@iowarp/clio-coder 0.3.6 → 0.3.8

package/dist/chunk-TTHACPOM.js

@@ -0,0 +1,961 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  AGENT_AUTOMATION_AUTHORITIES
+} from "./chunk-AOCYTWAV.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/core/json-payload.ts
+init_esm_shims();
+function jsonPayloadCandidates(text) {
+  const trimmed = text.trim();
+  const candidates = [trimmed];
+  const fenced = /```[A-Za-z0-9_-]*\s*\n?([\s\S]*?)```/.exec(trimmed)?.[1]?.trim();
+  if (fenced !== void 0 && fenced.length > 0) candidates.push(fenced);
+  const start = trimmed.indexOf("{");
+  const end = trimmed.lastIndexOf("}");
+  if (start >= 0 && end > start) candidates.push(trimmed.slice(start, end + 1));
+  return candidates;
+}
+function parseJsonObjectPayload(text) {
+  let parsedSomething = false;
+  for (const candidate of jsonPayloadCandidates(text)) {
+    let value;
+    try {
+      value = JSON.parse(candidate);
+    } catch {
+      continue;
+    }
+    parsedSomething = true;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) continue;
+    return { ok: true, value };
+  }
+  return { ok: false, reason: parsedSomething ? "not-object" : "not-json" };
+}
+
+// src/domains/agents/result-contract.ts
+init_esm_shims();
+import { createHash } from "node:crypto";
+import path from "node:path";
+function parseDelegationPlanResult(output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok || !hasOnlyKeys(parsed.value, ["tasks"]) || !Array.isArray(parsed.value.tasks) || parsed.value.tasks.length === 0)
+    return null;
+  const tasks = [];
+  for (const raw of parsed.value.tasks) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const task = raw;
+    if (!hasOnlyKeys(task, ["id", "agent", "description", "depends_on", "writes", "mode"]) || !string(task.id) || !string(task.agent) || !string(task.description) || !Array.isArray(task.depends_on) || task.depends_on.some((entry) => !string(entry)) || !Array.isArray(task.writes) || task.writes.some((entry) => !string(entry)) || task.mode !== void 0 && task.mode !== "sequential" && task.mode !== "parallel")
+      return null;
+    tasks.push({
+      id: task.id,
+      agent: task.agent,
+      description: task.description,
+      depends_on: [...task.depends_on],
+      writes: [...task.writes],
+      ...task.mode !== void 0 ? { mode: task.mode } : {}
+    });
+  }
+  return { tasks };
+}
+var COUNCIL_BALLOT_VERDICT_MAX_BYTES = 64;
+var COUNCIL_BALLOT_SHAPE = '{"verdict":"yes","text":"the answer and the evidence behind it"}';
+function parseCouncilBallot(output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return null;
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["verdict", "text"]) || !string(value.verdict) || !string(value.text)) return null;
+  const verdict = value.verdict.trim();
+  if (verdict.includes("\n") || Buffer.byteLength(verdict, "utf8") > COUNCIL_BALLOT_VERDICT_MAX_BYTES) return null;
+  return { verdict, text: value.text.trim() };
+}
+function validateCouncilBallot(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const ballot = parseCouncilBallot(output);
+  if (ballot === null) {
+    return failure(
+      contract,
+      "unmeasured",
+      `A council ballot must carry only verdict and text, both non-empty strings, with verdict a single line of at most ${COUNCIL_BALLOT_VERDICT_MAX_BYTES} bytes so the tally can match it against the other members`
+    );
+  }
+  return success(contract, "unmeasured", ballot);
+}
+function parseCouncilReport(output) {
+  if (output === null) return null;
+  const parsed = parseJsonObjectPayload(output);
+  if (!parsed.ok) return null;
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["members", "synthesis"]) || !Array.isArray(value.members) || value.members.length === 0) {
+    return null;
+  }
+  const members = [];
+  for (const raw of value.members) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const member = raw;
+    if (!hasOnlyKeys(member, ["label", "runId", "round", "answer", "verdict", "failed"]) || !string(member.label) || !string(member.runId) || !Number.isInteger(member.round) || Number(member.round) < 1 || typeof member.answer !== "string" || member.verdict !== void 0 && !string(member.verdict))
+      return null;
+    let failed;
+    if (member.failed !== void 0) {
+      if (member.failed === null || typeof member.failed !== "object" || Array.isArray(member.failed) || !hasOnlyKeys(member.failed, ["reason"]) || !string(member.failed.reason))
+        return null;
+      failed = { reason: member.failed.reason };
+    }
+    members.push({
+      label: member.label,
+      runId: member.runId,
+      round: Number(member.round),
+      answer: member.answer,
+      ...member.verdict !== void 0 ? { verdict: member.verdict } : {},
+      ...failed !== void 0 ? { failed } : {}
+    });
+  }
+  if (value.synthesis === null || typeof value.synthesis !== "object" || Array.isArray(value.synthesis)) return null;
+  const rawSynthesis = value.synthesis;
+  if (!hasOnlyKeys(rawSynthesis, ["kind", "text", "verdict", "tally", "judgeRunId"])) return null;
+  if (rawSynthesis.kind !== "none" && rawSynthesis.kind !== "judge" && rawSynthesis.kind !== "vote") return null;
