@iowarp/clio-coder 0.3.6 → 0.3.8

package/dist/{chunk-EKY57CSP.js → chunk-5H3GB5BO.js}

@@ -1,6 +1,12 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  AGENT_AUTOMATION_AUTHORITIES,
+  loadProjectVerifierCatalog
+} from "./chunk-A2NJGIB3.js";
+import {
+  pathBoundaryCovers,
+  resolvePathBoundary
+} from "./chunk-TTHACPOM.js";
+import {
   classify
 } from "./chunk-AOCYTWAV.js";
 import {
@@ -12,9 +18,6 @@ import {
   tokenizeShellLike,
   toolMutationPaths
 } from "./chunk-MV3K5QF2.js";
-import {
-  loadProjectVerifierCatalog
-} from "./chunk-FYYLNIL5.js";
 import {
   isProjectVerifierCheckId,
   isVerificationScriptName
@@ -28,715 +31,20 @@ import {
 import {
   foreignAgentDirs
 } from "./chunk-IHXBNWMM.js";
+import {
+  resolvePackageRoot
+} from "./chunk-IWHMRKLL.js";
 import {
   require_dist
 } from "./chunk-APJ265NV.js";
 import {
   clioConfigDir
 } from "./chunk-BNAZZHFG.js";
-import {
-  resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
 import {
   __toESM,
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
 
-// src/domains/agents/result-contract.ts
-init_esm_shims();
-import { createHash } from "node:crypto";
-import path from "node:path";
-
-// src/core/json-payload.ts
-init_esm_shims();
-function jsonPayloadCandidates(text) {
-  const trimmed = text.trim();
-  const candidates = [trimmed];
-  const fenced = /```[A-Za-z0-9_-]*\s*\n?([\s\S]*?)```/.exec(trimmed)?.[1]?.trim();
-  if (fenced !== void 0 && fenced.length > 0) candidates.push(fenced);
-  const start = trimmed.indexOf("{");
-  const end = trimmed.lastIndexOf("}");
-  if (start >= 0 && end > start) candidates.push(trimmed.slice(start, end + 1));
-  return candidates;
-}
-function parseJsonObjectPayload(text) {
-  let parsedSomething = false;
-  for (const candidate of jsonPayloadCandidates(text)) {
-    let value;
-    try {
-      value = JSON.parse(candidate);
-    } catch {
-      continue;
-    }
-    parsedSomething = true;
-    if (value === null || typeof value !== "object" || Array.isArray(value)) continue;
-    return { ok: true, value };
-  }
-  return { ok: false, reason: parsedSomething ? "not-object" : "not-json" };
-}
-
-// src/domains/agents/result-contract.ts
-function canonical(value) {
-  if (value === null) return "null";
-  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error("result contract cannot digest non-finite numbers");
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  if (typeof value === "object") {
-    const record = value;
-    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
-  }
-  throw new Error(`result contract cannot digest ${typeof value}`);
-}
-function digest(value) {
-  return createHash("sha256").update(canonical(value), "utf8").digest("hex");
-}
-function resultContractDigest(contract) {
-  return digest(contract);
-}
-function resultContractSourceId(contract) {
-  return `agent-result-contract:${contract.kind}:${resultContractDigest(contract)}`;
-}
-function failure(contract, quality, reason) {
-  return {
-    conformance: "fail",
-    quality,
-    sourceId: resultContractSourceId(contract),
-    validatorDigest: digest({ contract, reason }),
-    reason
-  };
-}
-function success(contract, quality, value, extra = {}) {
-  return {
-    conformance: "pass",
-    quality,
-    sourceId: resultContractSourceId(contract),
-    validatorDigest: digest({ contract, value }),
-    ...extra
-  };
-}
-function parseJson(output) {
-  if (output === null || output.trim().length === 0) return { ok: false, reason: "missing final result" };
-  const parsed = parseJsonObjectPayload(output);
-  if (parsed.ok) return parsed;
-  return {
-    ok: false,
-    reason: parsed.reason === "not-object" ? "result must be a JSON object" : "result must be valid JSON"
-  };
-}
-function hasOnlyKeys(value, keys) {
-  const allowed = new Set(keys);
-  return Object.keys(value).every((key) => allowed.has(key));
-}
-function string(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-function parseFindings(value) {
-  if (!Array.isArray(value)) return null;
-  const findings = [];
-  for (const entry of value) {
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
-    const finding = entry;
-    const line = finding.line;
-    if (!hasOnlyKeys(finding, ["claim", "path", "line"]) || !string(finding.claim) || !string(finding.path) || typeof line !== "number" || !Number.isSafeInteger(line) || line < 1) {
-      return null;
-    }
-    findings.push({ claim: finding.claim, path: finding.path, line });
-  }
-  return findings;
-}
-var RESULT_CONTRACT_KINDS = [
-  "architect-plan",
-  "scout-report",
-  "verifier-report",
-  "debugger-report",
-  "research-report",
-  "mutation-report",
-  "provenance-report",
-  "external-delegation"
-];
-function parseSubtasks(value) {
-  if (!Array.isArray(value) || value.length > 4) return null;
-  const subtasks = [];
-  const ids = /* @__PURE__ */ new Set();
-  for (const entry of value) {
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
-    const subtask = entry;
-    if (!hasOnlyKeys(subtask, ["id", "task", "dependencies", "expectedResultContract", "requestedAuthority"]) || !string(subtask.id) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(subtask.id) || ids.has(subtask.id) || !string(subtask.task) || Buffer.byteLength(subtask.task, "utf8") > 4096 || !Array.isArray(subtask.dependencies) || subtask.dependencies.length > 4 || subtask.dependencies.some((dependency) => !string(dependency)) || new Set(subtask.dependencies).size !== subtask.dependencies.length || !RESULT_CONTRACT_KINDS.includes(subtask.expectedResultContract) || !AGENT_AUTOMATION_AUTHORITIES.includes(subtask.requestedAuthority)) {
-      return null;
-    }
-    ids.add(subtask.id);
-    subtasks.push({
-      id: subtask.id,
-      task: subtask.task,
-      dependencies: [...subtask.dependencies],
