@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/policy-packs/builtin/post-merge-gate.js

@@ -1,347 +0,0 @@
-// Builtin Policy Pack: `post-merge-gate`.
-//
-// Catches the "kept working on a branch after it was already merged"
-// pattern: an agent (or operator) merges a PR via `gh pr merge`, then
-// keeps committing / pushing / rebasing on the SAME local checkout
-// without switching back to the default branch first — silently
-// building on top of a commit that is already integrated, which either
-// produces a confusing duplicate-merge PR or loses the new work off the
-// side of a branch nobody looks at again.
-//
-// Mechanics, mirroring `branch-protection` (see that pack's header for
-// the identical two-hook shape):
-//
-//   1. PostToolUse producer (`harness pack hook post-merge-gate-record`)
-//      watches every Bash call and, ONLY when the command matched
-//      `gh pr merge` AND the merge is CONFIRMED, writes a
-//      `post-merge-gate:merged:<repo>:<branch>:<sha>` fact (plus PR
-//      number and timestamp, audit-only) to the evidence ledger — `sha`
-//      being the LOCAL branch tip observed right after the merge, which
-//      is the exact commit that got merged (`gh pr merge` merges on the
-//      remote side; it does not move the local tip). Confirmation is
-//      DUAL-CONTRACT (payload-reality follow-up, 2026-07): a `tool_output.
-//      exit_code === 0` (Contract A) is NOT reliably present — live
-//      verification against a real Claude Code 2.1.218 install found the
-//      PostToolUse Bash payload carries no `tool_output` / exit-code field
-//      at all, only `tool_response` (`{ stdout, stderr, interrupted,
-//      isImage, noOutputExpected }`) — so a `gh pr merge` success sentence
-//      match against `tool_response` (Contract B) is the fallback that
-//      makes the producer fire at all on that install. See
-//      `resolveMergeConfirmation` in post-merge-gate-runtime.ts for the
-//      exact dual-contract / "Contract A wins" ordering. Payload reads are
-//      defensive throughout: an unexpected shape on either contract writes
-//      nothing.
-//
-//   2. PreToolUse blocker (`harness pack hook post-merge-gate`) checks a
-//      CURATED list of history-mutating commands (see
-//      post-merge-gate-runtime.ts for the exact list) and denies them
-//      when the CURRENT branch tip still equals a recorded merged tip
-//      for this repo+branch — an exact sha match, not ancestry, so a new
-//      commit (moving the tip) or a recycled branch name (a different
-//      tip) both fall silently outside the gate. GATE-ELIGIBILITY is
-//      classified FIRST, before any manifest load or ledger query, so
-//      the recovery vocabulary (git switch/checkout/pull/fetch, git
-//      branch -d/-D, git stash list/show, any `harness ...` command) can
-//      never be starved by an unrelated failure — none of those verbs is
-//      a curated mutation. Task 19356be7: DENY WINS when one command
-//      chains recovery vocabulary with a curated mutation; the escape
-//      list no longer short-circuits the whole command string.
-//
-// Fails OPEN when the ledger is unreachable (unlike branch-protection's
-// fail-closed posture): without the ledger, "merged" and "not merged"
-// are indistinguishable, and fail-closed here would block ordinary git
-// history work on every branch whenever grounding-mcp hiccups. This pack
-// is advisory-strength against a hostile agent, like the other
-// `requires.ledger_tag`-style gates (docs/okf/evidence-ledger-trust-boundary.md);
-// see post-merge-gate-runtime.ts's header for the full rationale.
-//
-// No auto-switch: the blocker only ever recommends the recovery commands
-// in its deny message, never runs them (operator/agent decides).
-//
-// Enabled per-installation via `harness pack add post-merge-gate`. The
-// `full` init template wires it with `enabled: false` (opt-in — a fresh,
-// higher-risk gate; see templates.ts for the rationale), unlike
-// branch-protection's default-enabled precedent.
-//
-// Claude Code only in v1 (no Codex or opencode adapter): both hooks
-// match on the `Bash` tool name and classify by command text, a
-// mechanism that has no established Codex-adapter parity yet (mirrors
-// `solution-acceptance`, which ships with no Codex variant either) and
-// no meaning at all under opencode (no declarative hook/event field to
-// match against). `resolve()` warns whenever `runtime !== "claude-code"`
-// (batch18 fix-round, task f34eb233 — widened from a codex-only check
-// so opencode gets the same warning).
-import { z } from "zod";
-import { PolicyUxSchema } from "../../schema/policies.js";
-import { DEFAULT_RUNTIME } from "../runtime.js";
-import { CURATED_MUTATION_BASH_RE, ESCAPE_GIT_BASH_RE, ESCAPE_HARNESS_BASH_RE, GH_MERGE_SUCCESS_RE, GH_PR_MERGE_BASH_RE, MERGED_TAG_PREFIX, PACK_NAME, } from "./post-merge-gate-runtime.js";
-export { PACK_NAME };
-/**
- * Zod schema for this pack's `config:` block. Strict by design so
- * typo'd keys fail loud at lint time (mirrors sibling packs). `ux` is
- * the only operator-tunable key today — the curated mutation list and
- * escape allowlist are fixed in v1 (03-decisions.md); a config override
- * for either can land as a follow-up if operators need it.
