@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-control-plane-release-gates.mjs

@@ -0,0 +1,369 @@
+export function createRuntimeControlPlaneReleaseGates(deps) {
+  const {
+    fs,
+    path,
+    jsonSchemaVersion,
+    stateDirectoryName,
+    evalReportsDirectoryName,
+    releaseGatesDirectoryName,
+    ensureRoot,
+    workflowPath,
+    evalReportsDirectory,
+    evalReportFilePath,
+    evalRunFilePath,
+    releaseGateSnapshotPath,
+    releaseGateFilePath,
+    readJsonArtifact,
+    validateEvalArtifact,
+    fileDigest,
+    digestObject,
+    runtimePolicyCatalogDigest,
+    evalCatalogDefinition,
+    governanceConvergenceEnvelope,
+    validateRuntimePolicyCatalogDigest,
+    validateCommonArtifactSafety,
+    writeStateArtifact,
+  } = deps;
+function releaseRequiredEvalSuites() {
+  return [
+    { suite_id: 'contract-core', eval_kind: 'contract', evidence_required: ['artifact-contract'], behavior_substitute: false },
+    { suite_id: 'scenario-routing', eval_kind: 'scenario', evidence_required: ['transcript-behavioral-judge'], behavior_substitute: false },
+    { suite_id: 'behavior-workflow', eval_kind: 'behavior', evidence_required: ['sandbox-replay-judge'], behavior_substitute: true },
+    { suite_id: 'adversarial-guardrails', eval_kind: 'adversarial', evidence_required: ['transcript-behavioral-judge'], behavior_substitute: false },
+  ];
+}
+
+function releaseSafety({ writes = false, artifact = false } = {}) {
+  return {
+    stage: 'Stage 52',
+    writes: Boolean(writes),
+    release_gate_artifact: Boolean(artifact),
+    dispatch: false,
+    session_create: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    runtime_action: false,
+    auto_execution: false,
+    controlled_auto_execution: false,
+    skill_execution: false,
+    business_source_write: false,
+    source_merge: false,
+    pr: false,
+    push: false,
+    merge: false,
+    subagent_dispatch: false,
+    subagent: false,
+    mcp: false,
+    daemon: false,
+    git: false,
+    worktree: false,
+    dispatch_event_modified: false,
+    claim_modified: false,
+  };
+}
+
+function validateStage52Safety(safety, artifactKey) {
+  const failures = validateCommonArtifactSafety(safety, 'Stage 52');
+  if (safety?.[artifactKey] !== true) failures.push(`safety.${artifactKey} must be true`);
+  for (const key of ['dispatch', 'session_create', 'platform_api', 'external_network', 'model_invocation', 'runtime_action', 'source_merge', 'pr', 'push', 'merge', 'subagent_dispatch']) {
+    if (safety?.[key] !== false) failures.push(`safety.${key} must be false`);
+  }
+  return failures;
+}
+
+function releaseEvalReportPath(root, reportFile) {
+  const raw = String(reportFile || '').trim();
+  if (!raw) throw new Error('Release eval report file is required');
+  const expectedDirectory = path.resolve(evalReportsDirectory(root));
+  const resolveInsideEvalReports = (candidate) => {
+    const resolved = path.resolve(candidate);
+    const relative = path.relative(expectedDirectory, resolved);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('Release eval report file must be inside the eval reports state directory');
+    if (!path.basename(resolved).endsWith('.eval-report.json')) throw new Error('Release eval report file must be an .eval-report.json file');
+    return resolved;
+  };
+  if (path.isAbsolute(raw)) return resolveInsideEvalReports(raw);
+  if (raw.includes('/') || raw.includes('\\')) return resolveInsideEvalReports(path.resolve(root, raw));
+  return evalReportFilePath(root, raw);
+}
+
+function summarizeReleaseReportEvidence(root, reportFile) {
+  const file = releaseEvalReportPath(root, reportFile);
+  const artifact = readJsonArtifact(file, 'Eval report');
+  const verification = validateEvalArtifact(root, artifact, path.basename(file));
+  const report = artifact.eval_report || {};
+  const runFile = report.run_file || '';
+  const runPath = runFile ? evalRunFilePath(root, runFile) : '';
+  const runArtifact = runPath ? readJsonArtifact(runPath, 'Eval run') : null;
+  const runVerification = runArtifact ? validateEvalArtifact(root, runArtifact, path.basename(runPath)) : { ok: false, failures: ['eval report run file is missing'] };