-      expectedResultContract: subtask.expectedResultContract,
-      requestedAuthority: subtask.requestedAuthority
-    });
-  }
-  for (const subtask of subtasks) {
-    if (subtask.dependencies.some((dependency) => dependency === subtask.id || !ids.has(dependency))) return null;
-  }
-  const remaining = new Set(ids);
-  const completed = /* @__PURE__ */ new Set();
-  while (remaining.size > 0) {
-    const ready = subtasks.filter(
-      (subtask) => remaining.has(subtask.id) && subtask.dependencies.every((dependency) => completed.has(dependency))
-    );
-    if (ready.length === 0) return null;
-    for (const subtask of ready) {
-      remaining.delete(subtask.id);
-      completed.add(subtask.id);
-    }
-  }
-  return subtasks;
-}
-function isContextHandbookResult(value) {
-  if (!hasOnlyKeys(value, ["projectName", "identity", "conventions", "invariants", "sections"])) return false;
-  if (!string(value.projectName) || !string(value.identity)) return false;
-  if (!Array.isArray(value.conventions) || value.conventions.some((entry) => !string(entry))) return false;
-  if (!Array.isArray(value.invariants) || value.invariants.some((entry) => !string(entry))) return false;
-  if (!Array.isArray(value.sections)) return false;
-  return value.sections.every((entry) => {
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
-    const section = entry;
-    return hasOnlyKeys(section, ["title", "body"]) && string(section.title) && string(section.body);
-  });
-}
-function validateContextHandbook(contract, output) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
-  if (!isContextHandbookResult(parsed.value)) {
-    return failure(
-      contract,
-      "fail",
-      "context handbook result must carry projectName, identity, conventions[], invariants[], and sections[{title, body}] and nothing else"
-    );
-  }
-  return success(contract, "unmeasured", parsed.value);
-}
-function salvageScoutClaims(value) {
-  const grounded = [];
-  const ungrounded = [];
-  if (!Array.isArray(value)) return { grounded, ungrounded };
-  for (const entry of value) {
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) continue;
-    const finding = entry;
-    if (!string(finding.claim)) continue;
-    const line = finding.line;
-    if (string(finding.path) && typeof line === "number" && Number.isSafeInteger(line) && line >= 1) {
-      grounded.push({ claim: finding.claim, path: finding.path, line });
-      continue;
-    }
-    ungrounded.push(finding.claim);
-  }
-  return { grounded, ungrounded };
-}
-function degradedScout(contract, value, reason) {
-  const salvaged = salvageScoutClaims(value.findings);
-  if (salvaged.grounded.length === 0 && salvaged.ungrounded.length === 0) return null;
-  const degradedReason = `${reason} (accepted as a degraded reconnaissance result; findings are leads, not validation evidence)`;
-  const scout = {
-    findings: salvaged.grounded,
-    citations: salvaged.grounded.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
-    needsSplit: false,
-    proposedSubtasks: [],
-    ungroundedClaims: salvaged.ungrounded,
-    degradedReason
-  };
-  return success(contract, "unmeasured", scout, { scout, reason: degradedReason });
-}
-function validateScout(contract, output) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
-  const value = parsed.value;
-  const degrade = (reason) => degradedScout(contract, value, reason) ?? failure(contract, "fail", reason);
-  if (!hasOnlyKeys(value, ["findings", "needsSplit", "proposedSubtasks"])) {
-    return degrade("Scout result has unknown fields");
-  }
-  const findings = parseFindings(value.findings);
-  const proposedSubtasks = parseSubtasks(value.proposedSubtasks);
-  if (findings === null || typeof value.needsSplit !== "boolean" || proposedSubtasks === null) {
-    return degrade(
-      "Scout result must carry findings as {claim, path, line} objects, needsSplit, and 0..4 typed proposed subtasks"
-    );
-  }
-  if (value.needsSplit !== proposedSubtasks.length > 0) {
-    return degrade("Scout needsSplit must agree with proposedSubtasks");
-  }
-  if (findings.length === 0 && !value.needsSplit) {
-    return degrade("Scout result must carry at least one cited finding, or set needsSplit");
-  }
-  if (value.needsSplit && findings.length > 0) {
-    return degrade("Scout split recommendations carry typed subtasks instead of findings");
-  }
-  const scout = {
-    findings,
-    citations: findings.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
-    needsSplit: value.needsSplit,
-    proposedSubtasks
-  };
-  return success(contract, "pass", scout, { scout });
-}
-function parseChecks(value) {
-  if (!Array.isArray(value) || value.length === 0) return null;
-  const checks = [];
-  for (const entry of value) {
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
-    const check = entry;
-    if (!hasOnlyKeys(check, ["name", "passed", "evidence"]) || !string(check.name) || typeof check.passed !== "boolean" || !string(check.evidence)) {
-      return null;
-    }
-    checks.push({ name: check.name, passed: check.passed, evidence: check.evidence });
-  }
-  return checks;
-}
-function validateScoutCitation(input, citation) {
-  const cwd = path.resolve(input.cwd);
-  const citedPath = path.resolve(cwd, citation.path);
-  const relative = path.relative(cwd, citedPath);
-  if (relative === "" || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative)) {
-    return { ok: false, reason: `Scout citation path escapes the workspace: ${citation.path}` };
-  }
-  const content = input.filesystem.readFile(citedPath);
-  if (content === null) return { ok: false, reason: `Scout citation cannot be read: ${citation.path}` };
-  const lineCount = content.split(/\r\n|\r|\n/u).length;
-  if (citation.line > lineCount) {
-    return { ok: false, reason: `Scout citation is past end of file: ${citation.path}:${citation.line}` };
