@jeger-ai/opengantry 3.0.1 → 3.1.1

package/dist/cli/commands/runtime.js

@@ -1,22 +1,30 @@
 import fs from "node:fs";
-import { agentErrorAbsolutePath } from "../lib/errors.js";
+import { agentErrorAbsolutePath, serializeAgentErrorPayload } from "../lib/errors.js";
 import { hintForbiddenZone, hintRuntimeHumanSummary, logFixHint } from "../lib/fix-hints.js";
+import { emitPinnedMissionBanner, resolveMissionArg } from "../lib/mission-arg.js";
 import { resolveRuntimeEnv, resolvedRuntimeEnvToJsonPayload } from "../lib/runtime-env.js";
-import { logError, logInfo, setExitCode, errorMessage } from "../lib/cli-io.js";
+import { logError, logInfo, setExitCode } from "../lib/cli-io.js";
+import { emitCliJson, runUserCommand, runUserCommandAsync } from "../lib/command-boundary.js";
 import { runRuntimeExec } from "../lib/runtime-exec.js";
 import { loadWorkspace } from "../lib/workspace.js";
 function escapeShellSingleQuotes(value) {
     return value.replace(/'/g, `'\\''`);
 }
 export function runRuntimeEnv(options) {
-    try {
+    runUserCommand({ json: options.json }, () => {
         const workspace = loadWorkspace();
-        const resolved = resolveRuntimeEnv(workspace, options.mission);
-        const payload = resolvedRuntimeEnvToJsonPayload(resolved);
+        const resolved = resolveMissionArg(workspace.root, options.mission);
+        const resolvedEnv = resolveRuntimeEnv(workspace, resolved.missionRel);
+        const payload = resolvedRuntimeEnvToJsonPayload(resolvedEnv);
         if (options.json) {
-            logInfo(JSON.stringify(payload, null, 2));
+            emitCliJson({
+                ...payload,
+                mission_file_path: resolved.missionRel,
+                mission_source: resolved.source,
+            });
             return;
         }
+        emitPinnedMissionBanner(resolved, { json: options.json });
         const fmt = options.format ?? "shell";
         if (fmt === "text") {
             for (const [k, v] of Object.entries(payload)) {
@@ -27,17 +35,7 @@ export function runRuntimeEnv(options) {
         for (const [k, v] of Object.entries(payload)) {
             logInfo(`export ${k}='${escapeShellSingleQuotes(v)}'`);
         }
-    }
-    catch (e) {
-        const errno = typeof e === "object" && e !== null ? e.code : undefined;
-        if (errno === "ENOENT") {
-            logError(`runtime env: mission file not found: ${options.mission} (ENOENT). Use an existing mission path — e.g. .gitagent/missions/example.verify.yaml — or run gantry legislate first, then pass that YAML path.`);
-        }
-        else {
-            logError(errorMessage(e));
-        }
-        setExitCode(2);
-    }
+    });
 }
 export async function runRuntimeExecCommand(options) {
     if (options.workerCommand.length === 0) {
@@ -45,7 +43,7 @@ export async function runRuntimeExecCommand(options) {
         setExitCode(2);
         return;
     }
-    try {
+    await runUserCommandAsync({ json: options.json }, async () => {
         const workspace = loadWorkspace();
         const resolved = resolveRuntimeEnv(workspace, options.mission);
         const result = await runRuntimeExec(workspace, {
@@ -65,7 +63,7 @@ export async function runRuntimeExecCommand(options) {
             }
         }
         if (options.json) {
-            logInfo(JSON.stringify({
+            emitCliJson({
                 status: result.status,
                 exit_code: result.exitCode,
                 worker_exit_code: result.workerExitCode,
@@ -76,7 +74,7 @@ export async function runRuntimeExecCommand(options) {
                 flight_id: result.flightId,
                 agent_error_path: agentError?.error_file ?? "",
                 agent_error: agentError,
-            }, null, 2));
+            });
         }
         else {
             logInfo(`runtime exec: ${result.status}`);
@@ -87,15 +85,11 @@ export async function runRuntimeExecCommand(options) {
                 if (result.violations[0]) {
                     logFixHint(hintForbiddenZone(result.violations[0].path, options.mission));
                 }
-                logError(JSON.stringify(agentError));
+                logError(serializeAgentErrorPayload(agentError));
             }
         }
         if (result.exitCode !== 0)
             setExitCode(result.exitCode);
-    }
-    catch (e) {
-        logError(errorMessage(e));
-        setExitCode(2);
-    }
+    });
 }
 //# sourceMappingURL=runtime.js.map