- */
-export const configSchema = z
-    .object({
-    ux: PolicyUxSchema.optional(),
-})
-    .strict();
-/**
- * Shipped default `config.ux` for this pack. Canonical source for the
- * `full` init template and `harness pack reseed` (mirrors
- * branch-protection's `defaultUx`): a future wording fix lands here once
- * and reaches both a fresh `harness init --template full` and an
- * operator running `harness pack reseed post-merge-gate` against an
- * already-installed manifest. `${DEFAULT_BRANCH}` is always populated by
- * the blocker (falling back to the literal placeholder `<default-branch>`
- * when it cannot resolve `origin/HEAD`), never left as an unresolved
- * template var.
- */
-export function defaultUx() {
-    return {
-        cannot: "You cannot run ${TOOL_NAME} on branch ${BRANCH} yet — its current tip was already merged.",
-        required: [
-            "a branch tip that is not sitting at an already-merged commit (switch off `${BRANCH}`, or move its tip with a new commit)",
-        ],
-        run: [
-            "git switch ${DEFAULT_BRANCH}",
-            "git pull --ff-only",
-            "git branch -d ${BRANCH}  # optional cleanup",
-        ],
-    };
-}
-const HOOK_NAME_PREFIX = `policy-pack:${PACK_NAME}`;
-const PRODUCER_COMMAND = "harness pack hook post-merge-gate-record";
-const BLOCKER_COMMAND = "harness pack hook post-merge-gate";
-function buildHooks() {
-    return [
-        {
-            name: `${HOOK_NAME_PREFIX}:post-tool-use`,
-            event: "PostToolUse",
-            match: "Bash",
-            command: PRODUCER_COMMAND,
-            blocking: false,
-            budget_ms: 5000,
-            description: "Producer: on a `gh pr merge` Bash call that exited 0, write `post-merge-gate:merged:<repo>:<branch>:<sha>` to the evidence ledger. Non-blocking; any failure just leaves the gate silent for that merge.",
-        },
-        {
-            name: `${HOOK_NAME_PREFIX}:pre-tool-use`,
-            event: "PreToolUse",
-            match: "Bash",
-            command: BLOCKER_COMMAND,
-            blocking: "hard",
-            // 15000 (task 7bf47554): the blocker's own ledger query
-            // (queryLedgerByTag, src/cli/pack/hook-post-merge-gate.ts) is bounded
-            // by the grounding-mcp server's own `health.timeout_ms` (default
-            // 5000ms) — the same number the old budget_ms=5000 used for the
-            // outer Claude Code kill-timeout, leaving no margin. This gate
-            // already fails OPEN by design on a genuinely unreachable ledger
-            // (unlike branch-protection); raising the outer timeout does not
-            // change that posture, it only gives a merely-SLOW (not dead) ledger
-            // room to answer before the outer timeout could fire first and kill
-            // the subprocess mid-query, consistent with the other ledger-backed
-            // pack blockers.
-            budget_ms: 15000,
-            description: "Blocker: deny curated history-mutating Bash commands (git commit/add/push/merge/rebase/cherry-pick/revert/reset/stash pop|apply, gh pr create/merge) when the current branch tip matches a recorded merged tip. The recovery vocabulary (git switch/checkout/pull/fetch, git branch -d/-D, git stash list/show, any `harness ...` command) always passes as its own command, classified before any manifest or ledger access; chaining one of those with a curated mutation does NOT exempt the mutation. Fails open when the ledger is unreachable.",
-        },
-    ];
-}
-function buildInstructions(pack, runtime) {
-    const description = pack.description?.trim() ?? "";
-    return `# Policy Pack: ${PACK_NAME}
-
-> Operator audit copy. This pack denies curated history-mutating Bash
-> commands on a branch whose tip was already merged via \`gh pr merge\`,
-> closing the loop on the "kept working on a merged branch" incident
-> pattern.
-
-## Runtime
-
-${runtime}${runtime === "codex"
-        ? " (UNSUPPORTED — see \"Known gaps\" below; both hooks assume the Claude Code Bash tool surface)"
-        : runtime === "opencode"
-            ? " (UNSUPPORTED — see \"Known gaps\" below; opencode has no declarative hook/event wiring, so neither hook is projected into any opencode artefact)"
-            : ""}
-
-## Trigger + signals
-
-1. \`PostToolUse\` producer (\`${PRODUCER_COMMAND}\`, blocking: false) on
-   \`Bash\`: tests \`${GH_PR_MERGE_BASH_RE.source}\` against the raw command
-   and, only when that misses, against the three normalized forms
-   (\`normalizeCommand\`, \`normalizeCommandAmpAware\`,
-   \`normalizeCommandQuoteAware\`), in the same raw-first, lazy order as the
-   gate. Fires only on a CONFIRMED merge, via either of two contracts
-   (dual-contract, payload-reality follow-up — real Claude Code shims
-   have shipped both shapes in the wild):
-   - **Contract A** — \`tool_output.exit_code\` is the number \`0\`.
