@intutic/cli 2.9.1 → 3.0.0

package/dist/commands/judge.js

@@ -7,8 +7,15 @@
  * hosted provider (`isHostedModelRef`) is refused.
  *
  * Deliberately local-artifacts-only: it writes a `litellm_config.yaml` and
+ * the decide engine's configuration (`~/.intutic/decide/engine.json`), and
  * prints env / Helm snippets for the operator to apply themselves. It never
- * calls a remote API to flip anything on. `local_judge` is deliberately NOT
+ * calls a remote API to flip anything on.
+ *
+ * The gateway variables it prints are deprecated since 3.0: the gateway maps
+ * the typed band to the decide rule `local-judge` with a warning, and 4.0
+ * removes them. engine.json is where 3.0 keeps the model a decide rule asks
+ * (`--engine-url`, default Ollama on this machine); its key stays in
+ * `INTUTIC_DECIDE_API_KEY` and is never written. `local_judge` is deliberately NOT
  * exposed through `PATCH /api/v1/gateways/:id/config`
  * (`services/control-plane/src/lib/gateway.ts`) — this command respects that
  * boundary by construction, not by omission.
@@ -20,11 +27,55 @@
  *
  * @module
  */
-import { writeFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
 import pc from 'picocolors';
-import { selfHostedJudgeModelChoices, isHostedModelRef, SELF_HOSTED_MODEL_PROVIDER_IDS, findCatalogModel, normalizeModelRef, } from '@intutic/shared-types';
+import { checkSelfHostedDecisionHost, DECIDE_DEFAULT_ENGINE_URL, DECIDE_ENGINE_FILE_PATH, resolveDecideEngineConfig, selfHostedJudgeModelChoices, isHostedModelRef, SELF_HOSTED_MODEL_PROVIDER_IDS, findCatalogModel, normalizeModelRef, } from '@intutic/shared-types';
 import { createClackIO } from './setup.js';
+/** The gateway variables the env block prints, all deprecated since 3.0. */
+export const DEPRECATED_JUDGE_ENV = [
+    'INTUTIC_GATEWAY_LOCAL_JUDGE',
+    'LITELLM_LOCAL_URL',
+    'LITELLM_LOCAL_API_KEY',
+    'LITELLM_LOCAL_JUDGE_MODEL',
+    'LITELLM_LOCAL_TYPED_JUDGE_MODEL',
+    'INTUTIC_GATEWAY_LOCAL_JUDGE_TYPED_LO',
+    'INTUTIC_GATEWAY_LOCAL_JUDGE_TYPED_HI',
+];
+/**
+ * Writes the decide engine's configuration to `file` (mode 0600 in a 0700
+ * directory, replaced whole by a rename): `url`, `adapter`, `model`,
+ * `timeoutMs`, `parallel` and `structured`. Other keys an existing file holds
+ * are kept. Never the key, which is environment only.
+ */
+export function writeDecideEngineFile(file, url, model) {
+    let existing = {};
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf-8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            existing = parsed;
+    }
+    catch {
+        // No file, or one that does not parse: start afresh.
