@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-reply-command.mjs

@@ -0,0 +1,488 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import {
+  latestReplyArtifactDescriptor,
+  replySourceManifest,
+  validateReplySourceManifest,
+  writeReplyArtifact,
+} from './runtime-reply-artifact-lifecycle-model.mjs';
+
+export function createRuntimeReplyCommand(deps) {
+  const {
+    jsonSchemaVersion,
+    replyPolicy,
+    ensureRoot,
+    workflowPath,
+    readWorkflow,
+    listDispatchEvents,
+    listExecutionFiles,
+    fileDigest,
+    digestObject,
+    writeJsonEnvelope,
+    printList,
+    readJsonArtifact,
+    executionsDirectory,
+    recoveryRunsDirectory,
+    observabilityDirectory,
+    runtimeTracesDirectory,
+    replyDraftsDirectory,
+    replyReviewsDirectory,
+    replyApprovalsDirectory,
+    replyOutboxDirectory,
+    replySendRunsDirectory,
+    replyDraftFilePath,
+    replyReviewFilePath,
+    replyApprovalFilePath,
+    replyOutboxFilePath,
+    replySendRunFilePath,
+    listReplyDraftFiles,
+    listReplyReviewFiles,
+    listReplyApprovalFiles,
+    listReplyOutboxFiles,
+    listReplySendRunFiles,
+  } = deps;
+
+function replyPolicySnapshot() {
+  const snapshot = { ...replyPolicy, source: 'builtin-data-only', dynamic_code: false, remote_config: false };
+  return { ...snapshot, reply_policy_digest: digestObject(snapshot) };
+}
+
+function isReplySourceBoundArtifact(artifact) {
+  return artifact?.safety?.stage === 'Reply E'
+    || artifact?.safety?.source_bound === true
+    || Boolean(artifact?.reply_draft?.source_manifest);
+}
+
+function replyDraftEnvelope(root, { persist = false, adapter = 'local-disabled', sourceBound = false } = {}) {
+  const workflow = readWorkflow(root);
+  const dispatches = listDispatchEvents(root);
+  const executions = listExecutionFiles(root);
+  const policy = replyPolicySnapshot();
+  const sourceManifest = sourceBound ? replySourceManifest(deps, root) : null;
+  const content = [
+    sourceBound ? 'Source-bound local runtime reply draft.' : 'Local runtime reply draft.',
+    `Workflow present: ${workflow ? 'yes' : 'no'}.`,
+    `Dispatch artifacts: ${dispatches.length}.`,
+    `Execution artifacts: ${executions.length}.`,
+    sourceManifest ? `Source manifest digest: ${sourceManifest.source_digest}.` : '',
+    'External delivery is disabled.',
+  ].filter(Boolean).join('\n');
+  const draft = {
+    created_at: new Date().toISOString(),
+    target_adapter: adapter,
+    source: { workflow_digest: workflow && fs.existsSync(workflowPath(root)) ? fileDigest(workflowPath(root)) : '', dispatch_count: dispatches.length, execution_count: executions.length },
+    ...(sourceManifest ? { source_manifest: sourceManifest } : {}),
+    content,
+    send_allowed: false,
+    external_delivery: false,
+    model_invocation: false,
+  };
+  return {
+    mode: 'reply-draft',
+    ok: true,
+    state_present: Boolean(workflow),
+    reply_draft: { ...draft, draft_digest: digestObject(draft), writes: Boolean(persist), policy_digest: policy.reply_policy_digest },
+    policy,
+    safety: { stage: sourceBound ? 'Reply E' : 'Reply A', writes: Boolean(persist), draft_artifact: Boolean(persist), source_bound: Boolean(sourceBound), model_invocation: false, platform_api: false, external_delivery: false, auto_reply: false, git: false, worktree: false, business_source_write: false, subagent: false, mcp: false },
+    quality: [],
+    action: persist ? 'reply draft artifact was written locally. No model, platform API, or external delivery occurred.' : 'reply draft was previewed read-only. No files were written.',
+  };
+}
+
+function writeReplyDraft(root, envelope) {
+  return writeReplyArtifact(deps, root, replyDraftsDirectory, 'reply-draft', envelope);
+}
+
+function replyReviewEnvelope(root, draftFile, { persist = false, actor = 'runtime' } = {}) {
+  const draftPath = replyDraftFilePath(root, draftFile);
+  const draft = readJsonArtifact(draftPath, 'Reply draft');
+  const draftDigest = fileDigest(draftPath);
+  const draftVerification = validateReplyArtifact(root, draft, draftFile, draftPath);