+  const run = runArtifact?.eval_run || {};
+  const caseResults = Array.isArray(run.case_results) ? run.case_results : [];
+  const evidence = {
+    transcript_behavioral_judge_count: caseResults.filter((result) => result.transcript_judge?.judge_type === 'transcript-behavioral-judge' && result.transcript_judge?.deterministic === true).length,
+    sandbox_replay_judge_count: caseResults.filter((result) => result.transcript_judge?.judge_type === 'sandbox-replay-judge' && result.replay_trace?.trace_type === 'sandbox-replay').length,
+    sandbox_replay_trace_count: caseResults.filter((result) => result.replay_trace?.trace_type === 'sandbox-replay').length,
+    artifact_contract_count: caseResults.filter((result) => !result.transcript_judge && !result.replay_trace).length,
+    all_cases_passed: caseResults.length > 0 && caseResults.every((result) => result.passed === true),
+  };
+  return {
+    file: path.basename(file),
+    state_path: `${stateDirectoryName}/${evalReportsDirectoryName}/${path.basename(file)}`,
+    file_digest: fileDigest(file),
+    report_digest: report.report_digest || '',
+    run_file: runFile,
+    run_file_digest: runPath ? fileDigest(runPath) : '',
+    run_artifact_digest: run.run_digest || '',
+    suite_id: report.suite_id || '',
+    eval_kind: report.eval_kind || '',
+    outcome: report.outcome || '',
+    report_status: report.report_status || '',
+    failing_case_ids: report.failing_case_ids || [],
+    report_allowed_followup: report.allowed_followup || [],
+    report_safety: {
+      dispatch: report.dispatch,
+      session_create: report.session_create,
+      platform_api: report.platform_api,
+      business_source_write: report.business_source_write,
+      source_merge: report.source_merge,
+      git: report.git,
+      worktree: report.worktree,
+    },
+    verification_ok: verification.ok,
+    verification_failures: verification.failures,
+    run_verification_ok: runVerification.ok,
+    run_verification_failures: runVerification.failures,
+    evidence,
+  };
+}
+
+function releaseGateBlockedReasons(sources) {
+  const blocked = [];
+  const requiredSuites = releaseRequiredEvalSuites();
+  for (const source of sources) {
+    if (!source.verification_ok) blocked.push(...source.verification_failures.map((failure) => `${source.file}: ${failure}`));
+    if (!source.run_verification_ok) blocked.push(...source.run_verification_failures.map((failure) => `${source.file}: eval run: ${failure}`));
+    if (source.report_status !== 'behavioral-eval-completed') blocked.push(`${source.file}: report_status must be behavioral-eval-completed`);
+    if (source.outcome !== 'passed') blocked.push(`${source.file}: outcome must be passed`);
+    if (!source.evidence.all_cases_passed) blocked.push(`${source.file}: every eval case must pass`);
+    if (Array.isArray(source.report_allowed_followup) && source.report_allowed_followup.length !== 0) blocked.push(`${source.file}: eval report allowed_followup must be empty`);
+    for (const [key, value] of Object.entries(source.report_safety || {})) if (value !== false) blocked.push(`${source.file}: eval report ${key} must be false`);
+  }
+  for (const required of requiredSuites) {
+    const matches = sources.filter((source) => source.suite_id === required.suite_id && source.eval_kind === required.eval_kind);
+    if (matches.length === 0) {
+      blocked.push(`required eval suite missing: ${required.suite_id}`);
+      continue;
+    }
+    if (matches.length > 1) blocked.push(`required eval suite duplicated: ${required.suite_id}`);
+    const source = matches[0];
+    if (required.evidence_required.includes('transcript-behavioral-judge') && source.evidence.transcript_behavioral_judge_count < 1) blocked.push(`${required.suite_id}: transcript behavioral judge evidence is required`);
+    if (required.evidence_required.includes('sandbox-replay-judge') && source.evidence.sandbox_replay_judge_count < 1) blocked.push(`${required.suite_id}: sandbox replay judge evidence is required`);