+    }
+    const cfg = resolveDecideEngineConfig({ url, adapter: 'logprobs', model }, {});
+    const doc = {
+        ...existing,
+        url: cfg.url,
+        adapter: cfg.adapter,
+        model: cfg.model,
+        timeoutMs: cfg.timeoutMs,
+        parallel: cfg.parallel,
+        structured: cfg.structured,
+    };
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, file);
+    return doc;
+}
 /** Printed instead of paths into Intutic's own source tree, which customers do not have. */
 const ON_PREM_JUDGE_DOCS = 'https://docs.intutic.ai/external/on-prem-judge';
 /**
@@ -61,7 +112,8 @@ export function buildLiteLLMConfigYaml(modelRef) {
 }
 function envBlock(modelAlias) {
     return [
-        "# The gateway's .env (beside docker-compose.gateway.yml in the release bundle) or your own env file:",
+        "# The gateway's .env (beside docker-compose.gateway.yml in the release bundle) or your own env file.",
+        '# Deprecated since 3.0 and removed in 4.0; the gateway maps them to the decide rule local-judge:',
         'INTUTIC_GATEWAY_LOCAL_JUDGE=true',
         'LITELLM_LOCAL_URL=http://litellm:4000',
         'LITELLM_LOCAL_API_KEY=${LITELLM_MASTER_KEY}',
@@ -86,6 +138,17 @@ export async function runJudgeConfigure(opts, io = createClackIO()) {
     io.log.info('This writes local files only — it never calls a remote API. local_judge is deliberately ' +
         'not remotely configurable; apply what this generates yourself. Judges run only on ' +
         'self-hosted models: hosted APIs (Anthropic, OpenAI, Gemini, OpenRouter, Ollama Cloud…) are refused.');
+    io.log.warn(`Deprecated since 3.0: ${DEPRECATED_JUDGE_ENV.join(', ')}. The gateway maps them to the decide ` +
+        'rule local-judge with a warning, and 4.0 removes them. This command also writes the decide ' +
+        `engine configuration (~/${DECIDE_ENGINE_FILE_PATH.join('/')}). See ${ON_PREM_JUDGE_DOCS}`);
+    const engineUrl = (opts.engineUrl ?? DECIDE_DEFAULT_ENGINE_URL).trim();
+    const host = checkSelfHostedDecisionHost(engineUrl, process.env.INTUTIC_SELF_HOSTED_DECISION_HOSTS);
+    if (!host.ok) {
+        io.log.error(`The decide engine URL ${engineUrl} is not a self-hosted host (${host.reason}). Use a loopback or ` +
+            'private address, or list the host in INTUTIC_SELF_HOSTED_DECISION_HOSTS.');
+        io.outro('Nothing written.');
+        return;
+    }
     // Self-hosted catalog entries, plus a free-text alias for anything else the
     // operator's own LiteLLM serves (vLLM, a renamed Ollama model…).
     const CUSTOM = '__custom__';
@@ -127,6 +190,9 @@ export async function runJudgeConfigure(opts, io = createClackIO()) {
     writeFileSync(outPath, yaml, 'utf-8');
     io.log.success(`Written to ${outPath}`);
     const { id: modelAlias } = normalizeModelRef(modelRef);
+    const engineFile = join(opts.home ?? homedir(), ...DECIDE_ENGINE_FILE_PATH);
+    writeDecideEngineFile(engineFile, engineUrl, modelAlias || modelRef);
+    io.log.success(`Decide engine: ${modelAlias || modelRef} at ${engineUrl}, written to ${engineFile}`);
     io.note(envBlock(modelAlias || modelRef), 'Environment');
     io.note(helmSnippet(modelAlias || modelRef, outPath), 'Helm values');
     io.log.info(`Full walkthrough, including the optional typed stage: ${ON_PREM_JUDGE_DOCS}`);

package/dist/commands/judge.js.map

@@ -1 +1 @@
-{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../src/commands/judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAA;AAOxD,4FAA4F;AAC5F,MAAM,kBAAkB,GAAG,gDAAgD,CAAA;AAE3E;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,CAAC,CAAC,8BAA8B,GAAG,aAAa;QAChD,CAAC,CAAC,6BAA6B,GAAG,YAAY,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,MAAM,KAAK,GAAG,EAAE,IAAI,QAAQ,CAAA;IAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAEzD,OAAO,CACL,+EAA+E;QAC/E,mDAAmD,kBAAkB,MAAM;QAC3E,eAAe;QACf,mBAAmB,KAAK,IAAI;QAC5B,uBAAuB;QACvB,gBAAgB,YAAY,IAAI;QAChC,QAAQ;QACR,IAAI;QACJ,qBAAqB;QACrB,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO;QACL,sGAAsG;QACtG,kCAAkC;QAClC,uCAAuC;QACvC,6CAA6C;QAC7C,6BAA6B,UAAU,EAAE;KAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,UAAkB;IACzD,OAAO;QACL,mFAAmF;QACnF,yDAAyD,UAAU,qBAAqB;QACxF,QAAQ;QACR,oBAAoB;QACpB,UAAU;QACV,iBAAiB;QACjB,kBAAkB,UAAU,GAAG;QAC/B,iGAAiG;QACjG,2BAA2B;KAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAwB,EAAE,KAAc,aAAa,EAAE;IAC7F,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAA;IAC1D,