@isaacriehm/cairn 0.1.0

package/dist/frontend/types.d.ts

@@ -0,0 +1,247 @@
+/**
+ * Frontend adapter contract per `docs/WORKFLOW_GUIDE.md` §0.1.
+ *
+ * The orchestrator + grounding daemon + MCP server are frontend-agnostic.
+ * The operator console is a swappable adapter that consumes a uniform
+ * task/run/UAT bundle and renders/listens via its native primitive.
+ *
+ * Adapters live in `harness/src/frontend/<name>/`. Each implements
+ * `FrontendAdapter`. The `harness run --frontend <name>` CLI loads + starts
+ * registered adapters; on operator events, adapters drop normalized JSON rows
+ * to `.harness/inbox/<ts>-<source>-<slug>.json`. The orchestrator (Phase 8)
+ * picks them up. Phase 5 lands ingress-only — no orchestrator yet.
+ */
+export type NotifyLevel = "info" | "warn" | "error";
+/**
+ * A normalized inbox entry kind. Adapters drop one of these to
+ * `.harness/inbox/`. The orchestrator multiplexes on `kind`.
+ */
+export type InboxKind = "task" | "slash" | "free_text" | "voice" | "interaction";
+export interface FrontendTask {
+    source: string;
+    intent: string;
+    rawText: string;
+    authorId: string;
+    channelId?: string;
+    guildId?: string;
+    messageId?: string;
+    receivedAt: string;
+}
+export interface VoiceMessage {
+    source: string;
+    attachmentUrl: string;
+    mime?: string;
+    authorId: string;
+    channelId: string;
+    guildId?: string;
+    messageId: string;
+    receivedAt: string;
+}
+export interface SlashEvent {
+    source: string;
+    command: string;
+    options: Record<string, string | number | boolean>;
+    authorId: string;
+    channelId?: string;
+    guildId?: string;
+    messageId?: string;
+    receivedAt: string;
+}
+export interface FreeTextEvent {
+    source: string;
+    intent: string;
+    rawText: string;
+    authorId: string;
+    channelId?: string;
+    guildId?: string;
+    messageId?: string;
+    receivedAt: string;
+}
+export interface InteractionEvent {
+    source: string;
+    bundleId: string;
+    choiceId: string;
+    freeText?: string;
+    authorId: string;
+    channelId?: string;
+    guildId?: string;
+    messageId?: string;
+    receivedAt: string;
+}
+export interface DialogChoice {
+    /** Stable id ("a" | "b" | ... | "e_other"). */
+    id: string;
+    label: string;
+}
+export interface DialogSpec {
+    /** Origin run / task id used to correlate adapter responses. */
+    bundleId: string;
+    prompt: string;
+    /**
+     * 2-5 choices. Last MUST be `E) Other` per WORKFLOW_GUIDE §1.4.
+     * If more than 4 orthogonal questions arise, caller MUST collapse to a
+     * single tightened-spec proposal per §1.0 (cap = 2 questions/turn).
+     */
+    choices: DialogChoice[];
+    channelId?: string;
+    timeoutMs?: number;
+    /**
+     * When true, ping the channel's authorized operators (Discord
+     * `<@id>` mentions for `DISCORD_OWNER_USER_IDS`) so they get a
+     * mobile push. Used for agent-initiated `harness_ask_operator` so
+     * the operator notices the run is paused. Routine confirmations
+     * (per-question walks, e2e setup) leave this false to avoid noise.
+     */
+    pingOperators?: boolean;
+    /**
+     * §3.4 win 1 — multi-step walks (per-question tightener resolution,
+     * /oops branches) edit one message in place instead of posting N+1
+     * messages. Set this to the previous step's `bundleId`; the adapter
+     * looks it up in its dialog-message map and edits that message
+     * (same channel, new prompt + buttons). When the bundleId is
+     * unknown (gone, never registered) the adapter falls back to a
+     * fresh send.
+     */
+    replaceBundleId?: string;
+    /**
+     * Terminal-dialog flag. When true (default), the adapter compacts
+     * the message on click — strips buttons, appends an "Answered" line
+     * — so the channel scrollback shows what was chosen. Walk steps
+     * that intend to be replaced by a follow-on dialog (per-Q tightener)
+     * MUST pass false: otherwise the compaction race-edits the message
+     * the next step is about to overwrite, and either the answer
+     * annotation or the next prompt loses depending on REST ordering.
+     * Adapter still fires `deferUpdate` so the click acknowledges.
+     */
+    compactOnAnswer?: boolean;
+}
+export interface DialogResponse {
+    bundleId: string;
+    choiceId: string;
+    /** Populated only when `choiceId` is the `E) Other` option. */
+    freeText?: string;
+    timedOut?: boolean;
+}
+export interface ApprovalArtifact {
+    kind: "gif" | "screenshot" | "table" | "diff" | "log" | "url" | "text";
+    label?: string;
+    path?: string;
+    url?: string;
+    content?: string;
+}
+export interface ApprovalBundle {
