@mikenguyen69/harness 0.1.0-beta.1

package/dist/internal/system/calibration/index.js

@@ -0,0 +1,141 @@
+/**
+ * calibration — the weekly job. Reads the fleet's envelopes over a trailing
+ * window and proposes gate severity changes as data, each citing its evidence
+ * query. Proposals are appended as `calibration.proposed`; a human applies (or
+ * rejects) them — severity never moves silently.
+ *
+ * Below an event-volume floor the cadence auto-derates to monthly and no
+ * proposals are made ("insufficient data").
+ */
+import { append, read as ledgerRead, } from "../ledger/index.js";
+const RUNS_TO_PROMOTE = 20;
+const RUNS_FOR_JUDGEMENT = 10;
+const FAIL_RATE_DEMOTE = 0.5;
+const RETRY_RATE_DEMOTE = 0.2;
+const MONTHLY_FLOOR = 30; // fewer than this many envelopes in the window → monthly cadence
+const RAMP = ["advisory", "changed-lines", "blocking"];
+function nextUp(s) {
+    const i = RAMP.indexOf(s);
+    return i >= 0 && i < RAMP.length - 1 ? RAMP[i + 1] : null;
+}
+function nextDown(s) {
+    const i = RAMP.indexOf(s);
+    return i > 0 ? RAMP[i - 1] : null;
+}
+export function analyzeGates(events, now, windowDays) {
+    const cutoff = now - windowDays * 24 * 60 * 60 * 1000;
+    const stats = new Map();
+    for (const e of events) {
+        if (e.type !== "envelope" || Date.parse(e.ts) < cutoff)
+            continue;
+        const b = e.body;
+        for (const g of b.gates ?? []) {
+            const s = stats.get(g.name) ?? {
+                runs: 0,
+                fails: 0,
+                retries: 0,
+                declined: 0,
+                severity: g.severity,
+            };
+            s.severity = g.severity;
+            if (g.outcome === "declined")
+                s.declined++;
+            else {
+                s.runs++;
+                if (g.outcome === "fail")
+                    s.fails++;
+                if ((g.retries ?? 0) > 0)
+                    s.retries++;
+            }
+            stats.set(g.name, s);
+        }
+    }
+    return stats;
+}
+export function proposeCalibration(opts) {
+    const now = opts.now ?? Date.now();
+    const windowDays = opts.windowDays ?? 30;
+    const events = ledgerRead(opts.ledgerDir);
+    const envelopesInWindow = events.filter((e) => e.type === "envelope" &&
+        Date.parse(e.ts) >= now - windowDays * 24 * 60 * 60 * 1000).length;
+    if (envelopesInWindow < MONTHLY_FLOOR) {
+        return {
+            cadence: "monthly",
+            windowDays,
+            envelopesInWindow,
+            insufficient: true,
+            proposals: [],
+        };
+    }
+    const stats = analyzeGates(events, now, windowDays);
+    const debt = opts.baseline?.debt ?? {};
+    const proposals = [];
+    for (const [name, s] of stats) {
+        // delete: never actually ran, no frozen debt for it
+        if (s.runs === 0 && s.declined > 0 && (debt[name] ?? 0) === 0) {
+            proposals.push({
+                action: "delete",
+                target: name,
+                evidence: `declined ${s.declined}× / ran 0× in ${windowDays}d, baseline debt 0`,
+            });
+            continue;
+        }
+        const failRate = s.runs ? s.fails / s.runs : 0;
+        const retryRate = s.runs ? s.retries / s.runs : 0;
+        // demote: failing or flaky
+        if (s.runs >= RUNS_FOR_JUDGEMENT &&
+            (failRate > FAIL_RATE_DEMOTE || retryRate > RETRY_RATE_DEMOTE)) {
+            const to = nextDown(s.severity);
+            if (to) {
+                proposals.push({
+                    action: "demote",
+                    target: name,
+                    from: s.severity,
+                    to,
+                    evidence: `${s.fails}/${s.runs} fail, ${s.retries}/${s.runs} pass-on-retry in ${windowDays}d`,
+                });
+            }
+            continue;
+        }
+        // promote: clean over a long run
+        if (s.runs >= RUNS_TO_PROMOTE && s.fails === 0 && s.retries === 0) {
+            const to = nextUp(s.severity);
+            if (to) {
+                proposals.push({
+                    action: "promote",
+                    target: name,
+                    from: s.severity,
+                    to,
+                    evidence: `0 failures in ${s.runs} runs over ${windowDays}d`,
+                });
