@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/chunk-RYSCLMU3.js

@@ -0,0 +1,1991 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  addWorkingDays,
+  dayOf,
+  initiativeStatus,
+  laterOf,
+  leadTimeFor,
+  readPlan,
+  readView,
+  workingDays
+} from "./chunk-ZUIAOKXI.js";
+import {
+  traceMatrix
+} from "./chunk-6SCVQZX5.js";
+import {
+  SYNC_FILE
+} from "./chunk-VPTTCYOC.js";
+import {
+  contentLines,
+  docOf,
+  hopNotes,
+  hopRoutes,
+  normalizePath,
+  readChangeFiles,
+  readDataChanges,
+  readHops,
+  readRound,
+  readRoundMeta,
+  readSnowDrafts,
+  readStoryIndex,
+  readTasks,
+  reviewedGates,
+  roundsOf,
+  sectionLines,
+  sectionMatching,
+  tableWith
+} from "./chunk-7UFQZXZA.js";
+import {
+  changeFolder,
+  changeReport,
+  changeStore,
+  loadChangeContext
+} from "./chunk-56YQ6ROQ.js";
+import {
+  fileStepStore,
+  stepOfProvisional
+} from "./chunk-7JUKDRSZ.js";
+import {
+  readServiceRequestExports
+} from "./chunk-23W7VWKR.js";
+import {
+  readChangeRepos
+} from "./chunk-KJPMEAI4.js";
+import {
+  BREAKING_SPEC,
+  NAMES_SECRET_SPEC,
+  PERSONAL_DATA_SPEC,
+  UNDOES_SPEC,
+  personalItem,
+  settle,
+  tokenFormatIn,
+  verdictOf
+} from "./chunk-CNUKCS2T.js";
+import {
+  ChangeOutcomes,
+  WORKSPACE_SCHEMA_VERSION,
+  external_exports,
+  fileJudgments,
+  inputsDirOf,
+  readRunSummary,
+  require_dist,
+  toCanonicalYaml
+} from "./chunk-S2A7YC3Q.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/release/dist/errors.js
+var ReleaseError = class extends Error {
+  code;
+  constructor(message, code = "invalid") {
+    super(message);
+    this.code = code;
+    this.name = "ReleaseError";
+  }
+};
+
+// packages/release/dist/context.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+var REQUESTS_FILE = "snow.md";
+var SyncEntries = external_exports.object({
+  requests: external_exports.array(external_exports.object({ key: external_exports.string(), id: external_exports.string() })).default([])
+});
+async function readServiceRequests(dir, files, templates, steps, exported) {
+  const drafts = readSnowDrafts(files);
+  if (drafts.length === 0)
+    return [];
+  let synced = [];
+  try {
+    synced = SyncEntries.parse((0, import_yaml.parse)(await readFile(join(dir, SYNC_FILE), "utf8"))).requests;
+  } catch {
+  }
+  return drafts.map((d) => {
+    const h = d.heading.toLowerCase();
+    const t = templates.find((x) => [x.requestType, x.name, x.id].some((n) => h.includes(n.toLowerCase())));
+    const fields = t ? t.fields.map((f) => ({
+      name: f.name,
+      value: d.fields.get(f.name.toLowerCase())?.value ?? "",
+      required: f.required
+    })) : [...d.fields].map(([name, v2]) => ({ name, value: v2.value, required: false }));
+    const fromHeading = /:\s*(\S+)\s*$/.exec(d.heading)?.[1] ?? "";
+    const recordField = t?.fields.find((f) => f.from === "${record}");
+    const record = fromHeading || (recordField ? d.fields.get(recordField.name.toLowerCase())?.value ?? "" : "");
+    const unblocks = [...d.fields].filter(([k]) => /^unblocks?\b/.test(k)).flatMap(([, v2]) => v2.value.match(/\d+(?:\.\d+)+|\b\d+\b/g) ?? []);
+    const lead = t ? leadTimeFor({ id: t.id, kind: "request", template: t.id, days: t.leadTimeDays }, void 0, { templates, requests: exported, journey: "change" }) : void 0;
+    const base = {
+      heading: d.heading,
+      line: d.line,
+      ...t ? { template: t.id } : {},
+      requestType: t?.requestType ?? d.heading,
+      record,
+      ...lead ? { leadTimeDays: lead.days, leadTimeSource: lead.source } : {},
+      approvers: t?.approvers ?? [],
+      fields,
+      missing: fields.filter((f) => f.required && !f.value.trim()).map((f) => f.name),
+      unblocks
+    };
+    const entry = t ? synced.find((e) => e.key === `${t.id}|${fromHeading}`) : void 0;
+    if (!entry)
+      return { ...base, state: "to-file" };
+    const stepId = stepOfProvisional(entry.id);
+    if (!stepId)
+      return { ...base, state: "filed", number: entry.id };
+    const s = steps.find((x) => x.id === stepId);
+    const v = s?.state === "done" ? s.recorded?.values : void 0;
+    return typeof v?.requestNumber === "string" ? {
+      ...base,
+      state: "filed",
+      step: stepId,
+      number: v.requestNumber,
+      ...typeof v.url === "string" ? { url: v.url } : {},
+      ...s?.recorded ? { filedAt: s.recorded.at } : {}
+    } : { ...base, state: "waiting", step: stepId };
+  });
+}
+async function readRounds(root, change) {
+  const out = [];
+  for (const gate of await reviewedGates(root, change))
+    for (const round2 of await roundsOf(root, change, gate)) {
+      const meta = await readRoundMeta(root, change, gate, round2);
+      const r = await readRound(root, change, gate, round2);
+      out.push({ gate, round: round2, ...meta ? { meta } : {}, findings: r.findings });
+    }
+  return out;
+}
+var iso = (d) => d.toISOString().replace(/\.\d{3}Z$/, "Z");
+async function loadRelease(root, changeId, o = {}) {
+  const now = typeof o.now === "string" ? o.now : iso(o.now ?? /* @__PURE__ */ new Date());
+  let change;
+  try {
+    change = await changeStore(root).read(changeId);
+  } catch {
+    throw new ReleaseError(`There is no change ${changeId}.`, "not-found");
+  }
+  const dir = changeFolder(root, change.id);
+  const [ctx, files] = await Promise.all([loadChangeContext(root), readChangeFiles(dir)]);
+  const problems = [...ctx.problems];
+  const records = ctx.records;
+  const key = (k, id) => `${k}|${id}`;
+  const byKey = new Map(records.map((r) => [key(r.kind, r.id), r]));
+  const repos = ctx.orgPack.profiles.flatMap((p) => p.repos?.repos ?? []).map((r) => ({
+    id: r.id,
+    type: r.type,
+    owner: r.owner,
+    ...r.component ? { component: r.component } : {},
+    ...r.system ? { system: r.system } : {}
+  })).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  let changeRepos;
+  try {
+    changeRepos = await readChangeRepos(root, change.id);
+  } catch (e) {
+    problems.push(e.message);
+  }
+  let steps = [];
+  try {
+    steps = await fileStepStore(root).list({ change: change.id });
+  } catch (e) {
+    problems.push(`A step file can't be read: ${e.message}`);
+  }
+  const exported = await readServiceRequestExports({ root, inputsDir: inputsDirOf(root) });
+  const requests = await readServiceRequests(dir, files, ctx.orgPack.serviceRequests, steps, exported.requests);
+  const rounds = await readRounds(root, change.id);
+  const latest = [];
+  for (const gate of [...new Set(rounds.map((r) => r.gate))]) {
+    const last = rounds.filter((r) => r.gate === gate).at(-1);
+    if (last)
+      latest.push(...last.findings);
+  }
+  return {
+    root,
+    now,
+    today: dayOf(now),
+    change,
+    dir,
+    files,
+    orgPack: ctx.orgPack,
+    policy: ctx.policy,
+    records,
+    get: (kind, id) => byKey.get(key(kind, id)),
+    all: (kind) => records.filter((r) => r.kind === kind),
+    repos,
+    ...changeRepos ? { changeRepos } : {},
+    steps,
+    requests,
+    rounds,
+    latest,
+    exportedRequests: exported.requests,
+    problems,
+    judging: {
+      store: o.judgments ?? fileJudgments(root),
+      ...o.runtime ? { runtime: o.runtime } : {}
+    }
+  };
+}
+
+// packages/release/dist/judged.js
+function breakingItem(h, notes) {
+  return {
+    inputs: {
+      v: 1,
+      change: h.change,
+      operation: h.operation,
+      caller: h.caller,
+      callee: h.callee,
+      notes
+    },
+    texts: { notes },
+    facts: [
+      `operation: ${h.operation}`,
+      `caller: ${h.caller}`,
+      `callee: ${h.callee}`,
+      `change: ${h.change.replace(/^planned-/, "")}`
+    ]
+  };
+}
+function undoesItem(sentence, step, others) {
+  return {
+    inputs: {
+      v: 1,
+      sentence,
+      step: step.key,
+      names: [...new Set(step.names)].sort(),
+      others: [...new Set(others.filter((n) => !step.names.includes(n)))].sort()
+    },
+    texts: { sentence },
+    facts: [
+      `the step: ${step.kind} in ${step.repo}`,
+      ...step.what.map((w) => `it deploys: ${w}`),
+      `its names: ${[...new Set(step.names)].join(", ")}`
+    ]
+  };
+}
+function secretItem(line) {
+  return { inputs: { v: 1, line }, texts: { line } };
+}
+async function judgedFor(ctx, spec, items) {
+  const results = items.length ? await settle(spec, items, {
+    store: ctx.judging.store,
+    runtime: ctx.judging.runtime,
+    change: ctx.change.id,
+    now: new Date(ctx.now)
+  }) : /* @__PURE__ */ new Map();
+  return (item) => verdictOf(results, spec, item.inputs);
+}
+
+// packages/release/dist/model.js
+var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var sortStrings = (xs) => [...new Set(xs)].sort(cmp);
+var EVENT = /^(publish|subscribe|emit|event|consume)$/i;
+function buildModel(ctx) {
+  const profileSystems = new Map(ctx.orgPack.profiles.flatMap((p) => p.profile?.systems ?? []).map((s) => [s.id, s]));
+  const repoOfComponent = (id) => ctx.get("Component", id)?.repo ?? ctx.repos.find((r) => (r.component ?? r.id) === id)?.id ?? ctx.repos.find((r) => r.id === id)?.id;
+  const componentsOfRepo = (repo) => {
+    const r = ctx.repos.find((x) => x.id === repo);
+    return sortStrings([
+      ...r?.component ? [r.component] : [],
+      ...ctx.all("Component").filter((c) => c.repo === repo).map((c) => c.id)
+    ]);
+  };
+  const systemOf = (id) => {
+    const c = ctx.get("Component", id);
+    if (c)
+      return c.system;
+    if (ctx.get("System", id) || profileSystems.has(id))
+      return id;
+    const t = ctx.get("Table", id);
+    if (t?.ownerComponent)
+      return systemOf(t.ownerComponent);
+    const s = ctx.get("DataStore", id);
+    if (s?.ownerComponent)
+      return systemOf(s.ownerComponent);
+    return ctx.repos.find((r) => (r.component ?? r.id) === id)?.system;
+  };
+  const boundaryOf = (s) => s ? ctx.get("System", s)?.boundary ?? profileSystems.get(s)?.boundary : void 0;
+  const systemName = (s) => ctx.get("System", s)?.name ?? profileSystems.get(s)?.name ?? s;
+  const evidenceRepo = (records, src) => sortStrings(records.flatMap((r) => r.evidence.filter((e) => e.source === src && e.repo).map((e) => e.repo)))[0];
+  const gatewayRepo = evidenceRepo(ctx.all("GatewayRoute"), "gateway") ?? ctx.repos.find((r) => /gateway/i.test(r.type))?.id;
+  const topics = ctx.all("Endpoint").filter((e) => e.endpointType === "event-topic");
+  const eventsRepo = evidenceRepo(topics, "event-config") ?? ctx.repos.find((r) => /event/i.test(r.type))?.id;
+  const storeOwner = (store) => {
