@mmerterden/multi-agent-pipeline 20.34.0 → 20.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.34.0",
+  "version": "20.35.0",
   "description": "6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/agents/bulk-reader.md

@@ -33,6 +33,9 @@ number you report is a number the caller can open directly.
   restated as one region.
 - If you did not see the whole file, set `truncated: true`. Do not summarize a
   part as though it were the whole.
+- **A script reads the answer, not a person.** Return the JSON object and nothing
+  around it, and write `why` as a short phrase. Shorten the wording, never the
+  content: a negation, a number or a path stays exactly as found.
 
 ## Output Format
 

package/pipeline/commands/multi-agent/channels/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Multi-channel reporter  -  Jira/Confluence/Wiki/PR description/Board status. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbucket PR PUT, GitHub Projects v2 board status move. Phase 5 delegates to this skill; users can invoke post-hoc by Jira ID / PR URL / branch."
+description: "Multi-channel reporter  -  Jira/Confluence/Wiki/PR description/Board status. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbucket PR PUT, GitHub Projects v2 board status move. Use to post or redo a run's report; Phase 5 delegates here, or invoke by Jira ID / PR URL / branch."
 description-tr: "Çok kanallı raporlayıcı - Jira/Confluence/Wiki/PR açıklaması/Board durumu. Çoklu kanal + içerik seçimi, humanizer geçişi, reviewer'ı koruyan Bitbucket PR PUT, GitHub Projects v2 board durum taşıma. Faz 5 bu skill'e delege eder; Jira ID / PR URL / branch ile sonradan da çağrılabilir."
 argument-hint: '[Jira-id | PR-url | #N | Jira-url] [--channels pr,jira,confluence,wiki,board] [--content normal,technical,test,auto-diff,note,test-run] [--flow-run <runId>] [--message "..."] [--message-file path] [--board-status <key>] [--dry-run] [--append] [--ready]'
 parameters: [{"name":"target","kind":"text"},{"name":"--channels","kind":"enum","repeat":true,"enum":["pr","jira","confluence","wiki","board"]},{"name":"--content","kind":"enum","repeat":true,"enum":["normal","technical","test","auto-diff","note","test-run"]},{"name":"--flow-run","kind":"text"},{"name":"--message","kind":"text"},{"name":"--message-file","kind":"path"},{"name":"--board-status","kind":"text"},{"name":"--dry-run","kind":"flag"},{"name":"--append","kind":"flag"},{"name":"--ready","kind":"flag"}]

package/pipeline/commands/multi-agent/office-on/SKILL.md

@@ -46,6 +46,10 @@ fresh bearer token per start). This command and `office-off` /
   `task-mirror` hook that install registers for every run.
 - The panel's writes call the same scripts the terminal commands call; it adds
   no behaviour of its own.
-- The server listens on 127.0.0.1 only. Remote access is not part of this
-  installation; `office-status` says whether a separate remote layer is
-  present.
+- The server listens on 127.0.0.1 only. Remote access is off unless a phone
+  was paired: then `office-on` also starts `office-remote-client.mjs`, which
+  polls the relay over HTTPS (no inbound port) and stops with the server
+  (`features/office-remote-protocol.md`). `office-status` says whether a
+  device is paired. Pairing is the user's own step in their terminal, never
+  run from here: `! node ~/.claude/scripts/office-pair.mjs start`, then
+  `wait`, then `confirm <code the phone shows>`.

package/pipeline/commands/multi-agent/office-status/SKILL.md

@@ -18,8 +18,9 @@ node "$HOME/.claude/scripts/office-control.mjs" status --json
 Report in `outputLanguage`:
 
 - `running`, and when it is, `url` and `idleMinutes` (0 means it runs until `office-off`);
-- `remote`: "not available in this installation" unless a separate remote
-  layer is installed; report the line as given;
+- `remote`: "off" until a phone is paired with `office-pair.mjs`, "configured"
+  when only the prefs block is set, "paired" once a device is; report the line
+  as given;
 - `pairedDevices`: the devices the phone registry lists; revoking one is
   `phone-devices.mjs revoke`;
 - `recentActions`: the last writes taken through the server (route, step,

package/pipeline/contract/CHANGELOG.md

@@ -3,6 +3,15 @@
 Versions of the client contract (`manifest.json` `contractVersion`), separate
 from the package version. See `README.md` for what counts as minor and major.
 