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,0FAA0F;QACxF,oFAAoF;QACpF,qGAAqG,CACxG,CAAA;IAED,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,MAAM,GAAG,YAAY,CAAA;IAC3B,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,uDAAuD;QAChE,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACjG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,8EAA8E,EAAE;SACzG;KACF,CAAC,CAAA;IACF,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iFAAiF,EAAE,CAAC,CAAA;QAC5H,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACxB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,CACV,IAAI,QAAQ,mFAAmF;gBAC7F,sCAAsC,CACzC,CAAA;YACD,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,2EAA2E,CAAC,CAAA;IACtG,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAA;IAC5D,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACrC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;IAEvC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IACxD,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,QAAQ,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAA;IAEpE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,kBAAkB,EAAE,CAAC,CAAA;IAE1F,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC,CAAA;AACvF,CAAC"}
+{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../src/commands/judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAA;AAWxD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,mBAAmB;IACnB,uBAAuB;IACvB,2BAA2B;IAC3B,iCAAiC;IACjC,sCAAsC;IACtC,sCAAsC;CAC9B,CAAA;AAEV;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,QAAQ,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAA;QACjE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,MAAiC,CAAA;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG;QACV,GAAG,QAAQ;QACX,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAA;IACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACxC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACrB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4FAA4F;AAC5F,MAAM,kBAAkB,GAAG,gDAAgD,CAAA;AAE3E;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,CAAC,CAAC,8BAA8B,GAAG,aAAa;QAChD,CAAC,CAAC,6BAA6B,GAAG,YAAY,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,MAAM,KAAK,GAAG,EAAE,IAAI,QAAQ,CAAA;IAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAEzD,OAAO,CACL,+EAA+E;QAC/E,mDAAmD,kBAAkB,MAAM;QAC3E,eAAe;QACf,mBAAmB,KAAK,IAAI;QAC5B,uBAAuB;QACvB,gBAAgB,YAAY,IAAI;QAChC,QAAQ;QACR,IAAI;QACJ,qBAAqB;QACrB,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO;QACL,sGAAsG;QACtG,kGAAkG;QAClG,kCAAkC;QAClC,uCAAuC;QACvC,6CAA6C;QAC7C,6BAA6B,UAAU,EAAE;KAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,UAAkB;IACzD,OAAO;QACL,mFAAmF;QACnF,yDAAyD,UAAU,qBAAqB;QACxF,QAAQ;QACR,oBAAoB;QACpB,UAAU;QACV,iBAAiB;QACjB,kBAAkB,UAAU,GAAG;QAC/B,iGAAiG;QACjG,2BAA2B;KAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAwB,EAAE,KAAc,aAAa,EAAE;IAC7F,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAA;IAC1D,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,0FAA0F;QACxF,oFAAoF;QACpF,qGAAqG,CACxG,CAAA;IACD,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,yBAAyB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;QAC9F,6FAA6F;QAC7F,2BAA2B,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,kBAAkB,EAAE,CAC7F,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAAC,CAAC,IAAI,EAAE,CAAA;IACtE,MAAM,IAAI,GAAG,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;IACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CAAC,KAAK,CACV,yBAAyB,SAAS,+BAA+B,IAAI,CAAC,MAAM,uBAAuB;YACjG,0EAA0E,CAC7E,CAAA;QACD,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC5B,OAAM;IACR,CAAC;IAED,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,MAAM,GAAG,YAAY,CAAA;IAC3B,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,uDAAuD;QAChE,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACjG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,8EAA8E,EAAE;SACzG;KACF,CAAC,CAAA;IACF,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iFAAiF,EAAE,CAAC,CAAA;QAC5H,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACxB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,CACV,IAAI,QAAQ,mFAAmF;gBAC7F,sCAAsC,CACzC,CAAA;YACD,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,2EAA2E,CAAC,CAAA;IACtG,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAA;IAC5D,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACrC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;IAEvC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,uBAAuB,CAAC,CAAA;IAC3E,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,QAAQ,CAAC,CAAA;IACpE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,UAAU,IAAI,QAAQ,OAAO,SAAS,gBAAgB,UAAU,EAAE,CAAC,CAAA;IAEpG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IACxD,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,QAAQ,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAA;IAEpE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,kBAAkB,EAAE,CAAC,CAAA;IAE1F,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC,CAAA;AACvF,CAAC"}

