@juzser/blacksmith 0.1.0

package/factory/orchestrator/dist/queue.js

@@ -0,0 +1,263 @@
+import { execFileSync } from 'node:child_process';
+import { collectCommittedChanges } from './claims.js';
+import { certifyCommit, UNCOMMITTED_WORK_CODE } from './commit.js';
+import { SmithError } from './errors.js';
+import { runGit } from './git.js';
+import { topoSort } from './graph.js';
+import { buildSymbolGraph, collectSources } from './symbols.js';
+import { emitTaskBlocked, emitWaveMerged } from './taskEvents.js';
+import { renderSelectedTestCmd, selectTests } from './testSelect.js';
+import { integrationBranchName } from './worktree.js';
+export class QueueError extends SmithError {
+}
+/**
+ * Admission order for a serial merge queue: topological by dependency
+ * edges, tie-broken by task id. Does not select which tasks to run — only
+ * orders whatever set the caller passes in.
+ */
+export function admit(tasks, edges = []) {
+    const result = topoSort(tasks.map((t) => t.task_id), edges);
+    if (!result.ok) {
+        throw new QueueError('queue.cyclic-dependency', `Cannot admit tasks with a cyclic dependency: ${result.cycle.join(', ')}.`, { cycle: result.cycle });
+    }
+    return result.order;
+}
+const OUTPUT_TAIL_LINES = 50;
+function tailLines(text, n) {
+    const lines = text.split('\n');
+    return lines.slice(Math.max(0, lines.length - n)).join('\n');
+}
+function conflictingFiles(worktreeDir) {
+    const out = runGit(worktreeDir, ['diff', '--name-only', '--diff-filter=U']);
+    return out
+        .split('\n')
+        .map((f) => f.trim())
+        .filter((f) => f.length > 0);
+}
+/**
+ * Serial merge-queue admission step for one task: rebase its branch onto the
+ * current epic integration head, run the epic's test command, then
+ * merge --no-ff into the integration branch. Never auto-resolves a conflict
+ * and never touches main — the caller decides what happens next on a
+ * non-merged outcome.
+ */
+export async function step(task, opts) {
+    const integrationBranch = integrationBranchName(opts.epic);
+    const events = opts.events;
+    /**
+     * Log the outcome the queue just observed — a refusal it has already decided
+     * on, or a failure it has already seen. Never a prediction about work still
+     * ahead of it: an event written before the merge that the merge then
+     * falsifies is exactly the phantom row D-46 is about.
+     */
+    const logBlocked = async (error, detail) => {
+        if (!events)
+            return;
+        const { ctx, ...opt } = events;
+        await emitTaskBlocked(task.taskId, { error, severity: 'S2-major', detail }, ctx, opt);
+    };
+    // Before the rebase, because a rebase, a test run and a merge all "succeed"
+    // against a branch that carries nothing: certify that there is a commit to
+    // merge at all (D-30/P9-8). A task that merges nothing is a bug, not a pass.
