@linzumi/cli 1.0.110 → 1.0.112

package/scripts/build-core-supervisor-parity-oracle.mjs

@@ -0,0 +1,734 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 10, commander-core / supervisor).
+// Relationship: Builds the TS-side PARITY ORACLE for the `connect
+// --supervise` supervisor port (src/supervisor.ts -> ReScript
+// CommanderSupervisor), the sibling of build-pipeline-parity-oracle.mjs
+// (cluster 9). The oracle bundles the REAL supervisor module - the flag
+// helpers, the code fingerprint, the supervisor lock (real fs on a scratch
+// dir, byte-compared records), the console logger + signal disposition, the
+// gone-TTY write-guard slice of ttyTeardownGuard.ts, the runSuperviseLoop
+// refusal legs, and createSupervisor (THE state machine) driven through
+// fully scripted deps: a scripted scheduler/clock (the scriptedTimers
+// pattern), a scripted child-process seam (ops declare exits with
+// codes/signals and IPC frames; spawns/kills/sends land in the trace), and
+// scripted probe/install/fingerprint/reexec seams - behind the one-shot
+// stdin/stdout JSON batch driver. Every supervision run returns the FULL
+// trace (spawn calls with argv/env deltas, signals sent, timer set/clear,
+// log events, store writes) for byte comparison.
+//
+// Determinism: clocks are injected per case; timers fire in scheduling
+// order once the scripted clock passes their due instant, with a full
+// microtask settle between fires and between ops (both drivers settle
+// identically, so async update-check chains interleave identically); the
+// only non-injectable TS timestamp (the lock record's startedAt) is pinned
+// with a scoped global-Date override, the cluster 2 oracle's technique.
+//
+// SECRETS: the oracle only ever sees the conformance suite's synthetic
+// argv/env/payloads. The output is a local test artifact (.differential/
+// is gitignored, never published) and stays unminified for debuggability.
+import { mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import {
+  acquireSupervisorLock,
+  createSupervisor,
+  createSupervisorConsoleLogger,
+  defaultSupervisorReexecStatePath,
+  defaultSupervisorTiming,
+  hasSuperviseFlag,
+  installSupervisorSignalHandlers,
+  isSupervisedChild,
+  runSuperviseLoop,
+  supervisedChildEnvKey,
+  supervisorCodeFingerprint,
+  supervisorLockKey,
+  supervisorLockPath,
+  withoutSuperviseFlags,
+} from './src/supervisor';
+import {
+  defaultGenerationStillbornWindowMs,
+  generationEpochEnvKey,
+  generationHandoffPidEnvKey,
+  generationOverlapFlagEnvKey,
+} from './src/generationOverlap';
+import { defaultLinzumiWebSocketUrl } from './src/defaultUrls';
+import {
+  goneTtyErrorCode,
+  goneTtyWriteErrorCode,
+  guardStreamWriteAgainstGoneTty,
+  streamGoneTtyWriteCodeForTest,
+} from './src/ttyTeardownGuard';
+
+const RealDate = Date;
+
+function withPinnedDate(nowMs, fn) {
+  class PinnedDate extends RealDate {
+    constructor(...args) {
+      if (args.length === 0) {
+        super(nowMs);
+      } else {
+        super(...args);
+      }
+    }
+  }
+  PinnedDate.now = () => nowMs;
+  globalThis.Date = PinnedDate;
+  try {
+    return fn();
+  } finally {
+    globalThis.Date = RealDate;
+  }
+}
+
+const settle = () => new Promise((resolve) => setImmediate(resolve));
+
+// --- Scripted scheduler (the scriptedTimers pattern; ids in creation order) ---
+
+function scriptedScheduler(clock, trace) {
+  let nextId = 1;
+  const pending = [];
+  return {
+    scheduler: {
+      setTimeout: (callback, ms) => {
+        const id = nextId;
+        nextId += 1;
+        trace.push({ t: 'timer_set', id, delayMs: ms });
+        pending.push({ id, dueAtMs: clock.nowMs + ms, callback });
+        return id;
+      },
+      clearTimeout: (handle) => {
+        const index = pending.findIndex((timer) => timer.id === handle);
+        if (index >= 0) {
+          trace.push({ t: 'timer_clear', id: pending[index].id });
+          pending.splice(index, 1);
+        }
+      },
+    },
+    fireNextDue: () => {
+      const index = pending.findIndex((timer) => timer.dueAtMs <= clock.nowMs);
+      if (index < 0) return false;
+      const timer = pending.splice(index, 1)[0];
+      trace.push({ t: 'timer_fire', id: timer.id });
+      timer.callback();
+      return true;
+    },
+  };
+}
+
+// --- The scripted supervision run --------------------------------------------------
+
+async function runSupervisionCase(caseInput) {
+  // The TS serial drain reads process.platform at drain time (the win32
+  // SIGTERM fallback); the ReScript port injects isWin32. Pin the live
+  // platform for win32 cases so both impls run the same branch.