package/dist/commands/rollback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/commands/rollback.ts"],"names":[],"mappings":"AA+EA,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwFhB"}
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/commands/rollback.ts"],"names":[],"mappings":"AA0FA,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwFhB"}

package/dist/commands/rollback.js

@@ -41,6 +41,14 @@ function readManifest() {
         return [];
     }
 }
+/** A captured entry's action tokens (gate body v23 writes them), at most 16. */
+function actionsOf(entry) {
+    const raw = entry.actions;
+    if (!Array.isArray(raw))
+        return {};
+    const actions = raw.filter((t) => typeof t === 'string' && t.startsWith('action:') && t.length <= 64).slice(0, 16);
+    return actions.length > 0 ? { actions } : {};
+}
 /** Appends to the same log the gate writes, so the undo is in the same trail. */
 function recordRestore(entry, note) {
     try {
@@ -57,6 +65,9 @@ function recordRestore(entry, note) {
             incidentId: crypto.createHash('sha1').update(ts + entry.id).digest('hex').slice(0, 16),
             // Made once and resent with this line: processed once however often the drain retries.
             eventId: crypto.randomBytes(16).toString('hex'),
+            // The action tokens the gate classified the call to at capture (LLD
+            // #75 §7.1): the control plane records the revert against each one.
+            ...actionsOf(entry),
         }) + '\n', { flag: 'a' });
     }
     catch {

package/dist/commands/rollback.js.map

@@ -1 +1 @@
-{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/commands/rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAOtC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAC3E,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAA;AAElE,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,EAAE;aACN,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;aACjC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAoB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;QAChE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACnC,EAAE,CAAC,cAAc,CACf,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,MAAM,EAAE,yBAAyB,KAAK,CAAC,EAAE,KAAK,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAC3F,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtF,uFAAuF;YACvF,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SAChD,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,uEAAuE;QACvE,wCAAwC;QACxC,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAA;IAC5F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAGjC;IACC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA;IAE9B,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;YACnC,GAAG,CAAC,GAAG,CACL,qFAAqF;gBACnF,kFAAkF,CACrF,CAAA;YACD,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,wCAAwC,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,uCAAuC,CAAA;YACtF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5B,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,0CAA0C,CAAC,CAAA;QAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;IAC1D,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,wEAAwE;QACxE,gEAAgE;QAChE,GAAG,CAAC,KAAK,CACP,aAAa,KAAK,CAAC,EAAE,8DAA8D;YACjF,gEAAgE,CACnE,CAAA;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACpD,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,CAAA;YAC1E,EAAE,CAAC,cAAc,CACf,QAAQ,EAAE,EACV,IAAI,CAAC,SAAS,CAAC;gBACb,GAAG,KAAK;gBACR,EAAE,EAAE,MAAM;gBACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,WAAW,KAAK,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI;gBACrC,OAAO,EAAE,IAAI;aACd,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,4DACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,qEAAqE,CACtE,CAAA;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,MAAM,mBAAmB,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,IAAI,CAAC,CAAA;YACtF,