@mmnto/cli 1.114.0 → 1.115.0

package/dist/commands/doctor-seat-identity.d.ts

@@ -0,0 +1,71 @@
+/**
+ * `totem doctor` — the seat-identity-binding SENSE (mmnto-ai/totem#2511).
+ *
+ * Tenet 9/13: this row senses, it never enforces. It carries `gateExempt: true`
+ * and never emits `fail`, so no `--strict` tier can give it teeth — the
+ * exemption is a property of the row (`doctor.ts` DiagnosticResult), not of the
+ * tier a later change might widen.
+ *
+ * Three post-hoc contradictions are sensed per registered seat dir:
+ *
+ *   (a) `from-mismatch` — an outbox dispatch whose frontmatter `from:` names a
+ *       DIFFERENT seat than the directory it sits in. The dir is the
+ *       registration (the mmnto-ai/totem#2141 dirs-union invariant), so the two
+ *       disagreeing is an identity contradiction on its face.
+ *   (b) `writing-while-excluded` — a seat whose PARSED lifecycle marker says
+ *       `suspended`/`retired` yet whose outbox carries filename-stamped writes
+ *       newer than the marker's `since`: declared lifecycle contradicted by
+ *       observed behaviour.
+ *   (c) `env-names-excluded-seat` / `env-names-unknown-seat` — `TOTEM_SELF_AGENT`
+ *       naming a non-active seat, or naming no seat directory in this repo.
+ *
+ * A corrupt marker degrades to `active` by core's contract
+ * (`seat-lifecycle.ts` — fail open on visibility), so (b) is NEVER evaluated
+ * against it: this sense refuses to build a finding on an unparsed marker.
+ * The core warning (which names the marker file) is relayed instead, as its own
+ * `unreadable-marker` row — a scan hole disclosed rather than a clean line that
+ * hides it.
+ *
+ * THE HONEST LIMIT is stated in every verdict, pass included: a CONSISTENT fake
+ * defeats all three arms, and that is precisely why write-time binding was
+ * judged infeasible for v1 and this doctor tier is the chartered fallback.
+ *
+ * Core is dynamic-imported so `@mmnto/totem` stays off the CLI cold-start
+ * graph, matching every other doctor check.
+ */
+import type { DiagnosticResult } from './doctor.js';
+/** Row label, `padEnd(18)`-safe in the doctor render. */
+export declare const SEAT_IDENTITY_CHECK_NAME = "Seat Identity";
+/**
+ * Newest-N outbox files scanned per seat, by filename sort. Dispatch basenames
+ * are stamp-prefixed (`YYYY-MM-DDTHHMMZ-`), so the lexical tail IS the newest
+ * tail. A bound is required — cohort outboxes grow without limit and this row
+ * runs on every `totem doctor` — and whenever it bites, the verdict SAYS so
+ * (never a silently partial scan).
+ */
+export declare const OUTBOX_SCAN_LIMIT = 200;
+/**
+ * The verbatim limit clause. Exported so the test pins it against drift: the
+ * whole justification for shipping a doctor-tier sense instead of write-time
+ * binding rides on this sentence staying true and staying said.
+ */
+export declare const SEAT_IDENTITY_HONEST_LIMIT = "honest limit: a CONSISTENT fake \u2014 writing from the wrong seat dir with a matching forged `from:`, the agy shape \u2014 is NOT detectable post-hoc, which is why full write-time binding was judged infeasible for v1 and this doctor tier is the chartered fallback; this check does not discharge the 2026-06-18 seat-identity precondition.";
+/** The contradiction classes this row can report. */
+export type SeatIdentityFindingClass = 'from-mismatch' | 'writing-while-excluded' | 'env-names-excluded-seat' | 'env-names-unknown-seat' | 'unreadable-marker' | 'outbox-unreadable';
+export interface SeatIdentitySeams {
+    /**
+     * Test seam — production reads `process.env`. Injected so the env arm is
+     * exercisable without mutating real env state (the `resolveSelfAgents`
+     * convention).
+     */
+    env?: Record<string, string | undefined>;
+    /** Test seam — overrides {@link OUTBOX_SCAN_LIMIT} so truncation is testable. */
+    outboxScanLimit?: number;
+}
+/**
+ * Sense seat-identity binding across every registered seat dir. Report-only:
+ * `gateExempt: true` on every arm, `fail` on none, and an unexpected throw
+ * lands as a warn row rather than taking `totem doctor` down (Tenet 13).