+## 1.7.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/prs/reach` (`work-items.mjs reach`, local-only): for each open GitHub
+  pull request (at most 20), how many files in the repository's own code graph
+  depend on what it changes, widest first, with a reason when it cannot be
+  measured. Changed paths are never returned, only counts.
+
 ## 1.6.0
 
 Added. Nothing existing changes shape.

package/pipeline/contract/README.md

@@ -71,6 +71,7 @@ same bytes (`test/contract-parity.test.mjs`):
 | Post a review verdict (two steps) | `work-items.mjs verdict ID [--post]` | `POST /v1/runs/{id}/review-verdict` |
 | An issue's maturity | `work-items.mjs maturity KEY` | `GET /v1/issues/{key}/maturity` |
 | Open pull requests | `work-items.mjs prs` | `GET /v1/prs` |
+| How far each open pull request reaches in its repository's graph | `work-items.mjs reach` | `GET /v1/prs/reach` |
 | Toolkit MCP tools | `toolkit-tools.mjs list` | `GET /v1/tools` |
 | Call an allowed toolkit tool (read-only, no location argument) | `toolkit-tools.mjs call NAME JSON` | `POST /v1/tools/{name}/call` |
 | A Confluence page, a Crashlytics issue, a Figma frame | `service-read.mjs confluence\|crashlytics\|figma ...` | `GET /v1/services/{confluence,crashlytics,figma}` |

package/pipeline/contract/fixtures/error-invalid-request.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.6.0",
+  "contractVersion": "1.7.0",
   "error": "invalid-request",
   "message": "the launch request was refused",
   "errors": [

package/pipeline/contract/fixtures/error-unauthorized.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.6.0",
+  "contractVersion": "1.7.0",
   "error": "unauthorized",
   "message": "a bearer token is required"
 }

package/pipeline/contract/fixtures/error-unsigned.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.6.0",
+  "contractVersion": "1.7.0",
   "error": "unsigned",
   "message": "a device signature is required"
 }

package/pipeline/contract/manifest.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.6.0",
+  "contractVersion": "1.7.0",
   "supportedMajors": [1],
   "description": "The pipeline's client contract: every surface a client reads or writes, the CLI invocation and the HTTP route that carry it, and the schema its JSON follows. Schemas are not copied here; schemasDir points at the one tree the producers validate against. Paths in cli are relative to the pipeline directory (installed: ~/.claude).",
   "schemasDir": "../schemas",
@@ -100,6 +100,7 @@
     "run-evidence.schema.json",
     "issue-maturity.schema.json",
     "prs.schema.json",
+    "pr-reach.schema.json",
     "review-verdict-request.schema.json",
     "review-verdict.schema.json",
     "tools.schema.json",
@@ -745,6 +746,18 @@
       "remote": "read",
       "risk": "read"
     },
+    {
+      "id": "prs-reach",
+      "method": "GET",
+      "path": "/v1/prs/reach",
+      "query": [],
+      "cli": ["node", "scripts/work-items.mjs", "reach"],
+      "schema": "pr-reach.schema.json",
+      "version": "1.1.0",
+      "note": "Run as a child process so parsing a large graph never holds up other routes. At most 20 GitHub pull requests, three gh calls at a time, each with its account's token in GH_TOKEN. A repository with no graph under ~/.claude/knowledge/<repo name>/ is listed with its reason and costs no gh call.",
+      "remote": "local-only",
+      "risk": "read"
+    },
     {
       "id": "tools",
       "method": "GET",

package/pipeline/contract/types/index.d.ts

@@ -1,8 +1,8 @@
 // Generated by pipeline/contract/build.mjs from pipeline/schemas/*.schema.json.
 // Do not edit: change the schema and run `node pipeline/contract/build.mjs --write`.
 