+    const component = ctx.get("DataStore", store)?.ownerComponent;
+    const repo = component ? repoOfComponent(component) : void 0;
+    return { ...component ? { component } : {}, ...repo ? { repo } : {} };
+  };
+  const touched = new Map(ctx.change.touches.interfaces.map((t) => [t.id, t.status]));
+  const hops = readHops(ctx.files).map((h) => {
+    const record = h.id && h.id !== "new" ? ctx.get("Interface", h.id) : void 0;
+    const routes = sortStrings([
+      ...record?.route ? [record.route] : [],
+      ...hopRoutes(ctx.files, h)
+    ]);
+    const isEvent = ["event-bus", "pubsub", "mq"].includes(record?.via ?? "") || /^A\./.test(h.pattern) || EVENT.test(h.method ?? "");
+    const topic = isEvent ? record?.normalizedPath ?? (EVENT.test(h.method ?? "") ? h.path : void 0) : void 0;
+    const callerSystem = systemOf(h.caller);
+    const calleeSystem = systemOf(h.callee);
+    const callerRepo = repoOfComponent(h.caller);
+    const calleeRepo = repoOfComponent(h.callee);
+    const callerBoundary = boundaryOf(callerSystem);
+    const calleeBoundary = boundaryOf(calleeSystem);
+    return {
+      ...h,
+      change: /^planned-/.test(h.status) ? h.status : touched.get(h.id) ?? h.status,
+      ...record ? { record } : {},
+      routes,
+      newRoutes: routes.filter((r) => !ctx.get("GatewayRoute", r)),
+      ...callerRepo ? { callerRepo } : {},
+      ...calleeRepo ? { calleeRepo } : {},
+      ...callerSystem ? { callerSystem } : {},
+      ...calleeSystem ? { calleeSystem } : {},
+      ...callerBoundary ? { callerBoundary } : {},
+      ...calleeBoundary ? { calleeBoundary } : {},
+      ...topic ? { topic } : {},
+      newTopic: !!topic && !topics.some((t) => t.pathOrTopic === topic),
+      notes: hopNotes(ctx.files, h)
+    };
+  });
+  return {
+    hops,
+    data: readDataChanges(ctx.files),
+    repoOfComponent,
+    componentsOfRepo,
+    systemOf,
+    boundaryOf,
+    systemName,
+    ...gatewayRepo ? { gatewayRepo } : {},
+    ...eventsRepo ? { eventsRepo } : {},
+    storeOwner
+  };
+}
+var opOf = (h) => h.operation || (h.path ?? "");
+function sectionOf(ctx, file, re) {
+  const doc = docOf(ctx.files, file);
+  const s = doc?.sections.find((x) => re.test(x.heading));
+  if (!doc || !s)
+    return void 0;
+  const lines2 = sectionLines(doc, s);
+  return {
+    heading: s.heading,
+    source: `${file}:${s.line}`,
+    text: lines2.map((l) => l.text).join("\n").trim(),
+    lines: lines2
+  };
+}
+function sectionsOf(ctx, file, re) {
+  const doc = docOf(ctx.files, file);
+  if (!doc)
+    return [];
+  return doc.sections.filter((x) => re.test(x.heading)).map((s) => {
+    const lines2 = sectionLines(doc, s);
+    return {
+      heading: s.heading,
+      source: `${file}:${s.line}`,
+      text: lines2.map((l) => l.text).join("\n").trim(),
+      lines: lines2
+    };
+  });
+}
+function sentences(lines2) {
+  const out = [];
+  let cur = "";
+  let start = 0;
+  const flush = () => {
+    const t = cur.trim();
+    if (t)
+      out.push({ n: start, text: t });
+    cur = "";
+  };
+  for (const l of lines2) {
+    const text = l.text.trim();
+    if (/^([-*+]|\d+\.)\s+/.test(text) || text.startsWith("|")) {
+      flush();
+      start = l.n;
+      cur = text.replace(/^([-*+]|\d+\.)\s+/, "");
+      flush();
+      continue;
+    }
+    for (const part of text.split(/(?<=[.!?])\s+/)) {
+      if (!cur)
+        start = l.n;
+      cur = cur ? `${cur} ${part}` : part;
+      if (/[.!?]$/.test(part))
+        flush();
+    }
+  }
+  flush();
+  return out;
+}
+function hasWord(text, word) {
+  if (!word)
+    return false;
+  const esc3 = word.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(^|[^A-Za-z0-9_-])${esc3}($|[^A-Za-z0-9_-])`, "i").test(text);
+}
+
+// packages/release/dist/plan.js
+var RANK = { migration: 0, topic: 1, "gateway-route": 2, code: 3 };
+var cmp2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function requestWait(ctx, r, why) {
+  const base = {
+    heading: r.heading,
+    ...r.template ? { template: r.template } : {},
+    requestType: r.requestType,
+    ...r.record ? { record: r.record } : {},
+    state: r.state,
+    ...r.number ? { number: r.number } : {},
+    missing: r.missing,
+    source: `${REQUESTS_FILE}:${r.line}`,
+    why
+  };
+  if (r.leadTimeDays === void 0)
+    return base;
+  const from = r.state === "filed" && r.filedAt ? dayOf(r.filedAt) : ctx.today;
+  const due = addWorkingDays(from, Math.ceil(r.leadTimeDays));
+  const readyBy = laterOf(due, ctx.today);
+  return {
+    ...base,
+    leadTimeDays: r.leadTimeDays,
+    ...r.leadTimeSource ? { leadTimeSource: r.leadTimeSource } : {},
+    waitDays: workingDays(ctx.today, readyBy),
+    readyBy
+  };
+}
+var SECTIONS = [
+  {
+    name: "rollout",
+    re: /roll-?out|release plan|deploy|cut-?over/i,
+    gap: 'design.md has no rollout section: add "Rollout and rollback" with the order and any feature flags.'
+  },
+  {
+    name: "rollback",
+    re: /roll-?back|back-?out/i,
+    gap: "design.md says nothing about rolling back: say how each step is undone, and when to decide."
+  },
+  {
+    name: "readiness",
+    re: /readiness|ready|pre-?release|go-?live|operational/i,
+    gap: "design.md has no readiness section: say what must be true before go-live (runbooks, on-call, alerts, sign-offs)."
+  },
+  {
+    name: "verification",
+    re: /verif|smoke|post-?(deploy|release)|validation/i,
+    gap: "design.md has no verification section: say how the team checks each step worked in production."
+  },
+  {
+    name: "hypercare",
+    re: /hyper-?care|early life|warranty|aftercare|monitoring after/i,
+    gap: "design.md has no hypercare section: say who watches what, and for how long, after release."
+  }
+];
+async function deploymentPlan(ctx) {
+  const m = buildModel(ctx);
+  const gaps = [];
+  const notes = [];
+  const units = /* @__PURE__ */ new Map();
+  const edges = [];
+  const unplaced = /* @__PURE__ */ new Map();
+  const external = [];
+  const externalCaller = /* @__PURE__ */ new Map();
+  const tasks = readTasks(ctx.files);
+  const stories = readStoryIndex(ctx.files);
+  const unit = (key, kind, repo) => {
+    let u = units.get(key);
+    if (!u) {
+      u = { key, kind, repo, what: [], sources: /* @__PURE__ */ new Set(), names: [repo], tasks: [] };
+      units.set(key, u);
+    }
+    return u;
+  };
+  const codeUnit = (repo) => {
+    const u = unit(`code:${repo}`, "code", repo);
+    for (const c of m.componentsOfRepo(repo))
+      if (!u.names.includes(c))
+        u.names.push(c);
+    return u;
+  };
+  const addWhat = (u, w, source) => {
+    if (!u.what.includes(w))
+      u.what.push(w);
+    u.sources.add(source);
+  };
+  for (const d of m.data) {
+    const owner = m.storeOwner(d.store);
+    if (!owner.repo) {
+      unplaced.set(d.store, `${d.store} has no owning component with a repo in the catalog, so its migration can't be placed.`);
+      continue;
+    }
+    const u = unit(`migration:${d.store}`, "migration", owner.repo);
+    addWhat(u, `${d.store}.${d.table}: ${d.change.trim() || "change"} (${d.migration || "no migration file named"})`, `data.md:${d.line}`);
+    for (const n of [d.migration, d.table, d.tableId, d.store].filter(Boolean))
+      if (!u.names.includes(n))
+        u.names.push(n);
+    if (!d.migration)
+      gaps.push(`data.md:${d.line}: the change to ${d.store}.${d.table} names no migration file, so the migration step can't say what runs.`);
+    const t = ctx.get("Table", d.tableId);
+    const users = sortStrings([
+      ...t?.readers ?? [],
+      ...t?.writers ?? [],
+      ...owner.component ? [owner.component] : []
+    ]);
+    for (const c of users) {
+      const repo = m.repoOfComponent(c);
+      if (!repo)
+        continue;
+      codeUnit(repo);
+      edges.push({
+        from: u.key,
+        to: `code:${repo}`,
+        why: `${c} reads or writes ${d.store}.${d.table}, so the migration (expand) runs first`
+      });
+    }
+  }
+  for (const h of m.hops) {
+    const live = /^planned-(new|modify)$/.test(h.change);
+    const op = opOf(h);
+    const src = `interfaces.md:${h.line}`;
+    const callerInternal = h.callerBoundary !== "vendor";
+    const calleeInternal = h.calleeBoundary !== "vendor";
+    const verb = h.change === "planned-new" ? "new" : h.change === "planned-modify" ? "changed" : h.change;
+    if (live && callerInternal) {
+      if (h.callerRepo)
+        addWhat(codeUnit(h.callerRepo), `${h.caller} calls ${op} on ${h.callee} (${verb})`, src);
+      else
+        unplaced.set(h.caller, placeWhy(ctx, h.caller, `caller of ${op}`));
+    }
+    if (live && calleeInternal) {
+      if (h.calleeRepo)
+        addWhat(codeUnit(h.calleeRepo), `${h.callee} serves ${op} (${verb})`, src);
+      else
+        unplaced.set(h.callee, placeWhy(ctx, h.callee, `callee of ${op}`));
+    }
+    if (live && !calleeInternal && h.calleeSystem) {
+      const what = `${op} must be live on ${m.systemName(h.calleeSystem)}'s side (a vendor: nothing of theirs deploys here)`;
+      external.push({ system: h.calleeSystem, name: m.systemName(h.calleeSystem), what });
+      if (h.callerRepo)
+        externalCaller.set(what, `code:${h.callerRepo}`);
+    }
+    for (const r of h.newRoutes) {
+      if (!m.gatewayRepo) {
+        unplaced.set(r, `${r} is a new gateway route but no repo holds gateway proxies, so Atticus can't place it.`);
+        continue;
+      }
+      const u = unit(`route:${r}`, "gateway-route", m.gatewayRepo);
+      addWhat(u, `New gateway route ${r} for ${op}`, src);
+      if (!u.names.includes(r))
+        u.names.push(r);
+      if (h.callerRepo && callerInternal)
+        edges.push({
+          from: u.key,
+          to: `code:${h.callerRepo}`,
+          why: `${h.caller} calls ${op} through ${r}, so the route goes first`
+        });
+    }
+    if (h.topic && h.newTopic && live) {
+      if (!m.eventsRepo) {
+        unplaced.set(h.topic, `${h.topic} is a new topic but no repo holds topic definitions, so Atticus can't place it.`);
+      } else {
+        const u = unit(`topic:${h.topic}`, "topic", m.eventsRepo);
+        addWhat(u, `New topic ${h.topic}`, src);
+        if (!u.names.includes(h.topic))
+          u.names.push(h.topic);
+        if (h.callerRepo)
+          edges.push({
+            from: u.key,
+            to: `code:${h.callerRepo}`,
+            why: `${h.caller} publishes to ${h.topic}, so the topic goes first`
+          });
+      }
+    }
