@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/chunk-V2YTAIQO.js

@@ -0,0 +1,1075 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  clientFor,
+  inputsSha256,
+  loadExecutors
+} from "./chunk-QSXK2RGH.js";
+import {
+  runDialectTests
+} from "./chunk-MC3H7736.js";
+import {
+  fsRepo,
+  scanRepo
+} from "./chunk-GQ4N4WKF.js";
+import {
+  AI_SCHEMA_VERSION,
+  API_VERSION,
+  CHANGE_SCHEMA_VERSION,
+  COMPONENT_TYPES,
+  DIALECT_SCHEMA_VERSION,
+  Dialect,
+  EXECUTOR_SCHEMA_VERSION,
+  ExecutorsFile,
+  FACT_KINDS,
+  ORGPACK_SCHEMA_VERSION,
+  RECORD_KINDS,
+  REVIEW_SCHEMA_VERSION,
+  RunResult,
+  STORE_TYPES,
+  SUPPORTED_SCHEMA_VERSIONS,
+  System,
+  WORKSPACE_SCHEMA_VERSION,
+  catalogDirOf,
+  external_exports,
+  loadOrgPack,
+  orgPackDirOf,
+  parseRecord,
+  recordPath,
+  recordReferences,
+  require_dist,
+  serializeRecord
+} from "./chunk-S2A7YC3Q.js";
+import {
+  SCHEMA_VERSION
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/u1-commands.js
+import { resolve } from "node:path";
+
+// packages/conformance/dist/report.js
+var Results = class {
+  list = [];
+  pass(check, message, file) {
+    this.list.push({ check, status: "pass", message, ...file ? { file } : {} });
+  }
+  fail(check, message, file) {
+    this.list.push({ check, status: "fail", message, ...file ? { file } : {} });
+  }
+  warn(check, message, file) {
+    this.list.push({ check, status: "warn", message, ...file ? { file } : {} });
+  }
+  /** A check that held for every item gets one pass line instead of one per item. */
+  passUnlessFailed(check, message) {
+    if (!this.list.some((r) => r.check === check && r.status === "fail"))
+      this.pass(check, message);
+  }
+  report(kind, target) {
+    const count = (s) => this.list.filter((r) => r.status === s).length;
+    const summary = { pass: count("pass"), fail: count("fail"), warn: count("warn") };
+    return {
+      kind,
+      target,
+      specVersion: SPEC_VERSION,
+      passed: summary.fail === 0,
+      results: this.list,
+      summary
+    };
+  }
+};
+var SPEC_VERSION = "0.1.0";
+
+// packages/conformance/dist/catalog.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+var isDir = async (p) => (await stat(p).catch(() => void 0))?.isDirectory() ?? false;
+async function yamlFiles(dir) {
+  const out = [];
+  async function walk(d) {
+    const entries = await readdir(d, { withFileTypes: true }).catch(() => []);
+    for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = join(d, e.name);
+      if (e.isDirectory())
+        await walk(full);
+      else if (/\.ya?ml$/.test(e.name))
+        out.push(full);
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function catalogFolder(target) {
+  if (await isDir(join(target, "generated")) || await isDir(join(target, "curated")))
+    return target;
+  return catalogDirOf(target);
+}
+async function checkCatalog(target) {
+  const res = new Results();
+  const dir = await catalogFolder(target);
+  const hasGenerated = await isDir(join(dir, "generated"));
+  const hasCurated = await isDir(join(dir, "curated"));
+  if (!hasGenerated && !hasCurated) {
+    res.fail("catalog.layout", `No generated/ or curated/ folder in ${dir}.`);
+    return res.report("catalog", target);
+  }
+  res.pass("catalog.layout", "The catalog has generated/ and curated/ folders where present.");
+  const records = [];
+  for (const full of await yamlFiles(dir)) {
+    const file = relative(dir, full).split(sep).join("/");
+    const folder = file.split("/")[0];
+    if (folder !== "generated" && folder !== "curated")
+      continue;
+    const text = await readFile(full, "utf8");
+    let data;
+    try {
+      data = (0, import_yaml.parse)(text);
+    } catch (e) {
+      res.fail("catalog.yaml", `Not valid YAML: ${e.message.split("\n")[0]}`, file);
+      continue;
+    }
+    const kind = data?.kind;
+    if (typeof kind !== "string" || !RECORD_KINDS.includes(kind)) {
+      res.warn("catalog.kind", "Not a catalog record (no known kind); ignored.", file);
+      continue;
+    }
+    const p = parseRecord(data);
+    if (!p.ok) {
+      res.fail("catalog.schema", `Doesn't match C1: ${p.issues.map((i) => `${i.path || "(record)"}: ${i.message}`).join("; ")}`, file);
+      continue;
+    }
+    const rec = p.record;
+    if (data.schemaVersion !== SCHEMA_VERSION)
+      res.fail("catalog.version", `Written at schema version ${String(data.schemaVersion)}; the current version is ${SCHEMA_VERSION} (run atticus catalog migrate).`, file);
+    else if (serializeRecord(rec) !== text)
+      res.fail("catalog.canonical", "Not in canonical form (key order, defaults or quoting).", file);
+    const want = `${folder}/${recordPath(rec)}`;
+    if (file !== want)
+      res.fail("catalog.path", `Should be at ${want}.`, file);
+    if (folder === "curated" && rec.kind !== "CuratedDecision")
+      res.fail("catalog.folder", "Only curated decisions belong in curated/.", file);
+    if (folder === "generated" && rec.kind === "CuratedDecision")
+      res.fail("catalog.folder", "A curated decision belongs in curated/.", file);
+    if (rec.kind !== "CuratedDecision" && rec.evidence.length === 0)
+      res.fail("catalog.evidence", "A generated record needs at least one piece of evidence.", file);
+    for (const e of rec.evidence)
+      if (!e.path && !e.by)
+        res.warn("catalog.evidence", `Evidence from ${e.source} names no file and no person.`, file);
+    records.push({ rec, file });
+  }
+  for (const c of ["catalog.version", "catalog.canonical", "catalog.path", "catalog.folder"])
+    res.passUnlessFailed(c, CHECK_PASS[c]);
+  const seen = /* @__PURE__ */ new Map();
+  for (const { rec, file } of records) {
+    const key = `${rec.kind}|${rec.id}`;
+    const first = seen.get(key);
+    if (first)
+      res.fail("catalog.unique-id", `Same ${rec.kind} id as ${first}.`, file);
+    else
+      seen.set(key, file);
+  }
+  res.passUnlessFailed("catalog.unique-id", "Every id is unique within its kind.");
+  const ids = new Set(records.map((r) => r.rec.id));
+  for (const { rec, file } of records) {
+    const refs = rec.kind === "CuratedDecision" ? [{ field: "target", id: rec.target }] : recordReferences(rec);
+    for (const r of refs)
+      if (!ids.has(r.id))
+        res.warn("catalog.references", `${r.field} points at ${r.id}, which isn't in this catalog.`, file);
+  }
+  if (!res.list.some((r) => r.check === "catalog.references"))
+    res.pass("catalog.references", "Every reference resolves to a record in the catalog.");
+  res.passUnlessFailed("catalog.evidence", "Every generated record carries evidence.");
+  res.pass("catalog.count", `${records.length} record${records.length === 1 ? "" : "s"} read.`);
+  return res.report("catalog", target);
+}
+var CHECK_PASS = {
+  "catalog.version": "Every record is written at the current schema version.",
+  "catalog.canonical": "Every record file is in canonical form.",
+  "catalog.path": "Every file is at <folder>/<kind>/<id>.yaml.",
+  "catalog.folder": "Generated records and curated decisions are in their own folders."