-export type ContractVersion = "1.6.0";
-export type SurfaceId = "runs" | "run" | "commands" | "questions" | "issues" | "worktrees" | "launch-spec" | "repos" | "repo-add" | "repo-remove" | "launch" | "answer" | "run-log" | "resume" | "kill" | "gc" | "autopilot" | "autopilot-off" | "phone-runs" | "phone-run" | "phone-answer" | "phone-launch" | "autopilot-on" | "steer" | "activity" | "activity-stream" | "agent-chat" | "routines" | "routine-delete" | "jobs" | "job-start" | "stack" | "stack-set" | "ledger" | "system" | "prune-logs" | "settings" | "settings-set" | "credentials" | "memory" | "run-results" | "run-evidence" | "review-verdict" | "issue-maturity" | "prs" | "tools" | "tool-call" | "service-confluence" | "service-crashlytics" | "service-figma" | "permissions";
+export type ContractVersion = "1.7.0";
+export type SurfaceId = "runs" | "run" | "commands" | "questions" | "issues" | "worktrees" | "launch-spec" | "repos" | "repo-add" | "repo-remove" | "launch" | "answer" | "run-log" | "resume" | "kill" | "gc" | "autopilot" | "autopilot-off" | "phone-runs" | "phone-run" | "phone-answer" | "phone-launch" | "autopilot-on" | "steer" | "activity" | "activity-stream" | "agent-chat" | "routines" | "routine-delete" | "jobs" | "job-start" | "stack" | "stack-set" | "ledger" | "system" | "prune-logs" | "settings" | "settings-set" | "credentials" | "memory" | "run-results" | "run-evidence" | "review-verdict" | "issue-maturity" | "prs" | "prs-reach" | "tools" | "tool-call" | "service-confluence" | "service-crashlytics" | "service-figma" | "permissions";
 
 /** What `runs-index.mjs --json` prints: every run under the log root and the unattended log root (one record per task id), grouped per status/SKILL.md 3b. Fields are only ever added - a decoder ignores keys it does not know. `--redact` drops every x-sensitivity local field (and `logsRoot`) and scrubs the free text in the title, `now`, sub-step names, task subjects and the pending question. */
 export interface RunsIndex {
@@ -1202,6 +1202,28 @@ export interface Prs {
   }>;
 }
 
+/** What GET /v1/prs/reach returns (`work-items.mjs reach`): for each open GitHub pull request (at most 20), how many files in the repository's own code graph depend on what it changes, widest first. Changed paths serve only as keys into the local graph and are never returned. A pull request that cannot be measured carries reach null and its reason. */
+export interface PrReach {
+  contractVersion: string;
+  /** Reverse-dependency depth the count was taken at. */
+  depth: number;
+  items: Array<{
+    source: "github" | "bitbucket";
+    repo: string;
+    number: number;
+    /** The knowledge-folder project whose graph answered, or null. */
+    project: string | null;
+    /** Files the pull request changes. */
+    changed?: number;
+    /** Of those, files the graph knows. */
+    inGraph?: number;
+    /** Files that depend on the changed ones, within depth. Null when not measured. */
+    reach: number | null;
+    /** Why reach is null. */
+    reason?: string;
+  }>;
+}
+
 /** The body of POST /v1/runs/{id}/review-verdict: empty for the preview, confirmToken to post. The verdict is never chosen by the request; it follows from the review's recorded findings. */
 export interface ReviewVerdictRequest {
   contractVersion: string;

package/pipeline/lib/json-file-lock.mjs

@@ -18,9 +18,12 @@
 
 import {
   chmodSync,
+  closeSync,
+  fstatSync,
   linkSync,
   lstatSync,
   mkdirSync,
+  openSync,
   readFileSync,
   readlinkSync,
   realpathSync,
@@ -47,22 +50,70 @@ export class FileLockTimeout extends Error {
 
