@miller-tech/uap 2.11.1 → 2.16.2

package/dist/delivery/adversarial-gate.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Adversarial Red-Team Gate — HLG master architecture, stage 5
+ * (docs/plans/hlg-master-architecture-uplift-2026-09-24.md).
+ *
+ * When a deliver run has converged (all gates green) and BEFORE the verdict
+ * is accepted, a skeptical verifier attacks the patch: it writes edge-case
+ * tests designed to BREAK the change. If any fail, the run routes back into
+ * the convergence loop with that failure as ordinary gate evidence; only a
+ * patch that survives proceeds to acceptance (and gate evidence).
+ *
+ * This module is the STAGE DRIVER: settings resolution, the bounded round
+ * loop, breach → re-convergence orchestration, and the repair/rollback
+ * rails. The single-round machinery (attack authoring, sanctioning, suite
+ * execution, verdicts) lives in adversarial-attack.ts — the split keeps
+ * both files under the 500-LOC quality-gate threshold, along the seam the
+ * architecture review suggested. This module RE-EXPORTS the attack module's
+ * public surface so existing imports from './adversarial-gate.js' keep
+ * working.
+ *
+ *  - BOUNDED: at most `maxRounds` attacks per run (default 2). A breach
+ *    consumes a round and re-enters the convergence loop; the breaching
+ *    tests REMAIN in the tree, so the repaired state has already survived
+ *    that attack — the next round, if budget remains, attacks with FRESH
+ *    tests rather than re-running the old ones forever.
+ *
+ * ACCEPTED RESIDUAL (C-stage review, 2026-09-24): authored tests execute
+ * with HOST FILESYSTEM privileges — sanitized-env strips environment
+ * variables but does NOT stop file-based credential reads (~/.aws, ~/.ssh,
+ * /etc) from inside a running test; and the repo content quoted into the
+ * attack prompt is an INDIRECT PROMPT-INJECTION channel into the authoring
+ * model. The additive oracle channel plus lexical+symlink path containment
+ * bound what an attack may WRITE and never weaken; what it can READ at
+ * runtime is everything the host user can read. This stage therefore runs
+ * only on the operator's own deliver run, never on untrusted input.
+ */
+import type { DeliveryResult, LoopExecutor } from './convergence-loop.js';
+import type { GateRung } from './verifier-ladder.js';
+import { type AdversarialRoundResult, type AdversarialStatus, type SuiteRunner } from './adversarial-attack.js';
+export { attackSurface, breachReconvergencePrompt, buildAttackPrompt, pickTestRung, runAdversarialRound, type AdversarialAttackFile, type AdversarialRoundOptions, type AdversarialRoundResult, type AdversarialStatus, type SuiteRun, type SuiteRunner, } from './adversarial-attack.js';
+export { sanctionAttackBlocks, type SanctionedWrite } from './adversarial-sanction.js';
+/** Default attacks per converged run; each breach re-enters the loop once. */
+export declare const DEFAULT_ADVERSARIAL_ROUNDS = 2;
+/** Hard ceiling — the stage must never become the loop it exists to bound. */
+export declare const MAX_ADVERSARIAL_ROUNDS = 4;
+/** Resolved on/off + round budget for the stage. */
+export interface AdversarialGateSettings {
+    enabled: boolean;
+    maxRounds: number;
+}
+/**
+ * Resolve the adversarial gate's effective settings.
+ *
+ * Precedence mirrors `resolveParallelTasks` (task-workspace.ts): the
+ * `UAP_DELIVER_ADVERSARIAL_GATE` env var > `.uap.json` `deliver.adversarialGate`
+ * > the default. The stage is DEFAULT ON; `0`/`off`/`false` at either layer
+ * disables it. A positive integer at either layer retunes the round budget
+ * (clamped to [1, MAX_ADVERSARIAL_ROUNDS]); any other truthy value keeps the
+ * default budget — a typo must never silently disable a safety gate, and the
+ * documented off switch is unambiguous.