package/dist/cli/commands/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/cli/commands/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAoBpD,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;QACtC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,UAAU,CAAC,KAAK,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,QAAQ,CACN,wCAAwC,OAAO,CAAC,OAAO,kJAAkJ,CAC1M,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA8B;IACxE,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;QAC/E,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,IAAI,UAAU,GAA6B,IAAI,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAsB,CAAC;YACjF,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CACL,IAAI,CAAC,SAAS,CACZ;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,MAAM,CAAC,cAAc;gBACvC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,eAAe;gBACpC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE;gBAC9C,WAAW,EAAE,UAAU;aACxB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,mBAAmB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/cli/commands/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAoBpD,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC1C,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,+BAA+B,CAAC,WAAW,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC;gBACV,GAAG,OAAO;gBACV,iBAAiB,EAAE,QAAQ,CAAC,UAAU;gBACtC,cAAc,EAAE,QAAQ,CAAC,MAAM;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,uBAAuB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;QACtC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,UAAU,CAAC,KAAK,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA8B;IACxE,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;QAC/E,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,IAAI,UAAU,GAA6B,IAAI,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAsB,CAAC;YACjF,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC;gBACV,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,MAAM,CAAC,cAAc;gBACvC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,eAAe;gBACpC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE;gBAC9C,WAAW,EAAE,UAAU;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,mBAAmB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,QAAQ,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAyBlD"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAuBlD"}

package/dist/cli/commands/scan.js

@@ -1,27 +1,29 @@
-import { parseMissionFile } from "../lib/missions/parser.js";
+import { logInfo } from "../lib/cli-io.js";
+import { emitCliJson, runUserCommand } from "../lib/command-boundary.js";
 import { runKpiScan } from "../lib/kpi-scan.js";
-import { logError, logInfo, setExitCode } from "../lib/cli-io.js";
+import { emitPinnedMissionBanner, resolveMissionArg } from "../lib/mission-arg.js";
+import { parseMissionFile } from "../lib/missions/parser.js";
 import { loadWorkspace } from "../lib/workspace.js";
 export function runScan(options) {
-    if (!options.mission) {
-        logError("gantry scan: --mission is required");
-        setExitCode(2);
-        return;
-    }
-    try {
+    runUserCommand({ json: options.json }, () => {
         const { root } = loadWorkspace();
-        const mission = parseMissionFile(root, options.mission);
+        const resolved = resolveMissionArg(root, options.mission);
+        emitPinnedMissionBanner(resolved, { json: options.json });
+        const mission = parseMissionFile(root, resolved.missionRel);
         const result = runKpiScan(root, mission, { cwd: options.cwd });
         if (options.json) {
-            process.stdout.write(`${JSON.stringify({ status: "ok", report_path: result.reportPath, report: result.report }, null, 2)}\n`);
+            emitCliJson({
+                status: "ok",
+                report_path: result.reportPath,
+                mission_file_path: resolved.missionRel,
+                mission_source: resolved.source,
+                report: result.report,
+            });
             return;
         }
         logInfo(`gantry scan: wrote ${result.reportPath}`);
         logInfo(`metrics: ${Object.keys(result.report.metrics).length}`);
-    }
-    catch (e) {
-        logError(e instanceof Error ? e.message : String(e));
-        setExitCode(1);
-    }
+        logInfo(`next: git add ${result.reportPath} && git commit -m "[${mission.msnId}] KPI report"  # then gantry verify`);
+    });
 }
 //# sourceMappingURL=scan.js.map