+};
+
+// packages/conformance/dist/dialect.js
+var import_yaml2 = __toESM(require_dist(), 1);
+import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+async function checkDialect(file) {
+  const res = new Results();
+  let data;
+  try {
+    data = (0, import_yaml2.parse)(await readFile2(file, "utf8"));
+  } catch (e) {
+    res.fail("dialect.yaml", `Can't read this file as YAML: ${e.message.split("\n")[0]}`);
+    return res.report("dialect", file);
+  }
+  const p = Dialect.safeParse(data);
+  if (!p.success) {
+    for (const i of p.error.issues)
+      res.fail("dialect.schema", `${i.path.join(".") || "(file)"}: ${i.message}`);
+    return res.report("dialect", file);
+  }
+  const d = p.data;
+  res.pass("dialect.schema", `Dialect ${d.name} ${d.version} matches C2.`);
+  const parents = /* @__PURE__ */ new Map();
+  const dir = dirname(file);
+  for (const n of (await readdir2(dir).catch(() => [])).filter((x) => /\.ya?ml$/.test(x))) {
+    try {
+      const other = Dialect.safeParse((0, import_yaml2.parse)(await readFile2(join2(dir, n), "utf8")));
+      if (other.success && other.data.name !== d.name)
+        parents.set(other.data.name, other.data);
+    } catch {
+    }
+  }
+  const missing = d.extends.filter((x) => !parents.has(x));
+  if (missing.length > 0)
+    res.fail("dialect.extends", `Extends ${missing.join(", ")}, which isn't in the same folder.`);
+  else if (d.extends.length > 0)
+    res.pass("dialect.extends", `Extends ${d.extends.join(", ")}.`);
+  if (d.tests.length === 0)
+    res.fail("dialect.tests", "A dialect must ship at least one test.");
+  else if (missing.length > 0)
+    res.fail("dialect.tests", "Tests not run: they need the dialects it extends.");
+  else {
+    const failures = await runDialectTests(d, dir, parents);
+    for (const f of failures)
+      res.fail("dialect.tests", `${f.test}: ${f.message}`);
+    res.passUnlessFailed("dialect.tests", `All ${d.tests.length} tests pass.`);
+  }
+  return res.report("dialect", file);
+}
+
+// packages/conformance/dist/executor.js
+var import_yaml3 = __toESM(require_dist(), 1);
+import { readFile as readFile3 } from "node:fs/promises";
+var AT = "2026-01-01T00:00:00Z";
+async function configOf(target, o) {
+  if (o.config)
+    return { cfg: o.config };
+  let executors;
+  if (/\.ya?ml$/.test(target)) {
+    try {
+      const r = ExecutorsFile.safeParse((0, import_yaml3.parse)(await readFile3(target, "utf8")));
+      if (!r.success)
+        return {
+          problem: r.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+        };
+      executors = r.data.executors;
+    } catch (e) {
+      return { problem: `Can't read ${target}: ${e.message.split("\n")[0]}` };
+    }
+  } else {
+    const loaded = await loadExecutors(target);
+    if (loaded.problems.length > 0)
+      return { problem: loaded.problems.join("; ") };
+    executors = loaded.executors;
+  }
+  const cfg = o.executor ? executors.find((e) => e.name === o.executor) : executors[0];
+  return cfg ? { cfg } : { problem: o.executor ? `No executor named ${o.executor}.` : "No executors configured." };
+}
+async function checkExecutor(target, o = {}) {
+  const res = new Results();
+  const { cfg, problem } = await configOf(target, o);
+  if (!cfg) {
+    res.fail("executor.config", problem ?? "No executor.");
+    return res.report("executor", target);
+  }
+  res.pass("executor.config", `Executor ${cfg.name} over ${cfg.transport}.`);
+  const client = (o.client ?? clientFor)(cfg);
+  const nonce = `${cfg.name}-${process.pid}-${Math.floor(Math.random() * 1e9)}`;
+  let pong;
+  try {
+    pong = await client.ping();
+    res.pass("executor.ping", `Answers a ping: ${pong.name} ${pong.version}.`);
+  } catch (e) {
+    res.fail("executor.ping", `Doesn't answer a ping: ${e.message}`);
+    return res.report("executor", target);
+  }
+  const named = [
+    ...cfg.procedures,
+    ...pong.procedures.filter((p) => cfg.transport !== "mcp" || p.includes("/"))
+  ];
+  const first = (named[0] ?? "firewall-rule/submit-request").split("/");
+  const procedure = first[0];
+  const step = first[1] ?? pong.stepKinds[0] ?? cfg.stepKinds[0] ?? "submit-request";
+  const inputs = { summary: "Conformance reference case", reference: `conformance-${nonce}` };
+  const key = `conf-${nonce}`.slice(0, 64);
+  const request = (k, mode = "submit") => ({
+    schemaVersion: 1,
+    type: "run",
+    runId: `run-${k}-${mode}`,
+    procedure,
+    step,
+    inputs,
+    idempotencyKey: k,
+    mode,
+    approval: {
+      by: "conformance",
+      at: AT,
+      ref: "conformance-reference-case",
+      inputsSha256: inputsSha256(inputs)
+    }
+  });
+  const used = async (k, want, check, when) => {
+    try {
+      const a = await client.check(k);
+      if (!a)
+        res.fail(check, `Doesn't answer idempotency checks (${when}).`);
+      else if (a.idempotencyKey !== k)
+        res.fail(check, `Answered for key ${a.idempotencyKey}, not ${k}.`);
+      else if (a.used !== want)
+        res.fail(check, `Says a key ${when} is ${a.used ? "used" : "unused"}.`);
+      else
+        res.pass(check, `Says a key ${when} is ${want ? "used" : "unused"}.`);
+    } catch (e) {
+      res.fail(check, `Idempotency check failed (${when}): ${e.message}`);
+    }
+  };
+  await used(key, false, "executor.idempotency-fresh", "never sent");
+  const run = async (req) => {
+    const progress = [];