+  for (const key of ["text", "verdict", "judgeRunId"]) {
+    if (rawSynthesis[key] !== void 0 && !string(rawSynthesis[key])) return null;
+  }
+  let tally;
+  if (rawSynthesis.tally !== void 0) {
+    if (rawSynthesis.tally === null || typeof rawSynthesis.tally !== "object" || Array.isArray(rawSynthesis.tally))
+      return null;
+    tally = {};
+    for (const [key, count] of Object.entries(rawSynthesis.tally)) {
+      if (!key || !Number.isInteger(count) || Number(count) < 0) return null;
+      tally[key] = Number(count);
+    }
+  }
+  return {
+    members,
+    synthesis: {
+      kind: rawSynthesis.kind,
+      ...rawSynthesis.text !== void 0 ? { text: rawSynthesis.text } : {},
+      ...rawSynthesis.verdict !== void 0 ? { verdict: rawSynthesis.verdict } : {},
+      ...tally !== void 0 ? { tally } : {},
+      ...rawSynthesis.judgeRunId !== void 0 ? { judgeRunId: rawSynthesis.judgeRunId } : {}
+    }
+  };
+}
+function canonical(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("result contract cannot digest non-finite numbers");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
+  }
+  throw new Error(`result contract cannot digest ${typeof value}`);
+}
+function digest(value) {
+  return createHash("sha256").update(canonical(value), "utf8").digest("hex");
+}
+function resultContractDigest(contract) {
+  return digest(contract);
+}
+function resultContractSourceId(contract) {
+  return `agent-result-contract:${contract.kind}:${resultContractDigest(contract)}`;
+}
+function failure(contract, quality, reason) {
+  return {
+    conformance: "fail",
+    quality,
+    sourceId: resultContractSourceId(contract),
+    validatorDigest: digest({ contract, reason }),
+    reason
+  };
+}
+function success(contract, quality, value, extra = {}) {
+  return {
+    conformance: "pass",
+    quality,
+    sourceId: resultContractSourceId(contract),
+    validatorDigest: digest({ contract, value }),
+    ...extra
+  };
+}
+function parseJson(output) {
+  if (output === null || output.trim().length === 0) return { ok: false, reason: "missing final result" };
+  const parsed = parseJsonObjectPayload(output);
+  if (parsed.ok) return parsed;
+  return {
+    ok: false,
+    reason: parsed.reason === "not-object" ? "result must be a JSON object" : "result must be valid JSON"
+  };
+}
+function hasOnlyKeys(value, keys) {
+  const allowed = new Set(keys);
+  return Object.keys(value).every((key) => allowed.has(key));
+}
+function string(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function parseFindings(value) {
+  if (!Array.isArray(value)) return null;
+  const findings = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const finding = entry;
+    const line = finding.line;
+    if (!hasOnlyKeys(finding, ["claim", "path", "line"]) || !string(finding.claim) || !string(finding.path) || typeof line !== "number" || !Number.isSafeInteger(line) || line < 1) {
+      return null;
+    }
+    findings.push({ claim: finding.claim, path: finding.path, line });
+  }
+  return findings;
+}
+var RESULT_CONTRACT_KINDS = [
+  "architect-plan",
+  "scout-report",
+  "verifier-report",
+  "council-report",
+  "debugger-report",
+  "research-report",
+  "mutation-report",
+  "provenance-report",
+  "external-delegation"
+];
+function parseSubtasks(value) {
+  if (!Array.isArray(value) || value.length > 4) return null;
+  const subtasks = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const subtask = entry;
+    if (!hasOnlyKeys(subtask, ["id", "task", "dependencies", "expectedResultContract", "requestedAuthority"]) || !string(subtask.id) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(subtask.id) || ids.has(subtask.id) || !string(subtask.task) || Buffer.byteLength(subtask.task, "utf8") > 4096 || !Array.isArray(subtask.dependencies) || subtask.dependencies.length > 4 || subtask.dependencies.some((dependency) => !string(dependency)) || new Set(subtask.dependencies).size !== subtask.dependencies.length || !RESULT_CONTRACT_KINDS.includes(subtask.expectedResultContract) || !AGENT_AUTOMATION_AUTHORITIES.includes(subtask.requestedAuthority)) {
+      return null;
+    }
+    ids.add(subtask.id);
+    subtasks.push({
+      id: subtask.id,
+      task: subtask.task,
+      dependencies: [...subtask.dependencies],
+      expectedResultContract: subtask.expectedResultContract,
+      requestedAuthority: subtask.requestedAuthority
+    });
+  }
+  for (const subtask of subtasks) {
+    if (subtask.dependencies.some((dependency) => dependency === subtask.id || !ids.has(dependency))) return null;
+  }
+  const remaining = new Set(ids);
+  const completed = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = subtasks.filter(
+      (subtask) => remaining.has(subtask.id) && subtask.dependencies.every((dependency) => completed.has(dependency))
+    );
+    if (ready.length === 0) return null;
+    for (const subtask of ready) {
+      remaining.delete(subtask.id);
+      completed.add(subtask.id);
+    }
+  }
+  return subtasks;
+}
+function isContextHandbookResult(value) {
+  if (!hasOnlyKeys(value, ["projectName", "identity", "conventions", "invariants", "sections"])) return false;