+ */
+export declare function resolveAdversarialGate(raw: unknown, env?: NodeJS.ProcessEnv): AdversarialGateSettings;
+/** Options for the whole stage (bounded rounds + re-convergence). */
+export interface AdversarialGateOptions {
+    instruction: string;
+    projectRoot: string;
+    rungs: GateRung[];
+    executor: LoopExecutor;
+    settings: AdversarialGateSettings;
+    /** The converged result under attack. */
+    initial: DeliveryResult;
+    /**
+     * Re-enter the convergence loop with the breach as feedback. The breaching
+     * tests are already in the tree, so a successful re-convergence has made
+     * THEM pass too — the attack persists as ordinary gate evidence.
+     */
+    reconverge: (prompt: string) => Promise<DeliveryResult>;
+    runSuite?: SuiteRunner;
+    timeoutMs?: number;
+    /** Operator-facing progress lines. */
+    note?: (line: string) => void;
+    /**
+     * Re-derive the rung set AT GATE TIME. deliver.ts wires this to
+     * `mergeRedetectedRungs(rungs, detectRungs(projectRoot), …)` — the same
+     * policy the loop's mid-mission redetection uses — because the rungs this
+     * stage receives were detected at t0, and a mission that CREATED its own
+     * test gate (greenfield) would otherwise no-surface forever. A throwing
+     * detector falls back to `opts.rungs`.
+     */
+    redetectRungs?: () => GateRung[];
+    /**
+     * Called with each breaching round BEFORE reconvergence, so the caller can
+     * extend the repair executor's protected set with the breaching test files
+     * (the t0 protection snapshot predates them). The post-repair verification
+     * below enforces the rule regardless; this is defense in depth.
+     */
+    onBreach?: (breach: AdversarialRoundResult) => void;
+}
+/** The stage's outcome, including the (possibly re-converged) final result. */
+export interface AdversarialGateReport {
+    status: AdversarialStatus | 'disabled';
+    rounds: AdversarialRoundResult[];
+    authored: number;
+    ran: number;
+    failed: number;
+    /** The state to accept (survived/no-surface) or reject (breached). */
+    result: DeliveryResult;
+    /** One-line outcome for telemetry / the gate-evidence artifact. */
+    summary: string;
+}
+/**
+ * The stage: attack the converged state up to `settings.maxRounds` times,
+ * routing breaches back into the convergence loop as ordinary gate evidence.
+ *
+ * Round-budget semantics: a breach CONSUMES a round and re-enters the loop.
+ * Because the breaching tests stay in the tree, the repaired state has already
+ * survived that attack — so exhausting the budget on a successful repair is an
+ * accept, not an open question. Only an UNREPAIRED breach rejects the run.
+ */
+export declare function runAdversarialGate(opts: AdversarialGateOptions): Promise<AdversarialGateReport>;
+//# sourceMappingURL=adversarial-gate.d.ts.map

package/dist/delivery/adversarial-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adversarial-gate.d.ts","sourceRoot":"","sources":["../../src/delivery/adversarial-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEvF,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,CAwBzB;AAED,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,yCAAyC;IACzC,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACrD;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,iBAAiB,GAAG,UAAU,CAAC;IACvC,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,cAAc,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AA+ED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+FrG"}

package/dist/delivery/adversarial-gate.js

@@ -0,0 +1,259 @@
+/**
+ * Adversarial Red-Team Gate — HLG master architecture, stage 5
+ * (docs/plans/hlg-master-architecture-uplift-2026-09-24.md).
+ *
+ * When a deliver run has converged (all gates green) and BEFORE the verdict
+ * is accepted, a skeptical verifier attacks the patch: it writes edge-case
+ * tests designed to BREAK the change. If any fail, the run routes back into
+ * the convergence loop with that failure as ordinary gate evidence; only a
+ * patch that survives proceeds to acceptance (and gate evidence).
+ *
+ * This module is the STAGE DRIVER: settings resolution, the bounded round
+ * loop, breach → re-convergence orchestration, and the repair/rollback
+ * rails. The single-round machinery (attack authoring, sanctioning, suite
+ * execution, verdicts) lives in adversarial-attack.ts — the split keeps
+ * both files under the 500-LOC quality-gate threshold, along the seam the
+ * architecture review suggested. This module RE-EXPORTS the attack module's
+ * public surface so existing imports from './adversarial-gate.js' keep
+ * working.