+    const commit = certifyCommit(task.worktreeDir, { baseRef: integrationBranch });
+    if (!commit.certified) {
+        const reason = commit.reason;
+        await logBlocked(reason === 'not-a-git-worktree' ? 'execution.env-failure' : UNCOMMITTED_WORK_CODE, commit.dirty.length > 0
+            ? `${task.branch} has uncommitted work: ${commit.dirty.join(', ')}`
+            : `${task.branch} has nothing to merge into ${integrationBranch} (${reason}).`);
+        return { outcome: 'nothing-to-merge', taskId: task.taskId, reason, dirty: commit.dirty };
+    }
+    try {
+        execFileSync('git', ['rebase', integrationBranch], {
+            cwd: task.worktreeDir,
+            stdio: 'pipe',
+        });
+    }
+    catch {
+        const files = conflictingFiles(task.worktreeDir);
+        execFileSync('git', ['rebase', '--abort'], { cwd: task.worktreeDir, stdio: 'pipe' });
+        await logBlocked('integration.merge-conflict-textual', `Rebase onto ${integrationBranch} conflicted in: ${files.join(', ')}`);
+        return { outcome: 'rebase-conflict', taskId: task.taskId, conflictingFiles: files };
+    }
+    const plan = planTestRun(task.worktreeDir, opts);
+    const testOutcome = runTestCmd(plan.cmd, task.worktreeDir);
+    if (!testOutcome.passed) {
+        const outputTail = tailLines(testOutcome.output, OUTPUT_TAIL_LINES);
+        await logBlocked('execution.test-failure', outputTail);
+        return {
+            outcome: 'tests-failed',
+            taskId: task.taskId,
+            outputTail,
+            ...(plan.report ? { tests: plan.report } : {}),
+        };
+    }
+    execFileSync('git', ['checkout', integrationBranch], { cwd: opts.projectDir, stdio: 'pipe' });
+    execFileSync('git', ['merge', '--no-ff', task.branch, '-m', `Merge ${task.taskId} into ${integrationBranch}`], { cwd: opts.projectDir, stdio: 'pipe' });
+    if (events) {
+        const { ctx, ...opt } = events;
+        await emitWaveMerged(task.taskId, ctx, opt, mergedFiles(opts.projectDir));
+    }
+    return { outcome: 'merged', taskId: task.taskId, ...(plan.report ? { tests: plan.report } : {}) };
+}
+/** The commit `ref` names, or null when it names nothing (or nothing committish). */
+function resolveCommit(projectDir, ref) {
+    try {
+        return runGit(projectDir, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`]);
+    }
+    catch {
+        return null;
+    }
+}
+function isAncestor(projectDir, ancestor, descendant) {
+    try {
+        runGit(projectDir, ['merge-base', '--is-ancestor', ancestor, descendant]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Record a merge that landed outside the queue — after verifying it did (D-137).
+ *
+ * `queue run` refuses to log a merge under an id the plan does not contain, and
+ * that guard is right. What it left was a hole with no floor: `envkit-mcp-followup`
+ * was merged by hand, so four tasks were genuinely on the integration branch and
+ * the log held zero `wave-merged` events — the only event db/projector.ts folds to
+ * `completed`. The epic could not be closed by any honest means, which is a
+ * standing invitation to `event append` one by hand.
+ *
+ * So this verb takes the claim and checks it against the repository, in the order
+ * a reader would: the branch and the commit exist, the commit is a merge, the
+ * merge is on the integration branch, the branch head is one of its parents, and
+ * the branch carried something the merge could have landed. Only then does it
+ * write the same `wave-merged` the queue would have written.
+ *
+ * Refusals throw. They deliberately do NOT log an `error-logged`: a
+ * non-coordination one folds the task to `blocked`, and a task whose adopt
+ * command was mistyped is not blocked — that would put a wrong status in the
+ * table to record a wrong command line.
+ */
+export async function adopt(task, opts) {
+    const { projectDir } = opts;
+    const integrationBranch = integrationBranchName(opts.epic);
+    for (const ref of [integrationBranch, task.branch]) {
+        if (!resolveCommit(projectDir, ref)) {
+            throw new QueueError('queue.adopt-unknown-branch', `Branch "${ref}" does not exist in ${projectDir} — there is nothing to adopt against.`, { branch: ref, taskId: task.taskId });
+        }
+    }
+    const branchHead = resolveCommit(projectDir, task.branch);
+    const merge = resolveCommit(projectDir, opts.mergeCommit);
+    if (!merge) {
+        throw new QueueError('queue.adopt-unknown-commit', `"${opts.mergeCommit}" does not name a commit in ${projectDir}.`, { mergeCommit: opts.mergeCommit, taskId: task.taskId });
+    }
+    // `rev-list --parents -n 1 <sha>` prints the commit then its parents.