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,yEAAyE;YACzE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,gDAAgD,CAAC,CAAA;YACjF,aAAa,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/commands/rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAOtC,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAC3E,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAA;AAElE,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,EAAE;aACN,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;aACjC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,KAAoB;IACrC,MAAM,GAAG,GAAI,KAA+C,CAAC,OAAO,CAAA;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/H,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAoB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;QAChE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACnC,EAAE,CAAC,cAAc,CACf,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,MAAM,EAAE,yBAAyB,KAAK,CAAC,EAAE,KAAK,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAC3F,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtF,uFAAuF;YACvF,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/C,oEAAoE;YACpE,oEAAoE;YACpE,GAAG,SAAS,CAAC,KAAK,CAAC;SACpB,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,uEAAuE;QACvE,wCAAwC;QACxC,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAA;IAC5F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAGjC;IACC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA;IAE9B,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;YACnC,GAAG,CAAC,GAAG,CACL,qFAAqF;gBACnF,kFAAkF,CACrF,CAAA;YACD,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,wCAAwC,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,uCAAuC,CAAA;YACtF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5B,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,0CAA0C,CAAC,CAAA;QAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;IAC1D,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,wEAAwE;QACxE,gEAAgE;QAChE,GAAG,CAAC,KAAK,CACP,aAAa,KAAK,CAAC,EAAE,8DAA8D;YACjF,gEAAgE,CACnE,CAAA;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACpD,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,CAAA;YAC1E,EAAE,CAAC,cAAc,CACf,QAAQ,EAAE,EACV,IAAI,CAAC,SAAS,CAAC;gBACb,GAAG,KAAK;gBACR,EAAE,EAAE,MAAM;gBACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,WAAW,KAAK,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI;gBACrC,OAAO,EAAE,IAAI;aACd,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,4DACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,qEAAqE,CACtE,CAAA;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,MAAM,mBAAmB,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,IAAI,CAAC,CAAA;YACtF,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,yEAAyE;YACzE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,gDAAgD,CAAC,CAAA;YACjF,aAAa,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IACtB,CAAC;AACH,CAAC"}

package/dist/commands/skill.d.ts

@@ -318,6 +318,23 @@ export declare function runLoopStart(opts: {
     autoJudge?: boolean;
     dev?: boolean;
 }): Promise<void>;
+/**
+ * Verifies a loop run: the diff from `--base` (or the commit
+ * the run started from) is checked against the local SOPs' `scope_paths`
+ * first; a local failure stops it with nothing sent. Then the control plane
+ * checks scope and plan, and asks the judge only if those pass. True when the
+ * verify passed.
+ */
+export declare function verifyLoopRun(loopRunId: string, opts: {
+    base?: string;
+    task?: string;
+    dev?: boolean;
+}, client?: Awaited<ReturnType<typeof getClient>>): Promise<boolean>;
+export declare function runLoopVerify(loopRunId: string, opts: {
+    base?: string;
+    task?: string;
+    dev?: boolean;
+}): Promise<void>;
 export declare function runLoopComplete(loopRunId: string, opts: {
     dev?: boolean;
 }): Promise<void>;