+    bundleId: string;
+    runId: string;
+    taskId?: string;
+    goal: string;
+    diffSummary?: string;
+    acceptance?: {
+        id: string;
+        status: "pass" | "fail" | "pending";
+        note?: string;
+    }[];
+    artifacts?: ApprovalArtifact[];
+    channelId?: string;
+    timeoutMs?: number;
+}
+export interface Approval {
+    bundleId: string;
+    decision: "approve" | "reject" | "ask";
+    reason?: string;
+    timedOut?: boolean;
+}
+export interface PostUpdate {
+    taskId: string;
+    runId?: string;
+    status: string;
+    /**
+     * Free-form body. ≤1024 chars renders as inline embed `details` field
+     * (§3.3 win 3 — drops the live-status + content-message split). >1024
+     * chars falls back to the chunked secondary-embed path.
+     */
+    body?: string;
+    /**
+     * Original task spec (the operator's verbatim ask). Replaces the
+     * standalone `🆕 Task` drop card — the body lives on the same live
+     * status embed as everything else, so the channel only ever shows
+     * one self-updating message per task. Truncated at 1024 chars.
+     */
+    taskBody?: string;
+    channelId?: string;
+    /**
+     * Tier-0 (Ollama) summary of what the agent is doing right now —
+     * one-line, present-progressive ("Reading core/src/X", "Editing
+     * platform/Y"). Surfaces inside the live status embed so the
+     * operator sees ongoing activity instead of a static "running" badge.
+     * Set on a throttled cadence by the orchestrator during the
+     * implementer phase.
+     */
+    activity?: string;
+    /**
+     * Second-source visibility (§3.3 win 2) — extracted from claude
+     * stream-json events. Independent of Ollama; renders even when the
+     * Tier-0 summary fails. Each list capped + deduped at the source.
+     */
+    tools?: {
+        files?: string[];
+        bash?: string[];
+        searches?: string[];
+    };
+    /**
+     * Curated narrative tail from `.harness/runs/active/<run_id>/log.jsonl`
+     * (§3.3 win 1) — last N transitions, pre-formatted. Renders inside the
+     * live status embed's description so operator sees actual progress
+     * instead of a static "phase: running" line.
+     */
+    recentEvents?: string[];
+    /**
+     * §3.4 win 3 — when status === "failed", the orchestrator classifies
+     * which gate eject the run so the embed renders class-colored title +
+     * emoji. Operator can route differently per class.
+     */
+    failureClass?: "sensor" | "reviewer" | "uat" | "hard" | "halt";
+    /**
+     * §3.4 win 2 — failure remediation guidance surfaced as a dedicated
+     * embed field. `reason` is a one-liner; `suggestedActions` are the
+     * operator's next moves (`/ship-anyway`, re-submit, open thread).
+     */
+    remediation?: {
+        reason: string;
+        suggestedActions: string[];
+    };
+}
+export type IngestHandler<T> = (item: T) => void | Promise<void>;
+export interface FrontendAdapter {
+    readonly name: string;
+    /** Connects, registers commands, prepares to ingest events. */
+    start(): Promise<void>;
+    /** Disconnects + cleans up. Idempotent. */
+    stop(): Promise<void>;
+    onTask(handler: IngestHandler<FrontendTask>): void;
+    onVoice(handler: IngestHandler<VoiceMessage>): void;
+    onSlash(handler: IngestHandler<SlashEvent>): void;
+    onFreeText(handler: IngestHandler<FreeTextEvent>): void;
+    onInteraction(handler: IngestHandler<InteractionEvent>): void;
+    postTaskUpdate(update: PostUpdate): Promise<void>;
+    requestApproval(bundle: ApprovalBundle): Promise<Approval>;
+    requestDialog(spec: DialogSpec): Promise<DialogResponse>;
+    notify(level: NotifyLevel, message: string): Promise<void>;
+    /**
+     * Show "typing" / activity indicator on the given channel until the
+     * returned stop fn is called. Adapters that don't support a native
+     * typing indicator (CLI, stub) should no-op. Discord refreshes every
+     * ~8 seconds since the native indicator decays after 10s.
+     */
+    startTyping?(channelId: string): () => void;
+    /**
+     * Pre-flight check: is this channel still reachable + writable?
+     * Adapters that can answer (Discord) MUST return false when the
+     * channel has been deleted or the bot lacks access. The orchestrator
+     * uses this to skip dispatching a queued task whose per-task channel
+     * is gone — typical when the operator deletes a stale `🟢 active`
+     * channel between runs and the queue shadow restored the entry.
+     * Adapters without channels (CLI / stub) should leave this undefined;
+     * the orchestrator treats undefined as "always alive."
+     */
+    isChannelAlive?(channelId: string): Promise<boolean>;
+}