-  }
-  if (input.observedReadRanges !== void 0) {
-    const spans = input.observedReadRanges.get(citedPath) ?? [];
-    if (!spans.some(([start, end]) => citation.line >= start && citation.line <= end)) {
-      const observed = spans.length === 0 ? "this run never read that file" : `this run read only ${spans.map(([start, end]) => `${start}-${end}`).join(", ")}`;
-      return {
-        ok: false,
-        reason: `Scout citation is not grounded in a live read: ${citation.path}:${citation.line} (${observed})`
-      };
-    }
-  }
-  return {
-    ok: true,
-    evidence: { ...citation, contentDigest: createHash("sha256").update(content, "utf8").digest("hex") }
-  };
-}
-function validateScoutCitations(input, citations) {
-  const evidence = [];
-  for (const citation of citations) {
-    const checked = validateScoutCitation(input, citation);
-    if (!checked.ok) return checked;
-    evidence.push(checked.evidence);
-  }
-  return { ok: true, evidence };
-}
-function groundDegradedScout(contract, input, scout, degradedReason) {
-  const grounded = [];
-  const evidence = [];
-  const demoted = [];
-  for (const finding of scout.findings) {
-    const checked = validateScoutCitation(input, { path: finding.path, line: finding.line });
-    if (checked.ok) {
-      grounded.push(finding);
-      evidence.push(checked.evidence);
-      continue;
-    }
-    demoted.push(finding.claim);
-  }
-  const degraded = {
-    findings: grounded,
-    citations: grounded.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
-    needsSplit: false,
-    proposedSubtasks: [],
-    ungroundedClaims: [...scout.ungroundedClaims ?? [], ...demoted],
-    degradedReason
-  };
-  return success(contract, "unmeasured", { scout: degraded, evidence }, { scout: degraded, reason: degradedReason });
-}
-function validateVerifier(contract, output) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
-  const value = parsed.value;
-  if (!hasOnlyKeys(value, ["verdict", "checks"]) || value.verdict !== "pass" && value.verdict !== "fail") {
-    return failure(contract, "fail", "Verifier result must carry pass or fail verdict and checks");
-  }
-  const checks = parseChecks(value.checks);
-  if (checks === null || value.verdict === "pass" !== checks.every((check) => check.passed)) {
-    return failure(contract, "fail", "Verifier verdict must agree with every typed check");
-  }
-  const verifier = { verdict: value.verdict, checks };
-  return success(contract, value.verdict, verifier, { verifier });
-}
-function parseVerifierResult(output) {
-  const validation = validateVerifier({ kind: "verifier-report" }, output);
-  return validation.verifier ?? null;
-}
-function validateCodeReport(contract, output) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
-  const value = parsed.value;
-  if (!hasOnlyKeys(value, ["passed", "exitCode", "checks", "artifactPaths", "outputExcerpt"]) || typeof value.passed !== "boolean" || typeof value.exitCode !== "number" || !Number.isSafeInteger(value.exitCode) || typeof value.outputExcerpt !== "string" || !Array.isArray(value.artifactPaths) || value.artifactPaths.some((entry) => !string(entry))) {
-    return failure(
-      contract,
-      "unmeasured",
-      "Code result must carry passed, integer exitCode, checks, artifactPaths, and outputExcerpt"
-    );
-  }
-  const checks = parseChecks(value.checks);
-  if (checks === null) return failure(contract, "unmeasured", "Code result must carry typed checks");
-  if (value.passed !== (value.exitCode === 0) || value.passed !== checks.every((check) => check.passed)) {
-    return failure(contract, "unmeasured", "Code result passed must agree with its exit code and every check");
-  }
-  return success(contract, "unmeasured", value);
-}
-var RESULT_COMMIT_MESSAGE_MAX_BYTES = 1e3;
-var AUTHORSHIP_FIELDS = ["commitMessage", "summary"];
-function hasControlCharacters(value) {
-  for (const character of value) {
-    const code = character.codePointAt(0) ?? 0;
-    if (code === 127) return true;
-    if (code < 32 && character !== "\n" && character !== "\r" && character !== "	") return true;
-  }
-  return false;
-}
-function normalizeAuthored(value) {
-  return value.replace(/\r\n/gu, "\n").replace(/\r/gu, "\n").trim();
-}
-function validateAuthorship(value) {
-  for (const field of AUTHORSHIP_FIELDS) {
-    const raw = value[field];
-    if (raw === void 0 || raw === null) continue;
-    if (typeof raw !== "string") return `${field} must be a string when present`;
-    if (raw.trim().length === 0) continue;
-    if (Buffer.byteLength(raw, "utf8") > RESULT_COMMIT_MESSAGE_MAX_BYTES) {
-      return `${field} must be at most ${RESULT_COMMIT_MESSAGE_MAX_BYTES} bytes`;
-    }
-    if (hasControlCharacters(raw)) return `${field} must not contain control characters`;
-  }
-  return null;
-}
-function resultContractAuthorship(contract, output) {
-  const empty = { commitMessage: null, summary: null };
-  if (contract.kind !== "mutation-report" && contract.kind !== "architect-plan") return empty;
-  const parsed = parseJson(output);
-  if (!parsed.ok || validateAuthorship(parsed.value) !== null) return empty;
-  const read = (field) => {
-    const raw = parsed.value[field];
-    if (typeof raw !== "string") return null;
-    const normalized = normalizeAuthored(raw);
-    return normalized.length === 0 ? null : normalized;
-  };
-  return { commitMessage: read("commitMessage"), summary: read("summary") };
-}
-function validateDebugger(contract, output) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
-  const value = parsed.value;
-  if (!hasOnlyKeys(value, ["diagnosis", "reproduction", "evidence"]) || !string(value.diagnosis) || value.reproduction !== "reproduced" && value.reproduction !== "not-reproduced" && value.reproduction !== "unknown" || !Array.isArray(value.evidence) || value.evidence.some((entry) => !string(entry))) {