-   - **Contract B** — \`tool_response\` is present with
-     \`interrupted === false\` AND its \`stdout\`+\`stderr\` contain \`gh pr
-     merge\`'s own past-tense success sentence: \`${GH_MERGE_SUCCESS_RE.source}\`
-     (covers all three merge methods: Squashed / Rebased / plain Merged).
-     Verified against the installed \`gh\` binary (v2.94.0,
-     \`pkg/cmd/pr/merge/merge.go\` lines 369-376): the line is built as
-     \`infof("%s %s pull request %s#%d (%s)", icon, action,
-     ghrepo.FullName(baseRepo), pr.Number, pr.Title)\` — the repo
-     fullname sits between "pull request" and the PR number, GLUED to
-     \`#\` with no space (e.g. \`Squashed and merged pull request
-     owner/repo#65 (title)\`), and \`infof\` writes to \`gh\`'s STDERR,
-     which is why this contract checks the concatenated
-     \`stdout\`+\`stderr\`, not stdout alone.
-   Contract A wins whenever it resolves to ANY definite verdict, success
-   OR failure — a well-formed non-zero \`exit_code\` short-circuits
-   WITHOUT consulting Contract B. Contract B is tried only when Contract
-   A's \`exit_code\` is entirely unresolvable (missing field, wrong
-   shape, or genuinely absent — as verified live against Claude Code
-   2.1.218, whose real PostToolUse Bash payload carries NO \`tool_output\`
-   / no exit-code field at all, only \`tool_response\`; the
-   \`tool_output.exit_code\` shape appears to describe a different,
-   possibly newer, Claude Code contract). Any other shape on either
-   contract writes NO fact; fail-safe against a false "merged" record.
-   On a confirmed match, records
-   \`${MERGED_TAG_PREFIX}:<repo>:<branch>:<sha>[ pr:<n>] at:<iso>\` to the
-   evidence ledger, where \`<sha>\` is the LOCAL branch tip observed right
-   after the merge (the exact commit that got merged — \`gh pr merge\`
-   merges remote-side and does not itself move the local tip). \`<n>\`
-   prefers extraction from the \`gh pr merge\` command itself, falling
-   back to the number captured out of the Contract-B success sentence.
-
-2. \`PreToolUse\` blocker (\`${BLOCKER_COMMAND}\`, blocking: hard) on
-   \`Bash\`: checked in this order —
-   a. **Gate-eligibility classification first, unconditionally** (before
-      any manifest load or ledger query): the curated mutation matcher
-      \`${CURATED_MUTATION_BASH_RE.source}\`. Commands it
-      does not match pass through untouched — that unconditionally covers the whole recovery
-      vocabulary (\`${ESCAPE_GIT_BASH_RE.source}\` and
-      \`${ESCAPE_HARNESS_BASH_RE.source}\`), since none of those verbs are
-      curated mutations. **Deny wins over the recovery vocabulary** when
-      one command chains both (task 19356be7): \`harness preflight &&
-      git push\` is judged by its push half, not exempted by its
-      preflight half.
-   b. **Ledger check**: denies only when the current branch tip exactly
-      equals a recorded \`${MERGED_TAG_PREFIX}:<repo>:<branch>:<sha>\` fact
-      for this repo+branch. A new commit moves the tip (gate falls
-      silent — that's legitimate continued work); a recycled branch name
-      has a different tip (no false positive). No freshness window is
-      needed as a result.
-
-## Escape hatches
-
-- **Recovery path** (named in every deny message): \`git switch
-  <default-branch>\`, then \`git pull --ff-only\`, then optionally
-  \`git branch -d <branch>\` to clean up the merged local branch.
-- **Read-only / inspection commands** (\`git switch\`/\`checkout\`,
-  \`pull\`/\`fetch\`, \`branch -d\`/\`-D\`, \`stash list\`/\`show\`, and any
-  \`harness ...\` invocation) always pass **as their own commands**,
-  independent of ledger reachability — the gate can never itself become
-  the reason the recovery path is unavailable. Chaining one of them with
-  a curated mutation does NOT exempt the mutation (the pre-19356be7
-  escape-first ordering did, which let the documented
-  preflight-then-push workflow skip the gate entirely).