+  const sourceBound = isReplySourceBoundArtifact(draft);
+  const blocked = [];
+  if (!draftVerification.ok) blocked.push(...draftVerification.failures.map((failure) => `reply draft verification failed: ${failure}`));
+  if (!sourceBound) blocked.push('reply review requires a source-bound draft');
+  const trace = latestReplyArtifactDescriptor(deps, root, 'latest_runtime_trace', runtimeTracesDirectory, '.runtime-trace.json');
+  const observability = latestReplyArtifactDescriptor(deps, root, 'latest_observability', observabilityDirectory, '.observability.json');
+  const sourceManifest = draft.reply_draft?.source_manifest || null;
+  const reviewPayload = {
+    created_at: new Date().toISOString(),
+    actor: actor || 'runtime',
+    draft_file: String(draftFile),
+    draft_digest: draftDigest,
+    source_manifest_digest: sourceManifest?.source_digest || '',
+    trace_file: trace.file,
+    trace_digest: trace.digest,
+    observability_file: observability.file,
+    observability_digest: observability.digest,
+    review_outcome: blocked.length === 0 ? 'approved' : 'blocked',
+    blocked_reasons: blocked,
+    boundary_assertions: { send_allowed: false, external_delivery: false, model_invocation: false, platform_api: false, git: false, worktree: false, business_source_write: false, subagent: false, mcp: false },
+  };
+  return {
+    mode: 'reply-review',
+    ok: blocked.length === 0,
+    state_present: fs.existsSync(workflowPath(root)),
+    reply_review: { ...reviewPayload, writes: Boolean(persist), review_digest: digestObject(reviewPayload) },
+    draft,
+    safety: { stage: 'Reply F', writes: Boolean(persist), review_artifact: Boolean(persist), source_bound: sourceBound, platform_api: false, external_delivery: false, auto_reply: false, model_invocation: false, git: false, worktree: false, business_source_write: false, subagent: false, mcp: false },
+    quality: blocked,
+    action: persist ? 'reply review sidecar was written locally. No model, platform API, or external delivery occurred.' : 'reply review was previewed read-only. No files were written.',
+  };
+}
+
+function writeReplyReview(root, envelope) {
+  if (!envelope.ok) throw new Error(`reply review gate failed: ${envelope.quality.join('; ')}`);
+  return writeReplyArtifact(deps, root, replyReviewsDirectory, 'reply-review', envelope);
+}
+
+function findValidReplyReview(root, draftFile, draftDigest) {
+  const files = listReplyReviewFiles(root).slice().reverse();
+  for (const fileName of files) {
+    try {
+      const file = replyReviewFilePath(root, fileName);
+      const artifact = readJsonArtifact(file, 'Reply review');
+      if (artifact.reply_review?.draft_file !== draftFile) continue;
+      if (artifact.reply_review?.draft_digest !== draftDigest) continue;
+      const verification = validateReplyArtifact(root, artifact, fileName, file);
+      if (!verification.ok) continue;
+      if (artifact.reply_review?.review_outcome !== 'approved') continue;
+      return { file: fileName, digest: fileDigest(file), artifact };
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+function replyApprovalEnvelope(root, draftFile, { persist = false, actor = 'runtime', adapter = 'local-disabled' } = {}) {
+  const draftPath = replyDraftFilePath(root, draftFile);
+  const draft = readJsonArtifact(draftPath, 'Reply draft');
+  const policy = replyPolicySnapshot();
+  const draftDigest = fileDigest(draftPath);
+  const blocked = [];
+  const draftDigestPayload = { ...draft.reply_draft };
+  delete draftDigestPayload.writes;
+  delete draftDigestPayload.policy_digest;
+  delete draftDigestPayload.draft_digest;
+  if (draft.reply_draft?.draft_digest && draft.reply_draft.draft_digest !== digestObject(draftDigestPayload)) blocked.push('reply draft digest mismatch');
+  if (draft.reply_draft?.external_delivery !== false) blocked.push('reply draft external_delivery must be false');
+  if (draft.reply_draft?.model_invocation !== false) blocked.push('reply draft model_invocation must be false');
+  const sourceBound = isReplySourceBoundArtifact(draft);
+  let review = null;
+  if (sourceBound) {