+  if (!string(value.projectName) || !string(value.identity)) return false;
+  if (!Array.isArray(value.conventions) || value.conventions.some((entry) => !string(entry))) return false;
+  if (!Array.isArray(value.invariants) || value.invariants.some((entry) => !string(entry))) return false;
+  if (!Array.isArray(value.sections)) return false;
+  return value.sections.every((entry) => {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
+    const section = entry;
+    return hasOnlyKeys(section, ["title", "body"]) && string(section.title) && string(section.body);
+  });
+}
+function validateContextHandbook(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  if (!isContextHandbookResult(parsed.value)) {
+    return failure(
+      contract,
+      "fail",
+      "context handbook result must carry projectName, identity, conventions[], invariants[], and sections[{title, body}] and nothing else"
+    );
+  }
+  return success(contract, "unmeasured", parsed.value);
+}
+function salvageScoutClaims(value) {
+  const grounded = [];
+  const ungrounded = [];
+  if (!Array.isArray(value)) return { grounded, ungrounded };
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const finding = entry;
+    if (!string(finding.claim)) continue;
+    const line = finding.line;
+    if (string(finding.path) && typeof line === "number" && Number.isSafeInteger(line) && line >= 1) {
+      grounded.push({ claim: finding.claim, path: finding.path, line });
+      continue;
+    }
+    ungrounded.push(finding.claim);
+  }
+  return { grounded, ungrounded };
+}
+function degradedScout(contract, value, reason) {
+  const salvaged = salvageScoutClaims(value.findings);
+  if (salvaged.grounded.length === 0 && salvaged.ungrounded.length === 0) return null;
+  const degradedReason = `${reason} (accepted as a degraded reconnaissance result; findings are leads, not validation evidence)`;
+  const scout = {
+    findings: salvaged.grounded,
+    citations: salvaged.grounded.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
+    needsSplit: false,
+    proposedSubtasks: [],
+    ungroundedClaims: salvaged.ungrounded,
+    degradedReason
+  };
+  return success(contract, "unmeasured", scout, { scout, reason: degradedReason });
+}
+function validateScout(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  const value = parsed.value;
+  const degrade = (reason) => degradedScout(contract, value, reason) ?? failure(contract, "fail", reason);
+  if (!hasOnlyKeys(value, ["findings", "needsSplit", "proposedSubtasks"])) {
+    return degrade("Scout result has unknown fields");
+  }
+  const findings = parseFindings(value.findings);
+  const proposedSubtasks = parseSubtasks(value.proposedSubtasks);
+  if (findings === null || typeof value.needsSplit !== "boolean" || proposedSubtasks === null) {
+    return degrade(
+      "Scout result must carry findings as {claim, path, line} objects, needsSplit, and 0..4 typed proposed subtasks"
+    );
+  }
+  if (value.needsSplit !== proposedSubtasks.length > 0) {
+    return degrade("Scout needsSplit must agree with proposedSubtasks");
+  }
+  if (findings.length === 0 && !value.needsSplit) {
+    return degrade("Scout result must carry at least one cited finding, or set needsSplit");
+  }
+  if (value.needsSplit && findings.length > 0) {
+    return degrade("Scout split recommendations carry typed subtasks instead of findings");
+  }
+  const scout = {
+    findings,
+    citations: findings.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
+    needsSplit: value.needsSplit,
+    proposedSubtasks
+  };
+  return success(contract, "pass", scout, { scout });
+}
+function parseChecks(value) {
+  if (!Array.isArray(value) || value.length === 0) return null;
+  const checks = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const check = entry;
+    if (!hasOnlyKeys(check, ["name", "passed", "evidence"]) || !string(check.name) || typeof check.passed !== "boolean" || !string(check.evidence)) {
+      return null;
+    }
+    checks.push({ name: check.name, passed: check.passed, evidence: check.evidence });
+  }
+  return checks;
+}
+function validateScoutCitation(input, citation) {
+  const cwd = path.resolve(input.cwd);
+  const citedPath = path.resolve(cwd, citation.path);
+  const relative = path.relative(cwd, citedPath);
+  if (relative === "" || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative)) {
+    return { ok: false, reason: `Scout citation path escapes the workspace: ${citation.path}` };
+  }
+  const content = input.filesystem.readFile(citedPath);
+  if (content === null) return { ok: false, reason: `Scout citation cannot be read: ${citation.path}` };
+  const lineCount = content.split(/\r\n|\r|\n/u).length;
+  if (citation.line > lineCount) {
+    return { ok: false, reason: `Scout citation is past end of file: ${citation.path}:${citation.line}` };
+  }
+  if (input.observedReadRanges !== void 0) {
+    const spans = input.observedReadRanges.get(citedPath) ?? [];
+    if (!spans.some(([start, end]) => citation.line >= start && citation.line <= end)) {
+      const observed = spans.length === 0 ? "this run never read that file" : `this run read only ${spans.map(([start, end]) => `${start}-${end}`).join(", ")}`;
