@kisev/agentomatic 11.0.0-dev.46.gfbe1e4c6992e

package/dist/config-setup.d.ts

@@ -0,0 +1,71 @@
+import { LifecycleError, type Scope, type SupersededPlan } from "./lifecycle.js";
+export declare class ConfigSetupError extends LifecycleError {
+}
+export declare const CONFIG_TARGETS: readonly ["opencode", "tui", "kilo", "mimo"];
+export type ConfigTargetName = (typeof CONFIG_TARGETS)[number];
+export declare const CONFIG_FRAGMENTS: readonly [{
+    readonly name: "core-plugin";
+    readonly description: "Register @kisev/agentomatic in the plugin array (OpenCode only)";
+    readonly targets: readonly ["opencode"];
+}, {
+    readonly name: "skills-state-permissions";
+    readonly description: "Allow the standard skills XDG state paths without per-run prompts";
+    readonly targets: readonly ["opencode", "kilo", "mimo"];
+}, {
+    readonly name: "lsp-preset";
+    readonly description: "Add LSP servers from the shared catalog (OpenCode only)";
+    readonly targets: readonly ["opencode"];
+}, {
+    readonly name: "secrets-guard";
+    readonly description: "Deny reads and edits of common secret files";
+    readonly targets: readonly ["opencode", "kilo", "mimo"];
+}, {
+    readonly name: "kilo-display";
+    readonly description: "Expand Kilo reasoning, terminal, edit, and tool blocks";
+    readonly targets: readonly ["kilo"];
+}, {
+    readonly name: "tui-schema";
+    readonly description: "Add the tui.json schema and stacked diffs";
+    readonly targets: readonly ["tui"];
+}];
+export type FragmentName = (typeof CONFIG_FRAGMENTS)[number]["name"];
+export type ConfigSetupSelection = {
+    targets: ConfigTargetName[];
+    fragments: FragmentName[];
+};
+export type ConfigSetupOperation = {
+    target: ConfigTargetName;
+    path: string;
+    fragment: FragmentName | "file";
+    operation: "create" | "update" | "unchanged" | "conflict";
+    reason?: string;
+};
+export type ConfigSetupPlan = {
+    schema_version: 1;
+    action: "config-setup";
+    scope: Scope;
+    root: string;
+    package_version: string;
+    selection: ConfigSetupSelection;
+    targets: Array<{
+        target: ConfigTargetName;
+        path: string;
+        exists: boolean;
+    }>;
+    operations: ConfigSetupOperation[];
+    skipped_fragments: Array<{
+        fragment: FragmentName;
+        reason: string;
+    }>;
+    plan_digest: string;
+    digest: string;
+    confirmation_digest?: string;
+    receipt_expires_at?: string;
+    superseded_plan?: SupersededPlan;
+    requires_restart: boolean;
+    confirmable: boolean;
+};
+export declare function normalizeConfigSelection(scope: Scope, value?: Partial<ConfigSetupSelection>): ConfigSetupSelection;
+export declare function defaultConfigSelection(scope: Scope, cwd?: string, home?: string): Promise<ConfigSetupSelection>;
+export declare function previewConfigSetup(selection: ConfigSetupSelection, scope: Scope, cwd?: string, home?: string): Promise<ConfigSetupPlan>;
+export declare function applyConfigSetup(selection: ConfigSetupSelection, scope: Scope, confirmationDigest: string, cwd?: string, home?: string): Promise<ConfigSetupPlan>;

package/dist/config-setup.js

@@ -0,0 +1,438 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { requirePackageVersion } from "./package-metadata.js";
+import { applyTransaction, consumeReceipt, deploymentRoot, digest, LifecycleError, lifecycleRoot, readRegular, recoverTransaction, saveReceipt, sha256, withLifecycleLock, } from "./lifecycle.js";
+import { applyJsoncEdits, parseJsonc } from "./jsonc.js";
+const PACKAGE_NAME = "@kisev/agentomatic";
+const LEGACY_PACKAGE_NAME = "@kisev/skills-opencode";
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const XDG_STATE_GLOB = "~/.local/state/agent-skills/**";
+const OPENCODE_SKILLS_GLOB = "~/.config/opencode/skills/**";
+const SECRET_PATHS = [
+    "**/.env",
+    "**/.env.*",
+    "**/*.env",
+    "**/.envrc",
+    "**/.npmrc",
+    "**/.netrc",
+    "**/.pypirc",
+    "**/.git-credentials",
+    "**/.ssh/**",
+    "**/id_rsa",
+    "**/id_ed25519",
+    "**/*.pem",
+    "**/*.key",