+    blocked.push(...validateReplySourceManifest(deps, root, draft.reply_draft?.source_manifest));
+    review = findValidReplyReview(root, String(draftFile), draftDigest);
+    if (!review) blocked.push('source-bound reply draft requires an approved reply review sidecar');
+  }
+  return {
+    mode: 'reply-approval',
+    ok: blocked.length === 0,
+    state_present: fs.existsSync(workflowPath(root)),
+    reply_approval: { writes: Boolean(persist), draft_file: String(draftFile), draft_digest: draftDigest, review_file: review?.file || '', review_digest: review?.digest || '', policy_digest: policy.reply_policy_digest, target_adapter: adapter, actor: actor || 'runtime', approved: blocked.length === 0, external_delivery: false, send_allowed: false, created_at: new Date().toISOString() },
+    draft,
+    ...(review ? { review: review.artifact } : {}),
+    policy,
+    safety: { stage: 'Reply B', writes: Boolean(persist), approval_artifact: Boolean(persist), platform_api: false, external_delivery: false, auto_reply: false, model_invocation: false, git: false, worktree: false, business_source_write: false, subagent: false, mcp: false },
+    quality: blocked,
+    action: persist ? 'reply approval sidecar was written locally. External delivery remains disabled.' : 'reply approval was previewed. No files were written.',
+  };
+}
+
+function writeReplyApproval(root, envelope) {
+  if (!envelope.ok) throw new Error(`reply approval gate failed: ${envelope.quality.join('; ')}`);
+  return writeReplyArtifact(deps, root, replyApprovalsDirectory, 'reply-approval', envelope);
+}
+
+function replyOutboxEnvelope(root, approvalFile, { persist = false } = {}) {
+  const approvalPath = replyApprovalFilePath(root, approvalFile);
+  const approval = readJsonArtifact(approvalPath, 'Reply approval');
+  const blocked = [];
+  const approvalVerification = validateReplyArtifact(root, approval, approvalFile, approvalPath);
+  if (!approvalVerification.ok) blocked.push(...approvalVerification.failures.map((failure) => `reply approval verification failed: ${failure}`));
+  if (approval.reply_approval?.external_delivery !== false) blocked.push('reply approval external_delivery must be false');
+  if (approval.reply_approval?.send_allowed !== false) blocked.push('reply approval send_allowed must be false');
+  return {
+    mode: 'reply-outbox',
+    ok: blocked.length === 0,
+    state_present: fs.existsSync(workflowPath(root)),
+    reply_outbox: { writes: Boolean(persist), approval_file: String(approvalFile), approval_digest: fileDigest(approvalPath), target_adapter: approval.reply_approval?.target_adapter || 'local-disabled', send_allowed: false, external_delivery: false, created_at: new Date().toISOString() },
+    approval,
+    safety: { stage: 'Reply C', writes: Boolean(persist), outbox_artifact: Boolean(persist), platform_api: false, external_delivery: false, auto_reply: false, model_invocation: false, git: false, worktree: false, business_source_write: false, subagent: false, mcp: false },
+    quality: blocked,
+    action: persist ? 'local reply outbox item was written with send_allowed=false and external_delivery=false.' : 'reply outbox item was previewed. No files were written.',
+  };
+}
+
+function writeReplyOutbox(root, envelope) {
+  if (!envelope.ok) throw new Error(`reply outbox gate failed: ${envelope.quality.join('; ')}`);
+  return writeReplyArtifact(deps, root, replyOutboxDirectory, 'reply-outbox', envelope);
+}
+
+function replySendEnvelope(root, outboxFile, { persist = false } = {}) {
+  const outboxPath = replyOutboxFilePath(root, outboxFile);
+  const outbox = readJsonArtifact(outboxPath, 'Reply outbox');
+  const blocked = ['adapter send is disabled in this batch'];
+  const outboxVerification = validateReplyArtifact(root, outbox, outboxFile, outboxPath);
+  if (!outboxVerification.ok) blocked.push(...outboxVerification.failures.map((failure) => `reply outbox verification failed: ${failure}`));
+  if (outbox.reply_outbox?.send_allowed !== false) blocked.push('outbox send_allowed must be false');