+            }
+        }
+    }
+    proposals.sort((a, b) => a.target.localeCompare(b.target));
+    return {
+        cadence: "weekly",
+        windowDays,
+        envelopesInWindow,
+        insufficient: false,
+        proposals,
+    };
+}
+/** Append the proposals to the ledger (calibration.proposed, one per proposal). */
+export function emitProposals(report, ledgerDir, system = "fleet") {
+    for (const p of report.proposals) {
+        append(ledgerDir, {
+            system,
+            actor: { kind: "ci", id: "calibration-job" },
+            type: "calibration.proposed",
+            body: {
+                action: p.action,
+                target: p.target,
+                ...(p.from ? { from: p.from } : {}),
+                ...(p.to ? { to: p.to } : {}),
+                evidence: p.evidence,
+            },
+        });
+    }
+    return report.proposals.length;
+}
+//# sourceMappingURL=index.js.map

package/dist/internal/system/cli.js

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+/**
+ * harness — the single entrypoint, identical for agent, human, and CI.
+ *
+ * The moment any caller gets its own weaker path, that path becomes the
+ * default and the standard is decorative. So: no flags that weaken gates
+ * per-caller.
+ *
+ * Structural rules the runner enforces (not configurable):
+ *   - a vocabulary gate with no binding and no declination is an error
+ *   - all-skip / all-declined is never a pass
+ *   - retries are recorded; a pass-on-retry is not a clean pass
+ *   - out-of-scope file touches halt (fail closed), never warn
+ */
+import { doorCommand, mergeCommand } from "./doors/cli.js";
+import { escapeCommand } from "./escapes/cli.js";
+import { gateCommand } from "./gates/cli.js";
+import { exploreCommand } from "./explore/cli.js";
+import { boardCommand, boardServeCommand } from "./board/cli.js";
+import { calibrateCommand } from "./calibration/cli.js";
+import { digestCommand } from "./digest/cli.js";
+import { hubCommand } from "./hub/cli.js";
+import { runstatusCommand } from "./runstatus/cli.js";
+import { ledgerCommand } from "./ledger/cli.js";
+import { initCommand } from "./init/index.js";
+import { claimCommand, heartbeatCommand, nextCommand, } from "./sequencer/cli.js";
+import { specCommand } from "./spec/cli.js";
+import { verifyCommand } from "./verify/cli.js";
+const USAGE = `harness — deterministic scaffolding around nondeterministic agents
+
+Usage:
+  harness init      scaffold component.toml, hooks, CI workflow, generated adapters
+                    --audit: read-only brownfield inventory (stack, tooling, substrate,
+                             debt counts, flaky tests) — writes nothing, prints the plan
+                    --mode ratchet: brownfield adoption — freeze the debt inventory as
+                             .harness/baseline.json; bulk gates run changed-lines against
+                             a floor that may only fall; flakes quarantined by name
+  harness verify    run all bound gates (cheap first, fail fast) and emit the report
+  harness gate      --pre --file <path>   ring-0: run bound cheap-cost gates
+                    (a single named gate, e.g. \`gate spec\`, is not yet implemented)
+  harness spec      check     lint specs/*.yaml + dep DAG + consumes/produces
+                              [--specs <dir>] [--system <system.toml>]
+                    materialize validated specs into idempotent unit.planned facts
+                              --specs <dir> --system <system.toml> [--ledger <dir>] [--json]
+                    project   emit harness unit YAML from OpenSpec + harness.projection.yaml
+                              --change <dir> [--openspec <dir>] [--out <dir>] [--json]
+  harness next      list units ready to claim (deps merged, unclaimed or stale)
+  harness claim     <unit-id> --session <id>   atomically take a ready unit
+  harness heartbeat <unit-id> --session <id>   keep a claim alive
+  harness door      list [--sweep] | show <id> | approve <id> --reason … | reject …
+  harness merge     <unit-id> <--check | --landed <sha>> [facts…] authorize/record
+  harness ledger    append/read/verify the hash-chained record plane
+                    append (stdin JSON) | read | verify-chain   [--dir <path>]