+ *
+ *  - BOUNDED: at most `maxRounds` attacks per run (default 2). A breach
+ *    consumes a round and re-enters the convergence loop; the breaching
+ *    tests REMAIN in the tree, so the repaired state has already survived
+ *    that attack — the next round, if budget remains, attacks with FRESH
+ *    tests rather than re-running the old ones forever.
+ *
+ * ACCEPTED RESIDUAL (C-stage review, 2026-09-24): authored tests execute
+ * with HOST FILESYSTEM privileges — sanitized-env strips environment
+ * variables but does NOT stop file-based credential reads (~/.aws, ~/.ssh,
+ * /etc) from inside a running test; and the repo content quoted into the
+ * attack prompt is an INDIRECT PROMPT-INJECTION channel into the authoring
+ * model. The additive oracle channel plus lexical+symlink path containment
+ * bound what an attack may WRITE and never weaken; what it can READ at
+ * runtime is everything the host user can read. This stage therefore runs
+ * only on the operator's own deliver run, never on untrusted input.
+ */
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { foldDeliveryResult } from './delivery-result.js';
+import { extractTestTitles } from './test-oracle-additive.js';
+import { breachReconvergencePrompt, runAdversarialRound, } from './adversarial-attack.js';
+// The attack + sanction modules' public surface, re-exported so consumers
+// (index.ts, tests) keep a single import site for the whole stage.
+export { attackSurface, breachReconvergencePrompt, buildAttackPrompt, pickTestRung, runAdversarialRound, } from './adversarial-attack.js';
+export { sanctionAttackBlocks } from './adversarial-sanction.js';
+/** Default attacks per converged run; each breach re-enters the loop once. */
+export const DEFAULT_ADVERSARIAL_ROUNDS = 2;
+/** Hard ceiling — the stage must never become the loop it exists to bound. */
+export const MAX_ADVERSARIAL_ROUNDS = 4;
+/**
+ * Resolve the adversarial gate's effective settings.
+ *
+ * Precedence mirrors `resolveParallelTasks` (task-workspace.ts): the
+ * `UAP_DELIVER_ADVERSARIAL_GATE` env var > `.uap.json` `deliver.adversarialGate`
+ * > the default. The stage is DEFAULT ON; `0`/`off`/`false` at either layer
+ * disables it. A positive integer at either layer retunes the round budget
+ * (clamped to [1, MAX_ADVERSARIAL_ROUNDS]); any other truthy value keeps the
+ * default budget — a typo must never silently disable a safety gate, and the
+ * documented off switch is unambiguous.
+ */
+export function resolveAdversarialGate(raw, env = process.env) {
+    const off = (v) => v === false || v === 0 || v === '0' || v === 'off';
+    const budget = (v) => {
+        // Boolean `true` means "on" (the flag form), not a round count —
+        // Number(true) === 1 would silently collapse the budget to one round
+        // while env 'true' keeps the default. Guard the TYPE, not the value.
+        if (typeof v === 'boolean')
+            return DEFAULT_ADVERSARIAL_ROUNDS;
+        const n = Number(v);
+        return Number.isFinite(n) && n > 0
+            ? Math.min(Math.floor(n), MAX_ADVERSARIAL_ROUNDS)
+            : DEFAULT_ADVERSARIAL_ROUNDS;
+    };
+    const fromEnv = env.UAP_DELIVER_ADVERSARIAL_GATE;
+    if (fromEnv !== undefined && fromEnv.trim() !== '') {
+        return off(fromEnv)
+            ? { enabled: false, maxRounds: 0 }
+            : { enabled: true, maxRounds: budget(fromEnv) };
+    }
+    if (raw === undefined || raw === null) {
+        return { enabled: true, maxRounds: DEFAULT_ADVERSARIAL_ROUNDS };
+    }
+    return off(raw)
+        ? { enabled: false, maxRounds: 0 }
+        : { enabled: true, maxRounds: budget(raw) };
+}
+/**
+ * Post-repair verification (C-stage review: vacuous breach repair). The
+ * reconvergence prompt's "never delete, skip, or weaken" rule is PROSE, and
+ * the repair executor's protected-files set was snapshotted at t0 — before
+ * the adversarial tests existed — so nothing structural stops a repair from
+ * deleting or gutting the very tests that pinned the breach. After a repair
+ * reports success, every breaching test file must still EXIST and still
+ * contain its authored titles; anything else is a failed repair, whatever
+ * the loop's gates say (a repair that removed the test trivially turns them
+ * green). Returns the per-file violations; empty means the attack survived
+ * the repair intact.
