@intentic/sandbox-contract 1.168.0 → 1.170.0

package/src/schemas.ts

@@ -414,7 +414,7 @@ export type UsageWindow = z.infer<typeof UsageWindowSchema>;
 // An account's headroom: EVERY window the provider reports, read together, plus when the reading was taken.
 // All of them, not the binding one, because "which pool is binding" changes between turns and a reader
 // comparing accounts needs the same pools on every row. How the reading is TAKEN is per provider and stops at
-// the daemon's readers: Claude's rides the turn's own stream, ChatGPT's and Google's are pulled through
+// the daemon's readers: Claude's rides the turn's own stream, ChatGPT's, Google's and Kimi's are pulled through
 // CLIProxyAPI's credential-scoped management call. All of them are control requests, so none costs tokens.
 //
 // Within one window utilization only climbs, so an un-reset window stays a valid FLOOR however old it is; past
@@ -426,13 +426,45 @@ export const AccountUsageSchema = z.object({
 });
 export type AccountUsage = z.infer<typeof AccountUsageSchema>;
 
+/* THE LAST TIME A PROVIDER ACTUALLY REFUSED A TURN — the other half of "can I run on this", and the half no
+ * meter can supply.
+ *
+ * A snapshot above is POLLED and therefore always a floor: read at turn end (Claude) or on a five-minute sweep
+ * (the routed subscriptions), and account-wide, so every other client on the plan spends the same pools without
+ * this sandbox hearing about it. A refusal is the opposite kind of fact — observed, exact, and timestamped by
+ * the only event that proves the plan said no. Between them they answer a question neither can alone: a green
+ * meter beside "refused a turn 4 minutes ago" means the reading is stale, not that the account has room.
+ *
+ * Keyed by PROVIDER rather than by account, because that is the resolution the daemon honestly has. A native
+ * Claude turn knows which account served it and names it; a routed turn does not — CLIProxyAPI picks the auth
+ * file itself and only refuses once every credential it holds is cooling down, which makes the refusal a fact
+ * about the provider in the first place.
+ *
+ * `kind` is read off what the provider SAID, not off the frame code the harness filed it under, because those
+ * two disagree: Kimi answers a spent plan with `403 You've reached your usage limit for this billing cycle`,
+ * which the CLI prints under "Failed to authenticate" and the stream codes as a refused credential. Sending
+ * someone to reconnect a perfectly good account is the cost of believing the code over the sentence. */
+export const ProviderRefusalSchema = z.object({
+    // Epoch MS, matching AccountUsage.measuredAt — the two are read side by side.
+    at: z.number(),
+    kind: z.enum(["limit", "auth"]),
+    // The provider's own sentence, verbatim. It is the only part that says WHICH pool or WHICH credential.
+    message: z.string(),
+    // The account that was serving, when the daemon knows it (native turns only — see above).
+    account: z.string().optional(),
+});
+export type ProviderRefusal = z.infer<typeof ProviderRefusalSchema>;
+
+export const ProviderRefusalsSchema = z.object({ refusals: z.record(z.string(), ProviderRefusalSchema) });
+export type ProviderRefusals = z.infer<typeof ProviderRefusalsSchema>;
+
 // One connected subscription in the translator. `name` is CLIProxyAPI's auth-file name — the stable store key a
 // disconnect addresses — and `label` the sign-in identity it reported (the account email, else the file name).
 export const TranslatorAccountSchema = z.object({
     name: z.string(),
     label: z.string(),
     // The same headroom an OauthAccount carries, on the same field, for the same reason: the account rows are
-    // one list to the reader. Optional because a provider whose quota this sandbox cannot read (Grok, Kimi) —
+    // one list to the reader. Optional because a provider whose quota this sandbox cannot read (Grok) —
     // or one that did not answer — must still render as the connected account it is, with a dot instead of a
     // ring.
     usage: AccountUsageSchema.optional(),
@@ -781,34 +813,26 @@ export const SandboxSettingsSchema = z.object({
      * OFF still records the interruption: the fleet card reads `interrupted` (see AgentStatusSchema) and an