+  harness runstatus publish [--file <path>] --spool <dir> [--machine <id>]
+                    push a run-status document to the hub spool (actuator → board)
+  harness board     build [--ledger <dir>] [--spool <dir>] [--out board.html]
+                    serve [--root <dir>]... [--port 4317] [--refresh 2000]
+                    run the local live dashboard across initialized repositories
+  harness attest    write/verify provenance attestations for a merge
+  harness report    aggregate envelopes (calibration input)
+`;
+const COMMANDS = [
+    "init",
+    "verify",
+    "gate",
+    "spec",
+    "next",
+    "claim",
+    "heartbeat",
+    "door",
+    "merge",
+    "escape",
+    "explore",
+    "hub",
+    "runstatus",
+    "board",
+    "calibrate",
+    "digest",
+    "ledger",
+    "attest",
+    "report",
+];
+function isCommand(arg) {
+    return COMMANDS.includes(arg);
+}
+const cmd = process.argv[2];
+if (!isCommand(cmd)) {
+    process.stderr.write(USAGE);
+    process.exit(2);
+}
+if (cmd === "ledger") {
+    process.exit(ledgerCommand(process.argv.slice(3)));
+}
+if (cmd === "init") {
+    process.exit(initCommand(process.argv.slice(3)));
+}
+if (cmd === "verify") {
+    process.exit(verifyCommand(process.argv.slice(3)));
+}
+if (cmd === "spec") {
+    process.exit(specCommand(process.argv.slice(3)));
+}
+if (cmd === "next") {
+    process.exit(nextCommand(process.argv.slice(3)));
+}
+if (cmd === "door") {
+    process.exit(doorCommand(process.argv.slice(3)));
+}
+if (cmd === "merge") {
+    process.exit(mergeCommand(process.argv.slice(3)));
+}
+if (cmd === "escape") {
+    process.exit(escapeCommand(process.argv.slice(3)));
+}
+if (cmd === "explore") {
+    process.exit(exploreCommand(process.argv.slice(3)));
+}
+if (cmd === "hub") {
+    process.exit(hubCommand(process.argv.slice(3)));
+}
+if (cmd === "runstatus") {
+    process.exit(runstatusCommand(process.argv.slice(3)));
+}
+if (cmd === "board") {
+    if (process.argv[3] === "serve") {
+        try {
+            const running = await boardServeCommand(process.argv.slice(4));
+            process.stdout.write(`Harness Operations live at ${running.url}\nPress Ctrl+C to stop.\n`);
+            // Safety valve for automated contexts: a verifier/agent that spawns
+            // `board serve` and forgets it would otherwise run forever and hold its
+            // parent's stdio pipes open. HARNESS_BOARD_SERVE_MAX_MS makes it
+            // self-terminate. Unset = unlimited, for interactive use.
+            const maxMs = Number(process.env.HARNESS_BOARD_SERVE_MAX_MS ?? 0);
+            await new Promise((accept) => {
+                const stop = () => void running.close().finally(accept);
+                process.once("SIGINT", stop);
+                process.once("SIGTERM", stop);
+                if (Number.isFinite(maxMs) && maxMs > 0) {
+                    setTimeout(() => {
+                        process.stderr.write(`harness board serve: self-stopping after ${maxMs}ms\n`);
+                        stop();
+                    }, maxMs);
+                }
+            });
+            process.exit(0);
+        }
+        catch (error) {
+            process.stderr.write(`harness board serve: ${error.message}\n`);
+            process.exit(2);
+        }
+    }
+    process.exit(boardCommand(process.argv.slice(3)));
+}
+if (cmd === "calibrate") {
+    process.exit(calibrateCommand(process.argv.slice(3)));
+}
+if (cmd === "digest") {
+    process.exit(digestCommand(process.argv.slice(3)));
+}
+if (cmd === "claim") {
+    process.exit(claimCommand(process.argv.slice(3)));
+}
+if (cmd === "heartbeat") {
+    process.exit(heartbeatCommand(process.argv.slice(3)));
+}
+if (cmd === "gate") {
+    const code = gateCommand(process.argv.slice(3));
+    if (code !== undefined)
+        process.exit(code);
+    // fall through: a bare `harness gate <name>` (not --pre) is still a skeleton
+}
+process.stderr.write(`harness ${cmd}: not implemented (skeleton)\n`);
+process.exit(1);
+//# sourceMappingURL=cli.js.map

package/dist/internal/system/corpus/replay.js

@@ -0,0 +1,79 @@
+/**
+ * Corpus replay — compiled so subprocess validation does not need a TypeScript
+ * loader. Every active fixture must still be blocked; a reopened fixture fails
+ * the build even when its detector would block it again.