+  if (outbox.reply_outbox?.external_delivery !== false) blocked.push('outbox external_delivery must be false');
+  return {
+    mode: 'reply-send-gate',
+    ok: false,
+    state_present: fs.existsSync(workflowPath(root)),
+    reply_send_run: { writes: Boolean(persist), outbox_file: String(outboxFile), outbox_digest: fileDigest(outboxPath), target_adapter: outbox.reply_outbox?.target_adapter || 'local-disabled', sent: false, send_allowed: false, external_delivery: false, blocked_reasons: blocked, created_at: new Date().toISOString() },
+    outbox,
+    safety: { stage: 'Reply D', writes: Boolean(persist), send_run_artifact: Boolean(persist), platform_api: false, external_delivery: false, sent: false, auto_reply: false, model_invocation: false, git: false, worktree: false, business_source_write: false, subagent: false, mcp: false },
+    quality: blocked,
+    action: persist ? 'reply send gate audit was written with sent=false. No platform API or external delivery occurred.' : 'reply send gate was previewed as blocked. No files were written and no message was sent.',
+  };
+}
+
+function writeReplySendRun(root, envelope) {
+  return writeReplyArtifact(deps, root, replySendRunsDirectory, 'reply-send-run', envelope);
+}
+
+function validateReplyReviewArtifact(root, artifact, review) {
+  const failures = [];
+  const digestPayload = { ...review };
+  delete digestPayload.writes;
+  delete digestPayload.review_digest;
+  if (review.review_digest !== digestObject(digestPayload)) failures.push('reply review digest mismatch');
+  if (review.review_outcome !== 'approved') failures.push('reply review outcome must be approved');
+  if (!Array.isArray(review.blocked_reasons) || review.blocked_reasons.length !== 0) failures.push('reply review blocked_reasons must be empty');
+  const boundary = review.boundary_assertions || {};
+  for (const key of ['send_allowed', 'external_delivery', 'model_invocation', 'platform_api', 'git', 'worktree', 'business_source_write', 'subagent', 'mcp']) {
+    if (boundary[key] !== false) failures.push(`reply review boundary ${key} must be false`);
+  }
+  if (artifact.safety?.stage !== 'Reply F') failures.push('reply review safety.stage must be Reply F');
+  if (artifact.safety?.external_delivery !== false) failures.push('reply review safety external_delivery must be false');
+  if (artifact.safety?.model_invocation !== false) failures.push('reply review safety model_invocation must be false');
+  if (review.draft_file) {
+    try {
+      const draftPath = replyDraftFilePath(root, review.draft_file);
+      if (fileDigest(draftPath) !== review.draft_digest) failures.push('reply review draft digest mismatch');
+      const draftArtifact = readJsonArtifact(draftPath, 'Reply draft');
+      const draftVerification = validateReplyArtifact(root, draftArtifact, review.draft_file, draftPath);
+      if (!draftVerification.ok) failures.push(...draftVerification.failures.map((failure) => `reply review draft verification failed: ${failure}`));
+      if (!isReplySourceBoundArtifact(draftArtifact)) failures.push('reply review draft must be source-bound');
+      if ((draftArtifact.reply_draft?.source_manifest?.source_digest || '') !== review.source_manifest_digest) failures.push('reply review source manifest digest mismatch');
+    } catch (error) {
+      failures.push(error.message);
+    }
+  } else {
+    failures.push('reply review draft_file is required');
+  }
+  return failures;
+}
+
+function validateReplyArtifact(root, artifact, fileName, filePath) {
+  const failures = [];
+  if (artifact.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+  if (artifact.command !== 'reply') failures.push('command must be reply');
+  const mode = artifact.mode || '';
+  if (fileName.endsWith('.reply-draft.json')) {
+    if (mode !== 'reply-draft') failures.push('mode must be reply-draft');
+    const draft = artifact.reply_draft || {};
+    const digestPayload = { ...draft };
+    delete digestPayload.writes;
+    delete digestPayload.policy_digest;
+    delete digestPayload.draft_digest;
+    if (draft.draft_digest !== digestObject(digestPayload)) failures.push('reply draft digest mismatch');