 const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
-function staleIdentity(lockPath, staleMs) {
-  let pid;
-  let st;
+/**
+ * The PID inside a lock file and that file's identity, read through one
+ * descriptor. Read by path twice, the PID can come from a lock that was
+ * released in between and the identity from the one acquired after it, which
+ * makes a live lock look like a dead holder's.
+ *
+ * @param {string} lockPath
+ * @returns {{pid: number, ino: number, mtimeMs: number} | null}
+ */
+export function readLockOwner(lockPath) {
+  let fd;
   try {
-    pid = parseInt(readFileSync(lockPath, "utf8").trim(), 10);
-    st = statSync(lockPath);
+    fd = openSync(lockPath, "r");
+    const st = fstatSync(fd);
+    const pid = parseInt(readFileSync(fd, "utf8").trim(), 10);
+    return { pid, ino: st.ino, mtimeMs: st.mtimeMs };
   } catch {
     return null;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
   }
-  const age = Date.now() - st.mtimeMs;
-  if (!Number.isInteger(pid) || pid <= 0) return age > staleMs ? st : null;
+}
+
+/**
+ * Remove the lock judged stale, and only that one. The lock is first moved to
+ * a name private to this process, so the file examined is the file removed; a
+ * live lock that took its place in the meantime is linked back as the same
+ * file, which its holder's release recognises by inode.
+ *
+ * @param {string} lockPath
+ * @param {{ino: number, mtimeMs: number}} judged
+ * @returns {boolean} true when the stale lock was removed
+ */
+export function reapLock(lockPath, judged) {
+  const reap = `${lockPath}.${process.pid}.reap`;
   try {
-    process.kill(pid, 0);
+    renameSync(lockPath, reap);
+  } catch {
+    return false;
+  }
+  const st = statSync(reap);
+  if (st.ino === judged.ino && st.mtimeMs === judged.mtimeMs) {
+    unlinkSync(reap);
+    return true;
+  }
+  try {
+    linkSync(reap, lockPath);
+  } catch {
+    /* a new holder already has the path; the displaced one keeps its inode */
+  }
+  unlinkSync(reap);
+  return false;
+}
+
+function staleIdentity(lockPath, staleMs) {
+  const owner = readLockOwner(lockPath);
+  if (!owner) return null;
+  const age = Date.now() - owner.mtimeMs;
+  if (!Number.isInteger(owner.pid) || owner.pid <= 0) return age > staleMs ? owner : null;
+  try {
+    process.kill(owner.pid, 0);
     return null;
   } catch (err) {
-    return err.code === "ESRCH" ? st : null;
+    return err.code === "ESRCH" ? owner : null;
   }
 }
 
@@ -82,12 +133,7 @@ function acquire(lockPath, timeoutMs, staleMs) {
     }
     const stale = staleIdentity(lockPath, staleMs);
     if (stale) {
-      try {
-        const now = statSync(lockPath);
-        if (now.ino === stale.ino && now.mtimeMs === stale.mtimeMs) unlinkSync(lockPath);
-      } catch {
-        /* gone already */
-      }
+      reapLock(lockPath, stale);
       continue;
     }
     if (Date.now() >= deadline) throw new FileLockTimeout(lockPath, timeoutMs);

