@meetless/mla 0.1.4

package/dist/commands/enrich.js

@@ -0,0 +1,427 @@
+"use strict";
+// `mla enrich`: the two CLI bookends for agent-orchestrated onboarding enrichment.
+//
+//   enrich plan   -> derive the workspace + git root, mint a runId, scan the repo into
+//                    an immutable run record (ranked doc targets + a bounded git-history
+//                    allowlist), persist it locally, and print the plan the agent reads.
+//   enrich ingest -> the agent dispatched read-only scouts against that plan and reports
+//                    candidates; this loads the authoritative run record, re-verifies it,
+//                    validates + verifies every candidate, and persists the survivors to
+//                    the governed KB born PENDING.
+//
+// The agent never supplies plan data: it gets a runId from `plan` and returns only the
+// scout results. All trust enforcement (realpath containment, exist-at-HEAD, line range,
+// commit allowlist, plan-digest match) lives in lib/enrichment, exercised here with the
+// real filesystem, git, and the kb-add route. See
+// notes/20260626-mla-agent-onboarding-enrichment-plan.md (§5, §5b, §6, §6b).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBudgetMs = resolveBudgetMs;
+exports.parsePlanArgs = parsePlanArgs;
+exports.parseIngestArgs = parseIngestArgs;
+exports.extractResults = extractResults;
+exports.parseBriefArgs = parseBriefArgs;
+exports.runEnrich = runEnrich;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const config_1 = require("../lib/config");
+const workspace_1 = require("../lib/workspace");
+const http_1 = require("../lib/http");
+const plan_1 = require("../lib/enrichment/plan");
+const ingest_1 = require("../lib/enrichment/ingest");
+const scout_brief_1 = require("../lib/enrichment/scout-brief");
+const protocol_1 = require("../lib/enrichment/protocol");
+const USAGE = `mla enrich: agent-orchestrated onboarding enrichment (two bookends).
+
+  mla enrich plan [--json] [--budget-ms <n>] [--workspace <id>]
+      Scan this repository into an immutable run record and print the plan the
+      agent reads to dispatch its read-only scouts. --json prints the machine
+      plan (the agent contract); without it, a human summary. The runId in the
+      output is what you pass back to \`enrich ingest\`.
+
+  mla enrich brief --run-id <id> --role <documentation|history> [--workspace <id>]
+      Print the exact subagent brief for one scout role, rendered from the run
+      record named by --run-id. Read-only; used by \`/mla onboard\` to dispatch each
+      scout with the run-specific prompt \`enrich ingest\` will validate against.
+
+  mla enrich ingest --run-id <id> [--results-file <path>] [--json] [--workspace <id>]
+      Validate + persist the scouts' candidates against the run record named by
+      --run-id. Reads the scout results as JSON from --results-file, or from
+      stdin when no file is given (an array of scout results, or an object with a
+      \`results\` array). Candidates land in the governed KB born PENDING.
+      Exit: 0 clean, 1 a scout needs attention (persistence failed / malformed),
+      2 the request was rejected (unknown run, mismatch, corrupt record).`;
+// Mirror kb_add's ingest timeout heuristic (it is module-private there). Generous,
+// scales with document count: the kb-add route runs the full atomic-claim pipeline.
+function ingestTimeoutMs(docCount) {
+    return Math.max(120_000, docCount * 20_000);
+}
+// The git toplevel is the enrichment repository root: `git ls-files` / `git log` must
+// run from it so the paths the scouts cite are repo-root-relative and the realpath
+// containment check has the right base. Throws a clean error outside a git repo.
+function resolveRepositoryRoot(startDir) {
+    try {
+        return (0, node_child_process_1.execFileSync)("git", ["rev-parse", "--show-toplevel"], {
+            cwd: startDir,
+            encoding: "utf8",
+        }).trim();
+    }
+    catch {
+        throw new Error(`mla enrich requires a git repository. No git toplevel found at ${startDir}. ` +
+            `Run it from inside an activated, git-tracked repository.`);
+    }
+}
+// The §8 budget knob. `--budget-ms` wins; else MLA_ENRICH_BUDGET_MS; else the protocol
+// default (createPlan applies it). An invalid env value is IGNORED with a warning rather
+// than failing the command (an explicit flag with a bad value still hard-errors upstream).