+    if (required.evidence_required.includes('artifact-contract') && source.evidence.artifact_contract_count < 1) blocked.push(`${required.suite_id}: artifact contract evidence is required`);
+  }
+  const contract = sources.find((source) => source.suite_id === 'contract-core');
+  const behavior = sources.find((source) => source.suite_id === 'behavior-workflow');
+  if (contract && behavior && behavior.evidence.sandbox_replay_judge_count < 1) blocked.push('artifact contract pass does not satisfy behavior workflow without sandbox replay judge evidence');
+  return [...new Set(blocked)];
+}
+
+function releaseConvergenceEvidence(root) {
+  const envelope = governanceConvergenceEnvelope(root);
+  const convergence = envelope.convergence || {};
+  const dimensions = (convergence.dimensions || []).map((dimension) => ({
+    id: dimension.id,
+    status: dimension.status,
+    target_stage: dimension.target_stage,
+  }));
+  const evidence = {
+    evidence_kind: 'governance-convergence-report',
+    stage: 'Stage 65',
+    report_stage: convergence.stage,
+    report_kind: convergence.report_kind,
+    optional: true,
+    release_chain_required: false,
+    writes: false,
+    state_directory_created: false,
+    convergence_target: convergence.convergence_target,
+    convergence_digest: convergence.convergence_digest,
+    summary: convergence.summary || {},
+    dimensions,
+    boundary_assertions_digest: digestObject(convergence.boundary_assertions || {}),
+  };
+  return { ...evidence, evidence_digest: digestObject(evidence) };
+}
+
+function buildReleaseGateEnvelope(root, reportFiles, { persist = false, artifactFile = '', withConvergence = false } = {}) {
+  ensureRoot(root);
+  const uniqueReportFiles = [...new Set(reportFiles.map((file) => String(file || '').trim()).filter(Boolean))];
+  if (uniqueReportFiles.length === 0) throw new Error('release --gate requires at least one --from-evals eval report file');
+  const sources = uniqueReportFiles.map((file) => summarizeReleaseReportEvidence(root, file));
+  const requiredSuites = releaseRequiredEvalSuites();
+  const blockedReasons = releaseGateBlockedReasons(sources);
+  const coveredSuites = sources.map((source) => ({ suite_id: source.suite_id, eval_kind: source.eval_kind, file: source.file, report_digest: source.report_digest })).sort((left, right) => left.suite_id.localeCompare(right.suite_id));
+  const gateFile = artifactFile || (persist ? path.basename(releaseGateSnapshotPath(root)) : 'preview.release-gate.json');
+  const convergenceEvidence = withConvergence ? releaseConvergenceEvidence(root) : null;
+  const core = {
+    version: 1,
+    stage: 'Stage 52',
+    created_at: new Date().toISOString(),
+    writes: Boolean(persist),
+    promotion_kind: 'eval-backed-promotion',
+    gate_status: blockedReasons.length === 0 ? 'passed' : 'blocked',
+    required_suites: requiredSuites,
+    covered_suites: coveredSuites,
+    sources,
+    policy_catalog_digest: runtimePolicyCatalogDigest(),
+    evidence: {
+      eval_catalog_digest: evalCatalogDefinition().catalog_digest,
+      required_suites_digest: digestObject(requiredSuites),
+      sources_digest: digestObject(sources.map((source) => ({ file: source.file, file_digest: source.file_digest, report_digest: source.report_digest, run_file_digest: source.run_file_digest }))),
+      artifact_contract_pass_does_not_imply_behavior_pass: true,
+      convergence_evidence_bound: Boolean(convergenceEvidence),
+      convergence_evidence_digest: convergenceEvidence?.evidence_digest || '',
+      sidecar_only: true,
+    },
+    convergence_evidence: convergenceEvidence,
+    blocked_reasons: blockedReasons,
+    allowed_followup: [],
+    dispatch: false,
+    session_create: false,
+    platform_api: false,
+    external_network: false,
+    model_invocation: false,
+    runtime_action: false,
+    business_source_write: false,
+    source_merge: false,
+    pr: false,
+    push: false,
+    merge: false,
+    git: false,
+    worktree: false,
+    planned_writes: persist ? [path.join(stateDirectoryName, releaseGatesDirectoryName, '<timestamp>.release-gate.json').replace(/\\/g, '/')] : [],