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EAYL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAA;AAM/B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B;uEACmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,GAAG,gBAAgB,CAAA;AAE/F,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,CAK7E;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAA;AAEF,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI9D;AAWD,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO;AACd;;;;;;gCAMgC;AAChC,KAAK,UAAQ;AACb;;;;;;0DAM0D;AAC1D,aAAa,UAAQ,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B;AAED;;;sEAGsE;AACtE,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoB9F;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM;AACrB;uDACuD;AACvD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CA6BjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAQ,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAiE3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,MAAM,EAAE,QAAQ,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACvE,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAID,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAkElD;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,cAAc,GAAE,SAAS,OAAO,EAAO;AACvC,uEAAuE;AACvE,cAAc,GAAE,SAAS,aAAa,EAAO,GAC5C,MAAM,CAiFR;AA+CD,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAGhF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,SAAS,gBAAgB,EAAE,EAC7C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,kBAAkB,EAC/B,aAAa,EAAE,MAAM,GACpB,MAAM,CAyBR;AAED,wBAAsB,aAAa,CACjC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,IAAI,CAAC,CA6Of;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkCxD;AAOD,wBAAsB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,8CAU5C;AAgCD,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhB;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB/F;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GACA,OAAO,CAAC,IAAI,CAAC,CA6Gf"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EAYL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAGvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAA;AAM/B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B;uEACmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,GAAG,gBAAgB,CAAA;AAE/F,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,CAK7E;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAA;AAEF,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI9D;AAWD,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO;AACd;;;;;;gCAMgC;AAChC,KAAK,UAAQ;AACb;;;;;;0DAM0D;AAC1D,aAAa,UAAQ,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B;AAED;;;sEAGsE;AACtE,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoB9F;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM;AACrB;uDACuD;AACvD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CA6BjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAQ,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAiE3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,MAAM,EAAE,QAAQ,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACvE,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAID,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAkElD;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,cAAc,GAAE,SAAS,OAAO,EAAO;AACvC,uEAAuE;AACvE,cAAc,GAAE,SAAS,aAAa,EAAO,GAC5C,MAAM,CAiFR;AA+CD,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAGhF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,SAAS,gBAAgB,EAAE,EAC7C,aAAa,EAAE,gBAAgB,EAC/B,WAAW,EAAE,kBAAkB,EAC/B,aAAa,EAAE,MAAM,GACpB,MAAM,CAyBR;AAED,wBAAsB,aAAa,CACjC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,IAAI,CAAC,CA6Of;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkCxD;AAOD,wBAAsB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,8CAU5C;AAgCD,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhB;AA2FD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EACrD,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CA2ClB;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3H;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/F;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GACA,OAAO,CAAC,IAAI,CAAC,CAmIf"}

package/dist/commands/skill.js

@@ -13,9 +13,9 @@ import { NOT_AUTHENTICATED } from '../lib/authMessages.js';
 import { loadCredentials, loadConfig } from '../config/store.js';
 import { getIntuticDir, resolveControlPlaneUrl } from '../config/paths.js';
 import { createApiClient } from '../lib/api.js';
-import { scanSkillContent, skillContentForTransport, skillExceedsTransportCap, SKILL_PARTIAL_SCAN_REASON, SKILL_SCAN_PATTERNS, scanScriptContent, SCRIPT_SCAN_PATTERNS, detectScriptLanguage, MAX_SKILL_DIR_DEPTH, MAX_FILES_PER_SKILL, MAX_SCRIPT_SCAN_BYTES, } from '@intutic/shared-types';
+import { scanSkillContent, skillContentForTransport, skillExceedsTransportCap, SKILL_PARTIAL_SCAN_REASON, SKILL_SCAN_PATTERNS, scanScriptContent, SCRIPT_SCAN_PATTERNS, detectScriptLanguage, MAX_SKILL_DIR_DEPTH, MAX_FILES_PER_SKILL, MAX_SCRIPT_SCAN_BYTES, isWithinScope, } from '@intutic/shared-types';
