaves an opaque upper directory the stale
- * lower can no longer reach. Only the mount root has no such repair, which is exactly where this rule sits.
- *
- * So: EMPTY A MIRRORED DIRECTORY, NEVER REPLACE IT. _tools/scripts/build/clean-outputs.mjs is what does that, and
- * _tools/checks/mirror-roots.mjs refuses the shape wherever a shell command in this repository spells it.
- *
- * Hand-written JavaScript rather than compiled TypeScript for the reason node.mjs gives: the checkout gate that
- * enforces this imports it by relative path from a clone that has never installed, and the daemon imports the
- * same file as `@intentic/constants/mirror-roots`. */
+// Directories an isolated turn's overlay mounts over (node_modules, .venv, dist, generated): emptying them is safe, but
+// replacing the directory (rm -rf then mkdir) orphans the mount at its old inode, and only umount/mount repairs it.
+// _tools/checks/mirror-roots.mjs refuses the replacing shape; clean-outputs.mjs does the emptying instead.
 
-// The directory NAMES a turn overlays, discovered by name wherever they appear in the tree (isolation.ts walks
-// for them). Caches are deliberately absent, and that absence is load-bearing: see the MIRRORED_DIRS comment in
-// isolation.ts for why a mirrored `.cache` would hand a turn the main checkout's idea of what its dist was
-// built from. Nothing mounts a `.cache`, so it is free to be removed outright, and the build scripts fixed for
-// this still do exactly that to theirs.
-export const MIRRORED_DIRS = new Set(["node_modules", "dist", "generated"]);
+// Overlaid directory names; `.cache` is deliberately excluded and `.venv` is python's node_modules.
+export const MIRRORED_DIRS = new Set(["node_modules", ".venv", "dist", "generated"]);
 
-// A path's last segment, with quotes and trailing slashes taken off. `"$PKG/dist"` and `./generated/` both name
-// a mirror root; `node_modules/.pnpm/onnxruntime-web@*` does not, and neither does `dist/*`, which removes the
-// CONTENTS and leaves the inode alone.
+// Last path segment, quotes and trailing slash stripped; `dist/*` (contents) is not a match, only the directory itself
+// is.
 const lastSegment = (token) => {
     const bare = token.replace(/^['"]|['"]$/g, "").replace(/\/+$/, "");
     return bare.slice(bare.lastIndexOf("/") + 1);
 };
 
-/* One shell word at a time, quotes kept so `lastSegment` can strip them and a quoted `'{}'` still reads as the
- * find placeholder it is. Not a shell parser and not trying to be: what this has to recognize is a removal
- * someone WROTE, and every one of those in this repository is a plain sequence of words. */
+// Splits into shell words, keeping quotes so lastSegment can strip them (and `'{}'` reads as find's placeholder); not a
+// shell parser.
 const tokenize = (segment) => segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
 
-/* The verbs that can remove a directory, and the words that may stand in front of one. `docker rm -f <name>`
- * removes a container and `find … -exec rm -rf {} +` removes files, so the preceding word is what tells them
- * apart: a removal is a COMMAND here, or the thing an exec/sudo/xargs runs, never an argument to something
- * else. (It costs nothing to be wrong about `docker rm` anyway — it is never recursive — but a check that
- * reports a container by name would be read as noise, and a noisy gate gets switched off.) */
+// Verbs that remove a directory, and words that may precede one; the word before tells command from argument.
 const REMOVERS = new Set(["rm", "rmdir", "rimraf"]);
 const RUNNERS = new Set(["exec", "-exec", "-execdir", "sudo", "xargs", "then", "do", "else", "{", "(", "npx", "pnpm", "bunx", "yarn"]);
-// `-rf`, `-fr`, `-Rf`, `-r`, `--recursive`. A non-recursive `rm` cannot take a directory at all, so it can
-// never be the operation this is about: `rm -f dist.zip` is fine and must stay unreported. (It is also what
-// keeps `pnpm rm <package>`, an uninstall, out of this: nothing there is recursive.)
+// Recursive rm flags (-rf, -fr, -Rf, -r, --recursive); a non-recursive rm can't take a directory at all.
 const RECURSIVE = /^(?:--recursive$|-[a-zA-Z]*[rR])/;
-// Where a `find -exec` command ends. Everything after it belongs to the find again.
+// Where a find -exec command ends; everything after belongs to find again.
 const EXEC_END = new Set([";", "\\;", "+"]);
 const PLACEHOLDER = /^['"]?\{\}['"]?$/;
-// The find predicates that NAME what will be removed, and the one that makes a find safe: `-mindepth 1` never
-// yields the directory it started from, which is precisely how you empty a tree without replacing its root.
+// find predicates naming what will be removed.
 const NAME_PREDICATES = new Set(["-name", "-iname", "-path", "-wholename", "-ipath"]);
 