+      return {
+        ok: false,
+        reason: `Scout citation is not grounded in a live read: ${citation.path}:${citation.line} (${observed})`
+      };
+    }
+  }
+  return {
+    ok: true,
+    evidence: { ...citation, contentDigest: createHash("sha256").update(content, "utf8").digest("hex") }
+  };
+}
+function validateScoutCitations(input, citations) {
+  const evidence = [];
+  for (const citation of citations) {
+    const checked = validateScoutCitation(input, citation);
+    if (!checked.ok) return checked;
+    evidence.push(checked.evidence);
+  }
+  return { ok: true, evidence };
+}
+function groundDegradedScout(contract, input, scout, degradedReason) {
+  const grounded = [];
+  const evidence = [];
+  const demoted = [];
+  for (const finding of scout.findings) {
+    const checked = validateScoutCitation(input, { path: finding.path, line: finding.line });
+    if (checked.ok) {
+      grounded.push(finding);
+      evidence.push(checked.evidence);
+      continue;
+    }
+    demoted.push(finding.claim);
+  }
+  const degraded = {
+    findings: grounded,
+    citations: grounded.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
+    needsSplit: false,
+    proposedSubtasks: [],
+    ungroundedClaims: [...scout.ungroundedClaims ?? [], ...demoted],
+    degradedReason
+  };
+  return success(contract, "unmeasured", { scout: degraded, evidence }, { scout: degraded, reason: degradedReason });
+}
+function validateVerifier(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["verdict", "checks"]) || value.verdict !== "pass" && value.verdict !== "fail") {
+    return failure(contract, "fail", "Verifier result must carry pass or fail verdict and checks");
+  }
+  const checks = parseChecks(value.checks);
+  if (checks === null || value.verdict === "pass" !== checks.every((check) => check.passed)) {
+    return failure(contract, "fail", "Verifier verdict must agree with every typed check");
+  }
+  const verifier = { verdict: value.verdict, checks };
+  return success(contract, value.verdict, verifier, { verifier });
+}
+function parseVerifierResult(output) {
+  const validation = validateVerifier({ kind: "verifier-report" }, output);
+  return validation.verifier ?? null;
+}
+function validateOracle(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["verdict", "challenge", "changesMyMind", "citedDecisions"]) || !string(value.verdict) || !string(value.challenge) || !string(value.changesMyMind) || !Array.isArray(value.citedDecisions) || value.citedDecisions.some((entry) => !string(entry))) {
+    return failure(
+      contract,
+      "unmeasured",
+      'Oracle result must carry verdict, challenge, changesMyMind, and a citedDecisions array of strings, for example {"verdict":"consistent with decision routing.target","challenge":"...","changesMyMind":"...","citedDecisions":["routing.target"]}'
+    );
+  }
+  return success(contract, "unmeasured", value);
+}
+function parseOracleResult(output) {
+  const validation = validateOracle({ kind: "oracle-report" }, output);
+  if (validation.conformance !== "pass") return null;
+  const parsed = parseJson(output);
+  if (!parsed.ok) return null;
+  return {
+    verdict: String(parsed.value.verdict),
+    challenge: String(parsed.value.challenge),
+    changesMyMind: String(parsed.value.changesMyMind),
+    citedDecisions: parsed.value.citedDecisions.map((entry) => String(entry))
+  };
+}
+function validateCodeReport(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["passed", "exitCode", "checks", "artifactPaths", "outputExcerpt"]) || typeof value.passed !== "boolean" || typeof value.exitCode !== "number" || !Number.isSafeInteger(value.exitCode) || typeof value.outputExcerpt !== "string" || !Array.isArray(value.artifactPaths) || value.artifactPaths.some((entry) => !string(entry))) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Code result must carry passed, integer exitCode, checks, artifactPaths, and outputExcerpt"
+    );
+  }
+  const checks = parseChecks(value.checks);
+  if (checks === null) return failure(contract, "unmeasured", "Code result must carry typed checks");
+  if (value.passed !== (value.exitCode === 0) || value.passed !== checks.every((check) => check.passed)) {
+    return failure(contract, "unmeasured", "Code result passed must agree with its exit code and every check");
+  }
+  return success(contract, "unmeasured", value);
+}
+var RESULT_COMMIT_MESSAGE_MAX_BYTES = 1e3;
+var AUTHORSHIP_FIELDS = ["commitMessage", "summary"];
+function hasControlCharacters(value) {
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if (code === 127) return true;
+    if (code < 32 && character !== "\n" && character !== "\r" && character !== "	") return true;
+  }
+  return false;
+}
+function normalizeAuthored(value) {
+  return value.replace(/\r\n/gu, "\n").replace(/\r/gu, "\n").trim();
+}
+function validateAuthorship(value) {
+  for (const field of AUTHORSHIP_FIELDS) {
+    const raw = value[field];
+    if (raw === void 0 || raw === null) continue;
+    if (typeof raw !== "string") return `${field} must be a string when present`;
+    if (raw.trim().length === 0) continue;