+    if (live && h.callerRepo && h.calleeRepo && h.callerRepo !== h.calleeRepo && callerInternal && calleeInternal)
+      edges.push({
+        from: `code:${h.calleeRepo}`,
+        to: `code:${h.callerRepo}`,
+        why: `${h.caller} calls ${h.callee}'s ${verb} ${op}, so ${h.callee} deploys first`
+      });
+  }
+  for (const t of tasks) {
+    if (!ctx.repos.some((r) => r.id === t.repo) && !m.componentsOfRepo(t.repo).length)
+      continue;
+    const u = codeUnit(t.repo);
+    const num = /\[[ xX]?\]\s*(\d+(?:\.\d+)*)/.exec(t.text)?.[1];
+    if (num && !u.tasks.includes(num))
+      u.tasks.push(num);
+    addWhat(u, `Task ${t.text.replace(/^\s*[-*]\s+\[[ xX]?\]\s*/, "")}`, `tasks.md:${t.line}`);
+  }
+  for (const s of stories)
+    for (const repo of s.repos) {
+      if (!ctx.repos.some((r) => r.id === repo))
+        continue;
+      addWhat(codeUnit(repo), `Story ${s.id}`, `stories.md:${s.line}`);
+    }
+  for (const repo of [
+    ...ctx.changeRepos?.repos.map((r) => r.id) ?? [],
+    ...ctx.change.touches.repos
+  ])
+    if (!units.has(`code:${repo}`))
+      addWhat(codeUnit(repo), "Named in the change's repos", "repos.yaml");
+  for (const s of stories)
+    for (const dep of s.dependsOn) {
+      const d = stories.find((x) => x.id === dep);
+      if (!d)
+        continue;
+      for (const a of d.repos)
+        for (const b of s.repos)
+          if (a !== b && units.has(`code:${a}`) && units.has(`code:${b}`))
+            edges.push({
+              from: `code:${a}`,
+              to: `code:${b}`,
+              why: `story ${s.id} depends on ${d.id}`
+            });
+    }
+  const keys = [...units.keys()];
+  const preds = new Map(keys.map((k) => [k, []]));
+  for (const e of edges)
+    if (units.has(e.from) && units.has(e.to) && e.from !== e.to && !preds.get(e.to).some((x) => x.from === e.from && x.why === e.why))
+      preds.get(e.to).push(e);
+  const prio = (k) => {
+    const u = units.get(k);
+    return [RANK[u.kind], u.repo, k];
+  };
+  const byPrio = (a, b) => {
+    const [ra, pa, ka] = prio(a);
+    const [rb, pb, kb] = prio(b);
+    return ra !== rb ? ra - rb : pa !== pb ? cmp2(pa, pb) : cmp2(ka, kb);
+  };
+  const order = [];
+  const left = new Set(keys);
+  while (left.size) {
+    const ready = [...left].filter((k) => preds.get(k).every((e) => !left.has(e.from))).sort(byPrio);
+    if (ready.length) {
+      order.push(ready[0]);
+      left.delete(ready[0]);
+      continue;
+    }
+    const next = [...left].sort(byPrio)[0];
+    const stuck = preds.get(next).filter((e) => left.has(e.from)).map((e) => units.get(e.from).repo);
+    gaps.push(`${units.get(next).repo} and ${sortStrings(stuck).join(", ")} depend on each other, so no order satisfies both; agree one and write it in design.md.`);
+    order.push(next);
+    left.delete(next);
+  }
+  const numOf = new Map(order.map((k, i) => [k, i + 1]));
+  const rollbackLines = [
+    ...sectionsOf(ctx, "design.md", /roll|release|deploy|back-?out/i).flatMap((s) => sentences(s.lines).map((x) => ({ ...x, file: "design.md" }))),
+    ...sectionsOf(ctx, "data.md", /.*/).flatMap((s) => sentences(s.lines).map((x) => ({ ...x, file: "data.md" })))
+  ].filter((x) => !/^\|[\s|:-]*\|?$/.test(x.text));
+  const allNames = [...units.values()].flatMap((u) => u.names);
+  const pairs = [...units.values()].flatMap((u) => rollbackLines.map((x) => ({
+    u,
+    x,
+    item: undoesItem(x.text, { key: u.key, kind: u.kind, repo: u.repo, what: u.what, names: u.names }, allNames)
+  })));
+  const undoes = await judgedFor(ctx, UNDOES_SPEC, pairs.map((p) => p.item));
+  const labelOf = (u) => u.kind === "code" ? u.repo : u.what[0] ?? u.repo;
+  const rollbackOf = (u) => {
+    const mine = pairs.filter((p) => p.u === u);
+    const fit = mine.filter((p) => undoes(p.item)?.verdict === "yes").map((p) => p.x);
+    if (fit.length > 0)
+      return {
+        text: fit.map((x) => x.text).join(" "),
+        source: sortStrings(fit.map((x) => `${x.file}:${x.n}`)).join(", ")
+      };
+    const open = mine.filter((p) => {
+      const v = undoes(p.item)?.verdict;
+      return v === void 0 || v === "unsure";
+    });
+    if (open.length > 0)
+      return {
+        gap: `No rollback step judged for ${labelOf(u)} yet: ${open.length === 1 ? "a sentence" : `${open.length} sentences`} of design.md or data.md may say how to undo it, but ${open.some((p) => undoes(p.item)) ? "a judge couldn't tell" : "no model was asked"}, so a person checks ${sortStrings([...new Set(open.map((p) => `${p.x.file}:${p.x.n}`))]).join(", ")}.`
+      };
+    return {
+      gap: `No rollback step written for ${labelOf(u)}: say how to undo it in design.md under "Rollout and rollback"${u.kind === "migration" ? " or in data.md" : ""}.`
+    };
+  };
+  const waitsOf = /* @__PURE__ */ new Map();
+  const before = [];
+  for (const r of ctx.requests) {
+    const route = r.record ? units.get(`route:${r.record}`) : void 0;
+    const taskUnit = !route ? [...units.values()].find((u) => r.unblocks.some((t) => u.tasks.includes(t))) : void 0;
+    const target = route ?? taskUnit;
+    const why = route ? `it deploys ${r.record}` : taskUnit ? `it unblocks task ${r.unblocks.join(", ")} in ${taskUnit.repo}` : "no step names it, so it is needed before the first step";
+    const w = requestWait(ctx, r, why);
+    if (r.leadTimeDays === void 0)
+      gaps.push(`${REQUESTS_FILE}:${r.line}: "${r.heading}" matches no request template, so it has no lead time to forecast.`);
+    if (target)
+      waitsOf.set(target.key, [...waitsOf.get(target.key) ?? [], w]);
+    else
+      before.push(w);
+  }
+  const beforeReady = before.reduce((d, w) => laterOf(d, w.readyBy ?? ctx.today), ctx.today);
+  const earliestOf = /* @__PURE__ */ new Map();
+  const steps = order.map((k) => {
+    const u = units.get(k);
+    const p = preds.get(k);
+    const waits = waitsOf.get(k) ?? [];
+    const earliest = [
+      beforeReady,
+      ...waits.map((w) => w.readyBy ?? ctx.today),
+      ...p.map((e) => earliestOf.get(e.from) ?? ctx.today)
+    ].reduce((a, b) => laterOf(a, b), ctx.today);
+    earliestOf.set(k, earliest);
+    const why = p.length ? sortStrings(p.map((e) => `After step ${numOf.get(e.from)}: ${e.why}.`)) : [
+      u.kind === "migration" ? "First: the schema is expanded before any code reads it." : u.kind === "gateway-route" || u.kind === "topic" ? "Nothing in this change has to be live before it." : "No dependency in interfaces.md, data.md or stories.md has to deploy before it."
+    ];
+    return {
+      n: numOf.get(k),
+      repo: u.repo,
+      kind: u.kind,
+      what: u.what,
+      why,
+      after: sortStrings(p.map((e) => String(numOf.get(e.from)))).map(Number).sort((a, b) => a - b),
+      rollback: rollbackOf(u),
+      waitsOn: waits,
+      earliest,
+      waitDays: workingDays(ctx.today, earliest),
+      sources: sortStrings(u.sources)
+    };
+  });
+  for (const s of steps)
+    if (s.rollback.gap)
+      gaps.push(s.rollback.gap);
+  for (const x of external) {
+    const caller = externalCaller.get(x.what);
+    if (caller && numOf.has(caller))
+      x.beforeStep = numOf.get(caller);
+  }
+  const sections = SECTIONS.map((d) => {
+    const s = sectionOf(ctx, "design.md", d.re);
+    if (!s || !s.text)
+      return { name: d.name, gap: d.gap };
+    const inSection = pairs.filter((p) => p.x.file === "design.md" && s.lines.some((l) => l.n === p.x.n));
+    if (d.name === "rollback" && inSection.length > 0 && inSection.every((p) => undoes(p.item)?.verdict === "no"))
+      return {
+        name: d.name,
+        heading: s.heading,
+        source: s.source,
+        gap: `design.md "${s.heading}" gives the order but no way back: say how each step is undone, and when to decide.`
+      };
+    return { name: d.name, heading: s.heading, source: s.source, text: s.text };
+  });
+  for (const s of sections)
+    if (s.gap)
+      gaps.push(s.gap);
+  const rollout = sections.find((s) => s.name === "rollout");
+  if (rollout?.text) {
+    const mentions = [];
+    for (const s of steps) {
+      const u = units.get(order[s.n - 1]);
+      const words = s.kind === "migration" ? [...u.names, "migration"] : u.names;
+      for (const w of words) {
+        const at = rollout.text.toLowerCase().search(new RegExp(`(^|[^a-z0-9_-])${w.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`));
+        if (at >= 0) {
+          mentions.push({ at, step: s.n, name: w });
+          break;
+        }
+      }
+    }
+    mentions.sort((a, b) => a.at - b.at);
+    for (let i = 0; i + 1 < mentions.length; i++)
+      for (let j = i + 1; j < mentions.length; j++)
+        if (mentions[i].step > mentions[j].step)
+          notes.push(`design.md (${rollout.source}) puts ${mentions[i].name} before ${mentions[j].name}; the dependencies put ${mentions[j].name} first (step ${mentions[j].step}).`);
+    const named = new Set(mentions.map((x) => x.step));
+    for (const s of steps)
+      if (!named.has(s.n) && s.kind !== "migration")
+        notes.push(`design.md's rollout doesn't mention step ${s.n} (${s.repo}).`);
+  }
+  for (const [id, why] of [...unplaced].sort(([a], [b]) => cmp2(a, b)))
+    gaps.push(why || id);
+  const findings = ctx.latest.filter((f) => f.finding.lens === "release" && f.finding.state === "open").map((f) => ({
+    gate: f.finding.gate,
+    id: f.finding.id,
+    rule: f.finding.rule,
+    severity: f.finding.severity,
+    state: f.finding.state,
+    summary: f.finding.summary,
+    path: f.path
+  }));
+  if (ctx.rounds.length === 0)
+    notes.push("No critic round has run on this change yet, so the release lens has nothing to add.");
+  return {
+    change: ctx.change.id,
+    title: ctx.change.title,
+    state: ctx.change.state,
+    today: ctx.today,
+    steps,
+    before,
+    external: external.filter((x, i, a) => a.findIndex((y) => y.what === x.what) === i),
+    unplaced: [...unplaced].map(([id, why]) => ({ id, why })).sort((a, b) => cmp2(a.id, b.id)),
+    sections,
+    findings,
+    earliest: steps.reduce((d, s) => laterOf(d, s.earliest), beforeReady),
+    gaps: [...new Set(gaps)],
+    notes: [...new Set(notes)]
+  };
+}
+function placeWhy(ctx, id, role) {
+  return ctx.get("Component", id) ? `${id} (${role}) has no repo in the catalog or the repos manifest, so Atticus can't place its deploy.` : `${id} (${role}) isn't in the catalog or the repos manifest, so Atticus can't place its deploy.`;
+}
+
+// packages/release/dist/forecast.js
+var RELEASED = /* @__PURE__ */ new Set(["released", "post-release-review", "archived"]);