-
-## Known gaps (documented, not attempted in v1)
-
-- **MCP merge path**: \`mcp__agent-tasks__pull_requests_merge\` is NOT a
-  producer trigger. Only the \`gh pr merge\` Bash surface is watched;
-  merges done through the agent-tasks MCP tool leave no
-  \`${MERGED_TAG_PREFIX}\` fact, so the blocker never fires for that
-  branch. Left as a documented gap (spec decision), not silently faked
-  as covered.
-- **Regex-vs-shell-eval residual**: same class of gap as every other
-  \`bash_match\`-style matcher in this codebase (branch-protection,
-  solution-acceptance, the kill-switch deny policies) — a heredoc,
-  \`sh -c\`, \`eval\`, or similarly indirected command defeats the TRIGGER
-  match before either hook ever runs. Not attempted to close here.
-- **Curated scope, not every Bash command**: destructive non-git
-  commands on a just-merged branch (e.g. hand-editing files outside
-  git's own history primitives) are out of v1 scope, mirroring
-  branch-protection's documented scope-cut.
-- **Chained-escape bypass — CLOSED (task 19356be7)**: the original
-  escape-first ordering matched the escape list against the WHOLE
-  command string, so a curated mutation chained with an escape verb
-  (\`harness preflight && git push\`, \`git commit -am x && git switch
-  main\`) skipped the gate entirely. The blocker now classifies by the
-  curated mutation match alone (deny wins; measured 0-divergent from
-  per-clause evaluation thanks to the escape/deny verb disjointness —
-  escape-at-start-only was measured and rejected, it still exempts three
-  of the four lines this closed).
-  Residual, measured and accepted: a deny verb as quoted TEXT in a
-  chain (\`git pull && echo 'a && git push'\`) is gate-eligible even
-  though bash never runs it — the existing accepted false-positive
-  class, no longer rescued by a chained escape verb.
-- **Inverted trust-boundary residual**: a merged fact written by any
-  means OTHER than the producer (e.g. directly via
-  \`mcp__grounding-mcp__ledger_add\`) that happens to exactly match the
-  CURRENT \`repo:branch:sha\` triple denies curated mutations on that
-  branch — recoverable via any escape command or by making a new commit
-  (which moves the tip and the fact no longer matches). A fact for a
-  different \`repo:branch:sha\` triple is inert; this is availability-only
-  (a spurious deny, always escapable), never a privilege the agent gains,
-  consistent with docs/okf/evidence-ledger-trust-boundary.md.
-- **Contract B is coupled to \`gh\`'s current wording**: \`${GH_MERGE_SUCCESS_RE.source}\`
-  matches \`gh\`'s OWN past-tense success sentence, verbatim, as verified
-  against the installed \`gh\` v2.94.0 source
-  (\`pkg/cmd/pr/merge/merge.go\` lines 369-376). A future \`gh\` release
-  that rephrases that sentence makes
-  Contract B silently, FAIL-SAFELY inert on installs that never send
-  \`tool_output.exit_code\` (Contract A stays available wherever it's
-  actually sent) — never a false "merged" record, but the blocker also
-  never fires for that merge. Not attempted to close here (would need a
-  \`gh\` wire-format contract, e.g. \`--json\`, out of this pack's Bash-text
-  matching design). Verification path after upgrading \`gh\`: merge a
-  throwaway PR and check for a fresh \`${MERGED_TAG_PREFIX}\` fact in the
-  evidence ledger.
-- **No Codex adapter**: see "Runtime" above.
-- **No opencode adapter**: see "Runtime" above; opencode has no
-  declarative hook/event field (only a JS/TS plugin API), so neither
-  the producer nor the blocker hook above is ever projected into the
-  generated opencode artefact (\`harness.generated/opencode/opencode.json\`)
-  — this pack has no effect at all under \`--runtime opencode\`.
-
-## Fail posture
-
-Fails OPEN (allows, with a stderr warning) when the evidence ledger is
-unreachable — deliberately the OPPOSITE of branch-protection's
-fail-closed posture, because without the ledger "merged" and "not
-merged" are indistinguishable, and fail-closed here would block ordinary
-git history work on every branch whenever grounding-mcp hiccups. This
-pack is advisory-strength against a hostile agent, like the other
-\`requires.ledger_tag\`-style gates
-(docs/okf/evidence-ledger-trust-boundary.md).
-
-## Pack metadata
-${description ? `\n> ${description.replace(/\n/g, "\n> ")}\n` : ""}
-- Source: \`builtin\`
-- Pack: \`${PACK_NAME}\`
-- Runtime: \`${runtime}\`
-`;
-}
-export function resolve(pack, runtime = DEFAULT_RUNTIME) {
-    const hooks = buildHooks();
-    const files = [
-        {
-            relativePath: `policy-packs/${PACK_NAME}/instructions.md`,
-            content: buildInstructions(pack, runtime),
-        },
-    ];
-    const warnings = [];
-    // HIGH-F1 (batch18 fix-round, task f34eb233): widened from
-    // `runtime === "codex"` to `runtime !== "claude-code"` so opencode
-    // gets the same pack-level warning codex already got — before this,
-    // opencode silently fell through this check (it is neither
-    // "claude-code" nor, before the widening, matched by
-    // `runtime === "codex"`), losing both the UNSUPPORTED marker above
-    // AND this warning even though opencode has no hook wiring at all
-    // (strictly worse than codex, whose hooks are at least PROJECTED,
-    // just against the wrong tool-name surface).