+  const platformDescriptor = Object.getOwnPropertyDescriptor(process, 'platform');
+  if (caseInput.win32 === true) {
+    Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+  }
+  try {
+    return await runSupervisionCaseInner(caseInput);
+  } finally {
+    if (caseInput.win32 === true && platformDescriptor !== undefined) {
+      Object.defineProperty(process, 'platform', platformDescriptor);
+    }
+  }
+}
+
+async function runSupervisionCaseInner(caseInput) {
+  const clock = { nowMs: caseInput.startMs ?? 0 };
+  const trace = [];
+  const timers = scriptedScheduler(clock, trace);
+  const children = [];
+  const entryBytes = new Map(Object.entries(caseInput.entryBytes ?? {}));
+  let probeState = { kind: 'none' };
+  let installState = { kind: 'none' };
+  let storedAttempt = caseInput.attemptRecord ?? undefined;
+
+  const initialEntryPath = caseInput.initialEntryPath ?? '/stable/v-base/bin/linzumi.js';
+  const childArgs = caseInput.childArgs ?? ['--workspace', 'ws-parity'];
+
+  const supervisor = createSupervisor({
+    childArgs,
+    initialEntryPath,
+    initialVersion: caseInput.initialVersion ?? '1.0.0',
+    ownEntryPath:
+      caseInput.ownEntryPath === null
+        ? undefined
+        : (caseInput.ownEntryPath ?? initialEntryPath),
+    spawnChild: ({ entryPath, childArgs: spawnArgs, onExit, generation }) => {
+      const index = children.length;
+      const pid = 4200 + index;
+      const record = { index, pid, alive: true, onExit, generation, sendOk: true };
+      children.push(record);
+      trace.push({
+        t: 'spawn',
+        index,
+        pid,
+        entryPath,
+        argv: [entryPath, 'connect', ...spawnArgs],
+        generation:
+          generation === undefined
+            ? null
+            : {
+                epoch: generation.epoch,
+                handoffFromPid: generation.handoffFromPid ?? null,
+                ipc: generation.onMessage !== undefined,
+              },
+        envDelta:
+          generation === undefined
+            ? { [supervisedChildEnvKey]: '1' }
+            : {
+                [supervisedChildEnvKey]: '1',
+                [generationEpochEnvKey]: String(generation.epoch),
+                ...(generation.handoffFromPid === undefined
+                  ? {}
+                  : {
+                      [generationHandoffPidEnvKey]: String(generation.handoffFromPid),
+                    }),
+              },
+      });
+      return {
+        pid,
+        kill: (signal) => trace.push({ t: 'kill', child: index, signal }),
+        ...(generation === undefined
+          ? {}
+          : {
+              send: (message) => {
+                trace.push({ t: 'send', child: index, message, ok: record.sendOk });
+                return record.sendOk;
+              },
+            }),
+      };
+    },
+    probeLatestVersion: async () => {
+      trace.push({ t: 'probe' });
+      if (probeState.kind === 'error') throw new Error(probeState.message);
+      return probeState.kind === 'version' ? probeState.version : undefined;
+    },
+    installVersion: async (version) => {
+      trace.push({ t: 'install', version });
+      if (installState.kind === 'error') throw new Error(installState.message);
+      if (installState.kind === 'entry') return { entryPath: installState.entryPath };
+      throw new Error('no scripted install result');
+    },
+    readEntryBytes: (entryPath) => {
+      trace.push({ t: 'read_bytes', path: entryPath });
+      return entryBytes.get(entryPath);
+    },
+    reexecSelf: ({ entryPath }) => trace.push({ t: 'reexec', entryPath }),
+    reexecAttemptStore: {
+      load: () => storedAttempt,
+      save: (record) => {
+        trace.push({ t: 'attempt_save', record });
+        storedAttempt = record;
+      },
+    },
+    log: (event, payload = {}) => trace.push({ t: 'log', event, payload }),
+    scheduler: timers.scheduler,
+    now: () => clock.nowMs,