+var MILESTONES = ["release-ready", "released"];
+async function releaseForecast(ctx, plan) {
+  const p = plan ?? await deploymentPlan(ctx);
+  const notes = [];
+  const tasks = readTasks(ctx.files);
+  const done = tasks.filter((t) => /\[[xX]\]/.test(t.text));
+  const open = tasks.filter((t) => !/\[[xX]\]/.test(t.text));
+  const taskNum = (t) => /\[[ xX]?\]\s*(\d+(?:\.\d+)*)/.exec(t.text)?.[1];
+  const waitingOnRequests = ctx.requests.flatMap((r) => r.unblocks).filter((n) => open.some((t) => taskNum(t) === n));
+  const taskView = {
+    total: tasks.length,
+    open: open.length,
+    done: done.length,
+    waitingOnRequests: [...new Set(waitingOnRequests)].sort()
+  };
+  if (RELEASED.has(ctx.change.state)) {
+    const at = ctx.change.history.filter((h) => h.to === "released").at(-1)?.at;
+    return {
+      change: ctx.change.id,
+      state: ctx.change.state,
+      today: ctx.today,
+      ...at ? { ready: at.slice(0, 10) } : {},
+      basis: "released",
+      status: "released",
+      waitDays: 0,
+      drivers: [],
+      tasks: taskView,
+      notes: at ? [`Released on ${at.slice(0, 10)} (change.yaml history).`] : []
+    };
+  }
+  const drivers = [];
+  for (const w of [...p.before, ...p.steps.flatMap((s) => s.waitsOn)])
+    if (w.readyBy)
+      drivers.push({
+        what: `${w.requestType}${w.record ? ` for ${w.record}` : ""} (${w.state === "filed" ? `filed${w.number ? ` as ${w.number}` : ""}` : w.state === "waiting" ? "waiting for a person to file it" : "not filed yet"})`,
+        until: w.readyBy,
+        days: w.waitDays ?? 0,
+        source: `${w.source}; lead time ${w.leadTimeDays} working days (${w.leadTimeSource})`
+      });
+  let ready = p.earliest;
+  let basis = drivers.length ? "requests" : "today";
+  let target;
+  let initiative;
+  const view = await readView(ctx.root);
+  const owning = view.all("Initiative").filter((i) => i.changes.includes(ctx.change.id)).sort((a, b) => a.id < b.id ? -1 : 1);
+  if (owning.length > 1)
+    notes.push(`${ctx.change.id} is in ${owning.length} initiatives (${owning.map((i) => i.id).join(", ")}); the forecast uses ${owning[0].id}.`);
+  if (owning[0]) {
+    try {
+      const st = await initiativeStatus(ctx.root, owning[0].id, { now: new Date(ctx.now) });
+      const planned = await readPlan(ctx.root, owning[0].id);
+      const milestoneOf = new Map((planned?.items ?? []).filter((i) => i.change === ctx.change.id && MILESTONES.includes(i.milestone ?? "")).map((i) => [i.key, i.milestone]));
+      const item = st.items.filter((i) => milestoneOf.has(i.key)).sort((a, b) => a.due < b.due ? -1 : 1)[0];
+      initiative = {
+        id: st.initiative,
+        title: st.title,
+        status: st.status,
+        ...st.targetRelease ? { targetRelease: st.targetRelease } : {},
+        ...st.projectedRelease ? { projectedRelease: st.projectedRelease } : {},
+        criticalPath: st.criticalPath,
+        ...item ? {
+          item: {
+            key: item.key,
+            milestone: milestoneOf.get(item.key),
+            due: item.due,
+            projectedFinish: item.projectedFinish,
+            status: item.status
+          }
+        } : {}
+      };
+      const src = `initiatives/${st.initiative}/plan.yaml`;
+      if (item) {
+        drivers.push({
+          what: `Initiative ${st.initiative}: ${item.what}`,
+          until: item.projectedFinish,
+          days: workingDays(ctx.today, item.projectedFinish),
+          source: `${src} item ${item.key} (critical path: ${st.criticalPath.join(" \u2192 ") || "none"})`
+        });
+        ready = laterOf(ready, item.projectedFinish);
+        basis = "initiative";
+        target = { date: item.due, source: `${src} item ${item.key} due` };
+      } else if (st.targetRelease) {
+        target = { date: st.targetRelease, source: `${src} targetRelease` };
+        notes.push(`Initiative ${st.initiative} has no release milestone for ${ctx.change.id}; the target is the initiative's release.`);
+      }
+      notes.push(...st.notes);
+    } catch (e) {
+      notes.push(`Initiative ${owning[0].id}: ${e.message}`);
+    }
+  } else
+    notes.push(`${ctx.change.id} isn't part of an initiative, so it has no target date.`);
+  if (open.length)
+    notes.push(`${open.length} of ${tasks.length} tasks are open. tasks.md carries no estimates, so they can't move the day: it is the earliest day the dates allow, not a promise.`);
+  if (!drivers.length)
+    notes.push("Nothing with a lead time stands in the way: no service request waits.");
+  for (const g of p.gaps.filter((x) => /no lead time/.test(x)))
+    notes.push(g);
+  const status = !target ? "no-target" : ctx.today > target.date ? "late" : ready > target.date ? "at-risk" : "on-track";
+  return {
+    change: ctx.change.id,
+    state: ctx.change.state,
+    today: ctx.today,
+    ready,
+    basis,
+    ...target ? { target } : {},
+    status,
+    waitDays: workingDays(ctx.today, ready),
+    drivers: drivers.sort((a, b) => a.until > b.until ? -1 : a.until < b.until ? 1 : 0),
+    tasks: taskView,
+    ...initiative ? { initiative } : {},
+    notes
+  };
+}
+
+// packages/release/dist/outcomes.js
+var import_yaml2 = __toESM(require_dist(), 1);
+import { mkdir, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+var OUTCOMES_FILE = "review/outcomes.yaml";
+var MEASURABLE = /* @__PURE__ */ new Set(["released", "post-release-review", "archived"]);
+var SECTION = [/success/i, /measures?|kpis?|metrics?/i, /outcome/i];
+function measureId(text) {
+  const slug = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (slug.length <= 60)
+    return slug || "measure";
+  const cut = slug.slice(0, 61);
+  return cut.slice(0, cut.lastIndexOf("-") > 20 ? cut.lastIndexOf("-") : 60);
+}
+var tidy = (s) => {
+  const t = s.trim().replace(/[.;]+$/, "").trim();
+  return t ? t[0].toUpperCase() + t.slice(1) : t;
+};
+function measuresOf(ctx) {
+  const doc = docOf(ctx.files, "brief.md");
+  if (!doc)
+    return { measures: [] };
+  const s = SECTION.map((re) => doc.sections.find((x) => re.test(x.heading))).find(Boolean);
+  if (!s)
+    return { measures: [] };
+  const out = [];
+  for (const sen of sentences(sectionLines(doc, s)))
+    for (const part of sen.text.split(/;\s+/)) {
+      const measure = tidy(part);
+      if (!measure)
+        continue;
+      let id = measureId(measure);
+      for (let k = 2; out.some((m) => m.id === id); k++)
+        id = `${measureId(measure)}-${k}`;
+      out.push({ id, n: out.length + 1, measure, source: `brief.md:${sen.n}` });
+    }
+  return { measures: out, source: `brief.md:${s.line}` };
+}
+async function readOutcomes(dir) {
+  let text;
+  try {
+    text = await readFile2(join2(dir, OUTCOMES_FILE), "utf8");
+  } catch {
+    return void 0;
+  }
+  const r = ChangeOutcomes.safeParse((0, import_yaml2.parse)(text));
+  if (!r.success)
+    throw new ReleaseError(`${OUTCOMES_FILE}: ${r.error.issues.map((i) => `${i.path.join(".")} ${i.message}`).join("; ")}`, "invalid");
+  return r.data;
+}
+async function outcomesView(ctx) {
+  const { measures, source } = measuresOf(ctx);
+  const file = await readOutcomes(ctx.dir);
+  const recorded = new Map((file?.measures ?? []).map((m) => [m.id, m]));
+  const gaps = [];
+  if (!source)
+    gaps.push('brief.md has no "Success measures" section, so there is nothing to measure after release. Add one: how the team will know the change worked.');
+  const canRecord = MEASURABLE.has(ctx.change.state) && measures.length > 0;
+  const why = !measures.length ? "The brief names no success measures." : canRecord ? void 0 : `Outcomes are measured after release; ${ctx.change.id} is ${ctx.change.state}.`;
+  return {
+    change: ctx.change.id,
+    title: ctx.change.title,
+    state: ctx.change.state,
+    ...source ? { source } : {},
+    measures: measures.map((m) => {
+      const values = recorded.get(m.id)?.values ?? [];
+      return { ...m, values, ...values.length ? { latest: values.at(-1) } : {} };
+    }),
+    orphans: (file?.measures ?? []).filter((x) => !measures.some((m) => m.id === x.id)).map((x) => ({ id: x.id, measure: x.measure, values: x.values })),
+    canRecord,
+    ...why ? { why } : {},
+    gaps
+  };
+}
+function findMeasure(measures, ref) {
+  const r = ref.trim();
+  if (/^\d+$/.test(r))
+    return measures.find((m) => m.n === Number(r));
+  return measures.find((m) => m.id === r) ?? measures.find((m) => m.measure.toLowerCase() === r.toLowerCase()) ?? measures.find((m) => m.id === measureId(r));
+}
+async function recordOutcome(ctx, input) {
+  const { measures } = measuresOf(ctx);
+  if (!measures.length)
+    throw new ReleaseError(`brief.md of ${ctx.change.id} names no success measures, so there is nothing to record.`, "refused");
+  if (!MEASURABLE.has(ctx.change.state))
+    throw new ReleaseError(`Outcomes are measured after release; ${ctx.change.id} is ${ctx.change.state}.`, "refused");
+  const m = findMeasure(measures, input.measure);
+  if (!m)
+    throw new ReleaseError(`brief.md has no measure "${input.measure}". Its measures: ${measures.map((x) => `${x.n} ${x.id}`).join("; ")}.`, "refused");
+  const by = input.by.replace(/^@/, "");
+  const value = {
+    value: input.value.trim(),
+    by,
+    at: ctx.now,
+    ...input.note?.trim() ? { note: input.note.trim() } : {}
+  };
+  const file = await readOutcomes(ctx.dir) ?? {
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    change: ctx.change.id,
+    measures: []
+  };
+  const existing = file.measures.find((x) => x.id === m.id);
+  const next = {
+    ...file,
+    measures: existing ? file.measures.map((x) => x.id === m.id ? { ...x, values: [...x.values, value] } : x) : [...file.measures, { id: m.id, measure: m.measure, values: [value] }]
+  };
+  const parsed = ChangeOutcomes.safeParse(next);
+  if (!parsed.success)
+    throw new ReleaseError(parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "), "refused");
+  const path = join2(ctx.dir, OUTCOMES_FILE);
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  try {
+    await writeFile(tmp, toCanonicalYaml(parsed.data, [
+      "schemaVersion",
+      "change",
+      "id",
+      "measure",
+      "value",
+      "by",
+      "at"
+    ]), "utf8");
+    await rename(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
+  return {
+    measure: m,
+    value: parsed.data.measures.find((x) => x.id === m.id).values.at(-1),
+    written: OUTCOMES_FILE
+  };
+}
+
+// packages/release/dist/evidence.js