+//
+// Contract honesty (§8, Phase 0B): this knob sets the run's `deadlineAt`; it is a SOFT
+// budget. The CLI does not supervise the scouts (the agent does), so the deadline steers
+// the skill's dispatch/wait and the scouts self-limit. Ingest already records a scout that
+// reports `timed_out` as partial-and-rerunnable; no late arrival is rejected on time. Do
+// not call this a hard ceiling until a live hang-test proves the runtime can abandon a
+// straggler at the deadline (background dispatch + scheduled wake + task-stop).
+function resolveBudgetMs(flagBudget, rawEnv) {
+    if (flagBudget !== undefined)
+        return { budgetMs: flagBudget };
+    if (rawEnv === undefined || rawEnv.trim() === "")
+        return {};
+    const v = Number(rawEnv);
+    if (!Number.isFinite(v) || v <= 0) {
+        return { warning: `ignoring invalid MLA_ENRICH_BUDGET_MS=${rawEnv} (expected a positive number of milliseconds)` };
+    }
+    return { budgetMs: v };
+}
+// Exported for unit tests: the pure flag/payload helpers are the only new logic in this
+// shell worth isolating (createPlan/ingestRun are covered by their own specs).
+function parsePlanArgs(argv) {
+    const flags = { json: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--json")
+            flags.json = true;
+        else if (a === "--budget-ms") {
+            const v = Number(argv[++i]);
+            if (!Number.isFinite(v) || v <= 0)
+                throw new Error("--budget-ms must be a positive number of milliseconds");
+            flags.budgetMs = v;
+        }
+        else if (a === "--workspace") {
+            flags.workspace = argv[++i];
+            if (!flags.workspace)
+                throw new Error("--workspace requires a workspace id");
+        }
+        else
+            throw new Error(`Unknown flag for \`mla enrich plan\`: ${a}`);
+    }
+    return flags;
+}
+async function runEnrichPlan(argv) {
+    let flags;
+    try {
+        flags = parsePlanArgs(argv);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    let cfg;
+    try {
+        cfg = (0, config_1.readKbConfig)(flags.workspace);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    let repositoryRoot;
+    try {
+        const ctx = (0, workspace_1.resolveWorkspaceContext)();
+        repositoryRoot = resolveRepositoryRoot(ctx.markerDir);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    const budget = resolveBudgetMs(flags.budgetMs, process.env.MLA_ENRICH_BUDGET_MS);
+    if (budget.warning)
+        console.error(budget.warning);
+    const runId = `run-${(0, node_crypto_1.randomUUID)()}`;
+    const { run, recordPath, pruned, historyTruncated } = (0, plan_1.createPlan)({
+        runId,
+        workspaceId: cfg.workspaceId,
+        repositoryRoot,
+        home: config_1.HOME,
+        now: new Date().toISOString(),
+        budgetMs: budget.budgetMs,
+    });
+    if (flags.json) {
+        // The agent contract: the run record plus the truncation signal. The agent reads
+        // documentationTargets + historyEvidence to dispatch its scouts and passes runId
+        // back to `enrich ingest`. It is the SAME record persisted on disk (no divergence).
+        console.log(JSON.stringify({ ...run, historyTruncated }, null, 2));
+        return 0;
+    }
+    const lines = [
+        `Onboarding enrichment plan ready.`,
+        ``,
+        `  runId:            ${run.runId}`,
+        `  workspace:        ${run.workspaceId}`,
+        `  repository:       ${run.repositoryRoot}`,
+        `  budget:           ${run.limits.budgetMs} ms (deadline ${run.deadlineAt})`,
+        `  doc targets:      ${run.documentationTargets.length}`,
+        `  history commits:  ${run.historyEvidence.length}${historyTruncated ? " (truncated)" : ""}`,
+        `  max candidates:   ${run.limits.maxCandidatesTotal}`,
+        `  record:           ${recordPath}${pruned ? ` (pruned ${pruned} stale)` : ""}`,
+        ``,
+        `Run \`mla enrich plan --json\` for the machine plan, then dispatch scouts and`,
+        `report with \`mla enrich ingest --run-id ${run.runId}\`.`,
+    ];
+    console.log(lines.join("\n"));
+    return 0;
+}
+function parseIngestArgs(argv) {
+    const flags = { json: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--json")
+            flags.json = true;
+        else if (a === "--run-id") {
+            flags.runId = argv[++i];
+            if (!flags.runId)
+                throw new Error("--run-id requires a value");
+        }
+        else if (a === "--results-file") {
+            flags.resultsFile = argv[++i];
+            if (!flags.resultsFile)
+                throw new Error("--results-file requires a path");
+        }
+        else if (a === "--workspace") {
+            flags.workspace = argv[++i];
+            if (!flags.workspace)
+                throw new Error("--workspace requires a workspace id");
+        }
+        else
+            throw new Error(`Unknown flag for \`mla enrich ingest\`: ${a}`);
+    }
+    if (!flags.runId)
+        throw new Error("--run-id is required (the id printed by `mla enrich plan`)");
+    return flags;
+}
+function readStdin() {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => (data += chunk));
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", reject);
+    });
+}
+// Normalize the agent's payload into the results array. Accept three shapes for
+// ergonomics: a bare array, `{results:[...]}`, or the full `{runId, results}` request.