+    const parents = runGit(projectDir, ['rev-list', '--parents', '-n', '1', merge])
+        .split(/\s+/)
+        .slice(1)
+        .filter((p) => p.length > 0);
+    if (parents.length < 2) {
+        throw new QueueError('queue.adopt-not-a-merge', `Commit ${merge} has ${parents.length} parent(s), so it is not a merge. Name the merge commit that brought "${task.branch}" onto ${integrationBranch}.`, { mergeCommit: merge, taskId: task.taskId });
+    }
+    if (!isAncestor(projectDir, merge, integrationBranch)) {
+        throw new QueueError('queue.adopt-not-on-integration', `Merge ${merge} is not reachable from ${integrationBranch}. A merge the epic's integration branch does not contain landed nothing for this epic.`, { mergeCommit: merge, integrationBranch, taskId: task.taskId });
+    }
+    // Parent identity, not ancestry, and on purpose: a branch that grew after the
+    // hand-merge did not land everything it now carries, and adopting it would
+    // mark work completed that is not on the integration branch at all.
+    if (!parents.includes(branchHead)) {
+        throw new QueueError('queue.adopt-branch-not-merged', `Merge ${merge} has no parent equal to the head of "${task.branch}" (${branchHead}). Either the merge did not bring in this branch, or the branch has moved on since — in which case what it carries now has not landed.`, { mergeCommit: merge, branch: task.branch, branchHead, parents, taskId: task.taskId });
+    }
+    // D-30 restated for the merge commit: a branch cut and never committed to is
+    // the first parent of every merge made after it, so "is a parent" on its own
+    // would adopt a task that landed nothing.
+    const landed = Number(runGit(projectDir, ['rev-list', '--count', `${parents[0]}..${branchHead}`]));
+    if (!landed) {
+        throw new QueueError('queue.adopt-nothing-landed', `"${task.branch}" carries no commit that merge ${merge} could have landed — it is that merge's own base. A task that merged nothing did not finish (D-30).`, { mergeCommit: merge, branch: task.branch, taskId: task.taskId });
+    }
+    const filesChanged = mergedFiles(projectDir, merge);
+    if (opts.events) {
+        const { ctx, ...opt } = opts.events;
+        await emitWaveMerged(task.taskId, ctx, opt, filesChanged);
+    }
+    return {
+        outcome: 'adopted',
+        taskId: task.taskId,
+        mergeCommit: merge,
+        filesChanged: filesChanged ?? [],
+    };
+}
+/**
+ * The files the merge brought in, read off the merge commit itself (P9-15): the
+ * queue is the only component that knows which files a landed branch actually
+ * rewrote, and an open finding anchored to one of them is evidence about code
+ * that no longer exists.
+ *
+ * `<merge>^1..<merge>` — the first parent is the integration branch as it was a
+ * moment before, so this is exactly "what this merge changed" and not "what the
+ * task branch diverged by". A failure returns undefined rather than throwing:
+ * the merge has already landed, and losing the file list degrades the
+ * staleness check to its claims fallback instead of failing a queue step.
+ */
+function mergedFiles(projectDir, merge = 'HEAD') {
+    try {
+        const out = execFileSync('git', ['diff', '--name-only', `${merge}^1`, merge], {
+            cwd: projectDir,
+            encoding: 'utf8',
+        });
+        return out
+            .split('\n')
+            .map((f) => f.trim())
+            .filter((f) => f.length > 0);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Decide what to run. Any failure to build the graph — an unreadable worktree,
+ * a git call that did not answer — falls back to the operator's full command
+ * with the reason attached, because a test gate that skips on error is not a
+ * gate.
+ */
+function planTestRun(worktreeDir, opts) {
+    const template = opts.selectTestCmd;
+    // No template means selection was never asked for, so there is nothing to
+    // report: `tests` present in a result means selection ran, and its absence
+    // means the operator's full command was the only command there ever was.