+  };
+  return {
+    mode: 'release-gate',
+    ok: blockedReasons.length === 0,
+    state_present: fs.existsSync(workflowPath(root)),
+    release_gate: { ...core, gate_digest: digestObject(core) },
+    files: { release_gate: gateFile },
+    safety: releaseSafety({ writes: persist, artifact: persist }),
+    quality: blockedReasons,
+    action: persist
+      ? `release gate artifact was written locally from verified eval reports${convergenceEvidence ? ' and optional convergence evidence' : ''}. No git, PR, push, merge, platform API, model invocation, or business source write occurred.`
+      : `release gate was previewed read-only from eval reports${convergenceEvidence ? ' and optional convergence evidence' : ''}. No files were written and no runtime action occurred.`,
+  };
+}
+
+function validateReleaseGateArtifact(root, artifact, fileName = '') {
+  const failures = [];
+  if (artifact.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+  if (artifact.command !== 'release') failures.push('command must be release');
+  if (artifact.mode !== 'release-gate') failures.push('mode must be release-gate');
+  if (artifact.ok !== true) failures.push('release gate artifact ok must be true');
+  if (fileName && artifact.files?.release_gate !== fileName) failures.push('Stage 52 release gate file identity mismatch');
+  failures.push(...validateStage52Safety(artifact.safety, 'release_gate_artifact'));
+  if (artifact.safety?.writes !== true) failures.push('safety.writes must be true');
+
+  const gate = artifact.release_gate || {};
+  if (gate.version !== 1) failures.push('release_gate.version must be 1');
+  if (gate.stage !== 'Stage 52') failures.push('release_gate.stage must be Stage 52');
+  if (gate.writes !== true) failures.push('release_gate.writes must be true');
+  if (gate.promotion_kind !== 'eval-backed-promotion') failures.push('release_gate.promotion_kind must be eval-backed-promotion');
+  if (gate.gate_status !== 'passed') failures.push('release_gate.gate_status must be passed');
+  if (!Array.isArray(gate.blocked_reasons) || gate.blocked_reasons.length !== 0) failures.push('release_gate.blocked_reasons must be empty');
+  if (!Array.isArray(gate.allowed_followup) || digestObject(gate.allowed_followup) !== digestObject([])) failures.push('release_gate.allowed_followup must be empty');
+  failures.push(...validateRuntimePolicyCatalogDigest(gate.policy_catalog_digest, 'release_gate'));
+  const requiredSuites = releaseRequiredEvalSuites();
+  if (digestObject(gate.required_suites || []) !== digestObject(requiredSuites)) failures.push('release_gate required suites digest mismatch');
+  if (gate.evidence?.eval_catalog_digest !== evalCatalogDefinition().catalog_digest) failures.push('release_gate eval catalog digest mismatch');
+  if (gate.evidence?.required_suites_digest !== digestObject(requiredSuites)) failures.push('release_gate required suites evidence digest mismatch');
+  if (gate.evidence?.artifact_contract_pass_does_not_imply_behavior_pass !== true) failures.push('release_gate must preserve artifact contract versus behavior boundary');
+  if (gate.evidence?.convergence_evidence_bound === true) {
+    const convergenceEvidence = gate.convergence_evidence;
+    if (!convergenceEvidence || typeof convergenceEvidence !== 'object') failures.push('release_gate convergence evidence missing');
+    else {
+      if (convergenceEvidence.evidence_kind !== 'governance-convergence-report') failures.push('release_gate convergence evidence kind mismatch');
+      if (convergenceEvidence.stage !== 'Stage 65') failures.push('release_gate convergence evidence stage must be Stage 65');
+      if (convergenceEvidence.optional !== true) failures.push('release_gate convergence evidence must be optional');
+      if (convergenceEvidence.release_chain_required !== false) failures.push('release_gate convergence evidence must not be release-chain required');
+      if (convergenceEvidence.writes !== false) failures.push('release_gate convergence evidence writes must be false');