+var import_yaml3 = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { copyFile, mkdir as mkdir2, readdir, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
+async function walk(dir, rel = "") {
+  let entries;
+  try {
+    entries = await readdir(join3(dir, rel), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+    const p = rel ? `${rel}/${e.name}` : e.name;
+    if (e.isDirectory())
+      out.push(...await walk(dir, p));
+    else if (e.isFile() && !e.name.endsWith(".tmp"))
+      out.push(p);
+  }
+  return out;
+}
+async function changeFiles(dir) {
+  const out = [];
+  for (const path of await walk(dir)) {
+    const buf = await readFile3(join3(dir, path));
+    out.push({ path, sha256: createHash("sha256").update(buf).digest("hex"), bytes: buf.length });
+  }
+  return out;
+}
+var esc = (s) => s.replace(/\|/g, "\\|").replace(/\n/g, " ");
+var day = (iso2) => iso2 ? iso2.slice(0, 10) : "";
+async function evidencePack(ctx) {
+  const files = await changeFiles(ctx.dir);
+  const c = ctx.change;
+  const md = [];
+  const h2 = (t) => {
+    if (md.at(-1) !== "")
+      md.push("");
+    md.push(`## ${t}`, "");
+  };
+  md.push(`# Evidence pack: ${c.id}`, "", `${c.title}. Generated ${ctx.now} by Atticus from the files of the change folder (\`openspec/changes/${c.id}/\`); nothing here is typed by hand, and every item names the file it came from.`);
+  h2("Change summary");
+  let risk;
+  try {
+    const rep = await changeReport(ctx.root, c.id);
+    risk = `${rep.risk.level} (score ${rep.risk.score})`;
+  } catch {
+    risk = "couldn't be assessed";
+  }
+  md.push(`| | |`, `| --- | --- |`, `| Change | ${c.id} |`, `| Title | ${esc(c.title)} |`, `| Type | ${c.type} |`, `| State | ${c.state} |`, `| Risk | ${risk} |`, `| Systems | ${c.systems.join(", ") || "none named"} |`, `| Owners | ${Object.entries(c.owners).map(([r, p]) => `${r}: ${p.join(", ")}`).join("; ")} |`, `| Created | ${c.createdAt} by ${c.createdBy} |`, "", "Source: change.yaml");
+  const problem = sectionOf(ctx, "brief.md", /^problem/i);
+  const outcome = sectionOf(ctx, "brief.md", /^outcome/i);
+  for (const s of [problem, outcome])
+    if (s)
+      md.push("", `**${s.heading}.** ${s.text.replace(/\n/g, " ")} (${s.source})`);
+  if (c.history.length) {
+    md.push("", "State history:", "");
+    for (const x of c.history)
+      md.push(`- ${x.at}: ${x.from} \u2192 ${x.to} by ${x.by}${x.pr ? ` (PR #${x.pr})` : ""}${x.reason ? `: ${x.reason}` : ""}`);
+    md.push("", "Source: change.yaml history");
+  }
+  h2("Artifacts and their sha-256");
+  const recorded = /* @__PURE__ */ new Map();
+  for (const hf of c.handoffs)
+    for (const a of hf.artifacts)
+      recorded.set(a.path, { phase: hf.phase, sha256: a.sha256 });
+  if (recorded.size)
+    md.push("| File | Bytes | sha-256 | Against the hand-off |", "| --- | --- | --- | --- |");
+  else
+    md.push("| File | Bytes | sha-256 |", "| --- | --- | --- |");
+  for (const f of files) {
+    const r = recorded.get(f.path);
+    const against = !r ? "not in a hand-off" : r.sha256 === f.sha256 ? `matches ${r.phase}` : `changed since ${r.phase} (${r.sha256.slice(0, 12)}\u2026)`;
+    md.push(`| ${f.path} | ${f.bytes} | \`${f.sha256}\` |${recorded.size ? ` ${against} |` : ""}`);
+  }
+  if (!recorded.size)
+    md.push("", "_No hand-off recorded artifact hashes, so there is nothing to compare against._");
+  h2("Critic rounds and findings");
+  const rounds = ctx.rounds.filter((r) => r.gate !== "drift");
+  if (!rounds.length)
+    md.push("_No critic round has run on this change yet._");
+  for (const r of rounds) {
+    const open = r.findings.filter((f) => f.finding.state === "open").length;
+    md.push(`### ${r.gate} gate, round ${r.round}${r.meta?.createdAt ? ` (${r.meta.createdAt})` : ""}`, "", `${r.findings.length} finding${r.findings.length === 1 ? "" : "s"}, ${open} open. Source: review/${r.gate}/${r.round}/`, "");
+    if (r.findings.length) {
+      md.push("| Finding | Severity | Rule | State | Summary | Resolution | Source |", "| --- | --- | --- | --- | --- | --- | --- |");
+      for (const { finding: f, path } of r.findings) {
+        const res = f.resolution ? `${f.resolution.action} by ${f.resolution.by} ${day(f.resolution.at)}${f.resolution.reason ? `: ${esc(f.resolution.reason)}` : ""}${f.resolution.askedOf ? ` (asked of ${f.resolution.askedOf})` : ""}` : "";
+        md.push(`| ${f.id} | ${f.severity} | ${f.rule} | ${f.state} | ${esc(f.summary)} | ${res} | ${path} |`);
+      }
+      md.push("");
+    }
+  }
+  h2("Waivers");
+  const waived = ctx.rounds.flatMap((r) => r.findings).filter((f) => f.finding.state === "waived");
+  const uniq = waived.filter((w, i, a) => a.findIndex((x) => x.finding.gate === w.finding.gate && x.finding.rule === w.finding.rule && x.finding.summary === w.finding.summary) === i);
+  if (!uniq.length)
+    md.push(rounds.length ? "_No finding is waived._" : "_No critic round yet, so nothing is waived._");
+  for (const { finding: f, path } of uniq)
+    md.push(`- ${f.summary} Rule ${f.rule} (${f.layer}), waived by ${f.resolution?.by ?? "?"} on ${day(f.resolution?.at)}: ${f.resolution?.reason ?? "no reason recorded"} (${path})`);
+  h2("Approvals (hand-off PRs)");
+  if (!c.handoffs.length)
+    md.push("_No hand-off PR yet._");
+  for (const hf of c.handoffs) {
+    md.push(`- ${hf.phase}: PR #${hf.pr.number} ${hf.pr.url}, ${hf.state}, raised by ${hf.by} ${day(hf.openedAt)}; ${hf.approvals.length ? `approved by ${hf.approvals.map((a) => `${a.by}${a.roles?.length ? ` as ${a.roles.join(", ")}` : ""} (${a.at})`).join("; ")}` : "no approvals yet"}.`);
+  }
+  if (c.handoffs.length)
+    md.push("", "Source: change.yaml handoffs");
+  h2("Test trace");
+  try {
+    const t = await traceMatrix(ctx.root, c.id);
+    const byKind = /* @__PURE__ */ new Map();
+    for (const g of t.gaps)
+      byKind.set(g.kind, (byKind.get(g.kind) ?? 0) + 1);
+    const tested = t.rows.filter((r) => r.tests.length).length;
+    md.push(`${t.requirements.length} requirement${t.requirements.length === 1 ? "" : "s"}, ${t.stories.length} stor${t.stories.length === 1 ? "y" : "ies"}, ${t.rows.length} trace row${t.rows.length === 1 ? "" : "s"} of which ${tested} ha${tested === 1 ? "s" : "ve"} a test; ${t.found.length} test file${t.found.length === 1 ? "" : "s"} found in the repos.`);
+    if (t.gaps.length) {
+      md.push("", "Gaps:", "");
+      for (const [k, n] of [...byKind].sort())
+        md.push(`- ${k}: ${n}`);
+    }
+    md.push("", "Source: computed as `atticus trace` does, from specs/, stories/, tests/ and Run with AI records");
+  } catch (e) {
+    md.push(`_The trace couldn't be computed: ${e.message}_`);
+  }
+  h2("Service requests and manual steps");
+  if (!ctx.requests.length)
+    md.push(`_${REQUESTS_FILE} drafts no service request._`);
+  for (const r of ctx.requests)
+    md.push(`- ${r.heading}: ${r.state === "filed" ? `filed${r.number ? ` as ${r.number}` : ""}${r.filedAt ? ` on ${day(r.filedAt)}` : ""}` : r.state === "waiting" ? `waiting for a person to file it (step ${r.step})` : "not filed"}${r.missing.length ? `; missing ${r.missing.join(", ")}` : ""} (${REQUESTS_FILE}:${r.line})`);
+  const steps = [...ctx.steps].sort((a, b) => a.createdAt < b.createdAt ? -1 : a.createdAt > b.createdAt ? 1 : a.id < b.id ? -1 : 1);
+  if (steps.length) {
+    md.push("", "| Step | System | What | State | Done by | Source |", "| --- | --- | --- | --- | --- | --- |");
+    for (const s of steps)
+      md.push(`| ${s.id} | ${s.system} | ${esc(s.title)} | ${s.state} | ${s.recorded ? `${s.recorded.by} ${s.recorded.at}${s.recorded.via === "executor" ? ` via ${s.recorded.executor ?? "an executor"}` : ""}` : ""} | steps/${s.id}.yaml |`);
+  } else
+    md.push("", "_No manual step for this change._");
+  h2("Drift");
+  const drift = ctx.rounds.filter((r) => r.gate === "drift").at(-1);
+  if (!drift)
+    md.push("_No drift check has run on this change (it runs in build and qa, and after each scan)._");
+  else {
+    const open = drift.findings.filter((f) => f.finding.state === "open");
+    md.push(`Newest round ${drift.round}${drift.meta?.createdAt ? ` (${drift.meta.createdAt})` : ""}: ${open.length ? `${open.length} open drift finding${open.length === 1 ? "" : "s"}` : "no open drift"}. Source: review/drift/${drift.round}/`);
+    for (const f of open)
+      md.push(`- ${f.finding.summary} (${f.path})`);
+  }
+  h2("AI run summaries");
+  const runs = [];
+  for (const f of files.filter((x) => /(^|\/)runs\/[^/]+\.ya?ml$/.test(x.path))) {
+    try {
+      const s = readRunSummary((0, import_yaml3.parse)(await readFile3(join3(ctx.dir, f.path), "utf8")));
+      if (s.success)
+        runs.push(`- ${s.data.runId}: ${s.data.agent} on ${s.data.runtime}, ${s.data.state}, ${s.data.startedAt}${s.data.usage ? `, ${s.data.usage.inputTokens} in / ${s.data.usage.outputTokens} out tokens` : ""}; context sha-256 \`${s.data.contextManifestSha256.slice(0, 12)}\u2026\` (${f.path})`);
+    } catch {
+    }
+  }
+  for (const r of rounds)
+    for (const l of r.meta?.lenses ?? [])
+      runs.push(`- ${r.gate} round ${r.round}, ${l.lens} lens: ${l.agent}, ${l.state}${l.reason ? ` (${l.reason})` : ""}${l.promptSha256 ? `; prompt sha-256 \`${l.promptSha256.slice(0, 12)}\u2026\`` : ""} (review/${r.gate}/${r.round}/meta/round.yaml)`);
+  md.push(...runs.length ? runs : ["_No AI run is recorded for this change._"]);
+  h2("Outcomes");
+  const o = await outcomesView(ctx);
+  if (!o.measures.length)
+    md.push(`_${o.gaps[0] ?? "The brief names no success measures."}_`);
+  for (const m of o.measures)
+    md.push(`- ${m.measure} (${m.source}): ${m.latest ? `${m.latest.value}, measured by ${m.latest.by} on ${day(m.latest.at)} (review/outcomes.yaml)` : "not measured yet"}`);
+  return {
+    change: c.id,
+    title: c.title,
+    generatedAt: ctx.now,
+    files,
+    markdown: md.join("\n") + "\n"
+  };
+}
+async function writeEvidencePack(ctx, out) {
+  const pack = await evidencePack(ctx);
+  await mkdir2(out, { recursive: true });
+  const written = ["evidence.md", "manifest.json"];
+  await writeFile2(join3(out, "evidence.md"), pack.markdown, "utf8");
+  await writeFile2(join3(out, "manifest.json"), JSON.stringify({ change: pack.change, generatedAt: pack.generatedAt, files: pack.files }, null, 2) + "\n", "utf8");
+  for (const f of pack.files) {
+    const to = join3(out, "files", ...f.path.split("/"));
+    await mkdir2(dirname2(to), { recursive: true });
+    await copyFile(join3(ctx.dir, ...f.path.split("/")), to);