+ */
+function breachingTestsGutted(projectRoot, breach) {
+    const gutted = [];
+    for (const f of breach.attackFiles ?? []) {
+        const abs = join(projectRoot, f.rel);
+        let content = null;
+        try {
+            content = existsSync(abs) ? readFileSync(abs, 'utf-8') : null;
+        }
+        catch {
+            content = null;
+        }
+        if (content === null) {
+            gutted.push(`${f.rel}: breaching test file was deleted during repair`);
+            continue;
+        }
+        const present = new Set(extractTestTitles(content));
+        const missing = f.titles.filter((t) => !present.has(t));
+        if (missing.length > 0) {
+            gutted.push(`${f.rel}: ${missing.length} authored adversarial test(s) removed or renamed during repair (${missing
+                .slice(0, 2)
+                .join('; ')})`);
+        }
+    }
+    return gutted;
+}
+/**
+ * Terminal-breach rollback: a REJECTED run must not leave the user's suite
+ * red, so the breaching round's authored files come back OUT — created files
+ * removed, appended-to files restored to their pre-attack bytes. (The
+ * keep-best rollback rail settled BEFORE this stage runs, so this is the
+ * only rail left.) Survived and repaired rounds keep their tests: those
+ * pass, and are regression tests now. Best-effort, like rollbackWrites.
+ */
+function rollbackAttackFiles(projectRoot, round) {
+    const rolledBack = [];
+    for (const f of round.attackFiles ?? []) {
+        try {
+            if (f.prior === null)
+                rmSync(join(projectRoot, f.rel), { force: true });
+            else
+                writeFileSync(join(projectRoot, f.rel), f.prior, 'utf-8');
+            rolledBack.push(f.rel);
+        }
+        catch {
+            /* rollback is best-effort; the round notes carry the residue */
+        }
+    }
+    return rolledBack;
+}
+function summarize(status, rounds, totals) {
+    const counts = `${totals.authored} authored / ${totals.ran} ran / ${totals.failed} failed`;
+    if (status === 'disabled')
+        return 'adversarial gate: disabled';
+    if (status === 'survived') {
+        return `adversarial gate: patch survived ${rounds.length} round(s) (${counts})`;
+    }
+    if (status === 'no-surface') {
+        return `adversarial gate: no attack surface found after ${rounds.length} round(s) (${counts})`;
+    }
+    return `adversarial gate: patch BREACHED (${counts}) — re-convergence could not repair it`;
+}
+/**
+ * The stage: attack the converged state up to `settings.maxRounds` times,
+ * routing breaches back into the convergence loop as ordinary gate evidence.
+ *
+ * Round-budget semantics: a breach CONSUMES a round and re-enters the loop.
+ * Because the breaching tests stay in the tree, the repaired state has already
+ * survived that attack — so exhausting the budget on a successful repair is an
+ * accept, not an open question. Only an UNREPAIRED breach rejects the run.
+ */
+export async function runAdversarialGate(opts) {
+    const totals = { authored: 0, ran: 0, failed: 0 };
+    const base = (status, rounds, result) => ({
+        status,
+        rounds,
+        ...totals,
+        result,
+        summary: summarize(status, rounds, totals),
+    });
+    if (!opts.settings.enabled) {
+        return base('disabled', [], opts.initial);
+    }
+    const rounds = [];
+    let result = opts.initial;
+    for (let round = 1; round <= opts.settings.maxRounds; round++) {
+        // Gate-time redetection (C-stage review: stale t0 rungs): the rungs this
+        // stage was handed were detected at mission start, so a greenfield
+        // mission that CREATED its test gate would no-surface forever. Re-merge
+        // the fresh detection the way the loop's mid-mission redetection does.