+    const result = await client.run(req, (p) => progress.push(p.message));
+    return { result: RunResult.parse(result), progress };
+  };
+  let done;
+  try {
+    const { result, progress } = await run(request(key));
+    if (result.runId !== request(key).runId)
+      res.fail("executor.run", `Answered for run ${result.runId}, not ${request(key).runId}.`);
+    else
+      res.pass("executor.run", `Ran the reference case: ${result.status}${result.message ? ` (${result.message})` : ""}.`);
+    if (progress.length > 0)
+      res.pass("executor.progress", `Reported progress (${progress.length} message${progress.length === 1 ? "" : "s"}).`);
+    else
+      res.warn("executor.progress", "Reported no progress before its result.");
+    if (result.status === "done")
+      done = result;
+    else
+      res.warn("executor.run", "The reference case didn't finish as done, so the idempotency checks after a run are skipped.");
+  } catch (e) {
+    res.fail("executor.run", `The reference run failed: ${e.message}`);
+  }
+  if (done) {
+    await used(key, true, "executor.idempotency-used", "already run");
+    try {
+      const { result } = await run({ ...request(key), runId: `run-${key}-again` });
+      if (result.status === "done" && JSON.stringify(result.outputs) !== JSON.stringify(done.outputs))
+        res.fail("executor.duplicate", "The same write sent twice gave a different result: it ran twice.");
+      else
+        res.pass("executor.duplicate", result.status === "done" ? "The same write sent twice gave the same result." : `The same write sent twice was refused (${result.status}).`);
+    } catch (e) {
+      res.pass("executor.duplicate", `The same write sent twice was refused: ${e.message}`);
+    }
+  }
+  if (pong.fillOnly || cfg.fillOnly) {
+    const k = `${key}-fill`.slice(0, 64);
+    try {
+      const { result } = await run(request(k, "fill-only"));
+      if (result.status !== "needs-person")
+        res.fail("executor.fill-only", `A fill-only run ended ${result.status}, not needs-person.`);
+      else
+        res.pass("executor.fill-only", "A fill-only run leaves the step to a person.");
+      await used(k, false, "executor.fill-only", "only filled in");
+    } catch (e) {
+      res.fail("executor.fill-only", `A fill-only run failed: ${e.message}`);
+    }
+  }
+  return res.report("executor", target);
+}
+
+// packages/conformance/dist/orgpack.js
+import { stat as stat2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+var isDir2 = async (p) => (await stat2(p).catch(() => void 0))?.isDirectory() ?? false;
+async function orgPackFolder(target) {
+  if (await isDir2(join3(target, "org-pack")) || await isDir2(join3(target, ".atticus", "org-pack")))
+    return orgPackDirOf(target);
+  return target;
+}
+async function checkOrgPack(target) {
+  const res = new Results();
+  const dir = await orgPackFolder(target);
+  if (!await isDir2(dir)) {
+    res.fail("orgpack.folder", `No org-pack folder at ${dir}.`);
+    return res.report("org-pack", target);
+  }
+  const pack = await loadOrgPack(dir);
+  for (const p of pack.problems)
+    res.fail(p.path ? "orgpack.schema" : "orgpack.file", `${p.path ? `${p.path}: ` : ""}${p.message}`, p.file);
+  res.passUnlessFailed("orgpack.file", "Every org-pack file reads as YAML or Markdown.");
+  res.passUnlessFailed("orgpack.schema", "Every file matches C6 and the cross-file rules hold.");
+  if (!pack.pack)
+    res.warn("orgpack.manifest", "No pack.yaml: the pack has no name or version.");
+  else
+    res.pass("orgpack.manifest", `Pack ${pack.pack.name} ${pack.pack.version}.`);
+  if (pack.defaulted.length > 0)
+    res.pass("orgpack.defaults", `Built-in defaults used for: ${pack.defaulted.join(", ")}.`);
+  const byName = new Map(pack.dialects.map((d) => [d.name, d]));
+  for (const d of pack.dialects) {
+    const failures = await runDialectTests(d, join3(dir, "dialects"), byName);
+    for (const f of failures)
+      res.fail("orgpack.dialect-tests", `${d.name}: ${f.test}: ${f.message}`, `dialects/${d.name}.yaml`);
+  }
+  res.passUnlessFailed("orgpack.dialect-tests", pack.dialects.length > 0 ? `Every dialect passes its tests (${pack.dialects.map((d) => d.name).join(", ")}).` : "No dialects in the pack.");
+  res.pass("orgpack.count", `${pack.gates.gates.length} gates, ${pack.changeTypes.types.length} change types, ${pack.patterns.length} patterns, ${pack.dialects.length} dialects, ${pack.checklists.length} checklists, ${pack.procedures.length} procedures.`);
+  return res.report("org-pack", target);
+}
+
+// packages/conformance/dist/plugin.js
+import { readdir as readdir3, readFile as readFile4, stat as stat3 } from "node:fs/promises";
+import { basename, join as join4, relative as relative2, sep as sep2 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// packages/conformance/dist/guard.js
+import dgram from "node:dgram";
+import dns from "node:dns";
+import http from "node:http";
+import https from "node:https";
+import { syncBuiltinESMExports } from "node:module";
+import net from "node:net";
+import tls from "node:tls";
+var NetworkBlocked = class extends Error {
+  constructor(what) {
+    super(`Network access is blocked in a conformance run (${what}).`);
+    this.name = "NetworkBlocked";
+  }
+};
+async function guarded(fn, o = {}) {
+  const attempts = [];
+  const saved = [];
+  const block = (target, key, what) => {
+    saved.push([target, key, target[key]]);