-/* WHICH MIRROR ROOTS A SHELL COMMAND WOULD REPLACE, as the operands were written, so a report can quote them.
- *
- * Two shapes, because those are the two ways this repository has ever spelled it:
- *   · a literal removal — `rm -rf ./generated ./dist ./.cache`, `rm -rf "$PKG/dist"`
- *   · a find that removes what it names — `find . \( -name 'node_modules' -o -name 'dist' \) -prune -exec rm
- *     -rf '{}' +`, where the removal's own operand is a placeholder and the find's predicates say what it hits.
- *
- * Split on the separators that end one command, so `a && rm -rf dist` is two commands and a `find … -exec rm …`
- * stays one: only inside a single command do a find's predicates describe that removal's operands.
- *
- * A FIND IS READ WHOLE, AND THAT ROUNDS TOWARDS REFUSING. `find . -name node_modules -prune -o -name dist
- * -prune -exec rm -rf {} +` removes only the second name; the first is pruned past. Telling them apart means
- * implementing find's expression grammar — `-o`, `-a`, `-prune` and their precedence — for a distinction that
- * changes nothing about the answer, since the safe rewrite is the same either way and neither name may be
- * REMOVED by a command running in the checkout. So every `-name` in a removing find is reported, and the fix
- * for a false one is the fix for a true one. */
+// Mirror roots a shell command would replace, split into commands on &&/;/|. Recognizes a literal removal and a find
+// whose predicates name what -exec/-delete removes; over-reports a pruned name rather than parsing -o/-prune.
 export const replacedMirrorRoots = (command) => {
     const found = [];
     for (const segment of command.split(/\|\||&&|[;|\n]/)) {
@@ -107,7 +39,7 @@ export const replacedMirrorRoots = (command) => {
             continue;
         }
         const named = tokens.flatMap((token, at) => (NAME_PREDICATES.has(token) && tokens[at + 1] !== undefined ? [tokens[at + 1]] : []));
-        // `find -delete` removes what the predicates name, with no `rm` anywhere in the line to notice.
+        // `find -delete` removes what the predicates name, with no `rm` on the line to notice.
         if (tokens.includes("-delete")) {
             found.push(...named.filter((token) => MIRRORED_DIRS.has(lastSegment(token))));
         }
@@ -132,7 +64,7 @@ export const replacedMirrorRoots = (command) => {
                 continue;
             }
             for (const operand of operands) {
-                // A `{}` is the find's placeholder: what it stands for is whatever the predicates named.
+                // A `{}` is find's placeholder: it stands for whatever the predicates named.
                 const targets = PLACEHOLDER.test(operand) ? named : [operand];
                 found.push(...targets.filter((target) => MIRRORED_DIRS.has(lastSegment(target))));
             }

package/src/node.mjs

@@ -2,57 +2,24 @@ import { existsSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-/* FINDING A ROOT BY LOOKING FOR IT, INSTEAD OF COUNTING THE WAY UP TO IT.
- *
- * Two dozen files used to work out where the monorepo root was by counting how deep they sat: `../..` from a
- * package's own directory, `../../..` from its `src/`, `../../../..` from the installer scripts. Every one of
- * those numbers is correct only for the file's CURRENT depth, and nothing anywhere checks it. Move the file
- * one directory and it silently resolves somewhere else: no import fails, no type breaks; you find out when
- * something reads the wrong .env at runtime, or reads nothing and falls back to a default.
- *
- * Walking up until a marker appears has none of that coupling. A file can sit at any depth, move between
- * packages, or be symlinked in, and still get the same answer.
- *
- * WHY THIS FILE IS HAND-WRITTEN JAVASCRIPT rather than TypeScript compiled to dist, in a package where
- * everything else is compiled: the earliest callers run BEFORE anything is built. `emit-declarations.mjs` is the script
- * that performs the build, and the byte check and the path guard both run ahead of it in `pnpm checks`. A
- * helper those three had to import from `dist/` would be a helper they could not import on a clean checkout,
- * which is exactly how the second copy of this walk gets written. Plain .mjs with a hand-written .d.mts beside
- * it is importable at every point in the build, so there only has to be one.
- *
- * A caller that runs before `pnpm install` has one more constraint: `@intentic/constants/node` is a BARE
- * specifier and bare specifiers resolve through node_modules, which a bare checkout has none of. Those callers
- * (`_tools/checks/*.mjs`, run by the pre-push hook and by CI's preflight job) import THIS FILE by relative path
- * instead. Still one walk; only the way in differs.
- *
- * NOT EXPORTED FROM THE PACKAGE INDEX, and that is deliberate: the index is imported by browser code
- * (Setup.vue reads PLATFORM_WEB_ORIGIN) and must never pull in node:fs. Path VALUES live there; path DISCOVERY
- * lives here, behind the `@intentic/constants/node` subpath. */
+// Finds the monorepo root by walking up to a marker (pnpm-workspace.yaml), not by counting `../..`, which broke
+// silently whenever a file moved. Kept out of the package index (browser-safe, no node:fs) and hand-written as plain
+// .mjs so callers can import it before install or build.
 