+        let roundRungs = opts.rungs;
+        if (opts.redetectRungs) {
+            try {
+                roundRungs = opts.redetectRungs();
+            }
+            catch {
+                roundRungs = opts.rungs;
+            }
+        }
+        const filesApplied = [...new Set(result.history.flatMap((h) => h.filesApplied))];
+        const r = await runAdversarialRound({
+            instruction: opts.instruction,
+            projectRoot: opts.projectRoot,
+            filesApplied,
+            rungs: roundRungs,
+            executor: opts.executor,
+            round,
+            ...(opts.runSuite ? { runSuite: opts.runSuite } : {}),
+            ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
+        });
+        rounds.push(r);
+        totals.authored += r.authored;
+        totals.ran += r.ran;
+        totals.failed += r.failed;
+        opts.note?.(r.status === 'breached'
+            ? `🛡 adversarial round ${r.round}: BREACH — ${r.failed} adversarial test(s) failed; re-entering the loop`
+            : r.status === 'survived'
+                ? `🛡 adversarial round ${r.round}: survived — ${r.ran}/${r.authored} authored test(s) ran and passed`
+                : `🛡 adversarial round ${r.round}: no attack surface found (${r.feedback})`);
+        if (r.status !== 'breached') {
+            return base(r.status, rounds, result);
+        }
+        // Breach: let the caller extend the repair's protected set with the
+        // breaching test files (its t0 protection snapshot predates them), then
+        // feed the failure back into the convergence loop as ordinary evidence.
+        opts.onBreach?.(r);
+        const repaired = await opts.reconverge(breachReconvergencePrompt(opts.instruction, r));
+        const merged = { ...result, history: [...result.history] };
+        foldDeliveryResult(merged, repaired);
+        merged.success = repaired.success;
+        merged.changedTree = Boolean(result.changedTree || repaired.changedTree);
+        if (!repaired.success) {
+            // TERMINAL breach: the run is rejected, and a rejected run must not
+            // leave the user's suite red — roll the round's authored files back.
+            const rolledBack = rollbackAttackFiles(opts.projectRoot, r);
+            r.notes.push(`terminal breach — authored adversarial test file(s) rolled back: ${rolledBack.join(', ') || 'none recorded'}`);
+            merged.finalFeedback =
+                `⛔ adversarial gate: the red team broke the patch and the repair loop did not converge.\n\n${repaired.finalFeedback}`;
+            return base('breached', rounds, merged);
+        }
+        // Vacuous-repair check: a "successful" repair that deleted or gutted the
+        // breaching tests did not fix anything — it removed the evidence. That
+        // is a failed repair, and the (terminal) breach rolls back as above.
+        const gutted = breachingTestsGutted(opts.projectRoot, r);
+        if (gutted.length > 0) {
+            const rolledBack = rollbackAttackFiles(opts.projectRoot, r);
+            r.notes.push(`repair gutted the breaching test(s) — repair REJECTED: ${gutted.join('; ')}`);
+            if (rolledBack.length > 0) {
+                r.notes.push(`terminal breach — authored adversarial test file(s) rolled back: ${rolledBack.join(', ')}`);
+            }
+            merged.success = false;
+            merged.finalFeedback =
+                '⛔ adversarial gate: the repair deleted or weakened the breaching adversarial tests instead of fixing the code.\n\n' +
+                    gutted.map((g) => `  ${g}`).join('\n');
+            return base('breached', rounds, merged);
+        }
+        result = merged;
+    }
+    // Budget exhausted on a repaired state: the breaching tests remained in the
+    // tree, so every repair already had to make them green — accept.