+ */
+import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as parseYaml } from "yaml";
+import { checkSpecs } from "../spec/index.js";
+import { scopeCross, suppressionDelta, testWeakening, } from "../gates/detectors.js";
+function detectorBlocks(f) {
+    const input = f.replay.input;
+    switch (f.replay.kind) {
+        case "spec": {
+            const dir = mkdtempSync(join(tmpdir(), "corpus-spec-"));
+            try {
+                writeFileSync(join(dir, "s.yaml"), JSON.stringify(input.spec));
+                return checkSpecs(dir).some((finding) => finding.level === "error");
+            }
+            finally {
+                rmSync(dir, { recursive: true, force: true });
+            }
+        }
+        case "suppression":
+            return suppressionDelta(String(input.before ?? ""), String(input.after ?? "")).length > 0;
+        case "scope":
+            return scopeCross(input.changed ?? [], input.scope ?? []).length > 0;
+        case "test-weakening":
+            return testWeakening({
+                changed: input.changed ?? [],
+                assertionsRemoved: input.assertionsRemoved ?? {},
+            }).length > 0;
+        default:
+            throw new Error(`unknown replay kind: ${f.replay.kind}`);
+    }
+}
+export function replayCorpus(fixturesDir) {
+    let failures = 0;
+    const lines = [];
+    const ids = readdirSync(fixturesDir).sort();
+    for (const id of ids) {
+        const fixture = parseYaml(readFileSync(join(fixturesDir, id, "fixture.yaml"), "utf8"));
+        if (fixture.status === "reopened") {
+            lines.push(`✗ ${fixture.id} — REOPENED (a recurred escape is unfinished work)`);
+            failures++;
+            continue;
+        }
+        const blocked = detectorBlocks(fixture);
+        if (blocked === fixture.replay.expect_block) {
+            lines.push(`✓ ${fixture.id} — ${fixture.must_block.gate} blocks as expected`);
+        }
+        else {
+            lines.push(`✗ ${fixture.id} — REGRESSION: expected block=${fixture.replay.expect_block}, got ${blocked}`);
+            failures++;
+        }
+    }
+    lines.push(`\n${ids.length - failures}/${ids.length} fixtures pass`);
+    return { total: ids.length, failures, lines };
+}
+export function corpusReplayCommand(args) {
+    const i = args.indexOf("--dir");
+    const fixturesDir = i >= 0 && args[i + 1]
+        ? args[i + 1]
+        : fileURLToPath(new URL("../../corpus/fixtures/", import.meta.url));
+    const result = replayCorpus(fixturesDir);
+    for (const line of result.lines) {
+        const stream = line.startsWith("✗") ? process.stderr : process.stdout;
+        stream.write(line + "\n");
+    }
+    return result.failures === 0 ? 0 : 1;
+}
+const invokedDirectly = process.argv[1] &&
+    fileURLToPath(import.meta.url).toLowerCase() ===
+        resolve(process.argv[1]).toLowerCase();
+if (invokedDirectly)
+    process.exit(corpusReplayCommand(process.argv.slice(2)));
+//# sourceMappingURL=replay.js.map

package/dist/internal/system/digest/cli.js

@@ -0,0 +1,23 @@
+/**
+ * `harness digest` — render the weekly operator digest from the ledger.