package/dist/cli/commands/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,QAAQ,CAAC,oCAAoC,CAAC,CAAC;QAC/C,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACxG,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,sBAAsB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1D,uBAAuB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,MAAM,CAAC,UAAU;gBAC9B,iBAAiB,EAAE,QAAQ,CAAC,UAAU;gBACtC,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,OAAO,CAAC,sBAAsB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,iBAAiB,MAAM,CAAC,UAAU,uBAAuB,OAAO,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/tmvc-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tmvc-guard.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/tmvc-guard.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAQD,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CA+D/D"}
+{"version":3,"file":"tmvc-guard.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/tmvc-guard.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAQD,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CA+C/D"}

package/dist/cli/commands/tmvc-guard.js

@@ -1,4 +1,5 @@
-import { logError, logWarn, setExitCode, errorMessage } from "../lib/cli-io.js";
+import { logWarn, setExitCode } from "../lib/cli-io.js";
+import { emitCliJson, runUserCommand } from "../lib/command-boundary.js";
 import { resolveRuntimeEnv } from "../lib/runtime-env.js";
 import { resolvePinnedMission } from "../lib/missions/parser.js";
 import { evaluateStagedTmvcGuard, formatStagedTmvcAdvisory, } from "../lib/staged-tmvc-guard.js";
@@ -9,13 +10,13 @@ function advisoryToStderr(lines) {
     }
 }
 export function runTmvcGuard(options) {
-    try {
+    runUserCommand({ json: options.json }, () => {
         const workspace = loadWorkspace();
         const missionRel = options.mission?.trim() || resolvePinnedMission(workspace.root) || null;
         if (!missionRel) {
             const msg = "tmvc guard: no pinned mission — skipping TMVC check (advisory)";
             if (options.json) {
-                process.stdout.write(`${JSON.stringify({ ok: true, skipped: true, skip_reason: "no pinned mission" }, null, 2)}\n`);
+                emitCliJson({ ok: true, skipped: true, skip_reason: "no pinned mission" });
                 return;
             }
             advisoryToStderr([msg]);
@@ -29,7 +30,7 @@ export function runTmvcGuard(options) {
         });
         const strict = options.strict === true || process.env.GXT_TMVC_GUARD_STRICT === "1";
         if (options.json) {
-            process.stdout.write(`${JSON.stringify({
+            emitCliJson({
                 ok: result.ok,
                 skipped: result.skipped,
                 skip_reason: result.skipReason ?? "",
@@ -40,24 +41,16 @@ export function runTmvcGuard(options) {
                 forbidden_zones: result.forbiddenZones,
                 mission: resolved.mission_file,
                 skill_key: resolved.skill_key,
-            }, null, 2)}\n`);
+            });
             if (strict && !result.ok && !result.skipped)
                 setExitCode(1);
             return;
         }
         const lines = formatStagedTmvcAdvisory(result);
-        if (result.skipped || result.ok) {
-            advisoryToStderr(lines);
-            return;
-        }
         advisoryToStderr(lines);
-        if (strict) {
+        if (!result.skipped && !result.ok && strict) {
             setExitCode(1);
         }
-    }
-    catch (e) {
-        logError(errorMessage(e));
-        setExitCode(2);
-    }
+    });
 }
 //# sourceMappingURL=tmvc-guard.js.map

package/dist/cli/commands/tmvc-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"tmvc-guard.js","sourceRoot":"","sources":["../../../src/cli/commands/tmvc-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,SAAS,gBAAgB,CAAC,KAAwB;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAE3F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,gEAAgE,CAAC;YAC7E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9F,CAAC;gBACF,OAAO;YACT,CAAC;YACD,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,QAAQ,CAAC,SAAS;SAC7B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC;QAEpF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CACf;gBACE,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACpC,MAAM;gBACN,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,eAAe,EAAE,MAAM,CAAC,cAAc;gBACtC,OAAO,EAAE,QAAQ,CAAC,YAAY;gBAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;YACF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,WAAW,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YAChC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"tmvc-guard.js","sourceRoot":"","sources":["../../../src/cli/commands/tmvc-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,SAAS,gBAAgB,CAAC,KAAwB;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC1C,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAE3F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,gEAAgE,CAAC;YAC7E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YACD,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,QAAQ,CAAC,SAAS;SAC7B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC;QAEpF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACpC,MAAM;gBACN,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,eAAe,EAAE,MAAM,CAAC,cAAc;gBACtC,OAAO,EAAE,QAAQ,CAAC,YAAY;gBAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,WAAW,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC/C,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/verify.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAM7D,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAgE7D,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BrE"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/verify.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAM7D,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAgE7D,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBrE"}