-    return failure(
-      contract,
-      "unmeasured",
-      "Debugger result must carry diagnosis, reproduction status, and evidence without a verdict"
-    );
-  }
-  return success(contract, "unmeasured", value);
-}
-function validateResearch(contract, output, networkAllowed) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
-  const value = parsed.value;
-  if (!hasOnlyKeys(value, ["source", "findings"]) || value.source !== "local" && value.source !== "external" || !Array.isArray(value.findings)) {
-    return failure(
-      contract,
-      "unmeasured",
-      "Research result must distinguish local or external sources and carry findings"
-    );
-  }
-  if (value.source === "external" && !networkAllowed) {
-    return failure(contract, "unmeasured", "external research requires an allowed network posture");
-  }
-  for (const finding of value.findings) {
-    if (finding === null || typeof finding !== "object" || Array.isArray(finding)) {
-      return failure(contract, "unmeasured", "Research findings must be objects");
-    }
-    const record = finding;
-    if (!hasOnlyKeys(record, ["claim", "evidence"]) || !string(record.claim) || !string(record.evidence)) {
-      return failure(contract, "unmeasured", "Research findings must carry claim and evidence");
-    }
-  }
-  return success(contract, "unmeasured", value);
-}
-function describeWriteSet(effects, cwd) {
-  if (effects.mutatedPaths.size === 0) return "this run wrote nothing";
-  const written = [...effects.mutatedPaths].map((target) => path.relative(cwd, target) || target).sort().slice(0, MUTATION_WRITE_SET_REASON_LIMIT);
-  const more = effects.mutatedPaths.size - written.length;
-  return `this run wrote ${written.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
-}
-var MUTATION_WRITE_SET_REASON_LIMIT = 8;
-function pathIsPresent(filesystem, target) {
-  if (filesystem.pathExists === void 0) return true;
-  return filesystem.pathExists(target);
-}
-var MUTATION_VALIDATION_EXAMPLE = '{"name":"npm test","passed":true,"evidence":"exit 0"}';
-function mutationValidationsReason(value) {
-  const empty = Array.isArray(value) && value.length === 0;
-  if (empty) {
-    return `Mutation result must carry typed validation results: validations was empty. Emit one entry per check this run actually made, each shaped like ${MUTATION_VALIDATION_EXAMPLE}. A run that only read files still names the read and cites what it saw.`;
-  }
-  return `Mutation result must carry typed validation results: every validations entry is shaped like ${MUTATION_VALIDATION_EXAMPLE}, with a string name, a boolean passed, a string evidence, and no other keys.`;
-}
-function validateMutation(contract, input) {
-  const parsed = parseJson(input.output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
-  const value = parsed.value;
-  if (!hasOnlyKeys(value, ["mutatedPaths", "validations", "commitMessage", "summary"]) || !Array.isArray(value.mutatedPaths) || value.mutatedPaths.some((entry) => !string(entry))) {
-    return failure(contract, "unmeasured", "Mutation result must carry mutatedPaths and validations");
-  }
-  const authorship = validateAuthorship(value);
-  if (authorship !== null) return failure(contract, "unmeasured", authorship);
-  const validations = parseChecks(value.validations);
-  if (validations === null) return failure(contract, "unmeasured", mutationValidationsReason(value.validations));
-  const reportedFailure = !validations.every((check) => check.passed);
-  const effects = input.observedRunEffects;
-  if (effects === void 0) return success(contract, reportedFailure ? "fail" : "pass", value);
-  const cwd = path.resolve(input.cwd);
-  let unverifiedMutation = false;
-  for (const reported of value.mutatedPaths) {
-    const target = path.resolve(cwd, reported);
-    if (effects.mutatedPaths.has(target)) continue;
-    if (effects.failedMutationPaths.has(target)) {
-      return failure(
-        contract,
-        "unmeasured",
-        `Mutation result names a path whose only write this run attempted was refused: ${reported} (${describeWriteSet(effects, cwd)})`
-      );
-    }
-    if (pathIsPresent(input.filesystem, target)) {
-      unverifiedMutation = true;
-      continue;
-    }
-    return failure(
-      contract,
-      "unmeasured",
-      `Mutation result names a path this run never wrote and that does not exist: ${reported} (${describeWriteSet(effects, cwd)})`
-    );
-  }
-  if (reportedFailure) return success(contract, "fail", value);
-  const measured = !unverifiedMutation && effects.validationCommands.size > 0;
-  return success(contract, measured ? "pass" : "unmeasured", value);
-}
-function validateProvenance(contract, output) {
-  const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
-  const value = parsed.value;
-  if (!hasOnlyKeys(value, ["confirmedFacts", "missingEvidence", "nextInspections"]) || ![value.confirmedFacts, value.missingEvidence, value.nextInspections].every(
-    (entry) => Array.isArray(entry) && entry.every((item) => string(item))
-  )) {
-    return failure(
-      contract,
-      "unmeasured",
-      "Provenance result must carry confirmedFacts, missingEvidence, and nextInspections"
-    );
-  }
-  return success(contract, "unmeasured", value);
-}
-function validateArchitect(contract, input) {
-  const artifactPath = path.resolve(input.cwd, contract.path);
-  const content = input.filesystem.readFile(artifactPath);
-  if (content === null || content.trim().length === 0) {
-    return failure(contract, "unmeasured", `required plan artifact is missing or empty: ${contract.path}`);
-  }
-  return success(contract, "unmeasured", {
-    path: contract.path,
-    artifactDigest: createHash("sha256").update(content, "utf8").digest("hex")
-  });
-}
-function parseScoutResult(output) {
-  const validation = validateScout({ kind: "scout-report" }, output);