+    return base('survived', rounds, result);
+}
+//# sourceMappingURL=adversarial-gate.js.map

package/dist/delivery/adversarial-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adversarial-gate.js","sourceRoot":"","sources":["../../src/delivery/adversarial-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,mEAAmE;AACnE,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,GAOpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAwB,MAAM,2BAA2B,CAAC;AAEvF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAC5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAQxC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;IACxF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAU,EAAE;QACpC,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,0BAA0B,CAAC;QAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC;YACjD,CAAC,CAAC,0BAA0B,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;QAClC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAChD,CAAC;AAoDD;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,WAAmB,EAAE,MAA8B;IAC/E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,iDAAiD,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,mEAAmE,OAAO;iBAClG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,IAAI,CAAC,IAAI,CAAC,GAAG,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,WAAmB,EAAE,KAA6B;IAC7E,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;gBACnE,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/D,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAChB,MAAuC,EACvC,MAAgC,EAChC,MAAyD;IAEzD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,eAAe,MAAM,CAAC,GAAG,UAAU,MAAM,CAAC,MAAM,SAAS,CAAC;IAC3F,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,4BAA4B,CAAC;IAC/D,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,oCAAoC,MAAM,CAAC,MAAM,cAAc,MAAM,GAAG,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,OAAO,mDAAmD,MAAM,CAAC,MAAM,cAAc,MAAM,GAAG,CAAC;IACjG,CAAC;IACD,OAAO,qCAAqC,MAAM,wCAAwC,CAAC;AAC7F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA4B;IACnE,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,MAAuC,EAAE,MAAgC,EAAE,MAAsB,EAAyB,EAAE,CAAC,CAAC;QAC1I,MAAM;QACN,MAAM;QACN,GAAG,MAAM;QACT,MAAM;QACN,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY;YACZ,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;YACL,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CACT,CAAC,CAAC,MAAM,KAAK,UAAU;YACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,MAAM,mDAAmD;YAC1G,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU;gBACvB,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,kCAAkC;gBACtG,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,8BAA8B,CAAC,CAAC,QAAQ,GAAG,CACjF,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAED,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAmB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC,KAAK,CAAC,IAAI,CACV,oEAAoE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,CAC/G,CAAC;YACF,MAAM,CAAC,aAAa;gBAClB,6FAA6F,QAAQ,CAAC,aAAa,EAAE,CAAC;YACxH,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,0DAA0D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,oEAAoE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YACvB,MAAM,CAAC,aAAa;gBAClB,oHAAoH;oBACpH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,4EAA4E;IAC5E,iEAAiE;IACjE,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/delivery/adversarial-sanction.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Adversarial attack SANCTIONING — the containment boundary every
+ * model-authored red-team test crosses before it touches disk. Split from
+ * adversarial-attack.ts to keep each module of the adversarial stage under
+ * the 500-LOC quality-gate threshold; the round orchestration that calls
+ * these functions lives in adversarial-attack.ts, and the stage driver
+ * (adversarial-gate.ts) re-exports the public surface.
+ *
+ * The rule set (composition over invention — nothing here is new machinery,
+ * it is the existing additive oracle channel applied to attack writes):
+ *
+ *  - The red team may only ADD tests: NEW test files pass the delta rule
+ *    (no suppressors, no process.exit, no assert reassignment); appends to
+ *    existing test files pass the full additive rule (existing content
+ *    survives verbatim as a prefix).
+ *  - Paths are contained to the project root lexically AND through
+ *    symlinks (realParentEscapes — the same check the applier enforces on
+ *    every other write), capped in count and in BYTES (not UTF-16 units).
+ *  - Every refusal and every dropped surplus block is recorded in the
+ *    notes — the audit trail must distinguish "the model tried X and was
+ *    refused" from "the model never tried".
+ */
+import { type FileBlock } from './applier.js';
+/** At most this many model-authored test files per round. Exported: the
+ * attack prompt states the cap to the authoring model. */
+export declare const MAX_ATTACK_FILES = 3;
+export interface SanctionedWrite {
+    /** Repo-relative, '/'-separated. */
+    rel: string;
+    abs: string;
+    /** Pre-existing content (append case); null for a new file. */
+    prior: string | null;
+    /** Test-case titles this write adds. */
+    titles: string[];
+}
+/**
+ * Sanction model-authored blocks through the additive oracle channel. The red
+ * team may only ADD tests: new test files (suppressor/exit/assert-patch
+ * checks), or verbatim-prefix appends to existing ones (full additive rule).