      * automation's row shows an `interrupted` run — nothing is re-run, but nothing is silently lost either. */
     autoResumeOnRestart: z.boolean().default(true),
-    /* THE LANDING GATE — the check command run over the COMPOSITE of landed work after a landing debounce.
-     * Empty ⇒ no gate at all, which is the default: only the owner knows what verifies this workspace, and a
-     * guessed command that fails on a fresh clone would read as the gate finding a bug on its first run.
+    /* THE PRE-PUSH CHECK — the command run when the user pushes, before anything leaves the machine.
+     * Empty ⇒ no check at all, which is the default: only the owner knows what verifies this workspace, and a
+     * guessed command that fails on a fresh clone would read as the check finding a bug on its first run.
      *
      * Configuring it is the opt-in, which is why there is no separate enable flag to disagree with it. The
-     * command runs in the workspace root through `sh -c`, exactly as a terminal would run it (see gate/gate.ts
-     * for why this is NOT an automation guard: a suite outlives GUARD_TIMEOUT_MS, and a timed-out guard reads
-     * as "skipped" — a silent green over a suite that never finished). */
-    gateCommand: z.string().max(500).default(""),
-    /* How long after a land the gate waits before running. A landing burst is the case this exists for: five
-     * agents finishing within a minute of each other are five lands, and a gate that ran per land would spend
-     * five suites to answer about four trees nobody will ever push. Every land re-arms the timer, so the run
-     * happens once, on the tree the user is about to review.
+     * command runs in the workspace root through `sh -c`, exactly as a terminal would run it. */
+    prepushCommand: z.string().max(500).default(""),
+    // Ceiling on one run, after which the child's whole process group is killed and the result is `failed` with
+    // `timedOut`. Never a pass: a suite that did not finish has said nothing about the tree, and the one thing
+    // this check exists to prevent is a green light nobody earned.
+    prepushTimeoutMs: z.number().min(60_000).max(3_600_000).default(900_000),
+    /* WHAT THE SUGGESTED FIX SESSION RUNS ON when the check fails — `${provider}:${model}` (quickModelKey), and
+     * the reasoning effort beside it. Both empty ⇒ whatever the chat composer would have started with, which is
+     * the right default precisely because it is the model the user already chose to work with.
      *
-     * It counts from the last LAND and nothing else — explicitly not "until the fleet is idle". Agents here run
-     * for hours, so a fleet of twenty with one long runner would never present a quiet moment, and a gate that
-     * waited for one would only ever fire when clicked (gate/gate.ts). */
-    gateQuietMs: z.number().min(0).max(600_000).default(20_000),
-    // Ceiling on one gate run, after which the child is killed and the verdict is `failed` with `timedOut`.
-    // Never a pass: a suite that did not finish has not said anything about the tree, and the one thing this
-    // gate exists to prevent is a green light nobody earned.
-    gateTimeoutMs: z.number().min(60_000).max(3_600_000).default(900_000),
-    /* Wake a fixer automatically when the gate goes red, instead of only lighting the badge. ON with a
-     * configured command, and the difference from the unattended spend a usage limit refuses is
-     * that the spend here is the POINT: a red gate whose fix waits for the user to notice has moved the CI
-     * round-trip into the workspace without removing it from the user's day. One attempt per verdict, so a
-     * command that fails for a reason no agent can fix costs one turn, not a loop (gate/gate.ts). */
-    gateAutoFix: z.boolean().default(true),
+     * Pinned here rather than resolved cheapest-first like `quickModel`: this is not a one-click helper, it is a
+     * turn that has to read a failing suite and repair it, so the choice is the user's and worth stating. The
+     * suggestion dialog seeds from these and stays editable — the setting decides where the dialog OPENS. */
+    prepushFixModel: z.string().default(""),
+    prepushFixEffort: z.string().default(""),
 });
 export type SandboxSettings = z.infer<typeof SandboxSettingsSchema>;
 