-  if (validation.conformance !== "pass" || validation.scout === void 0) return null;
-  return validation.scout.degradedReason === void 0 ? validation.scout : null;
-}
-function validateResultContract(input) {
-  switch (input.contract.kind) {
-    case "architect-plan":
-      return validateArchitect(input.contract, input);
-    case "scout-report": {
-      const validation = validateScout(input.contract, input.output);
-      if (validation.scout === void 0) return validation;
-      const degradedReason = validation.scout.degradedReason;
-      if (degradedReason !== void 0) {
-        return groundDegradedScout(input.contract, input, validation.scout, degradedReason);
-      }
-      const citations = validateScoutCitations(input, validation.scout.citations);
-      return citations.ok ? success(
-        input.contract,
-        "pass",
-        { scout: validation.scout, evidence: citations.evidence },
-        { scout: validation.scout }
-      ) : failure(input.contract, "fail", citations.reason);
-    }
-    case "verifier-report":
-      return validateVerifier(input.contract, input.output);
-    case "debugger-report":
-      return validateDebugger(input.contract, input.output);
-    case "research-report":
-      return validateResearch(input.contract, input.output, input.networkAllowed);
-    case "mutation-report":
-      return validateMutation(input.contract, input);
-    case "provenance-report":
-      return validateProvenance(input.contract, input.output);
-    case "external-delegation":
-      return success(input.contract, "unmeasured", { external: true });
-    case "artifact-report":
-      return success(input.contract, "unmeasured", { artifact: true });
-    case "context-handbook":
-      return validateContextHandbook(input.contract, input.output);
-    case "code-report":
-      return validateCodeReport(input.contract, input.output);
-  }
-}
-function validateRecipeResult(input) {
-  if (input.contract === null) return null;
-  if (!input.reachedTerminalResult) {
-    return {
-      applicable: false,
-      fact: {
-        sourceId: resultContractSourceId(input.contract),
-        validatorDigest: digest({ contract: input.contract, reached: false }),
-        conformance: "not-reached",
-        quality: "unmeasured"
-      }
-    };
-  }
-  const validation = validateResultContract({
-    contract: input.contract,
-    output: input.output,
-    cwd: input.cwd,
-    networkAllowed: input.networkAllowed,
-    filesystem: input.filesystem,
-    ...input.observedRunEffects !== void 0 ? { observedRunEffects: input.observedRunEffects } : {}
-  });
-  return {
-    applicable: true,
-    validation,
-    fact: {
-      sourceId: validation.sourceId,
-      validatorDigest: validation.validatorDigest,
-      conformance: validation.conformance,
-      quality: validation.quality
-    }
-  };
-}
-var RESULT_CONTRACT_REPAIR_LIMIT = 2;
-var RESULT_CONTRACT_ANCHOR_LIMIT = 12;
-function resultContractShape(contract) {
-  switch (contract.kind) {
-    case "architect-plan":
-      return `a plan artifact written to ${contract.path}, then optionally {"commitMessage":"...","summary":"..."} describing it`;
-    case "scout-report":
-      return '{"findings":[{"claim":"what you observed","path":"src/file.ts","line":1}],"needsSplit":false,"proposedSubtasks":[]} or {"findings":[],"needsSplit":true,"proposedSubtasks":[{"id":"inspect","task":"Inspect the boundary","dependencies":[],"expectedResultContract":"scout-report","requestedAuthority":"read-only"}]} or, if you cannot produce a citation you are sure of, at least {"findings":[{"claim":"what you observed"}]}, which is accepted as an ungrounded lead rather than losing the run';
-    case "verifier-report":
-      return '{"verdict":"pass","checks":[{"name":"npm run typecheck","passed":true,"evidence":"exit 0"}]}';
-    case "debugger-report":
-      return '{"diagnosis":"...","reproduction":"reproduced","evidence":["..."]}';
-    case "research-report":
-      return '{"source":"local","findings":[{"claim":"...","evidence":"..."}]}';
-    case "mutation-report":
-      return '{"mutatedPaths":["src/file.ts"],"validations":[{"name":"npm test","passed":true,"evidence":"exit 0"}],"commitMessage":"optional: the commit message for this change","summary":"optional: one line"}';
-    case "provenance-report":
-      return '{"confirmedFacts":["..."],"missingEvidence":["..."],"nextInspections":["..."]}';
-    case "external-delegation":
-      return "any final text";
-    case "artifact-report":
-      return "any final text; the artifact you wrote at the location the task named is the result";
-    case "context-handbook":
-      return '{"projectName":"string","identity":"one sentence","conventions":[],"invariants":[],"sections":[{"title":"Architecture","body":"markdown that cites `real/path.ts` tokens"}]}';
-    case "code-report":
-      return '{"passed":false,"exitCode":1,"checks":[{"name":"test","passed":false,"evidence":"exit 1"}],"artifactPaths":["/path/command.log"],"outputExcerpt":"..."}';
-  }
-}
-function resultContractRepairMessage(input) {
-  const last = input.attempt >= RESULT_CONTRACT_REPAIR_LIMIT;
-  const lines = [
-    last ? "FINAL RESULT REQUIRED IN THIS RESPONSE. Your previous response still did not satisfy this run's result contract." : "Your previous response did not satisfy this run's result contract.",
-    `Validator reason: ${input.reason}`,
-    input.toolsAvailable === true ? "You may use the admitted tools to repair this validator failure, then emit the required terminal result." : "Tool use is over. Answer from the evidence you already gathered.",
-    `Emit exactly this shape and nothing else: ${resultContractShape(input.contract)}`,
-    "Do not add prose, code fences, or commentary around it. Do not describe work you intend to do next."