+    timing: caseInput.timing ?? undefined,
+    ...(caseInput.overlap === undefined
+      ? {}
+      : {
+          generationOverlap: {
+            enabled: caseInput.overlap.enabled === true,
+            stillbornWindowMs: caseInput.overlap.stillbornWindowMs,
+          },
+        }),
+  });
+
+  const aliveChildren = () => children.filter((child) => child.alive);
+  const exitChild = (record, code, signal) => {
+    record.alive = false;
+    trace.push({ t: 'exit', child: record.index, code, signal });
+    record.onExit({ code, signal });
+  };
+  const ipcTo = (record, label, message) => {
+    if (
+      record === undefined ||
+      record.generation === undefined ||
+      record.generation.onMessage === undefined
+    ) {
+      trace.push({ t: 'ipc_no_channel', op: label });
+      return;
+    }
+    trace.push({ t: 'ipc', child: record.index, message });
+    record.generation.onMessage(message);
+  };
+
+  for (const op of caseInput.ops ?? []) {
+    switch (op.op) {
+      case 'start':
+        supervisor.start();
+        break;
+      case 'advance': {
+        clock.nowMs += op.byMs;
+        let fired = timers.fireNextDue();
+        while (fired) {
+          await settle();
+          fired = timers.fireNextDue();
+        }
+        break;
+      }
+      case 'exitNewest':
+      case 'exitOldest': {
+        const alive = aliveChildren();
+        const target = op.op === 'exitNewest' ? alive[alive.length - 1] : alive[0];
+        if (target === undefined) {
+          trace.push({ t: 'no_child', op: op.op });
+        } else {
+          exitChild(target, op.code ?? null, op.signal ?? null);
+        }
+        break;
+      }
+      case 'exitAll': {
+        for (const record of aliveChildren()) {
+          exitChild(record, op.code ?? null, op.signal ?? null);
+          await settle();
+        }
+        break;
+      }
+      case 'ipcReadyNewest': {
+        const alive = aliveChildren();
+        const target = alive[alive.length - 1];
+        ipcTo(target, op.op, {
+          type: 'generation_ready',
+          epoch: target?.generation?.epoch ?? 0,
+        });
+        break;
+      }
+      case 'ipcPinSnapshotOldest': {
+        const target = aliveChildren()[0];
+        ipcTo(target, op.op, {
+          type: 'generation_pin_snapshot',
+          epoch: target?.generation?.epoch ?? 0,
+          threadIds: op.threadIds,
+        });
+        break;
+      }
+      case 'ipcPinReleasedOldest': {
+        const target = aliveChildren()[0];
+        ipcTo(target, op.op, {
+          type: 'generation_pin_released',
+          epoch: target?.generation?.epoch ?? 0,
+          threadId: op.threadId,
+        });
+        break;
+      }
+      case 'ipcGarbageNewest': {
+        const alive = aliveChildren();
+        ipcTo(alive[alive.length - 1], op.op, op.message);
+        break;
+      }
+      case 'setLatest':
+        probeState =
+          op.version === null ? { kind: 'none' } : { kind: 'version', version: op.version };
+        break;
+      case 'probeError':
+        probeState = { kind: 'error', message: op.message };
+        break;
+      case 'setInstall':
+        installState = { kind: 'entry', entryPath: op.entryPath };
+        break;
+      case 'installError':
+        installState = { kind: 'error', message: op.message };
+        break;
+      case 'setBytes':
+        if (op.bytes === null) entryBytes.delete(op.path);
+        else entryBytes.set(op.path, op.bytes);
+        break;
+      case 'setSendNewest': {
+        const alive = aliveChildren();
+        const target = alive[alive.length - 1];
+        if (target === undefined) trace.push({ t: 'no_child', op: op.op });
+        else target.sendOk = op.ok === true;
+        break;
+      }
+      case 'requestStop':
+        supervisor.requestStop(
+          op.forwardSignal === undefined ? undefined : { forwardSignal: op.forwardSignal }
+        );
+        break;