+    if (template === undefined)
+        return { cmd: opts.testCmd };
+    try {
+        const changed = collectCommittedChanges(worktreeDir);
+        const graph = buildSymbolGraph(collectSources(worktreeDir));
+        const selection = selectTests(graph, changed);
+        if (selection.status === 'selected') {
+            return {
+                cmd: renderSelectedTestCmd(template, selection.tests),
+                report: { mode: 'selected', ran: selection.tests, known: selection.allTests.length },
+            };
+        }
+        return {
+            cmd: opts.testCmd,
+            report: { mode: 'full', known: selection.allTests.length, reasons: selection.reasons },
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            cmd: opts.testCmd,
+            report: { mode: 'full', reasons: [`selection failed: ${message}`] },
+        };
+    }
+}
+function runTestCmd(testCmd, cwd) {
+    try {
+        const output = execFileSync(testCmd, { cwd, shell: true, encoding: 'utf8', stdio: 'pipe' });
+        return { passed: true, output };
+    }
+    catch (err) {
+        const e = err;
+        const output = `${e.stdout ?? ''}${e.stderr ?? ''}` || e.message;
+        return { passed: false, output };
+    }
+}

package/factory/orchestrator/dist/quorum.js

@@ -0,0 +1,347 @@
+// Quorum engine (architecture §6 "Diversity quorum" + "Asymmetric roles,
+// kill mandate"; factory/policies/crosscheck.yml `quorum_rule`/
+// `asymmetric_roles`). Given the native (Claude) verdict plus zero or more
+// external JudgeResults for one trigger case (crosscheck.yml
+// `quorum_triggers`: a blocking S1/S2 finding, an epic-final verdict, a
+// same-mistake finding, or a low-confidence planner verdict), decide
+// whether the case is settled or must escalate to the operator with both
+// rationales side by side.
+//
+// Shadow mode (Phase 8 design decision): until crosscheck.yml flips a
+// provider's `mode` to `active`, its verdict is recorded for calibration
+// analytics (providerAgreement() in db/queries.ts) but has ZERO gating
+// power — computeQuorum() falls back to the native verdict alone whenever
+// no ACTIVE external judge is present in the case, exactly the pre-Phase-8
+// behavior. This is the mechanism that makes "flip crosscheck.yml" the
+// entire promotion step (docs/runbooks/providers.md).
+import { loadCrosscheckPolicy, providerModel } from './crosscheck.js';
+import { SmithError } from './errors.js';
+import { appendEvent } from './events.js';
+import { runJudge } from './providers/index.js';
+const DEFAULT_QUORUM_POLICY = { minProviders: 2 };
+/**
+ * Bridge a raw JudgeResult into the binary confirm/refute quorum needs.
+ * `kind: review` has no explicit verdict field (its contract is a findings
+ * array, .claude/agents/reviewer.md) — presence of any finding IS the
+ * claim being judged ("this task has a real blocking issue"), so a
+ * non-empty array reads as `confirm`. `kind: verify`/`plan-critique` carry
+ * an explicit judge-verdict.schema.json object instead.
+ */
+export function deriveVerdict(result) {
+    if (result.kind === 'review') {
+        const findings = Array.isArray(result.output) ? result.output : [];
+        return {
+            provider: result.provider,
+            verdict: findings.length > 0 ? 'confirm' : 'refute',
+            rationale: findings.length > 0 ? `${findings.length} finding(s) raised.` : 'No findings raised.',
+        };
+    }
+    const output = result.output;
+    const verdict = output.verdict === 'confirm' ? 'confirm' : 'refute';
+    return { provider: result.provider, verdict, rationale: output.rationale ?? '' };
+}
+function toRationales(participants) {
+    return participants
+        .filter((p) => p.ok && p.verdict !== null)
+        .map(({ provider, verdict, rationale }) => ({ provider, verdict, rationale }));
+}
+/**
+ * Pure decision function (table-driven testable): no I/O, no events. Applies
+ * quorum_rule (majority-of-N, generalizing "2-of-3") over the gating pool —
+ * native plus every ACTIVE, non-finder external participant. Shadow-mode
+ * and finder-excluded participants are recorded in `participants` for
+ * calibration but never enter the pool.