+ */
+export declare function sanctionAttackBlocks(blocks: FileBlock[], projectRoot: string): {
+    writes: SanctionedWrite[];
+    notes: string[];
+};
+/** Materialize sanctioned writes; returns nothing (rollback via the writes). */
+export declare function applyWrites(writes: SanctionedWrite[], blocks: FileBlock[]): void;
+/**
+ * Undo this round's writes: remove files the round CREATED, restore files it
+ * appended to. Only ever touches paths sanctionAttackBlocks sanctioned.
+ */
+export declare function rollbackWrites(writes: SanctionedWrite[]): void;
+//# sourceMappingURL=adversarial-sanction.d.ts.map

package/dist/delivery/adversarial-sanction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adversarial-sanction.d.ts","sourceRoot":"","sources":["../../src/delivery/adversarial-sanction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAOjF;0DAC0D;AAC1D,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAIlC,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EAAE,EACnB,WAAW,EAAE,MAAM,GAClB;IAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAuEhD;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAMhF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAS9D"}

package/dist/delivery/adversarial-sanction.js

@@ -0,0 +1,134 @@
+/**
+ * Adversarial attack SANCTIONING — the containment boundary every
+ * model-authored red-team test crosses before it touches disk. Split from
+ * adversarial-attack.ts to keep each module of the adversarial stage under
+ * the 500-LOC quality-gate threshold; the round orchestration that calls
+ * these functions lives in adversarial-attack.ts, and the stage driver
+ * (adversarial-gate.ts) re-exports the public surface.
+ *
+ * The rule set (composition over invention — nothing here is new machinery,
+ * it is the existing additive oracle channel applied to attack writes):
+ *
+ *  - The red team may only ADD tests: NEW test files pass the delta rule
+ *    (no suppressors, no process.exit, no assert reassignment); appends to
+ *    existing test files pass the full additive rule (existing content
+ *    survives verbatim as a prefix).
+ *  - Paths are contained to the project root lexically AND through
+ *    symlinks (realParentEscapes — the same check the applier enforces on
+ *    every other write), capped in count and in BYTES (not UTF-16 units).
+ *  - Every refusal and every dropped surplus block is recorded in the
+ *    notes — the audit trail must distinguish "the model tried X and was
+ *    refused" from "the model never tried".
+ */
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'fs';
+import { dirname, isAbsolute, resolve, sep } from 'path';
+import { isTestFilePath, realParentEscapes } from './applier.js';
+import { additiveTestDeltaRefusal, additiveTestEditRefusal, extractTestTitles, } from './test-oracle-additive.js';
+/** At most this many model-authored test files per round. Exported: the
+ * attack prompt states the cap to the authoring model. */
+export const MAX_ATTACK_FILES = 3;
+/** Per-file content cap for authored tests (guards runaway generations). */
+const MAX_ATTACK_BYTES = 100_000;
+/**
+ * Sanction model-authored blocks through the additive oracle channel. The red
+ * team may only ADD tests: new test files (suppressor/exit/assert-patch
+ * checks), or verbatim-prefix appends to existing ones (full additive rule).
+ */
+export function sanctionAttackBlocks(blocks, projectRoot) {
+    const writes = [];
+    const notes = [];
+    const rootAbs = resolve(projectRoot);
+    // Symlink-followed root for the containment check — the lexical resolve
+    // alone lets a pre-existing symlink inside the repo redirect an attack-file
+    // write outside it (same rule the applier enforces on every other write).
+    let realRoot = rootAbs;
+    try {
+        realRoot = realpathSync(rootAbs);
+    }
+    catch {
+        /* root unreadable — fall back to the lexical root */
+    }
+    if (blocks.length > MAX_ATTACK_FILES) {
+        const dropped = blocks.slice(MAX_ATTACK_FILES).map((b) => b.path);
+        // Surplus blocks are REFUSED, not silently lost — the audit trail records
+        // exactly what the model tried to add beyond the cap.