+// When a runId is present in the body it MUST match --run-id (defense against a stale
+// paste pointing the wrong run's results at this record).
+function extractResults(raw, runId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new Error(`scout results are not valid JSON: ${e.message}`);
+    }
+    if (Array.isArray(parsed))
+        return parsed;
+    if (parsed && typeof parsed === "object") {
+        const obj = parsed;
+        if (obj.runId !== undefined && obj.runId !== runId) {
+            throw new Error(`results runId (${String(obj.runId)}) does not match --run-id (${runId})`);
+        }
+        if (Array.isArray(obj.results))
+            return obj.results;
+    }
+    throw new Error("scout results must be a JSON array, or an object with a `results` array");
+}
+function renderIngestSummary(outcomes, status) {
+    const lines = [`Onboarding ingest complete (state: ${status ?? "unknown"}).`, ``];
+    for (const o of outcomes) {
+        lines.push(`  ${o.scout}: ${o.accepted} accepted, ${o.rejected} rejected, ${o.persisted} persisted (received ${o.received})`);
+        for (const e of o.errors) {
+            const where = e.index >= 0 ? `candidate ${e.index}` : "scout";
+            lines.push(`      - ${where}: ${e.code} (${e.message})`);
+        }
+    }
+    return lines.join("\n");
+}
+async function runEnrichIngest(argv) {
+    let flags;
+    try {
+        flags = parseIngestArgs(argv);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    let cfg;
+    try {
+        cfg = (0, config_1.readKbConfig)(flags.workspace);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    let repositoryRoot;
+    try {
+        const ctx = (0, workspace_1.resolveWorkspaceContext)();
+        repositoryRoot = resolveRepositoryRoot(ctx.markerDir);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    // Source the scout results: an explicit file, or piped stdin. Refuse to hang on a TTY.
+    let rawResults;
+    try {
+        if (flags.resultsFile) {
+            rawResults = (0, node_fs_1.readFileSync)(flags.resultsFile, "utf8");
+        }
+        else if (!process.stdin.isTTY) {
+            rawResults = await readStdin();
+        }
+        else {
+            console.error("provide --results-file <path> or pipe the scout results JSON to stdin");
+            return 2;
+        }
+    }
+    catch (e) {
+        console.error(`could not read scout results: ${e.message}`);
+        return 2;
+    }
+    let results;
+    try {
+        results = extractResults(rawResults, flags.runId);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    // The real kb-add persister: born-PENDING governed notes. provenance is advisory
+    // (the server derives the recorded value from the envelope); the count reflects
+    // receipts that landed (ingested or already-present), not failures.
+    const persist = async (docs) => {
+        const body = {
+            workspaceId: cfg.workspaceId,
+            actor: cfg.actorUserId,
+            documents: docs.map((d) => ({ relPath: d.relPath, content: d.content })),
+            provenance: "agent_distilled",
+            profile: "markdown_atomic_v1",
+            mode: "file",
+        };
+        const res = await (0, http_1.intelPost)(cfg, "/internal/v1/kb/add", body, ingestTimeoutMs(docs.length));
+        const receipts = res.receipts ?? [];
+        return { persisted: receipts.filter((r) => r.outcome !== "failed").length };
+    };
+    const res = await (0, ingest_1.ingestRun)({
+        env: { home: config_1.HOME, workspaceId: cfg.workspaceId, repositoryRoot },
+        request: { protocolVersion: protocol_1.PROTOCOL_VERSION, runId: flags.runId, results },
+        persist,
+        now: new Date().toISOString(),
+    });
+    if (!res.ok) {
+        if (flags.json)
+            console.log(JSON.stringify(res, null, 2));
+        else
+            console.error(`enrich ingest rejected: ${res.rejectionReason}`);
+        return 2;
+    }
+    if (flags.json) {
+        console.log(JSON.stringify(res, null, 2));
+    }
+    else {
+        console.log(renderIngestSummary(res.outcomes, res.state?.status));
+    }
+    // 1 when a scout needs attention (infra failure or a malformed envelope worth a retry);
+    // 0 otherwise. A scout that merely "timed_out" is rerunnable state, not an error here.