-  ];
-  if (input.anchors.length > 0) {
-    lines.push(
-      "",
-      "Locations you read successfully in this run (use these exact path:line values):",
-      ...input.anchors.slice(-RESULT_CONTRACT_ANCHOR_LIMIT).map((anchor) => `- ${anchor}`)
-    );
-  }
-  return lines.join("\n");
-}
-var RESULT_CONTRACT_REPAIR_TOOL = "result_contract";
-function resultContractRepairMessages(input, origin) {
-  const id = `clio-result-contract-repair-${input.attempt}`;
-  const timestamp = Date.now();
-  return [
-    {
-      role: "assistant",
-      content: [{ type: "toolCall", id, name: RESULT_CONTRACT_REPAIR_TOOL, arguments: {} }],
-      stopReason: "toolUse",
-      usage: {
-        input: 0,
-        output: 0,
-        cacheRead: 0,
-        cacheWrite: 0,
-        totalTokens: 0,
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 }
-      },
-      ...origin,
-      timestamp
-    },
-    {
-      role: "toolResult",
-      toolCallId: id,
-      toolName: RESULT_CONTRACT_REPAIR_TOOL,
-      content: [{ type: "text", text: resultContractRepairMessage(input) }],
-      isError: true,
-      timestamp
-    }
-  ];
-}
-function parseResultContract(value, sourcePath) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`agent recipe: ${sourcePath}: resultContract must be an object`);
-  }
-  const record = value;
-  if (typeof record.kind !== "string") throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is required`);
-  const keys = Object.keys(record);
-  const only = (...allowed) => keys.every((key) => allowed.includes(key));
-  if (record.kind === "architect-plan") {
-    if (!only("kind", "path") || !string(record.path)) {
-      throw new Error(`agent recipe: ${sourcePath}: architect-plan requires only non-empty path`);
-    }
-    if (path.isAbsolute(record.path) || record.path.split(/[\\/]/u).includes("..")) {
-      throw new Error(`agent recipe: ${sourcePath}: architect-plan path must be workspace-relative`);
-    }
-    return { kind: "architect-plan", path: record.path };
-  }
-  const kinds = [
-    "scout-report",
-    "verifier-report",
-    "debugger-report",
-    "research-report",
-    "mutation-report",
-    "provenance-report",
-    "external-delegation",
-    "artifact-report",
-    "context-handbook"
-  ];
-  if (!kinds.includes(record.kind) || !only("kind")) {
-    throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is unsupported or has unknown keys`);
-  }
-  return { kind: record.kind };
-}
-
 // src/domains/safety/finish-contract.ts
 init_esm_shims();
 var FINISH_CONTRACT_ADVISORY_MESSAGE = "[Clio Coder] finish-contract advisory: you changed files this turn without recording validation evidence or an explicit limitation. Run a verification command or state what could not be verified.";
@@ -786,7 +94,7 @@ function mutatingReceipts(recent) {
   for (const entry of recent) {
     const bashMutation = bashExecutionMutationPaths(entry);
     if (bashMutation !== null) {
-      for (const path5 of bashMutation) pushPath(paths, seen, path5);
+      for (const path4 of bashMutation) pushPath(paths, seen, path4);
       continue;
     }
     const call = mutatingToolCall(entry);
@@ -798,7 +106,7 @@ function mutatingReceipts(recent) {
     if (resultId !== null) {
       const candidate = mutationCalls.get(resultId);
       if (candidate !== void 0) {
-        for (const path5 of candidate.paths) pushPath(paths, seen, path5);
+        for (const path4 of candidate.paths) pushPath(paths, seen, path4);
       }
     }
   }
@@ -833,10 +141,10 @@ function bashExecutionMutationPaths(entry) {
   if (record.cancelled === true || record.exitCode !== 0) return null;
   return [...extractCommandWriteTargets(record.command), ...extractCommandDeleteTargets(record.command)];
 }
-function pushPath(paths, seen, path5) {
-  if (path5.length === 0 || seen.has(path5)) return;
-  seen.add(path5);
-  paths.push(path5);
+function pushPath(paths, seen, path4) {
+  if (path4.length === 0 || seen.has(path4)) return;
+  seen.add(path4);
+  paths.push(path4);
 }
 function collectValidationEvidence(recent) {
   const evidence = [];
@@ -977,8 +285,8 @@ function typedValidationSummary(toolName, payload) {
   if (toolName === "verify") {
     const check = typeof args?.check === "string" ? args.check.trim() : "";
     if (check === "frontend") {
-      const path5 = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
-      return `verify frontend ${path5}`;
+      const path4 = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
+      return `verify frontend ${path4}`;
     }
     if (isVerificationScriptName(check)) return `npm run ${check}`;
     if (isProjectVerifierCheckId(check)) return `verify ${check}`;
@@ -1059,11 +367,11 @@ function protectedArtifactEvidence(entry) {
   const record = asRecord(entry);
   if (record?.kind !== "protectedArtifact" || record.action !== "protect") return null;
   const artifact = asRecord(record.artifact);
-  const path5 = typeof artifact?.path === "string" && artifact.path.trim().length > 0 ? artifact.path.trim() : null;
-  if (path5 === null) return null;
+  const path4 = typeof artifact?.path === "string" && artifact.path.trim().length > 0 ? artifact.path.trim() : null;
+  if (path4 === null) return null;
   const evidence = {
     kind: "protected_artifact",
-    summary: `protected artifact recorded: ${path5}`
+    summary: `protected artifact recorded: ${path4}`
   };
   const turnId = turnIdOf(entry);
   if (turnId !== null) evidence.turnId = turnId;
@@ -1107,22 +415,22 @@ function asRecord(value) {
 // src/domains/safety/path-policy.ts
 init_esm_shims();
 import { homedir } from "node:os";
-import path2 from "node:path";
+import path from "node:path";
 var ORDERED_KINDS = ["zeroAccessPaths", "readOnlyPaths", "noWritePaths", "noDeletePaths"];
 function isSameOrDescendant(candidatePath, policyPath) {
-  const candidate = path2.resolve(candidatePath);
-  const policy = path2.resolve(policyPath);
-  const relative = path2.relative(policy, candidate);
-  return relative === "" || !relative.startsWith("..") && !path2.isAbsolute(relative);
+  const candidate = path.resolve(candidatePath);
+  const policy = path.resolve(policyPath);
+  const relative = path.relative(policy, candidate);
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
 }
 function expandTilde(rawPath) {