+    if (draft.policy_digest !== replyPolicySnapshot().reply_policy_digest) failures.push('reply draft policy digest mismatch');
+    if (draft.external_delivery !== false) failures.push('reply draft external_delivery must be false');
+    if (draft.send_allowed !== false) failures.push('reply draft send_allowed must be false');
+    if (draft.model_invocation !== false) failures.push('reply draft model_invocation must be false');
+    if (isReplySourceBoundArtifact(artifact)) failures.push(...validateReplySourceManifest(deps, root, draft.source_manifest));
+  } else if (fileName.endsWith('.reply-review.json')) {
+    if (mode !== 'reply-review') failures.push('mode must be reply-review');
+    failures.push(...validateReplyReviewArtifact(root, artifact, artifact.reply_review || {}));
+  } else if (fileName.endsWith('.reply-approval.json')) {
+    if (mode !== 'reply-approval') failures.push('mode must be reply-approval');
+    const approval = artifact.reply_approval || {};
+    if (approval.policy_digest !== replyPolicySnapshot().reply_policy_digest) failures.push('reply approval policy digest mismatch');
+    if (approval.external_delivery !== false) failures.push('reply approval external_delivery must be false');
+    if (approval.send_allowed !== false) failures.push('reply approval send_allowed must be false');
+    if (approval.approved !== true) failures.push('reply approval approved must be true');
+    if (approval.draft_file) {
+      try {
+        const draftPath = replyDraftFilePath(root, approval.draft_file);
+        if (fileDigest(draftPath) !== approval.draft_digest) failures.push('reply approval draft digest mismatch');
+        const draftArtifact = readJsonArtifact(draftPath, 'Reply draft');
+        const draftVerification = validateReplyArtifact(root, draftArtifact, approval.draft_file, draftPath);
+        if (!draftVerification.ok) failures.push(...draftVerification.failures.map((failure) => `reply approval draft verification failed: ${failure}`));
+        if (isReplySourceBoundArtifact(draftArtifact)) {
+          if (!approval.review_file) failures.push('reply approval review_file is required for source-bound draft');
+          if (!approval.review_digest) failures.push('reply approval review_digest is required for source-bound draft');
+          if (approval.review_file) {
+            const reviewPath = replyReviewFilePath(root, approval.review_file);
+            if (fileDigest(reviewPath) !== approval.review_digest) failures.push('reply approval review digest mismatch');
+            const reviewArtifact = readJsonArtifact(reviewPath, 'Reply review');
+            const reviewVerification = validateReplyArtifact(root, reviewArtifact, approval.review_file, reviewPath);
+            if (!reviewVerification.ok) failures.push(...reviewVerification.failures.map((failure) => `reply approval review verification failed: ${failure}`));
+            if (reviewArtifact.reply_review?.draft_file !== approval.draft_file) failures.push('reply approval review draft_file mismatch');
+            if (reviewArtifact.reply_review?.draft_digest !== approval.draft_digest) failures.push('reply approval review draft_digest mismatch');
+          }
+        }
+      } catch (error) {
+        failures.push(error.message);
+      }
+    } else {
+      failures.push('reply approval draft_file is required');
+    }
+  } else if (fileName.endsWith('.reply-outbox.json')) {
+    if (mode !== 'reply-outbox') failures.push('mode must be reply-outbox');
+    const outbox = artifact.reply_outbox || {};
+    if (outbox.external_delivery !== false) failures.push('reply outbox external_delivery must be false');
+    if (outbox.send_allowed !== false) failures.push('reply outbox send_allowed must be false');
+    if (outbox.approval_file) {
+      try {
+        const approvalPath = replyApprovalFilePath(root, outbox.approval_file);
+        if (fileDigest(approvalPath) !== outbox.approval_digest) failures.push('reply outbox approval digest mismatch');
+        const approvalArtifact = readJsonArtifact(approvalPath, 'Reply approval');