+    const needsAttention = (res.state ? Object.values(res.state.scouts) : []).some((s) => s.status === "persistence_failed" || s.status === "malformed");
+    return needsAttention ? 1 : 0;
+}
+function parseBriefArgs(argv) {
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--run-id") {
+            flags.runId = argv[++i];
+            if (!flags.runId)
+                throw new Error("--run-id requires a value");
+        }
+        else if (a === "--role") {
+            const v = argv[++i];
+            if (!v)
+                throw new Error("--role requires a value");
+            if (!protocol_1.SCOUT_NAMES.includes(v)) {
+                throw new Error(`--role must be one of: ${protocol_1.SCOUT_NAMES.join(", ")}`);
+            }
+            flags.role = v;
+        }
+        else if (a === "--workspace") {
+            flags.workspace = argv[++i];
+            if (!flags.workspace)
+                throw new Error("--workspace requires a workspace id");
+        }
+        else
+            throw new Error(`Unknown flag for \`mla enrich brief\`: ${a}`);
+    }
+    if (!flags.runId)
+        throw new Error("--run-id is required (the id printed by `mla enrich plan`)");
+    if (!flags.role)
+        throw new Error(`--role is required (one of: ${protocol_1.SCOUT_NAMES.join(", ")})`);
+    return flags;
+}
+// Print one scout's run-specific brief. Pure read of the persisted run record plus
+// buildScoutPrompt; no git, no network, no mutation. `/mla onboard` calls this to get
+// the exact prompt it hands each subagent, so the brief logic stays in tested TS and
+// every scout input matches what `enrich ingest` re-validates against the same record.
+function runEnrichBrief(argv) {
+    let flags;
+    try {
+        flags = parseBriefArgs(argv);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    let cfg;
+    try {
+        cfg = (0, config_1.readKbConfig)(flags.workspace);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    const run = (0, plan_1.loadRunRecord)(config_1.HOME, cfg.workspaceId, flags.runId);
+    if (!run) {
+        console.error(`no onboarding run record for ${flags.runId} in workspace ${cfg.workspaceId}. ` +
+            "Run `mla enrich plan` first, from the same workspace.");
+        return 2;
+    }
+    console.log((0, scout_brief_1.buildScoutPrompt)(run, flags.role));
+    return 0;
+}
+async function runEnrich(argv) {
+    const sub = argv[0];
+    const rest = argv.slice(1);
+    if (sub === undefined || sub === "help" || sub === "--help" || sub === "-h") {
+        console.log(USAGE);
+        return 0;
+    }
+    switch (sub) {
+        case "plan":
+            return runEnrichPlan(rest);
+        case "brief":
+            return runEnrichBrief(rest);
+        case "ingest":
+            return runEnrichIngest(rest);
+        default:
+            console.error(`unknown \`mla enrich\` subcommand: ${sub}\n`);
+            console.error(USAGE);
+            return 2;
+    }
+}

package/dist/commands/evidence.js

@@ -0,0 +1,229 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultCe0StorePath = void 0;
+exports.runEvidence = runEvidence;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../lib/config");
+const workspace_1 = require("../lib/workspace");
+const observability_1 = require("../lib/observability");
+const ce0_store_1 = require("../lib/rules/ce0-store");
+Object.defineProperty(exports, "defaultCe0StorePath", { enumerable: true, get: function () { return ce0_store_1.defaultCe0StorePath; } });
+const ce0_evidence_1 = require("../lib/rules/ce0-evidence");
+const ce0_recall_sample_1 = require("../lib/rules/ce0-recall-sample");
+const ce0_telemetry_project_1 = require("../lib/rules/ce0-telemetry-project");
+const recorder_1 = require("../lib/analytics/recorder");
+const store_1 = require("../lib/analytics/store");
+// `mla evidence` -- the one human-only CE0 labeling workflow
+// (notes/20260617-evidence-consultation-forcing-function-proposal.md §2.3). CE0 is a measurement
+// harness: the runtime hooks only record facts (the per-turn assessment, the consultation attempts)
+// and the first Stop freezes the eligibility boundary. Satisfaction and coverage are graded OFFLINE,
+// by a human, through this command. There is no model call and no external egress here; the response
+// ceiling stays RECORD_ONLY.