+    if (Buffer.byteLength(raw, "utf8") > RESULT_COMMIT_MESSAGE_MAX_BYTES) {
+      return `${field} must be at most ${RESULT_COMMIT_MESSAGE_MAX_BYTES} bytes`;
+    }
+    if (hasControlCharacters(raw)) return `${field} must not contain control characters`;
+  }
+  return null;
+}
+function resultContractAuthorship(contract, output) {
+  const empty = { commitMessage: null, summary: null };
+  if (contract.kind !== "mutation-report" && contract.kind !== "architect-plan") return empty;
+  const parsed = parseJson(output);
+  if (!parsed.ok || validateAuthorship(parsed.value) !== null) return empty;
+  const read = (field) => {
+    const raw = parsed.value[field];
+    if (typeof raw !== "string") return null;
+    const normalized = normalizeAuthored(raw);
+    return normalized.length === 0 ? null : normalized;
+  };
+  return { commitMessage: read("commitMessage"), summary: read("summary") };
+}
+function validateDebugger(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["diagnosis", "reproduction", "evidence"]) || !string(value.diagnosis) || value.reproduction !== "reproduced" && value.reproduction !== "not-reproduced" && value.reproduction !== "unknown" || !Array.isArray(value.evidence) || value.evidence.some((entry) => !string(entry))) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Debugger result must carry diagnosis, reproduction status, and evidence without a verdict"
+    );
+  }
+  return success(contract, "unmeasured", value);
+}
+function validateResearch(contract, output, networkAllowed) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["source", "findings"]) || value.source !== "local" && value.source !== "external" || !Array.isArray(value.findings)) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Research result must distinguish local or external sources and carry findings"
+    );
+  }
+  if (value.source === "external" && !networkAllowed) {
+    return failure(contract, "unmeasured", "external research requires an allowed network posture");
+  }
+  for (const finding of value.findings) {
+    if (finding === null || typeof finding !== "object" || Array.isArray(finding)) {
+      return failure(contract, "unmeasured", "Research findings must be objects");
+    }
+    const record = finding;
+    if (!hasOnlyKeys(record, ["claim", "evidence"]) || !string(record.claim) || !string(record.evidence)) {
+      return failure(contract, "unmeasured", "Research findings must carry claim and evidence");
+    }
+  }
+  return success(contract, "unmeasured", value);
+}
+function describeWriteSet(effects, cwd) {
+  if (effects.mutatedPaths.size === 0) return "this run wrote nothing";
+  const written = [...effects.mutatedPaths].map((target) => path.relative(cwd, target) || target).sort().slice(0, MUTATION_WRITE_SET_REASON_LIMIT);
+  const more = effects.mutatedPaths.size - written.length;
+  return `this run wrote ${written.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
+}
+var MUTATION_WRITE_SET_REASON_LIMIT = 8;
+function pathIsPresent(filesystem, target) {
+  if (filesystem.pathExists === void 0) return true;
+  return filesystem.pathExists(target);
+}
+var MUTATION_VALIDATION_EXAMPLE = '{"name":"npm test","passed":true,"evidence":"exit 0"}';
+function mutationValidationsReason(value) {
+  const empty = Array.isArray(value) && value.length === 0;
+  if (empty) {
+    return `Mutation result must carry typed validation results: validations was empty. Emit one entry per check this run actually made, each shaped like ${MUTATION_VALIDATION_EXAMPLE}. A run that only read files still names the read and cites what it saw.`;
+  }
+  return `Mutation result must carry typed validation results: every validations entry is shaped like ${MUTATION_VALIDATION_EXAMPLE}, with a string name, a boolean passed, a string evidence, and no other keys.`;
+}
+function validateMutation(contract, input) {
+  const parsed = parseJson(input.output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["mutatedPaths", "validations", "commitMessage", "summary"]) || !Array.isArray(value.mutatedPaths) || value.mutatedPaths.some((entry) => !string(entry))) {
+    return failure(contract, "unmeasured", "Mutation result must carry mutatedPaths and validations");
+  }
+  const authorship = validateAuthorship(value);
+  if (authorship !== null) return failure(contract, "unmeasured", authorship);
+  const validations = parseChecks(value.validations);
+  if (validations === null) return failure(contract, "unmeasured", mutationValidationsReason(value.validations));
+  const reportedFailure = !validations.every((check) => check.passed);
+  const effects = input.observedRunEffects;
+  if (effects === void 0) return success(contract, reportedFailure ? "fail" : "pass", value);
+  const cwd = path.resolve(input.cwd);
+  let unverifiedMutation = false;
+  for (const reported of value.mutatedPaths) {
+    const target = path.resolve(cwd, reported);
+    if (effects.mutatedPaths.has(target)) continue;
+    if (effects.failedMutationPaths.has(target)) {
+      return failure(
+        contract,
+        "unmeasured",
+        `Mutation result names a path whose only write this run attempted was refused: ${reported} (${describeWriteSet(effects, cwd)})`