+ */
+export function computeQuorum(kase, policy = DEFAULT_QUORUM_POLICY) {
+    const nativeParticipant = {
+        provider: kase.native.provider,
+        mode: 'native',
+        ok: true,
+        verdict: kase.native.verdict,
+        rationale: kase.native.rationale,
+        excludedAsFinder: kase.native.provider === kase.finderProvider,
+    };
+    const externalParticipants = kase.external.map((run) => {
+        const excludedAsFinder = run.provider === kase.finderProvider;
+        if (!run.outcome.ok) {
+            return {
+                provider: run.provider,
+                mode: run.mode,
+                ok: false,
+                verdict: null,
+                rationale: run.outcome.error.message,
+                excludedAsFinder,
+            };
+        }
+        const verdict = deriveVerdict(run.outcome.result);
+        return {
+            provider: run.provider,
+            mode: run.mode,
+            ok: true,
+            verdict: verdict.verdict,
+            rationale: verdict.rationale,
+            excludedAsFinder,
+        };
+    });
+    const participants = [nativeParticipant, ...externalParticipants];
+    const caseSummary = {
+        taskId: kase.taskId,
+        findingId: kase.findingId,
+        triggerReason: kase.triggerReason,
+    };
+    const activeExternal = externalParticipants.filter((p) => p.mode === 'active' && p.ok && !p.excludedAsFinder);
+    // Shadow mode: no ACTIVE external participant in this case's pool yet —
+    // gating stays exactly what it always was pre-Phase-8, the native verdict
+    // alone (zero gating power for shadow-mode providers, per the header note).
+    if (activeExternal.length === 0) {
+        if (nativeParticipant.excludedAsFinder) {
+            return {
+                case: caseSummary,
+                gating: { outcome: 'escalate', reason: 'insufficient-providers', rationales: [] },
+                participants,
+            };
+        }
+        return {
+            case: caseSummary,
+            gating: {
+                outcome: 'decided',
+                decision: nativeParticipant.verdict,
+                agreement: 'native-only',
+                participants: [nativeParticipant.provider],
+            },
+            participants,
+        };
+    }
+    const gatingPool = [
+        ...(nativeParticipant.excludedAsFinder ? [] : [nativeParticipant]),
+        ...activeExternal,
+    ];
+    if (gatingPool.length < policy.minProviders) {
+        return {
+            case: caseSummary,
+            gating: {
+                outcome: 'escalate',
+                reason: 'insufficient-providers',
+                rationales: toRationales(gatingPool),
+            },
+            participants,
+        };
+    }
+    const confirmCount = gatingPool.filter((p) => p.verdict === 'confirm').length;
+    const refuteCount = gatingPool.length - confirmCount;
+    const majority = Math.floor(gatingPool.length / 2) + 1;
+    if (confirmCount >= majority || refuteCount >= majority) {
+        return {
+            case: caseSummary,
+            gating: {
+                outcome: 'decided',
+                decision: confirmCount >= majority ? 'confirm' : 'refute',
+                agreement: `${Math.max(confirmCount, refuteCount)}-of-${gatingPool.length}`,
+                participants: gatingPool.map((p) => p.provider),
+            },
+            participants,
+        };
+    }
+    return {
+        case: caseSummary,
+        gating: { outcome: 'escalate', reason: 'disagreement', rationales: toRationales(gatingPool) },
+        participants,
+    };
+}
+// ---------------------------------------------------------------------------
+// Event recording — "Emit events for every judge run" (architecture §7/§8).
+// ---------------------------------------------------------------------------
+const KIND_TO_AGENT = {
+    review: 'reviewer',
+    verify: 'verifier',
+    'plan-critique': 'spec-reviewer',
+};
+/**
+ * One judge run -> one `dispatch_decision` event (so it shows up in the same
+ * analytics/timeline as any other agent dispatch, architecture §7) plus one
+ * `judge-verdict` event chained off it, always emitted whether the run
+ * succeeded or failed (the failure rates providerAgreement() reports need
+ * the failures on the log too — a call that throws before any event exists
+ * would make them unobservable).