-    if (runtime !== "claude-code") {
-        const detail = runtime === "codex"
-            ? "hooks are wired assuming the Claude Code Bash tool surface and will not fire correctly under a Codex runtime"
-            : "opencode has no declarative hook/event wiring, so neither hook is projected into any opencode artefact and this pack has no effect";
-        const adapterName = runtime === "codex" ? "Codex" : "opencode";
-        warnings.push(`policy_packs[${pack.name}]: post-merge-gate has no ${adapterName} adapter in v1; ${detail}.`);
-    }
-    return { contribution: { hooks, files }, warnings };
-}
-//# sourceMappingURL=post-merge-gate.js.map

package/dist/policy-packs/builtin/post-merge-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"post-merge-gate.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,uEAAuE;AACvE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,0DAA0D;AAC1D,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,2DAA2D;AAC3D,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,sDAAsD;AACtD,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,oEAAoE;AACpE,gEAAgE;AAChE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,sCAAsC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EACJ,2FAA2F;QAC7F,QAAQ,EAAE;YACR,0HAA0H;SAC3H;QACD,GAAG,EAAE;YACH,8BAA8B;YAC9B,oBAAoB;YACpB,6CAA6C;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAS,UAAU;IACjB,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,0MAA0M;SAC7M;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,wDAAwD;YACxD,sEAAsE;YACtE,iEAAiE;YACjE,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,iEAAiE;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,iBAAiB;YACjB,SAAS,EAAE,KAAK;YAChB,WAAW,EACT,shBAAshB;SACzhB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,SAAS;;;;;;;;;EASlC,OAAO,GACL,OAAO,KAAK,OAAO;QACjB,CAAC,CAAC,gGAAgG;QAClG,CAAC,CAAC,OAAO,KAAK,UAAU;YACtB,CAAC,CAAC,mJAAmJ;YACrJ,CAAC,CAAC,EACR;;;;iCAI+B,gBAAgB;uBAC1B,mBAAmB,CAAC,MAAM;;;;;;;;;;oDAUG,mBAAmB,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;OAsBvE,iBAAiB;;;;;;;+BAOO,eAAe;;;;UAIpC,wBAAwB,CAAC,MAAM;;sBAEnB,kBAAkB,CAAC,MAAM;UACrC,sBAAsB,CAAC,MAAM;;;;;;4BAMX,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;MAyBvC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAkCsC,mBAAmB,CAAC,MAAM;;;;;;;;;;;yCAW9C,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAqBxD,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;CACrB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;SAC1C;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,2DAA2D;IAC3D,mEAAmE;IACnE,oEAAoE;IACpE,2DAA2D;IAC3D,qDAAqD;IACrD,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,6CAA6C;IAC7C,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GACV,OAAO,KAAK,OAAO;YACjB,CAAC,CAAC,8GAA8G;YAChH,CAAC,CAAC,oIAAoI,CAAC;QAC3I,MAAM,WAAW,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/D,QAAQ,CAAC,IAAI,CACX,gBAAgB,IAAI,CAAC,IAAI,6BAA6B,WAAW,mBAAmB,MAAM,GAAG,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/policy-packs/builtin/solution-acceptance-reconnect.d.ts

@@ -1,50 +0,0 @@
-/** The grounding-mcp version this reconnect lifecycle was verified against. */
-export declare const RECONNECT_PRODUCER_FLOOR = "grounding-mcp >= 0.11.0";
-/** Rendered qualifier prefix both surfaces open the guidance with. */
-export declare const RECONNECT_VERSION_QUALIFIER = "With grounding-mcp >= 0.11.0:";
-export declare const RECONNECT_STATUS_TOOL = "mcp__grounding-mcp__solution_evaluate_status";
-export declare const RECONNECT_RESULT_TOOL = "mcp__grounding-mcp__solution_evaluate_result";
-export declare const RECONNECT_TASK_ID_PLACEHOLDER = "<task-id>";
-export declare const RECONNECT_POLL_MS_ADVERTISED = "5000ms";
-export declare const RECONNECT_RETENTION = "24h";
-export declare const RECONNECT_RETENTION_FLOOR = "100x pollAfterMs";
-/**
- * The three readings `gate.verdict === null` covers. The hook
- * (`classifyNullVerdictReading` / `readAttemptLockLiveness` in
- * `../../cli/pack/hook-solution-acceptance.ts`) reads the documented
- * attempt-lock anchor to rule two of the three out and select the one it
- * detected; this module only owns the wording listing them, consumed by
- * `renderReconnectDenyParagraph` below for its reading-(2)-only paragraph.