package/dist/frontend/types.js

@@ -0,0 +1,15 @@
+/**
+ * Frontend adapter contract per `docs/WORKFLOW_GUIDE.md` §0.1.
+ *
+ * The orchestrator + grounding daemon + MCP server are frontend-agnostic.
+ * The operator console is a swappable adapter that consumes a uniform
+ * task/run/UAT bundle and renders/listens via its native primitive.
+ *
+ * Adapters live in `harness/src/frontend/<name>/`. Each implements
+ * `FrontendAdapter`. The `harness run --frontend <name>` CLI loads + starts
+ * registered adapters; on operator events, adapters drop normalized JSON rows
+ * to `.harness/inbox/<ts>-<source>-<slug>.json`. The orchestrator (Phase 8)
+ * picks them up. Phase 5 lands ingress-only — no orchestrator yet.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/frontend/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/frontend/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/gc/apply.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Apply a single GcCommitProposal to the mirror checkout: write the patch
+ * files, run `git add` + `git commit`, return the resulting SHA.
+ *
+ * The caller is responsible for filtering proposals by `class` (only safe is
+ * auto-applied in v1; code / high-stakes are surfaced for confirm).
+ *
+ * No push happens here — the GC sweep + canary verification + push policy is
+ * orchestrated by `runGcBatch` (sweep.ts).
+ */
+import type { GcCommitProposal } from "./types.js";
+export interface ApplyCommitOptions {
+    repoRoot: string;
+    proposal: GcCommitProposal;
+    /** Override the commit author (smoke convenience). */
+    author?: {
+        name: string;
+        email: string;
+    };
+}
+export interface ApplyCommitResult {
+    commit_sha: string;
+    paths_written: string[];
+    paths_deleted: string[];
+}
+export declare function applyCommit(opts: ApplyCommitOptions): Promise<ApplyCommitResult>;