+ *
+ * A failed run carries `error_code` as well as the message (D-253). The two
+ * are not interchangeable: the message is prose written for a human reading
+ * one row, the code is the field every count is grouped by, and
+ * judgeFailureKind() reads it to say whether the provider answered badly or
+ * never answered at all.
+ */
+export async function recordJudgeRun(input, ctx, opts = {}) {
+    const agentRole = KIND_TO_AGENT[input.kind];
+    const dispatch = await appendEvent({
+        session_id: ctx.sessionId,
+        actor: ctx.actor ?? 'system',
+        event_type: 'dispatch_decision',
+        task_id: input.taskId,
+        plan_version: ctx.planVersion,
+        causal_parent: ctx.causalParent,
+        payload: {
+            agent_role: agentRole,
+            provider: input.run.provider,
+            model_tier: input.modelTier,
+            model: input.model,
+            reason: `cross-provider judge (${input.run.mode})`,
+        },
+    }, opts);
+    const ok = input.run.outcome.ok;
+    const verdict = ok ? deriveVerdict(input.run.outcome.result) : null;
+    // A failed run produced no verdict, so there is nothing for the native one to
+    // agree or disagree with. `false` there would be a placeholder wearing an
+    // observation's clothes -- and a reader grouping by it counts a provider that
+    // never answered as one that dissented. `null` is how the record says the
+    // question has no answer, the same choice `latency_ms` below already makes
+    // (D-168). Rows written before this carry `false` permanently; providerAgreement()
+    // gates on `schema_failure` first for exactly that reason.
+    const agreementWithNative = ok ? verdict?.verdict === input.native.verdict : null;
+    const verdictEvent = await appendEvent({
+        session_id: ctx.sessionId,
+        actor: ctx.actor ?? 'system',
+        event_type: 'judge-verdict',
+        task_id: input.taskId,
+        plan_version: ctx.planVersion,
+        causal_parent: dispatch.event_id,
+        payload: {
+            task_id: input.taskId,
+            finding_id: input.findingId ?? null,
+            agent: agentRole,
+            provider: input.run.provider,
+            model_tier: input.modelTier,
+            model: input.model,
+            kind: input.kind,
+            mode: input.run.mode,
+            ok,
+            verdict: ok ? verdict?.verdict : null,
+            rationale: ok
+                ? (verdict?.rationale ?? '')
+                : input.run.outcome.error.message,
+            native_verdict: input.native.verdict,
+            agreement_with_native: agreementWithNative,
+            schema_failure: !ok,
+            // `schema_failure` stays what it has always been -- "this run reached
+            // no verdict" -- because a decade of rows and ten-odd readers already
+            // spell it that way. What it cannot do is say *why*, and it was being
+            // read as though it could: runQuorumCase()'s catch had the code in
+            // hand and dropped it here, so eight straight deepseek runs killed by
+            // an unset DEEPSEEK_API_KEY were reported as unparseable answers from
+            // a provider that had not been sent a single request (D-253).
+            error_code: ok
+                ? null
+                : input.run.outcome.error.code,
+            latency_ms: ok ? input.run.outcome.result.latency_ms : null,
+        },
+    }, opts);
+    return { dispatchEventId: dispatch.event_id, verdictEventId: verdictEvent.event_id };
+}
+/**
+ * Every non-native provider crosscheck.yml has switched on. `enabled: false`
+ * means never invoked at all regardless of `mode`, so an all-disabled policy
+ * (the shipped default) returns [] and callers can skip the case entirely —
+ * no judge call, no events, no spend.