+      case 'childActive':
+        trace.push({ t: 'child_active', value: supervisor.childActive() });
+        break;
+      case 'awaitDone': {
+        const outcome = await Promise.race([
+          supervisor.done.then(() => 'done'),
+          new Promise((resolve) => setTimeout(() => resolve('done_timeout'), 5000)),
+        ]);
+        trace.push({ t: outcome });
+        break;
+      }
+      default:
+        trace.push({ t: 'unknown_op', op: op.op });
+    }
+    await settle();
+  }
+
+  return { trace };
+}
+
+// --- Lock acquire runs (real fs on a scratch dir; startedAt pinned) --------------------
+
+function runAcquireLockCase(caseInput) {
+  const scratch = mkdtempSync(join(tmpdir(), 'linzumi-core-sup-lock-'));
+  const lockPath = join(scratch, 'sup.lock');
+  const trace = [];
+  const releases = [];
+  for (const step of caseInput.steps ?? []) {
+    if (step.action === 'acquire') {
+      const alivePids = step.alivePids ?? [];
+      const result = withPinnedDate(caseInput.nowMs ?? 0, () =>
+        acquireSupervisorLock({
+          path: lockPath,
+          workspace: caseInput.workspace ?? 'ws-lock',
+          linzumiUrl: caseInput.linzumiUrl ?? 'wss://parity.example',
+          pid: step.pid,
+          isPidAlive: (candidate) => alivePids.includes(candidate),
+        })
+      );
+      if (result.ok) {
+        releases.push(result.release);
+        trace.push({ t: 'acquired' });
+      } else {
+        trace.push({ t: 'held', holderPid: result.holderPid ?? null });
+      }
+      trace.push({
+        t: 'lock_bytes',
+        bytes: existsSync(lockPath) ? readFileSync(lockPath, 'utf8') : null,
+      });
+    } else if (step.action === 'releaseLast') {
+      const release = releases.pop();
+      if (release !== undefined) release();
+      trace.push({ t: 'released', fileExists: existsSync(lockPath) });
+    } else if (step.action === 'seedLock') {
+      writeFileSync(lockPath, step.content);
+      trace.push({ t: 'seeded' });
+    }
+  }
+  return { trace };
+}
+
+// --- Console logger / signal handlers / tty guard --------------------------------------
+
+function runConsoleLoggerCase(caseInput) {
+  const stderrLines = [];
+  const audits = [];
+  let writes = 0;
+  const logger = createSupervisorConsoleLogger({
+    writeStderr: (line) => {
+      writes += 1;
+      if (
+        caseInput.stderrFailAfter !== undefined &&
+        writes > caseInput.stderrFailAfter
+      ) {
+        throw new Error('EIO scripted console death');
+      }
+      stderrLines.push(line);
+    },
+    audit: (event, payload) => {
+      if (caseInput.auditFails === true) throw new Error('scripted audit failure');
+      audits.push({ event, payload });
+    },
+    now: () => new RealDate(caseInput.nowMs ?? 0),
+  });
+  for (const entry of caseInput.events ?? []) {
+    logger(entry.event, entry.payload);
+  }
+  return { stderrLines, audits };
+}
+
+function runSignalHandlersCase(caseInput) {
+  const trace = [];
+  const once = new Map();
+  const on = new Map();
+  installSupervisorSignalHandlers(
+    {
+      requestStop: (options) =>
+        trace.push({ t: 'request_stop', forwardSignal: options?.forwardSignal ?? null }),
+    },
+    (event, payload = {}) => trace.push({ t: 'log', event, payload }),
+    {
+      once: (event, listener) => {
+        const queue = once.get(event) ?? [];
+        queue.push(listener);
+        once.set(event, queue);
+        trace.push({ t: 'registered_once', event });
+      },
+      on: (event, listener) => {
+        const queue = on.get(event) ?? [];
+        queue.push(listener);
+        on.set(event, queue);
+        trace.push({ t: 'registered_on', event });
+      },
+    }
+  );
+  for (const signal of caseInput.fires ?? []) {
+    trace.push({ t: 'fire', signal });
+    const onceQueue = once.get(signal) ?? [];
+    if (onceQueue.length > 0) {
+      const listener = onceQueue.shift();
+      listener();
+    }