+//
+//   mla evidence ce0-export                 Write the JSONL a labeler audits: every deadline-claimed,
+//                                           not-yet-finalized obligation with the deterministic
+//                                           machine baseline recomputed over its eligible consultations.
+//   mla evidence ce0-import-labels <file>   Read a labeled JSONL back, validate each label against the
+//                                           current export snapshot, and CAS-finalize the matched
+//                                           obligations. Prints the finalize / conflict / reject /
+//                                           agreement report.
+//
+// The command is a thin IO shell over the pure ce0-evidence core; the store path, workspace
+// resolution, and the stdout / stderr sinks are injectable so the workflow is testable end to end.
+const USAGE = "usage: mla evidence <ce0-export | ce0-import-labels <file> | ce0-emit-telemetry>";
+const RECALL_SAMPLE_RATE_FLAG = "--recall-sample-rate";
+/**
+ * Parse the optional `--recall-sample-rate <value>` (or `=<value>`) flag for `ce0-export`. Absent ->
+ * the pinned DEFAULT_RECALL_SAMPLE_RATE (sample every unflagged turn). Present -> a finite fraction in
+ * [0, 1]; anything else (non-numeric, out of range, missing value) is an operator error reported with a
+ * non-zero exit so a bad rate never silently narrows the recall denominator
+ * (notes/20260617-evidence-consultation-forcing-function-proposal.md lines 2129, 2145).
+ */
+function parseRecallSampleRate(args) {
+    let raw;
+    for (let i = 0; i < args.length; i++) {
+        const tok = args[i];
+        if (tok === RECALL_SAMPLE_RATE_FLAG) {
+            raw = args[i + 1];
+            i++;
+        }
+        else if (tok.startsWith(`${RECALL_SAMPLE_RATE_FLAG}=`)) {
+            raw = tok.slice(RECALL_SAMPLE_RATE_FLAG.length + 1);
+        }
+    }
+    if (raw === undefined)
+        return { value: ce0_recall_sample_1.DEFAULT_RECALL_SAMPLE_RATE };
+    const value = Number(raw);
+    if (raw.trim() === "" || !Number.isFinite(value) || value < 0 || value > 1) {
+        return { error: `${RECALL_SAMPLE_RATE_FLAG} must be a number in [0, 1] (got "${raw}")` };
+    }
+    return { value };
+}
+async function runEvidence(argv, deps = {}) {
+    const out = deps.out ?? ((line) => console.log(line));
+    const err = deps.err ?? ((line) => console.error(line));
+    const sub = argv[0];
+    if (sub === "ce0-export") {
+        const rate = parseRecallSampleRate(argv.slice(1));
+        if ("error" in rate) {
+            err(`mla evidence ce0-export: ${rate.error}\n${USAGE}`);
+            return 2;
+        }
+        return withWorkspaceAndStore(deps, err, (workspaceId, store) => {
+            out((0, ce0_evidence_1.runCe0Export)(store, workspaceId, rate.value));
+            return 0;
+        });
+    }
+    if (sub === "ce0-import-labels") {
+        const file = argv[1];
+        if (!file) {
+            err(`mla evidence ce0-import-labels: missing labels file argument\n${USAGE}`);
+            return 2;
+        }
+        const readFile = deps.readFile ?? ((p) => fs.readFileSync(p, "utf8"));
+        const labelJsonl = readFile(file);
+        return withWorkspaceAndStore(deps, err, (workspaceId, store) => {
+            const report = (0, ce0_evidence_1.runCe0ImportLabels)(store, workspaceId, labelJsonl);
+            out(JSON.stringify(report));
+            return 0;
+        });
+    }
+    if (sub === "ce0-emit-telemetry") {
+        return runEmitTelemetry(deps, out, err);
+    }
+    err(`mla evidence: unknown subcommand ${sub ? `"${sub}"` : "(none)"}\n${USAGE}`);
+    return 2;
+}
+/** `mla evidence ce0-emit-telemetry`: project the CE0 store into the two §6.4 events it honestly
+ * backs (memory_requirement_assessed per assessment, evidence_obligation_finalized per FINALIZED
+ * obligation), record each locally, then best-effort forward to control. A repeated sweep is
+ * idempotent two ways: the deterministic event_id dedupes on the remote sink, and a local skip-set
+ * (the event_ids already in the local log for these two types) avoids re-appending the same lines.