+    target[key] = (...args) => {
+      const arg = args[0];
+      const detail = typeof arg === "string" ? arg : arg instanceof URL ? arg.href : arg && typeof arg === "object" && "host" in arg ? String(arg.host) : "";
+      attempts.push(detail ? `${what} ${detail}` : what);
+      throw new NetworkBlocked(what);
+    };
+  };
+  if (typeof globalThis.fetch === "function")
+    block(globalThis, "fetch", "fetch");
+  block(http, "request", "http.request");
+  block(http, "get", "http.get");
+  block(https, "request", "https.request");
+  block(https, "get", "https.get");
+  block(net, "connect", "net.connect");
+  block(net, "createConnection", "net.createConnection");
+  block(net.Socket.prototype, "connect", "socket.connect");
+  block(tls, "connect", "tls.connect");
+  block(dgram, "createSocket", "dgram.createSocket");
+  for (const k of ["lookup", "resolve", "resolve4", "resolve6", "resolveAny"])
+    block(dns, k, `dns.${k}`);
+  for (const k of ["lookup", "resolve", "resolve4", "resolve6"])
+    block(dns.promises, k, `dns.${k}`);
+  const RealDate = globalThis.Date;
+  if (o.fixedTime) {
+    const fixed = RealDate.parse(o.fixedTime);
+    class FixedDate extends RealDate {
+      constructor(...args) {
+        if (args.length === 0)
+          super(fixed);
+        else
+          super(...args);
+      }
+      static now() {
+        return fixed;
+      }
+    }
+    globalThis.Date = FixedDate;
+  }
+  syncBuiltinESMExports();
+  try {
+    return { value: await fn(), attempts };
+  } catch (error) {
+    return { error, attempts };
+  } finally {
+    globalThis.Date = RealDate;
+    for (const [target, key, value] of saved.reverse())
+      target[key] = value;
+    syncBuiltinESMExports();
+  }
+}
+
+// packages/conformance/dist/plugin.js
+var __atticus_import_meta_url = __atticusUrl("packages/conformance/dist/plugin.js");
+var SAMPLE = fileURLToPath(new URL("../sample", __atticus_import_meta_url));
+var SHA = "0".repeat(40);
+var T1 = "2026-01-01T00:00:00Z";
+var T2 = "2031-06-15T12:30:00Z";
+var isExtractor = (v) => !!v && typeof v === "object" && typeof v.scan === "function";
+var isIngestor = (v) => !!v && typeof v === "object" && typeof v.sniff === "function" && typeof v.ingest === "function";
+async function files(dir) {
+  const out = [];
+  async function walk(d) {
+    for (const e of (await readdir3(d, { withFileTypes: true }).catch(() => [])).sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = join4(d, e.name);
+      if (e.isDirectory())
+        await walk(full);
+      else
+        out.push(full);
+    }
+  }
+  await walk(dir);
+  return out;
+}
+function own(records) {
+  return records.map((r) => ({
+    ...r,
+    evidence: r.evidence.map((e) => {
+      const { scannedAt: _s, commit: _c, extractor: _x, ...rest } = e;
+      return rest;
+    })
+  }));
+}
+async function checkPlugin(module, o = {}) {
+  const res = new Results();
+  let mod;
+  try {
+    mod = await import(pathToFileURL(module).href);
+  } catch (e) {
+    res.fail("plugin.load", `Can't load this module: ${e.message}`);
+    return res.report("plugin", module);
+  }
+  const exported = [...new Set(Object.values(mod).flatMap((v) => Array.isArray(v) ? v : [v]))];
+  const extractors = exported.filter(isExtractor);
+  const ingestors = exported.filter(isIngestor);
+  if (extractors.length + ingestors.length === 0) {
+    res.fail("plugin.exports", "The module exports no extractor (scan) and no ingestor (sniff and ingest).");
+    return res.report("plugin", module);
+  }
+  res.pass("plugin.exports", `Found ${[...extractors.map((x) => `extractor ${x.id}`), ...ingestors.map((x) => `ingestor ${x.id}`)].join(", ")}.`);
+  for (const x of extractors)
+    await checkExtractor(x, o.fixture ?? join4(SAMPLE, "repo"), res);
+  for (const x of ingestors)
+    await checkIngestor(x, o.inputs ?? await files(join4(SAMPLE, "inputs")), res);
+  return res.report("plugin", module);
+}
+function shape(p, what, res) {
+  let ok = true;
+  if (typeof p.id !== "string" || !/^[a-z][a-z0-9-]*$/.test(p.id)) {
+    res.fail("plugin.shape", `${what}: id ${JSON.stringify(p.id)} must be a lowercase slug.`);
+    ok = false;
+  }
+  if (typeof p.version !== "string" || !/^\d+\.\d+\.\d+(-[0-9a-z.-]+)?$/i.test(p.version)) {
+    res.fail("plugin.shape", `${what}: version ${JSON.stringify(p.version)} must be semver.`);
+    ok = false;
+  }
+  return ok;
+}
+async function checkExtractor(x, fixture, res) {
+  const name = `extractor ${String(x.id)}`;
+  let ok = shape(x, name, res);
+  if (!Array.isArray(x.claims) || x.claims.length === 0 || !x.claims.every((c) => typeof c === "string")) {
+    res.fail("plugin.shape", `${name}: claims must be a non-empty list of file globs.`);
+    ok = false;
+  }
+  if (ok)
+    res.pass("plugin.shape", `${name} ${x.version} has an id, a semver version and claims.`);
+  if (!(await stat3(fixture).catch(() => void 0))?.isDirectory()) {
+    res.fail("plugin.run", `${name}: no repo folder at ${fixture}.`);
+    return;
+  }
+  const once = (at) => guarded(() => scanRepo({
+    repo: fsRepo(basename(fixture), fixture, SHA),
+    extractors: [x],
+    scannedAt: T1,
+    repoInfo: { component: "sample", system: "sample" }
+  }), { fixedTime: at });
+  const a = await once(T1);
+  const b = await once(T2);
+  report(name, res, a, b, (s) => {
+    const failed = s.runs.filter((r) => r.status === "failed");
+    return {