+    for (const listener of on.get(signal) ?? []) {
+      listener();
+    }
+  }
+  return { trace };
+}
+
+function errorOfSpec(spec) {
+  if (spec.kind === 'null') return null;
+  if (spec.kind === 'string') return spec.value;
+  if (spec.kind === 'number') return spec.value;
+  const error = {};
+  if (spec.code !== undefined) error.code = spec.code;
+  if (spec.message !== undefined) error.message = spec.message;
+  return error;
+}
+
+function runTtyClassifyCase(caseInput) {
+  return (caseInput.errors ?? []).map((spec) => {
+    const error = errorOfSpec(spec);
+    return {
+      gone: goneTtyErrorCode(error) ?? null,
+      write: goneTtyWriteErrorCode(error) ?? null,
+    };
+  });
+}
+
+function runTtyGuardCase(caseInput) {
+  const trace = [];
+  const errorListeners = [];
+  let throwSpec;
+  const stream = {
+    isTTY: true,
+    write: (chunk) => {
+      if (throwSpec !== undefined) {
+        const error = new Error(throwSpec.message);
+        if (throwSpec.code !== undefined) error.code = throwSpec.code;
+        throwSpec = undefined;
+        throw error;
+      }
+      trace.push({ t: 'underlying_write', chunk });
+      return true;
+    },
+    on: (event, listener) => {
+      if (event === 'error') errorListeners.push(listener);
+      trace.push({ t: 'listener_added', event });
+    },
+    listenerCount: (event) => (event === 'error' ? errorListeners.length : 0),
+  };
+  const sinks = {
+    audit: (event, fields) => trace.push({ t: 'sink', leg: 'audit', event, fields }),
+    log: (event, fields) => trace.push({ t: 'sink', leg: 'log', event, fields }),
+  };
+  const guard = (label) =>
+    trace.push({
+      t: 'guarded',
+      label,
+      result: guardStreamWriteAgainstGoneTty(stream, {
+        context: { surface: 'parity_surface' },
+        sinks,
+        onGoneTty: (code) => trace.push({ t: 'gone_tty', label, code }),
+        rethrow: (error) =>
+          trace.push({
+            t: 'rethrown',
+            message: error instanceof Error ? error.message : String(error),
+          }),
+      }),
+    });
+  guard('first');
+  for (const op of caseInput.ops ?? []) {
+    if (op.op === 'write') {
+      if (op.throwCode !== undefined || op.throwMessage !== undefined) {
+        throwSpec = { code: op.throwCode, message: op.throwMessage ?? 'scripted write failure' };
+      }
+      let outcome;
+      let threwMessage = null;
+      try {
+        outcome = stream.write(op.data);
+      } catch (error) {
+        outcome = null;
+        threwMessage = error instanceof Error ? error.message : String(error);
+      }
+      trace.push({ t: 'write_result', returned: outcome, threw: threwMessage });
+    } else if (op.op === 'emitError') {
+      const error = new Error(op.message ?? 'scripted stream error');
+      if (op.code !== undefined) error.code = op.code;
+      trace.push({ t: 'emit_error', code: op.code ?? null });
+      for (const listener of [...errorListeners]) listener(error);
+    } else if (op.op === 'guardAgain') {
+      guard(op.label ?? 'again');
+    }
+  }
+  return { trace, goneCode: streamGoneTtyWriteCodeForTest(stream) ?? null };
+}
+
+// --- runSuperviseLoop refusal legs -----------------------------------------------------
+
+async function runLockRefusalCase(caseInput) {
+  const scratch = mkdtempSync(join(tmpdir(), 'linzumi-core-sup-home-'));
+  const workspace = caseInput.workspace ?? '';
+  const args = workspace === '' ? [] : ['--workspace', workspace];
+  const lockPath = supervisorLockPath(
+    { workspace, linzumiUrl: defaultLinzumiWebSocketUrl },
+    scratch
+  );
+  mkdirSync(dirname(lockPath), { recursive: true });
+  writeFileSync(
+    lockPath,
+    JSON.stringify({
+      pid: 1,
+      workspace,
+      linzumiUrl: defaultLinzumiWebSocketUrl,
+      startedAt: '2026-01-01T00:00:00.000Z',
+    }) + '\\n'
+  );
+  const previousHome = process.env.HOME;
+  process.env.HOME = scratch;
+  try {