package/dist/cli/commands/verify.js

@@ -1,4 +1,4 @@
-import { logError, logInfo, setExitCode } from "../lib/cli-io.js";
+import { logInfo, setExitCode } from "../lib/cli-io.js";
 import { gitRevParse } from "../lib/git.js";
 import { initFailurePayload } from "../lib/verify-payload.js";
 import { emitVerifyJson } from "../lib/verify-presenters.js";
@@ -73,11 +73,6 @@ export async function runVerify(options) {
         }
         return;
     }
-    if (!options.mission) {
-        logError("gantry verify: --mission is required (or use --changed-missions)");
-        setExitCode(2);
-        return;
-    }
     try {
         const result = await runVerifyCore(options);
         if (!result.ok) {

package/dist/cli/commands/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/cli/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,kGAAkG;AAClG,SAAS,yBAAyB,CAAC,CAAU,EAAE,OAAsB;IACnE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACtC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAsB;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,yGAAyG,EACzG,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,uDAAuD,EACvD,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY,EAAE,QAAiB;IACpE,IAAI,QAAQ,EAAE,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3E,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,OAAsB;IAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,kBAAkB,OAAO,gBAAgB,OAAO,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC9C,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,WAAW,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,IAAI,CAAC;QACH,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,QAAQ,CAAC,kEAAkE,CAAC,CAAC;QAC7E,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/cli/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,kGAAkG;AAClG,SAAS,yBAAyB,CAAC,CAAU,EAAE,OAAsB;IACnE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACtC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAsB;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,yGAAyG,EACzG,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,uDAAuD,EACvD,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY,EAAE,QAAiB;IACpE,IAAI,QAAQ,EAAE,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3E,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,OAAsB;IAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,kBAAkB,OAAO,gBAAgB,OAAO,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC9C,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,WAAW,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,IAAI,CAAC;QACH,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/cli/lib/attest-mission.d.ts

@@ -0,0 +1,17 @@
+import { type AttestationReceipt } from "./attestation-receipt.js";
+import type { ResolvedMissionArg } from "./mission-arg.js";
+export interface AttestMissionOptions {
+    root: string;
+    resolved: ResolvedMissionArg;
+    out?: string;
+    sign?: boolean;
+}
+export interface AttestMissionResult {
+    repo_root: string;
+    receipt: AttestationReceipt;
+    receipt_path: string;
+    mission_file_path: string;
+    mission_source: "flag" | "pin";
+}
+export declare function attestMission(options: AttestMissionOptions): AttestMissionResult;
+//# sourceMappingURL=attest-mission.d.ts.map

package/dist/cli/lib/attest-mission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest-mission.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/attest-mission.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,KAAK,CAAC;CAChC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAmBhF"}

package/dist/cli/lib/attest-mission.js

@@ -0,0 +1,23 @@
+import { buildAttestationReceipt, writeAttestationReceipt, } from "./attestation-receipt.js";
+import { assertMissionGatePresent, parseMissionFile } from "./missions/parser.js";
+export function attestMission(options) {
+    const { root, resolved } = options;
+    const mission = parseMissionFile(root, resolved.missionRel);
+    assertMissionGatePresent(mission);
+    const receipt = buildAttestationReceipt({
+        root,
+        mission,
+        missionArg: resolved.missionRel,
+        verifyStatus: "attest_only",
+        sign: options.sign === true,
+    });
+    const receipt_path = writeAttestationReceipt(root, receipt, options.out);
+    return {
+        repo_root: root,
+        receipt,
+        receipt_path,
+        mission_file_path: resolved.missionRel,
+        mission_source: resolved.source,
+    };
+}
+//# sourceMappingURL=attest-mission.js.map