+        const approvalVerification = validateReplyArtifact(root, approvalArtifact, outbox.approval_file, approvalPath);
+        if (!approvalVerification.ok) failures.push(...approvalVerification.failures.map((failure) => `reply outbox approval verification failed: ${failure}`));
+      } catch (error) {
+        failures.push(error.message);
+      }
+    } else {
+      failures.push('reply outbox approval_file is required');
+    }
+  } else if (fileName.endsWith('.reply-send-run.json')) {
+    if (mode !== 'reply-send-gate') failures.push('mode must be reply-send-gate');
+    const sendRun = artifact.reply_send_run || {};
+    if (sendRun.sent !== false) failures.push('reply send sent must be false');
+    if (sendRun.external_delivery !== false) failures.push('reply send external_delivery must be false');
+    if (sendRun.send_allowed !== false) failures.push('reply send send_allowed must be false');
+    if (sendRun.outbox_file) {
+      try {
+        const outboxPath = replyOutboxFilePath(root, sendRun.outbox_file);
+        if (fileDigest(outboxPath) !== sendRun.outbox_digest) failures.push('reply send outbox digest mismatch');
+        const outboxArtifact = readJsonArtifact(outboxPath, 'Reply outbox');
+        const outboxVerification = validateReplyArtifact(root, outboxArtifact, sendRun.outbox_file, outboxPath);
+        if (!outboxVerification.ok) failures.push(...outboxVerification.failures.map((failure) => `reply send outbox verification failed: ${failure}`));
+      } catch (error) {
+        failures.push(error.message);
+      }
+    } else {
+      failures.push('reply send outbox_file is required');
+    }
+  } else {
+    failures.push('reply artifact extension is not recognized');
+  }
+  if (filePath && !fs.existsSync(filePath)) failures.push('reply artifact file is missing');
+  return { ok: failures.length === 0, failures };
+}
+
+function replyAuditEnvelope(root, mode, fileName = '') {
+  const groups = [
+    ['drafts', listReplyDraftFiles(root)],
+    ['reviews', listReplyReviewFiles(root)],
+    ['approvals', listReplyApprovalFiles(root)],
+    ['outbox', listReplyOutboxFiles(root)],
+    ['send_runs', listReplySendRunFiles(root)],
+  ];
+  if (mode === 'list') return { mode: 'reply-list', ok: true, summary: Object.fromEntries(groups.map(([key, files]) => [key, files.length])), quality: [], action: 'read-only reply audit listed local reply artifacts. No message was sent.' };
+  const pick = fileName.endsWith('.reply-draft.json') ? ['Reply draft', replyDraftFilePath(root, fileName)]
+    : fileName.endsWith('.reply-review.json') ? ['Reply review', replyReviewFilePath(root, fileName)]
+      : fileName.endsWith('.reply-approval.json') ? ['Reply approval', replyApprovalFilePath(root, fileName)]
+        : fileName.endsWith('.reply-outbox.json') ? ['Reply outbox', replyOutboxFilePath(root, fileName)]
+          : ['Reply send run', replySendRunFilePath(root, fileName)];
+  const artifact = readJsonArtifact(pick[1], pick[0]);
+  const verification = validateReplyArtifact(root, artifact, fileName, pick[1]);
+  if (mode === 'verify' && !verification.ok) throw new Error(`reply artifact verification failed: ${verification.failures.join('; ')}`);
+  return { mode: mode === 'verify' ? 'reply-verify' : 'reply-show', ok: verification.ok, summary: { file: fileName, artifact_mode: artifact.mode || '' }, verification, artifact, quality: verification.failures, action: 'read-only reply audit inspected one local reply artifact. No message was sent.' };
+}
+
+function printReply(envelope, file = '') {
+  console.log('Vibecoding Runtime Reply Pipeline');
+  console.log(`Mode: ${envelope.mode}`);
+  if (file) console.log(`Reply artifact: ${path.relative(process.cwd(), file)}`);
+  if (envelope.quality?.length > 0) printList('Blocked reasons', envelope.quality);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function printReplyAudit(envelope) {
+  console.log('Vibecoding Runtime Reply Audit');
+  console.log(`Mode: ${envelope.mode.replace('reply-', '')}`);