+ *
+ *   harness digest [--ledger <dir>] [--window 7] [--out digest.html] [--json]
+ */
+import { writeFileSync } from "node:fs";
+import { buildDigestFromLedger, renderDigestHtml } from "./index.js";
+function flag(args, name) {
+    const i = args.indexOf(`--${name}`);
+    return i >= 0 && args[i + 1] ? args[i + 1] : undefined;
+}
+export function digestCommand(args) {
+    const d = buildDigestFromLedger(flag(args, "ledger") ?? ".harness/ledger", Date.now(), Number(flag(args, "window") ?? 7));
+    if (args.includes("--json")) {
+        process.stdout.write(JSON.stringify(d, null, 2) + "\n");
+        return 0;
+    }
+    const out = flag(args, "out") ?? "digest.html";
+    writeFileSync(out, renderDigestHtml(d));
+    process.stdout.write(`wrote ${out} — ${d.newFixtures.length} new fixture(s), ${d.approvedThenEscaped.length} approved-then-escaped, ${d.routeDrift.length} drift flag(s)\n`);
+    return 0;
+}
+//# sourceMappingURL=cli.js.map

package/dist/internal/system/digest/index.js

@@ -0,0 +1,145 @@
+/**
+ * digest — the weekly operator digest (solution design §9.2). Records must
+ * teach, not just render: this composes a page from
+ *   - new fixtures + their failure-class taxonomy
+ *   - your door decisions vs outcomes (anything you approved that later escaped?)
+ *   - route drift (eval catch rate falling across a model rev)
+ *   - one spec-wording suggestion traced from an escape back to the unit it hit
+ */
+import { read as ledgerRead } from "../ledger/index.js";
+function inWindow(e, now, windowDays) {
+    return Date.parse(e.ts) >= now - windowDays * 24 * 60 * 60 * 1000;
+}
+export function buildDigest(events, now = Date.now(), windowDays = 7) {
+    const win = events.filter((e) => inWindow(e, now, windowDays));
+    // 1. new fixtures + taxonomy
+    const newFixtures = [];
+    const failureTaxonomy = {};
+    for (const e of win) {
+        if (e.type !== "fixture.added")
+            continue;
+        const b = e.body;
+        const klass = b.klass ?? b.escape_class ?? "unclassified";
+        newFixtures.push({ id: b.id ?? "?", klass });
+        failureTaxonomy[klass] = (failureTaxonomy[klass] ?? 0) + 1;
+    }
+    // 2. approved-then-escaped: a door approved for a unit, then an escape naming it
+    const approvedUnits = new Map(); // unit → door id
+    for (const e of events) {
+        if (e.type !== "door.decided")
+            continue;
+        const b = e.body;
+        if (b.verdict === "approved" && b.unit_id)
+            approvedUnits.set(b.unit_id, b.door_id ?? "?");
+    }
+    const approvedThenEscaped = [];
+    for (const e of win) {
+        if (e.type !== "escape.routed" && e.type !== "escape.detected")
+            continue;
+        const b = e.body;
+        for (const [unit, door] of approvedUnits) {
+            const bareUnit = unit.includes("#")
+                ? unit.slice(unit.indexOf("#") + 1)
+                : unit;
+            if ((b.new_unit ?? "").includes(bareUnit) || (b.unit_id ?? "") === unit) {
+                approvedThenEscaped.push({ unit, door, escape: b.scenario ?? "?" });
+            }
+        }
+    }
+    // 3. route drift — consecutive eval.run for one route with a falling catch rate
+    const byRoute = new Map();
+    for (const e of events) {
+        if (e.type !== "eval.run")
+            continue;
+        const b = e.body;
+        if (!b.route || typeof b.catch_rate !== "number")
+            continue;
+        if (!byRoute.has(b.route))
+            byRoute.set(b.route, []);
+        byRoute.get(b.route).push(b.catch_rate);
+    }
+    const routeDrift = [];
+    for (const [route, rates] of byRoute) {
+        for (let i = 1; i < rates.length; i++) {
+            const delta = Number((rates[i] - rates[i - 1]).toFixed(3));
+            if (delta <= -0.09)
+                routeDrift.push({ route, from: rates[i - 1], to: rates[i], delta });
+        }
+    }
+    // 4. one spec-wording suggestion traced from an escape
+    let specSuggestion = null;
+    for (const e of win) {