package/dist/cli/lib/attest-mission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest-mission.js","sourceRoot":"","sources":["../../../src/cli/lib/attest-mission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAiBlF,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5D,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,uBAAuB,CAAC;QACtC,IAAI;QACJ,OAAO;QACP,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,aAAa;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,OAAO;QACL,SAAS,EAAE,IAAI;QACf,OAAO;QACP,YAAY;QACZ,iBAAiB,EAAE,QAAQ,CAAC,UAAU;QACtC,cAAc,EAAE,QAAQ,CAAC,MAAM;KAChC,CAAC;AACJ,CAAC"}

package/dist/cli/lib/attestation-receipt.d.ts

@@ -0,0 +1,40 @@
+import { type ReceiptSignature, type ReceiptSignatureVerifyStatus } from "./receipt-signing.js";
+import type { ParsedMission } from "./types.js";
+export declare const ATTESTATION_RECEIPT_SCHEMA_VERSION: "0.1.0";
+export type AttestationVerifyStatus = "passed" | "failed" | "attest_only";
+export interface PlannerStampReceipt {
+    commit: string;
+    subject: string;
+    author_email: string;
+}
+export interface AttestationReceipt {
+    schema_version: typeof ATTESTATION_RECEIPT_SCHEMA_VERSION;
+    msn_id: string;
+    mission_rel: string;
+    mission_sha256: string;
+    manifest_sha256: string | null;
+    target_architecture_sha256: string | null;
+    config_sha256: string | null;
+    git_head: string;
+    planner_stamp: PlannerStampReceipt | null;
+    verify_status: AttestationVerifyStatus;
+    error_code?: string;
+    issued_at: string;
+    receipt_sha256: string;
+    signature?: ReceiptSignature;
+}
+export interface BuildAttestationReceiptInput {
+    root: string;
+    mission: ParsedMission;
+    missionArg: string;
+    verifyStatus: AttestationVerifyStatus;
+    errorCode?: string;
+    sign?: boolean;
+}
+export declare function resolvePlannerStampForReceipt(root: string, msnId: string): PlannerStampReceipt | null;
+export declare function computeReceiptSha256(payload: Omit<AttestationReceipt, "receipt_sha256" | "signature">): string;
+export declare function buildAttestationReceipt(input: BuildAttestationReceiptInput): AttestationReceipt;
+export declare function defaultReceiptPath(root: string, msnId: string, receiptSha256: string): string;
+export declare function writeAttestationReceipt(root: string, receipt: AttestationReceipt, outPath?: string): string;
+export type { ReceiptSignatureVerifyStatus };
+//# sourceMappingURL=attestation-receipt.d.ts.map

package/dist/cli/lib/attestation-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-receipt.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/attestation-receipt.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EAClC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,eAAO,MAAM,kCAAkC,EAAG,OAAgB,CAAC;AAEnE,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE1E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,kCAAkC,CAAC;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,aAAa,EAAE,uBAAuB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,uBAAuB,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,mBAAmB,GAAG,IAAI,CAW5B;AASD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,GAAG,WAAW,CAAC,GAChE,MAAM,CAER;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,kBAAkB,CAwE/F;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAG7F;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAOR;AAED,YAAY,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/cli/lib/attestation-receipt.js