package/dist/gc/apply.js

@@ -0,0 +1,48 @@
+/**
+ * Apply a single GcCommitProposal to the mirror checkout: write the patch
+ * files, run `git add` + `git commit`, return the resulting SHA.
+ *
+ * The caller is responsible for filtering proposals by `class` (only safe is
+ * auto-applied in v1; code / high-stakes are surfaced for confirm).
+ *
+ * No push happens here — the GC sweep + canary verification + push policy is
+ * orchestrated by `runGcBatch` (sweep.ts).
+ */
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { simpleGit } from "simple-git";
+export async function applyCommit(opts) {
+    const written = [];
+    const deleted = [];
+    for (const [rel, content] of Object.entries(opts.proposal.patch)) {
+        const abs = resolve(opts.repoRoot, rel);
+        if (content === "") {
+            try {
+                rmSync(abs, { force: true });
+                deleted.push(rel);
+            }
+            catch {
+                // file may not exist; ignore
+            }
+        }
+        else {
+            mkdirSync(dirname(abs), { recursive: true });
+            writeFileSync(abs, content, "utf8");
+            written.push(rel);
+        }
+    }
+    const git = simpleGit({ baseDir: opts.repoRoot });
+    if (opts.author !== undefined) {
+        await git.addConfig("user.name", opts.author.name, false, "local");
+        await git.addConfig("user.email", opts.author.email, false, "local");
+    }
+    await git.add(opts.proposal.paths);
+    await git.commit(opts.proposal.commit_message);
+    const sha = (await git.revparse(["HEAD"])).trim();
+    return {
+        commit_sha: sha,
+        paths_written: written,
+        paths_deleted: deleted,
+    };
+}
+//# sourceMappingURL=apply.js.map

package/dist/gc/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/gc/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAgBvC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,OAAO;QACL,UAAU,EAAE,GAAG;QACf,aAAa,EAAE,OAAO;QACtB,aAAa,EAAE,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/gc/canary.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Batch canary — verifies a multi-commit GC batch hasn't broken anything that
+ * shows only when the commits are taken together. Per L46 (Codex audit
+ * must-fix): "individually safe, collectively broken."
+ *
+ * Two checks run after the batch lands locally and BEFORE any push:
+ *
+ *   1. workflow.md re-render against a synthetic-task fixture.
+ *      The orchestrator injects this template on every run; if a GC batch
+ *      removed a placeholder section, broke a `{{var}}` token, or left
+ *      orphaned `{{#each}}` blocks, the next live run would silently produce
+ *      a malformed prompt. Render the template against a known-good fixture
+ *      and assert (a) every `{{...}}` resolves and (b) the expected section
+ *      headers (`## Task`, `## Acceptance criteria`, `## Decisions in scope`,
+ *      `## Sensors that will run`) survive.
+ *
+ *   2. Manifest rebuild + ground-zone consistency.
+ *      Re-run `buildManifest` against the post-batch tree. If it throws or
+ *      produces zero entries (the canonical zone went empty), the batch
+ *      broke ground.
+ *
+ * Both checks are pure-mechanical — no claude burn — and run in milliseconds.
+ * They are not exhaustive (no runtime sensor sweep against a synthetic diff
+ * yet; that's deferred to a richer Phase 12.x revision when the orchestrator
+ * exposes an "isolated sensor sweep" entry point).
+ */
+import type { CanarySyntheticContext } from "./types.js";
+export interface BatchCanaryResult {
+    ok: boolean;
+    failures: string[];
+    /** Number of files in the rebuilt manifest. */
+    manifest_files: number;
+    /** Length of the rendered workflow.md template. */
+    rendered_length: number;
+}
+export interface BatchCanaryOptions {
+    repoRoot: string;
+    /** Override the synthetic context. Defaults to a minimal fixture. */
+    syntheticContext?: CanarySyntheticContext;
+}
+export declare function buildSyntheticContext(): CanarySyntheticContext;
+export declare function verifyBatchCanary(opts: BatchCanaryOptions): BatchCanaryResult;