+    written.push(`files/${f.path}`);
+  }
+  return written;
+}
+
+// packages/release/dist/notes.js
+var AUDIENCES = ["business", "technical"];
+var lines = (text) => (text ?? "").split("\n").map((l) => l.trim()).filter(Boolean);
+var bullets = (text) => lines(text).map((l) => l.replace(/^([-*+]|\d+\.)\s+/, ""));
+function breakingOf(change, said, j) {
+  if (j?.by === "veto")
+    return change === "planned-retire" ? { breaking: "yes", why: "The operation is retired.", judgedBy: "catalog" } : {
+      breaking: "no",
+      why: "A new operation in this change, so no existing caller breaks.",
+      judgedBy: "catalog"
+    };
+  if (!said)
+    return {
+      breaking: "check",
+      why: "interfaces.md doesn't say what changes for callers.",
+      judgedBy: "not judged"
+    };
+  const by = !j ? "not judged" : j.judgment?.confirmedBy.by === "person" ? "person" : "model";
+  if (j?.verdict === "yes")
+    return { breaking: "yes", why: said, judgedBy: by };
+  if (j?.verdict === "no")
+    return { breaking: "no", why: said, judgedBy: by };
+  return {
+    breaking: "check",
+    why: j ? `A judge couldn't tell whether callers must change, so a person checks: ${said}` : `Not judged: no model was asked whether callers must change, so a person checks: ${said}`,
+    judgedBy: by
+  };
+}
+async function releaseNotes(ctx, audience = "business") {
+  const m = buildModel(ctx);
+  const problem = sectionOf(ctx, "brief.md", /^problem|^why/i);
+  const outcome = sectionOf(ctx, "brief.md", /^outcome/i);
+  const scope = sectionOf(ctx, "brief.md", /^scope/i);
+  const questions = sectionOf(ctx, "brief.md", /open questions/i);
+  const whyP = sectionOf(ctx, "proposal.md", /^why/i);
+  const what = sectionOf(ctx, "proposal.md", /what changes/i);
+  const impact = sectionOf(ctx, "proposal.md", /^impact/i);
+  const systemsTable = tableWith(docOf(ctx.files, "proposal.md"), ["why"]);
+  const who = [];
+  let whoSource;
+  if (systemsTable) {
+    whoSource = `proposal.md:${systemsTable.line}`;
+    for (const r of systemsTable.rows) {
+      const idCell = Object.entries(r.cells).find(([k]) => /system/.test(k))?.[1] ?? "";
+      const id = idCell.split(/\s+/)[0] ?? "";
+      if (!id)
+        continue;
+      const how = Object.entries(r.cells).find(([k]) => /new|modified|retired/.test(k))?.[1] ?? "";
+      who.push(`${m.systemName(id)}${how ? ` (${how})` : ""}: ${r.cells.why || "no reason given"}`);
+    }
+  } else
+    for (const s of ctx.change.systems) {
+      who.push(m.systemName(s));
+      whoSource = "change.yaml";
+    }
+  const outOfScope = scope ? sentences(scope.lines).map((s) => /out of scope:?\s*(.*)$/i.exec(s.text)?.[1]?.trim()).filter((x) => !!x).map((x) => x[0].toUpperCase() + x.slice(1).replace(/\.$/, "")) : [];
+  const planned = m.hops.filter((h) => /^planned-/.test(h.change));
+  const saidOf = (h) => h.notes.map((n) => n.text.replace(/^\s*[-*]\s+/, "").trim()).join(" ");
+  const itemOf = (h) => breakingItem({ change: h.change, operation: opOf(h), caller: h.caller, callee: h.callee }, saidOf(h));
+  const judged = await judgedFor(ctx, BREAKING_SPEC, planned.filter((h) => saidOf(h) || h.change === "planned-new" || h.change === "planned-retire").map(itemOf));
+  const api = planned.map((h) => {
+    const b = breakingOf(h.change, saidOf(h), judged(itemOf(h)));
+    return {
+      operation: opOf(h),
+      caller: h.caller,
+      callee: h.calleeBoundary === "vendor" && h.calleeSystem ? `${h.callee} (${m.systemName(h.calleeSystem)}, a vendor)` : h.callee,
+      change: h.change.replace(/^planned-/, ""),
+      ...b,
+      source: `interfaces.md:${h.line}`
+    };
+  });
+  const data = m.data.map((d) => ({
+    table: `${d.store}.${d.table}`,
+    change: d.change.trim(),
+    ...d.migration ? { migration: d.migration } : {},
+    source: `data.md:${d.line}`
+  }));
+  const limitations = ctx.latest.filter((f) => f.finding.state === "waived").map((f) => ({
+    summary: f.finding.summary,
+    ...f.finding.resolution?.reason ? { reason: f.finding.resolution.reason } : {},
+    ...f.finding.resolution ? { by: f.finding.resolution.by, at: f.finding.resolution.at } : {},
+    source: f.path
+  }));
+  const sections = [];
+  const add = (heading, items, source, empty) => sections.push({
+    heading,
+    items,
+    ...source ? { source } : {},
+    ...items.length ? {} : { empty }
+  });
+  const why = problem ?? whyP;
+  add("Why", lines(why?.text), why?.source, "The brief doesn't say why yet.");
+  const changes = what ? bullets(what.text) : lines(outcome?.text);
+  add("What changes", changes, what?.source ?? outcome?.source, "Neither the proposal nor the brief says what changes yet.");
+  add("Who it affects", who, whoSource, "The proposal names no systems.");
+  if (audience === "technical") {
+    add("API changes", api.map((a) => `${a.operation} (${a.caller} \u2192 ${a.callee}): ${a.change}; breaking: ${a.breaking}${a.judgedBy === "not judged" ? " (not judged)" : ""}. ${a.why}`), api.length ? "interfaces.md" : void 0, "interfaces.md lists no new or changed interfaces.");
+    add("Data changes", data.map((d) => `${d.table}: ${d.change}${d.migration ? ` (${d.migration})` : " (no migration named)"}`), data.length ? "data.md" : void 0, "data.md lists no data changes.");
+    if (impact)
+      add("Impact", lines(impact.text), impact.source, "");
+  }
+  add("Not included", outOfScope, outOfScope.length ? scope?.source : void 0, "The brief doesn't say what is out of scope.");
+  add("Known limitations", limitations.map((l) => `${l.summary}${l.reason ? ` Waived${l.by ? ` by ${l.by}` : ""}${l.at ? ` on ${l.at.slice(0, 10)}` : ""}: ${l.reason}` : ""} (${l.source})`), void 0, ctx.rounds.length ? "No finding is waived." : "No critic round has run yet, so no finding is waived.");
+  if (audience === "business")
+    add("Still open", bullets(questions?.text), questions?.source, "The brief has no open questions.");
+  const md = [
+    `# Release notes: ${ctx.change.title}`,
+    "",
+    `For ${audience} readers. Change \`${ctx.change.id}\`, generated ${ctx.today} from the change folder; every line says where it came from.`
+  ];
+  for (const s of sections) {
+    md.push("", `## ${s.heading}`, "");
+    if (s.heading === "API changes" && api.length) {
+      md.push("| Operation | Caller \u2192 callee | Change | Breaking | Why | Source |");
+      md.push("| --- | --- | --- | --- | --- | --- |");
+      for (const a of api)
+        md.push(`| ${a.operation} | ${a.caller} \u2192 ${a.callee} | ${a.change} | ${a.breaking} (${a.judgedBy === "catalog" ? "by its change kind" : a.judgedBy === "not judged" ? "not judged" : a.breaking === "check" ? "a judge couldn't tell" : `judged by a ${a.judgedBy}`}) | ${a.why.replace(/\|/g, "\\|")} | ${a.source} |`);
+      continue;
+    }
+    if (s.heading === "Data changes" && data.length) {
+      md.push("| Table | Change | Migration | Source |", "| --- | --- | --- | --- |");
+      for (const d of data)
+        md.push(`| ${d.table} | ${d.change.replace(/\|/g, "\\|")} | ${d.migration ?? "none named"} | ${d.source} |`);
+      continue;
+    }
+    if (!s.items.length) {
+      md.push(`_${s.empty}_`);
+      continue;
+    }
+    if (s.heading === "Why" || s.heading === "Impact")
+      md.push(s.items.join(" "));
+    else
+      for (const i of s.items)
+        md.push(`- ${i}`);
+    if (s.source)
+      md.push("", `Source: ${s.source}`);
+  }
+  return {
+    change: ctx.change.id,
+    title: ctx.change.title,
+    audience,
+    today: ctx.today,
+    sections,
+    api,
+    data,
+    limitations,
+    markdown: md.join("\n") + "\n"
+  };
+}
+
+// packages/release/dist/security.js
+var SECURITY_RULES = /* @__PURE__ */ new Set([
+  "data-columns-classified",
+  "data-retention-stated",
+  "interface-pattern-approved",
+  "interface-ends-in-catalog",
+  "vendor-operation-known",
+  "no-embedded-instructions"
+]);
+var SECURITY_WORDS = /\b(auth\w*|secur\w*|secret|personal|privacy|classif\w*|encrypt\w*|tls|mtls|credential|token|vendor|retention|pii)\b/i;
+function authFromText(text) {
+  if (/\bm-?tls\b|mutual tls|client cert/i.test(text))
+    return "mtls";
+  if (/\boauth/i.test(text))
+    return "oauth2";
+  if (/\bapi[- ]?key/i.test(text))
+    return "api-key";
+  if (/\bbasic auth/i.test(text))
+    return "basic";
+  if (/\b(no auth|unauthenticated|without auth)/i.test(text))
+    return "none";
+  return void 0;
+}
+function authOf(ctx, h) {
+  if (h.record?.auth)
+    return { auth: h.record.auth, source: `catalog Interface ${h.record.id}` };
+  const ep = ctx.all("Endpoint").find((e) => e.component === h.callee && (e.method ?? "").toUpperCase() === (h.method ?? "") && (e.normalizedPath ?? normalizePath(e.pathOrTopic)) === (h.path ? normalizePath(h.path) : ""));
+  if (ep?.auth)
+    return { auth: ep.auth, source: `catalog Endpoint ${ep.id}` };
+  for (const n of h.notes) {
+    const a = authFromText(n.text);
+    if (a)
+      return { auth: a, source: `interfaces.md:${n.n}` };
+  }
+  for (const r of h.routes) {
+    const route = ctx.get("GatewayRoute", r);
+    for (const p of route?.policies ?? []) {
+      const a = authFromText(p.replace(/([a-z])([A-Z])/g, "$1 $2"));
+      if (a)
+        return { auth: a, source: `catalog GatewayRoute ${r} policy ${p}` };
+    }
+  }
+  return { auth: "not stated" };
+}
+function classifier(ctx, m) {
+  const levels = ctx.orgPack.pack?.classification ?? [
+    "public",
+    "internal",
+    "confidential",
+    "restricted"
+  ];
+  const personal = ctx.policy.privacy.classifications;
+  const terms = [...personal, ...levels];
+  const doc = docOf(ctx.files, "data.md");
+  const sec = sectionMatching(doc, /classif/i);
+  const lines2 = doc && sec ? sectionLines(doc, sec) : [];
+  const termIn = (text) => terms.find((t) => hasWord(text, t));
+  return {
+    levels,
+    personal,
+    of(table, column) {
+      const col = ctx.all("Column").find((c) => c.name === column && (c.table.endsWith(`.${table}`) || c.table === table));
+      if (col?.classification)
+        return { classification: col.classification, source: `catalog Column ${col.id}` };
+      const own = lines2.find((l) => hasWord(l.text, column) && termIn(l.text));
+      if (own)
+        return { classification: termIn(own.text), source: `data.md:${own.n}` };
+      const tableWide = lines2.find((l) => hasWord(l.text, table) && /\bcolumns\b/i.test(l.text) && termIn(l.text));
+      if (tableWide)
+        return { classification: termIn(tableWide.text), source: `data.md:${tableWide.n}` };