   if (rawPath === "~") return homedir();
-  if (rawPath.startsWith("~/")) return path2.join(homedir(), rawPath.slice(2));
+  if (rawPath.startsWith("~/")) return path.join(homedir(), rawPath.slice(2));
   return rawPath;
 }
 function normalizePolicyEntry(rawPath, root) {
   const expanded = expandTilde(rawPath.trim());
-  const resolved = path2.isAbsolute(expanded) ? path2.resolve(expanded) : path2.resolve(root, expanded);
+  const resolved = path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(root, expanded);
   return canonicalizeExistingPath(resolved);
 }
 function blocksOperation(kind, operation) {
@@ -1131,7 +439,7 @@ function blocksOperation(kind, operation) {
   return operation === "delete";
 }
 function compilePathPolicy(input, root = process.cwd()) {
-  const resolvedRoot = canonicalizeExistingPath(path2.resolve(root));
+  const resolvedRoot = canonicalizeExistingPath(path.resolve(root));
   const entries = [];
   const diagnostics = [];
   for (const kind of ORDERED_KINDS) {
@@ -1155,10 +463,10 @@ function compilePathPolicy(input, root = process.cwd()) {
 }
 function evaluatePathPolicy(policy, operation, targetPath, cwd = policy.root) {
   const expanded = expandTilde(targetPath);
-  const lexicalTarget = path2.isAbsolute(expanded) ? path2.resolve(expanded) : path2.resolve(cwd, expanded);
+  const lexicalTarget = path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(cwd, expanded);
   const resolvedTarget = canonicalizeExistingPath(lexicalTarget);
   const normalizedResolvedTarget = normalizeSeparators(resolvedTarget);
-  const normalizedRelativeTarget = normalizeSeparators(path2.relative(policy.root, resolvedTarget));
+  const normalizedRelativeTarget = normalizeSeparators(path.relative(policy.root, resolvedTarget));
   const normalizedRawTarget = normalizeSeparators(targetPath);
   for (const entry of policy.entries) {
     if (!blocksOperation(entry.kind, operation)) continue;
@@ -1182,9 +490,9 @@ function matchesEntry(entry, resolvedTarget, normalizedResolvedTarget, normalize
 function compilePathPattern(rawPath, root) {
   if (!rawPath.includes("*")) return null;
   const expanded = expandTilde(rawPath.trim());
-  const source = path2.isAbsolute(expanded) ? expanded : path2.join(root, expanded);
+  const source = path.isAbsolute(expanded) ? expanded : path.join(root, expanded);
   const normalized = normalizeSeparators(canonicalizePatternSource(source));
-  const relative = normalizeSeparators(path2.isAbsolute(expanded) ? expanded : expanded);
+  const relative = normalizeSeparators(path.isAbsolute(expanded) ? expanded : expanded);
   const absolutePattern = segmentPattern(normalized);
   const relativePattern = segmentPattern(relative);
   return new RegExp(`(?:${absolutePattern})|(?:${relativePattern})`);
@@ -1193,24 +501,24 @@ function canonicalizePatternSource(patternPath) {
   const wildcardIndex = patternPath.indexOf("*");
   if (wildcardIndex === -1) return canonicalizeExistingPath(patternPath);
   const fixedPrefix = patternPath.slice(0, wildcardIndex);
-  const separatorIndex = fixedPrefix.lastIndexOf(path2.sep);
+  const separatorIndex = fixedPrefix.lastIndexOf(path.sep);
   if (separatorIndex === -1) return patternPath;
   const prefix = patternPath.slice(0, separatorIndex + 1);
   const suffix = patternPath.slice(separatorIndex + 1);
-  return path2.join(canonicalizeExistingPath(prefix), suffix);
+  return path.join(canonicalizeExistingPath(prefix), suffix);
 }
 function segmentPattern(rawPath) {
   const escaped = rawPath.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
   return `(?:^|/)${escaped}(?:$|/)`;
 }
 function normalizeSeparators(value) {
-  return value.split(path2.sep).join("/");
+  return value.split(path.sep).join("/");
 }
 
 // src/domains/safety/policy-engine.ts
 init_esm_shims();
-import { createHash as createHash3 } from "node:crypto";
-import path4 from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import path3 from "node:path";
 
 // src/domains/safety/default-path-policy.ts
 init_esm_shims();
@@ -1332,10 +640,10 @@ function mergePathPolicyInputs(base, override) {
 // src/domains/safety/project-policy.ts
 init_esm_shims();
 var import_yaml = __toESM(require_dist(), 1);
-import { createHash as createHash2 } from "node:crypto";
+import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import path3 from "node:path";
-var POLICY_RELATIVE_PATH = path3.join(".clio-coder", "safety.yaml");
+import path2 from "node:path";
+var POLICY_RELATIVE_PATH = path2.join(".clio-coder", "safety.yaml");
 var ACTION_CLASSES = /* @__PURE__ */ new Set([
   "read",
   "write",
@@ -1364,11 +672,11 @@ var COMMAND_KEYS = /* @__PURE__ */ new Set([
 var ENV_KEYS = /* @__PURE__ */ new Set(["mode", "allow"]);
 var ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/;
 function projectSafetyPolicyPath(cwd = process.cwd()) {
-  let cursor = path3.resolve(cwd);
+  let cursor = path2.resolve(cwd);
   while (true) {
-    const candidate = path3.join(cursor, POLICY_RELATIVE_PATH);
+    const candidate = path2.join(cursor, POLICY_RELATIVE_PATH);
     if (existsSync(candidate)) return candidate;
-    const parent = path3.dirname(cursor);
+    const parent = path2.dirname(cursor);
     if (parent === cursor) return null;
     cursor = parent;
   }
@@ -1476,12 +784,12 @@ function parsePathList(value, key, errors) {
       continue;
     }
     const trimmed = item.trim();
-    if (path3.isAbsolute(trimmed)) {
+    if (path2.isAbsolute(trimmed)) {
       errors.push(`${label} must be relative to the policy root`);
       continue;
     }
-    const normalized = path3.normalize(trimmed);
-    const segments = normalized.split(path3.sep).filter((segment) => segment.length > 0);
+    const normalized = path2.normalize(trimmed);
+    const segments = normalized.split(path2.sep).filter((segment) => segment.length > 0);
     if (segments.some((segment) => segment === "..")) {
       errors.push(`${label} must not escape the policy root with '..'`);
       continue;
@@ -1526,11 +834,11 @@ function parseCommandPolicy(value, label) {
   if (id && !ID_RE.test(id)) errors.push(`${label}.id must match ${ID_RE}`);
   if (command && command.trim().length === 0) errors.push(`${label}.command must not be empty`);
   if (cwd !== void 0) {
-    if (path3.isAbsolute(cwd)) {
+    if (path2.isAbsolute(cwd)) {