@@ -1969,6 +1993,10 @@ export const ExtensionSummarySchema = z.object({
     // Image-baked first-party extension (no git checkout, not removable) vs a git-installed capability — the
     // web hides the uninstall affordance for baked ones.
     builtin: z.boolean(),
+    // The owner's switch (.intentic/extension-enablement.json). A disabled extension is still listed — that's
+    // what makes it switchable back on — but the daemon wires none of its contributions up and the web host
+    // doesn't activate it.
+    enabled: z.boolean(),
 });
 export type ExtensionSummary = z.infer<typeof ExtensionSummarySchema>;
 export const ExtensionsListSchema = z.object({ extensions: z.array(ExtensionSummarySchema) });
@@ -1985,6 +2013,9 @@ export const ExtensionSettingsInputSchema = z.object({
     id: z.string(),
     settings: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])),
 });
+// Flip one extension on or off. Persisted by publisher.name (like settings), so the choice outlives the
+// checkout; the daemon's immediate half of the flip — declared processes — converges in the same handler.
+export const ExtensionEnabledInputSchema = z.object({ id: z.string(), enabled: z.boolean() });
 // One declared background process (contributes.processes) — status/start/stop, addressed by the capability
 // entry id + the manifest's process name. Undeclared names are NOT_FOUND, the manifest-honesty rule again.
 export const ExtensionProcessParamSchema = z.object({ id: z.string(), name: z.string() });
@@ -2243,95 +2274,51 @@ export type CiRunParam = z.infer<typeof CiRunParamSchema>;
 export const CiFixResponseSchema = z.object({ conversationId: z.string() });
 export type CiFixResponse = z.infer<typeof CiFixResponseSchema>;
 
-/* ---- the landing gate: the workspace's own verdict on the composite of landed work ----
- *
- * WHERE THIS SITS, and why it is not one of the four other places it could:
+/* ---- the pre-push check: the workspace's own answer to "would this push go red" ----
  *
- * A fleet of 5-20 agents lands work into the main tree as UNCOMMITTED changes (agents/land.ts), the user
- * reviews and commits it by parts, pushes, and CI answers minutes later. This gate front-runs that answer by
- * asking the same question of the same artifact, before the push.
+ * WHERE THIS SITS. A fleet of 5-20 agents lands work into the main tree, the user reviews and commits it by
+ * parts, pushes, and CI answers minutes later. The check front-runs that answer at the push itself — the last
+ * moment before the work leaves the machine, and the first moment at which what will be pushed is finally
+ * settled.
  *
- * NOT inside an agent's turn. An isolated worktree's `node_modules` reads as the MAIN checkout's, so a
- * monorepo's workspace links resolve cross-package imports to /work's sources rather than the worktree's edited
- * ones (agents/worktrees.ts). A suite run in a worktree therefore tests the agent's edits against everyone
- * else's UNEDITED siblings: it invents failures that don't exist and passes changes that break on the
- * composite, and two agents editing one contract each go green alone and red together. The composite is the
- * only honest artifact, and it exists in exactly one place — the main working tree.
+ * WHY THE PUSH AND NOT THE LAND, which is where this used to run. A post-land verdict is about a tree that
+ * keeps moving: the user commits by parts, another agent lands, an edit arrives — so the verdict spent its life
+ * either stale or being recomputed, and needed a content fingerprint, a staleness rule and a badge to say which.
+ * All of that machinery existed to answer a question the push asks for free, because at the push there is
+ * exactly one artifact and the user is standing in front of it waiting.
  *
- * NOT at commit. The user commits BY PARTS, and a suite reads the worktree, not the index — so a verdict taken
- * at a partial commit describes a tree that never gets pushed as such. Commit is where a verdict is DISPLAYED
- * (ReviewPanel's badge), computed earlier.
- *
- * NOT at push. By then HEAD has moved, per-path attribution has expired (agents/origins.ts), and the agents may
- * be archived with their worktrees reclaimed — so the fix starts cold, in the same position `/ci/fix` is in.
- * That saves the CI round-trip and none of the context switch.
- *
- * So: after the land, before the staging — the one window where the artifact is what CI will see, attribution
- * is still live, and nobody is waiting on it. */
+ * SO THERE IS NO STORED VERDICT AND NOTHING IS POLLED AT REST. A run exists while it runs, reports to the
+ * dialog that started it, and is gone. Nothing survives a daemon restart because nothing needs to: the next
+ * push asks again. */
 