+      if (convergenceEvidence.state_directory_created !== false) failures.push('release_gate convergence evidence state_directory_created must be false');
+      const evidenceDigestPayload = { ...convergenceEvidence };
+      delete evidenceDigestPayload.evidence_digest;
+      if (convergenceEvidence.evidence_digest !== digestObject(evidenceDigestPayload)) failures.push('release_gate convergence evidence digest mismatch');
+      if (gate.evidence?.convergence_evidence_digest !== convergenceEvidence.evidence_digest) failures.push('release_gate convergence evidence binding digest mismatch');
+    }
+  } else if (gate.evidence?.convergence_evidence_bound === false && gate.evidence?.convergence_evidence_digest) {
+    failures.push('release_gate convergence evidence digest must be empty when not bound');
+  }
+  for (const key of ['dispatch', 'session_create', 'platform_api', 'external_network', 'model_invocation', 'runtime_action', 'business_source_write', 'source_merge', 'pr', 'push', 'merge', 'git', 'worktree']) if (gate[key] !== false) failures.push(`release_gate.${key} must be false`);
+  if (!Array.isArray(gate.planned_writes)) failures.push('release_gate.planned_writes must be an array');
+  else if (digestObject(gate.planned_writes) !== digestObject([path.join(stateDirectoryName, releaseGatesDirectoryName, '<timestamp>.release-gate.json').replace(/\\/g, '/')])) failures.push('release_gate.planned_writes must only contain release gate artifact');
+
+  const digestPayload = { ...gate };
+  delete digestPayload.gate_digest;
+  if (gate.gate_digest !== digestObject(digestPayload)) failures.push('release_gate digest mismatch');
+
+  if (root) {
+    try {
+      const rebuilt = buildReleaseGateEnvelope(root, (gate.sources || []).map((source) => source.file), { persist: true, artifactFile: artifact.files?.release_gate || path.basename(releaseGateSnapshotPath(root)), withConvergence: gate.evidence?.convergence_evidence_bound === true });
+      if (rebuilt.ok !== true) failures.push(...rebuilt.quality.map((failure) => `release gate source: ${failure}`));
+      const currentSourcesDigest = digestObject((gate.sources || []).map((source) => ({ file: source.file, file_digest: source.file_digest, report_digest: source.report_digest, run_file_digest: source.run_file_digest })));
+      if (gate.evidence?.sources_digest !== currentSourcesDigest) failures.push('release_gate sources evidence digest mismatch');
+      if (gate.evidence?.convergence_evidence_bound === true) {
+        const currentConvergenceEvidence = releaseConvergenceEvidence(root);
+        if (gate.convergence_evidence?.convergence_digest !== currentConvergenceEvidence.convergence_digest) failures.push('release_gate convergence report digest drift');
+        if (gate.convergence_evidence?.evidence_digest !== currentConvergenceEvidence.evidence_digest) failures.push('release_gate convergence evidence digest drift');
+      }
+      for (const source of gate.sources || []) {
+        const current = rebuilt.release_gate.sources.find((item) => item.file === source.file);
+        if (!current) failures.push(`release_gate source missing: ${source.file}`);
+        else {
+          if (current.file_digest !== source.file_digest) failures.push(`${source.file}: eval report digest drift`);
+          if (current.report_digest !== source.report_digest) failures.push(`${source.file}: eval report artifact digest drift`);
+          if (current.run_file_digest !== source.run_file_digest) failures.push(`${source.file}: eval run digest drift`);
+          if (current.run_artifact_digest !== source.run_artifact_digest) failures.push(`${source.file}: eval run artifact digest drift`);
+        }
+      }
+    } catch (error) {
+      failures.push(error.message);
+    }
+  }
+
+  return { ok: failures.length === 0, failures };
+}
+
+function writeReleaseGateArtifact(root, envelope) {
+  const file = releaseGateFilePath(root, envelope.files?.release_gate || path.basename(releaseGateSnapshotPath(root)));
+  const payload = { schema_version: jsonSchemaVersion, command: 'release', ...envelope, safety: { ...envelope.safety, release_gate_artifact: true } };