+        if (e.type !== "escape.routed")
+            continue;
+        const b = e.body;
+        const detected = win.find((x) => x.type === "escape.detected" &&
+            x.body.scenario === b.scenario);
+        const ctx = detected?.body?.context;
+        specSuggestion =
+            `Escape "${b.scenario}" hit ${b.owner ?? "a component"} → its next spec should state the behaviour that was missing` +
+                (ctx ? `: "${ctx}"` : ". Add a falsifiable acceptance criterion for it.");
+        break;
+    }
+    // 5. process cost per unit — from run.analyzed (P3)
+    const processCost = [];
+    for (const e of win) {
+        if (e.type !== "run.analyzed")
+            continue;
+        const b = e.body;
+        for (const u of b.units ?? []) {
+            processCost.push({
+                unit: u.unit_id ?? "",
+                turnsTotal: u.turns_total ?? 0,
+                wallMs: u.wall_ms ?? 0,
+                costUsd: typeof u.cost_usd === "number" ? u.cost_usd : null,
+                runId: b.run_id ?? "",
+            });
+        }
+    }
+    return {
+        windowDays,
+        generatedAt: new Date(now).toISOString(),
+        newFixtures,
+        failureTaxonomy,
+        approvedThenEscaped,
+        routeDrift,
+        specSuggestion,
+        processCost,
+    };
+}
+export function buildDigestFromLedger(ledgerDir, now, windowDays) {
+    return buildDigest(ledgerRead(ledgerDir), now, windowDays);
+}
+export function renderDigestHtml(d) {
+    const json = JSON.stringify(d, null, 2).replace(/</g, "\\u003c");
+    const section = (title, body) => `<section><h2>${title}</h2>${body}</section>`;
+    const list = (xs) => xs.length
+        ? `<ul>${xs.map((x) => `<li>${x}</li>`).join("")}</ul>`
+        : `<p class="empty">nothing this week</p>`;
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Operator digest</title>
+<style>
+  :root{color-scheme:light dark}
+  body{font:15px/1.6 ui-sans-serif,system-ui,sans-serif;max-width:760px;margin:40px auto;padding:0 20px;background:#0e1216;color:#e5e9ee}
+  h1{font-size:1.4rem} h2{font-size:.95rem;letter-spacing:.04em;text-transform:uppercase;color:#9aa4b1;margin:26px 0 8px}
+  .empty{color:#6b7583;font-style:italic} code{font-family:ui-monospace,monospace;color:#5bb8d4}
+  .suggest{border-left:3px solid #5bb8d4;background:#16333d;padding:10px 14px;border-radius:0 8px 8px 0}
+</style></head>
+<body>
+<h1>Operator digest — last ${d.windowDays} days</h1>
+<p style="color:#9aa4b1">generated ${d.generatedAt}</p>
+${section("New fixtures + failure taxonomy", list(d.newFixtures.map((f) => `<code>${f.id}</code> — ${f.klass}`)) +
+        (Object.keys(d.failureTaxonomy).length
+            ? `<p>${Object.entries(d.failureTaxonomy)
+                .map(([k, n]) => `${k}×${n}`)
+                .join(" · ")}</p>`
+            : ""))}
+${section("Door decisions vs outcomes", list(d.approvedThenEscaped.map((a) => `approved <code>${a.door}</code> for <code>${a.unit}</code> → later escaped via <code>${a.escape}</code>`)))}
+${section("Route drift", list(d.routeDrift.map((r) => `<code>${r.route}</code>: ${r.from} → ${r.to} (${r.delta})`)))}
+${section("Spec-wording suggestion", d.specSuggestion ? `<div class="suggest">${d.specSuggestion}</div>` : `<p class="empty">no escape to trace this week</p>`)}
+${section("Process cost per unit", list(d.processCost.map((p) => `<code>${p.unit}</code> — ${p.turnsTotal} turns, ${p.wallMs}ms${p.costUsd != null ? `, $${p.costUsd.toFixed(2)}` : ""} (run <code>${p.runId}</code>)`)))}
+<script type="application/json" id="data">${json}</script>
+</body></html>
+`;
+}
+//# sourceMappingURL=index.js.map

package/dist/internal/system/doors/classify.js

@@ -0,0 +1,94 @@
+/**
+ * doors/classify — a merge is routed to a door CLASS by data only. Nothing here
+ * is hardcoded policy: the always-human classes come from
+ * schema/decision-classes.yaml and the routing rules from system.toml's
+ * `[[door_class]]` (Contract C, solution design §6.3).