+    "**/*.p12",
+    "**/*.pfx",
+    "**/.kube/config",
+    "**/kubeconfig*",
+    "**/.aws/credentials",
+    "**/.docker/config.json",
+    "**/auth.json",
+];
+export class ConfigSetupError extends LifecycleError {
+}
+export const CONFIG_TARGETS = ["opencode", "tui", "kilo", "mimo"];
+export const CONFIG_FRAGMENTS = [
+    {
+        name: "core-plugin",
+        description: "Register @kisev/agentomatic in the plugin array (OpenCode only)",
+        targets: ["opencode"],
+    },
+    {
+        name: "skills-state-permissions",
+        description: "Allow the standard skills XDG state paths without per-run prompts",
+        targets: ["opencode", "kilo", "mimo"],
+    },
+    {
+        name: "lsp-preset",
+        description: "Add LSP servers from the shared catalog (OpenCode only)",
+        targets: ["opencode"],
+    },
+    {
+        name: "secrets-guard",
+        description: "Deny reads and edits of common secret files",
+        targets: ["opencode", "kilo", "mimo"],
+    },
+    {
+        name: "kilo-display",
+        description: "Expand Kilo reasoning, terminal, edit, and tool blocks",
+        targets: ["kilo"],
+    },
+    {
+        name: "tui-schema",
+        description: "Add the tui.json schema and stacked diffs",
+        targets: ["tui"],
+    },
+];
+const FRAGMENT_NAMES = CONFIG_FRAGMENTS.map((fragment) => fragment.name);
+const LSP_SERVER_COMMANDS = {
+    python: ["basedpyright-langserver", "--stdio"],
+    typescript: ["typescript-language-server", "--stdio"],
+    yaml: ["yaml-language-server", "--stdio"],
+    shell: ["bash-language-server", "start"],
+};
+function lspCatalog() {
+    const raw = readFileSync(resolve(packageRoot, "dist", "assets", "lsp-catalog.json"), "utf8");
+    const catalog = JSON.parse(raw);
+    if (!Array.isArray(catalog.servers))
+        throw new ConfigSetupError("invalid_package", "LSP catalog is unavailable");
+    return catalog.servers
+        .filter((server) => typeof server.name === "string" &&
+        Array.isArray(server.extensions) &&
+        server.extensions.every((extension) => typeof extension === "string"))
+        .filter((server) => LSP_SERVER_COMMANDS[server.name]);
+}
+function mapAllowsAll(value) {
+    return Boolean(value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        value["*"] === "allow");
+}
+function permissionMapEdits(path, entries) {
+    return [{ kind: "widen-scalar-map", path, entries }];
+}
+function fragmentEdits(fragment, target, current) {
+    const value = current && typeof current === "object" && !Array.isArray(current)
+        ? current
+        : {};
+    const permission = value.permission && typeof value.permission === "object" && !Array.isArray(value.permission)
+        ? value.permission
+        : {};
+    if (fragment === "core-plugin") {
+        return [
+            { kind: "set-if-absent", path: ["$schema"], value: "https://opencode.ai/config.json" },
+            { kind: "set-if-absent", path: ["plugin"], value: [] },
+            {
+                kind: "replace-array-value",
+                path: ["plugin"],
+                from: LEGACY_PACKAGE_NAME,
+                to: PACKAGE_NAME,
+            },
+            { kind: "append-unique", path: ["plugin"], value: PACKAGE_NAME },
+        ];
+    }
+    if (fragment === "skills-state-permissions") {
+        const statePaths = target === "opencode" ? [XDG_STATE_GLOB, OPENCODE_SKILLS_GLOB] : [XDG_STATE_GLOB];
+        const edits = [];
+        if (!mapAllowsAll(permission.read))
+            edits.push(...permissionMapEdits(["permission", "read"], Object.fromEntries(statePaths.map((glob) => [glob, "allow"]))));
+        if (!mapAllowsAll(permission.edit))
+            edits.push(...permissionMapEdits(["permission", "edit"], { [XDG_STATE_GLOB]: "allow" }));
+        if (!mapAllowsAll(permission.external_directory))
+            edits.push(...permissionMapEdits(["permission", "external_directory"], Object.fromEntries(statePaths.map((glob) => [glob, "allow"]))));
+        return edits;
+    }
+    if (fragment === "lsp-preset") {