-/* What the gate has to say about the tree right now.
+/* Where a run is.
  *
- *   idle      — no command configured, or nothing has run yet.
- *   armed     — work landed; the quiet period is counting down (see gateQuietMs).
+ *   idle      — nothing has run in this daemon's life, or the last run was cleared.
  *   running   — the check is live. `output` grows as it streams.
- *   passed    — exited 0 over `fingerprint`.
- *   failed    — exited non-zero, or was killed by gateTimeoutMs (`timedOut`). The state a fix answers.
- *   error     — the gate itself could not run: the command was not spawnable. NOT a fix-able failure, because
- *               there is nothing wrong with the code — the gate is misconfigured, and saying "tests failed"
+ *   passed    — exited 0. The push goes.
+ *   failed    — exited non-zero, or was killed by prepushTimeoutMs (`timedOut`). The state a fix answers.
+ *   error     — the check could not run at all: the command was not spawnable. NOT a fix-able failure, because
+ *               there is nothing wrong with the code — the command is misconfigured, and saying "tests failed"
  *               would send an agent hunting a bug that isn't there.
- *   cancelled — the user stopped the run, or the tree moved under it.
+ *   cancelled — the user stopped the run.
  */
-export const GateStatusSchema = z.enum(["idle", "armed", "running", "passed", "failed", "error", "cancelled"]);
-export type GateStatus = z.infer<typeof GateStatusSchema>;
-
-// An agent whose landed work the failure implicates. `paths` are its attributed files that the check's own
-// output NAMED — empty when the output named none of them, which is the honest shape for a failure that could
-// not be pinpointed (an integration break between two deltas, a suite that prints no paths at all): the agent
-// is listed because its work is in the tree under test, not because anything accused it.
-export const GateAgentSchema = z.object({
-    agentId: z.string(),
-    title: z.string().optional(),
-    provider: AgentProviderSchema.optional(),
-    paths: z.array(z.string()),
-});
-export type GateAgent = z.infer<typeof GateAgentSchema>;
-
-// The fix turn one red verdict got. It is a workspace conversation because the composite it must reproduce
-// lives as uncommitted content in the main working tree; it still has the same stable registry identity as any
-// other conversation.
-export const GateFixSchema = z.object({
-    startedAt: z.number(),
-    conversationId: z.string(),
-    // `running` while the turn streams; `done` when it ended cleanly, whatever the re-check then said;
-    // `error` when the turn itself failed (a provider outage, no credential), which is worth distinguishing
-    // because it is the one case where re-running the fix could still help.
-    outcome: z.enum(["running", "done", "error"]),
-    detail: z.string().optional(),
-});
-export type GateFix = z.infer<typeof GateFixSchema>;
+export const PrepushStatusSchema = z.enum(["idle", "running", "passed", "failed", "error", "cancelled"]);
+export type PrepushStatus = z.infer<typeof PrepushStatusSchema>;
 
-export const GateVerdictSchema = z.object({
-    status: GateStatusSchema,
-    // The command this verdict ran, echoed rather than read back from settings: a verdict read after the
+export const PrepushRunSchema = z.object({
+    status: PrepushStatusSchema,
+    // The command this run executed, echoed rather than read back from settings: a result read after the
     // setting changed still has to say what produced it.
     command: z.string(),
     startedAt: z.number().optional(),
     finishedAt: z.number().optional(),
     exitCode: z.number().optional(),
     timedOut: z.boolean().optional(),
-    // The check's own output, tail-capped (GATE_OUTPUT_BYTES). The tail, not the head: a suite's verdict and
+    // The check's own output, tail-capped (PREPUSH_OUTPUT_BYTES). The TAIL, not the head: a suite's verdict and
     // its failure summary are at the end, and a head-capped buffer of a chatty build is all progress lines.
     output: z.string(),
-    /* WHICH TREE this verdict is about — HEAD plus the shape of every repo's uncommitted content. Recomputed
-     * on read: when it no longer matches, the verdict is `stale` and the badge says so instead of asserting a
-     * green light over a tree that has since moved. This is what keeps a passed verdict from outliving its
-     * subject when the user edits, discards, or commits half of it. */
-    fingerprint: z.string(),
-    stale: z.boolean(),
-    implicated: z.array(GateAgentSchema),
-    fix: GateFixSchema.optional(),
 });
-export type GateVerdict = z.infer<typeof GateVerdictSchema>;
+export type PrepushRun = z.infer<typeof PrepushRunSchema>;
 