+  const verification = validateReleaseGateArtifact(root, payload, path.basename(file));
+  if (!verification.ok) throw new Error(`release gate verification failed: ${verification.failures.join('; ')}`);
+  return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+}
+
+function releaseGateAuditEnvelope(root, gateFile) {
+  const file = releaseGateFilePath(root, gateFile);
+  const artifact = readJsonArtifact(file, 'Release gate');
+  const verification = validateReleaseGateArtifact(root, artifact, path.basename(file));
+  if (!verification.ok) throw new Error(`release gate verification failed: ${verification.failures.join('; ')}`);
+  return {
+    mode: 'release-gate-verify',
+    ok: verification.ok,
+    summary: { file: path.basename(file), gate_status: artifact.release_gate?.gate_status || '', source_count: artifact.release_gate?.sources?.length || 0 },
+    verification,
+    release_gate: artifact.release_gate,
+    artifact,
+    quality: verification.failures,
+    action: 'read-only release gate audit inspected one local release gate artifact. No git, PR, push, merge, platform API, model invocation, or business source write occurred.',
+  };
+}
+
+  return {
+    releaseRequiredEvalSuites,
+    buildReleaseGateEnvelope,
+    validateReleaseGateArtifact,
+    writeReleaseGateArtifact,
+    releaseGateAuditEnvelope,
+  };
+}

package/tools/vibe-runtime/runtime-control-plane-router-planning-model.mjs

@@ -0,0 +1,152 @@
+export function createRuntimeControlPlaneRouterPlanningModel({ platformCapabilityCatalog }) {
+  function routerAgentProfileForBriefKind(kind) {
+    if (kind === 'verification') return 'verification';
+    if (kind === 'review') return 'review';
+    if (kind === 'debug') return 'debug';
+    if (kind === 'docs') return 'docs';
+    return 'implementation';
+  }
+
+  function routerPlatformOrderForBriefKind(kind) {
+    if (kind === 'verification' || kind === 'review') return ['claude', 'cursor', 'codex', 'local/manual'];
+    if (kind === 'debug') return ['codex', 'cursor', 'claude', 'local/manual'];
+    if (kind === 'docs') return ['local/manual', 'cursor', 'claude', 'codex'];
+    return ['cursor', 'claude', 'codex', 'local/manual'];
+  }
+
+  function routerRankingsForBriefItem(item) {
+    const catalog = platformCapabilityCatalog();
+    const order = routerPlatformOrderForBriefKind(item.brief_kind);
+    return {
+      task_id: item.task_id,
+      rankings: order.map((platform, index) => {
+        if (platform === 'local/manual') {
+          return {
+            platform,
+            rank: index + 1,
+            score: 100 - index * 10,
+            adapter: 'local-manual-handoff',
+            session_strategy: 'local-only',
+            reason: `${item.brief_kind} can always fall back to local/manual execution`,
+          };
+        }
+        const adapter = catalog.adapters.find((entry) => entry.platform === platform) || {};
+        return {
+          platform,
+          rank: index + 1,
+          score: 100 - index * 10,
+          adapter: adapter.adapter || 'local-contract-only',
+          session_strategy: 'platform-session',
+          reason: `${item.brief_kind} deterministic ranking from builtin Stage 41 capability catalog`,
+        };
+      }),
+    };
+  }
+
+  function routerFallbackRoutesForBriefItem(item) {
+    return [
+      { task_id: item.task_id, when: 'platform-unavailable', route: 'local/manual' },
+      { task_id: item.task_id, when: 'brief-incomplete', route: 'planner-backfill' },
+      { task_id: item.task_id, when: 'risky-write', route: 'force-review-path' },
+    ];
+  }
+
+  function hasSharedFileScope(left = [], right = []) {
+    const leftSet = new Set((left || []).map((value) => String(value || '')));
+    return (right || []).some((value) => leftSet.has(String(value || '')));
+  }
+
+  function routerConcurrencyBudget(briefItems) {
+    const serialTaskIds = [];
+    const mutexTaskIds = new Set();
+    for (let index = 0; index < briefItems.length; index += 1) {
+      const current = briefItems[index];
+      if ((current.deps || []).length > 0) serialTaskIds.push(current.task_id);