+        return lspCatalog().map((server) => ({
+            kind: "set-if-absent",
+            path: ["lsp", server.name],
+            value: { command: LSP_SERVER_COMMANDS[server.name], extensions: server.extensions },
+        }));
+    }
+    if (fragment === "secrets-guard") {
+        const deny = Object.fromEntries(SECRET_PATHS.map((glob) => [glob, "deny"]));
+        return [
+            ...permissionMapEdits(["permission", "read"], {
+                ...deny,
+                "**/.env.example": "allow",
+            }),
+            ...permissionMapEdits(["permission", "edit"], deny),
+        ];
+    }
+    if (fragment === "kilo-display") {
+        return [
+            { kind: "set-if-absent", path: ["reasoning_display"], value: "expanded" },
+            { kind: "set-if-absent", path: ["terminal_command_display"], value: "expanded" },
+            { kind: "set-if-absent", path: ["code_edit_display"], value: "expanded" },
+            { kind: "set-if-absent", path: ["mcp_tool_display"], value: "expanded" },
+        ];
+    }
+    return [
+        { kind: "set-if-absent", path: ["$schema"], value: "https://opencode.ai/tui.json" },
+        { kind: "set-if-absent", path: ["diff_style"], value: "stacked" },
+    ];
+}
+function applicable(fragment, target) {
+    const targets = CONFIG_FRAGMENTS.find((item) => item.name === fragment)?.targets ?? [];
+    return targets.includes(target);
+}
+export function normalizeConfigSelection(scope, value = {}) {
+    const requestedTargets = value.targets ?? ["opencode"];
+    const targets = CONFIG_TARGETS.filter((target) => requestedTargets.includes(target));
+    if (targets.length !== requestedTargets.length)
+        throw new ConfigSetupError("invalid_selection", "Unknown config target selection");
+    if (scope === "project" && (targets.length !== 1 || targets[0] !== "opencode"))
+        throw new ConfigSetupError("invalid_selection", "Project scope supports only the opencode target");
+    const requestedFragments = value.fragments ?? [];
+    const fragments = FRAGMENT_NAMES.filter((fragment) => requestedFragments.includes(fragment));
+    if (fragments.length !== requestedFragments.length)
+        throw new ConfigSetupError("invalid_selection", "Unknown config fragment selection");
+    return { targets, fragments };
+}
+export async function defaultConfigSelection(scope, cwd = process.cwd(), home = homedir()) {
+    const exists = async (path) => Boolean(await readRegular(path).catch(() => undefined));
+    const targets = ["opencode"];
+    if (scope === "global") {
+        if (await exists(join(home, ".config", "opencode", "tui.json")))
+            targets.push("tui");
+        if (await exists(join(home, ".config", "kilo", "kilo.json")))
+            targets.push("kilo");
+        if (await exists(join(home, ".config", "kilo", "kilo.jsonc")))
+            targets.push("kilo");
+        if (await exists(join(home, ".config", "mimocode", "mimocode.json")))
+            targets.push("mimo");
+        if (await exists(join(home, ".config", "mimocode", "mimocode.jsonc")))
+            targets.push("mimo");
+    }
+    return normalizeConfigSelection(scope, {
+        targets: [...new Set(targets)],
+        fragments: [...FRAGMENT_NAMES],
+    });
+}
+async function resolveTargetFile(target, scope, cwd, home) {
+    const existing = async (root, path) => Boolean(await readRegular(join(root, path)).catch(() => undefined));
+    const globalRoot = deploymentRoot("global", cwd, home);
+    if (target === "opencode") {
+        if (scope === "global") {
+            for (const path of ["opencode.json", "opencode.jsonc"])
+                if (await existing(globalRoot, path))
+                    return { target, root: globalRoot, path, absolute: join(globalRoot, path), exists: true };
+            return {
+                target,
+                root: globalRoot,
+                path: "opencode.jsonc",
+                absolute: join(globalRoot, "opencode.jsonc"),
+                exists: false,
+            };
+        }