+ *
+ * Output: the classes that fired, and whether an operator decision is required
+ * (any `human_required` class, or a `one-way` / `propose-only` routing).
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { parse as parseYaml } from "yaml";
+import { packageSchemaDir } from "../assets.js";
+function decisionClassesPath() {
+    return join(packageSchemaDir(), "decision-classes.yaml");
+}
+let _dc;
+function decisionClasses() {
+    _dc ??= parseYaml(readFileSync(decisionClassesPath(), "utf8"));
+    return _dc;
+}
+/** system.toml `[[door_class]]` entries, if a path is given. */
+function systemDoorClasses(systemTomlPath) {
+    if (!systemTomlPath)
+        return [];
+    const raw = parseToml(readFileSync(systemTomlPath, "utf8"));
+    return raw.door_class ?? [];
+}
+const HUMAN_FACT = {
+    "one-way-door": (f) => f.unitDoor === undefined || f.unitDoor === "one-way",
+    "new-dependency": (f) => f.addsDependency === true,
+    "schema-or-api-change": (f) => f.touchesSchemaOrApi === true,
+    "security-touching": (f) => f.touchesSecurity === true,
+};
+const DOOR_FACT = {
+    "gate:external": (f) => f.gateExternal === true,
+    "artifact-producer-change": (f) => f.artifactProducerChange === true,
+    "new-dependency": (f) => f.addsDependency === true,
+    "schema-or-api-change": (f) => f.touchesSchemaOrApi === true,
+    "security-touching": (f) => f.touchesSecurity === true,
+};
+function doorMatches(match, f) {
+    if (match.startsWith("component:"))
+        return f.component === match.slice("component:".length);
+    if (match.startsWith("mode:"))
+        return f.mode === match.slice("mode:".length);
+    return DOOR_FACT[match]?.(f) ?? false;
+}
+export function classifyMerge(facts, systemTomlPath) {
+    const dc = decisionClasses();
+    const fired = [];
+    for (const c of dc.human_required ?? []) {
+        if (HUMAN_FACT[c.id]?.(facts))
+            fired.push({ match: c.id, class: "one-way", source: "human_required" });
+    }
+    for (const c of dc.system_scope ?? []) {
+        // system_scope conditions are described in prose; only infra-apply is fact-checkable here
+        if (c.id === "infra-apply" && facts.gateExternal) {
+            fired.push({
+                match: c.id,
+                class: c.door ?? "one-way",
+                source: "system_scope",
+            });
+        }
+    }
+    for (const dcls of systemDoorClasses(systemTomlPath)) {
+        if (doorMatches(dcls.match, facts)) {
+            fired.push({
+                match: dcls.match,
+                class: dcls.class,
+                source: "door_class",
+                ...(dcls.until ? { until: dcls.until } : {}),
+            });
+        }
+    }
+    if (facts.mode === "propose-only") {
+        fired.push({
+            match: `mode:propose-only`,
+            class: "propose-only",
+            source: "component_mode",
+        });
+    }
+    const requiresHuman = fired.some((f) => f.class === "one-way" || f.class === "propose-only");
+    return {
+        fired,
+        requiresHuman,
+        antiRubberStamp: {
+            approvalRateThreshold: dc.anti_rubber_stamp?.approval_rate_threshold ?? 0.95,
+            minDeliberationSeconds: dc.anti_rubber_stamp?.min_deliberation_seconds ?? 30,
+        },
+    };
+}
+//# sourceMappingURL=classify.js.map