+      );
+    }
+    if (pathIsPresent(input.filesystem, target)) {
+      unverifiedMutation = true;
+      continue;
+    }
+    return failure(
+      contract,
+      "unmeasured",
+      `Mutation result names a path this run never wrote and that does not exist: ${reported} (${describeWriteSet(effects, cwd)})`
+    );
+  }
+  if (reportedFailure) return success(contract, "fail", value);
+  const measured = !unverifiedMutation && effects.validationCommands.size > 0;
+  return success(contract, measured ? "pass" : "unmeasured", value);
+}
+function validateProvenance(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["confirmedFacts", "missingEvidence", "nextInspections"]) || ![value.confirmedFacts, value.missingEvidence, value.nextInspections].every(
+    (entry) => Array.isArray(entry) && entry.every((item) => string(item))
+  )) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Provenance result must carry confirmedFacts, missingEvidence, and nextInspections"
+    );
+  }
+  return success(contract, "unmeasured", value);
+}
+function validateArchitect(contract, input) {
+  const artifactPath = path.resolve(input.cwd, contract.path);
+  const content = input.filesystem.readFile(artifactPath);
+  if (content === null || content.trim().length === 0) {
+    return failure(contract, "unmeasured", `required plan artifact is missing or empty: ${contract.path}`);
+  }
+  return success(contract, "unmeasured", {
+    path: contract.path,
+    artifactDigest: createHash("sha256").update(content, "utf8").digest("hex")
+  });
+}
+function parseScoutResult(output) {
+  const validation = validateScout({ kind: "scout-report" }, output);
+  if (validation.conformance !== "pass" || validation.scout === void 0) return null;
+  return validation.scout.degradedReason === void 0 ? validation.scout : null;
+}
+function validateResultContract(input) {
+  switch (input.contract.kind) {
+    case "architect-plan":
+      return validateArchitect(input.contract, input);
+    case "scout-report": {
+      const validation = validateScout(input.contract, input.output);
+      if (validation.scout === void 0) return validation;
+      const degradedReason = validation.scout.degradedReason;
+      if (degradedReason !== void 0) {
+        return groundDegradedScout(input.contract, input, validation.scout, degradedReason);
+      }
+      const citations = validateScoutCitations(input, validation.scout.citations);
+      return citations.ok ? success(
+        input.contract,
+        "pass",
+        { scout: validation.scout, evidence: citations.evidence },
+        { scout: validation.scout }
+      ) : failure(input.contract, "fail", citations.reason);
+    }
+    case "verifier-report":
+      return validateVerifier(input.contract, input.output);
+    case "council-report": {
+      const report = parseCouncilReport(input.output);
+      return report === null ? failure(input.contract, "fail", "council-report is malformed") : success(input.contract, "unmeasured", { council: report });
+    }
+    case "council-ballot":
+      return validateCouncilBallot(input.contract, input.output);
+    case "debugger-report":
+      return validateDebugger(input.contract, input.output);
+    case "research-report":
+      return validateResearch(input.contract, input.output, input.networkAllowed);
+    case "mutation-report":
+      return validateMutation(input.contract, input);
+    case "provenance-report":
+      return validateProvenance(input.contract, input.output);
+    case "delegation-plan": {
+      const plan = parseDelegationPlanResult(input.output);
+      return plan === null ? failure(
+        input.contract,
+        "fail",
+        "delegation-plan must carry tasks with id, agent, description, depends_on, writes, and optional mode"
+      ) : success(input.contract, "unmeasured", plan, { delegationPlan: plan });
+    }
+    case "oracle-report":
+      return validateOracle(input.contract, input.output);
+    case "external-delegation":
+      return success(input.contract, "unmeasured", { external: true });
+    case "artifact-report":
+      return success(input.contract, "unmeasured", { artifact: true });
+    case "context-handbook":
+      return validateContextHandbook(input.contract, input.output);
+    case "code-report":
+      return validateCodeReport(input.contract, input.output);
+  }
+}
+function validateRecipeResult(input) {
+  if (input.contract === null) return null;
+  if (!input.reachedTerminalResult) {
+    return {
+      applicable: false,
+      fact: {
+        sourceId: resultContractSourceId(input.contract),
+        validatorDigest: digest({ contract: input.contract, reached: false }),
+        conformance: "not-reached",
+        quality: "unmeasured"
+      }
+    };
+  }
+  const validation = validateResultContract({
+    contract: input.contract,
+    output: input.output,
+    cwd: input.cwd,
+    networkAllowed: input.networkAllowed,
+    filesystem: input.filesystem,
+    ...input.observedRunEffects !== void 0 ? { observedRunEffects: input.observedRunEffects } : {}
+  });
+  return {
+    applicable: true,
+    validation,