+ */
+export declare function checkSeatIdentity(cwd: string, seams?: SeatIdentitySeams): Promise<DiagnosticResult>;
+//# sourceMappingURL=doctor-seat-identity.d.ts.map

package/dist/commands/doctor-seat-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-seat-identity.d.ts","sourceRoot":"","sources":["../../src/commands/doctor-seat-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,uVACqS,CAAC;AAwC7U,qDAAqD;AACrD,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,wBAAwB,GACxB,yBAAyB,GACzB,wBAAwB,GACxB,mBAAmB,GACnB,mBAAmB,CAAC;AAQxB,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAqHD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,iBAAsB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwL3B"}

package/dist/commands/doctor-seat-identity.js

@@ -0,0 +1,352 @@
+/**
+ * `totem doctor` — the seat-identity-binding SENSE (mmnto-ai/totem#2511).
+ *
+ * Tenet 9/13: this row senses, it never enforces. It carries `gateExempt: true`
+ * and never emits `fail`, so no `--strict` tier can give it teeth — the
+ * exemption is a property of the row (`doctor.ts` DiagnosticResult), not of the
+ * tier a later change might widen.
+ *
+ * Three post-hoc contradictions are sensed per registered seat dir:
+ *
+ *   (a) `from-mismatch` — an outbox dispatch whose frontmatter `from:` names a
+ *       DIFFERENT seat than the directory it sits in. The dir is the
+ *       registration (the mmnto-ai/totem#2141 dirs-union invariant), so the two
+ *       disagreeing is an identity contradiction on its face.
+ *   (b) `writing-while-excluded` — a seat whose PARSED lifecycle marker says
+ *       `suspended`/`retired` yet whose outbox carries filename-stamped writes
+ *       newer than the marker's `since`: declared lifecycle contradicted by
+ *       observed behaviour.
+ *   (c) `env-names-excluded-seat` / `env-names-unknown-seat` — `TOTEM_SELF_AGENT`
+ *       naming a non-active seat, or naming no seat directory in this repo.
+ *
+ * A corrupt marker degrades to `active` by core's contract
+ * (`seat-lifecycle.ts` — fail open on visibility), so (b) is NEVER evaluated
+ * against it: this sense refuses to build a finding on an unparsed marker.
+ * The core warning (which names the marker file) is relayed instead, as its own
+ * `unreadable-marker` row — a scan hole disclosed rather than a clean line that
+ * hides it.
+ *
+ * THE HONEST LIMIT is stated in every verdict, pass included: a CONSISTENT fake
+ * defeats all three arms, and that is precisely why write-time binding was
+ * judged infeasible for v1 and this doctor tier is the chartered fallback.
+ *
+ * Core is dynamic-imported so `@mmnto/totem` stays off the CLI cold-start
+ * graph, matching every other doctor check.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** Row label, `padEnd(18)`-safe in the doctor render. */
+export const SEAT_IDENTITY_CHECK_NAME = 'Seat Identity';
+/**
+ * Newest-N outbox files scanned per seat, by filename sort. Dispatch basenames
+ * are stamp-prefixed (`YYYY-MM-DDTHHMMZ-`), so the lexical tail IS the newest
+ * tail. A bound is required — cohort outboxes grow without limit and this row
+ * runs on every `totem doctor` — and whenever it bites, the verdict SAYS so
+ * (never a silently partial scan).
+ */
+export const OUTBOX_SCAN_LIMIT = 200;
+/**
+ * The verbatim limit clause. Exported so the test pins it against drift: the
+ * whole justification for shipping a doctor-tier sense instead of write-time
+ * binding rides on this sentence staying true and staying said.
+ */
+export const SEAT_IDENTITY_HONEST_LIMIT = 'honest limit: a CONSISTENT fake — writing from the wrong seat dir with a matching forged `from:`, the agy shape — is NOT detectable post-hoc, which is why full write-time binding was judged infeasible for v1 and this doctor tier is the chartered fallback; this check does not discharge the 2026-06-18 seat-identity precondition.';
+/**
+ * Bytes read from the head of each dispatch. Sized to the mail reader's own
+ * frontmatter search window (`mail.ts` MAX_HEADER_SEARCH_BYTES, 16 KiB, sized
+ * ~4x the largest observed live header) so this sensor sees exactly the header
+ * the mail reader sees — one wire, one reading.