- */
-export declare const RECONNECT_THREE_READINGS_LABELS: readonly ["`solution_evaluate` was never called for \"<task-id>\"", "a `solution_evaluate` call for it is still running in the background", "a marker path exists but what is there was not accepted as a verdict"];
-/** Fact 1: reconnect by attempt id, not by starting a fresh call. */
-export declare const RECONNECT_FACT_RECONNECT_BY_ID: string;
-/**
- * Fact 2: never retry while the lock is held; a second call JOINS, it does
- * not refuse. It deliberately begins lowercase because each renderer owns
- * its own lead-in sentence.
- */
-export declare const RECONNECT_FACT_JOIN_NOT_RETRY: string;
-/**
- * Fact 3: poll interval and retention bounds, from the released
- * grounding-mcp version. Both renderers use this fact as a fresh sentence
- * (after a period), so it is capitalized.
- */
-export declare const RECONNECT_FACT_POLL_AND_RETENTION: string;
-/**
- * Compact paragraph appended to the completion-gate's deny reason
- * (`blockJson` in hook-solution-acceptance.ts) when `gate.verdict ===
- * null` AND the hook detected reading (2), a live attempt-lock
- * (`reconnectGuidanceFor`). Renders the SAME fact constants as
- * `renderReconnectInstructionsSection` below.
- */
-export declare function renderReconnectDenyParagraph(taskId: string): string;
-/**
- * "Reconnecting vs. retrying" section body rendered into the pack's
- * `instructions.md` operator audit copy (`buildInstructions` in
- * solution-acceptance.ts). Renders the SAME fact constants as
- * `renderReconnectDenyParagraph` above; a large repo can outlive a single
- * `solution_evaluate` call, so this section documents reconnecting to an
- * in-flight attempt rather than treating a timeout as a stall to retry.
- */
-export declare function renderReconnectInstructionsSection(): string;

package/dist/policy-packs/builtin/solution-acceptance-reconnect.js

@@ -1,151 +0,0 @@
-// Reconnect-vs-retry facts for the `solution-acceptance` pack (task
-// 5c9cad05), owned as DATA in exactly one place so the two rendered
-// surfaces cannot drift apart the way they did across review rounds 1-2:
-//
-//   1. `buildInstructions` (solution-acceptance.ts) renders the operator
-//      audit copy's "Reconnecting vs. retrying" section from
-//      `renderReconnectInstructionsSection`.
-//   2. `blockJson` (../../cli/pack/hook-solution-acceptance.ts) renders the
-//      agent-facing deny paragraph from `renderReconnectDenyParagraph`,
-//      shown only when `gate.verdict === null` AND the hook detected
-//      reading (2), a live attempt-lock (see `reconnectGuidanceFor` in
-//      hook-solution-acceptance.ts; the three readings are listed in
-//      `RECONNECT_THREE_READINGS_LABELS`
-//      below).
-//
-// Both renderers are built from the SAME fact constants below (not just
-// the same values restated in prose twice), and
-// `tests/policy-packs/solution-acceptance-reconnect.test.ts` asserts each
-// fact constant appears verbatim in both rendered surfaces, so a future
-// edit that updates one surface but not the other fails that test instead
-// of shipping a silent drift.
-//
-// Scope: this module documents grounding-mcp's ATTEMPT lifecycle
-// (`solution_evaluate_status` / `solution_evaluate_result`, `attemptId`,
-// `pollAfterMs`, retention), which the pack's producer floor (>= 0.3.2)
-// does not itself guarantee (that lifecycle shipped in grounding-mcp
-// 0.11.0), so every rendering below is explicitly qualified with
-// `RECONNECT_VERSION_QUALIFIER` rather than stated as if it held
-// unconditionally under the pack's own (older) producer floor.
-//
-// grounding-mcp's README also documents an attempt-lock anchor
-// (`<verdict dir>/<id>.attempt-lock`, beside the
-// `<id>.attempt-lock.lock` directory `proper-lockfile` manages, from
-// which the producer itself derives its own `running-unconfirmed`
-// status). The anchor IS read: `classifyNullVerdictReading` /
-// `readAttemptLockLiveness` in `../../cli/pack/hook-solution-acceptance.ts`
-// read it to rule two of the three readings below out and select the
-// one it detected (harness/799de976). This module does not touch the
-// filesystem itself; it only owns the WORDING both rendered surfaces
-// share, including `renderReconnectDenyParagraph`'s reading-(2)-only
-// paragraph below, which the hook appends solely when it has detected
-// the live-attempt reading.