+      void m;
+      return { classification: "not classified yet" };
+    }
+  };
+}
+async function securityReview(ctx) {
+  const m = buildModel(ctx);
+  const c = classifier(ctx, m);
+  const gaps = [];
+  const planned = m.hops.filter((h) => /^planned-/.test(h.change));
+  const interfaces = planned.map((h) => {
+    const a = authOf(ctx, h);
+    const crosses = h.callerSystem && h.calleeSystem && h.callerSystem !== h.calleeSystem ? `${m.systemName(h.callerSystem)} \u2192 ${m.systemName(h.calleeSystem)}${h.calleeBoundary ? ` (${h.calleeBoundary})` : ""}` : !h.calleeSystem ? `${h.callee} isn't in the catalog` : void 0;
+    if (a.auth === "not stated")
+      gaps.push(`interfaces.md:${h.line}: ${opOf(h)} (${h.caller} \u2192 ${h.callee}) says nothing about auth, and the catalog has none.`);
+    return {
+      operation: opOf(h),
+      caller: h.caller,
+      callee: h.callee,
+      change: h.change.replace(/^planned-/, ""),
+      auth: a.auth,
+      ...a.source ? { authSource: a.source } : {},
+      ...crosses ? { crosses } : {},
+      source: `interfaces.md:${h.line}`
+    };
+  });
+  const columnItem = (table, column, type) => personalItem({
+    column,
+    table,
+    ...type ? { type } : {},
+    classifiedPersonal: c.personal.includes(c.of(table, column).classification)
+  });
+  const mappedItem = (src) => {
+    const dot = /^([a-z0-9_]+)\.([a-z0-9_]+)$/i.exec(src.trim());
+    return dot ? columnItem(dot[1], dot[2]) : personalItem({ column: src, table: "(mapping)" });
+  };
+  const mdoc = docOf(ctx.files, "mappings.md");
+  const mappedSources = (mdoc?.tables ?? []).filter((t) => t.headers.includes("source field")).flatMap((t) => t.rows.map((r) => r.cells["source field"] ?? "")).filter(Boolean);
+  const personalOf = await judgedFor(ctx, PERSONAL_DATA_SPEC, [
+    ...m.data.flatMap((d) => d.newColumns.map((col) => columnItem(d.table, col.name, col.type))),
+    ...mappedSources.map(mappedItem)
+  ]);
+  const personalWord = (item) => {
+    const v = personalOf(item)?.verdict;
+    return v === "yes" || v === "no" || v === "unsure" ? v : "not judged";
+  };
+  const fields = [];
+  for (const d of m.data)
+    for (const col of d.newColumns) {
+      const k = c.of(d.table, col.name);
+      const personal = personalWord(columnItem(d.table, col.name, col.type));
+      fields.push({
+        field: `${d.store}.${d.table}.${col.name}`,
+        classification: k.classification,
+        ...k.source ? { classificationSource: k.source } : {},
+        personal,
+        personalLooking: personal === "yes",
+        source: `data.md:${d.line}`
+      });
+    }
+  for (const f of fields) {
+    if (f.classification === "not classified yet")
+      gaps.push(`${f.field} (${f.source}) is not classified yet.`);
+    else if (f.personal === "yes" && !c.personal.includes(f.classification))
+      gaps.push(`${f.field} is judged personal data but is classified ${f.classification} (${f.classificationSource}).`);
+  }
+  const unjudged = fields.filter((f) => (f.personal === "not judged" || f.personal === "unsure") && !c.personal.includes(f.classification));
+  if (unjudged.length)
+    gaps.push(`Not judged whether ${unjudged.map((f) => f.field).join(", ")} ${unjudged.length === 1 ? "holds" : "hold"} personal data (${unjudged.some((f) => f.personal === "unsure") ? "a judge couldn't tell" : "no model was asked"}), so a person checks ${unjudged.length === 1 ? "it" : "them"} against the personal classes (${c.personal.join(", ")}).`);
+  const crossings = [];
+  const level = (cl) => c.levels.indexOf(cl);
+  const sensitiveFrom = Math.max(1, level("confidential"));
+  for (const h of planned) {
+    if (!h.callerSystem || !h.calleeSystem || h.callerSystem === h.calleeSystem)
+      continue;
+    const s = mdoc?.sections.find((x) => x.heading.trim().toLowerCase() === opOf(h).toLowerCase());
+    const t = s && mdoc ? mdoc.tables.find((x) => x.line > s.line && x.line <= s.end && x.headers.includes("source field")) : void 0;
+    const out = (t?.rows ?? []).map((r) => {
+      const src = r.cells["source field"] ?? "";
+      const dot = /^([a-z0-9_]+)\.([a-z0-9_]+)$/i.exec(src.trim());
+      const k = dot ? c.of(dot[1], dot[2]) : { classification: "not a catalog field" };
+      const personal = src ? personalWord(mappedItem(src)) : "not judged";
+      const sensitive = c.personal.includes(k.classification) || personal === "yes" || level(k.classification) >= sensitiveFrom ? "yes" : level(k.classification) >= 0 && personal === "no" ? "no" : "unknown";
+      return {
+        field: src,
+        classification: k.classification,
+        ...k.source ? { classificationSource: k.source } : {},
+        personal,
+        personalLooking: personal === "yes",
+        ...r.cells["rule or transformation"] ? { transform: r.cells["rule or transformation"] } : {},
+        sensitive,
+        source: `mappings.md:${r.line}`
+      };
+    });
+    const note = s && mdoc && !t ? sectionLines(mdoc, s).map((l) => l.text.trim()).join(" ") : void 0;
+    if (!s)
+      gaps.push(`${opOf(h)} crosses from ${m.systemName(h.callerSystem)} to ${m.systemName(h.calleeSystem)} but mappings.md doesn't say which fields it sends.`);
+    crossings.push({
+      operation: opOf(h),
+      from: m.systemName(h.callerSystem),
+      to: m.systemName(h.calleeSystem),
+      toBoundary: h.calleeBoundary ?? "unknown",
+      fields: out,
+      ...note ? { note } : {},
+      source: t ? `mappings.md:${t.line}` : s ? `mappings.md:${s.line}` : `interfaces.md:${h.line}`
+    });
+  }
+  const vendorIds = sortStrings([
+    ...ctx.change.systems.filter((s) => m.boundaryOf(s) === "vendor"),
+    ...planned.filter((h) => h.calleeBoundary === "vendor" && h.calleeSystem).map((h) => h.calleeSystem)
+  ]);
+  const plannedIds = new Set(planned.map((h) => h.record?.id).filter(Boolean));
+  const vendors = vendorIds.map((v) => {
+    const existing = ctx.all("Interface").filter((i) => m.systemOf(i.to) === v && !plannedIds.has(i.id)).length;
+    return {
+      system: v,
+      name: m.systemName(v),
+      isNew: existing === 0,
+      operations: planned.filter((h) => h.calleeSystem === v).map((h) => opOf(h)),
+      existing
+    };
+  });
+  const secrets = [];
+  for (const i of interfaces) {
+    if (i.change === "retire")
+      continue;
+    if (i.auth === "mtls")
+      secrets.push({
+        what: `A client certificate for ${i.caller} to call ${i.operation} (mTLS)`,
+        source: i.authSource ?? i.source
+      });
+    if (i.auth === "api-key")
+      secrets.push({
+        what: `An API key for ${i.caller} to call ${i.operation}`,
+        source: i.authSource ?? i.source
+      });
+    if (i.auth === "oauth2") {
+      const h = planned.find((x) => opOf(x) === i.operation && x.caller === i.caller);
+      const grant = ctx.all("AccessGrant").find((g) => g.subject === i.caller && h.routes.some((r) => (ctx.get("GatewayRoute", r)?.proxy ?? r) === g.resource));
+      secrets.push(grant ? {
+        what: `OAuth client ${i.caller} with scopes ${grant.scopesOrPermissions.join(", ")} (existing grant)`,
+        source: `catalog AccessGrant ${grant.id}`
+      } : {
+        what: `An OAuth client for ${i.caller} to call ${i.operation}: no access grant in the catalog yet`,
+        source: i.authSource ?? i.source
+      });
+    }
+  }
+  const candidates = [...ctx.files.docs].flatMap(([path, doc]) => contentLines(doc).filter((l) => !/^\s*#/.test(l.text) && !/^\s*\|[\s|:-]*\|?\s*$/.test(l.text)).map((l) => ({ path, doc, l, item: secretItem(l.text.trim()) })));
+  const secretOf = await judgedFor(ctx, NAMES_SECRET_SPEC, candidates.map((x) => x.item));
+  const secretsNotJudged = [];
+  for (const { path, doc, l, item } of candidates) {
+    const v = secretOf(item);
+    if (!v || v.verdict === "unsure")
+      secretsNotJudged.push(`${path}:${l.n}`);
+    if (v?.verdict !== "yes")
+      continue;
+    const format = tokenFormatIn(l.text);
+    if (format) {
+      gaps.push(`${path}:${l.n} holds what looks like ${format}: take it out of the change folder and rotate it.`);
+      secrets.push({
+        what: `${format}, written in the change (not shown here)`,
+        source: `${path}:${l.n}`
+      });
+      continue;
+    }
+    const row = doc.tables.flatMap((t) => t.rows).find((r) => r.line === l.n);
+    const what = !row ? l.text.trim().replace(/^[-*]\s+/, "") : row.cells["source field"] && row.cells["target field"] ? `${row.cells["source field"]} \u2192 ${row.cells["target field"]}: ${Object.entries(row.cells).filter(([k, v2]) => v2 && k !== "source field" && k !== "target field").map(([, v2]) => v2).join("; ")}` : Object.values(row.cells).filter(Boolean).join("; ");
+    secrets.push({ what, source: `${path}:${l.n}` });
+  }
+  const uniqueSecrets = secrets.filter((x, i, a) => a.findIndex((y) => y.what === x.what && y.source === x.source) === i);
+  const touchedComponents = new Set(planned.flatMap((h) => [h.caller, h.callee]));
+  const settings = ctx.all("Setting").filter((s) => touchedComponents.has(s.component) && (!s.target || touchedComponents.has(s.target))).map((s) => ({
+    id: s.id,
+    key: s.key,
+    value: s.valueOrRef,
+    component: s.component,
+    ...s.target ? { target: s.target } : {}
+  }));
+  const findings = ctx.latest.filter((f) => f.finding.state === "open" && (SECURITY_RULES.has(f.finding.rule) || SECURITY_WORDS.test(f.finding.summary))).map((f) => ({
+    gate: f.finding.gate,
+    id: f.finding.id,
+    rule: f.finding.rule,
+    severity: f.finding.severity,
+    summary: f.finding.summary,
+    path: f.path
+  }));
+  const gates = ctx.orgPack.gates.gates.filter((g) => g.phase === "design" || g.phase === "release").map((g) => {
+    const h = ctx.change.handoffs.filter((x) => x.phase === g.phase).at(-1);
+    return {
+      gate: g.id,
+      phase: g.phase,
+      ...h ? {
+        handoff: {
+          state: h.state,
+          pr: h.pr.url,
+          approvals: h.approvals.map((a) => `${a.by} ${a.at.slice(0, 10)}`)
+        }
+      } : {}
+    };
+  });
+  const signOff = {
+    gates,
+    how: gates.length ? `Reviewers approve the ${gates.map((g) => g.phase).join(" and ")} hand-off PRs on the Git host with this draft in hand; merging a PR is its sign-off, and atticus change sync records it. The Git host's rules (branch protection, CODEOWNERS) decide who may approve. There is no separate security approval.` : "gates.yaml has no design or release gate, so no hand-off PR carries this review yet."