+ */
+const HEAD_READ_BYTES = 16_384;
+/** Example filenames carried per finding before the remainder is summarized. */
+const MAX_EVIDENCE_FILES = 3;
+/** Rendered cap for a token that came off the wire (a `from:` value, an env id). */
+const MAX_TOKEN_CHARS = 120;
+/** Errnos that PROVE an outbox is absent rather than unreadable. */
+const OUTBOX_ABSENT_ERRNOS = new Set(['ENOENT', 'ENOTDIR']);
+const TOTEM_DIR = '.totem';
+const ORCHESTRATION_DIR = 'orchestration';
+const OUTBOX_DIR = 'outbox';
+/** The frontmatter opener every ADR-098 dispatch starts with. */
+const FRONTMATTER_OPENER = '---';
+/**
+ * Closing frontmatter delimiter — a `---` line after the opener (LF/CRLF/EOF),
+ * tolerating trailing whitespace. Copied in shape from `mail.ts` deliberately:
+ * a file the mail reader rejects as unparseable is not a dispatch whose `from:`
+ * binds anything, so both readers must agree on where the header ends.
+ */
+const CLOSING_DELIMITER = /\r?\n---[ \t]*(?:\r?\n|$)/;
+/** `from:` inside the delimited header only — a body line can never fabricate one. */
+const FROM_FIELD = /^from:\s*(.+)$/im;
+/** The stamped-dispatch basename prefix: `YYYY-MM-DDTHHMMZ-`. */
+const STAMPED_BASENAME = /^(\d{4})-(\d{2})-(\d{2})T(\d{2})(\d{2})Z-/;
+/** One-line, ANSI-stripped, length-capped rendering of an off-the-wire token. */
+function capToken(value) {
+    return value.length > MAX_TOKEN_CHARS ? `${value.slice(0, MAX_TOKEN_CHARS)}…` : value;
+}
+/** Message text for an unknown throwable (checkEstate's shape). */
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** Errno of a throwable, when it carries one. */
+function errnoOf(err) {
+    return err !== null && typeof err === 'object' && 'code' in err
+        ? err.code
+        : undefined;
+}
+/**
+ * Strip a single pair of matching surrounding quotes. `composeDispatch` leaves
+ * a valid kebab agent-id unquoted (`yamlScalar` quotes only when the raw value
+ * would mis-parse), but hand-authored dispatches quote freely, and an
+ * unquote-blind compare would read every quoted `from:` as a mismatch.
+ */
+function unquoteScalar(value) {
+    const trimmed = value.trim();
+    if (trimmed.length >= 2) {
+        const first = trimmed[0];
+        const last = trimmed[trimmed.length - 1];
+        if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+            return trimmed.slice(1, -1).trim();
+        }
+    }
+    return trimmed;
+}
+/**
+ * The `from:` value declared in a dispatch's frontmatter, or `null` when the
+ * file is not header-shaped or declares none. A missing `from:` is NOT a
+ * finding: the mail reader falls back to the outbox dir name, which is the
+ * binding this row is checking — absence agrees with the dir by construction.
+ */
+function frontmatterFrom(content) {
+    if (!content.startsWith(FRONTMATTER_OPENER))
+        return null;
+    const window = content.slice(FRONTMATTER_OPENER.length);
+    const close = CLOSING_DELIMITER.exec(window);
+    if (close === null)
+        return null;
+    const match = FROM_FIELD.exec(window.slice(0, close.index));
+    return match === null ? null : unquoteScalar(match[1]);
+}
+/**
+ * The UTC instant encoded in a stamped basename, or `null` when the name
+ * carries no stamp. Minute granularity is the wire's own resolution
+ * (`compactStamp`), so a write in the SAME minute as a transition compares as
+ * not-newer — the conservative direction for a sensor that must not invent
+ * contradictions.
+ */
+function stampedInstantMs(basename) {
+    const m = STAMPED_BASENAME.exec(basename);
+    if (m === null)
+        return null;
+    const ms = Date.parse(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:00.000Z`);
+    return Number.isNaN(ms) ? null : ms;
+}
+function listOutbox(outboxDir, limit) {
+    let entries;
+    // totem-context: intentional degradation — the catch IS the answer: ENOENT/ENOTDIR PROVE a seat has never written (the steady state of a fresh seat dir, silent by contract), and every other errno is a scan hole this row DISCLOSES as an outbox-unreadable finding rather than reporting a clean seat it never looked inside.
+    try {
+        entries = fs.readdirSync(outboxDir, { withFileTypes: true });
+        // totem-context: intentional degradation — see directive above the try; dual placement so the rule fires on either the catch-keyword line or the catch-body line.