+        const projectRoot = deploymentRoot("project", cwd, home);
+        for (const [root, path] of [
+            [cwd, "opencode.json"],
+            [cwd, "opencode.jsonc"],
+            [projectRoot, "opencode.json"],
+            [projectRoot, "opencode.jsonc"],
+        ])
+            if (await existing(root, path))
+                return { target, root, path, absolute: join(root, path), exists: true };
+        return {
+            target,
+            root: cwd,
+            path: "opencode.jsonc",
+            absolute: join(cwd, "opencode.jsonc"),
+            exists: false,
+        };
+    }
+    if (target === "tui")
+        return {
+            target,
+            root: globalRoot,
+            path: "tui.json",
+            absolute: join(globalRoot, "tui.json"),
+            exists: await existing(globalRoot, "tui.json"),
+        };
+    if (target === "kilo") {
+        const root = join(home, ".config", "kilo");
+        for (const path of ["kilo.jsonc", "kilo.json"])
+            if (await existing(root, path))
+                return { target, root, path, absolute: join(root, path), exists: true };
+        return { target, root, path: "kilo.jsonc", absolute: join(root, "kilo.jsonc"), exists: false };
+    }
+    const root = join(home, ".config", "mimocode");
+    for (const path of ["mimocode.jsonc", "mimocode.json"])
+        if (await existing(root, path))
+            return { target, root, path, absolute: join(root, path), exists: true };
+    return {
+        target,
+        root,
+        path: "mimocode.jsonc",
+        absolute: join(root, "mimocode.jsonc"),
+        exists: false,
+    };
+}
+async function build(selection, scope, cwd = process.cwd(), home = homedir()) {
+    const root = deploymentRoot(scope, cwd, home);
+    const operations = [];
+    const mutations = [];
+    const allowedRoots = new Set([root]);
+    const files = [];
+    for (const target of CONFIG_TARGETS.filter((name) => selection.targets.includes(name))) {
+        let file;
+        let current;
+        try {
+            file = await resolveTargetFile(target, scope, cwd, home);
+            current = file.exists ? await readRegular(file.absolute) : undefined;
+        }
+        catch (error) {
+            const reason = error instanceof LifecycleError ? error.message : "target is unreadable";
+            for (const fragment of selection.fragments.filter((item) => applicable(item, target)))
+                operations.push({ target, path: "unknown", fragment, operation: "conflict", reason });
+            continue;
+        }
+        if (file.exists && current === undefined) {
+            for (const fragment of selection.fragments.filter((item) => applicable(item, target)))
+                operations.push({
+                    target,
+                    path: file.absolute,
+                    fragment,
+                    operation: "conflict",
+                    reason: "target is unreadable",
+                });
+            continue;
+        }
+        files.push(file);
+        allowedRoots.add(file.root);
+        let text = current ? current.toString("utf8") : "{}\n";
+        let changed = false;
+        for (const fragment of selection.fragments) {
+            if (!applicable(fragment, target))
+                continue;
+            let parsed = undefined;
+            try {
+                parsed = parseJsonc(text);
+            }
+            catch {
+                parsed = undefined;
+            }
+            try {
+                const applied = applyJsoncEdits(text, fragmentEdits(fragment, target, parsed));
+                if (applied.changed) {
+                    text = applied.text;
+                    changed = true;
+                    operations.push({
+                        target,
+                        path: file.absolute,
+                        fragment,
+                        operation: file.exists ? "update" : "create",
+                    });
+                }
+                else {
+                    operations.push({ target, path: file.absolute, fragment, operation: "unchanged" });