+      for (let compareIndex = index + 1; compareIndex < briefItems.length; compareIndex += 1) {
+        const compare = briefItems[compareIndex];
+        if (hasSharedFileScope(current.file_scope, compare.file_scope)) {
+          mutexTaskIds.add(current.task_id);
+          mutexTaskIds.add(compare.task_id);
+        }
+      }
+    }
+    const maxParallelLanes = briefItems.length === 0 ? 0 : Math.max(1, Math.min(briefItems.length, briefItems.length - Math.max(0, mutexTaskIds.size - 1)));
+    return {
+      max_parallel_lanes: maxParallelLanes,
+      suggested_mode: mutexTaskIds.size > 0 || serialTaskIds.length > 0 ? 'bounded-parallel-with-mutex' : 'parallel-lanes-allowed',
+      mutex_task_ids: [...mutexTaskIds].sort(),
+      serial_task_ids: [...new Set(serialTaskIds)].sort(),
+      workspace_isolation_recommended: mutexTaskIds.size > 0,
+    };
+  }
+
+  function orchestratorBuildPlanFromRouterPlan(plan) {
+    const routes = Array.isArray(plan.brief_routes) ? plan.brief_routes : [];
+    const rankings = new Map((plan.platform_rankings || []).map((entry) => [entry.task_id, entry.rankings || []]));
+    const lanes = [];
+    const laneScopes = [];
+    for (const route of routes) {
+      let laneIndex = laneScopes.findIndex((scope) => !hasSharedFileScope(scope, route.file_scope || []) && (route.deps || []).length === 0);
+      if (laneIndex === -1) {
+        laneIndex = lanes.length;
+        lanes.push({
+          lane_id: `lane-${laneIndex + 1}`,
+          task_ids: [],
+          preferred_platforms: [],
+          agent_profiles: [],
+          session_strategy: [],
+          dispatch_mode: 'artifact-only',
+        });
+        laneScopes.push([]);
+      }
+      const ranked = rankings.get(route.task_id) || [];
+      lanes[laneIndex].task_ids.push(route.task_id);
+      lanes[laneIndex].preferred_platforms.push(ranked[0]?.platform || 'local/manual');
+      lanes[laneIndex].agent_profiles.push(route.preferred_agent_profile || 'implementation');
+      lanes[laneIndex].session_strategy.push(ranked[0]?.session_strategy || 'local-only');
+      laneScopes[laneIndex] = [...new Set([...laneScopes[laneIndex], ...(route.file_scope || [])])];
+    }
+    const mutexGroups = [];
+    for (let index = 0; index < routes.length; index += 1) {
+      for (let compareIndex = index + 1; compareIndex < routes.length; compareIndex += 1) {
+        if (hasSharedFileScope(routes[index].file_scope, routes[compareIndex].file_scope)) {
+          mutexGroups.push({
+            group_id: `mutex-${routes[index].task_id}-${routes[compareIndex].task_id}`,
+            task_ids: [routes[index].task_id, routes[compareIndex].task_id],
+            reason: 'shared file scope requires serialized dispatch',
+          });
+        }
+      }
+    }
+    const dispatchOrder = [...routes]
+      .sort((left, right) => (left.deps || []).length - (right.deps || []).length || left.task_id.localeCompare(right.task_id))
+      .map((route) => route.task_id);
+    const escalationRules = [
+      { when: 'brief-incomplete', action: 'return-to-planner' },
+      { when: 'platform-unavailable', action: 'manual-pickup' },
+      { when: 'risky-write', action: 'force-review-path' },
+    ];
+    const retryPolicyRefs = ['Stage 27 bounded retry preview only'];
+    const sessionStrategy = routes.map((route) => {
+      const ranked = rankings.get(route.task_id) || [];
+      const top = ranked[0] || { platform: 'local/manual', session_strategy: 'local-only' };
+      return {
+        task_id: route.task_id,
+        platform: top.platform,
+        strategy: top.session_strategy,
+        session_create_allowed: false,
+        platform_api_allowed: false,
+      };
+    });
+    return { lanes, dispatch_order: dispatchOrder, mutex_groups: mutexGroups, escalation_rules: escalationRules, retry_policy_refs: retryPolicyRefs, session_strategy: sessionStrategy };
+  }
+
+  return {
+    routerAgentProfileForBriefKind,
+    routerPlatformOrderForBriefKind,
+    routerRankingsForBriefItem,
+    routerFallbackRoutesForBriefItem,
+    routerConcurrencyBudget,
+    orchestratorBuildPlanFromRouterPlan,
+  };
+}