+ */
+export function enabledExternalProviders(policy) {
+    return Object.values(policy.providers)
+        .filter((p) => p.kind !== 'native' && p.enabled)
+        .map((p) => p.name);
+}
+/** The provider running the factory itself (crosscheck.yml `kind: native`). */
+export function nativeProviderName(policy) {
+    return Object.values(policy.providers).find((p) => p.kind === 'native')?.name ?? 'claude';
+}
+/**
+ * Assemble the `verify` JudgeRequest for one finding, carrying
+ * crosscheck.yml's `asymmetric_roles.critic_mandate` ("refute, not confirm")
+ * into the prompt — the critic's job is to kill the finding, not to agree
+ * with it.
+ *
+ * Deliberate limitation: the prompt carries the CLAIM (summary + failure
+ * scenario + file path), never the file's contents or the diff. Shipping
+ * worktree source to a third-party API is an operator decision this call
+ * has no mandate to make, so a critic judges whether the claimed failure
+ * scenario is internally coherent and plausible, not whether the code
+ * really does that. Documented in docs/runbooks/providers.md §2.
+ */
+export function findingJudgeRequest(finding, filePath, budget) {
+    const prompt = [
+        'You are an adversarial critic in an automated code-review gate.',
+        'Another reviewer raised the finding below and it is about to block a task.',
+        'Your mandate is to REFUTE it: assume it is wrong until the stated failure',
+        'scenario forces you to agree. Confirm only if the described failure would',
+        'genuinely occur as written.',
+        '',
+        `Task: ${finding.task_id}`,
+        `File: ${filePath}`,
+        `Category: ${finding.finding_category}`,
+        `Severity: ${finding.severity}`,
+        `Summary: ${finding.summary}`,
+        '',
+        'Claimed failure scenario:',
+        `  inputs:   ${finding.failure_scenario.inputs}`,
+        `  expected: ${finding.failure_scenario.expected}`,
+        `  actual:   ${finding.failure_scenario.actual}`,
+        '',
+        'You are judging the claim as stated; you do not have the file contents.',
+        'A claim that is vague, self-contradictory, or that would not actually',
+        'produce the stated `actual` is a refute.',
+        '',
+        'Return only JSON matching judge-verdict.schema.json:',
+        '{"verdict": "confirm" | "refute", "rationale": "<one or two sentences>"}',
+        '"confirm" = the finding is real and should block. "refute" = it should not.',
+    ].join('\n');
+    return {
+        kind: 'verify',
+        taskId: finding.task_id,
+        inputRefs: { finding_id: finding.finding_id, fingerprint: finding.fingerprint, file: filePath },
+        prompt,
+        schemaName: 'judge-verdict',
+        budget,
+    };
+}
+export async function runQuorumCase(input, ctx, opts = {}) {
+    const policy = input.policy ?? loadCrosscheckPolicy();
+    const external = [];
+    for (const providerName of input.providers) {
+        const config = policy.providers[providerName];
+        if (!config || config.kind === 'native' || !config.enabled)
+            continue;
+        let outcome;
+        try {
+            const result = await runJudge(providerName, input.request, {
+                policy,
+                fetchImpl: input.fetchImpl,
+            });
+            outcome = { ok: true, result };
+        }
+        catch (err) {
+            outcome = {
+                ok: false,
+                error: {
+                    code: err instanceof SmithError ? err.code : 'provider.unknown-error',
+                    message: err instanceof Error ? err.message : String(err),
+                },
+            };
+        }
+        const run = { provider: providerName, mode: config.mode, outcome };
+        external.push(run);
+        await recordJudgeRun({
+            taskId: input.taskId,
+            findingId: input.findingId,
+            modelTier: config.modelTier,
+            model: providerModel(config),
+            kind: input.kind,
+            run,
+            native: input.native,
+        }, ctx, opts);
+    }
+    return computeQuorum({
+        taskId: input.taskId,
+        findingId: input.findingId,
+        triggerReason: input.triggerReason,
+        finderProvider: input.finderProvider,
+        native: input.native,
+        external,
+    }, input.quorumPolicy);
+}