+    }
+    catch (err) {
+        const code = errnoOf(err);
+        if (code !== undefined && OUTBOX_ABSENT_ERRNOS.has(code)) {
+            return { files: [], total: 0 };
+        }
+        return { files: [], total: 0, readFailure: messageOf(err) };
+    }
+    const all = entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.md'))
+        .map((entry) => entry.name)
+        .sort();
+    return { files: all.length > limit ? all.slice(all.length - limit) : all, total: all.length };
+}
+/** Read at most `HEAD_READ_BYTES` from the head of a file. */
+function readHead(filePath) {
+    const fd = fs.openSync(filePath, 'r');
+    try {
+        const buf = Buffer.alloc(HEAD_READ_BYTES);
+        const bytesRead = fs.readSync(fd, buf, 0, HEAD_READ_BYTES, 0);
+        return buf.toString('utf-8', 0, bytesRead);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** `N file(s): a, b, c (+M more)` — every count stated, nothing silently dropped. */
+function evidenceList(items) {
+    const shown = items.slice(0, MAX_EVIDENCE_FILES);
+    const more = items.length - shown.length;
+    const listed = more > 0 ? `${shown.join(', ')} (+${more} more)` : shown.join(', ');
+    return `${items.length} file(s): ${listed}`;
+}
+/**
+ * Sense seat-identity binding across every registered seat dir. Report-only:
+ * `gateExempt: true` on every arm, `fail` on none, and an unexpected throw
+ * lands as a warn row rather than taking `totem doctor` down (Tenet 13).
+ */
+export async function checkSeatIdentity(cwd, seams = {}) {
+    const name = SEAT_IDENTITY_CHECK_NAME;
+    const limit = seams.outboxScanLimit ?? OUTBOX_SCAN_LIMIT;
+    const env = seams.env ?? process.env;
+    // Sanitize-at-interpolation: `from:` values, env values, and errno text are
+    // all off-process bytes, and this row's message reaches the terminal
+    // unsanitized downstream. `sanitizeForTerminal` is core-owned and must not be
+    // imported statically here, so it is captured after the dynamic import; until
+    // then the fallback still FLATTENS (the line-forging vector) and only lacks
+    // the ANSI strip — a pre-import failure carries loader text, not wire bytes.
+    let sanitize = (text) => text;
+    const render = (text) => sanitize(text)
+        .replace(/[\t\n\r]+/g, ' ')
+        .replace(/ {2,}/g, ' ')
+        .trim();
+    // totem-context: a scan failure is reported as a warn row — the seat-identity sensor must never take `totem doctor` down with it (report-only, Tenet 13; the checkEstate precedent).
+    try {
+        const { deriveSeatStatuses, resolveTotemRepoRootSync, sanitizeForTerminal } = await import('@mmnto/totem');
+        sanitize = sanitizeForTerminal;
+        // The shared walk-start-is-not-the-root contract (`pollMail` / `eclGc` /
+        // `eclCompact`, mmnto-ai/totem#2312): a doctor run from a subdirectory must
+        // still resolve the real orchestration tree, or this row renders a
+        // false-clean "seats sensed: 0".
+        const repoRoot = resolveTotemRepoRootSync(undefined, cwd);
+        const statuses = deriveSeatStatuses(repoRoot);
+        const bySeat = new Map(statuses.map((status) => [status.seat, status]));
+        const findings = [];
+        const truncations = [];
+        for (const status of statuses) {
+            // A degraded marker read is a HOLE in this sense, not a clean seat: core
+            // fails open to `active`, so arm (b) cannot be evaluated here at all. Say
+            // so, with core's own warning (it names the marker file — the one-step
+            // recovery target).
+            if (status.warning !== undefined) {
+                findings.push({
+                    seat: status.seat,
+                    cls: 'unreadable-marker',
+                    evidence: render(status.warning),
+                });
+            }
+            const outboxDir = path.join(repoRoot, TOTEM_DIR, ORCHESTRATION_DIR, status.seat, OUTBOX_DIR);
+            const listing = listOutbox(outboxDir, limit);
+            if (listing.readFailure !== undefined) {
+                findings.push({
+                    seat: status.seat,
+                    cls: 'outbox-unreadable',
+                    evidence: render(listing.readFailure),
+                });
+                continue;
+            }
+            if (listing.total > listing.files.length) {
+                truncations.push(`${status.seat}: newest ${listing.files.length} of ${listing.total} outbox file(s) scanned`);
+            }
+            // Arm (b) arms ONLY on a successfully PARSED exclusion marker. A corrupt
+            // marker reads as `default-active` and is deliberately skipped here: this
+            // sense never builds a finding on an unparsed marker.