+      records: s.records,
+      rejected: s.rejected.map((r) => r.issues.map((i) => `${i.path}: ${i.message}`).join("; ")),
+      error: failed.map((r) => r.error).join("; ") || void 0
+    };
+  });
+}
+async function checkIngestor(x, inputs, res) {
+  const name = `ingestor ${String(x.id)}`;
+  if (shape(x, name, res))
+    res.pass("plugin.shape", `${name} ${x.version} has an id, a semver version, sniff and ingest.`);
+  const once = (at) => guarded(async () => {
+    const records = [];
+    const rejected = [];
+    for (const file of inputs) {
+      const content = new Uint8Array(await readFile4(file));
+      const score = x.sniff(basename(file), content.subarray(0, 4096));
+      if (typeof score !== "number" || score < 0 || score > 1) {
+        rejected.push(`${basename(file)}: sniff returned ${JSON.stringify(score)}, not a number from 0 to 1`);
+        continue;
+      }
+      if (score === 0)
+        continue;
+      const ctx = { dialects: [], scannedAt: T1, warn: () => void 0 };
+      for await (const r of x.ingest(basename(file), content, ctx)) {
+        const p = parseRecord(r);
+        if (p.ok)
+          records.push(p.record);
+        else
+          rejected.push(`${relative2(process.cwd(), file).split(sep2).join("/")}: ${p.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+      }
+    }
+    return { records, rejected };
+  }, { fixedTime: at });
+  const a = await once(T1);
+  const b = await once(T2);
+  report(name, res, a, b, (s) => ({ records: s.records, rejected: s.rejected }));
+}
+function report(name, res, a, b, read) {
+  const attempts = [.../* @__PURE__ */ new Set([...a.attempts, ...b.attempts])];
+  if (attempts.length > 0)
+    res.fail("plugin.network", `${name} tried to reach the network: ${attempts.join(", ")}.`);
+  else
+    res.pass("plugin.network", `${name} made no network call.`);
+  const ra = a.value ? read(a.value) : void 0;
+  const rb = b.value ? read(b.value) : void 0;
+  const err = a.error ?? b.error;
+  if (err || ra?.error || !ra || !rb) {
+    res.fail("plugin.run", `${name} failed: ${err instanceof Error ? err.message : String(err ?? ra?.error ?? rb?.error)}`);
+    return;
+  }
+  res.pass("plugin.run", `${name} ran and emitted ${ra.records.length} record${ra.records.length === 1 ? "" : "s"}.`);
+  for (const r of ra.rejected)
+    res.fail("plugin.records", `${name} emitted an invalid record: ${r}`);
+  if (ra.rejected.length === 0)
+    res.pass("plugin.records", `Every record ${name} emitted is valid C1.`);
+  if (JSON.stringify(own(ra.records)) !== JSON.stringify(own(rb.records)))
+    res.fail("plugin.determinism", `${name} gave different output on two runs (at two clock times): it must read files only, with no clock or randomness.`);
+  else
+    res.pass("plugin.determinism", `${name} gave identical output on two runs at two clock times.`);
+}
+
+// packages/conformance/dist/run.js
+var CONFORMANCE_KINDS = [
+  "catalog",
+  "org-pack",
+  "dialect",
+  "plugin",
+  "executor"
+];
+async function conformanceRun(target, o) {
+  switch (o.kind) {
+    case "catalog":
+      return checkCatalog(target);
+    case "org-pack":
+      return checkOrgPack(target);
+    case "dialect":
+      return checkDialect(target);
+    case "plugin":
+      return checkPlugin(target, o);
+    case "executor":
+      return checkExecutor(target, o);
+  }
+}
+
+// packages/conformance/dist/spec.js
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// packages/conformance/dist/zod-doc.js
+var defOf = (s) => s._zod.def;
+function unwrap(s) {
+  let cur = s;
+  let optional = false;
+  let dflt;
+  for (let i = 0; i < 20; i++) {
+    const d = defOf(cur);
+    if (d.type === "optional" || d.type === "nullable")
+      optional = true;
+    else if (d.type === "default" || d.type === "prefault") {
+      optional = true;
+      const v = d.defaultValue;
+      dflt = typeof v === "function" ? v() : v;
+    } else if (d.type === "readonly" || d.type === "catch") {
+    } else if (d.type === "pipe") {
+      cur = d.in;
+      continue;
+    } else if (d.type === "lazy") {
+      cur = d.getter();
+      continue;
+    } else
+      break;
+    cur = d.innerType;
+  }
+  return { inner: cur, optional, ...dflt !== void 0 ? { default: dflt } : {} };
+}
+var isObject = (s) => defOf(unwrap(s).inner).type === "object";
+function typeName(s, ctx) {
+  const { inner } = unwrap(s);
+  const d = defOf(inner);
+  const name = ctx?.named.get(inner) ?? ctx?.named.get(s);
+  const base = () => {
+    switch (d.type) {
+      case "string":
+        return typeof d.format === "string" && d.format !== "regex" ? `string (${d.format})` : "string";
+      case "number": {
+        const formats = [
+          d.format,
+          ...(d.checks ?? []).map((c) => c._zod?.def?.format)
+        ];
+        return formats.some((f) => f === "safeint" || f === "int32") ? "integer" : "number";
+      }
+      case "boolean":
+        return "boolean";
+      case "literal":
+        return d.values.map((v) => JSON.stringify(v)).join(" or ");
+      case "enum":
+        return "enum";
+      case "array":
+        return `${typeName(d.element, ctx)}[]`;
+      case "object":
+        return "object";
+      case "record":
+        return `map of ${typeName(d.valueType, ctx)}`;
+      case "union": {
+        const opts = d.options;
+        if (opts.every(isObject))
+          return `one of ${opts.length} shapes`;