package/pipeline/lib/office-remote.mjs

@@ -0,0 +1,228 @@
+/**
+ * office-remote.mjs  -  the machine side of the office remote layer
+ * (features/office-remote-protocol.md).
+ *
+ * - Keys: P-256 ECDH between the machine key and the phone's session key,
+ *   through HKDF-SHA-256 with the pairing id as salt, into one AES-256 key per
+ *   direction.
+ * - Frames: AES-256-GCM; the 12-byte nonce is a 4-byte direction tag and an
+ *   8-byte counter, so a frame opens only in its own direction and a counter
+ *   that does not exceed the last accepted one is refused as a replay.
+ * - Pairing: the phone's first message is sealed with a key that also mixes in
+ *   the one-time pairing secret from the QR code, so the relay cannot open it
+ *   even holding both public keys.
+ * - Comparison code: six digits from both public keys, the same on either end.
+ * - Passkey: a WebAuthn assertion checked against the paired credential key,
+ *   rp id, origin, the request-bound challenge, user verification and the sign
+ *   count.
+ *
+ * Zero runtime dependencies (ADR-0004): node:crypto only.
+ *
+ * @module pipeline/lib/office-remote
+ */
+
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  hkdfSync,
+  timingSafeEqual,
+  verify,
+} from "node:crypto";
+
+const DIRECTIONS = { "phone-to-machine": 1, "machine-to-phone": 2 };
+const INFO = "ma-office v1 ";
+const MAX_COUNTER = 2 ** 48;
+
+const b64u = (b) => Buffer.from(b).toString("base64url");
+const fromB64u = (s) => Buffer.from(String(s || ""), "base64url");
+const sha256 = (b) => createHash("sha256").update(b).digest();
+
+/** A new machine key pair: PKCS#8 PEM private key, base64url SPKI public key. */
+export function createMachineKeys() {
+  const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  return {
+    privatePem: privateKey.export({ type: "pkcs8", format: "pem" }),
+    publicKey: b64u(publicKey.export({ type: "spki", format: "der" })),
+  };
+}
+
+function shared(privatePem, peerPublic) {
+  return diffieHellman({
+    privateKey: createPrivateKey(privatePem),
+    publicKey: createPublicKey({ key: fromB64u(peerPublic), format: "der", type: "spki" }),
+  });
+}
+
+const derive = (ikm, pairingId, label) =>
+  Buffer.from(
+    hkdfSync("sha256", ikm, Buffer.from(String(pairingId)), Buffer.from(INFO + label), 32),
+  );
+
+/**
+ * The two AES keys of a pairing, from this end's point of view.
+ *
+ * @param {{privatePem: string, peerPublic: string, pairingId: string, role: "machine"|"phone"}} p
+ * @returns {{send: Buffer, recv: Buffer}}
+ */
+export function directionKeys({ privatePem, peerPublic, pairingId, role }) {
+  const ikm = shared(privatePem, peerPublic);
+  const p2m = derive(ikm, pairingId, "phone-to-machine");
+  const m2p = derive(ikm, pairingId, "machine-to-phone");
+  return role === "machine" ? { send: m2p, recv: p2m } : { send: p2m, recv: m2p };
+}
+
+function nonceFor(direction, counter) {
+  const tag = DIRECTIONS[direction];
+  if (!tag) throw new Error(`unknown direction ${direction}`);
+  if (!Number.isSafeInteger(counter) || counter < 1 || counter >= MAX_COUNTER) {
+    throw new Error("counter out of range");
+  }
+  const iv = Buffer.alloc(12);
+  iv.writeUInt32BE(tag, 0);
+  iv.writeUIntBE(counter, 6, 6);
+  return iv;
+}
+
+/** Seal a JSON value as one frame. */
+export function sealFrame(key, counter, direction, value) {
+  const iv = nonceFor(direction, counter);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  cipher.setAAD(Buffer.from(direction));
+  const body = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+  return { counter, ct: b64u(Buffer.concat([body, cipher.getAuthTag()])) };
+}
+
+/**
+ * Open one frame. Refuses a counter that does not exceed `lastCounter`, a
+ * frame for the other direction and any altered byte.
+ *
+ * @returns {{ok: true, value: unknown, counter: number} | {ok: false, reason: string}}
+ */
+export function openFrame(key, frame, direction, lastCounter) {
+  const counter = Number(frame?.counter);
+  if (!Number.isSafeInteger(counter) || counter <= Number(lastCounter || 0)) {
+    return { ok: false, reason: "counter did not grow (replay or reorder)" };
+  }
+  let iv;
+  try {
+    iv = nonceFor(direction, counter);
+  } catch (err) {
+    return { ok: false, reason: err.message };