@@ -0,0 +1,110 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { canonicalJson } from "./canonical-json.js";
+import { logWarn } from "./cli-io.js";
+import { CLI_NAME, REL_RECEIPTS_DIR } from "./constants.js";
+import { GantryUserError } from "./errors.js";
+import { listMsnSubjectCommits, missionPathRepoRelative, } from "./git-proof.js";
+import { gitRevParse } from "./git.js";
+import { loadGxtConfig, resolveReceiptSignatureTier } from "./gxt-config.js";
+import { resolvePlannerEmails } from "./planner-identity.js";
+import { signReceiptHash, verifyReceiptSignature, } from "./receipt-signing.js";
+import { computeWorkingDigests } from "./working-digests.js";
+export const ATTESTATION_RECEIPT_SCHEMA_VERSION = "0.1.0";
+function sha256Bytes(buf) {
+    return crypto.createHash("sha256").update(buf).digest("hex");
+}
+function isPlannerStamp(row, plannerEmails) {
+    return plannerEmails.includes(row.authorEmail.trim().toLowerCase());
+}
+export function resolvePlannerStampForReceipt(root, msnId) {
+    const plannerEmails = resolvePlannerEmails(root).emails;
+    if (plannerEmails.length === 0)
+        return null;
+    const rows = listMsnSubjectCommits(root, msnId);
+    const stamp = rows.find((row) => isPlannerStamp(row, plannerEmails));
+    if (!stamp)
+        return null;
+    return {
+        commit: stamp.hash,
+        subject: stamp.subject,
+        author_email: stamp.authorEmail,
+    };
+}
+function unsignedReceiptPayload(input) {
+    const { receipt_sha256: _receiptSha, signature: _signature, ...rest } = input;
+    return { ...rest };
+}
+export function computeReceiptSha256(payload) {
+    return crypto.createHash("sha256").update(canonicalJson(unsignedReceiptPayload(payload)), "utf8").digest("hex");
+}
+export function buildAttestationReceipt(input) {
+    const missionAbs = path.resolve(input.root, input.missionArg);
+    const missionRel = missionPathRepoRelative(input.root, missionAbs);
+    const msnId = input.mission.msnId;
+    if (!msnId) {
+        throw new GantryUserError("INVALID_ARGUMENT", "mission is missing msn_id", undefined, 2);
+    }
+    const digests = computeWorkingDigests(input.root);
+    if (digests.manifest_sha256 === null) {
+        throw new GantryUserError("MANIFEST_MISSING", "attestation receipt requires .gitagent/foreman/MANIFEST.json", "run gantry init or restore MANIFEST.json", 2);
+    }
+    const base = {
+        schema_version: ATTESTATION_RECEIPT_SCHEMA_VERSION,
+        msn_id: msnId,
+        mission_rel: missionRel,
+        mission_sha256: sha256Bytes(fs.readFileSync(missionAbs)),
+        manifest_sha256: digests.manifest_sha256,
+        target_architecture_sha256: digests.target_architecture_sha256,
+        config_sha256: digests.config_sha256,
+        git_head: gitRevParse(input.root, "HEAD") ?? "no-head",
+        planner_stamp: resolvePlannerStampForReceipt(input.root, msnId),
+        verify_status: input.verifyStatus,
+        issued_at: new Date().toISOString(),
+    };
+    if (input.errorCode) {
+        base.error_code = input.errorCode;
+    }
+    const receipt_sha256 = computeReceiptSha256(base);
+    const receipt = { ...base, receipt_sha256 };
+    const config = loadGxtConfig(input.root);
+    const tier = resolveReceiptSignatureTier(config);
+    const shouldSign = input.sign === true || tier === "require" || tier === "warn";
+    if (!shouldSign)
+        return receipt;
+    const signature = signReceiptHash(input.root, receipt_sha256);
+    if (!signature) {
+        if (tier === "require") {
+            throw new GantryUserError("RECEIPT_SIGNATURE_REQUIRED", "receipt_signature=require but no local SSH/GPG signing key is configured", "configure user.signingkey and gpg.format, or pass receipt_signature off", 2);
+        }
+        if (tier === "warn") {
+            logWarn(`${CLI_NAME} attest: receipt unsigned — no local SSH/GPG signing key is configured`);
+        }
+        return receipt;
+    }
+    const verifyStatus = verifyReceiptSignature(input.root, receipt_sha256, signature);
+    if (tier === "warn" && verifyStatus !== "good") {
+        logWarn(`${CLI_NAME} attest: receipt signature verify_status=${verifyStatus}`);
+    }
+    return {
+        ...receipt,
+        signature: {
+            ...signature,
+            verify_status: verifyStatus,
+        },
+    };
+}
+export function defaultReceiptPath(root, msnId, receiptSha256) {
+    const suffix = receiptSha256.slice(0, 12);
+    return path.join(root, REL_RECEIPTS_DIR, `${msnId}-${suffix}.json`);
+}
+export function writeAttestationReceipt(root, receipt, outPath) {
+    const target = outPath
+        ? path.resolve(root, outPath)
+        : defaultReceiptPath(root, receipt.msn_id, receipt.receipt_sha256);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
+    return target;
+}
+//# sourceMappingURL=attestation-receipt.js.map