+        return [...new Set(opts.map((o) => typeName(o, ctx)))].join(" or ");
+      }
+      case "intersection":
+        return "object";
+      case "tuple":
+        return "tuple";
+      case "date":
+        return "date";
+      default:
+        return "any";
+    }
+  };
+  const b = base();
+  return name && !["object"].includes(b) && !b.startsWith(name) ? `${b} (${name})` : b;
+}
+function enumValues(s) {
+  const { inner } = unwrap(s);
+  const d = defOf(inner);
+  if (d.type === "enum")
+    return Object.values(d.entries).map(String);
+  if (d.type === "literal")
+    return void 0;
+  if (d.type === "array")
+    return enumValues(d.element);
+  if (d.type === "union") {
+    const opts = d.options;
+    const vals = opts.map((o) => {
+      const od = defOf(unwrap(o).inner);
+      return od.type === "literal" ? od.values.map(String) : enumValues(o);
+    });
+    if (vals.every((v) => v !== void 0))
+      return vals.flat();
+  }
+  return void 0;
+}
+var fmt = (v) => typeof v === "string" ? v : JSON.stringify(v);
+function fieldRows(schema, ctx, docName, o = {}, depth = 0) {
+  const { inner } = unwrap(schema);
+  const d = defOf(inner);
+  if (depth > 5)
+    return [];
+  const shapes = d.type === "object" ? [d.shape] : d.type === "union" && d.options.every(isObject) ? d.options.map((x) => defOf(unwrap(x).inner).shape) : d.type === "intersection" ? [defOf(unwrap(d.left).inner).shape, defOf(unwrap(d.right).inner).shape].filter(Boolean) : [];
+  const rows = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const shape2 of shapes)
+    for (const [key, field] of Object.entries(shape2)) {
+      if (o.skip?.has(key) || seen.has(key))
+        continue;
+      seen.add(key);
+      const path = o.prefix ? `${o.prefix}.${key}` : key;
+      const docPath = o.docPrefix ? `${o.docPrefix}.${key}` : key;
+      const u = unwrap(field);
+      const fieldName = ctx.named.get(u.inner) ?? ctx.named.get(field);
+      const description = ctx.docs.get(docName)?.fields.get(docPath) ?? (o.fallbackDocs ?? []).map((n) => ctx.docs.get(n)?.fields.get(docPath)).find(Boolean) ?? (fieldName ? ctx.docs.get(fieldName)?.doc : void 0) ?? external_exports.globalRegistry.get(field)?.description;
+      const values = enumValues(field);
+      rows.push({
+        path,
+        type: typeName(field, ctx),
+        required: !u.optional,
+        ...values ? { values: values.map((v) => `\`${v}\``).join(", ") } : {},
+        ...u.default !== void 0 && !(Array.isArray(u.default) && u.default.length === 0) && !(typeof u.default === "object" && u.default !== null && Object.keys(u.default).length === 0) ? { default: fmt(u.default) } : {},
+        ...description ? { description } : {}
+      });
+      const id = defOf(u.inner);
+      const nestedDoc = fieldName && fieldName !== docName ? { name: fieldName, prefix: "" } : { name: docName, prefix: docPath };
+      if (id.type === "object" || id.type === "union" && id.options.every(isObject))
+        rows.push(...fieldRows(u.inner, ctx, nestedDoc.name, { prefix: path, docPrefix: nestedDoc.prefix || void 0 }, depth + 1));
+      else if (id.type === "array" && isObject(id.element)) {
+        const el = unwrap(id.element).inner;
+        const elName = ctx.named.get(el);
+        rows.push(...fieldRows(el, ctx, elName ?? nestedDoc.name, { prefix: `${path}[]`, docPrefix: elName ? void 0 : nestedDoc.prefix || void 0 }, depth + 1));
+      } else if (id.type === "record" && isObject(id.valueType)) {
+        const el = unwrap(id.valueType).inner;
+        const elName = ctx.named.get(el);
+        rows.push(...fieldRows(el, ctx, elName ?? nestedDoc.name, {
+          prefix: `${path}.<key>`,
+          docPrefix: elName ? void 0 : nestedDoc.prefix || void 0
+        }, depth + 1));
+      }
+    }
+  return rows;
+}
+var cell = (s) => s.replace(/\|/g, "\\|").replace(/\n/g, " ");
+function fieldTable(rows) {
+  const head = "| Field | Type | Required | Values | Description |\n| --- | --- | --- | --- | --- |";
+  const body = rows.map((r) => {
+    const values = [r.values, r.default !== void 0 ? `default \`${r.default}\`` : void 0].filter(Boolean).join("; ");
+    return `| \`${r.path}\` | ${cell(r.type)} | ${r.required ? "yes" : "no"} | ${cell(values)} | ${cell(r.description ?? "")} |`;
+  });
+  return [head, ...body].join("\n");
+}
+
+// packages/conformance/dist/spec.js
+var __atticus_import_meta_url2 = __atticusUrl("packages/conformance/dist/spec.js");
+var SCHEMA_SRC = fileURLToPath2(new URL("../../core/src/schema/", __atticus_import_meta_url2));
+var COMMON = ["kind", "schemaVersion", "id", "status", "confidence", "evidence", "flags"];
+var CONTRACTS = [
+  {
+    id: "C1",
+    file: "c1-catalog-records.md",
+    title: "C1: Catalog records",
+    summary: "The catalog: one YAML record per file, thirty kinds, evidence on every fact.",
+    intro: [
+      "A catalog describes an ecosystem as records. Each record is one YAML file at `catalog/generated/<kind>/<id>.yaml` (written by scans) or `catalog/curated/curateddecision/<id>.yaml` (decisions people make over generated records). Files are written in canonical form: keys in a fixed order, list defaults written out, so the same facts always give the same bytes.",
+      "Every record has the common fields below, then the fields of its kind. Readers accept every supported schema version and writers always write the current one."