+  };
+  const review = {
+    change: ctx.change.id,
+    title: ctx.change.title,
+    today: ctx.today,
+    levels: c.levels,
+    interfaces,
+    fields,
+    crossings,
+    vendors,
+    secrets: uniqueSecrets,
+    secretsNotJudged,
+    settings,
+    findings,
+    signOff,
+    gaps: [...new Set(gaps)]
+  };
+  return { ...review, markdown: securityMarkdown(review, ctx.rounds.length > 0) };
+}
+var esc2 = (s) => s.replace(/\|/g, "\\|");
+function securityMarkdown(r, reviewed) {
+  const md = [
+    `# Security review draft: ${r.title}`,
+    "",
+    `Change \`${r.change}\`, generated ${r.today} from the catalog and the change folder. A draft for the reviewers of the hand-off PRs: every line says where it came from, and anything Atticus couldn't find is listed as a gap.`,
+    "",
+    "## New or changed interfaces",
+    ""
+  ];
+  if (r.interfaces.length) {
+    md.push("| Operation | Caller \u2192 callee | Change | Auth | Auth from | Crosses | Source |", "| --- | --- | --- | --- | --- | --- | --- |");
+    for (const i of r.interfaces)
+      md.push(`| ${i.operation} | ${i.caller} \u2192 ${i.callee} | ${i.change} | ${i.auth} | ${i.authSource ?? "nowhere"} | ${i.crosses ?? "no"} | ${i.source} |`);
+  } else
+    md.push("_interfaces.md lists no new or changed interfaces._");
+  md.push("", "## Data fields touched", "", `Classification levels (org pack): ${r.levels.join(", ")}.`, "");
+  if (r.fields.length) {
+    md.push("| Field | Classification | From | Personal data | Source |", "| --- | --- | --- | --- | --- |");
+    for (const f of r.fields)
+      md.push(`| ${f.field} | ${f.classification} | ${f.classificationSource ?? "nowhere"} | ${f.personal} | ${f.source} |`);
+  } else
+    md.push("_data.md adds no fields._");
+  md.push("", "## Data crossing a boundary", "");
+  if (r.crossings.length)
+    for (const x of r.crossings) {
+      md.push(`### ${x.operation}: ${x.from} \u2192 ${x.to} (${x.toBoundary})`, "");
+      if (x.fields.length) {
+        md.push("| Field | Classification | Transformation | Sensitive | Source |", "| --- | --- | --- | --- | --- |");
+        for (const f of x.fields)
+          md.push(`| ${esc2(f.field)} | ${f.classification} | ${esc2(f.transform ?? "")} | ${f.sensitive} | ${f.source} |`);
+      } else if (x.note)
+        md.push(`${x.note} (${x.source})`);
+      else
+        md.push(`_mappings.md doesn't say which fields it sends (${x.source})._`);
+      md.push("");
+    }
+  else
+    md.push("_No new or changed call crosses a system boundary._", "");
+  md.push("## Vendors", "");
+  if (r.vendors.length)
+    for (const v of r.vendors)
+      md.push(`- ${v.name} (${v.system}): ${v.isNew ? "a new vendor" : `already called (${v.existing} interface${v.existing === 1 ? "" : "s"} in the catalog)`}; new or changed: ${v.operations.join(", ") || "none"}.`);
+  else
+    md.push("_The change calls no vendor._");
+  md.push("", "## Secrets and settings touched", "");
+  if (r.secrets.length)
+    for (const s of r.secrets)
+      md.push(`- ${s.what} (${s.source})`);
+  else if (!r.secretsNotJudged.length)
+    md.push("_No credential or secret is named or implied._");
+  if (r.secretsNotJudged.length)
+    md.push(...r.secrets.length ? [""] : [], `_Not judged: ${r.secretsNotJudged.length} ${r.secretsNotJudged.length === 1 ? "line" : "lines"} of the change ${r.secretsNotJudged.length === 1 ? "wasn't" : "weren't"} read for secrets (no model was asked, or a judge couldn't tell), so a person reads ${r.secretsNotJudged.length === 1 ? "it" : "them"} for keys, certificates and passwords: ${r.secretsNotJudged.slice(0, 10).join(", ")}${r.secretsNotJudged.length > 10 ? ` and ${r.secretsNotJudged.length - 10} more` : ""}._`);
+  if (r.settings.length) {
+    md.push("", "Settings in force on the touched calls:", "");
+    for (const s of r.settings)
+      md.push(`- ${s.key} = ${s.value} on ${s.component}${s.target ? ` \u2192 ${s.target}` : ""} (catalog Setting ${s.id})`);
+  }
+  md.push("", "## Open security-relevant findings", "");
+  if (r.findings.length)
+    for (const f of r.findings)
+      md.push(`- ${f.severity}: ${f.summary} (${f.rule}, ${f.path})`);
+  else
+    md.push(reviewed ? "_None open._" : "_No critic round has run yet, so there are no findings to show._");
+  md.push("", "## Sign-off", "");
+  md.push(`- How: ${r.signOff.how}`);
+  for (const g of r.signOff.gates)
+    md.push(`- ${g.gate} gate: ${g.handoff ? `hand-off PR ${g.handoff.pr} is ${g.handoff.state}${g.handoff.approvals.length ? `, approved by ${g.handoff.approvals.join("; ")}` : ""}` : "no hand-off PR yet"}.`);
+  md.push("", "## Gaps", "");
+  if (r.gaps.length)
+    for (const g of r.gaps)
+      md.push(`- ${g}`);
+  else
+    md.push("_None._");
+  return md.join("\n") + "\n";
+}
+
+// packages/release/dist/estimate.js
+var CALLS = /* @__PURE__ */ new Set(["call-out", "publish"]);
+var OP = {
+  added: "add",
+  changed: "change",
+  removed: "remove"
+};
+function classOf(s, boundaryOf) {
+  const parts = [OP[s.mark] ?? "keep", s.kind];
+  if (s.to && CALLS.has(s.kind)) {
+    if (boundaryOf(s.to.component) === "vendor")
+      parts.push("vendor");
+    if (s.to.new)
+      parts.push("new-entry");
+  }
+  if (s.store?.new)
+    parts.push("new-table");
+  else if (s.store?.migration)
+    parts.push("migration");
+  return parts.join("/");
+}
+function rangeOf(cls, table) {
+  for (const c of table?.classes ?? []) {
+    if (c.match === "*" || c.match === cls)
+      return c.days;
+    if (c.match.endsWith("/*") && `${cls}/`.startsWith(c.match.slice(0, -1)))
+      return c.days;
+  }
+  return void 0;
+}
+function seeded(text) {
+  let a = 2166136261;
+  for (const ch of text)
+    a = Math.imul(a ^ ch.charCodeAt(0), 16777619);
+  return () => {
+    a = a + 1831565813 | 0;
+    let t = Math.imul(a ^ a >>> 15, 1 | a);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+var Z80 = 0.8416;
+var SAMPLES = 4e3;
+function sampler(next) {
+  return (d) => {
+    const sigma = (Math.log(d.p80) - Math.log(d.p20)) / (2 * Z80);
+    const u = Math.max(next(), 1e-12);
+    const n = Math.sqrt(-2 * Math.log(u)) * Math.cos(2 * Math.PI * next());
+    return Math.exp(Math.log(d.p50) + sigma * n);
+  };
+}
+var round = (n) => Math.round(n * 10) / 10;
+function quantiles(xs) {
+  const s = [...xs].sort((a, b) => a - b);
+  const at = (q) => s[Math.min(s.length - 1, Math.floor(q * s.length))];
+  return { p20: round(at(0.2)), p50: round(at(0.5)), p80: round(at(0.8)) };
+}
+function estimateChange(input) {
+  const units = [];
+  const drivers = /* @__PURE__ */ new Map();
+  const factor = (id) => input.table?.risks[id];
+  const drive = (id, what, count, source) => {
+    if (!count)
+      return;
+    const d = drivers.get(id);
+    if (d)
+      d.count += count;
+    else {
+      const w = factor(id);
+      drivers.set(id, {
+        id,
+        what,
+        count,
+        ...w && w > 1 ? { widens: w } : {},
+        ...source ? { source } : {}
+      });
+    }
+  };
+  for (const f of input.flows) {
+    const unit = (u) => {
+      const days = rangeOf(u.class, input.table);
+      units.push({ flow: f.flow, repo: f.repo, ...u, ...days ? { days } : {}, source: f.file });
+    };
+    if (f.change === "remove") {
+      unit({ what: `${f.flow} goes`, class: "remove-flow" });
+      continue;
+    }
+    if (f.change === "new")
+      unit({ what: `${f.flow} is new`, class: `new-flow/${f.trigger ?? "endpoint"}` });
+    for (const s of f.steps) {
+      if (s.mark === "same")
+        continue;
+      const step = s.target ?? s.today;
+      unit({
+        ...step !== void 0 ? { step } : {},
+        what: s.what ?? s.kind,
+        class: classOf(s, input.boundaryOf)
+      });
+      if (s.mark === "removed")
+        continue;
+      if (s.to && CALLS.has(s.kind) && s.to.new && input.boundaryOf(s.to.component) === "vendor")
+        drive("new-vendor-call", "New calls to a vendor", 1, f.file);
+      if (s.store?.new)
+        drive("new-table", "New tables", 1, f.file);
+      else if (s.store?.migration)
+        drive("migration", "Migrations", 1, f.file);
+    }
+    const unconfirmed = f.steps.filter((s) => (s.mark === "changed" || s.mark === "removed") && (!s.confirmedBy || s.confirmedBy === "ai")).length;
+    drive("unconfirmed-step", "Changed steps no check or person confirmed", unconfirmed, f.file);
+  }
+  drive("open-blocking", "Open blocking findings", input.openBlocking ?? 0);
+  drive("open-questions", "Open questions", input.openQuestions ?? 0);
+  drive("conflicts", "Other open changes on the same parts", input.conflicts ?? 0);
+  const repos = [...new Set(input.flows.map((f) => f.repo))].sort();
+  if (repos.length > 1)
+    drive("repos", "Repos to change", repos.length);
+  const ORDER = [
+    "new-vendor-call",
+    "new-table",
+    "migration",
+    "unconfirmed-step",
+    "open-blocking",
+    "open-questions",
+    "conflicts",
+    "repos"
+  ];
+  const listed = ORDER.flatMap((id) => drivers.has(id) ? [drivers.get(id)] : []);
+  const classed = units.filter((u) => u.days);
+  let effort;
+  const perRepo = repos.map((repo) => ({
+    repo,
+    units: units.filter((u) => u.repo === repo).length
+  }));
+  if (classed.length) {
+    const draw = sampler(seeded(input.change));
+    const totals = [];
+    const byRepo = new Map(repos.map((r) => [r, []]));
+    const extra = input.table?.perExtraRepo;
+    for (let i = 0; i < SAMPLES; i++) {
+      let total = 0;
+      for (const r of repos) {
+        let sum = 0;
+        for (const u of classed)
+          if (u.repo === r)
+            sum += draw(u.days);
+        byRepo.get(r).push(sum);
+        total += sum;
+      }
+      if (extra)
+        for (let k = 1; k < repos.length; k++)
+          total += draw(extra);
+      totals.push(total);
+    }
+    const widen = listed.reduce((w, d) => w * (d.widens ?? 1), 1);
+    const q = quantiles(totals);
+    effort = { ...q, p80: round(q.p80 * widen) };
+    for (const p of perRepo)
+      if (classed.some((u) => u.repo === p.repo))
+        p.effort = quantiles(byRepo.get(p.repo));
+  }
+  const calendar = {
+    ...effort ? { effortDays: effort.p80 } : {},
+    ...input.waitDays !== void 0 ? { waitDays: input.waitDays } : {}
+  };
+  if (effort && input.waitDays !== void 0)
+    calendar.longer = effort.p80 > input.waitDays ? "work" : "waiting";
+  return {
+    change: input.change,
+    units,
+    needsClass: units.length - classed.length,
+    ...effort ? { effort } : {},
+    perRepo,
+    drivers: listed,
+    calendar,
+    calibration: {
+      calibrated: false,
+      ...input.table ? { source: input.table.source } : {}
+    }
+  };
+}
+
+export {
+  ReleaseError,
+  readServiceRequests,
+  loadRelease,
+  deploymentPlan,
+  releaseForecast,
+  outcomesView,
+  recordOutcome,
+  evidencePack,
+  writeEvidencePack,
+  AUDIENCES,
+  releaseNotes,
+  securityReview,
+  estimateChange
+};