+  }
+  const raw = fromB64u(frame?.ct);
+  if (raw.length < 17) return { ok: false, reason: "frame too short" };
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAAD(Buffer.from(direction));
+    decipher.setAuthTag(raw.subarray(raw.length - 16));
+    const text = Buffer.concat([
+      decipher.update(raw.subarray(0, raw.length - 16)),
+      decipher.final(),
+    ]);
+    return { ok: true, value: JSON.parse(text.toString("utf8")), counter };
+  } catch {
+    return { ok: false, reason: "frame did not authenticate" };
+  }
+}
+
+function pairingKey({ privatePem, peerPublic, secret, pairingId }) {
+  const ikm = Buffer.concat([shared(privatePem, peerPublic), fromB64u(secret)]);
+  return derive(ikm, pairingId, "pairing");
+}
+
+/** Seal the phone's pairing message (counter 1, phone to machine). */
+export function sealPairing({ privatePem, peerPublic, secret, pairingId, value }) {
+  return sealFrame(
+    pairingKey({ privatePem, peerPublic, secret, pairingId }),
+    1,
+    "phone-to-machine",
+    value,
+  );
+}
+
+/** Open the phone's pairing message with the machine key and the pairing secret. */
+export function openPairing({ privatePem, peerPublic, secret, pairingId, sealed }) {
+  try {
+    const key = pairingKey({ privatePem, peerPublic, secret, pairingId });
+    const r = openFrame(key, sealed, "phone-to-machine", 0);
+    return r.ok ? { ok: true, value: r.value } : r;
+  } catch {
+    return { ok: false, reason: "pairing message could not be opened" };
+  }
+}
+
+/** Six digits from two public keys, independent of their order. */
+export function comparisonCode(a, b) {
+  const [x, y] = [String(a), String(b)].sort();
+  const n = sha256(Buffer.from(`${INFO}compare\n${x}\n${y}`)).readUInt32BE(0) % 1_000_000;
+  return String(n).padStart(6, "0");
+}
+
+const sameBytes = (a, b) => a.length === b.length && timingSafeEqual(a, b);
+
+/**
+ * Check a WebAuthn assertion against the paired passkey.
+ *
+ * @param {object} p
+ * @param {{authenticatorData: string, clientDataJSON: string, signature: string}} p.assertion  base64url fields
+ * @param {string} p.credential   base64url SPKI of the passkey public key
+ * @param {string} p.rpId
+ * @param {string} p.origin
+ * @param {Buffer} p.challenge    the bytes this request binds (SHA-256 of its canonical signed text)
+ * @param {number} [p.prevSignCount]
+ * @returns {{ok: true, signCount: number} | {ok: false, reason: string}}
+ */
+export function verifyPasskey({
+  assertion,
+  credential,
+  rpId,
+  origin,
+  challenge,
+  prevSignCount = 0,
+}) {
+  const authData = fromB64u(assertion?.authenticatorData);
+  const clientRaw = fromB64u(assertion?.clientDataJSON);
+  if (authData.length < 37) return { ok: false, reason: "authenticator data too short" };
+  let client;
+  try {
+    client = JSON.parse(clientRaw.toString("utf8"));
+  } catch {
+    return { ok: false, reason: "client data is not JSON" };
+  }
+  if (client?.type !== "webauthn.get")
+    return { ok: false, reason: "client data type is not webauthn.get" };
+  if (!sameBytes(fromB64u(client.challenge), Buffer.from(challenge))) {
+    return { ok: false, reason: "challenge is not this request" };
+  }
+  if (client.origin !== origin) return { ok: false, reason: "origin is not the paired one" };
+  if (!sameBytes(authData.subarray(0, 32), sha256(Buffer.from(rpId)))) {
+    return { ok: false, reason: "rp id is not the paired one" };
+  }
+  const flags = authData[32];
+  if (!(flags & 0x01) || !(flags & 0x04))
+    return { ok: false, reason: "the user was not present and verified" };
+  const signCount = authData.readUInt32BE(33);
+  if ((signCount !== 0 || prevSignCount !== 0) && signCount <= prevSignCount) {
+    return { ok: false, reason: "sign count did not grow (a cloned authenticator or a replay)" };
+  }
+  let good;
+  try {
+    const key = createPublicKey({ key: fromB64u(credential), format: "der", type: "spki" });
+    good = verify(
+      "sha256",
+      Buffer.concat([authData, sha256(clientRaw)]),
+      key,
+      fromB64u(assertion.signature),
+    );
+  } catch {
+    good = false;
+  }
+  return good
+    ? { ok: true, signCount }
+    : { ok: false, reason: "signature does not verify with the paired passkey" };
+}