+    ],
+    versions: [
+      ["Schema version", SCHEMA_VERSION],
+      ["Versions readers accept", SUPPORTED_SCHEMA_VERSIONS.join(", ")]
+    ],
+    sections: [
+      ...RECORD_KINDS.map((name) => ({ name })),
+      ...[
+        "EntryFact",
+        "CallFact",
+        "StoreFact",
+        "FieldFact",
+        "DeployFact",
+        "ConfigFact",
+        "FlowFact"
+      ].map((name) => ({
+        name,
+        where: ".atticus/facts/<repo>.jsonl (one fact per line; ADR 0124)"
+      }))
+    ],
+    extra: (ctx) => [
+      "## Common fields",
+      "",
+      "Every record kind has these fields.",
+      "",
+      fieldTable(fieldRows(System, ctx, "commonFields", {
+        fallbackDocs: ["commonFields"],
+        skip: new Set(Object.keys(System.shape).filter((k) => !COMMON.includes(k)))
+      }).map((r) => r.path === "kind" ? { ...r, type: "string", description: "The record's kind: one of the kinds below." } : r)),
+      "",
+      "## Documented values",
+      "",
+      "`Component.type` and `DataStore.storeType` are free text, so an ecosystem can name a shape the specification doesn't list; these values are the documented ones, and tools treat them as known.",
+      "",
+      `- Component types: ${COMPONENT_TYPES.map((t) => `\`${t}\``).join(", ")}.`,
+      `- Data store types: ${STORE_TYPES.map((t) => `\`${t}\``).join(", ")}.`,
+      "- System tags: `saas` marks a SaaS product used as a system (boundary `vendor`).",
+      "",
+      "## Record kinds",
+      "",
+      RECORD_KINDS.map((k) => `- [${k}](#${k.toLowerCase()})`).join("\n"),
+      "",
+      "## The facts file (ADR 0124)",
+      "",
+      "What an assistant writes when it reads a repo: one JSON line per fact, in seven kinds plus flows, every one with a citation (`cite`: file, line, the claimed value, a short quote). The facts file is the assistant's input format, projected deterministically into the record kinds above by `projectFacts`; it is additive to C1 and changes the same way. A fact without a citation is not a fact; it is a question.",
+      "",
+      `Fact kinds: ${FACT_KINDS.map((k) => `\`${k}\``).join(", ")}.`
+    ]
+  },
+  {
+    id: "C2",
+    file: "c2-dialects.md",
+    title: "C2: Dialects",
+    summary: "Rule files that teach the scanner a house framework without code.",
+    intro: [
+      "A dialect is a YAML rule file, `org-pack/dialects/<name>.yaml`. Each rule matches something in source or config files (an annotation, a base class, a method call, a config key, an XPath or JSONPath, a regular expression) and emits a catalog record (C1) from templates over what matched. Every dialect ships its own tests; a dialect whose tests fail does not load."
+    ],
+    versions: [["Schema version", DIALECT_SCHEMA_VERSION]],
+    sections: [
+      { name: "Dialect", where: "org-pack/dialects/<name>.yaml" },
+      { name: "DialectRule" },
+      { name: "DialectEmit" },
+      { name: "DialectTest" }
+    ]
+  },
+  {
+    id: "C3",
+    file: "c3-rules-and-findings.md",
+    title: "C3: Rules and findings",
+    summary: "Checklist packs the critic applies, and the findings it records.",
+    intro: [
+      "A checklist pack is a set of rules a gate applies to a change: deterministic checks over the change's artifacts and the catalog, and bounded AI checks that must cite evidence. A finding is one result, stored as `openspec/changes/<change>/review/<gate>/<round>/<finding-id>.yaml`. Blocking findings stop a hand-off until fixed or waived by the stage owner; gaps need a fix or a recorded reason; risks and ideas never block."
+    ],
+    versions: [["Schema version", REVIEW_SCHEMA_VERSION]],
+    sections: [
+      { name: "ChecklistPack", where: "org-pack/checklists/<name>.yaml" },
+      { name: "ChecklistRule" },
+      { name: "Finding", where: "openspec/changes/<change>/review/<gate>/<round>/<id>.yaml" }
+    ]
+  },
+  {
+    id: "C4",
+    file: "c4-plugins-workspace-and-api.md",
+    title: "C4: Plugins, workspace files, executors and the local API",
+    summary: "Extractor and ingestor plugins, adapters, the workspace and change files, step executors and the local API.",
+    intro: [
+      "C4 is every interface between Atticus and code outside it: plugins that read files (extractors and ingestors), adapters to external systems, the workspace and change files, the step executor protocol, and the local API the UI uses."