+        notes.push(`dropped ${dropped.length} surplus attack block(s) beyond the ${MAX_ATTACK_FILES}-file cap: ${dropped.join(', ')}`);
+    }
+    for (const block of blocks.slice(0, MAX_ATTACK_FILES)) {
+        const rel = block.path.replace(/\\/g, '/').replace(/^\/+/, '');
+        const abs = resolve(rootAbs, rel);
+        if (isAbsolute(block.path) || (abs !== rootAbs && !abs.startsWith(rootAbs + sep))) {
+            notes.push(`refused ${block.path}: path escapes the project root`);
+            continue;
+        }
+        if (realParentEscapes(abs, realRoot)) {
+            notes.push(`refused ${rel}: a symlink in its parent path escapes the project root`);
+            continue;
+        }
+        if (!isTestFilePath(rel)) {
+            notes.push(`refused ${rel}: not a test file — the red team may only add tests`);
+            continue;
+        }
+        // Byte-accurate cap: a runaway generation of multibyte text must count
+        // the BYTES it would write, not UTF-16 code units.
+        if (Buffer.byteLength(block.content, 'utf-8') > MAX_ATTACK_BYTES) {
+            notes.push(`refused ${rel}: content exceeds ${MAX_ATTACK_BYTES} bytes`);
+            continue;
+        }
+        if (existsSync(abs)) {
+            const prior = readFileSync(abs, 'utf-8');
+            const refusal = additiveTestEditRefusal(prior, block.content);
+            if (refusal) {
+                notes.push(`refused ${rel}: append to an existing test file is not additive — ${refusal}`);
+                continue;
+            }
+            const priorTitles = new Set(extractTestTitles(prior));
+            const titles = extractTestTitles(block.content).filter((t) => !priorTitles.has(t));
+            if (titles.length === 0) {
+                notes.push(`refused ${rel}: the append adds no recognizable test cases`);
+                continue;
+            }
+            writes.push({ rel, abs, prior, titles });
+        }
+        else {
+            const refusal = additiveTestDeltaRefusal(block.content);
+            if (refusal) {
+                notes.push(`refused ${rel}: ${refusal}`);
+                continue;
+            }
+            const titles = extractTestTitles(block.content);
+            if (titles.length === 0) {
+                notes.push(`refused ${rel}: no recognizable test cases — nothing runnable to add`);
+                continue;
+            }
+            writes.push({ rel, abs, prior: null, titles });
+        }
+    }
+    return { writes, notes };
+}
+/** Materialize sanctioned writes; returns nothing (rollback via the writes). */
+export function applyWrites(writes, blocks) {
+    const contentByRel = new Map(blocks.map((b) => [b.path.replace(/\\/g, '/').replace(/^\/+/, ''), b.content]));
+    for (const w of writes) {
+        mkdirSync(dirname(w.abs), { recursive: true });
+        writeFileSync(w.abs, contentByRel.get(w.rel) ?? '', 'utf-8');
+    }
+}
+/**
+ * Undo this round's writes: remove files the round CREATED, restore files it
+ * appended to. Only ever touches paths sanctionAttackBlocks sanctioned.
+ */
+export function rollbackWrites(writes) {
+    for (const w of writes) {
+        try {
+            if (w.prior === null)
+                rmSync(w.abs, { force: true });
+            else
+                writeFileSync(w.abs, w.prior, 'utf-8');
+        }
+        catch {
+            /* rollback is best-effort; the notes carry the residue */
+        }
+    }
+}
+//# sourceMappingURL=adversarial-sanction.js.map

package/dist/delivery/adversarial-sanction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adversarial-sanction.js","sourceRoot":"","sources":["../../src/delivery/adversarial-sanction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAkB,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAEnC;0DAC0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAYjC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,WAAmB;IAEnB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrC,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,0EAA0E;QAC1E,sDAAsD;QACtD,KAAK,CAAC,IAAI,CACR,WAAW,OAAO,CAAC,MAAM,uCAAuC,gBAAgB,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;YAClF,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,yDAAyD,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,qDAAqD,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,gBAAgB,EAAE,CAAC;YACjE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,qBAAqB,gBAAgB,QAAQ,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,uDAAuD,OAAO,EAAE,CAAC,CAAC;gBAC3F,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,8CAA8C,CAAC,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,wDAAwD,CAAC,CAAC;gBACnF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAyB,EAAE,MAAmB;IACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7G,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;gBAChD,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;AACH,CAAC"}