+  if (envelope.mode === 'reply-list') console.log(`Drafts: ${envelope.summary.drafts}; Reviews: ${envelope.summary.reviews}; Approvals: ${envelope.summary.approvals}; Outbox: ${envelope.summary.outbox}; Send runs: ${envelope.summary.send_runs}`);
+  else console.log(`File: ${envelope.summary.file}; Artifact mode: ${envelope.summary.artifact_mode}`);
+  console.log(`Action: ${envelope.action}`);
+}
+
+function runReply(options) {
+  if (options.write || options.dryRun || options.scan || options.once || options.fromDispatch || options.dispatchEvent || options.run || options.autoRun) throw new Error('reply supports local draft, approval, outbox, send-gate, and audit only');
+  if (options.replySourceBound && !options.replyDraft) throw new Error('reply --source-bound is only supported with --draft');
+  ensureRoot(options.root);
+  const modes = [options.replyDraft, options.replyReview, options.replyApprove, options.replyOutbox, options.replySend, options.replyList, options.replyShow, options.replyVerify].filter(Boolean);
+  if (modes.length !== 1) throw new Error('reply requires exactly one local pipeline or audit mode');
+  if (options.replyDraft) {
+    const envelope = replyDraftEnvelope(options.root, { persist: options.confirm, adapter: options.replyAdapter, sourceBound: options.replySourceBound });
+    if (options.confirm) {
+      const file = writeReplyDraft(options.root, envelope);
+      if (options.json) writeJsonEnvelope('reply', { ...envelope, reply_draft_file: path.basename(file) });
+      else printReply(envelope, file);
+      return;
+    }
+    if (options.json) writeJsonEnvelope('reply', envelope);
+    else printReply(envelope);
+    return;
+  }
+  if (options.replyReview) {
+    const envelope = replyReviewEnvelope(options.root, options.replyFile, { persist: options.confirm, actor: options.actor || 'runtime' });
+    if (options.confirm) {
+      const file = writeReplyReview(options.root, envelope);
+      if (options.json) writeJsonEnvelope('reply', { ...envelope, reply_review_file: path.basename(file) });
+      else printReply(envelope, file);
+      return;
+    }
+    if (options.json) writeJsonEnvelope('reply', envelope);
+    else printReply(envelope);
+    return;
+  }
+  if (options.replyApprove) {
+    const envelope = replyApprovalEnvelope(options.root, options.replyFile, { persist: options.confirm, actor: options.actor || 'runtime', adapter: options.replyAdapter });
+    if (options.confirm) {
+      const file = writeReplyApproval(options.root, envelope);
+      if (options.json) writeJsonEnvelope('reply', { ...envelope, reply_approval_file: path.basename(file) });
+      else printReply(envelope, file);
+      return;
+    }
+    if (options.json) writeJsonEnvelope('reply', envelope);
+    else printReply(envelope);
+    return;
+  }
+  if (options.replyOutbox) {
+    const envelope = replyOutboxEnvelope(options.root, options.replyFile, { persist: options.confirm });
+    if (options.confirm) {
+      const file = writeReplyOutbox(options.root, envelope);
+      if (options.json) writeJsonEnvelope('reply', { ...envelope, reply_outbox_file: path.basename(file) });
+      else printReply(envelope, file);
+      return;
+    }
+    if (options.json) writeJsonEnvelope('reply', envelope);
+    else printReply(envelope);
+    return;
+  }
+  if (options.replySend) {
+    const envelope = replySendEnvelope(options.root, options.replyFile, { persist: options.confirm });
+    if (options.confirm) {
+      const file = writeReplySendRun(options.root, envelope);
+      if (options.json) writeJsonEnvelope('reply', { ...envelope, reply_send_run_file: path.basename(file) });
+      else printReply(envelope, file);
+      return;
+    }
+    if (options.json) writeJsonEnvelope('reply', envelope);
+    else printReply(envelope);
+    return;
+  }
+  if (options.confirm) throw new Error('reply audit does not support --confirm');
+  const mode = options.replyList ? 'list' : options.replyVerify ? 'verify' : 'show';
+  const envelope = replyAuditEnvelope(options.root, mode, options.replyFile);
+  if (options.json) writeJsonEnvelope('reply', envelope);
+  else printReplyAudit(envelope);
+}
+
+  return { validateReplyArtifact, runReply };
+}