+                }
+            }
+            catch (error) {
+                operations.push({
+                    target,
+                    path: file.absolute,
+                    fragment,
+                    operation: "conflict",
+                    reason: error instanceof LifecycleError || error instanceof Error
+                        ? error.message
+                        : String(error),
+                });
+            }
+        }
+        if (changed) {
+            const content = Buffer.from(text.endsWith("\n") ? text : `${text}\n`);
+            mutations.push({
+                ...(file.root === root ? {} : { root: file.root }),
+                path: file.path,
+                operation: "write",
+                content,
+                mode: 0o644,
+                expected: current ? { sha256: sha256(current) } : { absent: true },
+            });
+        }
+    }
+    const skipped = selection.fragments
+        .filter((fragment) => !selection.targets.some((target) => applicable(fragment, target)))
+        .map((fragment) => ({ fragment, reason: "no selected target supports this fragment" }));
+    const sorted = operations.sort((left, right) => CONFIG_TARGETS.indexOf(left.target) - CONFIG_TARGETS.indexOf(right.target) ||
+        FRAGMENT_NAMES.indexOf(left.fragment) -
+            FRAGMENT_NAMES.indexOf(right.fragment) ||
+        left.path.localeCompare(right.path));
+    const base = {
+        schema_version: 1,
+        action: "config-setup",
+        scope,
+        root,
+        package_version: requirePackageVersion(),
+        selection,
+        targets: files.map((file) => ({
+            target: file.target,
+            path: file.absolute,
+            exists: file.exists,
+        })),
+        operations: sorted,
+        skipped_fragments: skipped,
+        requires_restart: sorted.some((item) => item.operation === "create" || item.operation === "update"),
+        confirmable: mutations.length > 0,
+    };
+    const planDigest = digest(base);
+    return {
+        plan: { ...base, plan_digest: planDigest, digest: planDigest },
+        mutations,
+        allowedRoots: [...allowedRoots],
+    };
+}
+export async function previewConfigSetup(selection, scope, cwd = process.cwd(), home = homedir()) {
+    const stateRoot = lifecycleRoot(scope, cwd, home);
+    const root = deploymentRoot(scope, cwd, home);
+    try {
+        return await withLifecycleLock(stateRoot, async () => {
+            const built = await build(selection, scope, cwd, home);
+            if (await recoverTransaction(root, stateRoot, built.allowedRoots))
+                throw new ConfigSetupError("recovered_transaction", "Recovered an interrupted transaction; request a fresh plan");
+            if (!built.plan.confirmable)
+                return built.plan;
+            const receipt = await saveReceipt(stateRoot, "config-setup", scope, root, { plan_digest: built.plan.plan_digest }, Date.now(), built.plan.plan_digest);
+            return {
+                ...built.plan,
+                digest: receipt.digest,
+                confirmation_digest: receipt.digest,
+                receipt_expires_at: receipt.expires_at,
+                ...(receipt.superseded_plan ? { superseded_plan: receipt.superseded_plan } : {}),
+            };
+        });
+    }
+    catch (error) {
+        if (error instanceof ConfigSetupError)
+            throw error;
+        if (error instanceof LifecycleError)
+            throw new ConfigSetupError(error.code, error.message);
+        throw error;
+    }
+}
+export async function applyConfigSetup(selection, scope, confirmationDigest, cwd = process.cwd(), home = homedir()) {
+    const stateRoot = lifecycleRoot(scope, cwd, home);
+    const root = deploymentRoot(scope, cwd, home);
+    try {
+        return await withLifecycleLock(stateRoot, async () => {
+            const built = await build(selection, scope, cwd, home);
+            if (await recoverTransaction(root, stateRoot, built.allowedRoots))