 import { ciscoScannerOnPath, runCiscoScan, combineCiscoSarifRuns, } from '../lib/ciscoScanner.js';
-import { listSopSets } from '@intutic/sync-daemon';
+import { listSopSets, loadLocalSopEntries } from '@intutic/sync-daemon';
 import pc from 'picocolors';
 /** The words the audit uses for each {@link UnscannedReason}. */
 export function describeUnscanned(reason) {
@@ -960,7 +960,7 @@ export async function runLoopStart(opts) {
             // Write loop env file locally
             const loopEnvPath = join(getIntuticDir(), 'env', 'loop.env');
             await fs.mkdir(dirname(loopEnvPath), { recursive: true }).catch(() => { });
-            await fs.writeFile(loopEnvPath, `INTUTIC_LOOP_RUN_ID=${res.loop.loopRunId}\n`);
+            await writeLoopEnv(res.loop.loopRunId, workspaceRoot);
             log.dim(`Wrote run context to ~/.intutic/env/loop.env`);
         }
         else {
@@ -973,11 +973,153 @@ export async function runLoopStart(opts) {
         process.exit(1);
     }
 }
+/** The commit a loop run started from, so `loop verify` can diff against it. Empty outside a git repo. */
+function headCommit(cwd) {
+    try {
+        return execFileSync('git', ['rev-parse', 'HEAD'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/** `~/.intutic/env/loop.env`: the run id, and the commit the run started from. */
+async function writeLoopEnv(loopRunId, workspaceRoot) {
+    const loopEnvPath = join(getIntuticDir(), 'env', 'loop.env');
+    await fs.mkdir(dirname(loopEnvPath), { recursive: true }).catch(() => { });
+    const base = headCommit(workspaceRoot);
+    await fs.writeFile(loopEnvPath, `INTUTIC_LOOP_RUN_ID=${loopRunId}\n` + (base ? `INTUTIC_LOOP_BASE_COMMIT=${base}\n` : ''));
+}
+async function loopEnvValue(key) {
+    try {
+        const text = await fs.readFile(join(getIntuticDir(), 'env', 'loop.env'), 'utf8');
+        const line = text.split('\n').find((l) => l.startsWith(`${key}=`));
+        return line ? line.slice(key.length + 1).trim() : '';
+    }
+    catch {
+        return '';
+    }
+}
+function printLoopRefusal(status, body) {
+    log.error(`The control plane did not complete the run (${status}${body.code ? ` ${body.code}` : ''}): ${body.error ?? 'refused'}`);
+    for (const f of body.findings ?? [])
+        log.info(`  - ${f}`);
+    if (body.code === 'E_LOOP_NOT_VERIFIED' || body.code === 'E_LOOP_VERIFY_STALE') {
+        log.dim('Verify the run first: intutic loop verify <loopRunId>');
+    }
+}
+/** Strips quotes and brackets from both ends, in linear time. */
+function trimQuoted(v) {
+    const q = (c) => c === '"' || c === "'" || c === '[' || c === ']';
+    let a = 0;
+    let b = v.length;
+    while (a < b && q(v[a]))
+        a++;
+    while (b > a && q(v[b - 1]))
+        b--;
+    return v.slice(a, b);
+}
+/**
+ * The local half of a verify: every changed path must be
+ * inside the `scope_paths` of the local SOPs the session selected (and that
+ * declare no `roles:`; a loop has no agent role). No tolerance: a verify is a
+ * boundary check. Returns the findings; empty passes.
+ */
+async function localScopeFindings(workspaceRoot, changed) {
+    const sops = await loadLocalSopEntries(workspaceRoot, []);
+    const scopes = [];
+    for (const sop of sops) {
+        const front = sop.content.trimStart().startsWith('---') ? sop.content.trimStart().slice(3).split('\n---')[0] ?? '' : '';
+        if (front.split('\n').some((l) => l.startsWith('roles:') && l.slice(6).trim() !== ''))
+            continue;
+        for (const line of front.split('\n')) {
+            const t = line.trim();
+            if (!t.startsWith('scope_paths:'))
+                continue;
+            for (const piece of t.slice('scope_paths:'.length).split(',')) {
+                const v = trimQuoted(piece.trim());
+                if (v)
+                    scopes.push(v);
+            }
+        }
+    }
+    if (scopes.length === 0)
+        return [];
+    const out = changed.filter((p) => !isWithinScope(p, scopes));
+    return out.length === 0 ? [] : [`Changed outside scope_paths (${scopes.join(', ')}): ${out.slice(0, 10).join(', ')}${out.length > 10 ? ', …' : ''}`];
+}
+/**
+ * Verifies a loop run: the diff from `--base` (or the commit
+ * the run started from) is checked against the local SOPs' `scope_paths`
+ * first; a local failure stops it with nothing sent. Then the control plane
+ * checks scope and plan, and asks the judge only if those pass. True when the
+ * verify passed.