       errors.push(`${label}.cwd must be relative to the policy root`);
     } else {
-      const normalized = path3.normalize(cwd);
-      const segments = normalized.split(path3.sep).filter((segment) => segment.length > 0);
+      const normalized = path2.normalize(cwd);
+      const segments = normalized.split(path2.sep).filter((segment) => segment.length > 0);
       if (segments.some((segment) => segment === "..")) {
         errors.push(`${label}.cwd must not escape the policy root with '..'`);
       }
@@ -1634,7 +942,7 @@ function isPlainRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256(raw) {
-  return createHash2("sha256").update(raw, "utf8").digest("hex");
+  return createHash("sha256").update(raw, "utf8").digest("hex");
 }
 
 // src/domains/safety/rejection-feedback.ts
@@ -1836,19 +1144,17 @@ function evaluateWriteRoots(roots, writeRootCwd, call) {
   if (roots.length === 0) return null;
   const target = writeRootTargetPath(call);
   if (target === null) return null;
-  const resolved = path4.resolve(writeRootCwd, target);
-  for (const root of roots) {
-    if (resolved === root || resolved.startsWith(`${root}${path4.sep}`)) return null;
-  }
+  const resolved = path3.resolve(writeRootCwd, target);
+  if (pathBoundaryCovers(roots, resolved)) return null;
   return `write target '${target}' resolves to '${resolved}', which is outside the permitted write roots for this run: ${roots.join(", ")}`;
 }
 function createSafetyPolicyEngine(options = {}) {
-  const cwd = canonicalizeExistingPath(path4.resolve(options.cwd ?? process.cwd()));
-  const writeRootCwd = path4.resolve(options.cwd ?? process.cwd());
-  const writeRoots = (options.writeRoots ?? []).map((root) => path4.resolve(root));
+  const cwd = canonicalizeExistingPath(path3.resolve(options.cwd ?? process.cwd()));
+  const writeRootCwd = path3.resolve(options.cwd ?? process.cwd());
+  const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
   const packs = options.rulePacks ?? getCachedDefaultRulePacks();
   const projectPolicy = options.projectPolicy ?? loadProjectSafetyPolicy(cwd);
-  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(canonicalizeExistingPath(projectPolicy.path)));
+  const projectPolicyRoot = projectPolicy.path === null ? cwd : path3.dirname(path3.dirname(canonicalizeExistingPath(projectPolicy.path)));
   const pathPolicyInput = projectPolicy.disableDefaultPathPolicy ? projectPolicy.pathPolicy : mergePathPolicyInputs(DEFAULT_DAMAGE_CONTROL_PATH_POLICY, projectPolicy.pathPolicy);
   const expandedDefaults = projectPolicy.disableDefaultPathPolicy ? pathPolicyInput : mergePathPolicyInputs(pathPolicyInput, { zeroAccessPaths: clioCredentialStorePaths() });
   const pathPolicy = compilePathPolicy(expandedDefaults, projectPolicyRoot);
@@ -2007,7 +1313,7 @@ function createSafetyPolicyEngine(options = {}) {
 }
 function clioCredentialStorePaths() {
   try {
-    return [path4.join(clioConfigDir(), "credentials.yaml")];
+    return [path3.join(clioConfigDir(), "credentials.yaml")];
   } catch {
     return [];
   }
@@ -2272,11 +1578,11 @@ function effectiveClassification(classification, match) {
 }
 function matchingProjectCommand(policy, command, cwd) {
   if (!policy.valid || policy.path === null) return null;
-  const policyRoot = path4.dirname(path4.dirname(policy.path));
+  const policyRoot = path3.dirname(path3.dirname(policy.path));
   for (const entry of policy.commands) {
     if (entry.command !== command) continue;
     if (entry.shellOperators === "deny" && hasShellOperators(command)) continue;
-    const allowedCwd = entry.cwd !== void 0 ? path4.resolve(policyRoot, entry.cwd) : policyRoot;
+    const allowedCwd = entry.cwd !== void 0 ? path3.resolve(policyRoot, entry.cwd) : policyRoot;
     if (!isUnderOrSame(cwd, allowedCwd)) continue;
     return entry;
   }
@@ -2305,7 +1611,7 @@ function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
     if (segment[0] === "cd") {
       if (segment.length !== 2) return null;
       const target = segment[1] ?? "";
-      if (target.startsWith("~") || !isUnderOrSame(path4.resolve(callCwd, target), workspaceRoot)) return null;
+      if (target.startsWith("~") || !isUnderOrSame(path3.resolve(callCwd, target), workspaceRoot)) return null;
       ruleIds.push("builtin:cd-workspace");
       continue;
     }
@@ -2332,11 +1638,11 @@ function hasShellOperators(command) {
   return hasSequencingOperators(command) || hasCommandSubstitution(command);
 }
 function isUnderOrSame(child, parent) {
-  const rel = path4.relative(
-    canonicalizeExistingPath(path4.resolve(parent)),
-    canonicalizeExistingPath(path4.resolve(child))
+  const rel = path3.relative(
+    canonicalizeExistingPath(path3.resolve(parent)),
+    canonicalizeExistingPath(path3.resolve(child))
   );
-  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel);
 }
 function commandArg(args) {
   return typeof args?.command === "string" ? args.command : null;
@@ -2347,7 +1653,7 @@ function pathArg(args) {
   return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
 }
 function cwdArg(args, fallback) {
-  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path4.resolve(fallback, args.cwd) : fallback;
+  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path3.resolve(fallback, args.cwd) : fallback;
   return canonicalizeExistingPath(resolved);
 }
 var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
@@ -2389,7 +1695,7 @@ function rulePackHash(packs) {
   const payload = {
     base: packPayload(packs.base.rules)
   };
-  return createHash3("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
+  return createHash2("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
 }
 function packPayload(rules) {
   return rules.map((rule) => ({
@@ -2403,16 +1709,6 @@ function packPayload(rules) {
 }
 
 export {
-  parseJsonObjectPayload,
-  resultContractSourceId,
-  parseVerifierResult,
-  resultContractAuthorship,
-  parseScoutResult,
-  validateResultContract,
-  validateRecipeResult,
-  RESULT_CONTRACT_REPAIR_LIMIT,
-  resultContractRepairMessages,
-  parseResultContract,
   DEFAULT_RECENT_ENTRY_LIMIT,
   assessFinishContract,
   typedValidationSummary,
@@ -2420,4 +1716,4 @@ export {
   WRITE_ROOT_REFUSED_TOOLS,
   createSafetyPolicyEngine
 };
-//# sourceMappingURL=chunk-EKY57CSP.js.map
+//# sourceMappingURL=chunk-5H3GB5BO.js.map