+            const excluded = status.source === 'marker' && (status.state === 'suspended' || status.state === 'retired');
+            const sinceMs = excluded && status.since !== undefined ? Date.parse(status.since) : Number.NaN;
+            const mismatched = [];
+            const postSince = [];
+            const unreadable = [];
+            for (const file of listing.files) {
+                if (!Number.isNaN(sinceMs)) {
+                    const stamped = stampedInstantMs(file);
+                    if (stamped !== null && stamped > sinceMs) {
+                        postSince.push(render(file));
+                    }
+                }
+                let head;
+                // totem-context: intentional degradation — a per-file read failure (mid-rename race, EACCES) is collected into an outbox-unreadable finding for this seat and the scan continues; dropping the file silently would let an unreadable dispatch read as a checked one.
+                try {
+                    head = readHead(path.join(outboxDir, file));
+                    // totem-context: intentional degradation — see directive above the try; dual placement so the rule fires on either the catch-keyword line or the catch-body line.
+                }
+                catch (err) {
+                    unreadable.push(`${render(file)} (${render(messageOf(err))})`);
+                    continue;
+                }
+                const declared = frontmatterFrom(head);
+                if (declared !== null && declared !== status.seat) {
+                    mismatched.push(`${render(file)} declares from: ${capToken(render(declared))}`);
+                }
+            }
+            if (mismatched.length > 0) {
+                findings.push({
+                    seat: status.seat,
+                    cls: 'from-mismatch',
+                    evidence: evidenceList(mismatched),
+                });
+            }
+            if (postSince.length > 0) {
+                findings.push({
+                    seat: status.seat,
+                    cls: 'writing-while-excluded',
+                    evidence: `${status.state} since ${render(status.since ?? 'unknown')} — ${evidenceList(postSince)} stamped after it`,
+                });
+            }
+            if (unreadable.length > 0) {
+                findings.push({
+                    seat: status.seat,
+                    cls: 'outbox-unreadable',
+                    evidence: evidenceList(unreadable),
+                });
+            }
+        }
+        // Arm (c). Same comma-split as `resolveSelfAgents`' env layer, and the same
+        // parsed-marker-only rule as arm (b): a corrupt marker reads active and
+        // earns no env finding.
+        const envRaw = env['TOTEM_SELF_AGENT'];
+        if (typeof envRaw === 'string' && envRaw.trim().length > 0) {
+            for (const named of envRaw
+                .split(',')
+                .map((entry) => entry.trim())
+                .filter((entry) => entry.length > 0)) {
+                const status = bySeat.get(named);
+                if (status === undefined) {
+                    findings.push({
+                        seat: capToken(render(named)),
+                        cls: 'env-names-unknown-seat',
+                        evidence: `TOTEM_SELF_AGENT names a seat with no directory under ${TOTEM_DIR}/${ORCHESTRATION_DIR}/ in this repo`,
+                    });
+                }
+                else if (status.source === 'marker' && status.state !== 'active') {
+                    findings.push({
+                        seat: status.seat,
+                        cls: 'env-names-excluded-seat',
+                        evidence: `TOTEM_SELF_AGENT names a ${status.state} seat (since ${render(status.since ?? 'unknown')})`,
+                    });
+                }
+            }
+        }
+        const parts = [`seats sensed: ${statuses.length}`];
+        parts.push(findings.length === 0
+            ? 'no identity contradictions sensed'
+            : `${findings.length} finding(s): ${findings
+                .map((f) => `${f.seat} [${f.cls}] ${f.evidence}`)
+                .join(' | ')}`);
+        if (truncations.length > 0) {
+            parts.push(`scan bounded at ${limit}/outbox — ${truncations.join('; ')}`);
+        }
+        parts.push(SEAT_IDENTITY_HONEST_LIMIT);
+        return {
+            name,
+            status: findings.length === 0 ? 'pass' : 'warn',
+            message: parts.join(' · '),
+            ...(findings.length > 0
+                ? {
+                    remediation: 'Inspect the named files and `totem seat list` — this row senses only and never gates.',
+                }
+                : {}),
+            gateExempt: true,
+        };
+        // totem-context: intentional degradation — see directive above the try; dual placement so the rule fires on either the catch-keyword line or the catch-body line.