-/** The grounding-mcp version this reconnect lifecycle was verified against. */
-export const RECONNECT_PRODUCER_FLOOR = "grounding-mcp >= 0.11.0";
-/** Rendered qualifier prefix both surfaces open the guidance with. */
-export const RECONNECT_VERSION_QUALIFIER = `With ${RECONNECT_PRODUCER_FLOOR}:`;
-export const RECONNECT_STATUS_TOOL = "mcp__grounding-mcp__solution_evaluate_status";
-export const RECONNECT_RESULT_TOOL = "mcp__grounding-mcp__solution_evaluate_result";
-export const RECONNECT_TASK_ID_PLACEHOLDER = "<task-id>";
-export const RECONNECT_POLL_MS_ADVERTISED = "5000ms";
-export const RECONNECT_RETENTION = "24h";
-export const RECONNECT_RETENTION_FLOOR = "100x pollAfterMs";
-/**
- * The three readings `gate.verdict === null` covers. The hook
- * (`classifyNullVerdictReading` / `readAttemptLockLiveness` in
- * `../../cli/pack/hook-solution-acceptance.ts`) reads the documented
- * attempt-lock anchor to rule two of the three out and select the one it
- * detected; this module only owns the wording listing them, consumed by
- * `renderReconnectDenyParagraph` below for its reading-(2)-only paragraph.
- */
-export const RECONNECT_THREE_READINGS_LABELS = [
-    `\`solution_evaluate\` was never called for "${RECONNECT_TASK_ID_PLACEHOLDER}"`,
-    "a `solution_evaluate` call for it is still running in the background",
-    "a marker path exists but what is there was not accepted as a verdict",
-];
-/** Fact 1: reconnect by attempt id, not by starting a fresh call. */
-export const RECONNECT_FACT_RECONNECT_BY_ID = `poll \`${RECONNECT_STATUS_TOOL}\` /\n` +
-    `\`${RECONNECT_RESULT_TOOL}\` for the SAME \`id\`,\n` +
-    `passing the \`attemptId\` you were given (or omitting it to resolve the latest attempt,\n` +
-    `the recovery path when your own call timed out before it ever returned one)`;
-/**
- * Fact 2: never retry while the lock is held; a second call JOINS, it does
- * not refuse. It deliberately begins lowercase because each renderer owns
- * its own lead-in sentence.
- */
-export const RECONNECT_FACT_JOIN_NOT_RETRY = `a second \`solution_evaluate\` call for an \`id\` whose attempt is still live just joins\n` +
-    `that attempt and returns its \`attemptId\`, never starting a second \`preflight\` run;\n` +
-    `only \`forceNewAttempt\` is refused while that attempt's lock holds`;
-/**
- * Fact 3: poll interval and retention bounds, from the released
- * grounding-mcp version. Both renderers use this fact as a fresh sentence
- * (after a period), so it is capitalized.
- */
-export const RECONNECT_FACT_POLL_AND_RETENTION = `Wait at least the returned \`pollAfterMs\` (advertised as \`${RECONNECT_POLL_MS_ADVERTISED}\`)\n` +
-    `between polls; attempt records are retained \`${RECONNECT_RETENTION}\` by default (always at\n` +
-    `least \`${RECONNECT_RETENTION_FLOOR}\`), and a pruned terminal attempt\n` +
-    `reads \`expired\``;
-/** The three readings, as one clause, with the task id interpolated. */
-function threeReadingsClause(taskId) {
-    const [neverCalled, stillRunning, unreadable] = RECONNECT_THREE_READINGS_LABELS;
-    return [
-        neverCalled.replace(RECONNECT_TASK_ID_PLACEHOLDER, taskId),
-        stillRunning,
-        `or ${unreadable}`,
-    ].join(",\n");
-}
-/**
- * Compact paragraph appended to the completion-gate's deny reason
- * (`blockJson` in hook-solution-acceptance.ts) when `gate.verdict ===
- * null` AND the hook detected reading (2), a live attempt-lock
- * (`reconnectGuidanceFor`). Renders the SAME fact constants as
- * `renderReconnectInstructionsSection` below.
- */
-export function renderReconnectDenyParagraph(taskId) {
-    return `\n${[
-        `Reconnecting vs. retrying. ${RECONNECT_VERSION_QUALIFIER} this same`,
-        `"no readable verdict marker" case covers three readings:`,
-        threeReadingsClause(taskId),
-        `(the verdict marker only appears once an attempt finishes, and is validated on read;`,
-        `this hook read the documented attempt-lock anchor and is showing you this paragraph`,
-        `because it detected reading (2): an attempt is still live). If you already called`,
-        `\`solution_evaluate\` for this \`id\`, do not call it again:`,
-        `${RECONNECT_FACT_RECONNECT_BY_ID}.`,
-        `Never re-call \`solution_evaluate\`:`,
-        `${RECONNECT_FACT_JOIN_NOT_RETRY}.`,
-        `${RECONNECT_FACT_POLL_AND_RETENTION}.`,
-    ].join("\n")}\n`;
-}
-/**
- * "Reconnecting vs. retrying" section body rendered into the pack's
- * `instructions.md` operator audit copy (`buildInstructions` in
- * solution-acceptance.ts). Renders the SAME fact constants as
- * `renderReconnectDenyParagraph` above; a large repo can outlive a single
- * `solution_evaluate` call, so this section documents reconnecting to an
- * in-flight attempt rather than treating a timeout as a stall to retry.