-// The marker that identifies the monorepo root. pnpm-workspace.yaml rather than package.json or .git: a
-// package.json sits in all 78 packages, and .git is absent in an agent worktree's checkout and present in
-// unrelated parents. This file exists exactly once, at exactly the directory everyone means by "the root".
+// Root marker; not package.json (in every package) or .git (absent in a worktree, present in other parents).
 const REPO_MARKER = "pnpm-workspace.yaml";
 
-/* Where the caller is, from whichever of the three things it has in hand. `import.meta.url` is a file:// URL
- * and needs converting; `import.meta.dirname` and a bare path are already paths. Accepting all three is what
- * stops a caller reaching for `fileURLToPath(new URL("...", import.meta.url))` out of habit and reintroducing
- * a relative segment on the way in. */
+// Caller's directory from a file:// URL, import.meta.dirname, or a bare path; accepting all three avoids callers
+// composing their own relative path.
 const startDir = (from) => {
     const path = from.startsWith("file:") ? fileURLToPath(from) : resolve(from);
-    /* A URL or path naming a FILE has to become its directory; one naming a directory is already there. Asked
-     * of the filesystem rather than guessed from the shape, because `.../src/lib` and `.../lib/version.js` are
-     * indistinguishable as strings.
-     *
-     * A path that does not exist is treated as a directory, and costs nothing when it isn't: the walk simply
-     * finds no marker at that level and moves to the parent, which is where a non-existent file's directory
-     * was all along. */
+    // Resolved via the filesystem, not guessed from the string; a path that doesn't exist is treated as a directory at
+    // no cost.
     return statSync(path, { throwIfNoEntry: false })?.isDirectory() === false ? dirname(path) : path;
 };
 
-// Walk up from `dir` until `marker` is found beside us, or we run out of parents. Returns "" for not-found so
-// each caller decides whether that is fatal: the installers treat it as "not run from a checkout" and carry
-// on, while everything inside the repo treats it as impossible and throws.
+// Walks up from `dir` until `marker` appears beside it, or parents run out (returns ""); callers decide whether that's
+// fatal.
 const walkUp = (dir, marker) => {
     let current = dir;
     for (;;) {
@@ -67,12 +34,8 @@ const walkUp = (dir, marker) => {
     }
 };
 
-/* THE MONOREPO ROOT, from anywhere inside it. Pass `import.meta.url`: the caller's own location is the only
- * thing this needs, and it is the one thing every module already knows about itself.
- *
- * Throws when the marker is nowhere above the caller, which inside this repo means the checkout is broken. The
- * throw is the point: the counting version's failure mode was to return a WRONG directory confidently, and a
- * wrong directory is how a config loader silently reads no .env and every credential arrives empty. */
+// Monorepo root from anywhere inside it (pass import.meta.url). Throws if the marker is nowhere above, rather than
+// resolving to a confidently wrong directory.
 export const repoRoot = (from) => {
     const found = walkUp(startDir(from), REPO_MARKER);
     if (found === "") {
@@ -81,11 +44,8 @@ export const repoRoot = (from) => {
     return found;
 };
 
-/* THE CALLING PACKAGE'S OWN ROOT: the directory its package.json sits in. The other thing the dot-counting
- * was reaching for: `createRequire(import.meta.url)("../../package.json")` in three different version.ts files,
- * each with a different number of dots because each sat at a different depth, all of them meaning "mine".
- *
- * Stops at the FIRST package.json above the caller, so a package's own manifest always wins over the root's. */
+// Caller's own package root: the directory nearest above it holding a package.json. Stops at the first match, so a
+// package's own manifest always wins over the root's.
 export const packageRoot = (from) => {
     const found = walkUp(startDir(from), "package.json");
     if (found === "") {