package/dist/gc/canary.js

@@ -0,0 +1,134 @@
+/**
+ * Batch canary — verifies a multi-commit GC batch hasn't broken anything that
+ * shows only when the commits are taken together. Per L46 (Codex audit
+ * must-fix): "individually safe, collectively broken."
+ *
+ * Two checks run after the batch lands locally and BEFORE any push:
+ *
+ *   1. workflow.md re-render against a synthetic-task fixture.
+ *      The orchestrator injects this template on every run; if a GC batch
+ *      removed a placeholder section, broke a `{{var}}` token, or left
+ *      orphaned `{{#each}}` blocks, the next live run would silently produce
+ *      a malformed prompt. Render the template against a known-good fixture
+ *      and assert (a) every `{{...}}` resolves and (b) the expected section
+ *      headers (`## Task`, `## Acceptance criteria`, `## Decisions in scope`,
+ *      `## Sensors that will run`) survive.
+ *
+ *   2. Manifest rebuild + ground-zone consistency.
+ *      Re-run `buildManifest` against the post-batch tree. If it throws or
+ *      produces zero entries (the canonical zone went empty), the batch
+ *      broke ground.
+ *
+ * Both checks are pure-mechanical — no claude burn — and run in milliseconds.
+ * They are not exhaustive (no runtime sensor sweep against a synthetic diff
+ * yet; that's deferred to a richer Phase 12.x revision when the orchestrator
+ * exposes an "isolated sensor sweep" entry point).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { buildManifest } from "../ground/manifest.js";
+import { loadWorkflowTemplate, renderTemplate } from "../orchestrator/prompt.js";
+const REQUIRED_SECTION_HEADINGS = [
+    "## Task",
+    "## Acceptance criteria",
+    "## Decisions in scope",
+    "## Off-limits paths",
+    "## Sensors that will run",
+];
+const UNRESOLVED_TOKEN_RE = /\{\{[^}]*\}\}/;
+export function buildSyntheticContext() {
+    return {
+        agent_role: "implementer",
+        project_name: "canary",
+        run_id: "canary-run",
+        mirror_path: "/tmp/canary-mirror",
+        sha_pin: "0000000000000000000000000000000000000000",
+        tightened_spec_body: "Canary fixture body — non-empty.",
+        acceptance_criteria: ["Renders workflow.md without unresolved tokens."],
+        in_scope_decisions: [
+            { id: "D-CANARY-1", title: "Canary decision", scope_summary: "fixture" },
+        ],
+        in_scope_invariants: [{ id: "V-CANARY-1", title: "Canary invariant" }],
+        off_limits: [".git/**", ".archive/**"],
+        scoped_sensors: [
+            { id: "stub-pattern-catalog", description: "Layer A stub catalog" },
+            { id: "attestation-cross-check", description: "Layer B attestation cross-check" },
+        ],
+    };
+}
+export function verifyBatchCanary(opts) {
+    const failures = [];
+    const ctx = opts.syntheticContext ?? buildSyntheticContext();
+    // 1. Workflow template re-render.
+    let template = "";
+    let rendered = "";
+    try {
+        template = loadWorkflowTemplate(opts.repoRoot);
+    }
+    catch (err) {
+        failures.push(`workflow.md template missing or unreadable: ${err.message}`);
+    }
+    if (template.length === 0) {
+        failures.push("workflow.md template is empty after frontmatter strip");
+    }
+    else {
+        rendered = renderTemplate(template, {
+            agent_role: ctx.agent_role,
+            project_name: ctx.project_name,
+            run_id: ctx.run_id,
+            mirror_path: ctx.mirror_path,
+            sha_pin: ctx.sha_pin,
+            tightened_spec_body: ctx.tightened_spec_body,
+            acceptance_criteria: ctx.acceptance_criteria,
+            in_scope_decisions: ctx.in_scope_decisions,
+            in_scope_invariants: ctx.in_scope_invariants,
+            off_limits: ctx.off_limits,
+            scoped_sensors: ctx.scoped_sensors,
+        });
+        if (UNRESOLVED_TOKEN_RE.test(rendered)) {
+            const m = rendered.match(UNRESOLVED_TOKEN_RE);
+            failures.push(`workflow.md rendered prompt contains unresolved token: ${m?.[0] ?? "<unknown>"}`);
+        }
+        for (const heading of REQUIRED_SECTION_HEADINGS) {
+            if (!rendered.includes(heading)) {
+                failures.push(`workflow.md rendered prompt missing section: \`${heading}\``);
+            }
+        }
+    }
+    // 2. Manifest rebuild (canonical-zone integrity).
+    let manifestFiles = 0;
+    try {
+        const manifest = buildManifest({ repoRoot: opts.repoRoot, generator: "gc.canary" });
+        manifestFiles = manifest.files.length;
+        if (manifestFiles === 0) {
+            failures.push("manifest rebuild produced zero canonical-zone files");
+        }
+    }
+    catch (err) {
+        failures.push(`manifest rebuild threw: ${err.message}`);
+    }
+    // 3. Sanity: workflow.md exists at the expected path (loadWorkflowTemplate
+    // already throws when missing, but a missing template yields the more
+    // detailed failure above; this check ensures the path itself is right).
+    const workflowPath = join(opts.repoRoot, ".harness", "config", "workflow.md");
+    if (!existsSync(workflowPath)) {
+        failures.push(`workflow.md not found at .harness/config/workflow.md`);
+    }
+    else {
+        // Cheap re-read to ensure we can read it post-batch (catches an edit that
+        // wrote invalid utf-8 etc).
+        try {
+            readFileSync(workflowPath, "utf8");
+        }
+        catch (err) {
+            failures.push(`workflow.md unreadable post-batch: ${err.message}`);
+        }
+    }
+    return {
+        ok: failures.length === 0,
+        failures,
+        manifest_files: manifestFiles,
+        rendered_length: rendered.length,
+    };
+}
+//# sourceMappingURL=canary.js.map