+    fact: {
+      sourceId: validation.sourceId,
+      validatorDigest: validation.validatorDigest,
+      conformance: validation.conformance,
+      quality: validation.quality
+    }
+  };
+}
+var RESULT_CONTRACT_REPAIR_LIMIT = 2;
+var RESULT_CONTRACT_ANCHOR_LIMIT = 12;
+function resultContractShape(contract) {
+  switch (contract.kind) {
+    case "architect-plan":
+      return `a plan artifact written to ${contract.path}, then optionally {"commitMessage":"...","summary":"..."} describing it`;
+    case "scout-report":
+      return '{"findings":[{"claim":"what you observed","path":"src/file.ts","line":1}],"needsSplit":false,"proposedSubtasks":[]} or {"findings":[],"needsSplit":true,"proposedSubtasks":[{"id":"inspect","task":"Inspect the boundary","dependencies":[],"expectedResultContract":"scout-report","requestedAuthority":"read-only"}]} or, if you cannot produce a citation you are sure of, at least {"findings":[{"claim":"what you observed"}]}, which is accepted as an ungrounded lead rather than losing the run';
+    case "verifier-report":
+      return '{"verdict":"pass","checks":[{"name":"npm run typecheck","passed":true,"evidence":"exit 0"}]}';
+    case "council-report":
+      return '{"members":[{"label":"alpha","runId":"run-1","round":1,"answer":"..."}],"synthesis":{"kind":"none"}}';
+    case "council-ballot":
+      return COUNCIL_BALLOT_SHAPE;
+    case "debugger-report":
+      return '{"diagnosis":"...","reproduction":"reproduced","evidence":["..."]}';
+    case "research-report":
+      return '{"source":"local","findings":[{"claim":"...","evidence":"..."}]}';
+    case "mutation-report":
+      return '{"mutatedPaths":["src/file.ts"],"validations":[{"name":"npm test","passed":true,"evidence":"exit 0"}],"commitMessage":"optional: the commit message for this change","summary":"optional: one line"}';
+    case "provenance-report":
+      return '{"confirmedFacts":["..."],"missingEvidence":["..."],"nextInspections":["..."]}';
+    case "delegation-plan":
+      return '{"tasks":[{"id":"build","agent":"coder","description":"Implement the change","depends_on":[],"writes":["src"],"mode":"parallel"}]}';
+    case "oracle-report":
+      return '{"verdict":"one line","challenge":"the strongest objection you can mount","changesMyMind":"the evidence that would reverse the verdict","citedDecisions":["decision key or task id you relied on"]}';
+    case "external-delegation":
+      return "any final text";
+    case "artifact-report":
+      return "any final text; the artifact you wrote at the location the task named is the result";
+    case "context-handbook":
+      return '{"projectName":"string","identity":"one sentence","conventions":[],"invariants":[],"sections":[{"title":"Architecture","body":"markdown that cites `real/path.ts` tokens"}]}';
+    case "code-report":
+      return '{"passed":false,"exitCode":1,"checks":[{"name":"test","passed":false,"evidence":"exit 1"}],"artifactPaths":["/path/command.log"],"outputExcerpt":"..."}';
+  }
+}
+function resultContractRepairMessage(input) {
+  const last = input.attempt >= RESULT_CONTRACT_REPAIR_LIMIT;
+  const lines = [
+    last ? "FINAL RESULT REQUIRED IN THIS RESPONSE. Your previous response still did not satisfy this run's result contract." : "Your previous response did not satisfy this run's result contract.",
+    `Validator reason: ${input.reason}`,
+    input.toolsAvailable === true ? "You may use the admitted tools to repair this validator failure, then emit the required terminal result." : "Tool use is over. Answer from the evidence you already gathered.",
+    `Emit exactly this shape and nothing else: ${resultContractShape(input.contract)}`,
+    "Do not add prose, code fences, or commentary around it. Do not describe work you intend to do next."
+  ];
+  if (input.anchors.length > 0) {
+    lines.push(
+      "",
+      "Locations you read successfully in this run (use these exact path:line values):",
+      ...input.anchors.slice(-RESULT_CONTRACT_ANCHOR_LIMIT).map((anchor) => `- ${anchor}`)
+    );
+  }
+  return lines.join("\n");
+}
+var RESULT_CONTRACT_REPAIR_TOOL = "result_contract";
+function resultContractRepairMessages(input, origin) {
+  const id = `clio-result-contract-repair-${input.attempt}`;
+  const timestamp = Date.now();
+  return [
+    {
+      role: "assistant",
+      content: [{ type: "toolCall", id, name: RESULT_CONTRACT_REPAIR_TOOL, arguments: {} }],
+      stopReason: "toolUse",
+      usage: {
+        input: 0,
+        output: 0,
+        cacheRead: 0,
+        cacheWrite: 0,
+        totalTokens: 0,
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 }
+      },
+      ...origin,
+      timestamp
+    },
+    {
+      role: "toolResult",
+      toolCallId: id,
+      toolName: RESULT_CONTRACT_REPAIR_TOOL,
+      content: [{ type: "text", text: resultContractRepairMessage(input) }],
+      isError: true,
+      timestamp
+    }
+  ];
+}
+var RECIPE_DECLARABLE_KINDS = [
+  "scout-report",
+  "verifier-report",
+  "council-report",
+  "debugger-report",
+  "research-report",
+  "mutation-report",
+  "provenance-report",
+  "oracle-report",
+  "external-delegation",
+  "artifact-report",