 // ---- drafts: agent-proposed posts awaiting owner approval (.intentic/drafts/<id>.json) ----
 // One JSON file per draft. The AGENT creates drafts with its normal file tools — it can't call daemon routes,
@@ -2479,10 +2466,9 @@ export type PortForwardResult = z.infer<typeof PortForwardResultSchema>;
 // it lists from /system/browsers with the pages it has open (BrowserSessionSchema below).
 //
 // `activityAt` (epoch ms of the session's last output) and `exitCode` (the LAST window's exit status, absent
-// while that pane still lives) are what let a finished session be READ rather than merely listed: the panel's
-// Recent-terminals popover orders by the one and reports the other ("exit 1 · 1h ago"), and the daemon's
-// retention sweep ages sessions out by the same clock. 0 is "tmux didn't say" — treated as unknown by both,
-// never as 1970.
+// while that pane still lives) describe a session beyond "it exists": the panel's work popover orders its live
+// rows by the one and dates them off it, and the daemon's retention sweep ages sessions out by the same clock.
+// 0 is "tmux didn't say" — treated as unknown by both, never as 1970.
 export const TerminalSessionSchema = z.object({
     name: z.string(),
     label: z.string().optional(),

package/src/workspace-state.ts

@@ -82,6 +82,14 @@ export const WORKSPACE_STATE_FILES: readonly WorkspaceStateFile[] = [
         invalidates: [],
         why: "Held in a module-level shallowRef store per extension (web's extensionSettingsStore) with no query observer, and deliberately so: api.settings.get must answer SYNCHRONOUSLY from an extension's first activate() line, and the store outlives every component scope. A module-level QueryObserver is the one shape that would make invalidation refetch, and this app already ruled it out — it detaches on the queryClient.clear() at logout (see useSandbox's sandbox-list mirror). So a remote member's setting edit reaches this browser on its next load, not live.",
     },
+    /* Unlike the settings file above it, the on/off switch IS observed by a query — the Extensions tab's list,
+     * which carries each row's switch position — so a flip made elsewhere (another member, the agent writing the
+     * file) shows up here live. It does not re-run the host: activating or retiring an extension is the loader's
+     * reconcile, which the tab's own toggle triggers, so a remote flip takes effect on this browser's next load. */
+    {
+        path: ".intentic/extension-enablement.json",
+        invalidates: ["extensions"],
+    },
     {
         path: ".intentic/members.json",
         invalidates: [],
@@ -89,16 +97,6 @@ export const WORKSPACE_STATE_FILES: readonly WorkspaceStateFile[] = [
     },
 
     // ---- daemon-owned, nothing derives from watching them ----
-    {
-        path: ".intentic/gate.json",
-        invalidates: [],
-        why: "The landing gate's verdict is POLLED on purpose (web's useGate). Its fingerprint pass rewrites this file every couple of seconds while a check runs, and pushing that back would refetch the review set — the daemon's most expensive read — on every poll.",
-    },
-    {
-        path: ".intentic/gate-index/",
-        invalidates: [],
-        why: "The gate's per-repo git index. Machine state, rewritten continuously by the fingerprint pass.",
-    },
     /* Agent session transcripts, rewritten on every streamed token.
      *
      * The memory notes under it (`projects/<slug>/memory/**`) ARE user-facing and the /memory view polls them