- */
-export function renderReconnectInstructionsSection() {
-    return `## Reconnecting vs. retrying (${RECONNECT_PRODUCER_FLOOR})
-
-${RECONNECT_VERSION_QUALIFIER} a large repo can outlive the call: \`solution_evaluate\` may
-hand back \`{status: "running", attemptId, id, pollAfterMs}\` instead of a verdict, or your
-own call may time out with nothing at all. Either way the \`preflight\` run keeps going in
-the background; reconnect as follows:
-${RECONNECT_FACT_RECONNECT_BY_ID}.
-
-Never re-call \`solution_evaluate\` as a stall workaround:
-${RECONNECT_FACT_JOIN_NOT_RETRY}.
-A prior attempt's reported status (\`completed\`,
-\`failed\`, \`unknown\`, or \`expired\`) is informational, not the gate: \`unknown\`/
-\`expired\` never license a new attempt by themselves while another process still holds the
-id's lock. A genuinely new attempt becomes possible only once the previous one is terminal and
-the id's lock is free again, at which point an ordinary \`solution_evaluate\` call starts
-one.
-
-${RECONNECT_FACT_POLL_AND_RETENTION}. \`running-unconfirmed\` still means keep
-polling, not stall or escalate: it resolves by itself, into \`running\`
-or once the lock is reclaimed as stale. Never escalate to a human before
-the poll hint has elapsed.
-`;
-}
-//# sourceMappingURL=solution-acceptance-reconnect.js.map

package/dist/policy-packs/builtin/solution-acceptance-reconnect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"solution-acceptance-reconnect.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/solution-acceptance-reconnect.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAC7D,6CAA6C;AAC7C,4EAA4E;AAC5E,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,yCAAyC;AACzC,eAAe;AACf,EAAE;AACF,wEAAwE;AACxE,gDAAgD;AAChD,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,8BAA8B;AAC9B,EAAE;AACF,iEAAiE;AACjE,yEAAyE;AACzE,wEAAwE;AACxE,qEAAqE;AACrE,iEAAiE;AACjE,iEAAiE;AACjE,+DAA+D;AAC/D,EAAE;AACF,+DAA+D;AAC/D,iDAAiD;AACjD,qEAAqE;AACrE,kEAAkE;AAClE,8DAA8D;AAC9D,4EAA4E;AAC5E,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,4BAA4B;AAE5B,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAElE,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,wBAAwB,GAAG,CAAC;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,8CAA8C,CAAC;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,8CAA8C,CAAC;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAG,WAAW,CAAC;AAEzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,+CAA+C,6BAA6B,GAAG;IAC/E,sEAAsE;IACtE,sEAAsE;CAC9D,CAAC;AAEX,qEAAqE;AACrE,MAAM,CAAC,MAAM,8BAA8B,GACzC,UAAU,qBAAqB,QAAQ;IACvC,KAAK,qBAAqB,2BAA2B;IACrD,2FAA2F;IAC3F,6EAA6E,CAAC;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,4FAA4F;IAC5F,0FAA0F;IAC1F,qEAAqE,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,+DAA+D,4BAA4B,OAAO;IAClG,iDAAiD,mBAAmB,4BAA4B;IAChG,WAAW,yBAAyB,sCAAsC;IAC1E,mBAAmB,CAAC;AAEtB,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,+BAA+B,CAAC;IAChF,OAAO;QACL,WAAW,CAAC,OAAO,CAAC,6BAA6B,EAAE,MAAM,CAAC;QAC1D,YAAY;QACZ,MAAM,UAAU,EAAE;KACnB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,KAAK;QACV,8BAA8B,2BAA2B,YAAY;QACrE,0DAA0D;QAC1D,mBAAmB,CAAC,MAAM,CAAC;QAC3B,sFAAsF;QACtF,qFAAqF;QACrF,mFAAmF;QACnF,8DAA8D;QAC9D,GAAG,8BAA8B,GAAG;QACpC,sCAAsC;QACtC,GAAG,6BAA6B,GAAG;QACnC,GAAG,iCAAiC,GAAG;KACxC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,wBAAwB;;EAEhE,2BAA2B;;;;EAI3B,8BAA8B;;;EAG9B,6BAA6B;;;;;;;;EAQ7B,iCAAiC;;;;CAIlC,CAAC;AACF,CAAC"}