+    await runSuperviseLoop(['--supervise', ...args]);
+    return { message: null };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { message: message.split(scratch).join('$SCRATCH') };
+  } finally {
+    process.env.HOME = previousHome;
+  }
+}
+
+async function runEmptyEntryCase() {
+  const scratch = mkdtempSync(join(tmpdir(), 'linzumi-core-sup-home-'));
+  const previousHome = process.env.HOME;
+  const previousArgv1 = process.argv[1];
+  process.env.HOME = scratch;
+  process.argv[1] = '';
+  try {
+    await runSuperviseLoop(['--supervise', '--workspace', 'ws-empty']);
+    return { message: null };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { message: message.split(scratch).join('$SCRATCH') };
+  } finally {
+    process.env.HOME = previousHome;
+    process.argv[1] = previousArgv1;
+  }
+}
+
+// --- Case dispatch -----------------------------------------------------------------------
+
+async function runCase(input) {
+  switch (input.kind) {
+    case 'constants':
+      return {
+        supervisedChildEnvKey,
+        generationOverlapFlagEnvKey,
+        generationEpochEnvKey,
+        generationHandoffPidEnvKey,
+        defaultGenerationStillbornWindowMs,
+        defaultSupervisorTiming,
+        defaultLinzumiWebSocketUrl,
+      };
+    case 'isSupervisedChild':
+      return isSupervisedChild(input.env);
+    case 'withoutSuperviseFlags':
+      return withoutSuperviseFlags(input.args);
+    case 'hasSuperviseFlag':
+      return hasSuperviseFlag(input.args);
+    case 'fingerprint':
+      return (
+        supervisorCodeFingerprint(input.entryPath, (path) => {
+          const bytes = (input.files ?? {})[path];
+          return bytes === undefined ? undefined : bytes;
+        }) ?? null
+      );
+    case 'lockKey':
+      return supervisorLockKey({ workspace: input.workspace, linzumiUrl: input.linzumiUrl });
+    case 'lockPath':
+      return supervisorLockPath(
+        { workspace: input.workspace, linzumiUrl: input.linzumiUrl },
+        input.homeDir
+      );
+    case 'reexecStatePath':
+      return defaultSupervisorReexecStatePath(input.env);
+    case 'acquireLockRun':
+      return runAcquireLockCase(input);
+    case 'consoleLogger':
+      return runConsoleLoggerCase(input);
+    case 'signalHandlers':
+      return runSignalHandlersCase(input);
+    case 'ttyClassify':
+      return runTtyClassifyCase(input);
+    case 'ttyGuardRun':
+      return runTtyGuardCase(input);
+    case 'lockRefusalLoop':
+      return runLockRefusalCase(input);
+    case 'emptyEntryLoop':
+      return runEmptyEntryCase();
+    case 'supervisionRun':
+      return runSupervisionCase(input);
+    default:
+      return { error: 'unknown case kind ' + String(input.kind) };
+  }
+}
+
+async function runBatch() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const cases = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+  const results = [];
+  for (const testCase of cases) {
+    results.push(await runCase(testCase));
+  }
+  process.stdout.write(JSON.stringify(results), () => {
+    process.exit(0);
+  });
+}
+
+runBatch().then(
+  () => {},
+  (error) => {
+    process.stderr.write(String(error && error.stack ? error.stack : error) + '\\n');
+    process.exit(1);
+  }
+);
+`;
+
+const outDir = join(packageRoot, '.differential');
+const outPath = join(outDir, 'core-supervisor-parity-oracle.mjs');
+
+await mkdir(outDir, { recursive: true });
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'core-supervisor-parity-driver.ts',
+    loader: 'ts',
+  },
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: outPath,
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  logLevel: 'silent',
+  // supervisor.ts pulls the wider commander graph (updateNudge,
+  // workerEntryStability, runnerLogger); the same runtime externals as the
+  // differential entry build stay external.
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});
+
+process.stdout.write(outPath + '\n');