+                throw new ConfigSetupError("recovered_transaction", "Recovered an interrupted transaction; request a fresh plan");
+            const receipt = (await consumeReceipt(stateRoot, {
+                digest: confirmationDigest,
+                kind: "config-setup",
+                scope,
+                root,
+            }));
+            if (built.plan.plan_digest !== (receipt.plan_digest ?? digest(receipt)))
+                throw new ConfigSetupError("stale_plan", "Config setup plan changed after preview");
+            if (!built.plan.confirmable)
+                throw new ConfigSetupError("invalid_state", "Config setup plan has no applicable changes");
+            await applyTransaction(root, stateRoot, built.mutations, {
+                validateFinal: async () => {
+                    for (const mutation of built.mutations) {
+                        if (mutation.operation !== "write")
+                            continue;
+                        const target = join(mutation.root ?? root, mutation.path);
+                        const content = await readRegular(target);
+                        if (!content || !content.equals(mutation.content))
+                            throw new ConfigSetupError("final_validation_failed", `Written config failed final validation: ${mutation.path}`);
+                    }
+                },
+            });
+            return { ...built.plan, digest: confirmationDigest };
+        });
+    }
+    catch (error) {
+        if (error instanceof ConfigSetupError)
+            throw error;
+        if (error instanceof LifecycleError)
+            throw new ConfigSetupError(error.code, error.message);
+        throw error;
+    }
+}

package/dist/contracts.d.ts

@@ -0,0 +1,52 @@
+import { type ExecutionCard } from "./routing.js";
+export declare const CONTRACT_SCHEMA_VERSION: 1;
+export type AgentReportStatus = "COMPLETED" | "BLOCKED" | "FAILED" | "REJECTED_PLAN" | "APPROVED" | "CHANGES_REQUIRED";
+export type MapperReport = {
+    mapper_report: {
+        schema_version: 1;
+        paths: Array<Record<string, string>>;
+        callers: Array<Record<string, string>>;
+        tests: Array<Record<string, string>>;
+        patterns: Array<Record<string, string>>;
+        evidence_gaps: string[];
+    };
+};
+export type WorkerReport = {
+    worker_report: {
+        schema_version: 1;
+        status: Extract<AgentReportStatus, "COMPLETED" | "BLOCKED" | "FAILED" | "REJECTED_PLAN">;
+        card_id: string | null;
+        revision: number | null;
+        changed_files: string[];
+        checks: Array<{
+            command: string;
+            status: string;
+        }>;
+        writes_performed: boolean;
+        risks: string[];
+    };
+};
+export type ReviewReport = {
+    review_report: {
+        schema_version: 1;
+        status: "APPROVED" | "CHANGES_REQUIRED";
+        target: string;
+        findings: Array<Record<string, unknown>>;
+        evidence: string[];
+        checks: string[];
+        risks: string[];
+    };
+};
+export type CriticReport = {
+    critic_report: {
+        schema_version: 1;
+        status: "APPROVED" | "CHANGES_REQUIRED";
+        card_id: string;
+        revision: number;
+        findings: Array<Record<string, unknown>>;
+        evidence: string[];
+        unrun_checks: string[];
+        risks: string[];
+    };
+};
+export declare function validateAgentReport(agent: string, report: unknown, card?: ExecutionCard): void;

package/dist/contracts.js

@@ -0,0 +1,102 @@
+import { validateExecutionCard } from "./routing.js";
+export const CONTRACT_SCHEMA_VERSION = 1;
+function object(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function strings(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+export function validateAgentReport(agent, report, card) {
+    if (!object(report))
+        throw new Error("agent report must be an object");
+    if (agent === "critic" && !card && "review_report" in report) {
+        validateAgentReport("review", report);
+        return;
+    }
+    const reportKey = agent === "architect" ? "execution_card" : `${agent}_report`;