+  "context-handbook",
+  "delegation-plan"
+];
+var COORDINATOR_AUTHORED_KINDS = ["council-ballot"];
+function parseContract(value, sourcePath, kinds) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`agent recipe: ${sourcePath}: resultContract must be an object`);
+  }
+  const record = value;
+  if (typeof record.kind !== "string") throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is required`);
+  const keys = Object.keys(record);
+  const only = (...allowed) => keys.every((key) => allowed.includes(key));
+  if (record.kind === "architect-plan") {
+    if (!only("kind", "path") || !string(record.path)) {
+      throw new Error(`agent recipe: ${sourcePath}: architect-plan requires only non-empty path`);
+    }
+    if (path.isAbsolute(record.path) || record.path.split(/[\\/]/u).includes("..")) {
+      throw new Error(`agent recipe: ${sourcePath}: architect-plan path must be workspace-relative`);
+    }
+    return { kind: "architect-plan", path: record.path };
+  }
+  if (!kinds.includes(record.kind) || !only("kind")) {
+    throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is unsupported or has unknown keys`);
+  }
+  return { kind: record.kind };
+}
+function parseResultContract(value, sourcePath) {
+  return parseContract(value, sourcePath, RECIPE_DECLARABLE_KINDS);
+}
+function parseWorkerResultContract(value, sourcePath) {
+  return parseContract(value, sourcePath, [...RECIPE_DECLARABLE_KINDS, ...COORDINATOR_AUTHORED_KINDS]);
+}
+
+// src/core/path-boundary.ts
+init_esm_shims();
+import path2 from "node:path";
+var PATH_BOUNDARY_MAX_ENTRIES = 32;
+var PathBoundaryError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "PathBoundaryError";
+    this.code = code;
+  }
+};
+var GLOB_CHARACTERS = /[*?[\]{}]/u;
+function normalizePathBoundaryEntry(entry) {
+  const raw = entry.trim();
+  if (raw.length === 0) throw new PathBoundaryError("empty", "write boundary: entry must be a non-empty path");
+  if (raw.includes("\\")) {
+    throw new PathBoundaryError("separator", `write boundary: entry '${entry}' must use '/' separators`);
+  }
+  if (GLOB_CHARACTERS.test(raw)) {
+    throw new PathBoundaryError("glob", `write boundary: entry '${entry}' looks like a glob, which v1 does not support`);
+  }
+  if (raw.startsWith("/") || /^[A-Za-z]:/u.test(raw)) {
+    throw new PathBoundaryError("absolute", `write boundary: entry '${entry}' must be repository-relative, not absolute`);
+  }
+  const subtree = raw.endsWith("/");
+  const segments = raw.split("/").filter((segment) => segment.length > 0);
+  if (segments.length === 0) {
+    throw new PathBoundaryError("empty", `write boundary: entry '${entry}' must name a path inside the repository`);
+  }
+  for (const segment of segments) {
+    if (segment === "..") {
+      throw new PathBoundaryError("parent", `write boundary: entry '${entry}' must not contain '..'`);
+    }
+    if (segment === ".") {
+      throw new PathBoundaryError("dot", `write boundary: entry '${entry}' must not contain '.' segments`);
+    }
+  }
+  const joined = segments.join("/");
+  return subtree ? `${joined}/` : joined;
+}
+function normalizePathBoundary(entries) {
+  if (entries.length > PATH_BOUNDARY_MAX_ENTRIES) {
+    throw new Error(`write boundary: at most ${PATH_BOUNDARY_MAX_ENTRIES} entries may be declared`);
+  }
+  return [...new Set(entries.map(normalizePathBoundaryEntry))].sort();
+}
+function toPosixBoundaryPath(value) {
+  return value.split("\\").join("/");
+}
+function isDirectoryPathBoundary(entry) {
+  return toPosixBoundaryPath(entry).endsWith("/");
+}
+function asDirectoryPathBoundary(entry) {
+  const normalized = toPosixBoundaryPath(entry);
+  return normalized.endsWith("/") ? normalized : `${normalized}/`;
+}
+function resolvePathBoundary(cwd, entry) {
+  const directory = isDirectoryPathBoundary(entry);
+  const withoutMarker = directory ? entry.slice(0, -1) : entry;
+  const resolved = toPosixBoundaryPath(path2.resolve(cwd, withoutMarker));
+  return directory ? asDirectoryPathBoundary(resolved) : resolved;
+}
+function pathBoundaryEntryCovers(outer, inner) {
+  const normalizedOuter = toPosixBoundaryPath(outer);
+  const normalizedInner = toPosixBoundaryPath(inner);
+  return normalizedOuter.endsWith("/") ? normalizedInner.startsWith(normalizedOuter) : !normalizedInner.endsWith("/") && normalizedInner === normalizedOuter;
+}
+function pathBoundaryCovers(boundary, candidate) {
+  return boundary.some((entry) => pathBoundaryEntryCovers(entry, candidate));
+}
+
+export {
+  parseJsonObjectPayload,
+  COUNCIL_BALLOT_VERDICT_MAX_BYTES,
+  COUNCIL_BALLOT_SHAPE,
+  parseCouncilReport,
+  resultContractSourceId,
+  parseVerifierResult,
+  parseOracleResult,
+  resultContractAuthorship,
+  parseScoutResult,
+  validateResultContract,
+  validateRecipeResult,
+  RESULT_CONTRACT_REPAIR_LIMIT,
+  resultContractRepairMessages,
+  parseResultContract,
+  parseWorkerResultContract,
+  PATH_BOUNDARY_MAX_ENTRIES,
+  PathBoundaryError,
+  normalizePathBoundaryEntry,
+  normalizePathBoundary,
+  asDirectoryPathBoundary,
+  resolvePathBoundary,
+  pathBoundaryEntryCovers,
+  pathBoundaryCovers
+};
+//# sourceMappingURL=chunk-TTHACPOM.js.map