package/dist/gc/canary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.js","sourceRoot":"","sources":["../../src/gc/canary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGjF,MAAM,yBAAyB,GAAG;IAChC,SAAS;IACT,wBAAwB;IACxB,uBAAuB;IACvB,qBAAqB;IACrB,0BAA0B;CAC3B,CAAC;AAEF,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAiB5C,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,YAAY,EAAE,QAAQ;QACtB,MAAM,EAAE,YAAY;QACpB,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,0CAA0C;QACnD,mBAAmB,EAAE,kCAAkC;QACvD,mBAAmB,EAAE,CAAC,gDAAgD,CAAC;QACvE,kBAAkB,EAAE;YAClB,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE;SACzE;QACD,mBAAmB,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACtE,UAAU,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;QACtC,cAAc,EAAE;YACd,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACnE,EAAE,EAAE,EAAE,yBAAyB,EAAE,WAAW,EAAE,iCAAiC,EAAE;SAClF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,EAAE,CAAC;IAE7D,kCAAkC;IAClC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,+CAAgD,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,cAAc,EAAE,GAAG,CAAC,cAAc;SACnC,CAAC,CAAC;QACH,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,0DAA0D,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,kDAAkD,OAAO,IAAI,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACpF,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,4BAA4B;QAC5B,IAAI,CAAC;YACH,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,QAAQ;QACR,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,QAAQ,CAAC,MAAM;KACjC,CAAC;AACJ,CAAC"}

package/dist/gc/classify.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Auto-merge classification per L16/L17/L18 (PRIMER §12.2).
+ *
+ * Given a set of repo-relative paths a commit will touch, return one of:
+ *   safe        — formatting, doc regen, frontmatter refresh, generated content,
+ *                 archive moves, stub-catalog additions, .harness/ground/* writes
+ *   code        — touches *.ts / *.tsx / *.js outside generator-managed files
+ *   high-stakes — any path matches projectGlobs.high_stakes_globs
+ *
+ * The classifier is deliberately conservative: when in doubt, escalate. A
+ * single high-stakes hit dominates the result. A single code hit dominates
+ * over safe.
+ */
+import type { ProjectGlobs } from "../sensors/types.js";
+import type { GcAutoMergeClass } from "./types.js";
+export interface ClassifyArgs {
+    paths: readonly string[];
+    projectGlobs?: ProjectGlobs;
+    /**
+     * Globs of paths the harness considers generator-managed — touching these
+     * stays safe-class even when the extension is .ts. Default: empty.
+     */
+    generatorManagedGlobs?: readonly string[];
+}
+export declare function classifyAutoMerge(args: ClassifyArgs): GcAutoMergeClass;