package/dist/cli/lib/attestation-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-receipt.js","sourceRoot":"","sources":["../../../src/cli/lib/attestation-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,eAAe,EACf,sBAAsB,GAGvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,OAAgB,CAAC;AAoCnE,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,GAAiB,EAAE,aAAuB;IAChE,OAAO,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,KAAa;IAEb,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAoF;IAEpF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAA2B,CAAC;IACpG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAiE;IAEjE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAmC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,8DAA8D,EAC9D,0CAA0C,EAC1C,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAA6D;QACrE,cAAc,EAAE,kCAAkC;QAClD,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACxD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS;QACtD,aAAa,EAAE,6BAA6B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/D,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACpC,CAAC;IAED,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAuB,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC;IAChF,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAEhC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,4BAA4B,EAC5B,0EAA0E,EAC1E,yEAAyE,EACzE,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,CACL,GAAG,QAAQ,wEAAwE,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACnF,IAAI,IAAI,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,QAAQ,4CAA4C,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE;YACT,GAAG,SAAS;YACZ,aAAa,EAAE,YAAY;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,aAAqB;IACnF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,KAAK,IAAI,MAAM,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,OAA2B,EAC3B,OAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7B,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/lib/canonical-json.d.ts

@@ -0,0 +1,3 @@
+/** Deterministic JSON with sorted object keys (recursive). */
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/cli/lib/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/canonical-json.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD"}

package/dist/cli/lib/canonical-json.js

@@ -0,0 +1,13 @@
+/** Deterministic JSON with sorted object keys (recursive). */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((v) => canonicalJson(v)).join(",")}]`;
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/cli/lib/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/cli/lib/canonical-json.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/cli/lib/command-boundary.d.ts

@@ -2,6 +2,24 @@
  * Command-boundary error helpers: commands resolve their repo root and report
  * boundary failures through one place instead of hand-rolled try/catch copies.
  */
+export interface CliFailureEnvelope {
+    status: "failed";
+    error_code: string;
+    message: string;
+    fix_hints: string[];
+    exit_code: number;
+}
+/** Sole serializer for stdout JSON from commands (success and failure). */
+export declare function emitCliJson(payload: unknown): void;
+export declare function cliFailureEnvelope(e: unknown): CliFailureEnvelope;
+/** Run a sync command body with one JSON-aware error boundary. */
+export declare function runUserCommand(opts: {
+    json?: boolean;
+}, fn: () => void): void;
+/** Async variant of {@link runUserCommand}. */
+export declare function runUserCommandAsync(opts: {
+    json?: boolean;
+}, fn: () => Promise<void>): Promise<void>;
 /** Report a command-boundary failure: log the message and set the exit code once. */
 export declare function reportCommandError(e: unknown, exitCode?: number): void;
 /**

package/dist/cli/lib/command-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-boundary.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/command-boundary.ts"],"names":[],"mappings":"AAIA;;;GAGG;AAEH,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,SAAI,GAAG,IAAI,CAGjE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQrE;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAM3E;AAED,qDAAqD;AACrD,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf"}
+{"version":3,"file":"command-boundary.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/command-boundary.ts"],"names":[],"mappings":"AAKA;;;GAGG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAElD;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,kBAAkB,CASjE;AAOD,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAW7E;AAED,+CAA+C;AAC/C,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EACxB,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,SAAI,GAAG,IAAI,CAGjE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQrE;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAM3E;AAED,qDAAqD;AACrD,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf"}