+ */
+export async function verifyLoopRun(loopRunId, opts, client) {
+    const config = loadConfig();
+    const workspaceRoot = config?.workspaceRoot ?? process.cwd();
+    const base = opts.base || process.env.INTUTIC_LOOP_BASE_COMMIT || (await loopEnvValue('INTUTIC_LOOP_BASE_COMMIT')) || 'HEAD';
+    let diff;
+    let files;
+    try {
+        diff = execFileSync('git', ['diff', base], { cwd: workspaceRoot, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+        files = execFileSync('git', ['diff', '--name-only', base], { cwd: workspaceRoot, encoding: 'utf8' }).split('\n').filter(Boolean).slice(0, 2000);
+    }
+    catch (err) {
+        log.error(`Could not take the diff against ${base}: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+    const local = await localScopeFindings(workspaceRoot, files);
+    if (local.length > 0) {
+        log.error('The run fails the local scope check; nothing was sent.');
+        for (const f of local)
+            log.info(`  - ${f}`);
+        return false;
+    }
+    if (!diff.trim())
+        diff = `(no changes against ${base})`;
+    const api = client ?? (await getClient(opts.dev));
+    const res = await api.postWithStatus(`/api/v1/loops/${loopRunId}/verify`, {
+        diff,
+        taskDescription: opts.task || `Loop run ${loopRunId}`,
+        ...(files.length > 0 ? { files } : {}),
+        base,
+    });
+    if (res.status !== 200) {
+        log.error(`Verify failed (${res.status}): ${res.body.error ?? 'refused'}`);
+        return false;
+    }
+    const v = res.body;
+    for (const c of v.checks ?? []) {
+        log.info(`  ${c.id}: ${c.status}`);
+        for (const f of c.findings)
+            log.dim(`      ${f}`);
+    }
+    if (v.ok && !v.unverified) {
+        log.success(`Verified (${v.stage ?? 'judge'}${v.verificationId ? `, ${v.verificationId}` : ''}).`);
+        return true;
+    }
+    log.error(v.unverified ? 'Nothing could verify this run (no scope, plan or judge applied).' : `Verify did not pass (${v.stage ?? 'judge'}).`);
+    for (const f of v.findings ?? [])
+        log.info(`  - ${f}`);
+    return false;
+}
+export async function runLoopVerify(loopRunId, opts) {
+    log.header('Intutic — Verify Loop');
+    if (!(await verifyLoopRun(loopRunId, opts)))
+        process.exitCode = 1;
+}
 export async function runLoopComplete(loopRunId, opts) {
     log.header('Intutic — Complete Loop');
     const client = await getClient(opts.dev);
     try {
-        const res = await client.post(`/api/v1/loops/${loopRunId}/complete`);
+        const done = await client.postWithStatus(`/api/v1/loops/${loopRunId}/complete`);
+        if (done.status === 409 || done.status === 503) {
+            printLoopRefusal(done.status, done.body);
+            process.exit(1);
+        }
+        if (done.status !== 200)
+            throw new Error(`API POST /api/v1/loops/${loopRunId}/complete failed (${done.status}): ${done.body.error ?? ''}`);
+        const res = done.body;
         if (res.ok) {
             log.success(`Loop run ${loopRunId} completed.`);
             // Clean env
@@ -1109,6 +1251,7 @@ export async function runLoopExec(commandAndArgs, opts) {
         }
         const loopRunId = res.loop.loopRunId;
         log.success(`Loop run registered: ${loopRunId}`);
+        await writeLoopEnv(loopRunId, workspaceRoot);
         // Execute process with INTUTIC_LOOP_RUN_ID in environment
         const childEnv = {
             ...process.env,
@@ -1152,9 +1295,31 @@ export async function runLoopExec(commandAndArgs, opts) {
                 // than leaving the run open on a transient error.
             }
             if (code === 0) {
-                await client
-                    .post(`/api/v1/loops/${loopRunId}/complete`, { outcome: 'SUCCEEDED' })
-                    .catch(() => { });
+                // The completion gate: when the workspace requires a
+                // verified completion, verify first. A refusal is shown and leaves the
+                // run ACTIVE, and the wrapper exits non-zero.
+                let gated = false;
+                try {
+                    const detail = await client.get(`/api/v1/loops/${loopRunId}`);
+                    gated = detail?.requiresVerifiedCompletion === true;
+                }
+                catch {
+                    // Unknown: complete as usual; the server refuses an unverified run itself.
+                }
+                if (gated && !(await verifyLoopRun(loopRunId, { task: loopName, dev: opts.dev }, client))) {
+                    log.warn(`The run stays ACTIVE. Fix it and run: intutic loop verify ${loopRunId} && intutic loop complete ${loopRunId}`);
+                    process.exit(1);
+                    return;
+                }
+                const done = await client
+                    .postWithStatus(`/api/v1/loops/${loopRunId}/complete`, { outcome: 'SUCCEEDED' })
+                    .catch((err) => ({ status: 0, body: { error: err instanceof Error ? err.message : String(err) } }));
+                if (done.status !== 200) {
+                    printLoopRefusal(done.status, done.body);
+                    log.warn('The run stays ACTIVE.');
+                    process.exit(1);
+                    return;
+                }
                 log.success('Loop command execution succeeded. Wrapper loop marked COMPLETED.');
             }
             else {