+    }
+    catch (err) {
+        return {
+            name,
+            status: 'warn',
+            message: `Seat-identity scan failed: ${render(messageOf(err))} · ${SEAT_IDENTITY_HONEST_LIMIT}`,
+            remediation: 'Check .totem/orchestration/ readability, then re-run `totem doctor`.',
+            gateExempt: true,
+        };
+    }
+}
+//# sourceMappingURL=doctor-seat-identity.js.map

package/dist/commands/doctor-seat-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-seat-identity.js","sourceRoot":"","sources":["../../src/commands/doctor-seat-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAMlC,yDAAyD;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,0UAA0U,CAAC;AAE7U;;;;;GAKG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,oFAAoF;AACpF,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,oEAAoE;AACpE,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjF,MAAM,SAAS,GAAG,QAAQ,CAAC;AAC3B,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAEtD,sFAAsF;AACtF,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,2CAA2C,CAAC;AA4BrE,iFAAiF;AACjF,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACxF,CAAC;AAED,mEAAmE;AACnE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,iDAAiD;AACjD,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;QAC7D,CAAC,CAAE,GAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAYD,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAa;IAClD,IAAI,OAAoB,CAAC;IACzB,iUAAiU;IACjU,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,kKAAkK;IACpK,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO;SAChB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAChG,CAAC;AAED,8DAA8D;AAC9D,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,KAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,OAAO,GAAG,KAAK,CAAC,MAAM,aAAa,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,QAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,wBAAwB,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAErC,4EAA4E;IAC5E,qEAAqE;IACrE,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,QAAQ,GAA6B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,QAAQ,CAAC,IAAI,CAAC;SACX,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,IAAI,EAAE,CAAC;IAEZ,qLAAqL;IACrL,IAAI,CAAC;QACH,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GACzE,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/B,QAAQ,GAAG,mBAAmB,CAAC;QAE/B,yEAAyE;QACzE,4EAA4E;QAC5E,mEAAmE;QACnE,iCAAiC;QACjC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAiB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAqB,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAE5F,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,oBAAoB;YACpB,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,mBAAmB;oBACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,mBAAmB;oBACxB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;iBACtC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzC,WAAW,CAAC,IAAI,CACd,GAAG,MAAM,CAAC,IAAI,YAAY,OAAO,CAAC,KAAK,CAAC,MAAM,OAAO,OAAO,CAAC,KAAK,yBAAyB,CAC5F,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC7F,MAAM,OAAO,GACX,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAEjF,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;YAEhC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;oBACvC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;wBAC1C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,IAAI,IAAY,CAAC;gBACjB,qQAAqQ;gBACrQ,IAAI,CAAC;oBACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC5C,kKAAkK;gBACpK,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC/D,SAAS;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;oBAClD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,eAAe;oBACpB,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,wBAAwB;oBAC7B,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,mBAAmB;iBACrH,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,mBAAmB;oBACxB,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,wBAAwB;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,KAAK,IAAI,MAAM;iBACvB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAC7B,GAAG,EAAE,wBAAwB;wBAC7B,QAAQ,EAAE,yDAAyD,SAAS,IAAI,iBAAiB,gBAAgB;qBAClH,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnE,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,GAAG,EAAE,yBAAyB;wBAC9B,QAAQ,EAAE,4BAA4B,MAAM,CAAC,KAAK,gBAAgB,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,GAAG;qBACvG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,iBAAiB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,gBAAgB,QAAQ;iBACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;iBAChD,IAAI,CAAC,KAAK,CAAC,EAAE,CACrB,CAAC;QACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,aAAa,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAEvC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC/C,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC;oBACE,WAAW,EACT,uFAAuF;iBAC1F;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,kKAAkK;IACpK,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8BAA8B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,0BAA0B,EAAE;YAC/F,WAAW,EAAE,sEAAsE;YACnF,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/doctor-seat-identity.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Sense-tier contract for the seat-identity doctor row (mmnto-ai/totem#2511).
+ *
+ * Real temp trees, because every arm this row senses is literally a filesystem
+ * shape (a dir, a marker, a stamped basename). Fixture roots stay SHORT — the
+ * orchestration paths nest four levels deep before the dispatch basename, and
+ * MAX_PATH bites on win32.
+ *
+ * The two invariants asserted on EVERY arm: `gateExempt: true` and never
+ * `fail`. A sense that could gate is not a sense.
+ */
+export {};
+//# sourceMappingURL=doctor-seat-identity.test.d.ts.map

package/dist/commands/doctor-seat-identity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-seat-identity.test.d.ts","sourceRoot":"","sources":["../../src/commands/doctor-seat-identity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}