+    if (Object.keys(report).length !== 1 || !(reportKey in report))
+        throw new Error(`${agent} report has an invalid envelope`);
+    const value = report[reportKey];
+    if (!object(value))
+        throw new Error(`missing ${agent}_report`);
+    if (value.schema_version !== CONTRACT_SCHEMA_VERSION)
+        throw new Error(`${agent} report schema version is unsupported`);
+    if (agent === "mapper") {
+        for (const key of ["paths", "callers", "tests", "patterns"])
+            if (!Array.isArray(value[key]))
+                throw new Error(`mapper report field is invalid: ${key}`);
+        if (Object.keys(value).some((key) => !["schema_version", "paths", "callers", "tests", "patterns", "evidence_gaps"].includes(key)))
+            throw new Error("mapper report contains unknown fields");
+        if (!strings(value.evidence_gaps))
+            throw new Error("mapper report evidence_gaps is invalid");
+    }
+    else if (agent === "architect") {
+        if (value.status === "NEEDS_EVIDENCE")
+            return;
+        const result = validateExecutionCard(value);
+        if (!result.valid)
+            throw new Error(`architect execution card is invalid: ${result.failedField}`);
+    }
+    else if (agent === "worker") {
+        if (!strings(value.changed_files) ||
+            !Array.isArray(value.checks) ||
+            typeof value.writes_performed !== "boolean" ||
+            !strings(value.risks))
+            throw new Error("worker report is invalid");
+        if (Object.keys(value).some((key) => ![
+            "schema_version",
+            "status",
+            "card_id",
+            "revision",
+            "changed_files",
+            "checks",
+            "writes_performed",
+            "risks",
+        ].includes(key)))
+            throw new Error("worker report contains unknown fields");
+        if (value.status === "COMPLETED" &&
+            (value.writes_performed !== true ||
+                value.checks.some((check) => check.status !== "passed")))
+            throw new Error("completed worker report has incomplete checks");
+        if (card && value.changed_files.some((path) => !card.write_set.includes(path)))
+            throw new Error("worker report writes outside execution card");
+    }
+    else if (agent === "review" || agent === "critic") {
+        if (!["APPROVED", "CHANGES_REQUIRED"].includes(String(value.status)) ||
+            !Array.isArray(value.findings) ||
+            (typeof value.target !== "string" && agent === "review"))
+            throw new Error(`${agent} report is invalid`);
+        if (agent === "review" &&
+            (!Array.isArray(value.checks) ||
+                !strings(value.checks) ||
+                !strings(value.risks) ||
+                !strings(value.evidence) ||
+                !value.target))
+            throw new Error("review report fields are invalid");
+        if (agent === "critic" &&
+            (typeof value.card_id !== "string" ||
+                !Number.isInteger(value.revision) ||
+                !strings(value.unrun_checks) ||
+                !strings(value.risks) ||
+                !strings(value.evidence)))
+            throw new Error("critic report fields are invalid");
+        const allowed = agent === "review"
+            ? ["schema_version", "status", "target", "findings", "evidence", "checks", "risks"]
+            : [
+                "schema_version",
+                "status",
+                "card_id",
+                "revision",
+                "findings",
+                "evidence",
+                "unrun_checks",
+                "risks",
+            ];
+        if (Object.keys(value).some((key) => !allowed.includes(key)))
+            throw new Error(`${agent} report contains unknown fields`);
+    }
+    else
+        throw new Error(`unknown report agent: ${agent}`);
+    if (card && (value.card_id !== card.card_id || value.revision !== card.revision))
+        throw new Error("agent report does not match execution card");
+}