package/dist/gc/classify.js

@@ -0,0 +1,89 @@
+/**
+ * Auto-merge classification per L16/L17/L18 (PRIMER §12.2).
+ *
+ * Given a set of repo-relative paths a commit will touch, return one of:
+ *   safe        — formatting, doc regen, frontmatter refresh, generated content,
+ *                 archive moves, stub-catalog additions, .harness/ground/* writes
+ *   code        — touches *.ts / *.tsx / *.js outside generator-managed files
+ *   high-stakes — any path matches projectGlobs.high_stakes_globs
+ *
+ * The classifier is deliberately conservative: when in doubt, escalate. A
+ * single high-stakes hit dominates the result. A single code hit dominates
+ * over safe.
+ */
+import { matchAnyGlob } from "../ground/glob.js";
+/** Patterns the classifier always treats as safe regardless of file type. */
+const SAFE_PATH_PREFIXES = [
+    ".harness/ground/",
+    ".harness/staleness/",
+    ".harness/runs/terminal/",
+    ".archive/",
+];
+/** Doc / config / generated extensions. Not safe by themselves; combined with
+ *  off-source-tree location they are. */
+const DOC_LIKE_EXTS = [".md", ".yaml", ".yml", ".json", ".txt"];
+/** Source-code extensions that escalate to code-class. */
+const CODE_EXTS = [
+    ".ts",
+    ".tsx",
+    ".cts",
+    ".mts",
+    ".js",
+    ".jsx",
+    ".cjs",
+    ".mjs",
+    ".py",
+    ".rb",
+    ".go",
+    ".rs",
+];
+export function classifyAutoMerge(args) {
+    const highStakes = args.projectGlobs?.high_stakes_globs ?? [];
+    const generated = args.generatorManagedGlobs ?? args.projectGlobs?.generator_source_globs ?? [];
+    let cls = "safe";
+    for (const path of args.paths) {
+        if (highStakes.length > 0 && matchAnyGlob(path, highStakes)) {
+            return "high-stakes";
+        }
+        if (cls === "code")
+            continue; // already escalated; only high-stakes upgrade further
+        if (isSafePath(path, generated))
+            continue;
+        if (isCodePath(path)) {
+            cls = "code";
+            continue;
+        }
+        // Unknown extension under the canonical zone — keep as safe; .archive
+        // moves or yaml writes etc.
+    }
+    return cls;
+}
+function isSafePath(path, generatorManagedGlobs) {
+    for (const prefix of SAFE_PATH_PREFIXES) {
+        if (path.startsWith(prefix))
+            return true;
+    }
+    if (generatorManagedGlobs.length > 0 && matchAnyGlob(path, generatorManagedGlobs)) {
+        return true;
+    }
+    // Documentation files are safe.
+    if (path.startsWith("docs/"))
+        return true;
+    if (path === "AGENTS.md" || path === "CLAUDE.md" || path === "README.md")
+        return true;
+    // Frontmatter / config under .harness/config/* is safe (the GC pass that
+    // writes there is doing config maintenance, not source change).
+    if (path.startsWith(".harness/config/") || path.startsWith(".claude/"))
+        return true;
+    // Generic doc-extension files outside the source tree fall here.
+    for (const ext of DOC_LIKE_EXTS) {
+        if (path.endsWith(ext))
+            return true;
+    }
+    return false;
+}
+function isCodePath(path) {
+    const lower = path.toLowerCase();
+    return CODE_EXTS.some((e) => lower.endsWith(e));
+}
+//# sourceMappingURL=classify.js.map

package/dist/gc/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/gc/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIjD,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG;IACzB,kBAAkB;IAClB,qBAAqB;IACrB,yBAAyB;IACzB,WAAW;CACZ,CAAC;AAEF;yCACyC;AACzC,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEhE,0DAA0D;AAC1D,MAAM,SAAS,GAAG;IAChB,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC;AAYF,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,iBAAiB,IAAI,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,YAAY,EAAE,sBAAsB,IAAI,EAAE,CAAC;IAEhG,IAAI,GAAG,GAAqB,MAAM,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5D,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,GAAG,KAAK,MAAM;YAAE,SAAS,CAAC,sDAAsD;QACpF,IAAI,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,SAAS;QAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,GAAG,MAAM,CAAC;YACb,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,4BAA4B;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,qBAAwC;IACxE,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gCAAgC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtF,yEAAyE;IACzE,gEAAgE;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,iEAAiE;IACjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}