+    ],
+    versions: [
+      ["Workspace files", WORKSPACE_SCHEMA_VERSION],
+      ["Change state file", CHANGE_SCHEMA_VERSION],
+      ["Executor protocol", EXECUTOR_SCHEMA_VERSION],
+      ["Local API", API_VERSION]
+    ],
+    sections: [
+      { name: "RepoManifest", where: "org-pack/profiles/<profile>/repos.manifest.yaml" },
+      { name: "ChangeRepos", where: "openspec/changes/<change>/repos.yaml" },
+      { name: "ChangeLifecycle", where: "openspec/changes/<change>/change.yaml" },
+      { name: "ManualStep" },
+      { name: "ExecutorsFile", where: ".atticus/executors.yaml (never committed)" },
+      { name: "RunRequest" },
+      { name: "RunProgress" },
+      { name: "RunResult" },
+      { name: "PingResponse" },
+      { name: "IdempotencyCheck" },
+      { name: "IdempotencyAnswer" }
+    ],
+    extra: () => [
+      "## Plugins",
+      "",
+      "Extractors read a repository and emit catalog records; ingestors read one input file (a diagram, a document, an export). Both read files only: no network, no AI model, no clock (timestamps come from the scan context), so a scan is deterministic and a plugin's output can be cached by commit. Everything a plugin emits is validated against C1; invalid records are reported and never written.",
+      "",
+      "```ts",
+      "interface RepoHandle {",
+      "  readonly name: string; // repo name from the repo manifest",
+      "  readonly commit: string; // commit being scanned",
+      "  listFiles(globs: readonly string[]): AsyncIterable<string>;",
+      "  readText(path: string): Promise<string>;",
+      "}",
+      "",
+      "interface ScanContext {",
+      "  readonly dialects: readonly string[];",
+      "  readonly component?: string; // the component this repo builds",
+      "  readonly system?: string;",
+      "  readonly repoType?: string;",
+      "  readonly scannedAt: string; // ISO timestamp of this scan",
+      "  warn(message: string, path?: string): void;",
+      "}",
+      "",
+      "interface Extractor {",
+      "  readonly id: string; // lowercase slug",
+      "  readonly version: string; // semver; part of the cache key and of every record's evidence",
+      "  readonly claims: readonly string[]; // file globs it reads",
+      "  scan(repo: RepoHandle, ctx: ScanContext): AsyncIterable<CatalogRecord>;",
+      "}",
+      "",
+      "interface Ingestor {",
+      "  readonly id: string;",
+      "  readonly version: string;",
+      "  sniff(fileName: string, head: Uint8Array): number; // 0..1",
+      "  ingest(fileName: string, content: Uint8Array, ctx: ScanContext): AsyncIterable<CatalogRecord>;",
+      "}",
+      "```",
+      "",
+      "## Adapters",
+      "",
+      "Adapters connect Atticus to external systems by type: work tracker, service desk, Git host, wiki, design tool, notifications, each with a manual fallback. Every write to a shared system goes through an adapter call that carries an explicit approval from a person; this is not configurable.",
+      "",
+      "## Local API",
+      "",
+      `The local API (version ${API_VERSION}) is an OpenAPI 3.1 document, generated from the same schemas and committed at [docs/api/openapi.json](../../api/openapi.json). It listens on 127.0.0.1 only and every request carries the per-session token printed at start-up.`
+    ]
+  },
+  {
+    id: "C5",
+    file: "c5-ai-runtime.md",
+    title: "C5: AI runtime",
+    summary: "Agent definitions, context packs, run summaries and recordings.",
+    intro: [
+      "Agents are defined as data: what they read, what they may write, the model and budget. Every run gets a context pack (the data it may see, wrapped and labelled as data, never instructions, with its classification), and leaves a run summary. Recordings let any run be replayed without a model, which is how tests run."
+    ],
+    versions: [["Schema version", AI_SCHEMA_VERSION]],
+    sections: [
+      { name: "AgentDefinition", where: "org-pack/agents/<id>.yaml" },
+      { name: "ContextPackManifest" },
+      { name: "RunSummary" },
+      { name: "Recording" }
+    ]
+  },
+  {
+    id: "C6",
+    file: "c6-org-pack.md",
+    title: "C6: The org pack",
+    summary: "An organisation's configuration: change types, gates, patterns, sources, runtime, procedures, profiles.",
+    intro: [
+      "The org pack is everything an organisation configures, as files: the kinds of change and their flows, the gates and what they check, integration patterns, knowledge sources, the runtime (adapters and AI), procedures with their steps, test strategies and ecosystem profiles. A pack is validated file by file and across files; files it leaves out fall back to built-in defaults.",
+      "`roles.yaml`, and the role-based approval fields in `gates.yaml`, `change-types.yaml` and the change policy, are deprecated (ADR 0073): they still load and validate, and nothing reads them. The person is the metarepo's Git user, and a gate is approved when its hand-off PR merges."
+    ],
+    versions: [["Schema version", ORGPACK_SCHEMA_VERSION]],
+    sections: [
+      { name: "PackManifest", where: "org-pack/pack.yaml" },
+      { name: "Roles", where: "org-pack/roles.yaml (deprecated, ADR 0073)" },
+      { name: "ChangeTypes", where: "org-pack/change-types.yaml" },
+      { name: "Gates", where: "org-pack/gates.yaml" },
+      { name: "IntegrationPattern", where: "org-pack/patterns/<code>.yaml" },
+      { name: "FrameworkModel", where: "org-pack/frameworks/<name>.yaml (ADR 0054)" },
+      { name: "Sources", where: "org-pack/sources.yaml" },
+      { name: "Runtime", where: "org-pack/runtime.yaml" },
+      { name: "SkillMeta", where: "org-pack/process/skills/<name>/SKILL.md (front matter)" },
+      {
+        name: "ServiceRequestTemplate",
+        where: "org-pack/process/snow/<id>.yaml (service-desk request templates)"
+      },
+      { name: "Procedure", where: "org-pack/process/procedures/<id>.yaml" },
+      { name: "TestStrategy", where: "org-pack/test-strategy.yaml" },
+      { name: "Profile", where: "org-pack/profiles/<profile>/profile.yaml" },
+      {
+        name: "OpenSpecSettings",
+        where: "org-pack/openspec.yaml (optional; OpenSpec's beta stores, ADR 0126)"
+      }
+    ]
+  }
+];
+
+// packages/cli/dist/u1-commands.js
+async function conformanceCommand(target, o, io) {
+  if (!o.kind || !CONFORMANCE_KINDS.includes(o.kind)) {
+    io.err(`Say what to check with --kind: ${CONFORMANCE_KINDS.join(", ")}.${o.kind ? ` "${o.kind}" isn't one of them.` : ""}`);
+    return 2;
+  }
+  const report2 = await conformanceRun(resolve(target), {
+    kind: o.kind,
+    ...o.executor ? { executor: o.executor } : {},
+    ...o.fixture ? { fixture: resolve(o.fixture) } : {}
+  });
+  if (o.json)
+    io.out(JSON.stringify(report2, null, 2));
+  else
+    for (const l of lines(report2))
+      io.out(l);
+  return report2.passed ? 0 : 1;
+}
+var MARK = { pass: "ok  ", fail: "FAIL", warn: "warn" };
+function lines(r) {
+  const out = [`Conformance of ${r.target} (${r.kind}) to specification ${r.specVersion}:`];
+  for (const x of r.results)
+    out.push(`  ${MARK[x.status]}  ${x.check}  ${x.file ? `${x.file}: ` : ""}${x.message}`);
+  const { pass, fail, warn } = r.summary;
+  const n = (k, word) => `${k} ${word}${k === 1 ? "" : "s"}`;
+  const warnings = warn ? `, ${n(warn, "warning")}` : "";
+  out.push(r.passed ? `Passed: ${n(pass, "check")}${warnings}.` : `Failed: ${n(fail, "problem")}, ${n(pass, "check")} passed${warnings}.`);
+  return out;
+}
+
+export {
+  conformanceCommand
+};