package/dist/contracts/gate.contract.d.ts

@@ -1,47 +0,0 @@
-export declare const gateContract: {
-    verdict: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, import("zod").ZodObject<{
-        status: import("zod").ZodEnum<{
-            armed: "armed";
-            cancelled: "cancelled";
-            error: "error";
-            failed: "failed";
-            idle: "idle";
-            passed: "passed";
-            running: "running";
-        }>;
-        command: import("zod").ZodString;
-        startedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        finishedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        exitCode: import("zod").ZodOptional<import("zod").ZodNumber>;
-        timedOut: import("zod").ZodOptional<import("zod").ZodBoolean>;
-        output: import("zod").ZodString;
-        fingerprint: import("zod").ZodString;
-        stale: import("zod").ZodBoolean;
-        implicated: import("zod").ZodArray<import("zod").ZodObject<{
-            agentId: import("zod").ZodString;
-            title: import("zod").ZodOptional<import("zod").ZodString>;
-            provider: import("zod").ZodOptional<import("zod").ZodString>;
-            paths: import("zod").ZodArray<import("zod").ZodString>;
-        }, import("zod/v4/core").$strip>>;
-        fix: import("zod").ZodOptional<import("zod").ZodObject<{
-            startedAt: import("zod").ZodNumber;
-            conversationId: import("zod").ZodString;
-            outcome: import("zod").ZodEnum<{
-                done: "done";
-                error: "error";
-                running: "running";
-            }>;
-            detail: import("zod").ZodOptional<import("zod").ZodString>;
-        }, import("zod/v4/core").$strip>>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-    run: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, import("zod").ZodObject<{
-        ok: import("zod").ZodLiteral<true>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-    cancel: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, import("zod").ZodObject<{
-        ok: import("zod").ZodLiteral<true>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-    fix: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, import("zod").ZodObject<{
-        ok: import("zod").ZodLiteral<true>;
-    }, import("zod/v4/core").$strip>, Record<never, never>, Record<never, never>>;
-};
-//# sourceMappingURL=gate.contract.d.ts.map

package/dist/contracts/gate.contract.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gate.contract.d.ts","sourceRoot":"","sources":["../../src/contracts/gate.contract.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,YAAY;IACrB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACP,GAAG;;;IACH,MAAM;;;IACN,GAAG;;;CACN,CAAC"}

package/dist/contracts/gate.contract.js

@@ -1,9 +0,0 @@
-import { oc } from "@orpc/contract";
-import { GateVerdictSchema, OkSchema } from "../schemas.js";
-export const gateContract = {
-    verdict: oc.route({ method: "GET", path: "/gate/verdict" }).output(GateVerdictSchema),
-    run: oc.route({ method: "POST", path: "/gate/run" }).output(OkSchema),
-    cancel: oc.route({ method: "POST", path: "/gate/cancel" }).output(OkSchema),
-    fix: oc.route({ method: "POST", path: "/gate/fix" }).output(OkSchema),
-};
-//# sourceMappingURL=gate.contract.js.map

package/dist/contracts/gate.contract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gate.contract.js","sourceRoot":"","sources":["../../src/contracts/gate.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAY5D,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACrF,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACrE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC3E,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;CACxE,CAAC"}

package/src/contracts/gate.contract.ts

@@ -1,19 +0,0 @@
-import { oc } from "@orpc/contract";
-import { GateVerdictSchema, OkSchema } from "../schemas.js";
-
-// The landing gate — the check command run over the composite of landed work once the fleet goes quiet (see
-// GateVerdictSchema for where this sits and why). Four verbs, all about ONE verdict: the gate answers about the
-// main working tree, of which there is exactly one, so nothing here is addressed by id.
-//
-// `verdict` is the one read, and the panel polls it; it recomputes staleness per call, so a passed verdict stops
-// claiming a green light the moment the tree moves under it. The three writes answer `ok` and nothing else —
-// each starts work that outlives the request, so there is no result to return and the poll is what reports.
-// `run` arms nothing and waits for nothing: it starts the check now, the user's own "I'm about to commit, check
-// this". `fix` opens a seeded workspace conversation for a red verdict; it has the same registry lifecycle as
-// /ci/fix, minus the isolated worktree it must not have.
-export const gateContract = {
-    verdict: oc.route({ method: "GET", path: "/gate/verdict" }).output(GateVerdictSchema),
-    run: oc.route({ method: "POST", path: "/gate/run" }).output(OkSchema),
-    cancel: oc.route({ method: "POST", path: "/gate/cancel" }).output(OkSchema),
-    fix: oc.route({ method: "POST", path: "/gate/fix" }).output(OkSchema),
-};