+ * Each event carries the ORIGINAL turn's session, so the analytics side joins it to the turn it
+ * describes, not to this emit run. */
+async function runEmitTelemetry(deps, out, err) {
+    const env = deps.env ?? process.env;
+    const record = deps.record ?? recorder_1.recordAnalyticsEvent;
+    const read = deps.readEvents ?? store_1.readEvents;
+    const readCfg = deps.readCfg ??
+        (() => {
+            try {
+                return (0, config_1.readConfig)();
+            }
+            catch {
+                return null;
+            }
+        });
+    const cfg = readCfg();
+    // One run_id per invocation (never derived from trace); reuse the bootstrap-set run/trace when
+    // present so all events in this sweep share them, else mint fresh (a standalone measurement run).
+    const runId = deps.runId ?? (0, observability_1.getRunId)() ?? (0, observability_1.mintRunId)();
+    const traceId = deps.traceId ?? (0, observability_1.getRunTraceId)() ?? (0, observability_1.mintTraceId)();
+    const distinctId = deps.distinctId ?? cfg?.actorUserId ?? (deps.machineId ?? store_1.machineId)();
+    const nowIso = new Date(deps.nowMs ?? Date.now()).toISOString();
+    let assessed = 0;
+    let finalized = 0;
+    let skipped = 0;
+    const code = withWorkspaceAndStore(deps, err, (workspaceId, store) => {
+        // Skip-set: every event_id already logged locally for the two projected types. Keeps a repeated
+        // sweep from re-appending lines the deterministic event_id would otherwise dedupe only remotely.
+        const emitted = new Set();
+        for (const ev of read(env)) {
+            if ((ev.event_type === "memory_requirement_assessed" ||
+                ev.event_type === "evidence_obligation_finalized") &&
+                typeof ev.event_id === "string") {
+                emitted.add(ev.event_id);
+            }
+        }
+        const emit = (sessionId, input) => {
+            if (input.eventId && emitted.has(input.eventId)) {
+                skipped++;
+                return false;
+            }
+            const ctx = { workspaceId, sessionId, distinctId, runId, traceId, now: nowIso };
+            record(ctx, input, env);
+            if (input.eventId)
+                emitted.add(input.eventId);
+            return true;
+        };
+        for (const a of (0, ce0_store_1.listTurnMemoryAssessments)(store, workspaceId)) {
+            if (emit(a.sessionId, (0, ce0_telemetry_project_1.projectAssessedEvent)(a)))
+                assessed++;
+        }
+        for (const o of (0, ce0_store_1.listDeadlineClaimedObligations)(store, workspaceId)) {
+            if (o.status !== "FINALIZED")
+                continue;
+            const consultations = (0, ce0_store_1.listConsultationsForTurn)(store, {
+                workspaceId: o.workspaceId,
+                sessionId: o.sessionId,
+                localTurnSequence: o.localTurnSequence,
+            });
+            if (emit(o.sessionId, (0, ce0_telemetry_project_1.projectFinalizedEvent)(o, consultations)))
+                finalized++;
+        }
+        return 0;
+    });
+    if (code !== 0)
+        return code;
+    if (cfg) {
+        const flush = deps.flush ?? recorder_1.flushAnalyticsEvents;
+        await flush(cfg, env);
+    }
+    out(JSON.stringify({ emitted: { assessed, finalized }, skipped }));
+    return 0;
+}
+/** Resolve the workspace, ensure the store directory exists, open it, run `body`, and close it. A
+ * missing workspace is exit 1 (an operator problem: run from a marked repo or set the env var). */
+function withWorkspaceAndStore(deps, err, body) {
+    const resolve = deps.resolveWorkspaceId ?? workspace_1.resolveWorkspaceIdWithEnv;
+    const workspaceId = resolve();
+    if (!workspaceId) {
+        err("mla evidence: no workspace resolved. Run from a directory with a .meetless.json marker, " +
+            "or set MEETLESS_WORKSPACE_ID.");
+        return 1;
+    }
+    const dbPath = deps.storePath ?? (0, ce0_store_1.defaultCe0StorePath)();
+    fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+    const open = deps.openStore ?? ce0_store_1.openCe0Store;
+    const store = open(dbPath);
+    try {
+        return body(workspaceId, store);
+    }
+    finally {
+        (0, ce0_store_1.closeCe0Store)(store);
+    }
+}